?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
eepro100: convert to memory API
[qemu/mdroth.git] / hw / lsi53c895a.c
blobe9904c49d9297d4250420ab42e0ed662e3b70591
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 SCSIRequest *req;
178 uint32_t tag;
179 uint32_t dma_len;
180 uint8_t *dma_buf;
181 uint32_t pending;
182 int out;
183 QTAILQ_ENTRY(lsi_request) next;
184 } lsi_request;
185
186 typedef struct {
187 PCIDevice dev;
188 int mmio_io_addr;
189 int ram_io_addr;
190 uint32_t script_ram_base;
191
192 int carry; /* ??? Should this be an a visible register somewhere? */
193 int status;
194 /* Action to take at the end of a MSG IN phase.
195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
196 int msg_action;
197 int msg_len;
198 uint8_t msg[LSI_MAX_MSGIN_LEN];
199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
203 int waiting;
204 SCSIBus bus;
205 int current_lun;
206 /* The tag is a combination of the device ID and the SCSI tag. */
207 uint32_t select_tag;
208 int command_complete;
209 QTAILQ_HEAD(, lsi_request) queue;
210 lsi_request *current;
211
212 uint32_t dsa;
213 uint32_t temp;
214 uint32_t dnad;
215 uint32_t dbc;
216 uint8_t istat0;
217 uint8_t istat1;
218 uint8_t dcmd;
219 uint8_t dstat;
220 uint8_t dien;
221 uint8_t sist0;
222 uint8_t sist1;
223 uint8_t sien0;
224 uint8_t sien1;
225 uint8_t mbox0;
226 uint8_t mbox1;
227 uint8_t dfifo;
228 uint8_t ctest2;
229 uint8_t ctest3;
230 uint8_t ctest4;
231 uint8_t ctest5;
232 uint8_t ccntl0;
233 uint8_t ccntl1;
234 uint32_t dsp;
235 uint32_t dsps;
236 uint8_t dmode;
237 uint8_t dcntl;
238 uint8_t scntl0;
239 uint8_t scntl1;
240 uint8_t scntl2;
241 uint8_t scntl3;
242 uint8_t sstat0;
243 uint8_t sstat1;
244 uint8_t scid;
245 uint8_t sxfer;
246 uint8_t socl;
247 uint8_t sdid;
248 uint8_t ssid;
249 uint8_t sfbr;
250 uint8_t stest1;
251 uint8_t stest2;
252 uint8_t stest3;
253 uint8_t sidl;
254 uint8_t stime0;
255 uint8_t respid0;
256 uint8_t respid1;
257 uint32_t mmrs;
258 uint32_t mmws;
259 uint32_t sfs;
260 uint32_t drs;
261 uint32_t sbms;
262 uint32_t dbms;
263 uint32_t dnad64;
264 uint32_t pmjad1;
265 uint32_t pmjad2;
266 uint32_t rbc;
267 uint32_t ua;
268 uint32_t ia;
269 uint32_t sbc;
270 uint32_t csbc;
271 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
272 uint8_t sbr;
273
274 /* Script ram is stored as 32-bit words in host byteorder. */
275 uint32_t script_ram[2048];
276 } LSIState;
277
278 static inline int lsi_irq_on_rsl(LSIState *s)
279 {
280 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
281 }
282
283 static void lsi_soft_reset(LSIState *s)
284 {
285 lsi_request *p;
286
287 DPRINTF("Reset\n");
288 s->carry = 0;
289
290 s->msg_action = 0;
291 s->msg_len = 0;
292 s->waiting = 0;
293 s->dsa = 0;
294 s->dnad = 0;
295 s->dbc = 0;
296 s->temp = 0;
297 memset(s->scratch, 0, sizeof(s->scratch));
298 s->istat0 = 0;
299 s->istat1 = 0;
300 s->dcmd = 0x40;
301 s->dstat = LSI_DSTAT_DFE;
302 s->dien = 0;
303 s->sist0 = 0;
304 s->sist1 = 0;
305 s->sien0 = 0;
306 s->sien1 = 0;
307 s->mbox0 = 0;
308 s->mbox1 = 0;
309 s->dfifo = 0;
310 s->ctest2 = LSI_CTEST2_DACK;
311 s->ctest3 = 0;
312 s->ctest4 = 0;
313 s->ctest5 = 0;
314 s->ccntl0 = 0;
315 s->ccntl1 = 0;
316 s->dsp = 0;
317 s->dsps = 0;
318 s->dmode = 0;
319 s->dcntl = 0;
320 s->scntl0 = 0xc0;
321 s->scntl1 = 0;
322 s->scntl2 = 0;
323 s->scntl3 = 0;
324 s->sstat0 = 0;
325 s->sstat1 = 0;
326 s->scid = 7;
327 s->sxfer = 0;
328 s->socl = 0;
329 s->sdid = 0;
330 s->ssid = 0;
331 s->stest1 = 0;
332 s->stest2 = 0;
333 s->stest3 = 0;
334 s->sidl = 0;
335 s->stime0 = 0;
336 s->respid0 = 0x80;
337 s->respid1 = 0;
338 s->mmrs = 0;
339 s->mmws = 0;
340 s->sfs = 0;
341 s->drs = 0;
342 s->sbms = 0;
343 s->dbms = 0;
344 s->dnad64 = 0;
345 s->pmjad1 = 0;
346 s->pmjad2 = 0;
347 s->rbc = 0;
348 s->ua = 0;
349 s->ia = 0;
350 s->sbc = 0;
351 s->csbc = 0;
352 s->sbr = 0;
353 while (!QTAILQ_EMPTY(&s->queue)) {
354 p = QTAILQ_FIRST(&s->queue);
355 QTAILQ_REMOVE(&s->queue, p, next);
356 qemu_free(p);
357 }
358 if (s->current) {
359 qemu_free(s->current);
360 s->current = NULL;
361 }
362 }
363
364 static int lsi_dma_40bit(LSIState *s)
365 {
366 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
367 return 1;
368 return 0;
369 }
370
371 static int lsi_dma_ti64bit(LSIState *s)
372 {
373 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
374 return 1;
375 return 0;
376 }
377
378 static int lsi_dma_64bit(LSIState *s)
379 {
380 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
381 return 1;
382 return 0;
383 }
384
385 static uint8_t lsi_reg_readb(LSIState *s, int offset);
386 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
387 static void lsi_execute_script(LSIState *s);
388 static void lsi_reselect(LSIState *s, lsi_request *p);
389
390 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
391 {
392 uint32_t buf;
393
394 /* Optimize reading from SCRIPTS RAM. */
395 if ((addr & 0xffffe000) == s->script_ram_base) {
396 return s->script_ram[(addr & 0x1fff) >> 2];
397 }
398 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
399 return cpu_to_le32(buf);
400 }
401
402 static void lsi_stop_script(LSIState *s)
403 {
404 s->istat1 &= ~LSI_ISTAT1_SRUN;
405 }
406
407 static void lsi_update_irq(LSIState *s)
408 {
409 int level;
410 static int last_level;
411 lsi_request *p;
