?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
compile -fsdev and -virtfs cmd line options unconditionally.
[qemu/mdroth.git] / hw / lsi53c895a.c
blobbd7b661426023929d58f0e1748dc54ae3a1ff436
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 uint32_t tag;
178 uint32_t dma_len;
179 uint8_t *dma_buf;
180 uint32_t pending;
181 int out;
182 QTAILQ_ENTRY(lsi_request) next;
183 } lsi_request;
184
185 typedef struct {
186 PCIDevice dev;
187 int mmio_io_addr;
188 int ram_io_addr;
189 uint32_t script_ram_base;
190
191 int carry; /* ??? Should this be an a visible register somewhere? */
192 int sense;
193 /* Action to take at the end of a MSG IN phase.
194 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
195 int msg_action;
196 int msg_len;
197 uint8_t msg[LSI_MAX_MSGIN_LEN];
198 /* 0 if SCRIPTS are running or stopped.
199 * 1 if a Wait Reselect instruction has been issued.
200 * 2 if processing DMA from lsi_execute_script.
201 * 3 if a DMA operation is in progress. */
202 int waiting;
203 SCSIBus bus;
204 int current_lun;
205 /* The tag is a combination of the device ID and the SCSI tag. */
206 uint32_t select_tag;
207 int command_complete;
208 QTAILQ_HEAD(, lsi_request) queue;
209 lsi_request *current;
210
211 uint32_t dsa;
212 uint32_t temp;
213 uint32_t dnad;
214 uint32_t dbc;
215 uint8_t istat0;
216 uint8_t istat1;
217 uint8_t dcmd;
218 uint8_t dstat;
219 uint8_t dien;
220 uint8_t sist0;
221 uint8_t sist1;
222 uint8_t sien0;
223 uint8_t sien1;
224 uint8_t mbox0;
225 uint8_t mbox1;
226 uint8_t dfifo;
227 uint8_t ctest2;
228 uint8_t ctest3;
229 uint8_t ctest4;
230 uint8_t ctest5;
231 uint8_t ccntl0;
232 uint8_t ccntl1;
233 uint32_t dsp;
234 uint32_t dsps;
235 uint8_t dmode;
236 uint8_t dcntl;
237 uint8_t scntl0;
238 uint8_t scntl1;
239 uint8_t scntl2;
240 uint8_t scntl3;
241 uint8_t sstat0;
242 uint8_t sstat1;
243 uint8_t scid;
244 uint8_t sxfer;
245 uint8_t socl;
246 uint8_t sdid;
247 uint8_t ssid;
248 uint8_t sfbr;
249 uint8_t stest1;
250 uint8_t stest2;
251 uint8_t stest3;
252 uint8_t sidl;
253 uint8_t stime0;
254 uint8_t respid0;
255 uint8_t respid1;
256 uint32_t mmrs;
257 uint32_t mmws;
258 uint32_t sfs;
259 uint32_t drs;
260 uint32_t sbms;
261 uint32_t dbms;
262 uint32_t dnad64;
263 uint32_t pmjad1;
264 uint32_t pmjad2;
265 uint32_t rbc;
266 uint32_t ua;
267 uint32_t ia;
268 uint32_t sbc;
269 uint32_t csbc;
270 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
271 uint8_t sbr;
272
273 /* Script ram is stored as 32-bit words in host byteorder. */
274 uint32_t script_ram[2048];
275 } LSIState;
276
277 static inline int lsi_irq_on_rsl(LSIState *s)
278 {
279 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
280 }
281
282 static void lsi_soft_reset(LSIState *s)
283 {
284 lsi_request *p;
285
286 DPRINTF("Reset\n");
287 s->carry = 0;
288
289 s->msg_action = 0;
290 s->msg_len = 0;
291 s->waiting = 0;
292 s->dsa = 0;
293 s->dnad = 0;
294 s->dbc = 0;
295 s->temp = 0;
296 memset(s->scratch, 0, sizeof(s->scratch));
297 s->istat0 = 0;
298 s->istat1 = 0;
299 s->dcmd = 0x40;
300 s->dstat = LSI_DSTAT_DFE;
301 s->dien = 0;
302 s->sist0 = 0;
303 s->sist1 = 0;
304 s->sien0 = 0;
305 s->sien1 = 0;
306 s->mbox0 = 0;
307 s->mbox1 = 0;
308 s->dfifo = 0;
309 s->ctest2 = LSI_CTEST2_DACK;
310 s->ctest3 = 0;
311 s->ctest4 = 0;
312 s->ctest5 = 0;
313 s->ccntl0 = 0;
314 s->ccntl1 = 0;
315 s->dsp = 0;
316 s->dsps = 0;
317 s->dmode = 0;
318 s->dcntl = 0;
319 s->scntl0 = 0xc0;
320 s->scntl1 = 0;
321 s->scntl2 = 0;
322 s->scntl3 = 0;
323 s->sstat0 = 0;
324 s->sstat1 = 0;
325 s->scid = 7;
326 s->sxfer = 0;
327 s->socl = 0;
328 s->sdid = 0;
329 s->ssid = 0;
330 s->stest1 = 0;
331 s->stest2 = 0;
332 s->stest3 = 0;
333 s->sidl = 0;
334 s->stime0 = 0;
335 s->respid0 = 0x80;
336 s->respid1 = 0;
337 s->mmrs = 0;
338 s->mmws = 0;
339 s->sfs = 0;
340 s->drs = 0;
341 s->sbms = 0;
342 s->dbms = 0;
343 s->dnad64 = 0;
344 s->pmjad1 = 0;
345 s->pmjad2 = 0;
346 s->rbc = 0;
347 s->ua = 0;
348 s->ia = 0;
349 s->sbc = 0;
350 s->csbc = 0;
351 s->sbr = 0;
352 while (!QTAILQ_EMPTY(&s->queue)) {
353 p = QTAILQ_FIRST(&s->queue);
354 QTAILQ_REMOVE(&s->queue, p, next);
355 qemu_free(p);
356 }
357 if (s->current) {
358 qemu_free(s->current);
359 s->current = NULL;
360 }
361 }
362
363 static int lsi_dma_40bit(LSIState *s)
364 {
365 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
366 return 1;
367 return 0;
368 }
369
370 static int lsi_dma_ti64bit(LSIState *s)
371 {
372 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
373 return 1;
374 return 0;
375 }
376
377 static int lsi_dma_64bit(LSIState *s)
378 {
379 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
380 return 1;
381 return 0;
382 }
383
384 static uint8_t lsi_reg_readb(LSIState *s, int offset);
385 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
386 static void lsi_execute_script(LSIState *s);
387 static void lsi_reselect(LSIState *s, lsi_request *p);
388
389 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
390 {
391 uint32_t buf;
392
393 /* Optimize reading from SCRIPTS RAM. */
394 if ((addr & 0xffffe000) == s->script_ram_base) {
395 return s->script_ram[(addr & 0x1fff) >> 2];
396 }
397 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
398 return cpu_to_le32(buf);
399 }
400
401 static void lsi_stop_script(LSIState *s)
402 {
403 s->istat1 &= ~LSI_ISTAT1_SRUN;
404 }
405
406 static void lsi_update_irq(LSIState *s)
407 {
408 int level;
409 static int last_level;
410 lsi_request *p;
