?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
pci: Remove unused pci_reserve_capability
[qemu/ar7.git] / hw / lsi53c895a.c
blobdbb3bdf2ceb07b071bb0f053af9518a64cbde073
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18
19 //#define DEBUG_LSI
20 //#define DEBUG_LSI_REG
21
22 #ifdef DEBUG_LSI
23 #define DPRINTF(fmt, ...) \
24 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
25 #define BADF(fmt, ...) \
26 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
27 #else
28 #define DPRINTF(fmt, ...) do {} while(0)
29 #define BADF(fmt, ...) \
30 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
31 #endif
32
33 #define LSI_MAX_DEVS 7
34
35 #define LSI_SCNTL0_TRG 0x01
36 #define LSI_SCNTL0_AAP 0x02
37 #define LSI_SCNTL0_EPC 0x08
38 #define LSI_SCNTL0_WATN 0x10
39 #define LSI_SCNTL0_START 0x20
40
41 #define LSI_SCNTL1_SST 0x01
42 #define LSI_SCNTL1_IARB 0x02
43 #define LSI_SCNTL1_AESP 0x04
44 #define LSI_SCNTL1_RST 0x08
45 #define LSI_SCNTL1_CON 0x10
46 #define LSI_SCNTL1_DHP 0x20
47 #define LSI_SCNTL1_ADB 0x40
48 #define LSI_SCNTL1_EXC 0x80
49
50 #define LSI_SCNTL2_WSR 0x01
51 #define LSI_SCNTL2_VUE0 0x02
52 #define LSI_SCNTL2_VUE1 0x04
53 #define LSI_SCNTL2_WSS 0x08
54 #define LSI_SCNTL2_SLPHBEN 0x10
55 #define LSI_SCNTL2_SLPMD 0x20
56 #define LSI_SCNTL2_CHM 0x40
57 #define LSI_SCNTL2_SDU 0x80
58
59 #define LSI_ISTAT0_DIP 0x01
60 #define LSI_ISTAT0_SIP 0x02
61 #define LSI_ISTAT0_INTF 0x04
62 #define LSI_ISTAT0_CON 0x08
63 #define LSI_ISTAT0_SEM 0x10
64 #define LSI_ISTAT0_SIGP 0x20
65 #define LSI_ISTAT0_SRST 0x40
66 #define LSI_ISTAT0_ABRT 0x80
67
68 #define LSI_ISTAT1_SI 0x01
69 #define LSI_ISTAT1_SRUN 0x02
70 #define LSI_ISTAT1_FLSH 0x04
71
72 #define LSI_SSTAT0_SDP0 0x01
73 #define LSI_SSTAT0_RST 0x02
74 #define LSI_SSTAT0_WOA 0x04
75 #define LSI_SSTAT0_LOA 0x08
76 #define LSI_SSTAT0_AIP 0x10
77 #define LSI_SSTAT0_OLF 0x20
78 #define LSI_SSTAT0_ORF 0x40
79 #define LSI_SSTAT0_ILF 0x80
80
81 #define LSI_SIST0_PAR 0x01
82 #define LSI_SIST0_RST 0x02
83 #define LSI_SIST0_UDC 0x04
84 #define LSI_SIST0_SGE 0x08
85 #define LSI_SIST0_RSL 0x10
86 #define LSI_SIST0_SEL 0x20
87 #define LSI_SIST0_CMP 0x40
88 #define LSI_SIST0_MA 0x80
89
90 #define LSI_SIST1_HTH 0x01
91 #define LSI_SIST1_GEN 0x02
92 #define LSI_SIST1_STO 0x04
93 #define LSI_SIST1_SBMC 0x10
94
95 #define LSI_SOCL_IO 0x01
96 #define LSI_SOCL_CD 0x02
97 #define LSI_SOCL_MSG 0x04
98 #define LSI_SOCL_ATN 0x08
99 #define LSI_SOCL_SEL 0x10
100 #define LSI_SOCL_BSY 0x20
101 #define LSI_SOCL_ACK 0x40
102 #define LSI_SOCL_REQ 0x80
103
104 #define LSI_DSTAT_IID 0x01
105 #define LSI_DSTAT_SIR 0x04
106 #define LSI_DSTAT_SSI 0x08
107 #define LSI_DSTAT_ABRT 0x10
108 #define LSI_DSTAT_BF 0x20
109 #define LSI_DSTAT_MDPE 0x40
110 #define LSI_DSTAT_DFE 0x80
111
112 #define LSI_DCNTL_COM 0x01
113 #define LSI_DCNTL_IRQD 0x02
114 #define LSI_DCNTL_STD 0x04
115 #define LSI_DCNTL_IRQM 0x08
116 #define LSI_DCNTL_SSM 0x10
117 #define LSI_DCNTL_PFEN 0x20
118 #define LSI_DCNTL_PFF 0x40
119 #define LSI_DCNTL_CLSE 0x80
120
121 #define LSI_DMODE_MAN 0x01
122 #define LSI_DMODE_BOF 0x02
123 #define LSI_DMODE_ERMP 0x04
124 #define LSI_DMODE_ERL 0x08
125 #define LSI_DMODE_DIOM 0x10
126 #define LSI_DMODE_SIOM 0x20
127
128 #define LSI_CTEST2_DACK 0x01
129 #define LSI_CTEST2_DREQ 0x02
130 #define LSI_CTEST2_TEOP 0x04
131 #define LSI_CTEST2_PCICIE 0x08
132 #define LSI_CTEST2_CM 0x10
133 #define LSI_CTEST2_CIO 0x20
134 #define LSI_CTEST2_SIGP 0x40
135 #define LSI_CTEST2_DDIR 0x80
136
137 #define LSI_CTEST5_BL2 0x04
138 #define LSI_CTEST5_DDIR 0x08
139 #define LSI_CTEST5_MASR 0x10
140 #define LSI_CTEST5_DFSN 0x20
141 #define LSI_CTEST5_BBCK 0x40
142 #define LSI_CTEST5_ADCK 0x80
143
144 #define LSI_CCNTL0_DILS 0x01
145 #define LSI_CCNTL0_DISFC 0x10
146 #define LSI_CCNTL0_ENNDJ 0x20
147 #define LSI_CCNTL0_PMJCTL 0x40
148 #define LSI_CCNTL0_ENPMJ 0x80
149
150 #define LSI_CCNTL1_EN64DBMV 0x01
151 #define LSI_CCNTL1_EN64TIBMV 0x02
152 #define LSI_CCNTL1_64TIMOD 0x04
153 #define LSI_CCNTL1_DDAC 0x08
154 #define LSI_CCNTL1_ZMOD 0x80
155
156 /* Enable Response to Reselection */
157 #define LSI_SCID_RRE 0x60
158
159 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
160
161 #define PHASE_DO 0
162 #define PHASE_DI 1
163 #define PHASE_CMD 2
164 #define PHASE_ST 3
165 #define PHASE_MO 6
166 #define PHASE_MI 7
167 #define PHASE_MASK 7
168
169 /* Maximum length of MSG IN data. */
170 #define LSI_MAX_MSGIN_LEN 8
171
172 /* Flag set if this is a tagged command. */
173 #define LSI_TAG_VALID (1 << 16)
174
175 typedef struct lsi_request {
176 SCSIRequest *req;
177 uint32_t tag;
178 uint32_t dma_len;
179 uint8_t *dma_buf;
180 uint32_t pending;
181 int out;
182 QTAILQ_ENTRY(lsi_request) next;
183 } lsi_request;
184
185 typedef struct {
186 PCIDevice dev;
187 MemoryRegion mmio_io;
188 MemoryRegion ram_io;
189 MemoryRegion io_io;
190
191 int carry; /* ??? Should this be an a visible register somewhere? */
192 int status;
193 /* Action to take at the end of a MSG IN phase.
194 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
195 int msg_action;
196 int msg_len;
197 uint8_t msg[LSI_MAX_MSGIN_LEN];
198 /* 0 if SCRIPTS are running or stopped.
199 * 1 if a Wait Reselect instruction has been issued.
200 * 2 if processing DMA from lsi_execute_script.
