?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
spapr: use specific endian ld/st_phys
[qemu/v9fs2.git] / hw / lsi53c895a.c
blob940b43abfd26ae0c3da8f6ec6d3f18c02fb461d4
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
159
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
162 #define PHASE_DO 0
163 #define PHASE_DI 1
164 #define PHASE_CMD 2
165 #define PHASE_ST 3
166 #define PHASE_MO 6
167 #define PHASE_MI 7
168 #define PHASE_MASK 7
169
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
172
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
175
176 typedef struct lsi_request {
177 SCSIRequest *req;
178 uint32_t tag;
179 uint32_t dma_len;
180 uint8_t *dma_buf;
181 uint32_t pending;
182 int out;
183 QTAILQ_ENTRY(lsi_request) next;
184 } lsi_request;
185
186 typedef struct {
187 PCIDevice dev;
188 int mmio_io_addr;
189 int ram_io_addr;
190 uint32_t script_ram_base;
191
192 int carry; /* ??? Should this be an a visible register somewhere? */
193 int status;
194 /* Action to take at the end of a MSG IN phase.
195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
196 int msg_action;
197 int msg_len;
198 uint8_t msg[LSI_MAX_MSGIN_LEN];
199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
203 int waiting;
204 SCSIBus bus;
205 int current_lun;
206 /* The tag is a combination of the device ID and the SCSI tag. */
207 uint32_t select_tag;
208 int command_complete;
209 QTAILQ_HEAD(, lsi_request) queue;
210 lsi_request *current;
211
212 uint32_t dsa;
213 uint32_t temp;
214 uint32_t dnad;
215 uint32_t dbc;
216 uint8_t istat0;
217 uint8_t istat1;
218 uint8_t dcmd;
219 uint8_t dstat;
220 uint8_t dien;
221 uint8_t sist0;
222 uint8_t sist1;
223 uint8_t sien0;
224 uint8_t sien1;
225 uint8_t mbox0;
226 uint8_t mbox1;
227 uint8_t dfifo;
228 uint8_t ctest2;
229 uint8_t ctest3;
230 uint8_t ctest4;
231 uint8_t ctest5;
232 uint8_t ccntl0;
233 uint8_t ccntl1;
234 uint32_t dsp;
235 uint32_t dsps;
236 uint8_t dmode;
237 uint8_t dcntl;
238 uint8_t scntl0;
239 uint8_t scntl1;
240 uint8_t scntl2;
241 uint8_t scntl3;
242 uint8_t sstat0;
243 uint8_t sstat1;
244 uint8_t scid;
245 uint8_t sxfer;
246 uint8_t socl;
247 uint8_t sdid;
248 uint8_t ssid;
249 uint8_t sfbr;
250 uint8_t stest1;
251 uint8_t stest2;
252 uint8_t stest3;
253 uint8_t sidl;
254 uint8_t stime0;
255 uint8_t respid0;
256 uint8_t respid1;
257 uint32_t mmrs;
258 uint32_t mmws;
259 uint32_t sfs;
260 uint32_t drs;
261 uint32_t sbms;
262 uint32_t dbms;
263 uint32_t dnad64;
264 uint32_t pmjad1;
265 uint32_t pmjad2;
266 uint32_t rbc;
267 uint32_t ua;
268 uint32_t ia;
269 uint32_t sbc;
270 uint32_t csbc;
271 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
272 uint8_t sbr;
273
274 /* Script ram is stored as 32-bit words in host byteorder. */
275 uint32_t script_ram[2048];
276 } LSIState;
277
278 static inline int lsi_irq_on_rsl(LSIState *s)
279 {
280 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
281 }
282
283 static void lsi_soft_reset(LSIState *s)
284 {
285 lsi_request *p;
286
287 DPRINTF("Reset\n");
288 s->carry = 0;
289
290 s->msg_action = 0;
291 s->msg_len = 0;
292 s->waiting = 0;
293 s->dsa = 0;
294 s->dnad = 0;
295 s->dbc = 0;
296 s->temp = 0;
297 memset(s->scratch, 0, sizeof(s->scratch));
298 s->istat0 = 0;
299 s->istat1 = 0;
300 s->dcmd = 0x40;
301 s->dstat = LSI_DSTAT_DFE;
302 s->dien = 0;
303 s->sist0 = 0;
304 s->sist1 = 0;
305 s->sien0 = 0;
306 s->sien1 = 0;
307 s->mbox0 = 0;
308 s->mbox1 = 0;
309 s->dfifo = 0;
310 s->ctest2 = LSI_CTEST2_DACK;
311 s->ctest3 = 0;
312 s->ctest4 = 0;
313 s->ctest5 = 0;
314 s->ccntl0 = 0;
315 s->ccntl1 = 0;
316 s->dsp = 0;
317 s->dsps = 0;
318 s->dmode = 0;
319 s->dcntl = 0;
320 s->scntl0 = 0xc0;
321 s->scntl1 = 0;
322 s->scntl2 = 0;
323 s->scntl3 = 0;
324 s->sstat0 = 0;
325 s->sstat1 = 0;
326 s->scid = 7;
327 s->sxfer = 0;
328 s->socl = 0;
329 s->sdid = 0;
330 s->ssid = 0;
331 s->stest1 = 0;
332 s->stest2 = 0;
333 s->stest3 = 0;
334 s->sidl = 0;
335 s->stime0 = 0;
336 s->respid0 = 0x80;
337 s->respid1 = 0;
338 s->mmrs = 0;
339 s->mmws = 0;
340 s->sfs = 0;
341 s->drs = 0;
342 s->sbms = 0;
343 s->dbms = 0;
344 s->dnad64 = 0;
345 s->pmjad1 = 0;
346 s->pmjad2 = 0;
347 s->rbc = 0;
348 s->ua = 0;
349 s->ia = 0;
350 s->sbc = 0;
351 s->csbc = 0;
352 s->sbr = 0;
353 while (!QTAILQ_EMPTY(&s->queue)) {
354 p = QTAILQ_FIRST(&s->queue);
355 QTAILQ_REMOVE(&s->queue, p, next);
356 qemu_free(p);
357 }
358 if (s->current) {
359 qemu_free(s->current);
360 s->current = NULL;
361 }
362 }
363
364 static int lsi_dma_40bit(LSIState *s)
365 {
366 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
367 return 1;
368 return 0;
369 }
370
371 static int lsi_dma_ti64bit(LSIState *s)
372 {
373 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
374 return 1;
375 return 0;
376 }
377
378 static int lsi_dma_64bit(LSIState *s)
379 {
380 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
381 return 1;
382 return 0;
383 }
384
385 static uint8_t lsi_reg_readb(LSIState *s, int offset);
386 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
387 static void lsi_execute_script(LSIState *s);
388 static void lsi_reselect(LSIState *s, lsi_request *p);
389
390 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
391 {
392 uint32_t buf;
393
394 /* Optimize reading from SCRIPTS RAM. */
395 if ((addr & 0xffffe000) == s->script_ram_base) {
396 return s->script_ram[(addr & 0x1fff) >> 2];
397 }
398 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
399 return cpu_to_le32(buf);
400 }
401
402 static void lsi_stop_script(LSIState *s)
403 {
404 s->istat1 &= ~LSI_ISTAT1_SRUN;
405 }
406
407 static void lsi_update_irq(LSIState *s)
408 {
409 int level;
410 static int last_level;
411 lsi_request *p;