411
412 /* It's unclear whether the DIP/SIP bits should be cleared when the
413 Interrupt Status Registers are cleared or when istat0 is read.
414 We currently do the formwer, which seems to work. */
415 level = 0;
416 if (s->dstat) {
417 if (s->dstat & s->dien)
418 level = 1;
419 s->istat0 |= LSI_ISTAT0_DIP;
420 } else {
421 s->istat0 &= ~LSI_ISTAT0_DIP;
422 }
423
424 if (s->sist0 || s->sist1) {
425 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
426 level = 1;
427 s->istat0 |= LSI_ISTAT0_SIP;
428 } else {
429 s->istat0 &= ~LSI_ISTAT0_SIP;
430 }
431 if (s->istat0 & LSI_ISTAT0_INTF)
432 level = 1;
433
434 if (level != last_level) {
435 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
436 level, s->dstat, s->sist1, s->sist0);
437 last_level = level;
438 }
439 qemu_set_irq(s->dev.irq[0], level);
440
441 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
442 DPRINTF("Handled IRQs & disconnected, looking for pending "
443 "processes\n");
444 QTAILQ_FOREACH(p, &s->queue, next) {
445 if (p->pending) {
446 lsi_reselect(s, p);
447 break;
448 }
449 }
450 }
451 }
452
453 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
454 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
455 {
456 uint32_t mask0;
457 uint32_t mask1;
458
459 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
460 stat1, stat0, s->sist1, s->sist0);
461 s->sist0 |= stat0;
462 s->sist1 |= stat1;
463 /* Stop processor on fatal or unmasked interrupt. As a special hack
464 we don't stop processing when raising STO. Instead continue
465 execution and stop at the next insn that accesses the SCSI bus. */
466 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
467 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
468 mask1 &= ~LSI_SIST1_STO;
469 if (s->sist0 & mask0 || s->sist1 & mask1) {
470 lsi_stop_script(s);
471 }
472 lsi_update_irq(s);
473 }
474
475 /* Stop SCRIPTS execution and raise a DMA interrupt. */
476 static void lsi_script_dma_interrupt(LSIState *s, int stat)
477 {
478 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
479 s->dstat |= stat;
480 lsi_update_irq(s);
481 lsi_stop_script(s);
482 }
483
484 static inline void lsi_set_phase(LSIState *s, int phase)
485 {
486 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
487 }
488
489 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
490 {
491 /* Trigger a phase mismatch. */
492 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
493 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
494 s->dsp = out ? s->pmjad1 : s->pmjad2;
495 } else {
496 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
497 }
498 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
499 } else {
500 DPRINTF("Phase mismatch interrupt\n");
501 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
502 lsi_stop_script(s);
503 }
504 lsi_set_phase(s, new_phase);
505 }
506
507
508 /* Resume SCRIPTS execution after a DMA operation. */
509 static void lsi_resume_script(LSIState *s)
510 {
511 if (s->waiting != 2) {
512 s->waiting = 0;
513 lsi_execute_script(s);
514 } else {
515 s->waiting = 0;
516 }
517 }
518
519 static void lsi_disconnect(LSIState *s)
520 {
521 s->scntl1 &= ~LSI_SCNTL1_CON;
522 s->sstat1 &= ~PHASE_MASK;
523 }
524
525 static void lsi_bad_selection(LSIState *s, uint32_t id)
526 {
527 DPRINTF("Selected absent target %d\n", id);
528 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
529 lsi_disconnect(s);
530 }
531
532 /* Initiate a SCSI layer data transfer. */
533 static void lsi_do_dma(LSIState *s, int out)
534 {
535 uint32_t count, id;
536 target_phys_addr_t addr;
537 SCSIDevice *dev;
538
539 assert(s->current);
540 if (!s->current->dma_len) {
541 /* Wait until data is available. */
542 DPRINTF("DMA no data available\n");
543 return;
544 }
545
546 id = (s->current->tag >> 8) & 0xf;
547 dev = s->bus.devs[id];
548 if (!dev) {
549 lsi_bad_selection(s, id);
550 return;
551 }
552
553 count = s->dbc;
554 if (count > s->current->dma_len)
555 count = s->current->dma_len;
556
557 addr = s->dnad;
558 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
559 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
560 addr |= ((uint64_t)s->dnad64 << 32);
561 else if (s->dbms)
562 addr |= ((uint64_t)s->dbms << 32);
563 else if (s->sbms)
564 addr |= ((uint64_t)s->sbms << 32);
565
566 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
567 s->csbc += count;
568 s->dnad += count;
569 s->dbc -= count;
570
571 if (s->current->dma_buf == NULL) {
572 s->current->dma_buf = dev->info->get_buf(dev, s->current->tag);
573 }
574
575 /* ??? Set SFBR to first data byte. */
576 if (out) {
577 cpu_physical_memory_read(addr, s->current->dma_buf, count);
578 } else {
579 cpu_physical_memory_write(addr, s->current->dma_buf, count);
580 }
581 s->current->dma_len -= count;
582 if (s->current->dma_len == 0) {
583 s->current->dma_buf = NULL;
584 if (out) {
585 /* Write the data. */
586 dev->info->write_data(dev, s->current->tag);
587 } else {
588 /* Request any remaining data. */
589 dev->info->read_data(dev, s->current->tag);
590 }
591 } else {
592 s->current->dma_buf += count;
593 lsi_resume_script(s);
594 }
595 }
596
597
598 /* Add a command to the queue. */
599 static void lsi_queue_command(LSIState *s)
600 {
601 lsi_request *p = s->current;
602
603 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
604 assert(s->current != NULL);
605 assert(s->current->dma_len == 0);
606 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
607 s->current = NULL;
608
609 p->pending = 0;
610 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
611 }
612
613 /* Queue a byte for a MSG IN phase. */
614 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
615 {
616 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
617 BADF("MSG IN data too long\n");
618 } else {
619 DPRINTF("MSG IN 0x%02x\n", data);
620 s->msg[s->msg_len++] = data;
621 }
622 }
623
624 /* Perform reselection to continue a command. */
625 static void lsi_reselect(LSIState *s, lsi_request *p)
626 {
627 int id;
628
629 assert(s->current == NULL);
630 QTAILQ_REMOVE(&s->queue, p, next);
631 s->current = p;
632
633 id = (p->tag >> 8) & 0xf;
634 s->ssid = id | 0x80;
635 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
636 if (!(s->dcntl & LSI_DCNTL_COM)) {
637 s->sfbr = 1 << (id & 0x7);
638 }
639 DPRINTF("Reselected target %d\n", id);
640 s->scntl1 |= LSI_SCNTL1_CON;
641 lsi_set_phase(s, PHASE_MI);
642 s->msg_action = p->out ? 2 : 3;
643 s->current->dma_len = p->pending;
644 lsi_add_msg_byte(s, 0x80);
645 if (s->current->tag & LSI_TAG_VALID) {
646 lsi_add_msg_byte(s, 0x20);
647 lsi_add_msg_byte(s, p->tag & 0xff);
648 }
649
650 if (lsi_irq_on_rsl(s)) {
651 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
652 }
653 }
654
655 /* Record that data is available for a queued command. Returns zero if
656 the device was reselected, nonzero if the IO is deferred. */
657 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
658 {
659 lsi_request *p;
660
661 QTAILQ_FOREACH(p, &s->queue, next) {
662 if (p->tag == tag) {
663 if (p->pending) {
664 BADF("Multiple IO pending for tag %d\n", tag);
665 }
666 p->pending = arg;
667 /* Reselect if waiting for it, or if reselection triggers an IRQ
668 and the bus is free.