412
413 /* It's unclear whether the DIP/SIP bits should be cleared when the
414 Interrupt Status Registers are cleared or when istat0 is read.
415 We currently do the formwer, which seems to work. */
416 level = 0;
417 if (s->dstat) {
418 if (s->dstat & s->dien)
419 level = 1;
420 s->istat0 |= LSI_ISTAT0_DIP;
421 } else {
422 s->istat0 &= ~LSI_ISTAT0_DIP;
423 }
424
425 if (s->sist0 || s->sist1) {
426 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
427 level = 1;
428 s->istat0 |= LSI_ISTAT0_SIP;
429 } else {
430 s->istat0 &= ~LSI_ISTAT0_SIP;
431 }
432 if (s->istat0 & LSI_ISTAT0_INTF)
433 level = 1;
434
435 if (level != last_level) {
436 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
437 level, s->dstat, s->sist1, s->sist0);
438 last_level = level;
439 }
440 qemu_set_irq(s->dev.irq[0], level);
441
442 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
443 DPRINTF("Handled IRQs & disconnected, looking for pending "
444 "processes\n");
445 QTAILQ_FOREACH(p, &s->queue, next) {
446 if (p->pending) {
447 lsi_reselect(s, p);
448 break;
449 }
450 }
451 }
452 }
453
454 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
455 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
456 {
457 uint32_t mask0;
458 uint32_t mask1;
459
460 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
461 stat1, stat0, s->sist1, s->sist0);
462 s->sist0 |= stat0;
463 s->sist1 |= stat1;
464 /* Stop processor on fatal or unmasked interrupt. As a special hack
465 we don't stop processing when raising STO. Instead continue
466 execution and stop at the next insn that accesses the SCSI bus. */
467 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
468 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
469 mask1 &= ~LSI_SIST1_STO;
470 if (s->sist0 & mask0 || s->sist1 & mask1) {
471 lsi_stop_script(s);
472 }
473 lsi_update_irq(s);
474 }
475
476 /* Stop SCRIPTS execution and raise a DMA interrupt. */
477 static void lsi_script_dma_interrupt(LSIState *s, int stat)
478 {
479 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
480 s->dstat |= stat;
481 lsi_update_irq(s);
482 lsi_stop_script(s);
483 }
484
485 static inline void lsi_set_phase(LSIState *s, int phase)
486 {
487 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
488 }
489
490 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
491 {
492 /* Trigger a phase mismatch. */
493 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
494 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
495 s->dsp = out ? s->pmjad1 : s->pmjad2;
496 } else {
497 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
498 }
499 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
500 } else {
501 DPRINTF("Phase mismatch interrupt\n");
502 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
503 lsi_stop_script(s);
504 }
505 lsi_set_phase(s, new_phase);
506 }
507
508
509 /* Resume SCRIPTS execution after a DMA operation. */
510 static void lsi_resume_script(LSIState *s)
511 {
512 if (s->waiting != 2) {
513 s->waiting = 0;
514 lsi_execute_script(s);
515 } else {
516 s->waiting = 0;
517 }
518 }
519
520 static void lsi_disconnect(LSIState *s)
521 {
522 s->scntl1 &= ~LSI_SCNTL1_CON;
523 s->sstat1 &= ~PHASE_MASK;
524 }
525
526 static void lsi_bad_selection(LSIState *s, uint32_t id)
527 {
528 DPRINTF("Selected absent target %d\n", id);
529 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
530 lsi_disconnect(s);
531 }
532
533 /* Initiate a SCSI layer data transfer. */
534 static void lsi_do_dma(LSIState *s, int out)
535 {
536 uint32_t count, id;
537 target_phys_addr_t addr;
538 SCSIDevice *dev;
539
540 assert(s->current);
541 if (!s->current->dma_len) {
542 /* Wait until data is available. */
543 DPRINTF("DMA no data available\n");
544 return;
545 }
546
547 id = (s->current->tag >> 8) & 0xf;
548 dev = s->bus.devs[id];
549 if (!dev) {
550 lsi_bad_selection(s, id);
551 return;
552 }
553
554 count = s->dbc;
555 if (count > s->current->dma_len)
556 count = s->current->dma_len;
557
558 addr = s->dnad;
559 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
560 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
561 addr |= ((uint64_t)s->dnad64 << 32);
562 else if (s->dbms)
563 addr |= ((uint64_t)s->dbms << 32);
564 else if (s->sbms)
565 addr |= ((uint64_t)s->sbms << 32);
566
567 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
568 s->csbc += count;
569 s->dnad += count;
570 s->dbc -= count;
571 if (s->current->dma_buf == NULL) {
572 s->current->dma_buf = scsi_req_get_buf(s->current->req);
573 }
574 /* ??? Set SFBR to first data byte. */
575 if (out) {
576 cpu_physical_memory_read(addr, s->current->dma_buf, count);
577 } else {
578 cpu_physical_memory_write(addr, s->current->dma_buf, count);
579 }
580 s->current->dma_len -= count;
581 if (s->current->dma_len == 0) {
582 s->current->dma_buf = NULL;
583 scsi_req_continue(s->current->req);
584 } else {
585 s->current->dma_buf += count;
586 lsi_resume_script(s);
587 }
588 }
589
590
591 /* Add a command to the queue. */
592 static void lsi_queue_command(LSIState *s)
593 {
594 lsi_request *p = s->current;
595
596 DPRINTF("Queueing tag=0x%x\n", p->tag);
597 assert(s->current != NULL);
598 assert(s->current->dma_len == 0);
599 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
600 s->current = NULL;
601
602 p->pending = 0;
603 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
604 }
605
606 /* Queue a byte for a MSG IN phase. */
607 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
608 {
609 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
610 BADF("MSG IN data too long\n");
611 } else {
612 DPRINTF("MSG IN 0x%02x\n", data);
613 s->msg[s->msg_len++] = data;
614 }
615 }
616
617 /* Perform reselection to continue a command. */
618 static void lsi_reselect(LSIState *s, lsi_request *p)
619 {
620 int id;
621
622 assert(s->current == NULL);
623 QTAILQ_REMOVE(&s->queue, p, next);
624 s->current = p;
625
626 id = (p->tag >> 8) & 0xf;
627 s->ssid = id | 0x80;
628 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
629 if (!(s->dcntl & LSI_DCNTL_COM)) {
630 s->sfbr = 1 << (id & 0x7);
631 }
632 DPRINTF("Reselected target %d\n", id);
633 s->scntl1 |= LSI_SCNTL1_CON;
634 lsi_set_phase(s, PHASE_MI);
635 s->msg_action = p->out ? 2 : 3;
636 s->current->dma_len = p->pending;
637 lsi_add_msg_byte(s, 0x80);
638 if (s->current->tag & LSI_TAG_VALID) {
639 lsi_add_msg_byte(s, 0x20);
640 lsi_add_msg_byte(s, p->tag & 0xff);
641 }
642
643 if (lsi_irq_on_rsl(s)) {
644 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
645 }
646 }
647
648 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
649 {
650 lsi_request *p;
651
652 QTAILQ_FOREACH(p, &s->queue, next) {
653 if (p->tag == tag) {
654 return p;
655 }
656 }
657
658 return NULL;
659 }
660
661 static void lsi_request_cancelled(SCSIRequest *req)
662 {
663 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
664 lsi_request *p = req->hba_private;
665
666 if (s->current && req == s->current->req) {
667 scsi_req_unref(req);
668 qemu_free(s->current);
669 s->current = NULL;
670 return;
671 }
672
673 if (p) {
674 QTAILQ_REMOVE(&s->queue, p, next);
675 scsi_req_unref(req);
676 qemu_free(p);
677 }
678 }
679
680 /* Record that data is available for a queued command. Returns zero if
681 the device was reselected, nonzero if the IO is deferred. */
682 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
683 {
684 lsi_request *p = req->hba_private;
685
686 if (p->pending) {
687 BADF("Multiple IO pending for request %p\n", p);
688 }
689 p->pending = len;
690 /* Reselect if waiting for it, or if reselection triggers an IRQ
691 and the bus is free.