201 * 3 if a DMA operation is in progress. */
202 int waiting;
203 SCSIBus bus;
204 int current_lun;
205 /* The tag is a combination of the device ID and the SCSI tag. */
206 uint32_t select_tag;
207 int command_complete;
208 QTAILQ_HEAD(, lsi_request) queue;
209 lsi_request *current;
210
211 uint32_t dsa;
212 uint32_t temp;
213 uint32_t dnad;
214 uint32_t dbc;
215 uint8_t istat0;
216 uint8_t istat1;
217 uint8_t dcmd;
218 uint8_t dstat;
219 uint8_t dien;
220 uint8_t sist0;
221 uint8_t sist1;
222 uint8_t sien0;
223 uint8_t sien1;
224 uint8_t mbox0;
225 uint8_t mbox1;
226 uint8_t dfifo;
227 uint8_t ctest2;
228 uint8_t ctest3;
229 uint8_t ctest4;
230 uint8_t ctest5;
231 uint8_t ccntl0;
232 uint8_t ccntl1;
233 uint32_t dsp;
234 uint32_t dsps;
235 uint8_t dmode;
236 uint8_t dcntl;
237 uint8_t scntl0;
238 uint8_t scntl1;
239 uint8_t scntl2;
240 uint8_t scntl3;
241 uint8_t sstat0;
242 uint8_t sstat1;
243 uint8_t scid;
244 uint8_t sxfer;
245 uint8_t socl;
246 uint8_t sdid;
247 uint8_t ssid;
248 uint8_t sfbr;
249 uint8_t stest1;
250 uint8_t stest2;
251 uint8_t stest3;
252 uint8_t sidl;
253 uint8_t stime0;
254 uint8_t respid0;
255 uint8_t respid1;
256 uint32_t mmrs;
257 uint32_t mmws;
258 uint32_t sfs;
259 uint32_t drs;
260 uint32_t sbms;
261 uint32_t dbms;
262 uint32_t dnad64;
263 uint32_t pmjad1;
264 uint32_t pmjad2;
265 uint32_t rbc;
266 uint32_t ua;
267 uint32_t ia;
268 uint32_t sbc;
269 uint32_t csbc;
270 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
271 uint8_t sbr;
272
273 /* Script ram is stored as 32-bit words in host byteorder. */
274 uint32_t script_ram[2048];
275 } LSIState;
276
277 static inline int lsi_irq_on_rsl(LSIState *s)
278 {
279 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
280 }
281
282 static void lsi_soft_reset(LSIState *s)
283 {
284 lsi_request *p;
285
286 DPRINTF("Reset\n");
287 s->carry = 0;
288
289 s->msg_action = 0;
290 s->msg_len = 0;
291 s->waiting = 0;
292 s->dsa = 0;
293 s->dnad = 0;
294 s->dbc = 0;
295 s->temp = 0;
296 memset(s->scratch, 0, sizeof(s->scratch));
297 s->istat0 = 0;
298 s->istat1 = 0;
299 s->dcmd = 0x40;
300 s->dstat = LSI_DSTAT_DFE;
301 s->dien = 0;
302 s->sist0 = 0;
303 s->sist1 = 0;
304 s->sien0 = 0;
305 s->sien1 = 0;
306 s->mbox0 = 0;
307 s->mbox1 = 0;
308 s->dfifo = 0;
309 s->ctest2 = LSI_CTEST2_DACK;
310 s->ctest3 = 0;
311 s->ctest4 = 0;
312 s->ctest5 = 0;
313 s->ccntl0 = 0;
314 s->ccntl1 = 0;
315 s->dsp = 0;
316 s->dsps = 0;
317 s->dmode = 0;
318 s->dcntl = 0;
319 s->scntl0 = 0xc0;
320 s->scntl1 = 0;
321 s->scntl2 = 0;
322 s->scntl3 = 0;
323 s->sstat0 = 0;
324 s->sstat1 = 0;
325 s->scid = 7;
326 s->sxfer = 0;
327 s->socl = 0;
328 s->sdid = 0;
329 s->ssid = 0;
330 s->stest1 = 0;
331 s->stest2 = 0;
332 s->stest3 = 0;
333 s->sidl = 0;
334 s->stime0 = 0;
335 s->respid0 = 0x80;
336 s->respid1 = 0;
337 s->mmrs = 0;
338 s->mmws = 0;
339 s->sfs = 0;
340 s->drs = 0;
341 s->sbms = 0;
342 s->dbms = 0;
343 s->dnad64 = 0;
344 s->pmjad1 = 0;
345 s->pmjad2 = 0;
346 s->rbc = 0;
347 s->ua = 0;
348 s->ia = 0;
349 s->sbc = 0;
350 s->csbc = 0;
351 s->sbr = 0;
352 while (!QTAILQ_EMPTY(&s->queue)) {
353 p = QTAILQ_FIRST(&s->queue);
354 QTAILQ_REMOVE(&s->queue, p, next);
355 g_free(p);
356 }
357 if (s->current) {
358 g_free(s->current);
359 s->current = NULL;
360 }
361 }
362
363 static int lsi_dma_40bit(LSIState *s)
364 {
365 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
366 return 1;
367 return 0;
368 }
369
370 static int lsi_dma_ti64bit(LSIState *s)
371 {
372 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
373 return 1;
374 return 0;
375 }
376
377 static int lsi_dma_64bit(LSIState *s)
378 {
379 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
380 return 1;
381 return 0;
382 }
383
384 static uint8_t lsi_reg_readb(LSIState *s, int offset);
385 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
386 static void lsi_execute_script(LSIState *s);
387 static void lsi_reselect(LSIState *s, lsi_request *p);
388
389 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
390 {
391 uint32_t buf;
392
393 /* XXX: an optimization here used to fast-path the read from scripts
394 * memory. But that bypasses any iommu.
395 */
396 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
397 return cpu_to_le32(buf);
398 }
399
400 static void lsi_stop_script(LSIState *s)
401 {
402 s->istat1 &= ~LSI_ISTAT1_SRUN;
403 }
404
405 static void lsi_update_irq(LSIState *s)
406 {
407 int level;
408 static int last_level;
409 lsi_request *p;
410
411 /* It's unclear whether the DIP/SIP bits should be cleared when the
412 Interrupt Status Registers are cleared or when istat0 is read.
413 We currently do the formwer, which seems to work. */
414 level = 0;
415 if (s->dstat) {
416 if (s->dstat & s->dien)
417 level = 1;
418 s->istat0 |= LSI_ISTAT0_DIP;
419 } else {
420 s->istat0 &= ~LSI_ISTAT0_DIP;
421 }
422
423 if (s->sist0 || s->sist1) {
424 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
425 level = 1;
426 s->istat0 |= LSI_ISTAT0_SIP;
427 } else {
428 s->istat0 &= ~LSI_ISTAT0_SIP;
429 }
430 if (s->istat0 & LSI_ISTAT0_INTF)
431 level = 1;
432
433 if (level != last_level) {
434 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
435 level, s->dstat, s->sist1, s->sist0);
436 last_level = level;
437 }
438 qemu_set_irq(s->dev.irq[0], level);
439
440 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
441 DPRINTF("Handled IRQs & disconnected, looking for pending "
442 "processes\n");
443 QTAILQ_FOREACH(p, &s->queue, next) {
444 if (p->pending) {
445 lsi_reselect(s, p);
446 break;
447 }
448 }
449 }
450 }
451
452 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
453 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
454 {
455 uint32_t mask0;
456 uint32_t mask1;
457
458 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
459 stat1, stat0, s->sist1, s->sist0);
460 s->sist0 |= stat0;
461 s->sist1 |= stat1;
462 /* Stop processor on fatal or unmasked interrupt. As a special hack
463 we don't stop processing when raising STO. Instead continue
464 execution and stop at the next insn that accesses the SCSI bus. */
465 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
466 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
467 mask1 &= ~LSI_SIST1_STO;
468 if (s->sist0 & mask0 || s->sist1 & mask1) {
469 lsi_stop_script(s);
470 }
471 lsi_update_irq(s);
472 }
473
474 /* Stop SCRIPTS execution and raise a DMA interrupt. */
475 static void lsi_script_dma_interrupt(LSIState *s, int stat)
476 {
477 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
478 s->dstat |= stat;
479 lsi_update_irq(s);
480 lsi_stop_script(s);
481 }
482
483 static inline void lsi_set_phase(LSIState *s, int phase)
484 {
485 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
486 }
487
488 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
489 {
490 /* Trigger a phase mismatch. */
491 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
492 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
493 s->dsp = out ? s->pmjad1 : s->pmjad2;
494 } else {
495 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
496 }
497 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
498 } else {
499 DPRINTF("Phase mismatch interrupt\n");
500 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
501 lsi_stop_script(s);
502 }
503 lsi_set_phase(s, new_phase);
504 }
505
506
507 /* Resume SCRIPTS execution after a DMA operation. */
508 static void lsi_resume_script(LSIState *s)
509 {
510 if (s->waiting != 2) {
511 s->waiting = 0;
512 lsi_execute_script(s);
513 } else {
514 s->waiting = 0;
515 }
516 }
517
518 static void lsi_disconnect(LSIState *s)
519 {
520 s->scntl1 &= ~LSI_SCNTL1_CON;
521 s->sstat1 &= ~PHASE_MASK;
522 }
523
524 static void lsi_bad_selection(LSIState *s, uint32_t id)
525 {
526 DPRINTF("Selected absent target %d\n", id);
527 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
528 lsi_disconnect(s);
529 }
530
531 /* Initiate a SCSI layer data transfer. */
532 static void lsi_do_dma(LSIState *s, int out)
533 {
534 uint32_t count, id;
535 target_phys_addr_t addr;
536 SCSIDevice *dev;
537
538 assert(s->current);
539 if (!s->current->dma_len) {
540 /* Wait until data is available. */
541 DPRINTF("DMA no data available\n");
542 return;
543 }
544
545 id = (s->current->tag >> 8) & 0xf;
546 dev = s->bus.devs[id];
547 if (!dev) {
548 lsi_bad_selection(s, id);
549 return;
550 }
551
552 count = s->dbc;
553 if (count > s->current->dma_len)
554 count = s->current->dma_len;
555
556 addr = s->dnad;
557 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
558 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
559 addr |= ((uint64_t)s->dnad64 << 32);
560 else if (s->dbms)
561 addr |= ((uint64_t)s->dbms << 32);
562 else if (s->sbms)