669 Since no interrupt stacking is implemented in the emulation, it
670 is also required that there are no pending interrupts waiting
671 for service from the device driver. */
672 if (s->waiting == 1 ||
673 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
674 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
675 /* Reselect device. */
676 lsi_reselect(s, p);
677 return 0;
678 } else {
679 DPRINTF("Queueing IO tag=0x%x\n", tag);
680 p->pending = arg;
681 return 1;
682 }
683 }
684 }
685 BADF("IO with unknown tag %d\n", tag);
686 return 1;
687 }
688
689 /* Callback to indicate that the SCSI layer has completed a transfer. */
690 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
691 uint32_t arg)
692 {
693 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
694 int out;
695
696 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
697 if (reason == SCSI_REASON_DONE) {
698 DPRINTF("Command complete sense=%d\n", (int)arg);
699 s->sense = arg;
700 s->command_complete = 2;
701 if (s->waiting && s->dbc != 0) {
702 /* Raise phase mismatch for short transfers. */
703 lsi_bad_phase(s, out, PHASE_ST);
704 } else {
705 lsi_set_phase(s, PHASE_ST);
706 }
707
708 qemu_free(s->current);
709 s->current = NULL;
710
711 lsi_resume_script(s);
712 return;
713 }
714
715 if (s->waiting == 1 || !s->current || tag != s->current->tag ||
716 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
717 if (lsi_queue_tag(s, tag, arg))
718 return;
719 }
720
721 /* host adapter (re)connected */
722 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
723 s->current->dma_len = arg;
724 s->command_complete = 1;
725 if (!s->waiting)
726 return;
727 if (s->waiting == 1 || s->dbc == 0) {
728 lsi_resume_script(s);
729 } else {
730 lsi_do_dma(s, out);
731 }
732 }
733
734 static void lsi_do_command(LSIState *s)
735 {
736 SCSIDevice *dev;
737 uint8_t buf[16];
738 uint32_t id;
739 int n;
740
741 DPRINTF("Send command len=%d\n", s->dbc);
742 if (s->dbc > 16)
743 s->dbc = 16;
744 cpu_physical_memory_read(s->dnad, buf, s->dbc);
745 s->sfbr = buf[0];
746 s->command_complete = 0;
747
748 id = (s->select_tag >> 8) & 0xf;
749 dev = s->bus.devs[id];
750 if (!dev) {
751 lsi_bad_selection(s, id);
752 return;
753 }
754
755 assert(s->current == NULL);
756 s->current = qemu_mallocz(sizeof(lsi_request));
757 s->current->tag = s->select_tag;
758
759 n = dev->info->send_command(dev, s->current->tag, buf, s->current_lun);
760 if (n > 0) {
761 lsi_set_phase(s, PHASE_DI);
762 dev->info->read_data(dev, s->current->tag);
763 } else if (n < 0) {
764 lsi_set_phase(s, PHASE_DO);
765 dev->info->write_data(dev, s->current->tag);
766 }
767
768 if (!s->command_complete) {
769 if (n) {
770 /* Command did not complete immediately so disconnect. */
771 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
772 lsi_add_msg_byte(s, 4); /* DISCONNECT */
773 /* wait data */
774 lsi_set_phase(s, PHASE_MI);
775 s->msg_action = 1;
776 lsi_queue_command(s);
777 } else {
778 /* wait command complete */
779 lsi_set_phase(s, PHASE_DI);
780 }
781 }
782 }
783
784 static void lsi_do_status(LSIState *s)
785 {
786 uint8_t sense;
787 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
788 if (s->dbc != 1)
789 BADF("Bad Status move\n");
790 s->dbc = 1;
791 sense = s->sense;
792 s->sfbr = sense;
793 cpu_physical_memory_write(s->dnad, &sense, 1);
794 lsi_set_phase(s, PHASE_MI);
795 s->msg_action = 1;
796 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
797 }
798
799 static void lsi_do_msgin(LSIState *s)
800 {
801 int len;
802 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
803 s->sfbr = s->msg[0];
804 len = s->msg_len;
805 if (len > s->dbc)
806 len = s->dbc;
807 cpu_physical_memory_write(s->dnad, s->msg, len);
808 /* Linux drivers rely on the last byte being in the SIDL. */
809 s->sidl = s->msg[len - 1];
810 s->msg_len -= len;
811 if (s->msg_len) {
812 memmove(s->msg, s->msg + len, s->msg_len);
813 } else {
814 /* ??? Check if ATN (not yet implemented) is asserted and maybe
815 switch to PHASE_MO. */
816 switch (s->msg_action) {
817 case 0:
818 lsi_set_phase(s, PHASE_CMD);
819 break;
820 case 1:
821 lsi_disconnect(s);
822 break;
823 case 2:
824 lsi_set_phase(s, PHASE_DO);
825 break;
826 case 3:
827 lsi_set_phase(s, PHASE_DI);
828 break;
829 default:
830 abort();
831 }
832 }
833 }
834
835 /* Read the next byte during a MSGOUT phase. */
836 static uint8_t lsi_get_msgbyte(LSIState *s)
837 {
838 uint8_t data;
839 cpu_physical_memory_read(s->dnad, &data, 1);
840 s->dnad++;
841 s->dbc--;
842 return data;
843 }
844
845 static void lsi_do_msgout(LSIState *s)
846 {
847 uint8_t msg;
848 int len;
849
850 DPRINTF("MSG out len=%d\n", s->dbc);
851 while (s->dbc) {
852 msg = lsi_get_msgbyte(s);
853 s->sfbr = msg;
854
855 switch (msg) {
856 case 0x04:
857 DPRINTF("MSG: Disconnect\n");
858 lsi_disconnect(s);
859 break;
860 case 0x08:
861 DPRINTF("MSG: No Operation\n");
862 lsi_set_phase(s, PHASE_CMD);
863 break;
864 case 0x01:
865 len = lsi_get_msgbyte(s);
866 msg = lsi_get_msgbyte(s);
867 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
868 switch (msg) {
869 case 1:
870 DPRINTF("SDTR (ignored)\n");
871 s->dbc -= 2;
872 break;
873 case 3:
874 DPRINTF("WDTR (ignored)\n");
875 s->dbc -= 1;
876 break;
877 default:
878 goto bad;
879 }
880 break;
881 case 0x20: /* SIMPLE queue */
882 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
883 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
884 break;
885 case 0x21: /* HEAD of queue */
886 BADF("HEAD queue not implemented\n");
887 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
888 break;
889 case 0x22: /* ORDERED queue */
890 BADF("ORDERED queue not implemented\n");
891 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
892 break;
893 default:
894 if ((msg & 0x80) == 0) {
895 goto bad;
896 }
897 s->current_lun = msg & 7;
898 DPRINTF("Select LUN %d\n", s->current_lun);
899 lsi_set_phase(s, PHASE_CMD);
900 break;
901 }
902 }
903 return;
904 bad:
905 BADF("Unimplemented message 0x%02x\n", msg);
906 lsi_set_phase(s, PHASE_MI);
907 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
908 s->msg_action = 0;
909 }
910
911 /* Sign extend a 24-bit value. */
912 static inline int32_t sxt24(int32_t n)
913 {
914 return (n << 8) >> 8;
915 }
916
917 #define LSI_BUF_SIZE 4096
918 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
919 {
920 int n;
921 uint8_t buf[LSI_BUF_SIZE];
922
923 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
924 while (count) {
925 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
926 cpu_physical_memory_read(src, buf, n);
927 cpu_physical_memory_write(dest, buf, n);
928 src += n;
929 dest += n;
930 count -= n;
931 }
932 }
933
934 static void lsi_wait_reselect(LSIState *s)
935 {
936 lsi_request *p;
937
938 DPRINTF("Wait Reselect\n");
939
940 QTAILQ_FOREACH(p, &s->queue, next) {
941 if (p->pending) {
942 lsi_reselect(s, p);
943 break;
944 }
945 }
946 if (s->current == NULL) {
947 s->waiting = 1;
948 }
949 }
950
951 static void lsi_execute_script(LSIState *s)