412
413 /* It's unclear whether the DIP/SIP bits should be cleared when the
414 Interrupt Status Registers are cleared or when istat0 is read.
415 We currently do the formwer, which seems to work. */
416 level = 0;
417 if (s->dstat) {
418 if (s->dstat & s->dien)
419 level = 1;
420 s->istat0 |= LSI_ISTAT0_DIP;
421 } else {
422 s->istat0 &= ~LSI_ISTAT0_DIP;
423 }
424
425 if (s->sist0 || s->sist1) {
426 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
427 level = 1;
428 s->istat0 |= LSI_ISTAT0_SIP;
429 } else {
430 s->istat0 &= ~LSI_ISTAT0_SIP;
431 }
432 if (s->istat0 & LSI_ISTAT0_INTF)
433 level = 1;
434
435 if (level != last_level) {
436 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
437 level, s->dstat, s->sist1, s->sist0);
438 last_level = level;
439 }
440 qemu_set_irq(s->dev.irq[0], level);
441
442 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
443 DPRINTF("Handled IRQs & disconnected, looking for pending "
444 "processes\n");
445 QTAILQ_FOREACH(p, &s->queue, next) {
446 if (p->pending) {
447 lsi_reselect(s, p);
448 break;
449 }
450 }
451 }
452 }
453
454 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
455 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
456 {
457 uint32_t mask0;
458 uint32_t mask1;
459
460 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
461 stat1, stat0, s->sist1, s->sist0);
462 s->sist0 |= stat0;
463 s->sist1 |= stat1;
464 /* Stop processor on fatal or unmasked interrupt. As a special hack
465 we don't stop processing when raising STO. Instead continue
466 execution and stop at the next insn that accesses the SCSI bus. */
467 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
468 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
469 mask1 &= ~LSI_SIST1_STO;
470 if (s->sist0 & mask0 || s->sist1 & mask1) {
471 lsi_stop_script(s);
472 }
473 lsi_update_irq(s);
474 }
475
476 /* Stop SCRIPTS execution and raise a DMA interrupt. */
477 static void lsi_script_dma_interrupt(LSIState *s, int stat)
478 {
479 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
480 s->dstat |= stat;
481 lsi_update_irq(s);
482 lsi_stop_script(s);
483 }
484
485 static inline void lsi_set_phase(LSIState *s, int phase)
486 {
487 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
488 }
489
490 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
491 {
492 /* Trigger a phase mismatch. */
493 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
494 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
495 s->dsp = out ? s->pmjad1 : s->pmjad2;
496 } else {
497 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
498 }
499 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
500 } else {
501 DPRINTF("Phase mismatch interrupt\n");
502 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
503 lsi_stop_script(s);
504 }
505 lsi_set_phase(s, new_phase);
506 }
507
508
509 /* Resume SCRIPTS execution after a DMA operation. */
510 static void lsi_resume_script(LSIState *s)
511 {
512 if (s->waiting != 2) {
513 s->waiting = 0;
514 lsi_execute_script(s);
515 } else {
516 s->waiting = 0;
517 }
518 }
519
520 static void lsi_disconnect(LSIState *s)
521 {
522 s->scntl1 &= ~LSI_SCNTL1_CON;
523 s->sstat1 &= ~PHASE_MASK;
524 }
525
526 static void lsi_bad_selection(LSIState *s, uint32_t id)
527 {
528 DPRINTF("Selected absent target %d\n", id);
529 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
530 lsi_disconnect(s);
531 }
532
533 /* Initiate a SCSI layer data transfer. */
534 static void lsi_do_dma(LSIState *s, int out)
535 {
536 uint32_t count, id;
537 target_phys_addr_t addr;
538 SCSIDevice *dev;
539
540 assert(s->current);
541 if (!s->current->dma_len) {
542 /* Wait until data is available. */
543 DPRINTF("DMA no data available\n");
544 return;
545 }
546
547 id = (s->current->tag >> 8) & 0xf;
548 dev = s->bus.devs[id];
549 if (!dev) {
550 lsi_bad_selection(s, id);
551 return;
552 }
553
554 count = s->dbc;
555 if (count > s->current->dma_len)
556 count = s->current->dma_len;
557
558 addr = s->dnad;
559 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
560 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
561 addr |= ((uint64_t)s->dnad64 << 32);
562 else if (s->dbms)
563 addr |= ((uint64_t)s->dbms << 32);
564 else if (s->sbms)
565 addr |= ((uint64_t)s->sbms << 32);
566
567 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
568 s->csbc += count;
569 s->dnad += count;
570 s->dbc -= count;
571 if (s->current->dma_buf == NULL) {
572 s->current->dma_buf = scsi_req_get_buf(s->current->req);
573 }
574 /* ??? Set SFBR to first data byte. */
575 if (out) {
576 cpu_physical_memory_read(addr, s->current->dma_buf, count);
577 } else {
578 cpu_physical_memory_write(addr, s->current->dma_buf, count);
579 }
580 s->current->dma_len -= count;
581 if (s->current->dma_len == 0) {
582 s->current->dma_buf = NULL;
583 scsi_req_continue(s->current->req);
584 } else {
585 s->current->dma_buf += count;
586 lsi_resume_script(s);
587 }
588 }
589
590
591 /* Add a command to the queue. */
592 static void lsi_queue_command(LSIState *s)
593 {
594 lsi_request *p = s->current;
595
596 DPRINTF("Queueing tag=0x%x\n", p->tag);
597 assert(s->current != NULL);
598 assert(s->current->dma_len == 0);
599 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
600 s->current = NULL;
601
602 p->pending = 0;
603 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
604 }
605
606 /* Queue a byte for a MSG IN phase. */
607 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
608 {
609 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
610 BADF("MSG IN data too long\n");
611 } else {
612 DPRINTF("MSG IN 0x%02x\n", data);
613 s->msg[s->msg_len++] = data;
614 }
615 }
616
617 /* Perform reselection to continue a command. */
618 static void lsi_reselect(LSIState *s, lsi_request *p)
619 {
620 int id;
621
622 assert(s->current == NULL);
623 QTAILQ_REMOVE(&s->queue, p, next);
624 s->current = p;
625
626 id = (p->tag >> 8) & 0xf;
627 s->ssid = id | 0x80;
628 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
629 if (!(s->dcntl & LSI_DCNTL_COM)) {
630 s->sfbr = 1 << (id & 0x7);
631 }
632 DPRINTF("Reselected target %d\n", id);
633 s->scntl1 |= LSI_SCNTL1_CON;
634 lsi_set_phase(s, PHASE_MI);
635 s->msg_action = p->out ? 2 : 3;
636 s->current->dma_len = p->pending;
637 lsi_add_msg_byte(s, 0x80);
638 if (s->current->tag & LSI_TAG_VALID) {
639 lsi_add_msg_byte(s, 0x20);
640 lsi_add_msg_byte(s, p->tag & 0xff);
641 }
642
643 if (lsi_irq_on_rsl(s)) {
644 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
645 }
646 }
647
648 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
649 {
650 lsi_request *p;
651
652 QTAILQ_FOREACH(p, &s->queue, next) {
653 if (p->tag == tag) {
654 return p;
655 }
656 }
657
658 return NULL;
659 }
660
661 static void lsi_request_cancelled(SCSIRequest *req)
662 {
663 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
664 lsi_request *p;
665
666 if (s->current && req == s->current->req) {
667 scsi_req_unref(req);
668 qemu_free(s->current);
669 s->current = NULL;
670 return;
671 }
672
673 p = lsi_find_by_tag(s, req->tag);
674 if (p) {
675 QTAILQ_REMOVE(&s->queue, p, next);
676 scsi_req_unref(req);
677 qemu_free(p);
678 }
679 }
680
681 /* Record that data is available for a queued command. Returns zero if
682 the device was reselected, nonzero if the IO is deferred. */
683 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t len)
684 {
685 lsi_request *p;
686
687 p = lsi_find_by_tag(s, tag);
688 if (!p) {
689 BADF("IO with unknown tag %d\n", tag);
690 return 1;
691 }
692
693 if (p->pending) {
694 BADF("Multiple IO pending for tag %d\n", tag);
695 }
696 p->pending = len;
697 /* Reselect if waiting for it, or if reselection triggers an IRQ
698 and the bus is free.