692 Since no interrupt stacking is implemented in the emulation, it
693 is also required that there are no pending interrupts waiting
694 for service from the device driver. */
695 if (s->waiting == 1 ||
696 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
697 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
698 /* Reselect device. */
699 lsi_reselect(s, p);
700 return 0;
701 } else {
702 DPRINTF("Queueing IO tag=0x%x\n", tag);
703 p->pending = len;
704 return 1;
705 }
706 }
707
708 /* Callback to indicate that the SCSI layer has completed a command. */
709 static void lsi_command_complete(SCSIRequest *req, uint32_t status)
710 {
711 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
712 int out;
713
714 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
715 DPRINTF("Command complete status=%d\n", (int)status);
716 s->status = status;
717 s->command_complete = 2;
718 if (s->waiting && s->dbc != 0) {
719 /* Raise phase mismatch for short transfers. */
720 lsi_bad_phase(s, out, PHASE_ST);
721 } else {
722 lsi_set_phase(s, PHASE_ST);
723 }
724
725 if (s->current && req == s->current->req) {
726 scsi_req_unref(s->current->req);
727 qemu_free(s->current);
728 s->current = NULL;
729 }
730 lsi_resume_script(s);
731 }
732
733 /* Callback to indicate that the SCSI layer has completed a transfer. */
734 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
735 {
736 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
737 int out;
738
739 if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
740 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
741 if (lsi_queue_req(s, req, len)) {
742 return;
743 }
744 }
745
746 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
747
748 /* host adapter (re)connected */
749 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
750 s->current->dma_len = len;
751 s->command_complete = 1;
752 if (s->waiting) {
753 if (s->waiting == 1 || s->dbc == 0) {
754 lsi_resume_script(s);
755 } else {
756 lsi_do_dma(s, out);
757 }
758 }
759 }
760
761 static void lsi_do_command(LSIState *s)
762 {
763 SCSIDevice *dev;
764 uint8_t buf[16];
765 uint32_t id;
766 int n;
767
768 DPRINTF("Send command len=%d\n", s->dbc);
769 if (s->dbc > 16)
770 s->dbc = 16;
771 cpu_physical_memory_read(s->dnad, buf, s->dbc);
772 s->sfbr = buf[0];
773 s->command_complete = 0;
774
775 id = (s->select_tag >> 8) & 0xf;
776 dev = s->bus.devs[id];
777 if (!dev) {
778 lsi_bad_selection(s, id);
779 return;
780 }
781
782 assert(s->current == NULL);
783 s->current = qemu_mallocz(sizeof(lsi_request));
784 s->current->tag = s->select_tag;
785 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun,
786 s->current);
787
788 n = scsi_req_enqueue(s->current->req, buf);
789 if (n) {
790 if (n > 0) {
791 lsi_set_phase(s, PHASE_DI);
792 } else if (n < 0) {
793 lsi_set_phase(s, PHASE_DO);
794 }
795 scsi_req_continue(s->current->req);
796 }
797 if (!s->command_complete) {
798 if (n) {
799 /* Command did not complete immediately so disconnect. */
800 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
801 lsi_add_msg_byte(s, 4); /* DISCONNECT */
802 /* wait data */
803 lsi_set_phase(s, PHASE_MI);
804 s->msg_action = 1;
805 lsi_queue_command(s);
806 } else {
807 /* wait command complete */
808 lsi_set_phase(s, PHASE_DI);
809 }
810 }
811 }
812
813 static void lsi_do_status(LSIState *s)
814 {
815 uint8_t status;
816 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
817 if (s->dbc != 1)
818 BADF("Bad Status move\n");
819 s->dbc = 1;
820 status = s->status;
821 s->sfbr = status;
822 cpu_physical_memory_write(s->dnad, &status, 1);
823 lsi_set_phase(s, PHASE_MI);
824 s->msg_action = 1;
825 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
826 }
827
828 static void lsi_do_msgin(LSIState *s)
829 {
830 int len;
831 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
832 s->sfbr = s->msg[0];
833 len = s->msg_len;
834 if (len > s->dbc)
835 len = s->dbc;
836 cpu_physical_memory_write(s->dnad, s->msg, len);
837 /* Linux drivers rely on the last byte being in the SIDL. */
838 s->sidl = s->msg[len - 1];
839 s->msg_len -= len;
840 if (s->msg_len) {
841 memmove(s->msg, s->msg + len, s->msg_len);
842 } else {
843 /* ??? Check if ATN (not yet implemented) is asserted and maybe
844 switch to PHASE_MO. */
845 switch (s->msg_action) {
846 case 0:
847 lsi_set_phase(s, PHASE_CMD);
848 break;
849 case 1:
850 lsi_disconnect(s);
851 break;
852 case 2:
853 lsi_set_phase(s, PHASE_DO);
854 break;
855 case 3:
856 lsi_set_phase(s, PHASE_DI);
857 break;
858 default:
859 abort();
860 }
861 }
862 }
863
864 /* Read the next byte during a MSGOUT phase. */
865 static uint8_t lsi_get_msgbyte(LSIState *s)
866 {
867 uint8_t data;
868 cpu_physical_memory_read(s->dnad, &data, 1);
869 s->dnad++;
870 s->dbc--;
871 return data;
872 }
873
874 /* Skip the next n bytes during a MSGOUT phase. */
875 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
876 {
877 s->dnad += n;
878 s->dbc -= n;
879 }
880
881 static void lsi_do_msgout(LSIState *s)
882 {
883 uint8_t msg;
884 int len;
885 uint32_t current_tag;
886 lsi_request *current_req, *p, *p_next;
887 int id;
888
889 if (s->current) {
890 current_tag = s->current->tag;
891 current_req = s->current;
892 } else {
893 current_tag = s->select_tag;
894 current_req = lsi_find_by_tag(s, current_tag);
895 }
896 id = (current_tag >> 8) & 0xf;
897
898 DPRINTF("MSG out len=%d\n", s->dbc);
899 while (s->dbc) {
900 msg = lsi_get_msgbyte(s);
901 s->sfbr = msg;
902
903 switch (msg) {
904 case 0x04:
905 DPRINTF("MSG: Disconnect\n");
906 lsi_disconnect(s);
907 break;
908 case 0x08:
909 DPRINTF("MSG: No Operation\n");
910 lsi_set_phase(s, PHASE_CMD);
911 break;
912 case 0x01:
913 len = lsi_get_msgbyte(s);
914 msg = lsi_get_msgbyte(s);
915 (void)len; /* avoid a warning about unused variable*/
916 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
917 switch (msg) {
918 case 1:
919 DPRINTF("SDTR (ignored)\n");
920 lsi_skip_msgbytes(s, 2);
921 break;
922 case 3:
923 DPRINTF("WDTR (ignored)\n");
924 lsi_skip_msgbytes(s, 1);
925 break;
926 default:
927 goto bad;
928 }
929 break;
930 case 0x20: /* SIMPLE queue */
931 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
932 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
933 break;
934 case 0x21: /* HEAD of queue */
935 BADF("HEAD queue not implemented\n");
936 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
937 break;
938 case 0x22: /* ORDERED queue */
939 BADF("ORDERED queue not implemented\n");
940 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
941 break;
942 case 0x0d:
943 /* The ABORT TAG message clears the current I/O process only. */
944 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
945 if (current_req) {
946 scsi_req_cancel(current_req->req);
947 }
948 lsi_disconnect(s);
949 break;
950 case 0x06:
951 case 0x0e:
952 case 0x0c:
953 /* The ABORT message clears all I/O processes for the selecting
954 initiator on the specified logical unit of the target. */
955 if (msg == 0x06) {
956 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
957 }
958 /* The CLEAR QUEUE message clears all I/O processes for all
959 initiators on the specified logical unit of the target. */
960 if (msg == 0x0e) {
961 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
962 }
963 /* The BUS DEVICE RESET message clears all I/O processes for all
964 initiators on all logical units of the target. */
965 if (msg == 0x0c) {
966 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
967 }
968
969 /* clear the current I/O process */
970 if (s->current) {
971 scsi_req_cancel(s->current->req);
972 }
973
974 /* As the current implemented devices scsi_disk and scsi_generic
975 only support one LUN, we don't need to keep track of LUNs.