563 addr |= ((uint64_t)s->sbms << 32);
564
565 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
566 s->csbc += count;
567 s->dnad += count;
568 s->dbc -= count;
569 if (s->current->dma_buf == NULL) {
570 s->current->dma_buf = scsi_req_get_buf(s->current->req);
571 }
572 /* ??? Set SFBR to first data byte. */
573 if (out) {
574 cpu_physical_memory_read(addr, s->current->dma_buf, count);
575 } else {
576 cpu_physical_memory_write(addr, s->current->dma_buf, count);
577 }
578 s->current->dma_len -= count;
579 if (s->current->dma_len == 0) {
580 s->current->dma_buf = NULL;
581 scsi_req_continue(s->current->req);
582 } else {
583 s->current->dma_buf += count;
584 lsi_resume_script(s);
585 }
586 }
587
588
589 /* Add a command to the queue. */
590 static void lsi_queue_command(LSIState *s)
591 {
592 lsi_request *p = s->current;
593
594 DPRINTF("Queueing tag=0x%x\n", p->tag);
595 assert(s->current != NULL);
596 assert(s->current->dma_len == 0);
597 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
598 s->current = NULL;
599
600 p->pending = 0;
601 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
602 }
603
604 /* Queue a byte for a MSG IN phase. */
605 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
606 {
607 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
608 BADF("MSG IN data too long\n");
609 } else {
610 DPRINTF("MSG IN 0x%02x\n", data);
611 s->msg[s->msg_len++] = data;
612 }
613 }
614
615 /* Perform reselection to continue a command. */
616 static void lsi_reselect(LSIState *s, lsi_request *p)
617 {
618 int id;
619
620 assert(s->current == NULL);
621 QTAILQ_REMOVE(&s->queue, p, next);
622 s->current = p;
623
624 id = (p->tag >> 8) & 0xf;
625 s->ssid = id | 0x80;
626 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
627 if (!(s->dcntl & LSI_DCNTL_COM)) {
628 s->sfbr = 1 << (id & 0x7);
629 }
630 DPRINTF("Reselected target %d\n", id);
631 s->scntl1 |= LSI_SCNTL1_CON;
632 lsi_set_phase(s, PHASE_MI);
633 s->msg_action = p->out ? 2 : 3;
634 s->current->dma_len = p->pending;
635 lsi_add_msg_byte(s, 0x80);
636 if (s->current->tag & LSI_TAG_VALID) {
637 lsi_add_msg_byte(s, 0x20);
638 lsi_add_msg_byte(s, p->tag & 0xff);
639 }
640
641 if (lsi_irq_on_rsl(s)) {
642 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
643 }
644 }
645
646 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
647 {
648 lsi_request *p;
649
650 QTAILQ_FOREACH(p, &s->queue, next) {
651 if (p->tag == tag) {
652 return p;
653 }
654 }
655
656 return NULL;
657 }
658
659 static void lsi_request_cancelled(SCSIRequest *req)
660 {
661 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
662 lsi_request *p = req->hba_private;
663
664 if (s->current && req == s->current->req) {
665 scsi_req_unref(req);
666 g_free(s->current);
667 s->current = NULL;
668 return;
669 }
670
671 if (p) {
672 QTAILQ_REMOVE(&s->queue, p, next);
673 scsi_req_unref(req);
674 g_free(p);
675 }
676 }
677
678 /* Record that data is available for a queued command. Returns zero if
679 the device was reselected, nonzero if the IO is deferred. */
680 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
681 {
682 lsi_request *p = req->hba_private;
683
684 if (p->pending) {
685 BADF("Multiple IO pending for request %p\n", p);
686 }
687 p->pending = len;
688 /* Reselect if waiting for it, or if reselection triggers an IRQ
689 and the bus is free.
690 Since no interrupt stacking is implemented in the emulation, it
691 is also required that there are no pending interrupts waiting
692 for service from the device driver. */
693 if (s->waiting == 1 ||
694 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
695 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
696 /* Reselect device. */
697 lsi_reselect(s, p);
698 return 0;
699 } else {
700 DPRINTF("Queueing IO tag=0x%x\n", tag);
701 p->pending = len;
702 return 1;
703 }
704 }
705
706 /* Callback to indicate that the SCSI layer has completed a command. */
707 static void lsi_command_complete(SCSIRequest *req, uint32_t status)
708 {
709 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
710 int out;
711
712 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
713 DPRINTF("Command complete status=%d\n", (int)status);
714 s->status = status;
715 s->command_complete = 2;
716 if (s->waiting && s->dbc != 0) {
717 /* Raise phase mismatch for short transfers. */
718 lsi_bad_phase(s, out, PHASE_ST);
719 } else {
720 lsi_set_phase(s, PHASE_ST);
721 }
722
723 if (s->current && req == s->current->req) {
724 scsi_req_unref(s->current->req);
725 g_free(s->current);
726 s->current = NULL;
727 }
728 lsi_resume_script(s);
729 }
730
731 /* Callback to indicate that the SCSI layer has completed a transfer. */
732 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
733 {
734 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
735 int out;
736
737 if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
738 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
739 if (lsi_queue_req(s, req, len)) {
740 return;
741 }
742 }
743
744 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
745
746 /* host adapter (re)connected */
747 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
748 s->current->dma_len = len;
749 s->command_complete = 1;
750 if (s->waiting) {
751 if (s->waiting == 1 || s->dbc == 0) {
752 lsi_resume_script(s);
753 } else {
754 lsi_do_dma(s, out);
755 }
756 }
757 }
758
759 static void lsi_do_command(LSIState *s)
760 {
761 SCSIDevice *dev;
762 uint8_t buf[16];
763 uint32_t id;
764 int n;
765
766 DPRINTF("Send command len=%d\n", s->dbc);
767 if (s->dbc > 16)
768 s->dbc = 16;
769 cpu_physical_memory_read(s->dnad, buf, s->dbc);
770 s->sfbr = buf[0];
771 s->command_complete = 0;
772
773 id = (s->select_tag >> 8) & 0xf;
774 dev = s->bus.devs[id];
775 if (!dev) {
776 lsi_bad_selection(s, id);
777 return;
778 }
779
780 assert(s->current == NULL);
781 s->current = g_malloc0(sizeof(lsi_request));
782 s->current->tag = s->select_tag;
783 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
784 s->current);
785
786 n = scsi_req_enqueue(s->current->req);
787 if (n) {
788 if (n > 0) {
789 lsi_set_phase(s, PHASE_DI);
790 } else if (n < 0) {
791 lsi_set_phase(s, PHASE_DO);
792 }
793 scsi_req_continue(s->current->req);
794 }
795 if (!s->command_complete) {
796 if (n) {
797 /* Command did not complete immediately so disconnect. */
798 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
799 lsi_add_msg_byte(s, 4); /* DISCONNECT */
800 /* wait data */
801 lsi_set_phase(s, PHASE_MI);
802 s->msg_action = 1;
803 lsi_queue_command(s);
804 } else {
805 /* wait command complete */
806 lsi_set_phase(s, PHASE_DI);
807 }
808 }
809 }
810
811 static void lsi_do_status(LSIState *s)
812 {
813 uint8_t status;
814 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
815 if (s->dbc != 1)
816 BADF("Bad Status move\n");
817 s->dbc = 1;
818 status = s->status;
819 s->sfbr = status;
820 cpu_physical_memory_write(s->dnad, &status, 1);
821 lsi_set_phase(s, PHASE_MI);
822 s->msg_action = 1;
823 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
824 }
825
826 static void lsi_do_msgin(LSIState *s)
827 {
828 int len;
829 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
830 s->sfbr = s->msg[0];
831 len = s->msg_len;
832 if (len > s->dbc)
833 len = s->dbc;
834 cpu_physical_memory_write(s->dnad, s->msg, len);
835 /* Linux drivers rely on the last byte being in the SIDL. */
836 s->sidl = s->msg[len - 1];
837 s->msg_len -= len;
838 if (s->msg_len) {
839 memmove(s->msg, s->msg + len, s->msg_len);
840 } else {
841 /* ??? Check if ATN (not yet implemented) is asserted and maybe
842 switch to PHASE_MO. */
843 switch (s->msg_action) {
844 case 0:
845 lsi_set_phase(s, PHASE_CMD);
846 break;
847 case 1:
848 lsi_disconnect(s);
849 break;
850 case 2:
851 lsi_set_phase(s, PHASE_DO);
852 break;
853 case 3:
854 lsi_set_phase(s, PHASE_DI);
855 break;
856 default:
857 abort();
858 }
859 }
860 }
861
862 /* Read the next byte during a MSGOUT phase. */
863 static uint8_t lsi_get_msgbyte(LSIState *s)
864 {
865 uint8_t data;
866 cpu_physical_memory_read(s->dnad, &data, 1);
867 s->dnad++;
868 s->dbc--;
869 return data;
870 }
871
872 /* Skip the next n bytes during a MSGOUT phase. */
873 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
874 {
875 s->dnad += n;
876 s->dbc -= n;
877 }
878
879 static void lsi_do_msgout(LSIState *s)
880 {
881 uint8_t msg;
882 int len;
883 uint32_t current_tag;
884 lsi_request *current_req, *p, *p_next;
885
886 if (s->current) {
887 current_tag = s->current->tag;
888 current_req = s->current;
889 } else {
890 current_tag = s->select_tag;
891 current_req = lsi_find_by_tag(s, current_tag);
892 }
893
894 DPRINTF("MSG out len=%d\n", s->dbc);