699 Since no interrupt stacking is implemented in the emulation, it
700 is also required that there are no pending interrupts waiting
701 for service from the device driver. */
702 if (s->waiting == 1 ||
703 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
704 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
705 /* Reselect device. */
706 lsi_reselect(s, p);
707 return 0;
708 } else {
709 DPRINTF("Queueing IO tag=0x%x\n", tag);
710 p->pending = len;
711 return 1;
712 }
713 }
714
715 /* Callback to indicate that the SCSI layer has completed a command. */
716 static void lsi_command_complete(SCSIRequest *req, uint32_t status)
717 {
718 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
719 int out;
720
721 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
722 DPRINTF("Command complete status=%d\n", (int)status);
723 s->status = status;
724 s->command_complete = 2;
725 if (s->waiting && s->dbc != 0) {
726 /* Raise phase mismatch for short transfers. */
727 lsi_bad_phase(s, out, PHASE_ST);
728 } else {
729 lsi_set_phase(s, PHASE_ST);
730 }
731
732 if (s->current && req == s->current->req) {
733 scsi_req_unref(s->current->req);
734 qemu_free(s->current);
735 s->current = NULL;
736 }
737 lsi_resume_script(s);
738 }
739
740 /* Callback to indicate that the SCSI layer has completed a transfer. */
741 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
742 {
743 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
744 int out;
745
746 if (s->waiting == 1 || !s->current || req->tag != s->current->tag ||
747 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
748 if (lsi_queue_tag(s, req->tag, len)) {
749 return;
750 }
751 }
752
753 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
754
755 /* host adapter (re)connected */
756 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
757 s->current->dma_len = len;
758 s->command_complete = 1;
759 if (s->waiting) {
760 if (s->waiting == 1 || s->dbc == 0) {
761 lsi_resume_script(s);
762 } else {
763 lsi_do_dma(s, out);
764 }
765 }
766 }
767
768 static void lsi_do_command(LSIState *s)
769 {
770 SCSIDevice *dev;
771 uint8_t buf[16];
772 uint32_t id;
773 int n;
774
775 DPRINTF("Send command len=%d\n", s->dbc);
776 if (s->dbc > 16)
777 s->dbc = 16;
778 cpu_physical_memory_read(s->dnad, buf, s->dbc);
779 s->sfbr = buf[0];
780 s->command_complete = 0;
781
782 id = (s->select_tag >> 8) & 0xf;
783 dev = s->bus.devs[id];
784 if (!dev) {
785 lsi_bad_selection(s, id);
786 return;
787 }
788
789 assert(s->current == NULL);
790 s->current = qemu_mallocz(sizeof(lsi_request));
791 s->current->tag = s->select_tag;
792 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun);
793
794 n = scsi_req_enqueue(s->current->req, buf);
795 if (n) {
796 if (n > 0) {
797 lsi_set_phase(s, PHASE_DI);
798 } else if (n < 0) {
799 lsi_set_phase(s, PHASE_DO);
800 }
801 scsi_req_continue(s->current->req);
802 }
803 if (!s->command_complete) {
804 if (n) {
805 /* Command did not complete immediately so disconnect. */
806 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
807 lsi_add_msg_byte(s, 4); /* DISCONNECT */
808 /* wait data */
809 lsi_set_phase(s, PHASE_MI);
810 s->msg_action = 1;
811 lsi_queue_command(s);
812 } else {
813 /* wait command complete */
814 lsi_set_phase(s, PHASE_DI);
815 }
816 }
817 }
818
819 static void lsi_do_status(LSIState *s)
820 {
821 uint8_t status;
822 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
823 if (s->dbc != 1)
824 BADF("Bad Status move\n");
825 s->dbc = 1;
826 status = s->status;
827 s->sfbr = status;
828 cpu_physical_memory_write(s->dnad, &status, 1);
829 lsi_set_phase(s, PHASE_MI);
830 s->msg_action = 1;
831 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
832 }
833
834 static void lsi_do_msgin(LSIState *s)
835 {
836 int len;
837 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
838 s->sfbr = s->msg[0];
839 len = s->msg_len;
840 if (len > s->dbc)
841 len = s->dbc;
842 cpu_physical_memory_write(s->dnad, s->msg, len);
843 /* Linux drivers rely on the last byte being in the SIDL. */
844 s->sidl = s->msg[len - 1];
845 s->msg_len -= len;
846 if (s->msg_len) {
847 memmove(s->msg, s->msg + len, s->msg_len);
848 } else {
849 /* ??? Check if ATN (not yet implemented) is asserted and maybe
850 switch to PHASE_MO. */
851 switch (s->msg_action) {
852 case 0:
853 lsi_set_phase(s, PHASE_CMD);
854 break;
855 case 1:
856 lsi_disconnect(s);
857 break;
858 case 2:
859 lsi_set_phase(s, PHASE_DO);
860 break;
861 case 3:
862 lsi_set_phase(s, PHASE_DI);
863 break;
864 default:
865 abort();
866 }
867 }
868 }
869
870 /* Read the next byte during a MSGOUT phase. */
871 static uint8_t lsi_get_msgbyte(LSIState *s)
872 {
873 uint8_t data;
874 cpu_physical_memory_read(s->dnad, &data, 1);
875 s->dnad++;
876 s->dbc--;
877 return data;
878 }
879
880 /* Skip the next n bytes during a MSGOUT phase. */
881 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
882 {
883 s->dnad += n;
884 s->dbc -= n;
885 }
886
887 static void lsi_do_msgout(LSIState *s)
888 {
889 uint8_t msg;
890 int len;
891 uint32_t current_tag;
892 lsi_request *current_req, *p, *p_next;
893 int id;
894
895 if (s->current) {
896 current_tag = s->current->tag;
897 current_req = s->current;
898 } else {
899 current_tag = s->select_tag;
900 current_req = lsi_find_by_tag(s, current_tag);
901 }
902 id = (current_tag >> 8) & 0xf;
903
904 DPRINTF("MSG out len=%d\n", s->dbc);
905 while (s->dbc) {
906 msg = lsi_get_msgbyte(s);
907 s->sfbr = msg;
908
909 switch (msg) {
910 case 0x04:
911 DPRINTF("MSG: Disconnect\n");
912 lsi_disconnect(s);
913 break;
914 case 0x08:
915 DPRINTF("MSG: No Operation\n");
916 lsi_set_phase(s, PHASE_CMD);
917 break;
918 case 0x01:
919 len = lsi_get_msgbyte(s);
920 msg = lsi_get_msgbyte(s);
921 (void)len; /* avoid a warning about unused variable*/
922 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
923 switch (msg) {
924 case 1:
925 DPRINTF("SDTR (ignored)\n");
926 lsi_skip_msgbytes(s, 2);
927 break;
928 case 3:
929 DPRINTF("WDTR (ignored)\n");
930 lsi_skip_msgbytes(s, 1);
931 break;
932 default:
933 goto bad;
934 }
935 break;
936 case 0x20: /* SIMPLE queue */
937 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
938 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
939 break;
940 case 0x21: /* HEAD of queue */
941 BADF("HEAD queue not implemented\n");
942 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
943 break;
944 case 0x22: /* ORDERED queue */
945 BADF("ORDERED queue not implemented\n");
946 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
947 break;
948 case 0x0d:
949 /* The ABORT TAG message clears the current I/O process only. */
950 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
951 if (current_req) {
952 scsi_req_cancel(current_req->req);
953 }
954 lsi_disconnect(s);
955 break;
956 case 0x06:
957 case 0x0e:
958 case 0x0c:
959 /* The ABORT message clears all I/O processes for the selecting
960 initiator on the specified logical unit of the target. */
961 if (msg == 0x06) {
962 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
963 }
964 /* The CLEAR QUEUE message clears all I/O processes for all
965 initiators on the specified logical unit of the target. */
966 if (msg == 0x0e) {
967 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
968 }
969 /* The BUS DEVICE RESET message clears all I/O processes for all
970 initiators on all logical units of the target. */
971 if (msg == 0x0c) {
972 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
973 }
974
975 /* clear the current I/O process */
976 if (s->current) {
977 scsi_req_cancel(s->current->req);
978 }
979
980 /* As the current implemented devices scsi_disk and scsi_generic
981 only support one LUN, we don't need to keep track of LUNs.