976 Clearing I/O processes for other initiators could be possible
977 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
978 device, but this is currently not implemented (and seems not
979 to be really necessary). So let's simply clear all queued
980 commands for the current device: */
981 id = current_tag & 0x0000ff00;
982 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
983 if ((p->tag & 0x0000ff00) == id) {
984 scsi_req_cancel(p->req);
985 }
986 }
987
988 lsi_disconnect(s);
989 break;
990 default:
991 if ((msg & 0x80) == 0) {
992 goto bad;
993 }
994 s->current_lun = msg & 7;
995 DPRINTF("Select LUN %d\n", s->current_lun);
996 lsi_set_phase(s, PHASE_CMD);
997 break;
998 }
999 }
1000 return;
1001 bad:
1002 BADF("Unimplemented message 0x%02x\n", msg);
1003 lsi_set_phase(s, PHASE_MI);
1004 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1005 s->msg_action = 0;
1006 }
1007
1008 /* Sign extend a 24-bit value. */
1009 static inline int32_t sxt24(int32_t n)
1010 {
1011 return (n << 8) >> 8;
1012 }
1013
1014 #define LSI_BUF_SIZE 4096
1015 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1016 {
1017 int n;
1018 uint8_t buf[LSI_BUF_SIZE];
1019
1020 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1021 while (count) {
1022 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1023 cpu_physical_memory_read(src, buf, n);
1024 cpu_physical_memory_write(dest, buf, n);
1025 src += n;
1026 dest += n;
1027 count -= n;
1028 }
1029 }
1030
1031 static void lsi_wait_reselect(LSIState *s)
1032 {
1033 lsi_request *p;
1034
1035 DPRINTF("Wait Reselect\n");
1036
1037 QTAILQ_FOREACH(p, &s->queue, next) {
1038 if (p->pending) {
1039 lsi_reselect(s, p);
1040 break;
1041 }
1042 }
1043 if (s->current == NULL) {
1044 s->waiting = 1;
1045 }
1046 }
1047
1048 static void lsi_execute_script(LSIState *s)
1049 {
1050 uint32_t insn;
1051 uint32_t addr, addr_high;
1052 int opcode;
1053 int insn_processed = 0;
1054
1055 s->istat1 |= LSI_ISTAT1_SRUN;
1056 again:
1057 insn_processed++;
1058 insn = read_dword(s, s->dsp);
1059 if (!insn) {
1060 /* If we receive an empty opcode increment the DSP by 4 bytes
1061 instead of 8 and execute the next opcode at that location */
1062 s->dsp += 4;
1063 goto again;
1064 }
1065 addr = read_dword(s, s->dsp + 4);
1066 addr_high = 0;
1067 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1068 s->dsps = addr;
1069 s->dcmd = insn >> 24;
1070 s->dsp += 8;
1071 switch (insn >> 30) {
1072 case 0: /* Block move. */
1073 if (s->sist1 & LSI_SIST1_STO) {
1074 DPRINTF("Delayed select timeout\n");
1075 lsi_stop_script(s);
1076 break;
1077 }
1078 s->dbc = insn & 0xffffff;
1079 s->rbc = s->dbc;
1080 /* ??? Set ESA. */
1081 s->ia = s->dsp - 8;
1082 if (insn & (1 << 29)) {
1083 /* Indirect addressing. */
1084 addr = read_dword(s, addr);
1085 } else if (insn & (1 << 28)) {
1086 uint32_t buf[2];
1087 int32_t offset;
1088 /* Table indirect addressing. */
1089
1090 /* 32-bit Table indirect */
1091 offset = sxt24(addr);
1092 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
1093 /* byte count is stored in bits 0:23 only */
1094 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1095 s->rbc = s->dbc;
1096 addr = cpu_to_le32(buf[1]);
1097
1098 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1099 * table, bits [31:24] */
1100 if (lsi_dma_40bit(s))
1101 addr_high = cpu_to_le32(buf[0]) >> 24;
1102 else if (lsi_dma_ti64bit(s)) {
1103 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1104 switch (selector) {
1105 case 0 ... 0x0f:
1106 /* offset index into scratch registers since
1107 * TI64 mode can use registers C to R */
1108 addr_high = s->scratch[2 + selector];
1109 break;
1110 case 0x10:
1111 addr_high = s->mmrs;
1112 break;
1113 case 0x11:
1114 addr_high = s->mmws;
1115 break;
1116 case 0x12:
1117 addr_high = s->sfs;
1118 break;
1119 case 0x13:
1120 addr_high = s->drs;
1121 break;
1122 case 0x14:
1123 addr_high = s->sbms;
1124 break;
1125 case 0x15:
1126 addr_high = s->dbms;
1127 break;
1128 default:
1129 BADF("Illegal selector specified (0x%x > 0x15)"
1130 " for 64-bit DMA block move", selector);
1131 break;
1132 }
1133 }
1134 } else if (lsi_dma_64bit(s)) {
1135 /* fetch a 3rd dword if 64-bit direct move is enabled and
1136 only if we're not doing table indirect or indirect addressing */
1137 s->dbms = read_dword(s, s->dsp);
1138 s->dsp += 4;
1139 s->ia = s->dsp - 12;
1140 }
1141 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1142 DPRINTF("Wrong phase got %d expected %d\n",
1143 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1144 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1145 break;
1146 }
1147 s->dnad = addr;
1148 s->dnad64 = addr_high;
1149 switch (s->sstat1 & 0x7) {
1150 case PHASE_DO:
1151 s->waiting = 2;
1152 lsi_do_dma(s, 1);
1153 if (s->waiting)
1154 s->waiting = 3;
1155 break;
1156 case PHASE_DI:
1157 s->waiting = 2;
1158 lsi_do_dma(s, 0);
1159 if (s->waiting)
1160 s->waiting = 3;
1161 break;
1162 case PHASE_CMD:
1163 lsi_do_command(s);
1164 break;
1165 case PHASE_ST:
1166 lsi_do_status(s);
1167 break;
1168 case PHASE_MO:
1169 lsi_do_msgout(s);
1170 break;
1171 case PHASE_MI:
1172 lsi_do_msgin(s);
1173 break;
1174 default:
1175 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1176 exit(1);
1177 }
1178 s->dfifo = s->dbc & 0xff;
1179 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1180 s->sbc = s->dbc;
1181 s->rbc -= s->dbc;
1182 s->ua = addr + s->dbc;
1183 break;
1184
1185 case 1: /* IO or Read/Write instruction. */
1186 opcode = (insn >> 27) & 7;
1187 if (opcode < 5) {
1188 uint32_t id;
1189
1190 if (insn & (1 << 25)) {
1191 id = read_dword(s, s->dsa + sxt24(insn));
1192 } else {
1193 id = insn;
1194 }
1195 id = (id >> 16) & 0xf;
1196 if (insn & (1 << 26)) {
1197 addr = s->dsp + sxt24(addr);
1198 }
1199 s->dnad = addr;
1200 switch (opcode) {
1201 case 0: /* Select */
1202 s->sdid = id;
1203 if (s->scntl1 & LSI_SCNTL1_CON) {
1204 DPRINTF("Already reselected, jumping to alternative address\n");
1205 s->dsp = s->dnad;
1206 break;
1207 }
1208 s->sstat0 |= LSI_SSTAT0_WOA;
1209 s->scntl1 &= ~LSI_SCNTL1_IARB;
1210 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1211 lsi_bad_selection(s, id);
1212 break;
1213 }
1214 DPRINTF("Selected target %d%s\n",
1215 id, insn & (1 << 3) ? " ATN" : "");
1216 /* ??? Linux drivers compain when this is set. Maybe
1217 it only applies in low-level mode (unimplemented).
1218 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1219 s->select_tag = id << 8;
1220 s->scntl1 |= LSI_SCNTL1_CON;
1221 if (insn & (1 << 3)) {
1222 s->socl |= LSI_SOCL_ATN;
1223 }
1224 lsi_set_phase(s, PHASE_MO);
1225 break;
1226 case 1: /* Disconnect */
1227 DPRINTF("Wait Disconnect\n");
1228 s->scntl1 &= ~LSI_SCNTL1_CON;
1229 break;
1230 case 2: /* Wait Reselect */
1231 if (!lsi_irq_on_rsl(s)) {
1232 lsi_wait_reselect(s);
1233 }
1234 break;
1235 case 3: /* Set */
1236 DPRINTF("Set%s%s%s%s\n",
1237 insn & (1 << 3) ? " ATN" : "",
1238 insn & (1 << 6) ? " ACK" : "",
1239 insn & (1 << 9) ? " TM" : "",
1240 insn & (1 << 10) ? " CC" : "");
1241 if (insn & (1 << 3)) {
1242 s->socl |= LSI_SOCL_ATN;
1243 lsi_set_phase(s, PHASE_MO);
1244 }
1245 if (insn & (1 << 9)) {
1246 BADF("Target mode not implemented\n");
1247 exit(1);
1248 }
1249 if (insn & (1 << 10))
1250 s->carry = 1;