952 {
953 uint32_t insn;
954 uint32_t addr, addr_high;
955 int opcode;
956 int insn_processed = 0;
957
958 s->istat1 |= LSI_ISTAT1_SRUN;
959 again:
960 insn_processed++;
961 insn = read_dword(s, s->dsp);
962 if (!insn) {
963 /* If we receive an empty opcode increment the DSP by 4 bytes
964 instead of 8 and execute the next opcode at that location */
965 s->dsp += 4;
966 goto again;
967 }
968 addr = read_dword(s, s->dsp + 4);
969 addr_high = 0;
970 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
971 s->dsps = addr;
972 s->dcmd = insn >> 24;
973 s->dsp += 8;
974 switch (insn >> 30) {
975 case 0: /* Block move. */
976 if (s->sist1 & LSI_SIST1_STO) {
977 DPRINTF("Delayed select timeout\n");
978 lsi_stop_script(s);
979 break;
980 }
981 s->dbc = insn & 0xffffff;
982 s->rbc = s->dbc;
983 /* ??? Set ESA. */
984 s->ia = s->dsp - 8;
985 if (insn & (1 << 29)) {
986 /* Indirect addressing. */
987 addr = read_dword(s, addr);
988 } else if (insn & (1 << 28)) {
989 uint32_t buf[2];
990 int32_t offset;
991 /* Table indirect addressing. */
992
993 /* 32-bit Table indirect */
994 offset = sxt24(addr);
995 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
996 /* byte count is stored in bits 0:23 only */
997 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
998 s->rbc = s->dbc;
999 addr = cpu_to_le32(buf[1]);
1000
1001 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1002 * table, bits [31:24] */
1003 if (lsi_dma_40bit(s))
1004 addr_high = cpu_to_le32(buf[0]) >> 24;
1005 else if (lsi_dma_ti64bit(s)) {
1006 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1007 switch (selector) {
1008 case 0 ... 0x0f:
1009 /* offset index into scratch registers since
1010 * TI64 mode can use registers C to R */
1011 addr_high = s->scratch[2 + selector];
1012 break;
1013 case 0x10:
1014 addr_high = s->mmrs;
1015 break;
1016 case 0x11:
1017 addr_high = s->mmws;
1018 break;
1019 case 0x12:
1020 addr_high = s->sfs;
1021 break;
1022 case 0x13:
1023 addr_high = s->drs;
1024 break;
1025 case 0x14:
1026 addr_high = s->sbms;
1027 break;
1028 case 0x15:
1029 addr_high = s->dbms;
1030 break;
1031 default:
1032 BADF("Illegal selector specified (0x%x > 0x15)"
1033 " for 64-bit DMA block move", selector);
1034 break;
1035 }
1036 }
1037 } else if (lsi_dma_64bit(s)) {
1038 /* fetch a 3rd dword if 64-bit direct move is enabled and
1039 only if we're not doing table indirect or indirect addressing */
1040 s->dbms = read_dword(s, s->dsp);
1041 s->dsp += 4;
1042 s->ia = s->dsp - 12;
1043 }
1044 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1045 DPRINTF("Wrong phase got %d expected %d\n",
1046 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1047 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1048 break;
1049 }
1050 s->dnad = addr;
1051 s->dnad64 = addr_high;
1052 switch (s->sstat1 & 0x7) {
1053 case PHASE_DO:
1054 s->waiting = 2;
1055 lsi_do_dma(s, 1);
1056 if (s->waiting)
1057 s->waiting = 3;
1058 break;
1059 case PHASE_DI:
1060 s->waiting = 2;
1061 lsi_do_dma(s, 0);
1062 if (s->waiting)
1063 s->waiting = 3;
1064 break;
1065 case PHASE_CMD:
1066 lsi_do_command(s);
1067 break;
1068 case PHASE_ST:
1069 lsi_do_status(s);
1070 break;
1071 case PHASE_MO:
1072 lsi_do_msgout(s);
1073 break;
1074 case PHASE_MI:
1075 lsi_do_msgin(s);
1076 break;
1077 default:
1078 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1079 exit(1);
1080 }
1081 s->dfifo = s->dbc & 0xff;
1082 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1083 s->sbc = s->dbc;
1084 s->rbc -= s->dbc;
1085 s->ua = addr + s->dbc;
1086 break;
1087
1088 case 1: /* IO or Read/Write instruction. */
1089 opcode = (insn >> 27) & 7;
1090 if (opcode < 5) {
1091 uint32_t id;
1092
1093 if (insn & (1 << 25)) {
1094 id = read_dword(s, s->dsa + sxt24(insn));
1095 } else {
1096 id = insn;
1097 }
1098 id = (id >> 16) & 0xf;
1099 if (insn & (1 << 26)) {
1100 addr = s->dsp + sxt24(addr);
1101 }
1102 s->dnad = addr;
1103 switch (opcode) {
1104 case 0: /* Select */
1105 s->sdid = id;
1106 if (s->scntl1 & LSI_SCNTL1_CON) {
1107 DPRINTF("Already reselected, jumping to alternative address\n");
1108 s->dsp = s->dnad;
1109 break;
1110 }
1111 s->sstat0 |= LSI_SSTAT0_WOA;
1112 s->scntl1 &= ~LSI_SCNTL1_IARB;
1113 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1114 lsi_bad_selection(s, id);
1115 break;
1116 }
1117 DPRINTF("Selected target %d%s\n",
1118 id, insn & (1 << 3) ? " ATN" : "");
1119 /* ??? Linux drivers compain when this is set. Maybe
1120 it only applies in low-level mode (unimplemented).
1121 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1122 s->select_tag = id << 8;
1123 s->scntl1 |= LSI_SCNTL1_CON;
1124 if (insn & (1 << 3)) {
1125 s->socl |= LSI_SOCL_ATN;
1126 }
1127 lsi_set_phase(s, PHASE_MO);
1128 break;
1129 case 1: /* Disconnect */
1130 DPRINTF("Wait Disconnect\n");
1131 s->scntl1 &= ~LSI_SCNTL1_CON;
1132 break;
1133 case 2: /* Wait Reselect */
1134 if (!lsi_irq_on_rsl(s)) {
1135 lsi_wait_reselect(s);
1136 }
1137 break;
1138 case 3: /* Set */
1139 DPRINTF("Set%s%s%s%s\n",
1140 insn & (1 << 3) ? " ATN" : "",
1141 insn & (1 << 6) ? " ACK" : "",
1142 insn & (1 << 9) ? " TM" : "",
1143 insn & (1 << 10) ? " CC" : "");
1144 if (insn & (1 << 3)) {
1145 s->socl |= LSI_SOCL_ATN;
1146 lsi_set_phase(s, PHASE_MO);
1147 }
1148 if (insn & (1 << 9)) {
1149 BADF("Target mode not implemented\n");
1150 exit(1);
1151 }
1152 if (insn & (1 << 10))
1153 s->carry = 1;
1154 break;
1155 case 4: /* Clear */
1156 DPRINTF("Clear%s%s%s%s\n",
1157 insn & (1 << 3) ? " ATN" : "",
1158 insn & (1 << 6) ? " ACK" : "",
1159 insn & (1 << 9) ? " TM" : "",
1160 insn & (1 << 10) ? " CC" : "");
1161 if (insn & (1 << 3)) {
1162 s->socl &= ~LSI_SOCL_ATN;
1163 }
1164 if (insn & (1 << 10))
1165 s->carry = 0;
1166 break;
1167 }
1168 } else {
1169 uint8_t op0;
1170 uint8_t op1;
1171 uint8_t data8;
1172 int reg;
1173 int operator;
1174 #ifdef DEBUG_LSI
1175 static const char *opcode_names[3] =
1176 {"Write", "Read", "Read-Modify-Write"};
1177 static const char *operator_names[8] =
1178 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1179 #endif
1180
1181 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1182 data8 = (insn >> 8) & 0xff;
1183 opcode = (insn >> 27) & 7;
1184 operator = (insn >> 24) & 7;
1185 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1186 opcode_names[opcode - 5], reg,
1187 operator_names[operator], data8, s->sfbr,
1188 (insn & (1 << 23)) ? " SFBR" : "");
1189 op0 = op1 = 0;
1190 switch (opcode) {
1191 case 5: /* From SFBR */
1192 op0 = s->sfbr;
1193 op1 = data8;
1194 break;
1195 case 6: /* To SFBR */
1196 if (operator)
1197 op0 = lsi_reg_readb(s, reg);
1198 op1 = data8;
1199 break;
1200 case 7: /* Read-modify-write */
1201 if (operator)
1202 op0 = lsi_reg_readb(s, reg);
1203 if (insn & (1 << 23)) {
1204 op1 = s->sfbr;
1205 } else {
1206 op1 = data8;
1207 }
1208 break;
1209 }
1210
1211 switch (operator) {
1212 case 0: /* move */
1213 op0 = op1;
1214 break;
1215 case 1: /* Shift left */
1216 op1 = op0 >> 7;