982 Clearing I/O processes for other initiators could be possible
983 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
984 device, but this is currently not implemented (and seems not
985 to be really necessary). So let's simply clear all queued
986 commands for the current device: */
987 id = current_tag & 0x0000ff00;
988 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
989 if ((p->tag & 0x0000ff00) == id) {
990 scsi_req_cancel(p->req);
991 }
992 }
993
994 lsi_disconnect(s);
995 break;
996 default:
997 if ((msg & 0x80) == 0) {
998 goto bad;
999 }
1000 s->current_lun = msg & 7;
1001 DPRINTF("Select LUN %d\n", s->current_lun);
1002 lsi_set_phase(s, PHASE_CMD);
1003 break;
1004 }
1005 }
1006 return;
1007 bad:
1008 BADF("Unimplemented message 0x%02x\n", msg);
1009 lsi_set_phase(s, PHASE_MI);
1010 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1011 s->msg_action = 0;
1012 }
1013
1014 /* Sign extend a 24-bit value. */
1015 static inline int32_t sxt24(int32_t n)
1016 {
1017 return (n << 8) >> 8;
1018 }
1019
1020 #define LSI_BUF_SIZE 4096
1021 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1022 {
1023 int n;
1024 uint8_t buf[LSI_BUF_SIZE];
1025
1026 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1027 while (count) {
1028 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1029 cpu_physical_memory_read(src, buf, n);
1030 cpu_physical_memory_write(dest, buf, n);
1031 src += n;
1032 dest += n;
1033 count -= n;
1034 }
1035 }
1036
1037 static void lsi_wait_reselect(LSIState *s)
1038 {
1039 lsi_request *p;
1040
1041 DPRINTF("Wait Reselect\n");
1042
1043 QTAILQ_FOREACH(p, &s->queue, next) {
1044 if (p->pending) {
1045 lsi_reselect(s, p);
1046 break;
1047 }
1048 }
1049 if (s->current == NULL) {
1050 s->waiting = 1;
1051 }
1052 }
1053
1054 static void lsi_execute_script(LSIState *s)
1055 {
1056 uint32_t insn;
1057 uint32_t addr, addr_high;
1058 int opcode;
1059 int insn_processed = 0;
1060
1061 s->istat1 |= LSI_ISTAT1_SRUN;
1062 again:
1063 insn_processed++;
1064 insn = read_dword(s, s->dsp);
1065 if (!insn) {
1066 /* If we receive an empty opcode increment the DSP by 4 bytes
1067 instead of 8 and execute the next opcode at that location */
1068 s->dsp += 4;
1069 goto again;
1070 }
1071 addr = read_dword(s, s->dsp + 4);
1072 addr_high = 0;
1073 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1074 s->dsps = addr;
1075 s->dcmd = insn >> 24;
1076 s->dsp += 8;
1077 switch (insn >> 30) {
1078 case 0: /* Block move. */
1079 if (s->sist1 & LSI_SIST1_STO) {
1080 DPRINTF("Delayed select timeout\n");
1081 lsi_stop_script(s);
1082 break;
1083 }
1084 s->dbc = insn & 0xffffff;
1085 s->rbc = s->dbc;
1086 /* ??? Set ESA. */
1087 s->ia = s->dsp - 8;
1088 if (insn & (1 << 29)) {
1089 /* Indirect addressing. */
1090 addr = read_dword(s, addr);
1091 } else if (insn & (1 << 28)) {
1092 uint32_t buf[2];
1093 int32_t offset;
1094 /* Table indirect addressing. */
1095
1096 /* 32-bit Table indirect */
1097 offset = sxt24(addr);
1098 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
1099 /* byte count is stored in bits 0:23 only */
1100 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1101 s->rbc = s->dbc;
1102 addr = cpu_to_le32(buf[1]);
1103
1104 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1105 * table, bits [31:24] */
1106 if (lsi_dma_40bit(s))
1107 addr_high = cpu_to_le32(buf[0]) >> 24;
1108 else if (lsi_dma_ti64bit(s)) {
1109 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1110 switch (selector) {
1111 case 0 ... 0x0f:
1112 /* offset index into scratch registers since
1113 * TI64 mode can use registers C to R */
1114 addr_high = s->scratch[2 + selector];
1115 break;
1116 case 0x10:
1117 addr_high = s->mmrs;
1118 break;
1119 case 0x11:
1120 addr_high = s->mmws;
1121 break;
1122 case 0x12:
1123 addr_high = s->sfs;
1124 break;
1125 case 0x13:
1126 addr_high = s->drs;
1127 break;
1128 case 0x14:
1129 addr_high = s->sbms;
1130 break;
1131 case 0x15:
1132 addr_high = s->dbms;
1133 break;
1134 default:
1135 BADF("Illegal selector specified (0x%x > 0x15)"
1136 " for 64-bit DMA block move", selector);
1137 break;
1138 }
1139 }
1140 } else if (lsi_dma_64bit(s)) {
1141 /* fetch a 3rd dword if 64-bit direct move is enabled and
1142 only if we're not doing table indirect or indirect addressing */
1143 s->dbms = read_dword(s, s->dsp);
1144 s->dsp += 4;
1145 s->ia = s->dsp - 12;
1146 }
1147 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1148 DPRINTF("Wrong phase got %d expected %d\n",
1149 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1150 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1151 break;
1152 }
1153 s->dnad = addr;
1154 s->dnad64 = addr_high;
1155 switch (s->sstat1 & 0x7) {
1156 case PHASE_DO:
1157 s->waiting = 2;
1158 lsi_do_dma(s, 1);
1159 if (s->waiting)
1160 s->waiting = 3;
1161 break;
1162 case PHASE_DI:
1163 s->waiting = 2;
1164 lsi_do_dma(s, 0);
1165 if (s->waiting)
1166 s->waiting = 3;
1167 break;
1168 case PHASE_CMD:
1169 lsi_do_command(s);
1170 break;
1171 case PHASE_ST:
1172 lsi_do_status(s);
1173 break;
1174 case PHASE_MO:
1175 lsi_do_msgout(s);
1176 break;
1177 case PHASE_MI:
1178 lsi_do_msgin(s);
1179 break;
1180 default:
1181 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1182 exit(1);
1183 }
1184 s->dfifo = s->dbc & 0xff;
1185 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1186 s->sbc = s->dbc;
1187 s->rbc -= s->dbc;
1188 s->ua = addr + s->dbc;
1189 break;
1190
1191 case 1: /* IO or Read/Write instruction. */
1192 opcode = (insn >> 27) & 7;
1193 if (opcode < 5) {
1194 uint32_t id;
1195
1196 if (insn & (1 << 25)) {
1197 id = read_dword(s, s->dsa + sxt24(insn));
1198 } else {
1199 id = insn;
1200 }
1201 id = (id >> 16) & 0xf;
1202 if (insn & (1 << 26)) {
1203 addr = s->dsp + sxt24(addr);
1204 }
1205 s->dnad = addr;
1206 switch (opcode) {
1207 case 0: /* Select */
1208 s->sdid = id;
1209 if (s->scntl1 & LSI_SCNTL1_CON) {
1210 DPRINTF("Already reselected, jumping to alternative address\n");
1211 s->dsp = s->dnad;
1212 break;
1213 }
1214 s->sstat0 |= LSI_SSTAT0_WOA;
1215 s->scntl1 &= ~LSI_SCNTL1_IARB;
1216 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1217 lsi_bad_selection(s, id);
1218 break;
1219 }
1220 DPRINTF("Selected target %d%s\n",
1221 id, insn & (1 << 3) ? " ATN" : "");
1222 /* ??? Linux drivers compain when this is set. Maybe
1223 it only applies in low-level mode (unimplemented).