895 while (s->dbc) {
896 msg = lsi_get_msgbyte(s);
897 s->sfbr = msg;
898
899 switch (msg) {
900 case 0x04:
901 DPRINTF("MSG: Disconnect\n");
902 lsi_disconnect(s);
903 break;
904 case 0x08:
905 DPRINTF("MSG: No Operation\n");
906 lsi_set_phase(s, PHASE_CMD);
907 break;
908 case 0x01:
909 len = lsi_get_msgbyte(s);
910 msg = lsi_get_msgbyte(s);
911 (void)len; /* avoid a warning about unused variable*/
912 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
913 switch (msg) {
914 case 1:
915 DPRINTF("SDTR (ignored)\n");
916 lsi_skip_msgbytes(s, 2);
917 break;
918 case 3:
919 DPRINTF("WDTR (ignored)\n");
920 lsi_skip_msgbytes(s, 1);
921 break;
922 default:
923 goto bad;
924 }
925 break;
926 case 0x20: /* SIMPLE queue */
927 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
928 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
929 break;
930 case 0x21: /* HEAD of queue */
931 BADF("HEAD queue not implemented\n");
932 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
933 break;
934 case 0x22: /* ORDERED queue */
935 BADF("ORDERED queue not implemented\n");
936 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
937 break;
938 case 0x0d:
939 /* The ABORT TAG message clears the current I/O process only. */
940 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
941 if (current_req) {
942 scsi_req_cancel(current_req->req);
943 }
944 lsi_disconnect(s);
945 break;
946 case 0x06:
947 case 0x0e:
948 case 0x0c:
949 /* The ABORT message clears all I/O processes for the selecting
950 initiator on the specified logical unit of the target. */
951 if (msg == 0x06) {
952 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
953 }
954 /* The CLEAR QUEUE message clears all I/O processes for all
955 initiators on the specified logical unit of the target. */
956 if (msg == 0x0e) {
957 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
958 }
959 /* The BUS DEVICE RESET message clears all I/O processes for all
960 initiators on all logical units of the target. */
961 if (msg == 0x0c) {
962 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
963 }
964
965 /* clear the current I/O process */
966 if (s->current) {
967 scsi_req_cancel(s->current->req);
968 }
969
970 /* As the current implemented devices scsi_disk and scsi_generic
971 only support one LUN, we don't need to keep track of LUNs.
972 Clearing I/O processes for other initiators could be possible
973 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
974 device, but this is currently not implemented (and seems not
975 to be really necessary). So let's simply clear all queued
976 commands for the current device: */
977 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
978 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
979 scsi_req_cancel(p->req);
980 }
981 }
982
983 lsi_disconnect(s);
984 break;
985 default:
986 if ((msg & 0x80) == 0) {
987 goto bad;
988 }
989 s->current_lun = msg & 7;
990 DPRINTF("Select LUN %d\n", s->current_lun);
991 lsi_set_phase(s, PHASE_CMD);
992 break;
993 }
994 }
995 return;
996 bad:
997 BADF("Unimplemented message 0x%02x\n", msg);
998 lsi_set_phase(s, PHASE_MI);
999 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1000 s->msg_action = 0;
1001 }
1002
1003 /* Sign extend a 24-bit value. */
1004 static inline int32_t sxt24(int32_t n)
1005 {
1006 return (n << 8) >> 8;
1007 }
1008
1009 #define LSI_BUF_SIZE 4096
1010 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1011 {
1012 int n;
1013 uint8_t buf[LSI_BUF_SIZE];
1014
1015 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1016 while (count) {
1017 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1018 cpu_physical_memory_read(src, buf, n);
1019 cpu_physical_memory_write(dest, buf, n);
1020 src += n;
1021 dest += n;
1022 count -= n;
1023 }
1024 }
1025
1026 static void lsi_wait_reselect(LSIState *s)
1027 {
1028 lsi_request *p;
1029
1030 DPRINTF("Wait Reselect\n");
1031
1032 QTAILQ_FOREACH(p, &s->queue, next) {
1033 if (p->pending) {
1034 lsi_reselect(s, p);
1035 break;
1036 }
1037 }
1038 if (s->current == NULL) {
1039 s->waiting = 1;
1040 }
1041 }
1042
1043 static void lsi_execute_script(LSIState *s)
1044 {
1045 uint32_t insn;
1046 uint32_t addr, addr_high;
1047 int opcode;
1048 int insn_processed = 0;
1049
1050 s->istat1 |= LSI_ISTAT1_SRUN;
1051 again:
1052 insn_processed++;
1053 insn = read_dword(s, s->dsp);
1054 if (!insn) {
1055 /* If we receive an empty opcode increment the DSP by 4 bytes
1056 instead of 8 and execute the next opcode at that location */
1057 s->dsp += 4;
1058 goto again;
1059 }
1060 addr = read_dword(s, s->dsp + 4);
1061 addr_high = 0;
1062 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1063 s->dsps = addr;
1064 s->dcmd = insn >> 24;
1065 s->dsp += 8;
1066 switch (insn >> 30) {
1067 case 0: /* Block move. */
1068 if (s->sist1 & LSI_SIST1_STO) {
1069 DPRINTF("Delayed select timeout\n");
1070 lsi_stop_script(s);
1071 break;
1072 }
1073 s->dbc = insn & 0xffffff;
1074 s->rbc = s->dbc;
1075 /* ??? Set ESA. */
1076 s->ia = s->dsp - 8;
1077 if (insn & (1 << 29)) {
1078 /* Indirect addressing. */
1079 addr = read_dword(s, addr);
1080 } else if (insn & (1 << 28)) {
1081 uint32_t buf[2];
1082 int32_t offset;
1083 /* Table indirect addressing. */
1084
1085 /* 32-bit Table indirect */
1086 offset = sxt24(addr);
1087 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
1088 /* byte count is stored in bits 0:23 only */
1089 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1090 s->rbc = s->dbc;
1091 addr = cpu_to_le32(buf[1]);
1092
1093 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1094 * table, bits [31:24] */
1095 if (lsi_dma_40bit(s))
1096 addr_high = cpu_to_le32(buf[0]) >> 24;
1097 else if (lsi_dma_ti64bit(s)) {
1098 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1099 switch (selector) {
1100 case 0 ... 0x0f:
1101 /* offset index into scratch registers since
1102 * TI64 mode can use registers C to R */
1103 addr_high = s->scratch[2 + selector];
1104 break;
1105 case 0x10:
1106 addr_high = s->mmrs;
1107 break;
1108 case 0x11:
1109 addr_high = s->mmws;
1110 break;
1111 case 0x12:
1112 addr_high = s->sfs;
1113 break;
1114 case 0x13:
1115 addr_high = s->drs;
1116 break;
1117 case 0x14:
1118 addr_high = s->sbms;
1119 break;
1120 case 0x15:
1121 addr_high = s->dbms;
1122 break;
1123 default:
1124 BADF("Illegal selector specified (0x%x > 0x15)"
1125 " for 64-bit DMA block move", selector);
1126 break;
1127 }
1128 }
1129 } else if (lsi_dma_64bit(s)) {
1130 /* fetch a 3rd dword if 64-bit direct move is enabled and
1131 only if we're not doing table indirect or indirect addressing */
1132 s->dbms = read_dword(s, s->dsp);
1133 s->dsp += 4;
1134 s->ia = s->dsp - 12;
1135 }
1136 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1137 DPRINTF("Wrong phase got %d expected %d\n",
1138 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1139 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1140 break;
1141 }
1142 s->dnad = addr;
1143 s->dnad64 = addr_high;
1144 switch (s->sstat1 & 0x7) {
1145 case PHASE_DO:
1146 s->waiting = 2;
1147 lsi_do_dma(s, 1);
1148 if (s->waiting)
1149 s->waiting = 3;
1150 break;
1151 case PHASE_DI:
1152 s->waiting = 2;
1153 lsi_do_dma(s, 0);
1154 if (s->waiting)
1155 s->waiting = 3;
1156 break;
1157 case PHASE_CMD:
1158 lsi_do_command(s);
1159 break;
1160 case PHASE_ST:
1161 lsi_do_status(s);
1162 break;
1163 case PHASE_MO:
1164 lsi_do_msgout(s);
1165 break;
1166 case PHASE_MI:
1167 lsi_do_msgin(s);
1168 break;
1169 default:
1170 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1171 exit(1);
1172 }
1173 s->dfifo = s->dbc & 0xff;
1174 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1175 s->sbc = s->dbc;
1176 s->rbc -= s->dbc;
1177 s->ua = addr + s->dbc;
1178 break;
1179
1180 case 1: /* IO or Read/Write instruction. */
1181 opcode = (insn >> 27) & 7;
1182 if (opcode < 5) {
1183 uint32_t id;
1184
1185 if (insn & (1 << 25)) {
1186 id = read_dword(s, s->dsa + sxt24(insn));
1187 } else {
1188 id = insn;
1189 }
1190 id = (id >> 16) & 0xf;
1191 if (insn & (1 << 26)) {
1192 addr = s->dsp + sxt24(addr);
1193 }
1194 s->dnad = addr;
1195 switch (opcode) {
1196 case 0: /* Select */
1197 s->sdid = id;
1198 if (s->scntl1 & LSI_SCNTL1_CON) {
1199 DPRINTF("Already reselected, jumping to alternative address\n");
1200 s->dsp = s->dnad;
1201 break;
1202 }
1203 s->sstat0 |= LSI_SSTAT0_WOA;
1204 s->scntl1 &= ~LSI_SCNTL1_IARB;
1205 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1206 lsi_bad_selection(s, id);
1207 break;
1208 }
1209 DPRINTF("Selected target %d%s\n",
1210 id, insn & (1 << 3) ? " ATN" : "");
1211 /* ??? Linux drivers compain when this is set. Maybe
1212 it only applies in low-level mode (unimplemented).