1217 op0 = (op0 << 1) | s->carry;
1218 s->carry = op1;
1219 break;
1220 case 2: /* OR */
1221 op0 |= op1;
1222 break;
1223 case 3: /* XOR */
1224 op0 ^= op1;
1225 break;
1226 case 4: /* AND */
1227 op0 &= op1;
1228 break;
1229 case 5: /* SHR */
1230 op1 = op0 & 1;
1231 op0 = (op0 >> 1) | (s->carry << 7);
1232 s->carry = op1;
1233 break;
1234 case 6: /* ADD */
1235 op0 += op1;
1236 s->carry = op0 < op1;
1237 break;
1238 case 7: /* ADC */
1239 op0 += op1 + s->carry;
1240 if (s->carry)
1241 s->carry = op0 <= op1;
1242 else
1243 s->carry = op0 < op1;
1244 break;
1245 }
1246
1247 switch (opcode) {
1248 case 5: /* From SFBR */
1249 case 7: /* Read-modify-write */
1250 lsi_reg_writeb(s, reg, op0);
1251 break;
1252 case 6: /* To SFBR */
1253 s->sfbr = op0;
1254 break;
1255 }
1256 }
1257 break;
1258
1259 case 2: /* Transfer Control. */
1260 {
1261 int cond;
1262 int jmp;
1263
1264 if ((insn & 0x002e0000) == 0) {
1265 DPRINTF("NOP\n");
1266 break;
1267 }
1268 if (s->sist1 & LSI_SIST1_STO) {
1269 DPRINTF("Delayed select timeout\n");
1270 lsi_stop_script(s);
1271 break;
1272 }
1273 cond = jmp = (insn & (1 << 19)) != 0;
1274 if (cond == jmp && (insn & (1 << 21))) {
1275 DPRINTF("Compare carry %d\n", s->carry == jmp);
1276 cond = s->carry != 0;
1277 }
1278 if (cond == jmp && (insn & (1 << 17))) {
1279 DPRINTF("Compare phase %d %c= %d\n",
1280 (s->sstat1 & PHASE_MASK),
1281 jmp ? '=' : '!',
1282 ((insn >> 24) & 7));
1283 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1284 }
1285 if (cond == jmp && (insn & (1 << 18))) {
1286 uint8_t mask;
1287
1288 mask = (~insn >> 8) & 0xff;
1289 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1290 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1291 cond = (s->sfbr & mask) == (insn & mask);
1292 }
1293 if (cond == jmp) {
1294 if (insn & (1 << 23)) {
1295 /* Relative address. */
1296 addr = s->dsp + sxt24(addr);
1297 }
1298 switch ((insn >> 27) & 7) {
1299 case 0: /* Jump */
1300 DPRINTF("Jump to 0x%08x\n", addr);
1301 s->dsp = addr;
1302 break;
1303 case 1: /* Call */
1304 DPRINTF("Call 0x%08x\n", addr);
1305 s->temp = s->dsp;
1306 s->dsp = addr;
1307 break;
1308 case 2: /* Return */
1309 DPRINTF("Return to 0x%08x\n", s->temp);
1310 s->dsp = s->temp;
1311 break;
1312 case 3: /* Interrupt */
1313 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1314 if ((insn & (1 << 20)) != 0) {
1315 s->istat0 |= LSI_ISTAT0_INTF;
1316 lsi_update_irq(s);
1317 } else {
1318 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1319 }
1320 break;
1321 default:
1322 DPRINTF("Illegal transfer control\n");
1323 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1324 break;
1325 }
1326 } else {
1327 DPRINTF("Control condition failed\n");
1328 }
1329 }
1330 break;
1331
1332 case 3:
1333 if ((insn & (1 << 29)) == 0) {
1334 /* Memory move. */
1335 uint32_t dest;
1336 /* ??? The docs imply the destination address is loaded into
1337 the TEMP register. However the Linux drivers rely on
1338 the value being presrved. */
1339 dest = read_dword(s, s->dsp);
1340 s->dsp += 4;
1341 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1342 } else {
1343 uint8_t data[7];
1344 int reg;
1345 int n;
1346 int i;
1347
1348 if (insn & (1 << 28)) {
1349 addr = s->dsa + sxt24(addr);
1350 }
1351 n = (insn & 7);
1352 reg = (insn >> 16) & 0xff;
1353 if (insn & (1 << 24)) {
1354 cpu_physical_memory_read(addr, data, n);
1355 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1356 addr, *(int *)data);
1357 for (i = 0; i < n; i++) {
1358 lsi_reg_writeb(s, reg + i, data[i]);
1359 }
1360 } else {
1361 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1362 for (i = 0; i < n; i++) {
1363 data[i] = lsi_reg_readb(s, reg + i);
1364 }
1365 cpu_physical_memory_write(addr, data, n);
1366 }
1367 }
1368 }
1369 if (insn_processed > 10000 && !s->waiting) {
1370 /* Some windows drivers make the device spin waiting for a memory
1371 location to change. If we have been executed a lot of code then
1372 assume this is the case and force an unexpected device disconnect.
1373 This is apparently sufficient to beat the drivers into submission.
1374 */
1375 if (!(s->sien0 & LSI_SIST0_UDC))
1376 fprintf(stderr, "inf. loop with UDC masked\n");
1377 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1378 lsi_disconnect(s);
1379 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1380 if (s->dcntl & LSI_DCNTL_SSM) {
1381 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1382 } else {
1383 goto again;
1384 }
1385 }
1386 DPRINTF("SCRIPTS execution stopped\n");
1387 }
1388
1389 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1390 {
1391 uint8_t tmp;
1392 #define CASE_GET_REG24(name, addr) \
1393 case addr: return s->name & 0xff; \
1394 case addr + 1: return (s->name >> 8) & 0xff; \
1395 case addr + 2: return (s->name >> 16) & 0xff;
1396
1397 #define CASE_GET_REG32(name, addr) \
1398 case addr: return s->name & 0xff; \
1399 case addr + 1: return (s->name >> 8) & 0xff; \
1400 case addr + 2: return (s->name >> 16) & 0xff; \
1401 case addr + 3: return (s->name >> 24) & 0xff;
1402
1403 #ifdef DEBUG_LSI_REG
1404 DPRINTF("Read reg %x\n", offset);
1405 #endif
1406 switch (offset) {
1407 case 0x00: /* SCNTL0 */
1408 return s->scntl0;
1409 case 0x01: /* SCNTL1 */
1410 return s->scntl1;
1411 case 0x02: /* SCNTL2 */
1412 return s->scntl2;
1413 case 0x03: /* SCNTL3 */
1414 return s->scntl3;
1415 case 0x04: /* SCID */
1416 return s->scid;
1417 case 0x05: /* SXFER */
1418 return s->sxfer;
1419 case 0x06: /* SDID */
1420 return s->sdid;
1421 case 0x07: /* GPREG0 */
1422 return 0x7f;
1423 case 0x08: /* Revision ID */
1424 return 0x00;
1425 case 0xa: /* SSID */
1426 return s->ssid;
1427 case 0xb: /* SBCL */
1428 /* ??? This is not correct. However it's (hopefully) only
1429 used for diagnostics, so should be ok. */
1430 return 0;
1431 case 0xc: /* DSTAT */
1432 tmp = s->dstat | 0x80;
1433 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1434 s->dstat = 0;
1435 lsi_update_irq(s);
1436 return tmp;
1437 case 0x0d: /* SSTAT0 */
1438 return s->sstat0;
1439 case 0x0e: /* SSTAT1 */
1440 return s->sstat1;
1441 case 0x0f: /* SSTAT2 */
1442 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1443 CASE_GET_REG32(dsa, 0x10)
1444 case 0x14: /* ISTAT0 */
1445 return s->istat0;
1446 case 0x15: /* ISTAT1 */
1447 return s->istat1;
1448 case 0x16: /* MBOX0 */
1449 return s->mbox0;
1450 case 0x17: /* MBOX1 */
1451 return s->mbox1;
1452 case 0x18: /* CTEST0 */
1453 return 0xff;
1454 case 0x19: /* CTEST1 */
1455 return 0;
1456 case 0x1a: /* CTEST2 */
1457 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1458 if (s->istat0 & LSI_ISTAT0_SIGP) {
1459 s->istat0 &= ~LSI_ISTAT0_SIGP;
1460 tmp |= LSI_CTEST2_SIGP;
1461 }
1462 return tmp;
1463 case 0x1b: /* CTEST3 */
1464 return s->ctest3;
1465 CASE_GET_REG32(temp, 0x1c)
1466 case 0x20: /* DFIFO */
1467 return 0;
1468 case 0x21: /* CTEST4 */
1469 return s->ctest4;
1470 case 0x22: /* CTEST5 */
1471 return s->ctest5;
1472 case 0x23: /* CTEST6 */
1473 return 0;