1224 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1225 s->select_tag = id << 8;
1226 s->scntl1 |= LSI_SCNTL1_CON;
1227 if (insn & (1 << 3)) {
1228 s->socl |= LSI_SOCL_ATN;
1229 }
1230 lsi_set_phase(s, PHASE_MO);
1231 break;
1232 case 1: /* Disconnect */
1233 DPRINTF("Wait Disconnect\n");
1234 s->scntl1 &= ~LSI_SCNTL1_CON;
1235 break;
1236 case 2: /* Wait Reselect */
1237 if (!lsi_irq_on_rsl(s)) {
1238 lsi_wait_reselect(s);
1239 }
1240 break;
1241 case 3: /* Set */
1242 DPRINTF("Set%s%s%s%s\n",
1243 insn & (1 << 3) ? " ATN" : "",
1244 insn & (1 << 6) ? " ACK" : "",
1245 insn & (1 << 9) ? " TM" : "",
1246 insn & (1 << 10) ? " CC" : "");
1247 if (insn & (1 << 3)) {
1248 s->socl |= LSI_SOCL_ATN;
1249 lsi_set_phase(s, PHASE_MO);
1250 }
1251 if (insn & (1 << 9)) {
1252 BADF("Target mode not implemented\n");
1253 exit(1);
1254 }
1255 if (insn & (1 << 10))
1256 s->carry = 1;
1257 break;
1258 case 4: /* Clear */
1259 DPRINTF("Clear%s%s%s%s\n",
1260 insn & (1 << 3) ? " ATN" : "",
1261 insn & (1 << 6) ? " ACK" : "",
1262 insn & (1 << 9) ? " TM" : "",
1263 insn & (1 << 10) ? " CC" : "");
1264 if (insn & (1 << 3)) {
1265 s->socl &= ~LSI_SOCL_ATN;
1266 }
1267 if (insn & (1 << 10))
1268 s->carry = 0;
1269 break;
1270 }
1271 } else {
1272 uint8_t op0;
1273 uint8_t op1;
1274 uint8_t data8;
1275 int reg;
1276 int operator;
1277 #ifdef DEBUG_LSI
1278 static const char *opcode_names[3] =
1279 {"Write", "Read", "Read-Modify-Write"};
1280 static const char *operator_names[8] =
1281 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1282 #endif
1283
1284 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1285 data8 = (insn >> 8) & 0xff;
1286 opcode = (insn >> 27) & 7;
1287 operator = (insn >> 24) & 7;
1288 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1289 opcode_names[opcode - 5], reg,
1290 operator_names[operator], data8, s->sfbr,
1291 (insn & (1 << 23)) ? " SFBR" : "");
1292 op0 = op1 = 0;
1293 switch (opcode) {
1294 case 5: /* From SFBR */
1295 op0 = s->sfbr;
1296 op1 = data8;
1297 break;
1298 case 6: /* To SFBR */
1299 if (operator)
1300 op0 = lsi_reg_readb(s, reg);
1301 op1 = data8;
1302 break;
1303 case 7: /* Read-modify-write */
1304 if (operator)
1305 op0 = lsi_reg_readb(s, reg);
1306 if (insn & (1 << 23)) {
1307 op1 = s->sfbr;
1308 } else {
1309 op1 = data8;
1310 }
1311 break;
1312 }
1313
1314 switch (operator) {
1315 case 0: /* move */
1316 op0 = op1;
1317 break;
1318 case 1: /* Shift left */
1319 op1 = op0 >> 7;
1320 op0 = (op0 << 1) | s->carry;
1321 s->carry = op1;
1322 break;
1323 case 2: /* OR */
1324 op0 |= op1;
1325 break;
1326 case 3: /* XOR */
1327 op0 ^= op1;
1328 break;
1329 case 4: /* AND */
1330 op0 &= op1;
1331 break;
1332 case 5: /* SHR */
1333 op1 = op0 & 1;
1334 op0 = (op0 >> 1) | (s->carry << 7);
1335 s->carry = op1;
1336 break;
1337 case 6: /* ADD */
1338 op0 += op1;
1339 s->carry = op0 < op1;
1340 break;
1341 case 7: /* ADC */
1342 op0 += op1 + s->carry;
1343 if (s->carry)
1344 s->carry = op0 <= op1;
1345 else
1346 s->carry = op0 < op1;
1347 break;
1348 }
1349
1350 switch (opcode) {
1351 case 5: /* From SFBR */
1352 case 7: /* Read-modify-write */
1353 lsi_reg_writeb(s, reg, op0);
1354 break;
1355 case 6: /* To SFBR */
1356 s->sfbr = op0;
1357 break;
1358 }
1359 }
1360 break;
1361
1362 case 2: /* Transfer Control. */
1363 {
1364 int cond;
1365 int jmp;
1366
1367 if ((insn & 0x002e0000) == 0) {
1368 DPRINTF("NOP\n");
1369 break;
1370 }
1371 if (s->sist1 & LSI_SIST1_STO) {
1372 DPRINTF("Delayed select timeout\n");
1373 lsi_stop_script(s);
1374 break;
1375 }
1376 cond = jmp = (insn & (1 << 19)) != 0;
1377 if (cond == jmp && (insn & (1 << 21))) {
1378 DPRINTF("Compare carry %d\n", s->carry == jmp);
1379 cond = s->carry != 0;
1380 }
1381 if (cond == jmp && (insn & (1 << 17))) {
1382 DPRINTF("Compare phase %d %c= %d\n",
1383 (s->sstat1 & PHASE_MASK),
1384 jmp ? '=' : '!',
1385 ((insn >> 24) & 7));
1386 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1387 }
1388 if (cond == jmp && (insn & (1 << 18))) {
1389 uint8_t mask;
1390
1391 mask = (~insn >> 8) & 0xff;
1392 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1393 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1394 cond = (s->sfbr & mask) == (insn & mask);
1395 }
1396 if (cond == jmp) {
1397 if (insn & (1 << 23)) {
1398 /* Relative address. */
1399 addr = s->dsp + sxt24(addr);
1400 }
1401 switch ((insn >> 27) & 7) {
1402 case 0: /* Jump */
1403 DPRINTF("Jump to 0x%08x\n", addr);
1404 s->dsp = addr;
1405 break;
1406 case 1: /* Call */
1407 DPRINTF("Call 0x%08x\n", addr);
1408 s->temp = s->dsp;
1409 s->dsp = addr;
1410 break;
1411 case 2: /* Return */
1412 DPRINTF("Return to 0x%08x\n", s->temp);
1413 s->dsp = s->temp;
1414 break;
1415 case 3: /* Interrupt */
1416 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1417 if ((insn & (1 << 20)) != 0) {
1418 s->istat0 |= LSI_ISTAT0_INTF;
1419 lsi_update_irq(s);
1420 } else {
1421 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1422 }
1423 break;
1424 default:
1425 DPRINTF("Illegal transfer control\n");
1426 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1427 break;
1428 }
1429 } else {
1430 DPRINTF("Control condition failed\n");
1431 }
1432 }
1433 break;
1434
1435 case 3:
1436 if ((insn & (1 << 29)) == 0) {
1437 /* Memory move. */
1438 uint32_t dest;
1439 /* ??? The docs imply the destination address is loaded into
1440 the TEMP register. However the Linux drivers rely on
1441 the value being presrved. */
1442 dest = read_dword(s, s->dsp);
1443 s->dsp += 4;
1444 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1445 } else {
1446 uint8_t data[7];
1447 int reg;
1448 int n;
1449 int i;
1450
1451 if (insn & (1 << 28)) {
1452 addr = s->dsa + sxt24(addr);
1453 }
1454 n = (insn & 7);
1455 reg = (insn >> 16) & 0xff;
1456 if (insn & (1 << 24)) {
1457 cpu_physical_memory_read(addr, data, n);
1458 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1459 addr, *(int *)data);
1460 for (i = 0; i < n; i++) {
1461 lsi_reg_writeb(s, reg + i, data[i]);
1462 }
1463 } else {
1464 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1465 for (i = 0; i < n; i++) {
1466 data[i] = lsi_reg_readb(s, reg + i);
1467 }
1468 cpu_physical_memory_write(addr, data, n);
1469 }
1470 }
1471 }
1472 if (insn_processed > 10000 && !s->waiting) {
1473 /* Some windows drivers make the device spin waiting for a memory
1474 location to change. If we have been executed a lot of code then
1475 assume this is the case and force an unexpected device disconnect.