1251 break;
1252 case 4: /* Clear */
1253 DPRINTF("Clear%s%s%s%s\n",
1254 insn & (1 << 3) ? " ATN" : "",
1255 insn & (1 << 6) ? " ACK" : "",
1256 insn & (1 << 9) ? " TM" : "",
1257 insn & (1 << 10) ? " CC" : "");
1258 if (insn & (1 << 3)) {
1259 s->socl &= ~LSI_SOCL_ATN;
1260 }
1261 if (insn & (1 << 10))
1262 s->carry = 0;
1263 break;
1264 }
1265 } else {
1266 uint8_t op0;
1267 uint8_t op1;
1268 uint8_t data8;
1269 int reg;
1270 int operator;
1271 #ifdef DEBUG_LSI
1272 static const char *opcode_names[3] =
1273 {"Write", "Read", "Read-Modify-Write"};
1274 static const char *operator_names[8] =
1275 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1276 #endif
1277
1278 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1279 data8 = (insn >> 8) & 0xff;
1280 opcode = (insn >> 27) & 7;
1281 operator = (insn >> 24) & 7;
1282 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1283 opcode_names[opcode - 5], reg,
1284 operator_names[operator], data8, s->sfbr,
1285 (insn & (1 << 23)) ? " SFBR" : "");
1286 op0 = op1 = 0;
1287 switch (opcode) {
1288 case 5: /* From SFBR */
1289 op0 = s->sfbr;
1290 op1 = data8;
1291 break;
1292 case 6: /* To SFBR */
1293 if (operator)
1294 op0 = lsi_reg_readb(s, reg);
1295 op1 = data8;
1296 break;
1297 case 7: /* Read-modify-write */
1298 if (operator)
1299 op0 = lsi_reg_readb(s, reg);
1300 if (insn & (1 << 23)) {
1301 op1 = s->sfbr;
1302 } else {
1303 op1 = data8;
1304 }
1305 break;
1306 }
1307
1308 switch (operator) {
1309 case 0: /* move */
1310 op0 = op1;
1311 break;
1312 case 1: /* Shift left */
1313 op1 = op0 >> 7;
1314 op0 = (op0 << 1) | s->carry;
1315 s->carry = op1;
1316 break;
1317 case 2: /* OR */
1318 op0 |= op1;
1319 break;
1320 case 3: /* XOR */
1321 op0 ^= op1;
1322 break;
1323 case 4: /* AND */
1324 op0 &= op1;
1325 break;
1326 case 5: /* SHR */
1327 op1 = op0 & 1;
1328 op0 = (op0 >> 1) | (s->carry << 7);
1329 s->carry = op1;
1330 break;
1331 case 6: /* ADD */
1332 op0 += op1;
1333 s->carry = op0 < op1;
1334 break;
1335 case 7: /* ADC */
1336 op0 += op1 + s->carry;
1337 if (s->carry)
1338 s->carry = op0 <= op1;
1339 else
1340 s->carry = op0 < op1;
1341 break;
1342 }
1343
1344 switch (opcode) {
1345 case 5: /* From SFBR */
1346 case 7: /* Read-modify-write */
1347 lsi_reg_writeb(s, reg, op0);
1348 break;
1349 case 6: /* To SFBR */
1350 s->sfbr = op0;
1351 break;
1352 }
1353 }
1354 break;
1355
1356 case 2: /* Transfer Control. */
1357 {
1358 int cond;
1359 int jmp;
1360
1361 if ((insn & 0x002e0000) == 0) {
1362 DPRINTF("NOP\n");
1363 break;
1364 }
1365 if (s->sist1 & LSI_SIST1_STO) {
1366 DPRINTF("Delayed select timeout\n");
1367 lsi_stop_script(s);
1368 break;
1369 }
1370 cond = jmp = (insn & (1 << 19)) != 0;
1371 if (cond == jmp && (insn & (1 << 21))) {
1372 DPRINTF("Compare carry %d\n", s->carry == jmp);
1373 cond = s->carry != 0;
1374 }
1375 if (cond == jmp && (insn & (1 << 17))) {
1376 DPRINTF("Compare phase %d %c= %d\n",
1377 (s->sstat1 & PHASE_MASK),
1378 jmp ? '=' : '!',
1379 ((insn >> 24) & 7));
1380 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1381 }
1382 if (cond == jmp && (insn & (1 << 18))) {
1383 uint8_t mask;
1384
1385 mask = (~insn >> 8) & 0xff;
1386 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1387 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1388 cond = (s->sfbr & mask) == (insn & mask);
1389 }
1390 if (cond == jmp) {
1391 if (insn & (1 << 23)) {
1392 /* Relative address. */
1393 addr = s->dsp + sxt24(addr);
1394 }
1395 switch ((insn >> 27) & 7) {
1396 case 0: /* Jump */
1397 DPRINTF("Jump to 0x%08x\n", addr);
1398 s->dsp = addr;
1399 break;
1400 case 1: /* Call */
1401 DPRINTF("Call 0x%08x\n", addr);
1402 s->temp = s->dsp;
1403 s->dsp = addr;
1404 break;
1405 case 2: /* Return */
1406 DPRINTF("Return to 0x%08x\n", s->temp);
1407 s->dsp = s->temp;
1408 break;
1409 case 3: /* Interrupt */
1410 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1411 if ((insn & (1 << 20)) != 0) {
1412 s->istat0 |= LSI_ISTAT0_INTF;
1413 lsi_update_irq(s);
1414 } else {
1415 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1416 }
1417 break;
1418 default:
1419 DPRINTF("Illegal transfer control\n");
1420 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1421 break;
1422 }
1423 } else {
1424 DPRINTF("Control condition failed\n");
1425 }
1426 }
1427 break;
1428
1429 case 3:
1430 if ((insn & (1 << 29)) == 0) {
1431 /* Memory move. */
1432 uint32_t dest;
1433 /* ??? The docs imply the destination address is loaded into
1434 the TEMP register. However the Linux drivers rely on
1435 the value being presrved. */
1436 dest = read_dword(s, s->dsp);
1437 s->dsp += 4;
1438 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1439 } else {
1440 uint8_t data[7];
1441 int reg;
1442 int n;
1443 int i;
1444
1445 if (insn & (1 << 28)) {
1446 addr = s->dsa + sxt24(addr);
1447 }
1448 n = (insn & 7);
1449 reg = (insn >> 16) & 0xff;
1450 if (insn & (1 << 24)) {
1451 cpu_physical_memory_read(addr, data, n);
1452 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1453 addr, *(int *)data);
1454 for (i = 0; i < n; i++) {
1455 lsi_reg_writeb(s, reg + i, data[i]);
1456 }
1457 } else {
1458 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1459 for (i = 0; i < n; i++) {
1460 data[i] = lsi_reg_readb(s, reg + i);
1461 }
1462 cpu_physical_memory_write(addr, data, n);
1463 }
1464 }
1465 }
1466 if (insn_processed > 10000 && !s->waiting) {
1467 /* Some windows drivers make the device spin waiting for a memory
1468 location to change. If we have been executed a lot of code then
1469 assume this is the case and force an unexpected device disconnect.
1470 This is apparently sufficient to beat the drivers into submission.
1471 */
1472 if (!(s->sien0 & LSI_SIST0_UDC))
1473 fprintf(stderr, "inf. loop with UDC masked\n");
1474 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1475 lsi_disconnect(s);
1476 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1477 if (s->dcntl & LSI_DCNTL_SSM) {
1478 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1479 } else {
1480 goto again;
1481 }
1482 }
1483 DPRINTF("SCRIPTS execution stopped\n");
1484 }
1485
1486 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1487 {
1488 uint8_t tmp;
1489 #define CASE_GET_REG24(name, addr) \
1490 case addr: return s->name & 0xff; \
1491 case addr + 1: return (s->name >> 8) & 0xff; \
1492 case addr + 2: return (s->name >> 16) & 0xff;
1493
1494 #define CASE_GET_REG32(name, addr) \
1495 case addr: return s->name & 0xff; \
1496 case addr + 1: return (s->name >> 8) & 0xff; \
1497 case addr + 2: return (s->name >> 16) & 0xff; \
1498 case addr + 3: return (s->name >> 24) & 0xff;
1499
1500 #ifdef DEBUG_LSI_REG
1501 DPRINTF("Read reg %x\n", offset);
1502 #endif
1503 switch (offset) {
1504 case 0x00: /* SCNTL0 */
1505 return s->scntl0;
1506 case 0x01: /* SCNTL1 */
1507 return s->scntl1;
1508 case 0x02: /* SCNTL2 */
1509 return s->scntl2;
1510 case 0x03: /* SCNTL3 */
1511 return s->scntl3;
1512 case 0x04: /* SCID */
1513 return s->scid;
1514 case 0x05: /* SXFER */
1515 return s->sxfer;
1516 case 0x06: /* SDID */
1517 return s->sdid;
1518 case 0x07: /* GPREG0 */
1519 return 0x7f;
1520 case 0x08: /* Revision ID */
1521 return 0x00;
1522 case 0xa: /* SSID */
1523 return s->ssid;
1524 case 0xb: /* SBCL */