1474 CASE_GET_REG24(dbc, 0x24)
1475 case 0x27: /* DCMD */
1476 return s->dcmd;
1477 CASE_GET_REG32(dnad, 0x28)
1478 CASE_GET_REG32(dsp, 0x2c)
1479 CASE_GET_REG32(dsps, 0x30)
1480 CASE_GET_REG32(scratch[0], 0x34)
1481 case 0x38: /* DMODE */
1482 return s->dmode;
1483 case 0x39: /* DIEN */
1484 return s->dien;
1485 case 0x3a: /* SBR */
1486 return s->sbr;
1487 case 0x3b: /* DCNTL */
1488 return s->dcntl;
1489 case 0x40: /* SIEN0 */
1490 return s->sien0;
1491 case 0x41: /* SIEN1 */
1492 return s->sien1;
1493 case 0x42: /* SIST0 */
1494 tmp = s->sist0;
1495 s->sist0 = 0;
1496 lsi_update_irq(s);
1497 return tmp;
1498 case 0x43: /* SIST1 */
1499 tmp = s->sist1;
1500 s->sist1 = 0;
1501 lsi_update_irq(s);
1502 return tmp;
1503 case 0x46: /* MACNTL */
1504 return 0x0f;
1505 case 0x47: /* GPCNTL0 */
1506 return 0x0f;
1507 case 0x48: /* STIME0 */
1508 return s->stime0;
1509 case 0x4a: /* RESPID0 */
1510 return s->respid0;
1511 case 0x4b: /* RESPID1 */
1512 return s->respid1;
1513 case 0x4d: /* STEST1 */
1514 return s->stest1;
1515 case 0x4e: /* STEST2 */
1516 return s->stest2;
1517 case 0x4f: /* STEST3 */
1518 return s->stest3;
1519 case 0x50: /* SIDL */
1520 /* This is needed by the linux drivers. We currently only update it
1521 during the MSG IN phase. */
1522 return s->sidl;
1523 case 0x52: /* STEST4 */
1524 return 0xe0;
1525 case 0x56: /* CCNTL0 */
1526 return s->ccntl0;
1527 case 0x57: /* CCNTL1 */
1528 return s->ccntl1;
1529 case 0x58: /* SBDL */
1530 /* Some drivers peek at the data bus during the MSG IN phase. */
1531 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1532 return s->msg[0];
1533 return 0;
1534 case 0x59: /* SBDL high */
1535 return 0;
1536 CASE_GET_REG32(mmrs, 0xa0)
1537 CASE_GET_REG32(mmws, 0xa4)
1538 CASE_GET_REG32(sfs, 0xa8)
1539 CASE_GET_REG32(drs, 0xac)
1540 CASE_GET_REG32(sbms, 0xb0)
1541 CASE_GET_REG32(dbms, 0xb4)
1542 CASE_GET_REG32(dnad64, 0xb8)
1543 CASE_GET_REG32(pmjad1, 0xc0)
1544 CASE_GET_REG32(pmjad2, 0xc4)
1545 CASE_GET_REG32(rbc, 0xc8)
1546 CASE_GET_REG32(ua, 0xcc)
1547 CASE_GET_REG32(ia, 0xd4)
1548 CASE_GET_REG32(sbc, 0xd8)
1549 CASE_GET_REG32(csbc, 0xdc)
1550 }
1551 if (offset >= 0x5c && offset < 0xa0) {
1552 int n;
1553 int shift;
1554 n = (offset - 0x58) >> 2;
1555 shift = (offset & 3) * 8;
1556 return (s->scratch[n] >> shift) & 0xff;
1557 }
1558 BADF("readb 0x%x\n", offset);
1559 exit(1);
1560 #undef CASE_GET_REG24
1561 #undef CASE_GET_REG32
1562 }
1563
1564 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1565 {
1566 #define CASE_SET_REG24(name, addr) \
1567 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1568 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1569 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1570
1571 #define CASE_SET_REG32(name, addr) \
1572 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1573 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1574 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1575 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1576
1577 #ifdef DEBUG_LSI_REG
1578 DPRINTF("Write reg %x = %02x\n", offset, val);
1579 #endif
1580 switch (offset) {
1581 case 0x00: /* SCNTL0 */
1582 s->scntl0 = val;
1583 if (val & LSI_SCNTL0_START) {
1584 BADF("Start sequence not implemented\n");
1585 }
1586 break;
1587 case 0x01: /* SCNTL1 */
1588 s->scntl1 = val & ~LSI_SCNTL1_SST;
1589 if (val & LSI_SCNTL1_IARB) {
1590 BADF("Immediate Arbritration not implemented\n");
1591 }
1592 if (val & LSI_SCNTL1_RST) {
1593 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1594 DeviceState *dev;
1595 int id;
1596
1597 for (id = 0; id < s->bus.ndev; id++) {
1598 if (s->bus.devs[id]) {
1599 dev = &s->bus.devs[id]->qdev;
1600 dev->info->reset(dev);
1601 }
1602 }
1603 s->sstat0 |= LSI_SSTAT0_RST;
1604 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1605 }
1606 } else {
1607 s->sstat0 &= ~LSI_SSTAT0_RST;
1608 }
1609 break;
1610 case 0x02: /* SCNTL2 */
1611 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1612 s->scntl2 = val;
1613 break;
1614 case 0x03: /* SCNTL3 */
1615 s->scntl3 = val;
1616 break;
1617 case 0x04: /* SCID */
1618 s->scid = val;
1619 break;
1620 case 0x05: /* SXFER */
1621 s->sxfer = val;
1622 break;
1623 case 0x06: /* SDID */
1624 if ((val & 0xf) != (s->ssid & 0xf))
1625 BADF("Destination ID does not match SSID\n");
1626 s->sdid = val & 0xf;
1627 break;
1628 case 0x07: /* GPREG0 */
1629 break;
1630 case 0x08: /* SFBR */
1631 /* The CPU is not allowed to write to this register. However the
1632 SCRIPTS register move instructions are. */
1633 s->sfbr = val;
1634 break;
1635 case 0x0a: case 0x0b:
1636 /* Openserver writes to these readonly registers on startup */
1637 return;
1638 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1639 /* Linux writes to these readonly registers on startup. */
1640 return;
1641 CASE_SET_REG32(dsa, 0x10)
1642 case 0x14: /* ISTAT0 */
1643 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1644 if (val & LSI_ISTAT0_ABRT) {
1645 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1646 }
1647 if (val & LSI_ISTAT0_INTF) {
1648 s->istat0 &= ~LSI_ISTAT0_INTF;
1649 lsi_update_irq(s);
1650 }
1651 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1652 DPRINTF("Woken by SIGP\n");
1653 s->waiting = 0;
1654 s->dsp = s->dnad;
1655 lsi_execute_script(s);
1656 }
1657 if (val & LSI_ISTAT0_SRST) {
1658 lsi_soft_reset(s);
1659 }
1660 break;
1661 case 0x16: /* MBOX0 */
1662 s->mbox0 = val;
1663 break;
1664 case 0x17: /* MBOX1 */
1665 s->mbox1 = val;
1666 break;
1667 case 0x1a: /* CTEST2 */
1668 s->ctest2 = val & LSI_CTEST2_PCICIE;
1669 break;
1670 case 0x1b: /* CTEST3 */
1671 s->ctest3 = val & 0x0f;
1672 break;
1673 CASE_SET_REG32(temp, 0x1c)
1674 case 0x21: /* CTEST4 */
1675 if (val & 7) {
1676 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1677 }
1678 s->ctest4 = val;
1679 break;
1680 case 0x22: /* CTEST5 */
1681 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1682 BADF("CTEST5 DMA increment not implemented\n");
1683 }
1684 s->ctest5 = val;
1685 break;
1686 CASE_SET_REG24(dbc, 0x24)
1687 CASE_SET_REG32(dnad, 0x28)
1688 case 0x2c: /* DSP[0:7] */
1689 s->dsp &= 0xffffff00;
1690 s->dsp |= val;
1691 break;
1692 case 0x2d: /* DSP[8:15] */
1693 s->dsp &= 0xffff00ff;
1694 s->dsp |= val << 8;
1695 break;
1696 case 0x2e: /* DSP[16:23] */
1697 s->dsp &= 0xff00ffff;
1698 s->dsp |= val << 16;
1699 break;
1700 case 0x2f: /* DSP[24:31] */
1701 s->dsp &= 0x00ffffff;
1702 s->dsp |= val << 24;
1703 if ((s->dmode & LSI_DMODE_MAN) == 0
1704 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1705 lsi_execute_script(s);
1706 break;
1707 CASE_SET_REG32(dsps, 0x30)
1708 CASE_SET_REG32(scratch[0], 0x34)
1709 case 0x38: /* DMODE */
1710 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1711 BADF("IO mappings not implemented\n");
1712 }
1713 s->dmode = val;
1714 break;
1715 case 0x39: /* DIEN */
1716 s->dien = val;
1717 lsi_update_irq(s);
1718 break;
1719 case 0x3a: /* SBR */
1720 s->sbr = val;
1721 break;
1722 case 0x3b: /* DCNTL */