1476 This is apparently sufficient to beat the drivers into submission.
1477 */
1478 if (!(s->sien0 & LSI_SIST0_UDC))
1479 fprintf(stderr, "inf. loop with UDC masked\n");
1480 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1481 lsi_disconnect(s);
1482 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1483 if (s->dcntl & LSI_DCNTL_SSM) {
1484 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1485 } else {
1486 goto again;
1487 }
1488 }
1489 DPRINTF("SCRIPTS execution stopped\n");
1490 }
1491
1492 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1493 {
1494 uint8_t tmp;
1495 #define CASE_GET_REG24(name, addr) \
1496 case addr: return s->name & 0xff; \
1497 case addr + 1: return (s->name >> 8) & 0xff; \
1498 case addr + 2: return (s->name >> 16) & 0xff;
1499
1500 #define CASE_GET_REG32(name, addr) \
1501 case addr: return s->name & 0xff; \
1502 case addr + 1: return (s->name >> 8) & 0xff; \
1503 case addr + 2: return (s->name >> 16) & 0xff; \
1504 case addr + 3: return (s->name >> 24) & 0xff;
1505
1506 #ifdef DEBUG_LSI_REG
1507 DPRINTF("Read reg %x\n", offset);
1508 #endif
1509 switch (offset) {
1510 case 0x00: /* SCNTL0 */
1511 return s->scntl0;
1512 case 0x01: /* SCNTL1 */
1513 return s->scntl1;
1514 case 0x02: /* SCNTL2 */
1515 return s->scntl2;
1516 case 0x03: /* SCNTL3 */
1517 return s->scntl3;
1518 case 0x04: /* SCID */
1519 return s->scid;
1520 case 0x05: /* SXFER */
1521 return s->sxfer;
1522 case 0x06: /* SDID */
1523 return s->sdid;
1524 case 0x07: /* GPREG0 */
1525 return 0x7f;
1526 case 0x08: /* Revision ID */
1527 return 0x00;
1528 case 0xa: /* SSID */
1529 return s->ssid;
1530 case 0xb: /* SBCL */
1531 /* ??? This is not correct. However it's (hopefully) only
1532 used for diagnostics, so should be ok. */
1533 return 0;
1534 case 0xc: /* DSTAT */
1535 tmp = s->dstat | 0x80;
1536 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1537 s->dstat = 0;
1538 lsi_update_irq(s);
1539 return tmp;
1540 case 0x0d: /* SSTAT0 */
1541 return s->sstat0;
1542 case 0x0e: /* SSTAT1 */
1543 return s->sstat1;
1544 case 0x0f: /* SSTAT2 */
1545 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1546 CASE_GET_REG32(dsa, 0x10)
1547 case 0x14: /* ISTAT0 */
1548 return s->istat0;
1549 case 0x15: /* ISTAT1 */
1550 return s->istat1;
1551 case 0x16: /* MBOX0 */
1552 return s->mbox0;
1553 case 0x17: /* MBOX1 */
1554 return s->mbox1;
1555 case 0x18: /* CTEST0 */
1556 return 0xff;
1557 case 0x19: /* CTEST1 */
1558 return 0;
1559 case 0x1a: /* CTEST2 */
1560 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1561 if (s->istat0 & LSI_ISTAT0_SIGP) {
1562 s->istat0 &= ~LSI_ISTAT0_SIGP;
1563 tmp |= LSI_CTEST2_SIGP;
1564 }
1565 return tmp;
1566 case 0x1b: /* CTEST3 */
1567 return s->ctest3;
1568 CASE_GET_REG32(temp, 0x1c)
1569 case 0x20: /* DFIFO */
1570 return 0;
1571 case 0x21: /* CTEST4 */
1572 return s->ctest4;
1573 case 0x22: /* CTEST5 */
1574 return s->ctest5;
1575 case 0x23: /* CTEST6 */
1576 return 0;
1577 CASE_GET_REG24(dbc, 0x24)
1578 case 0x27: /* DCMD */
1579 return s->dcmd;
1580 CASE_GET_REG32(dnad, 0x28)
1581 CASE_GET_REG32(dsp, 0x2c)
1582 CASE_GET_REG32(dsps, 0x30)
1583 CASE_GET_REG32(scratch[0], 0x34)
1584 case 0x38: /* DMODE */
1585 return s->dmode;
1586 case 0x39: /* DIEN */
1587 return s->dien;
1588 case 0x3a: /* SBR */
1589 return s->sbr;
1590 case 0x3b: /* DCNTL */
1591 return s->dcntl;
1592 case 0x40: /* SIEN0 */
1593 return s->sien0;
1594 case 0x41: /* SIEN1 */
1595 return s->sien1;
1596 case 0x42: /* SIST0 */
1597 tmp = s->sist0;
1598 s->sist0 = 0;
1599 lsi_update_irq(s);
1600 return tmp;
1601 case 0x43: /* SIST1 */
1602 tmp = s->sist1;
1603 s->sist1 = 0;
1604 lsi_update_irq(s);
1605 return tmp;
1606 case 0x46: /* MACNTL */
1607 return 0x0f;
1608 case 0x47: /* GPCNTL0 */
1609 return 0x0f;
1610 case 0x48: /* STIME0 */
1611 return s->stime0;
1612 case 0x4a: /* RESPID0 */
1613 return s->respid0;
1614 case 0x4b: /* RESPID1 */
1615 return s->respid1;
1616 case 0x4d: /* STEST1 */
1617 return s->stest1;
1618 case 0x4e: /* STEST2 */
1619 return s->stest2;
1620 case 0x4f: /* STEST3 */
1621 return s->stest3;
1622 case 0x50: /* SIDL */
1623 /* This is needed by the linux drivers. We currently only update it
1624 during the MSG IN phase. */
1625 return s->sidl;
1626 case 0x52: /* STEST4 */
1627 return 0xe0;
1628 case 0x56: /* CCNTL0 */
1629 return s->ccntl0;
1630 case 0x57: /* CCNTL1 */
1631 return s->ccntl1;
1632 case 0x58: /* SBDL */
1633 /* Some drivers peek at the data bus during the MSG IN phase. */
1634 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1635 return s->msg[0];
1636 return 0;
1637 case 0x59: /* SBDL high */
1638 return 0;
1639 CASE_GET_REG32(mmrs, 0xa0)
1640 CASE_GET_REG32(mmws, 0xa4)
1641 CASE_GET_REG32(sfs, 0xa8)
1642 CASE_GET_REG32(drs, 0xac)
1643 CASE_GET_REG32(sbms, 0xb0)
1644 CASE_GET_REG32(dbms, 0xb4)
1645 CASE_GET_REG32(dnad64, 0xb8)
1646 CASE_GET_REG32(pmjad1, 0xc0)
1647 CASE_GET_REG32(pmjad2, 0xc4)
1648 CASE_GET_REG32(rbc, 0xc8)
1649 CASE_GET_REG32(ua, 0xcc)
1650 CASE_GET_REG32(ia, 0xd4)
1651 CASE_GET_REG32(sbc, 0xd8)
1652 CASE_GET_REG32(csbc, 0xdc)
1653 }
1654 if (offset >= 0x5c && offset < 0xa0) {
1655 int n;
1656 int shift;
1657 n = (offset - 0x58) >> 2;
1658 shift = (offset & 3) * 8;
1659 return (s->scratch[n] >> shift) & 0xff;
1660 }
1661 BADF("readb 0x%x\n", offset);
1662 exit(1);
1663 #undef CASE_GET_REG24
1664 #undef CASE_GET_REG32
1665 }
1666
1667 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1668 {
1669 #define CASE_SET_REG24(name, addr) \
1670 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1671 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1672 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1673
1674 #define CASE_SET_REG32(name, addr) \
1675 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1676 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1677 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1678 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1679