1213 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1214 s->select_tag = id << 8;
1215 s->scntl1 |= LSI_SCNTL1_CON;
1216 if (insn & (1 << 3)) {
1217 s->socl |= LSI_SOCL_ATN;
1218 }
1219 lsi_set_phase(s, PHASE_MO);
1220 break;
1221 case 1: /* Disconnect */
1222 DPRINTF("Wait Disconnect\n");
1223 s->scntl1 &= ~LSI_SCNTL1_CON;
1224 break;
1225 case 2: /* Wait Reselect */
1226 if (!lsi_irq_on_rsl(s)) {
1227 lsi_wait_reselect(s);
1228 }
1229 break;
1230 case 3: /* Set */
1231 DPRINTF("Set%s%s%s%s\n",
1232 insn & (1 << 3) ? " ATN" : "",
1233 insn & (1 << 6) ? " ACK" : "",
1234 insn & (1 << 9) ? " TM" : "",
1235 insn & (1 << 10) ? " CC" : "");
1236 if (insn & (1 << 3)) {
1237 s->socl |= LSI_SOCL_ATN;
1238 lsi_set_phase(s, PHASE_MO);
1239 }
1240 if (insn & (1 << 9)) {
1241 BADF("Target mode not implemented\n");
1242 exit(1);
1243 }
1244 if (insn & (1 << 10))
1245 s->carry = 1;
1246 break;
1247 case 4: /* Clear */
1248 DPRINTF("Clear%s%s%s%s\n",
1249 insn & (1 << 3) ? " ATN" : "",
1250 insn & (1 << 6) ? " ACK" : "",
1251 insn & (1 << 9) ? " TM" : "",
1252 insn & (1 << 10) ? " CC" : "");
1253 if (insn & (1 << 3)) {
1254 s->socl &= ~LSI_SOCL_ATN;
1255 }
1256 if (insn & (1 << 10))
1257 s->carry = 0;
1258 break;
1259 }
1260 } else {
1261 uint8_t op0;
1262 uint8_t op1;
1263 uint8_t data8;
1264 int reg;
1265 int operator;
1266 #ifdef DEBUG_LSI
1267 static const char *opcode_names[3] =
1268 {"Write", "Read", "Read-Modify-Write"};
1269 static const char *operator_names[8] =
1270 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1271 #endif
1272
1273 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1274 data8 = (insn >> 8) & 0xff;
1275 opcode = (insn >> 27) & 7;
1276 operator = (insn >> 24) & 7;
1277 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1278 opcode_names[opcode - 5], reg,
1279 operator_names[operator], data8, s->sfbr,
1280 (insn & (1 << 23)) ? " SFBR" : "");
1281 op0 = op1 = 0;
1282 switch (opcode) {
1283 case 5: /* From SFBR */
1284 op0 = s->sfbr;
1285 op1 = data8;
1286 break;
1287 case 6: /* To SFBR */
1288 if (operator)
1289 op0 = lsi_reg_readb(s, reg);
1290 op1 = data8;
1291 break;
1292 case 7: /* Read-modify-write */
1293 if (operator)
1294 op0 = lsi_reg_readb(s, reg);
1295 if (insn & (1 << 23)) {
1296 op1 = s->sfbr;
1297 } else {
1298 op1 = data8;
1299 }
1300 break;
1301 }
1302
1303 switch (operator) {
1304 case 0: /* move */
1305 op0 = op1;
1306 break;
1307 case 1: /* Shift left */
1308 op1 = op0 >> 7;
1309 op0 = (op0 << 1) | s->carry;
1310 s->carry = op1;
1311 break;
1312 case 2: /* OR */
1313 op0 |= op1;
1314 break;
1315 case 3: /* XOR */
1316 op0 ^= op1;
1317 break;
1318 case 4: /* AND */
1319 op0 &= op1;
1320 break;
1321 case 5: /* SHR */
1322 op1 = op0 & 1;
1323 op0 = (op0 >> 1) | (s->carry << 7);
1324 s->carry = op1;
1325 break;
1326 case 6: /* ADD */
1327 op0 += op1;
1328 s->carry = op0 < op1;
1329 break;
1330 case 7: /* ADC */
1331 op0 += op1 + s->carry;
1332 if (s->carry)
1333 s->carry = op0 <= op1;
1334 else
1335 s->carry = op0 < op1;
1336 break;
1337 }
1338
1339 switch (opcode) {
1340 case 5: /* From SFBR */
1341 case 7: /* Read-modify-write */
1342 lsi_reg_writeb(s, reg, op0);
1343 break;
1344 case 6: /* To SFBR */
1345 s->sfbr = op0;
1346 break;
1347 }
1348 }
1349 break;
1350
1351 case 2: /* Transfer Control. */
1352 {
1353 int cond;
1354 int jmp;
1355
1356 if ((insn & 0x002e0000) == 0) {
1357 DPRINTF("NOP\n");
1358 break;
1359 }
1360 if (s->sist1 & LSI_SIST1_STO) {
1361 DPRINTF("Delayed select timeout\n");
1362 lsi_stop_script(s);
1363 break;
1364 }
1365 cond = jmp = (insn & (1 << 19)) != 0;
1366 if (cond == jmp && (insn & (1 << 21))) {
1367 DPRINTF("Compare carry %d\n", s->carry == jmp);
1368 cond = s->carry != 0;
1369 }
1370 if (cond == jmp && (insn & (1 << 17))) {
1371 DPRINTF("Compare phase %d %c= %d\n",
1372 (s->sstat1 & PHASE_MASK),
1373 jmp ? '=' : '!',
1374 ((insn >> 24) & 7));
1375 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1376 }
1377 if (cond == jmp && (insn & (1 << 18))) {
1378 uint8_t mask;
1379
1380 mask = (~insn >> 8) & 0xff;
1381 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1382 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1383 cond = (s->sfbr & mask) == (insn & mask);
1384 }
1385 if (cond == jmp) {
1386 if (insn & (1 << 23)) {
1387 /* Relative address. */
1388 addr = s->dsp + sxt24(addr);
1389 }
1390 switch ((insn >> 27) & 7) {
1391 case 0: /* Jump */
1392 DPRINTF("Jump to 0x%08x\n", addr);
1393 s->dsp = addr;
1394 break;
1395 case 1: /* Call */
1396 DPRINTF("Call 0x%08x\n", addr);
1397 s->temp = s->dsp;
1398 s->dsp = addr;
1399 break;
1400 case 2: /* Return */
1401 DPRINTF("Return to 0x%08x\n", s->temp);
1402 s->dsp = s->temp;
1403 break;
1404 case 3: /* Interrupt */
1405 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1406 if ((insn & (1 << 20)) != 0) {
1407 s->istat0 |= LSI_ISTAT0_INTF;
1408 lsi_update_irq(s);
1409 } else {
1410 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1411 }
1412 break;
1413 default:
1414 DPRINTF("Illegal transfer control\n");
1415 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1416 break;
1417 }
1418 } else {
1419 DPRINTF("Control condition failed\n");
1420 }
1421 }
1422 break;
1423
1424 case 3:
1425 if ((insn & (1 << 29)) == 0) {
1426 /* Memory move. */
1427 uint32_t dest;
1428 /* ??? The docs imply the destination address is loaded into
1429 the TEMP register. However the Linux drivers rely on
1430 the value being presrved. */
1431 dest = read_dword(s, s->dsp);
1432 s->dsp += 4;
1433 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1434 } else {
1435 uint8_t data[7];
1436 int reg;
1437 int n;
1438 int i;
1439
1440 if (insn & (1 << 28)) {
1441 addr = s->dsa + sxt24(addr);
1442 }
1443 n = (insn & 7);
1444 reg = (insn >> 16) & 0xff;
1445 if (insn & (1 << 24)) {
1446 cpu_physical_memory_read(addr, data, n);
1447 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1448 addr, *(int *)data);
1449 for (i = 0; i < n; i++) {
1450 lsi_reg_writeb(s, reg + i, data[i]);
1451 }
1452 } else {
1453 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1454 for (i = 0; i < n; i++) {
1455 data[i] = lsi_reg_readb(s, reg + i);
1456 }
1457 cpu_physical_memory_write(addr, data, n);
1458 }
1459 }
1460 }
1461 if (insn_processed > 10000 && !s->waiting) {
1462 /* Some windows drivers make the device spin waiting for a memory
1463 location to change. If we have been executed a lot of code then
1464 assume this is the case and force an unexpected device disconnect.