1525 /* ??? This is not correct. However it's (hopefully) only
1526 used for diagnostics, so should be ok. */
1527 return 0;
1528 case 0xc: /* DSTAT */
1529 tmp = s->dstat | 0x80;
1530 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1531 s->dstat = 0;
1532 lsi_update_irq(s);
1533 return tmp;
1534 case 0x0d: /* SSTAT0 */
1535 return s->sstat0;
1536 case 0x0e: /* SSTAT1 */
1537 return s->sstat1;
1538 case 0x0f: /* SSTAT2 */
1539 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1540 CASE_GET_REG32(dsa, 0x10)
1541 case 0x14: /* ISTAT0 */
1542 return s->istat0;
1543 case 0x15: /* ISTAT1 */
1544 return s->istat1;
1545 case 0x16: /* MBOX0 */
1546 return s->mbox0;
1547 case 0x17: /* MBOX1 */
1548 return s->mbox1;
1549 case 0x18: /* CTEST0 */
1550 return 0xff;
1551 case 0x19: /* CTEST1 */
1552 return 0;
1553 case 0x1a: /* CTEST2 */
1554 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1555 if (s->istat0 & LSI_ISTAT0_SIGP) {
1556 s->istat0 &= ~LSI_ISTAT0_SIGP;
1557 tmp |= LSI_CTEST2_SIGP;
1558 }
1559 return tmp;
1560 case 0x1b: /* CTEST3 */
1561 return s->ctest3;
1562 CASE_GET_REG32(temp, 0x1c)
1563 case 0x20: /* DFIFO */
1564 return 0;
1565 case 0x21: /* CTEST4 */
1566 return s->ctest4;
1567 case 0x22: /* CTEST5 */
1568 return s->ctest5;
1569 case 0x23: /* CTEST6 */
1570 return 0;
1571 CASE_GET_REG24(dbc, 0x24)
1572 case 0x27: /* DCMD */
1573 return s->dcmd;
1574 CASE_GET_REG32(dnad, 0x28)
1575 CASE_GET_REG32(dsp, 0x2c)
1576 CASE_GET_REG32(dsps, 0x30)
1577 CASE_GET_REG32(scratch[0], 0x34)
1578 case 0x38: /* DMODE */
1579 return s->dmode;
1580 case 0x39: /* DIEN */
1581 return s->dien;
1582 case 0x3a: /* SBR */
1583 return s->sbr;
1584 case 0x3b: /* DCNTL */
1585 return s->dcntl;
1586 case 0x40: /* SIEN0 */
1587 return s->sien0;
1588 case 0x41: /* SIEN1 */
1589 return s->sien1;
1590 case 0x42: /* SIST0 */
1591 tmp = s->sist0;
1592 s->sist0 = 0;
1593 lsi_update_irq(s);
1594 return tmp;
1595 case 0x43: /* SIST1 */
1596 tmp = s->sist1;
1597 s->sist1 = 0;
1598 lsi_update_irq(s);
1599 return tmp;
1600 case 0x46: /* MACNTL */
1601 return 0x0f;
1602 case 0x47: /* GPCNTL0 */
1603 return 0x0f;
1604 case 0x48: /* STIME0 */
1605 return s->stime0;
1606 case 0x4a: /* RESPID0 */
1607 return s->respid0;
1608 case 0x4b: /* RESPID1 */
1609 return s->respid1;
1610 case 0x4d: /* STEST1 */
1611 return s->stest1;
1612 case 0x4e: /* STEST2 */
1613 return s->stest2;
1614 case 0x4f: /* STEST3 */
1615 return s->stest3;
1616 case 0x50: /* SIDL */
1617 /* This is needed by the linux drivers. We currently only update it
1618 during the MSG IN phase. */
1619 return s->sidl;
1620 case 0x52: /* STEST4 */
1621 return 0xe0;
1622 case 0x56: /* CCNTL0 */
1623 return s->ccntl0;
1624 case 0x57: /* CCNTL1 */
1625 return s->ccntl1;
1626 case 0x58: /* SBDL */
1627 /* Some drivers peek at the data bus during the MSG IN phase. */
1628 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1629 return s->msg[0];
1630 return 0;
1631 case 0x59: /* SBDL high */
1632 return 0;
1633 CASE_GET_REG32(mmrs, 0xa0)
1634 CASE_GET_REG32(mmws, 0xa4)
1635 CASE_GET_REG32(sfs, 0xa8)
1636 CASE_GET_REG32(drs, 0xac)
1637 CASE_GET_REG32(sbms, 0xb0)
1638 CASE_GET_REG32(dbms, 0xb4)
1639 CASE_GET_REG32(dnad64, 0xb8)
1640 CASE_GET_REG32(pmjad1, 0xc0)
1641 CASE_GET_REG32(pmjad2, 0xc4)
1642 CASE_GET_REG32(rbc, 0xc8)
1643 CASE_GET_REG32(ua, 0xcc)
1644 CASE_GET_REG32(ia, 0xd4)
1645 CASE_GET_REG32(sbc, 0xd8)
1646 CASE_GET_REG32(csbc, 0xdc)
1647 }
1648 if (offset >= 0x5c && offset < 0xa0) {
1649 int n;
1650 int shift;
1651 n = (offset - 0x58) >> 2;
1652 shift = (offset & 3) * 8;
1653 return (s->scratch[n] >> shift) & 0xff;
1654 }
1655 BADF("readb 0x%x\n", offset);
1656 exit(1);
1657 #undef CASE_GET_REG24
1658 #undef CASE_GET_REG32
1659 }
1660
1661 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1662 {
1663 #define CASE_SET_REG24(name, addr) \
1664 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1665 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1666 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1667
1668 #define CASE_SET_REG32(name, addr) \
1669 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1670 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1671 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1672 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1673
1674 #ifdef DEBUG_LSI_REG
1675 DPRINTF("Write reg %x = %02x\n", offset, val);
1676 #endif
1677 switch (offset) {
1678 case 0x00: /* SCNTL0 */
1679 s->scntl0 = val;
1680 if (val & LSI_SCNTL0_START) {
1681 BADF("Start sequence not implemented\n");
1682 }
1683 break;
1684 case 0x01: /* SCNTL1 */
1685 s->scntl1 = val & ~LSI_SCNTL1_SST;
1686 if (val & LSI_SCNTL1_IARB) {
1687 BADF("Immediate Arbritration not implemented\n");
1688 }
1689 if (val & LSI_SCNTL1_RST) {
1690 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1691 DeviceState *dev;
1692 int id;
1693
1694 for (id = 0; id < s->bus.ndev; id++) {
1695 if (s->bus.devs[id]) {
1696 dev = &s->bus.devs[id]->qdev;
1697 dev->info->reset(dev);
1698 }
1699 }
1700 s->sstat0 |= LSI_SSTAT0_RST;
1701 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1702 }
1703 } else {
1704 s->sstat0 &= ~LSI_SSTAT0_RST;
1705 }
1706 break;
1707 case 0x02: /* SCNTL2 */
1708 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1709 s->scntl2 = val;
1710 break;
1711 case 0x03: /* SCNTL3 */
1712 s->scntl3 = val;
1713 break;
1714 case 0x04: /* SCID */
1715 s->scid = val;
1716 break;
1717 case 0x05: /* SXFER */
1718 s->sxfer = val;
1719 break;
1720 case 0x06: /* SDID */
1721 if ((val & 0xf) != (s->ssid & 0xf))
1722 BADF("Destination ID does not match SSID\n");
1723 s->sdid = val & 0xf;
1724 break;
1725 case 0x07: /* GPREG0 */
1726 break;
1727 case 0x08: /* SFBR */
1728 /* The CPU is not allowed to write to this register. However the
1729 SCRIPTS register move instructions are. */
1730 s->sfbr = val;
1731 break;
1732 case 0x0a: case 0x0b:
1733 /* Openserver writes to these readonly registers on startup */
1734 return;
1735 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1736 /* Linux writes to these readonly registers on startup. */
1737 return;
1738 CASE_SET_REG32(dsa, 0x10)
1739 case 0x14: /* ISTAT0 */
1740 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1741 if (val & LSI_ISTAT0_ABRT) {
1742 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1743 }
1744 if (val & LSI_ISTAT0_INTF) {
1745 s->istat0 &= ~LSI_ISTAT0_INTF;
1746 lsi_update_irq(s);
1747 }
1748 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1749 DPRINTF("Woken by SIGP\n");
1750 s->waiting = 0;
1751 s->dsp = s->dnad;
1752 lsi_execute_script(s);
1753 }
1754 if (val & LSI_ISTAT0_SRST) {
1755 lsi_soft_reset(s);
1756 }
1757 break;
1758 case 0x16: /* MBOX0 */
1759 s->mbox0 = val;
1760 break;
1761 case 0x17: /* MBOX1 */
1762 s->mbox1 = val;
1763 break;
1764 case 0x1a: /* CTEST2 */
1765 s->ctest2 = val & LSI_CTEST2_PCICIE;
1766 break;
1767 case 0x1b: /* CTEST3 */
1768 s->ctest3 = val & 0x0f;
1769 break;
1770 CASE_SET_REG32(temp, 0x1c)
1771 case 0x21: /* CTEST4 */
1772 if (val & 7) {
1773 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1774 }
1775 s->ctest4 = val;
1776 break;
1777 case 0x22: /* CTEST5 */
1778 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1779 BADF("CTEST5 DMA increment not implemented\n");
1780 }