1723 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1724 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1725 lsi_execute_script(s);
1726 break;
1727 case 0x40: /* SIEN0 */
1728 s->sien0 = val;
1729 lsi_update_irq(s);
1730 break;
1731 case 0x41: /* SIEN1 */
1732 s->sien1 = val;
1733 lsi_update_irq(s);
1734 break;
1735 case 0x47: /* GPCNTL0 */
1736 break;
1737 case 0x48: /* STIME0 */
1738 s->stime0 = val;
1739 break;
1740 case 0x49: /* STIME1 */
1741 if (val & 0xf) {
1742 DPRINTF("General purpose timer not implemented\n");
1743 /* ??? Raising the interrupt immediately seems to be sufficient
1744 to keep the FreeBSD driver happy. */
1745 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1746 }
1747 break;
1748 case 0x4a: /* RESPID0 */
1749 s->respid0 = val;
1750 break;
1751 case 0x4b: /* RESPID1 */
1752 s->respid1 = val;
1753 break;
1754 case 0x4d: /* STEST1 */
1755 s->stest1 = val;
1756 break;
1757 case 0x4e: /* STEST2 */
1758 if (val & 1) {
1759 BADF("Low level mode not implemented\n");
1760 }
1761 s->stest2 = val;
1762 break;
1763 case 0x4f: /* STEST3 */
1764 if (val & 0x41) {
1765 BADF("SCSI FIFO test mode not implemented\n");
1766 }
1767 s->stest3 = val;
1768 break;
1769 case 0x56: /* CCNTL0 */
1770 s->ccntl0 = val;
1771 break;
1772 case 0x57: /* CCNTL1 */
1773 s->ccntl1 = val;
1774 break;
1775 CASE_SET_REG32(mmrs, 0xa0)
1776 CASE_SET_REG32(mmws, 0xa4)
1777 CASE_SET_REG32(sfs, 0xa8)
1778 CASE_SET_REG32(drs, 0xac)
1779 CASE_SET_REG32(sbms, 0xb0)
1780 CASE_SET_REG32(dbms, 0xb4)
1781 CASE_SET_REG32(dnad64, 0xb8)
1782 CASE_SET_REG32(pmjad1, 0xc0)
1783 CASE_SET_REG32(pmjad2, 0xc4)
1784 CASE_SET_REG32(rbc, 0xc8)
1785 CASE_SET_REG32(ua, 0xcc)
1786 CASE_SET_REG32(ia, 0xd4)
1787 CASE_SET_REG32(sbc, 0xd8)
1788 CASE_SET_REG32(csbc, 0xdc)
1789 default:
1790 if (offset >= 0x5c && offset < 0xa0) {
1791 int n;
1792 int shift;
1793 n = (offset - 0x58) >> 2;
1794 shift = (offset & 3) * 8;
1795 s->scratch[n] &= ~(0xff << shift);
1796 s->scratch[n] |= (val & 0xff) << shift;
1797 } else {
1798 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1799 }
1800 }
1801 #undef CASE_SET_REG24
1802 #undef CASE_SET_REG32
1803 }
1804
1805 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1806 {
1807 LSIState *s = opaque;
1808
1809 lsi_reg_writeb(s, addr & 0xff, val);
1810 }
1811
1812 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1813 {
1814 LSIState *s = opaque;
1815
1816 addr &= 0xff;
1817 lsi_reg_writeb(s, addr, val & 0xff);
1818 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1819 }
1820
1821 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1822 {
1823 LSIState *s = opaque;
1824
1825 addr &= 0xff;
1826 lsi_reg_writeb(s, addr, val & 0xff);
1827 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1828 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1829 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1830 }
1831
1832 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1833 {
1834 LSIState *s = opaque;
1835
1836 return lsi_reg_readb(s, addr & 0xff);
1837 }
1838
1839 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1840 {
1841 LSIState *s = opaque;
1842 uint32_t val;
1843
1844 addr &= 0xff;
1845 val = lsi_reg_readb(s, addr);
1846 val |= lsi_reg_readb(s, addr + 1) << 8;
1847 return val;
1848 }
1849
1850 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1851 {
1852 LSIState *s = opaque;
1853 uint32_t val;
1854 addr &= 0xff;
1855 val = lsi_reg_readb(s, addr);
1856 val |= lsi_reg_readb(s, addr + 1) << 8;
1857 val |= lsi_reg_readb(s, addr + 2) << 16;
1858 val |= lsi_reg_readb(s, addr + 3) << 24;
1859 return val;
1860 }
1861
1862 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1863 lsi_mmio_readb,
1864 lsi_mmio_readw,
1865 lsi_mmio_readl,
1866 };
1867
1868 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1869 lsi_mmio_writeb,
1870 lsi_mmio_writew,
1871 lsi_mmio_writel,
1872 };
1873
1874 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1875 {
1876 LSIState *s = opaque;
1877 uint32_t newval;
1878 int shift;
1879
1880 addr &= 0x1fff;
1881 newval = s->script_ram[addr >> 2];
1882 shift = (addr & 3) * 8;
1883 newval &= ~(0xff << shift);
1884 newval |= val << shift;
1885 s->script_ram[addr >> 2] = newval;
1886 }
1887
1888 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1889 {
1890 LSIState *s = opaque;
1891 uint32_t newval;
1892
1893 addr &= 0x1fff;
1894 newval = s->script_ram[addr >> 2];
1895 if (addr & 2) {
1896 newval = (newval & 0xffff) | (val << 16);
1897 } else {
1898 newval = (newval & 0xffff0000) | val;
1899 }
1900 s->script_ram[addr >> 2] = newval;
1901 }
1902
1903
1904 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1905 {
1906 LSIState *s = opaque;
1907
1908 addr &= 0x1fff;
1909 s->script_ram[addr >> 2] = val;
1910 }
1911
1912 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1913 {
1914 LSIState *s = opaque;
1915 uint32_t val;
1916
1917 addr &= 0x1fff;
1918 val = s->script_ram[addr >> 2];
1919 val >>= (addr & 3) * 8;
1920 return val & 0xff;
1921 }
1922
1923 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1924 {
1925 LSIState *s = opaque;
1926 uint32_t val;
1927
1928 addr &= 0x1fff;
1929 val = s->script_ram[addr >> 2];
1930 if (addr & 2)
1931 val >>= 16;
1932 return le16_to_cpu(val);
1933 }
1934
1935 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1936 {
1937 LSIState *s = opaque;
1938
1939 addr &= 0x1fff;
1940 return le32_to_cpu(s->script_ram[addr >> 2]);
1941 }
1942
1943 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1944 lsi_ram_readb,
1945 lsi_ram_readw,
1946 lsi_ram_readl,
1947 };
1948
1949 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1950 lsi_ram_writeb,
1951 lsi_ram_writew,
1952 lsi_ram_writel,
1953 };
1954
1955 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1956 {
1957 LSIState *s = opaque;
1958 return lsi_reg_readb(s, addr & 0xff);
1959 }
1960
1961 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1962 {
1963 LSIState *s = opaque;
1964 uint32_t val;
1965 addr &= 0xff;
1966 val = lsi_reg_readb(s, addr);
1967 val |= lsi_reg_readb(s, addr + 1) << 8;
1968 return val;
1969 }
1970
1971 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1972 {
1973 LSIState *s = opaque;
1974 uint32_t val;
1975 addr &= 0xff;
1976 val = lsi_reg_readb(s, addr);
1977 val |= lsi_reg_readb(s, addr + 1) << 8;
1978 val |= lsi_reg_readb(s, addr + 2) << 16;
1979 val |= lsi_reg_readb(s, addr + 3) << 24;
1980 return val;
1981 }
1982
1983 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1984 {
1985 LSIState *s = opaque;
1986 lsi_reg_writeb(s, addr & 0xff, val);
1987 }
1988
1989 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1990 {
1991 LSIState *s = opaque;
1992 addr &= 0xff;
1993 lsi_reg_writeb(s, addr, val & 0xff);
1994 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1995 }
1996
1997 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1998 {
1999 LSIState *s = opaque;
2000 addr &= 0xff;
2001 lsi_reg_writeb(s, addr, val & 0xff);