1465 This is apparently sufficient to beat the drivers into submission.
1466 */
1467 if (!(s->sien0 & LSI_SIST0_UDC))
1468 fprintf(stderr, "inf. loop with UDC masked\n");
1469 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1470 lsi_disconnect(s);
1471 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1472 if (s->dcntl & LSI_DCNTL_SSM) {
1473 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1474 } else {
1475 goto again;
1476 }
1477 }
1478 DPRINTF("SCRIPTS execution stopped\n");
1479 }
1480
1481 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1482 {
1483 uint8_t tmp;
1484 #define CASE_GET_REG24(name, addr) \
1485 case addr: return s->name & 0xff; \
1486 case addr + 1: return (s->name >> 8) & 0xff; \
1487 case addr + 2: return (s->name >> 16) & 0xff;
1488
1489 #define CASE_GET_REG32(name, addr) \
1490 case addr: return s->name & 0xff; \
1491 case addr + 1: return (s->name >> 8) & 0xff; \
1492 case addr + 2: return (s->name >> 16) & 0xff; \
1493 case addr + 3: return (s->name >> 24) & 0xff;
1494
1495 #ifdef DEBUG_LSI_REG
1496 DPRINTF("Read reg %x\n", offset);
1497 #endif
1498 switch (offset) {
1499 case 0x00: /* SCNTL0 */
1500 return s->scntl0;
1501 case 0x01: /* SCNTL1 */
1502 return s->scntl1;
1503 case 0x02: /* SCNTL2 */
1504 return s->scntl2;
1505 case 0x03: /* SCNTL3 */
1506 return s->scntl3;
1507 case 0x04: /* SCID */
1508 return s->scid;
1509 case 0x05: /* SXFER */
1510 return s->sxfer;
1511 case 0x06: /* SDID */
1512 return s->sdid;
1513 case 0x07: /* GPREG0 */
1514 return 0x7f;
1515 case 0x08: /* Revision ID */
1516 return 0x00;
1517 case 0xa: /* SSID */
1518 return s->ssid;
1519 case 0xb: /* SBCL */
1520 /* ??? This is not correct. However it's (hopefully) only
1521 used for diagnostics, so should be ok. */
1522 return 0;
1523 case 0xc: /* DSTAT */
1524 tmp = s->dstat | 0x80;
1525 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1526 s->dstat = 0;
1527 lsi_update_irq(s);
1528 return tmp;
1529 case 0x0d: /* SSTAT0 */
1530 return s->sstat0;
1531 case 0x0e: /* SSTAT1 */
1532 return s->sstat1;
1533 case 0x0f: /* SSTAT2 */
1534 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1535 CASE_GET_REG32(dsa, 0x10)
1536 case 0x14: /* ISTAT0 */
1537 return s->istat0;
1538 case 0x15: /* ISTAT1 */
1539 return s->istat1;
1540 case 0x16: /* MBOX0 */
1541 return s->mbox0;
1542 case 0x17: /* MBOX1 */
1543 return s->mbox1;
1544 case 0x18: /* CTEST0 */
1545 return 0xff;
1546 case 0x19: /* CTEST1 */
1547 return 0;
1548 case 0x1a: /* CTEST2 */
1549 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1550 if (s->istat0 & LSI_ISTAT0_SIGP) {
1551 s->istat0 &= ~LSI_ISTAT0_SIGP;
1552 tmp |= LSI_CTEST2_SIGP;
1553 }
1554 return tmp;
1555 case 0x1b: /* CTEST3 */
1556 return s->ctest3;
1557 CASE_GET_REG32(temp, 0x1c)
1558 case 0x20: /* DFIFO */
1559 return 0;
1560 case 0x21: /* CTEST4 */
1561 return s->ctest4;
1562 case 0x22: /* CTEST5 */
1563 return s->ctest5;
1564 case 0x23: /* CTEST6 */
1565 return 0;
1566 CASE_GET_REG24(dbc, 0x24)
1567 case 0x27: /* DCMD */
1568 return s->dcmd;
1569 CASE_GET_REG32(dnad, 0x28)
1570 CASE_GET_REG32(dsp, 0x2c)
1571 CASE_GET_REG32(dsps, 0x30)
1572 CASE_GET_REG32(scratch[0], 0x34)
1573 case 0x38: /* DMODE */
1574 return s->dmode;
1575 case 0x39: /* DIEN */
1576 return s->dien;
1577 case 0x3a: /* SBR */
1578 return s->sbr;
1579 case 0x3b: /* DCNTL */
1580 return s->dcntl;
1581 case 0x40: /* SIEN0 */
1582 return s->sien0;
1583 case 0x41: /* SIEN1 */
1584 return s->sien1;
1585 case 0x42: /* SIST0 */
1586 tmp = s->sist0;
1587 s->sist0 = 0;
1588 lsi_update_irq(s);
1589 return tmp;
1590 case 0x43: /* SIST1 */
1591 tmp = s->sist1;
1592 s->sist1 = 0;
1593 lsi_update_irq(s);
1594 return tmp;
1595 case 0x46: /* MACNTL */
1596 return 0x0f;
1597 case 0x47: /* GPCNTL0 */
1598 return 0x0f;
1599 case 0x48: /* STIME0 */
1600 return s->stime0;
1601 case 0x4a: /* RESPID0 */
1602 return s->respid0;
1603 case 0x4b: /* RESPID1 */
1604 return s->respid1;
1605 case 0x4d: /* STEST1 */
1606 return s->stest1;
1607 case 0x4e: /* STEST2 */
1608 return s->stest2;
1609 case 0x4f: /* STEST3 */
1610 return s->stest3;
1611 case 0x50: /* SIDL */
1612 /* This is needed by the linux drivers. We currently only update it
1613 during the MSG IN phase. */
1614 return s->sidl;
1615 case 0x52: /* STEST4 */
1616 return 0xe0;
1617 case 0x56: /* CCNTL0 */
1618 return s->ccntl0;
1619 case 0x57: /* CCNTL1 */
1620 return s->ccntl1;
1621 case 0x58: /* SBDL */
1622 /* Some drivers peek at the data bus during the MSG IN phase. */
1623 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1624 return s->msg[0];
1625 return 0;
1626 case 0x59: /* SBDL high */
1627 return 0;
1628 CASE_GET_REG32(mmrs, 0xa0)
1629 CASE_GET_REG32(mmws, 0xa4)
1630 CASE_GET_REG32(sfs, 0xa8)
1631 CASE_GET_REG32(drs, 0xac)
1632 CASE_GET_REG32(sbms, 0xb0)
1633 CASE_GET_REG32(dbms, 0xb4)
1634 CASE_GET_REG32(dnad64, 0xb8)
1635 CASE_GET_REG32(pmjad1, 0xc0)
1636 CASE_GET_REG32(pmjad2, 0xc4)
1637 CASE_GET_REG32(rbc, 0xc8)
1638 CASE_GET_REG32(ua, 0xcc)
1639 CASE_GET_REG32(ia, 0xd4)
1640 CASE_GET_REG32(sbc, 0xd8)
1641 CASE_GET_REG32(csbc, 0xdc)
1642 }
1643 if (offset >= 0x5c && offset < 0xa0) {
1644 int n;
1645 int shift;
1646 n = (offset - 0x58) >> 2;
1647 shift = (offset & 3) * 8;
1648 return (s->scratch[n] >> shift) & 0xff;
1649 }
1650 BADF("readb 0x%x\n", offset);
1651 exit(1);
1652 #undef CASE_GET_REG24
1653 #undef CASE_GET_REG32
1654 }
1655
1656 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1657 {
1658 #define CASE_SET_REG24(name, addr) \
1659 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1660 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1661 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1662
1663 #define CASE_SET_REG32(name, addr) \
1664 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1665 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1666 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1667 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1668
1669 #ifdef DEBUG_LSI_REG
1670 DPRINTF("Write reg %x = %02x\n", offset, val);
1671 #endif
1672 switch (offset) {
1673 case 0x00: /* SCNTL0 */
1674 s->scntl0 = val;
1675 if (val & LSI_SCNTL0_START) {
1676 BADF("Start sequence not implemented\n");
1677 }
1678 break;
1679 case 0x01: /* SCNTL1 */
1680 s->scntl1 = val & ~LSI_SCNTL1_SST;
1681 if (val & LSI_SCNTL1_IARB) {
1682 BADF("Immediate Arbritration not implemented\n");
1683 }
1684 if (val & LSI_SCNTL1_RST) {
1685 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1686 DeviceState *dev;
1687 int id;
1688