1781 s->ctest5 = val;
1782 break;
1783 CASE_SET_REG24(dbc, 0x24)
1784 CASE_SET_REG32(dnad, 0x28)
1785 case 0x2c: /* DSP[0:7] */
1786 s->dsp &= 0xffffff00;
1787 s->dsp |= val;
1788 break;
1789 case 0x2d: /* DSP[8:15] */
1790 s->dsp &= 0xffff00ff;
1791 s->dsp |= val << 8;
1792 break;
1793 case 0x2e: /* DSP[16:23] */
1794 s->dsp &= 0xff00ffff;
1795 s->dsp |= val << 16;
1796 break;
1797 case 0x2f: /* DSP[24:31] */
1798 s->dsp &= 0x00ffffff;
1799 s->dsp |= val << 24;
1800 if ((s->dmode & LSI_DMODE_MAN) == 0
1801 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1802 lsi_execute_script(s);
1803 break;
1804 CASE_SET_REG32(dsps, 0x30)
1805 CASE_SET_REG32(scratch[0], 0x34)
1806 case 0x38: /* DMODE */
1807 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1808 BADF("IO mappings not implemented\n");
1809 }
1810 s->dmode = val;
1811 break;
1812 case 0x39: /* DIEN */
1813 s->dien = val;
1814 lsi_update_irq(s);
1815 break;
1816 case 0x3a: /* SBR */
1817 s->sbr = val;
1818 break;
1819 case 0x3b: /* DCNTL */
1820 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1821 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1822 lsi_execute_script(s);
1823 break;
1824 case 0x40: /* SIEN0 */
1825 s->sien0 = val;
1826 lsi_update_irq(s);
1827 break;
1828 case 0x41: /* SIEN1 */
1829 s->sien1 = val;
1830 lsi_update_irq(s);
1831 break;
1832 case 0x47: /* GPCNTL0 */
1833 break;
1834 case 0x48: /* STIME0 */
1835 s->stime0 = val;
1836 break;
1837 case 0x49: /* STIME1 */
1838 if (val & 0xf) {
1839 DPRINTF("General purpose timer not implemented\n");
1840 /* ??? Raising the interrupt immediately seems to be sufficient
1841 to keep the FreeBSD driver happy. */
1842 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1843 }
1844 break;
1845 case 0x4a: /* RESPID0 */
1846 s->respid0 = val;
1847 break;
1848 case 0x4b: /* RESPID1 */
1849 s->respid1 = val;
1850 break;
1851 case 0x4d: /* STEST1 */
1852 s->stest1 = val;
1853 break;
1854 case 0x4e: /* STEST2 */
1855 if (val & 1) {
1856 BADF("Low level mode not implemented\n");
1857 }
1858 s->stest2 = val;
1859 break;
1860 case 0x4f: /* STEST3 */
1861 if (val & 0x41) {
1862 BADF("SCSI FIFO test mode not implemented\n");
1863 }
1864 s->stest3 = val;
1865 break;
1866 case 0x56: /* CCNTL0 */
1867 s->ccntl0 = val;
1868 break;
1869 case 0x57: /* CCNTL1 */
1870 s->ccntl1 = val;
1871 break;
1872 CASE_SET_REG32(mmrs, 0xa0)
1873 CASE_SET_REG32(mmws, 0xa4)
1874 CASE_SET_REG32(sfs, 0xa8)
1875 CASE_SET_REG32(drs, 0xac)
1876 CASE_SET_REG32(sbms, 0xb0)
1877 CASE_SET_REG32(dbms, 0xb4)
1878 CASE_SET_REG32(dnad64, 0xb8)
1879 CASE_SET_REG32(pmjad1, 0xc0)
1880 CASE_SET_REG32(pmjad2, 0xc4)
1881 CASE_SET_REG32(rbc, 0xc8)
1882 CASE_SET_REG32(ua, 0xcc)
1883 CASE_SET_REG32(ia, 0xd4)
1884 CASE_SET_REG32(sbc, 0xd8)
1885 CASE_SET_REG32(csbc, 0xdc)
1886 default:
1887 if (offset >= 0x5c && offset < 0xa0) {
1888 int n;
1889 int shift;
1890 n = (offset - 0x58) >> 2;
1891 shift = (offset & 3) * 8;
1892 s->scratch[n] &= ~(0xff << shift);
1893 s->scratch[n] |= (val & 0xff) << shift;
1894 } else {
1895 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1896 }
1897 }
1898 #undef CASE_SET_REG24
1899 #undef CASE_SET_REG32
1900 }
1901
1902 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1903 {
1904 LSIState *s = opaque;
1905
1906 lsi_reg_writeb(s, addr & 0xff, val);
1907 }
1908
1909 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1910 {
1911 LSIState *s = opaque;
1912
1913 addr &= 0xff;
1914 lsi_reg_writeb(s, addr, val & 0xff);
1915 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1916 }
1917
1918 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1919 {
1920 LSIState *s = opaque;
1921
1922 addr &= 0xff;
1923 lsi_reg_writeb(s, addr, val & 0xff);
1924 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1925 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1926 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1927 }
1928
1929 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1930 {
1931 LSIState *s = opaque;
1932
1933 return lsi_reg_readb(s, addr & 0xff);
1934 }
1935
1936 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1937 {
1938 LSIState *s = opaque;
1939 uint32_t val;
1940
1941 addr &= 0xff;
1942 val = lsi_reg_readb(s, addr);
1943 val |= lsi_reg_readb(s, addr + 1) << 8;
1944 return val;
1945 }
1946
1947 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1948 {
1949 LSIState *s = opaque;
1950 uint32_t val;
1951 addr &= 0xff;
1952 val = lsi_reg_readb(s, addr);
1953 val |= lsi_reg_readb(s, addr + 1) << 8;
1954 val |= lsi_reg_readb(s, addr + 2) << 16;
1955 val |= lsi_reg_readb(s, addr + 3) << 24;
1956 return val;
1957 }
1958
1959 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1960 lsi_mmio_readb,
1961 lsi_mmio_readw,
1962 lsi_mmio_readl,
1963 };
1964
1965 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1966 lsi_mmio_writeb,
1967 lsi_mmio_writew,
1968 lsi_mmio_writel,
1969 };
1970
1971 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1972 {
1973 LSIState *s = opaque;
1974 uint32_t newval;
1975 int shift;
1976
1977 addr &= 0x1fff;
1978 newval = s->script_ram[addr >> 2];
1979 shift = (addr & 3) * 8;
1980 newval &= ~(0xff << shift);
1981 newval |= val << shift;
1982 s->script_ram[addr >> 2] = newval;
1983 }
1984
1985 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1986 {
1987 LSIState *s = opaque;
1988 uint32_t newval;
1989
1990 addr &= 0x1fff;
1991 newval = s->script_ram[addr >> 2];
1992 if (addr & 2) {
1993 newval = (newval & 0xffff) | (val << 16);
1994 } else {
1995 newval = (newval & 0xffff0000) | val;
1996 }
1997 s->script_ram[addr >> 2] = newval;
1998 }
1999
2000
2001 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2002 {
2003 LSIState *s = opaque;
2004
2005 addr &= 0x1fff;
2006 s->script_ram[addr >> 2] = val;
2007 }
2008
2009 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
2010 {
2011 LSIState *s = opaque;
2012 uint32_t val;
2013
2014 addr &= 0x1fff;
2015 val = s->script_ram[addr >> 2];
2016 val >>= (addr & 3) * 8;
2017 return val & 0xff;
2018 }
2019
2020 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
2021 {
2022 LSIState *s = opaque;
2023 uint32_t val;
2024
2025 addr &= 0x1fff;
2026 val = s->script_ram[addr >> 2];
2027 if (addr & 2)
2028 val >>= 16;
2029 return val;
2030 }
2031
2032 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
2033 {
2034 LSIState *s = opaque;
2035
2036 addr &= 0x1fff;
2037 return s->script_ram[addr >> 2];
2038 }
2039
2040 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
2041 lsi_ram_readb,
2042 lsi_ram_readw,
2043 lsi_ram_readl,
2044 };
2045
2046 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
2047 lsi_ram_writeb,
2048 lsi_ram_writew,
2049 lsi_ram_writel,
2050 };
2051
2052 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
2053 {
2054 LSIState *s = opaque;
2055 return lsi_reg_readb(s, addr & 0xff);
2056 }
2057
2058 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
2059 {
2060 LSIState *s = opaque;
2061 uint32_t val;
2062 addr &= 0xff;
2063 val = lsi_reg_readb(s, addr);
2064 val |= lsi_reg_readb(s, addr + 1) << 8;
2065 return val;
2066 }
2067
2068 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
2069 {
2070 LSIState *s = opaque;
2071 uint32_t val;
2072 addr &= 0xff;
2073 val = lsi_reg_readb(s, addr);