2002 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2003 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
2004 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
2005 }
2006
2007 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
2008 pcibus_t addr, pcibus_t size, int type)
2009 {
2010 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2011
2012 DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
2013
2014 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
2015 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
2016 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
2017 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
2018 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
2019 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
2020 }
2021
2022 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
2023 pcibus_t addr, pcibus_t size, int type)
2024 {
2025 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2026
2027 DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
2028 s->script_ram_base = addr;
2029 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
2030 }
2031
2032 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
2033 pcibus_t addr, pcibus_t size, int type)
2034 {
2035 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2036
2037 DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
2038 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
2039 }
2040
2041 static void lsi_scsi_reset(DeviceState *dev)
2042 {
2043 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
2044
2045 lsi_soft_reset(s);
2046 }
2047
2048 static void lsi_pre_save(void *opaque)
2049 {
2050 LSIState *s = opaque;
2051
2052 if (s->current) {
2053 assert(s->current->dma_buf == NULL);
2054 assert(s->current->dma_len == 0);
2055 }
2056 assert(QTAILQ_EMPTY(&s->queue));
2057 }
2058
2059 static const VMStateDescription vmstate_lsi_scsi = {
2060 .name = "lsiscsi",
2061 .version_id = 0,
2062 .minimum_version_id = 0,
2063 .minimum_version_id_old = 0,
2064 .pre_save = lsi_pre_save,
2065 .fields = (VMStateField []) {
2066 VMSTATE_PCI_DEVICE(dev, LSIState),
2067
2068 VMSTATE_INT32(carry, LSIState),
2069 VMSTATE_INT32(sense, LSIState),
2070 VMSTATE_INT32(msg_action, LSIState),
2071 VMSTATE_INT32(msg_len, LSIState),
2072 VMSTATE_BUFFER(msg, LSIState),
2073 VMSTATE_INT32(waiting, LSIState),
2074
2075 VMSTATE_UINT32(dsa, LSIState),
2076 VMSTATE_UINT32(temp, LSIState),
2077 VMSTATE_UINT32(dnad, LSIState),
2078 VMSTATE_UINT32(dbc, LSIState),
2079 VMSTATE_UINT8(istat0, LSIState),
2080 VMSTATE_UINT8(istat1, LSIState),
2081 VMSTATE_UINT8(dcmd, LSIState),
2082 VMSTATE_UINT8(dstat, LSIState),
2083 VMSTATE_UINT8(dien, LSIState),
2084 VMSTATE_UINT8(sist0, LSIState),
2085 VMSTATE_UINT8(sist1, LSIState),
2086 VMSTATE_UINT8(sien0, LSIState),
2087 VMSTATE_UINT8(sien1, LSIState),
2088 VMSTATE_UINT8(mbox0, LSIState),
2089 VMSTATE_UINT8(mbox1, LSIState),
2090 VMSTATE_UINT8(dfifo, LSIState),
2091 VMSTATE_UINT8(ctest2, LSIState),
2092 VMSTATE_UINT8(ctest3, LSIState),
2093 VMSTATE_UINT8(ctest4, LSIState),
2094 VMSTATE_UINT8(ctest5, LSIState),
2095 VMSTATE_UINT8(ccntl0, LSIState),
2096 VMSTATE_UINT8(ccntl1, LSIState),
2097 VMSTATE_UINT32(dsp, LSIState),
2098 VMSTATE_UINT32(dsps, LSIState),
2099 VMSTATE_UINT8(dmode, LSIState),
2100 VMSTATE_UINT8(dcntl, LSIState),
2101 VMSTATE_UINT8(scntl0, LSIState),
2102 VMSTATE_UINT8(scntl1, LSIState),
2103 VMSTATE_UINT8(scntl2, LSIState),
2104 VMSTATE_UINT8(scntl3, LSIState),
2105 VMSTATE_UINT8(sstat0, LSIState),
2106 VMSTATE_UINT8(sstat1, LSIState),
2107 VMSTATE_UINT8(scid, LSIState),
2108 VMSTATE_UINT8(sxfer, LSIState),
2109 VMSTATE_UINT8(socl, LSIState),
2110 VMSTATE_UINT8(sdid, LSIState),
2111 VMSTATE_UINT8(ssid, LSIState),
2112 VMSTATE_UINT8(sfbr, LSIState),
2113 VMSTATE_UINT8(stest1, LSIState),
2114 VMSTATE_UINT8(stest2, LSIState),
2115 VMSTATE_UINT8(stest3, LSIState),
2116 VMSTATE_UINT8(sidl, LSIState),
2117 VMSTATE_UINT8(stime0, LSIState),
2118 VMSTATE_UINT8(respid0, LSIState),
2119 VMSTATE_UINT8(respid1, LSIState),
2120 VMSTATE_UINT32(mmrs, LSIState),
2121 VMSTATE_UINT32(mmws, LSIState),
2122 VMSTATE_UINT32(sfs, LSIState),
2123 VMSTATE_UINT32(drs, LSIState),
2124 VMSTATE_UINT32(sbms, LSIState),
2125 VMSTATE_UINT32(dbms, LSIState),
2126 VMSTATE_UINT32(dnad64, LSIState),
2127 VMSTATE_UINT32(pmjad1, LSIState),
2128 VMSTATE_UINT32(pmjad2, LSIState),
2129 VMSTATE_UINT32(rbc, LSIState),
2130 VMSTATE_UINT32(ua, LSIState),
2131 VMSTATE_UINT32(ia, LSIState),
2132 VMSTATE_UINT32(sbc, LSIState),
2133 VMSTATE_UINT32(csbc, LSIState),
2134 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2135 VMSTATE_UINT8(sbr, LSIState),
2136
2137 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2138 VMSTATE_END_OF_LIST()
2139 }
2140 };
2141
2142 static int lsi_scsi_uninit(PCIDevice *d)
2143 {
2144 LSIState *s = DO_UPCAST(LSIState, dev, d);
2145
2146 cpu_unregister_io_memory(s->mmio_io_addr);
2147 cpu_unregister_io_memory(s->ram_io_addr);
2148
2149 return 0;
2150 }
2151
2152 static int lsi_scsi_init(PCIDevice *dev)
2153 {
2154 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2155 uint8_t *pci_conf;
2156
2157 pci_conf = s->dev.config;
2158
2159 /* PCI Vendor ID (word) */
2160 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2161 /* PCI device ID (word) */
2162 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2163 /* PCI base class code */
2164 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2165 /* PCI subsystem ID */
2166 pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2167 pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
2168 /* PCI latency timer = 255 */
2169 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2170 /* TODO: RST# value should be 0 */
2171 /* Interrupt pin 1 */
2172 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2173
2174 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2175 lsi_mmio_writefn, s);
2176 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2177 lsi_ram_writefn, s);
2178
2179 /* TODO: use dev and get rid of cast below */
2180 pci_register_bar((struct PCIDevice *)s, 0, 256,
2181 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2182 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2183 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2184 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2185 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2186 QTAILQ_INIT(&s->queue);
2187
2188 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2189 if (!dev->qdev.hotplugged) {
2190 return scsi_bus_legacy_handle_cmdline(&s->bus);
2191 }
2192 return 0;
2193 }
2194
2195 static PCIDeviceInfo lsi_info = {
2196 .qdev.name = "lsi53c895a",
2197 .qdev.alias = "lsi",
2198 .qdev.size = sizeof(LSIState),
2199 .qdev.reset = lsi_scsi_reset,
2200 .qdev.vmsd = &vmstate_lsi_scsi,
2201 .init = lsi_scsi_init,
2202 .exit = lsi_scsi_uninit,
2203 };
2204
2205 static void lsi53c895a_register_devices(void)
2206 {
2207 pci_qdev_register(&lsi_info);
2208 }
2209
2210 device_init(lsi53c895a_register_devices);
various patches