1689 for (id = 0; id < s->bus.ndev; id++) {
1690 if (s->bus.devs[id]) {
1691 dev = &s->bus.devs[id]->qdev;
1692 dev->info->reset(dev);
1693 }
1694 }
1695 s->sstat0 |= LSI_SSTAT0_RST;
1696 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1697 }
1698 } else {
1699 s->sstat0 &= ~LSI_SSTAT0_RST;
1700 }
1701 break;
1702 case 0x02: /* SCNTL2 */
1703 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1704 s->scntl2 = val;
1705 break;
1706 case 0x03: /* SCNTL3 */
1707 s->scntl3 = val;
1708 break;
1709 case 0x04: /* SCID */
1710 s->scid = val;
1711 break;
1712 case 0x05: /* SXFER */
1713 s->sxfer = val;
1714 break;
1715 case 0x06: /* SDID */
1716 if ((val & 0xf) != (s->ssid & 0xf))
1717 BADF("Destination ID does not match SSID\n");
1718 s->sdid = val & 0xf;
1719 break;
1720 case 0x07: /* GPREG0 */
1721 break;
1722 case 0x08: /* SFBR */
1723 /* The CPU is not allowed to write to this register. However the
1724 SCRIPTS register move instructions are. */
1725 s->sfbr = val;
1726 break;
1727 case 0x0a: case 0x0b:
1728 /* Openserver writes to these readonly registers on startup */
1729 return;
1730 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1731 /* Linux writes to these readonly registers on startup. */
1732 return;
1733 CASE_SET_REG32(dsa, 0x10)
1734 case 0x14: /* ISTAT0 */
1735 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1736 if (val & LSI_ISTAT0_ABRT) {
1737 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1738 }
1739 if (val & LSI_ISTAT0_INTF) {
1740 s->istat0 &= ~LSI_ISTAT0_INTF;
1741 lsi_update_irq(s);
1742 }
1743 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1744 DPRINTF("Woken by SIGP\n");
1745 s->waiting = 0;
1746 s->dsp = s->dnad;
1747 lsi_execute_script(s);
1748 }
1749 if (val & LSI_ISTAT0_SRST) {
1750 lsi_soft_reset(s);
1751 }
1752 break;
1753 case 0x16: /* MBOX0 */
1754 s->mbox0 = val;
1755 break;
1756 case 0x17: /* MBOX1 */
1757 s->mbox1 = val;
1758 break;
1759 case 0x1a: /* CTEST2 */
1760 s->ctest2 = val & LSI_CTEST2_PCICIE;
1761 break;
1762 case 0x1b: /* CTEST3 */
1763 s->ctest3 = val & 0x0f;
1764 break;
1765 CASE_SET_REG32(temp, 0x1c)
1766 case 0x21: /* CTEST4 */
1767 if (val & 7) {
1768 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1769 }
1770 s->ctest4 = val;
1771 break;
1772 case 0x22: /* CTEST5 */
1773 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1774 BADF("CTEST5 DMA increment not implemented\n");
1775 }
1776 s->ctest5 = val;
1777 break;
1778 CASE_SET_REG24(dbc, 0x24)
1779 CASE_SET_REG32(dnad, 0x28)
1780 case 0x2c: /* DSP[0:7] */
1781 s->dsp &= 0xffffff00;
1782 s->dsp |= val;
1783 break;
1784 case 0x2d: /* DSP[8:15] */
1785 s->dsp &= 0xffff00ff;
1786 s->dsp |= val << 8;
1787 break;
1788 case 0x2e: /* DSP[16:23] */
1789 s->dsp &= 0xff00ffff;
1790 s->dsp |= val << 16;
1791 break;
1792 case 0x2f: /* DSP[24:31] */
1793 s->dsp &= 0x00ffffff;
1794 s->dsp |= val << 24;
1795 if ((s->dmode & LSI_DMODE_MAN) == 0
1796 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1797 lsi_execute_script(s);
1798 break;
1799 CASE_SET_REG32(dsps, 0x30)
1800 CASE_SET_REG32(scratch[0], 0x34)
1801 case 0x38: /* DMODE */
1802 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1803 BADF("IO mappings not implemented\n");
1804 }
1805 s->dmode = val;
1806 break;
1807 case 0x39: /* DIEN */
1808 s->dien = val;
1809 lsi_update_irq(s);
1810 break;
1811 case 0x3a: /* SBR */
1812 s->sbr = val;
1813 break;
1814 case 0x3b: /* DCNTL */
1815 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1816 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1817 lsi_execute_script(s);
1818 break;
1819 case 0x40: /* SIEN0 */
1820 s->sien0 = val;
1821 lsi_update_irq(s);
1822 break;
1823 case 0x41: /* SIEN1 */
1824 s->sien1 = val;
1825 lsi_update_irq(s);
1826 break;
1827 case 0x47: /* GPCNTL0 */
1828 break;
1829 case 0x48: /* STIME0 */
1830 s->stime0 = val;
1831 break;
1832 case 0x49: /* STIME1 */
1833 if (val & 0xf) {
1834 DPRINTF("General purpose timer not implemented\n");
1835 /* ??? Raising the interrupt immediately seems to be sufficient
1836 to keep the FreeBSD driver happy. */
1837 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1838 }
1839 break;
1840 case 0x4a: /* RESPID0 */
1841 s->respid0 = val;
1842 break;
1843 case 0x4b: /* RESPID1 */
1844 s->respid1 = val;
1845 break;
1846 case 0x4d: /* STEST1 */
1847 s->stest1 = val;
1848 break;
1849 case 0x4e: /* STEST2 */
1850 if (val & 1) {
1851 BADF("Low level mode not implemented\n");
1852 }
1853 s->stest2 = val;
1854 break;
1855 case 0x4f: /* STEST3 */
1856 if (val & 0x41) {
1857 BADF("SCSI FIFO test mode not implemented\n");
1858 }
1859 s->stest3 = val;
1860 break;
1861 case 0x56: /* CCNTL0 */
1862 s->ccntl0 = val;
1863 break;
1864 case 0x57: /* CCNTL1 */
1865 s->ccntl1 = val;
1866 break;
1867 CASE_SET_REG32(mmrs, 0xa0)
1868 CASE_SET_REG32(mmws, 0xa4)
1869 CASE_SET_REG32(sfs, 0xa8)
1870 CASE_SET_REG32(drs, 0xac)
1871 CASE_SET_REG32(sbms, 0xb0)
1872 CASE_SET_REG32(dbms, 0xb4)
1873 CASE_SET_REG32(dnad64, 0xb8)
1874 CASE_SET_REG32(pmjad1, 0xc0)
1875 CASE_SET_REG32(pmjad2, 0xc4)
1876 CASE_SET_REG32(rbc, 0xc8)
1877 CASE_SET_REG32(ua, 0xcc)
1878 CASE_SET_REG32(ia, 0xd4)
1879 CASE_SET_REG32(sbc, 0xd8)
1880 CASE_SET_REG32(csbc, 0xdc)
1881 default:
1882 if (offset >= 0x5c && offset < 0xa0) {
1883 int n;
1884 int shift;
1885 n = (offset - 0x58) >> 2;
1886 shift = (offset & 3) * 8;
1887 s->scratch[n] &= ~(0xff << shift);
1888 s->scratch[n] |= (val & 0xff) << shift;
1889 } else {
1890 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1891 }
1892 }
1893 #undef CASE_SET_REG24
1894 #undef CASE_SET_REG32
1895 }
1896
1897 static void lsi_mmio_write(void *opaque, target_phys_addr_t addr,
1898 uint64_t val, unsigned size)
1899 {
1900 LSIState *s = opaque;
1901
1902 lsi_reg_writeb(s, addr & 0xff, val);
1903 }
1904
1905 static uint64_t lsi_mmio_read(void *opaque, target_phys_addr_t addr,
1906 unsigned size)
1907 {
1908 LSIState *s = opaque;
1909
1910 return lsi_reg_readb(s, addr & 0xff);
1911 }
1912
1913 static const MemoryRegionOps lsi_mmio_ops = {
1914 .read = lsi_mmio_read,
1915 .write = lsi_mmio_write,
1916 .endianness = DEVICE_NATIVE_ENDIAN,
1917 .impl = {
1918 .min_access_size = 1,
1919 .max_access_size = 1,
1920 },
1921 };
1922
1923 static void lsi_ram_write(void *opaque, target_phys_addr_t addr,
1924 uint64_t val, unsigned size)
1925 {
1926 LSIState *s = opaque;
1927 uint32_t newval;
1928 uint32_t mask;
1929 int shift;
1930
1931 newval = s->script_ram[addr >> 2];
1932 shift = (addr & 3) * 8;
1933 mask = ((uint64_t)1 << (size * 8)) - 1;
1934 newval &= ~(mask << shift);