1680 #ifdef DEBUG_LSI_REG
1681 DPRINTF("Write reg %x = %02x\n", offset, val);
1682 #endif
1683 switch (offset) {
1684 case 0x00: /* SCNTL0 */
1685 s->scntl0 = val;
1686 if (val & LSI_SCNTL0_START) {
1687 BADF("Start sequence not implemented\n");
1688 }
1689 break;
1690 case 0x01: /* SCNTL1 */
1691 s->scntl1 = val & ~LSI_SCNTL1_SST;
1692 if (val & LSI_SCNTL1_IARB) {
1693 BADF("Immediate Arbritration not implemented\n");
1694 }
1695 if (val & LSI_SCNTL1_RST) {
1696 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1697 DeviceState *dev;
1698 int id;
1699
1700 for (id = 0; id < s->bus.ndev; id++) {
1701 if (s->bus.devs[id]) {
1702 dev = &s->bus.devs[id]->qdev;
1703 dev->info->reset(dev);
1704 }
1705 }
1706 s->sstat0 |= LSI_SSTAT0_RST;
1707 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1708 }
1709 } else {
1710 s->sstat0 &= ~LSI_SSTAT0_RST;
1711 }
1712 break;
1713 case 0x02: /* SCNTL2 */
1714 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1715 s->scntl2 = val;
1716 break;
1717 case 0x03: /* SCNTL3 */
1718 s->scntl3 = val;
1719 break;
1720 case 0x04: /* SCID */
1721 s->scid = val;
1722 break;
1723 case 0x05: /* SXFER */
1724 s->sxfer = val;
1725 break;
1726 case 0x06: /* SDID */
1727 if ((val & 0xf) != (s->ssid & 0xf))
1728 BADF("Destination ID does not match SSID\n");
1729 s->sdid = val & 0xf;
1730 break;
1731 case 0x07: /* GPREG0 */
1732 break;
1733 case 0x08: /* SFBR */
1734 /* The CPU is not allowed to write to this register. However the
1735 SCRIPTS register move instructions are. */
1736 s->sfbr = val;
1737 break;
1738 case 0x0a: case 0x0b:
1739 /* Openserver writes to these readonly registers on startup */
1740 return;
1741 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1742 /* Linux writes to these readonly registers on startup. */
1743 return;
1744 CASE_SET_REG32(dsa, 0x10)
1745 case 0x14: /* ISTAT0 */
1746 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1747 if (val & LSI_ISTAT0_ABRT) {
1748 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1749 }
1750 if (val & LSI_ISTAT0_INTF) {
1751 s->istat0 &= ~LSI_ISTAT0_INTF;
1752 lsi_update_irq(s);
1753 }
1754 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1755 DPRINTF("Woken by SIGP\n");
1756 s->waiting = 0;
1757 s->dsp = s->dnad;
1758 lsi_execute_script(s);
1759 }
1760 if (val & LSI_ISTAT0_SRST) {
1761 lsi_soft_reset(s);
1762 }
1763 break;
1764 case 0x16: /* MBOX0 */
1765 s->mbox0 = val;
1766 break;
1767 case 0x17: /* MBOX1 */
1768 s->mbox1 = val;
1769 break;
1770 case 0x1a: /* CTEST2 */
1771 s->ctest2 = val & LSI_CTEST2_PCICIE;
1772 break;
1773 case 0x1b: /* CTEST3 */
1774 s->ctest3 = val & 0x0f;
1775 break;
1776 CASE_SET_REG32(temp, 0x1c)
1777 case 0x21: /* CTEST4 */
1778 if (val & 7) {
1779 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1780 }
1781 s->ctest4 = val;
1782 break;
1783 case 0x22: /* CTEST5 */
1784 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1785 BADF("CTEST5 DMA increment not implemented\n");
1786 }
1787 s->ctest5 = val;
1788 break;
1789 CASE_SET_REG24(dbc, 0x24)
1790 CASE_SET_REG32(dnad, 0x28)
1791 case 0x2c: /* DSP[0:7] */
1792 s->dsp &= 0xffffff00;
1793 s->dsp |= val;
1794 break;
1795 case 0x2d: /* DSP[8:15] */
1796 s->dsp &= 0xffff00ff;
1797 s->dsp |= val << 8;
1798 break;
1799 case 0x2e: /* DSP[16:23] */
1800 s->dsp &= 0xff00ffff;
1801 s->dsp |= val << 16;
1802 break;
1803 case 0x2f: /* DSP[24:31] */
1804 s->dsp &= 0x00ffffff;
1805 s->dsp |= val << 24;
1806 if ((s->dmode & LSI_DMODE_MAN) == 0
1807 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1808 lsi_execute_script(s);
1809 break;
1810 CASE_SET_REG32(dsps, 0x30)
1811 CASE_SET_REG32(scratch[0], 0x34)
1812 case 0x38: /* DMODE */
1813 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1814 BADF("IO mappings not implemented\n");
1815 }
1816 s->dmode = val;
1817 break;
1818 case 0x39: /* DIEN */
1819 s->dien = val;
1820 lsi_update_irq(s);
1821 break;
1822 case 0x3a: /* SBR */
1823 s->sbr = val;
1824 break;
1825 case 0x3b: /* DCNTL */
1826 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1827 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1828 lsi_execute_script(s);
1829 break;
1830 case 0x40: /* SIEN0 */
1831 s->sien0 = val;
1832 lsi_update_irq(s);
1833 break;
1834 case 0x41: /* SIEN1 */
1835 s->sien1 = val;
1836 lsi_update_irq(s);
1837 break;
1838 case 0x47: /* GPCNTL0 */
1839 break;
1840 case 0x48: /* STIME0 */
1841 s->stime0 = val;
1842 break;
1843 case 0x49: /* STIME1 */
1844 if (val & 0xf) {
1845 DPRINTF("General purpose timer not implemented\n");
1846 /* ??? Raising the interrupt immediately seems to be sufficient
1847 to keep the FreeBSD driver happy. */
1848 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1849 }
1850 break;
1851 case 0x4a: /* RESPID0 */
1852 s->respid0 = val;
1853 break;
1854 case 0x4b: /* RESPID1 */
1855 s->respid1 = val;
1856 break;
1857 case 0x4d: /* STEST1 */
1858 s->stest1 = val;
1859 break;
1860 case 0x4e: /* STEST2 */
1861 if (val & 1) {
1862 BADF("Low level mode not implemented\n");
1863 }
1864 s->stest2 = val;
1865 break;
1866 case 0x4f: /* STEST3 */
1867 if (val & 0x41) {
1868 BADF("SCSI FIFO test mode not implemented\n");
1869 }
1870 s->stest3 = val;
1871 break;
1872 case 0x56: /* CCNTL0 */
1873 s->ccntl0 = val;
1874 break;
1875 case 0x57: /* CCNTL1 */
1876 s->ccntl1 = val;
1877 break;
1878 CASE_SET_REG32(mmrs, 0xa0)
1879 CASE_SET_REG32(mmws, 0xa4)
1880 CASE_SET_REG32(sfs, 0xa8)
1881 CASE_SET_REG32(drs, 0xac)
1882 CASE_SET_REG32(sbms, 0xb0)
1883 CASE_SET_REG32(dbms, 0xb4)
1884 CASE_SET_REG32(dnad64, 0xb8)
1885 CASE_SET_REG32(pmjad1, 0xc0)
1886 CASE_SET_REG32(pmjad2, 0xc4)
1887 CASE_SET_REG32(rbc, 0xc8)
1888 CASE_SET_REG32(ua, 0xcc)
1889 CASE_SET_REG32(ia, 0xd4)
1890 CASE_SET_REG32(sbc, 0xd8)
1891 CASE_SET_REG32(csbc, 0xdc)
1892 default:
1893 if (offset >= 0x5c && offset < 0xa0) {
1894 int n;
1895 int shift;
1896 n = (offset - 0x58) >> 2;