2074 val |= lsi_reg_readb(s, addr + 1) << 8;
2075 val |= lsi_reg_readb(s, addr + 2) << 16;
2076 val |= lsi_reg_readb(s, addr + 3) << 24;
2077 return val;
2078 }
2079
2080 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
2081 {
2082 LSIState *s = opaque;
2083 lsi_reg_writeb(s, addr & 0xff, val);
2084 }
2085
2086 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
2087 {
2088 LSIState *s = opaque;
2089 addr &= 0xff;
2090 lsi_reg_writeb(s, addr, val & 0xff);
2091 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2092 }
2093
2094 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
2095 {
2096 LSIState *s = opaque;
2097 addr &= 0xff;
2098 lsi_reg_writeb(s, addr, val & 0xff);
2099 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2100 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
2101 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
2102 }
2103
2104 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
2105 pcibus_t addr, pcibus_t size, int type)
2106 {
2107 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2108
2109 DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
2110
2111 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
2112 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
2113 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
2114 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
2115 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
2116 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
2117 }
2118
2119 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
2120 pcibus_t addr, pcibus_t size, int type)
2121 {
2122 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2123
2124 DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
2125 s->script_ram_base = addr;
2126 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
2127 }
2128
2129 static void lsi_scsi_reset(DeviceState *dev)
2130 {
2131 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
2132
2133 lsi_soft_reset(s);
2134 }
2135
2136 static void lsi_pre_save(void *opaque)
2137 {
2138 LSIState *s = opaque;
2139
2140 if (s->current) {
2141 assert(s->current->dma_buf == NULL);
2142 assert(s->current->dma_len == 0);
2143 }
2144 assert(QTAILQ_EMPTY(&s->queue));
2145 }
2146
2147 static const VMStateDescription vmstate_lsi_scsi = {
2148 .name = "lsiscsi",
2149 .version_id = 0,
2150 .minimum_version_id = 0,
2151 .minimum_version_id_old = 0,
2152 .pre_save = lsi_pre_save,
2153 .fields = (VMStateField []) {
2154 VMSTATE_PCI_DEVICE(dev, LSIState),
2155
2156 VMSTATE_INT32(carry, LSIState),
2157 VMSTATE_INT32(status, LSIState),
2158 VMSTATE_INT32(msg_action, LSIState),
2159 VMSTATE_INT32(msg_len, LSIState),
2160 VMSTATE_BUFFER(msg, LSIState),
2161 VMSTATE_INT32(waiting, LSIState),
2162
2163 VMSTATE_UINT32(dsa, LSIState),
2164 VMSTATE_UINT32(temp, LSIState),
2165 VMSTATE_UINT32(dnad, LSIState),
2166 VMSTATE_UINT32(dbc, LSIState),
2167 VMSTATE_UINT8(istat0, LSIState),
2168 VMSTATE_UINT8(istat1, LSIState),
2169 VMSTATE_UINT8(dcmd, LSIState),
2170 VMSTATE_UINT8(dstat, LSIState),
2171 VMSTATE_UINT8(dien, LSIState),
2172 VMSTATE_UINT8(sist0, LSIState),
2173 VMSTATE_UINT8(sist1, LSIState),
2174 VMSTATE_UINT8(sien0, LSIState),
2175 VMSTATE_UINT8(sien1, LSIState),
2176 VMSTATE_UINT8(mbox0, LSIState),
2177 VMSTATE_UINT8(mbox1, LSIState),
2178 VMSTATE_UINT8(dfifo, LSIState),
2179 VMSTATE_UINT8(ctest2, LSIState),
2180 VMSTATE_UINT8(ctest3, LSIState),
2181 VMSTATE_UINT8(ctest4, LSIState),
2182 VMSTATE_UINT8(ctest5, LSIState),
2183 VMSTATE_UINT8(ccntl0, LSIState),
2184 VMSTATE_UINT8(ccntl1, LSIState),
2185 VMSTATE_UINT32(dsp, LSIState),
2186 VMSTATE_UINT32(dsps, LSIState),
2187 VMSTATE_UINT8(dmode, LSIState),
2188 VMSTATE_UINT8(dcntl, LSIState),
2189 VMSTATE_UINT8(scntl0, LSIState),
2190 VMSTATE_UINT8(scntl1, LSIState),
2191 VMSTATE_UINT8(scntl2, LSIState),
2192 VMSTATE_UINT8(scntl3, LSIState),
2193 VMSTATE_UINT8(sstat0, LSIState),
2194 VMSTATE_UINT8(sstat1, LSIState),
2195 VMSTATE_UINT8(scid, LSIState),
2196 VMSTATE_UINT8(sxfer, LSIState),
2197 VMSTATE_UINT8(socl, LSIState),
2198 VMSTATE_UINT8(sdid, LSIState),
2199 VMSTATE_UINT8(ssid, LSIState),
2200 VMSTATE_UINT8(sfbr, LSIState),
2201 VMSTATE_UINT8(stest1, LSIState),
2202 VMSTATE_UINT8(stest2, LSIState),
2203 VMSTATE_UINT8(stest3, LSIState),
2204 VMSTATE_UINT8(sidl, LSIState),
2205 VMSTATE_UINT8(stime0, LSIState),
2206 VMSTATE_UINT8(respid0, LSIState),
2207 VMSTATE_UINT8(respid1, LSIState),
2208 VMSTATE_UINT32(mmrs, LSIState),
2209 VMSTATE_UINT32(mmws, LSIState),
2210 VMSTATE_UINT32(sfs, LSIState),
2211 VMSTATE_UINT32(drs, LSIState),
2212 VMSTATE_UINT32(sbms, LSIState),
2213 VMSTATE_UINT32(dbms, LSIState),
2214 VMSTATE_UINT32(dnad64, LSIState),
2215 VMSTATE_UINT32(pmjad1, LSIState),
2216 VMSTATE_UINT32(pmjad2, LSIState),
2217 VMSTATE_UINT32(rbc, LSIState),
2218 VMSTATE_UINT32(ua, LSIState),
2219 VMSTATE_UINT32(ia, LSIState),
2220 VMSTATE_UINT32(sbc, LSIState),
2221 VMSTATE_UINT32(csbc, LSIState),
2222 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2223 VMSTATE_UINT8(sbr, LSIState),
2224
2225 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2226 VMSTATE_END_OF_LIST()
2227 }
2228 };
2229
2230 static int lsi_scsi_uninit(PCIDevice *d)
2231 {
2232 LSIState *s = DO_UPCAST(LSIState, dev, d);
2233
2234 cpu_unregister_io_memory(s->mmio_io_addr);
2235 cpu_unregister_io_memory(s->ram_io_addr);
2236
2237 return 0;
2238 }
2239
2240 static const struct SCSIBusOps lsi_scsi_ops = {
2241 .transfer_data = lsi_transfer_data,
2242 .complete = lsi_command_complete,
2243 .cancel = lsi_request_cancelled
2244 };
2245
2246 static int lsi_scsi_init(PCIDevice *dev)
2247 {
2248 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2249 uint8_t *pci_conf;
2250
2251 pci_conf = s->dev.config;
2252
2253 /* PCI latency timer = 255 */
2254 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2255 /* TODO: RST# value should be 0 */
2256 /* Interrupt pin 1 */
2257 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2258
2259 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2260 lsi_mmio_writefn, s,
2261 DEVICE_NATIVE_ENDIAN);
2262 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2263 lsi_ram_writefn, s,
2264 DEVICE_NATIVE_ENDIAN);
2265
2266 pci_register_bar(&s->dev, 0, 256,
2267 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2268 pci_register_bar_simple(&s->dev, 1, 0x400, 0, s->mmio_io_addr);
2269 pci_register_bar(&s->dev, 2, 0x2000,
2270 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2271 QTAILQ_INIT(&s->queue);
2272
2273 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, &lsi_scsi_ops);
2274 if (!dev->qdev.hotplugged) {
2275 return scsi_bus_legacy_handle_cmdline(&s->bus);
2276 }
2277 return 0;
2278 }
2279
2280 static PCIDeviceInfo lsi_info = {
2281 .qdev.name = "lsi53c895a",
2282 .qdev.alias = "lsi",
2283 .qdev.size = sizeof(LSIState),
2284 .qdev.reset = lsi_scsi_reset,
2285 .qdev.vmsd = &vmstate_lsi_scsi,
2286 .init = lsi_scsi_init,
2287 .exit = lsi_scsi_uninit,
2288 .vendor_id = PCI_VENDOR_ID_LSI_LOGIC,
2289 .device_id = PCI_DEVICE_ID_LSI_53C895A,
2290 .class_id = PCI_CLASS_STORAGE_SCSI,
2291 .subsystem_id = 0x1000,
2292 };
2293
2294 static void lsi53c895a_register_devices(void)
2295 {
2296 pci_qdev_register(&lsi_info);
2297 }
2298
2299 device_init(lsi53c895a_register_devices);
various patches