1935 newval |= val << shift;
1936 s->script_ram[addr >> 2] = newval;
1937 }
1938
1939 static uint64_t lsi_ram_read(void *opaque, target_phys_addr_t addr,
1940 unsigned size)
1941 {
1942 LSIState *s = opaque;
1943 uint32_t val;
1944 uint32_t mask;
1945
1946 val = s->script_ram[addr >> 2];
1947 mask = ((uint64_t)1 << (size * 8)) - 1;
1948 val >>= (addr & 3) * 8;
1949 return val & mask;
1950 }
1951
1952 static const MemoryRegionOps lsi_ram_ops = {
1953 .read = lsi_ram_read,
1954 .write = lsi_ram_write,
1955 .endianness = DEVICE_NATIVE_ENDIAN,
1956 };
1957
1958 static uint64_t lsi_io_read(void *opaque, target_phys_addr_t addr,
1959 unsigned size)
1960 {
1961 LSIState *s = opaque;
1962 return lsi_reg_readb(s, addr & 0xff);
1963 }
1964
1965 static void lsi_io_write(void *opaque, target_phys_addr_t addr,
1966 uint64_t val, unsigned size)
1967 {
1968 LSIState *s = opaque;
1969 lsi_reg_writeb(s, addr & 0xff, val);
1970 }
1971
1972 static const MemoryRegionOps lsi_io_ops = {
1973 .read = lsi_io_read,
1974 .write = lsi_io_write,
1975 .endianness = DEVICE_NATIVE_ENDIAN,
1976 .impl = {
1977 .min_access_size = 1,
1978 .max_access_size = 1,
1979 },
1980 };
1981
1982 static void lsi_scsi_reset(DeviceState *dev)
1983 {
1984 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
1985
1986 lsi_soft_reset(s);
1987 }
1988
1989 static void lsi_pre_save(void *opaque)
1990 {
1991 LSIState *s = opaque;
1992
1993 if (s->current) {
1994 assert(s->current->dma_buf == NULL);
1995 assert(s->current->dma_len == 0);
1996 }
1997 assert(QTAILQ_EMPTY(&s->queue));
1998 }
1999
2000 static const VMStateDescription vmstate_lsi_scsi = {
2001 .name = "lsiscsi",
2002 .version_id = 0,
2003 .minimum_version_id = 0,
2004 .minimum_version_id_old = 0,
2005 .pre_save = lsi_pre_save,
2006 .fields = (VMStateField []) {
2007 VMSTATE_PCI_DEVICE(dev, LSIState),
2008
2009 VMSTATE_INT32(carry, LSIState),
2010 VMSTATE_INT32(status, LSIState),
2011 VMSTATE_INT32(msg_action, LSIState),
2012 VMSTATE_INT32(msg_len, LSIState),
2013 VMSTATE_BUFFER(msg, LSIState),
2014 VMSTATE_INT32(waiting, LSIState),
2015
2016 VMSTATE_UINT32(dsa, LSIState),
2017 VMSTATE_UINT32(temp, LSIState),
2018 VMSTATE_UINT32(dnad, LSIState),
2019 VMSTATE_UINT32(dbc, LSIState),
2020 VMSTATE_UINT8(istat0, LSIState),
2021 VMSTATE_UINT8(istat1, LSIState),
2022 VMSTATE_UINT8(dcmd, LSIState),
2023 VMSTATE_UINT8(dstat, LSIState),
2024 VMSTATE_UINT8(dien, LSIState),
2025 VMSTATE_UINT8(sist0, LSIState),
2026 VMSTATE_UINT8(sist1, LSIState),
2027 VMSTATE_UINT8(sien0, LSIState),
2028 VMSTATE_UINT8(sien1, LSIState),
2029 VMSTATE_UINT8(mbox0, LSIState),
2030 VMSTATE_UINT8(mbox1, LSIState),
2031 VMSTATE_UINT8(dfifo, LSIState),
2032 VMSTATE_UINT8(ctest2, LSIState),
2033 VMSTATE_UINT8(ctest3, LSIState),
2034 VMSTATE_UINT8(ctest4, LSIState),
2035 VMSTATE_UINT8(ctest5, LSIState),
2036 VMSTATE_UINT8(ccntl0, LSIState),
2037 VMSTATE_UINT8(ccntl1, LSIState),
2038 VMSTATE_UINT32(dsp, LSIState),
2039 VMSTATE_UINT32(dsps, LSIState),
2040 VMSTATE_UINT8(dmode, LSIState),
2041 VMSTATE_UINT8(dcntl, LSIState),
2042 VMSTATE_UINT8(scntl0, LSIState),
2043 VMSTATE_UINT8(scntl1, LSIState),
2044 VMSTATE_UINT8(scntl2, LSIState),
2045 VMSTATE_UINT8(scntl3, LSIState),
2046 VMSTATE_UINT8(sstat0, LSIState),
2047 VMSTATE_UINT8(sstat1, LSIState),
2048 VMSTATE_UINT8(scid, LSIState),
2049 VMSTATE_UINT8(sxfer, LSIState),
2050 VMSTATE_UINT8(socl, LSIState),
2051 VMSTATE_UINT8(sdid, LSIState),
2052 VMSTATE_UINT8(ssid, LSIState),
2053 VMSTATE_UINT8(sfbr, LSIState),
2054 VMSTATE_UINT8(stest1, LSIState),
2055 VMSTATE_UINT8(stest2, LSIState),
2056 VMSTATE_UINT8(stest3, LSIState),
2057 VMSTATE_UINT8(sidl, LSIState),
2058 VMSTATE_UINT8(stime0, LSIState),
2059 VMSTATE_UINT8(respid0, LSIState),
2060 VMSTATE_UINT8(respid1, LSIState),
2061 VMSTATE_UINT32(mmrs, LSIState),
2062 VMSTATE_UINT32(mmws, LSIState),
2063 VMSTATE_UINT32(sfs, LSIState),
2064 VMSTATE_UINT32(drs, LSIState),
2065 VMSTATE_UINT32(sbms, LSIState),
2066 VMSTATE_UINT32(dbms, LSIState),
2067 VMSTATE_UINT32(dnad64, LSIState),
2068 VMSTATE_UINT32(pmjad1, LSIState),
2069 VMSTATE_UINT32(pmjad2, LSIState),
2070 VMSTATE_UINT32(rbc, LSIState),
2071 VMSTATE_UINT32(ua, LSIState),
2072 VMSTATE_UINT32(ia, LSIState),
2073 VMSTATE_UINT32(sbc, LSIState),
2074 VMSTATE_UINT32(csbc, LSIState),
2075 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2076 VMSTATE_UINT8(sbr, LSIState),
2077
2078 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2079 VMSTATE_END_OF_LIST()
2080 }
2081 };
2082
2083 static int lsi_scsi_uninit(PCIDevice *d)
2084 {
2085 LSIState *s = DO_UPCAST(LSIState, dev, d);
2086
2087 memory_region_destroy(&s->mmio_io);
2088 memory_region_destroy(&s->ram_io);
2089 memory_region_destroy(&s->io_io);
2090
2091 return 0;
2092 }
2093
2094 static const struct SCSIBusOps lsi_scsi_ops = {
2095 .transfer_data = lsi_transfer_data,
2096 .complete = lsi_command_complete,
2097 .cancel = lsi_request_cancelled
2098 };
2099
2100 static int lsi_scsi_init(PCIDevice *dev)
2101 {
2102 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2103 uint8_t *pci_conf;
2104
2105 pci_conf = s->dev.config;
2106
2107 /* PCI latency timer = 255 */
2108 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2109 /* TODO: RST# value should be 0 */
2110 /* Interrupt pin 1 */
2111 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2112
2113 memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
2114 memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
2115 memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
2116
2117 pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2118 pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
2119 pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2120 QTAILQ_INIT(&s->queue);
2121
2122 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, &lsi_scsi_ops);
2123 if (!dev->qdev.hotplugged) {
2124 return scsi_bus_legacy_handle_cmdline(&s->bus);
2125 }
2126 return 0;
2127 }
2128
2129 static PCIDeviceInfo lsi_info = {
2130 .qdev.name = "lsi53c895a",
2131 .qdev.alias = "lsi",
2132 .qdev.size = sizeof(LSIState),
2133 .qdev.reset = lsi_scsi_reset,
2134 .qdev.vmsd = &vmstate_lsi_scsi,
2135 .init = lsi_scsi_init,
2136 .exit = lsi_scsi_uninit,
2137 .vendor_id = PCI_VENDOR_ID_LSI_LOGIC,
2138 .device_id = PCI_DEVICE_ID_LSI_53C895A,
2139 .class_id = PCI_CLASS_STORAGE_SCSI,
2140 .subsystem_id = 0x1000,
2141 };
2142
2143 static void lsi53c895a_register_devices(void)
2144 {
2145 pci_qdev_register(&lsi_info);
2146 }
2147
2148 device_init(lsi53c895a_register_devices);
AR7 emulation for QEMU