1897 shift = (offset & 3) * 8;
1898 s->scratch[n] &= ~(0xff << shift);
1899 s->scratch[n] |= (val & 0xff) << shift;
1900 } else {
1901 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1902 }
1903 }
1904 #undef CASE_SET_REG24
1905 #undef CASE_SET_REG32
1906 }
1907
1908 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1909 {
1910 LSIState *s = opaque;
1911
1912 lsi_reg_writeb(s, addr & 0xff, val);
1913 }
1914
1915 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1916 {
1917 LSIState *s = opaque;
1918
1919 addr &= 0xff;
1920 lsi_reg_writeb(s, addr, val & 0xff);
1921 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1922 }
1923
1924 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1925 {
1926 LSIState *s = opaque;
1927
1928 addr &= 0xff;
1929 lsi_reg_writeb(s, addr, val & 0xff);
1930 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1931 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1932 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1933 }
1934
1935 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1936 {
1937 LSIState *s = opaque;
1938
1939 return lsi_reg_readb(s, addr & 0xff);
1940 }
1941
1942 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1943 {
1944 LSIState *s = opaque;
1945 uint32_t val;
1946
1947 addr &= 0xff;
1948 val = lsi_reg_readb(s, addr);
1949 val |= lsi_reg_readb(s, addr + 1) << 8;
1950 return val;
1951 }
1952
1953 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1954 {
1955 LSIState *s = opaque;
1956 uint32_t val;
1957 addr &= 0xff;
1958 val = lsi_reg_readb(s, addr);
1959 val |= lsi_reg_readb(s, addr + 1) << 8;
1960 val |= lsi_reg_readb(s, addr + 2) << 16;
1961 val |= lsi_reg_readb(s, addr + 3) << 24;
1962 return val;
1963 }
1964
1965 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1966 lsi_mmio_readb,
1967 lsi_mmio_readw,
1968 lsi_mmio_readl,
1969 };
1970
1971 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1972 lsi_mmio_writeb,
1973 lsi_mmio_writew,
1974 lsi_mmio_writel,
1975 };
1976
1977 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1978 {
1979 LSIState *s = opaque;
1980 uint32_t newval;
1981 int shift;
1982
1983 addr &= 0x1fff;
1984 newval = s->script_ram[addr >> 2];
1985 shift = (addr & 3) * 8;
1986 newval &= ~(0xff << shift);
1987 newval |= val << shift;
1988 s->script_ram[addr >> 2] = newval;
1989 }
1990
1991 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1992 {
1993 LSIState *s = opaque;
1994 uint32_t newval;
1995
1996 addr &= 0x1fff;
1997 newval = s->script_ram[addr >> 2];
1998 if (addr & 2) {
1999 newval = (newval & 0xffff) | (val << 16);
2000 } else {
2001 newval = (newval & 0xffff0000) | val;
2002 }
2003 s->script_ram[addr >> 2] = newval;
2004 }
2005
2006
2007 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2008 {
2009 LSIState *s = opaque;
2010
2011 addr &= 0x1fff;
2012 s->script_ram[addr >> 2] = val;
2013 }
2014
2015 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
2016 {
2017 LSIState *s = opaque;
2018 uint32_t val;
2019
2020 addr &= 0x1fff;
2021 val = s->script_ram[addr >> 2];
2022 val >>= (addr & 3) * 8;
2023 return val & 0xff;
2024 }
2025
2026 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
2027 {
2028 LSIState *s = opaque;
2029 uint32_t val;
2030
2031 addr &= 0x1fff;
2032 val = s->script_ram[addr >> 2];
2033 if (addr & 2)
2034 val >>= 16;
2035 return val;
2036 }
2037
2038 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
2039 {
2040 LSIState *s = opaque;
2041
2042 addr &= 0x1fff;
2043 return s->script_ram[addr >> 2];
2044 }
2045
2046 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
2047 lsi_ram_readb,
2048 lsi_ram_readw,
2049 lsi_ram_readl,
2050 };
2051
2052 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
2053 lsi_ram_writeb,
2054 lsi_ram_writew,
2055 lsi_ram_writel,
2056 };
2057
2058 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
2059 {
2060 LSIState *s = opaque;
2061 return lsi_reg_readb(s, addr & 0xff);
2062 }
2063
2064 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
2065 {
2066 LSIState *s = opaque;
2067 uint32_t val;
2068 addr &= 0xff;
2069 val = lsi_reg_readb(s, addr);
2070 val |= lsi_reg_readb(s, addr + 1) << 8;
2071 return val;
2072 }
2073
2074 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
2075 {
2076 LSIState *s = opaque;
2077 uint32_t val;
2078 addr &= 0xff;
2079 val = lsi_reg_readb(s, addr);
2080 val |= lsi_reg_readb(s, addr + 1) << 8;
2081 val |= lsi_reg_readb(s, addr + 2) << 16;
2082 val |= lsi_reg_readb(s, addr + 3) << 24;
2083 return val;
2084 }
2085
2086 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
2087 {
2088 LSIState *s = opaque;
2089 lsi_reg_writeb(s, addr & 0xff, val);
2090 }
2091
2092 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
2093 {
2094 LSIState *s = opaque;
2095 addr &= 0xff;
2096 lsi_reg_writeb(s, addr, val & 0xff);
2097 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2098 }
2099
2100 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
2101 {
2102 LSIState *s = opaque;
2103 addr &= 0xff;
2104 lsi_reg_writeb(s, addr, val & 0xff);
2105 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2106 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
2107 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
2108 }
2109
2110 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
2111 pcibus_t addr, pcibus_t size, int type)
2112 {
2113 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2114
2115 DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
2116
2117 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
2118 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
2119 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
2120 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
2121 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
2122 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
2123 }
2124
2125 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
2126 pcibus_t addr, pcibus_t size, int type)
2127 {
2128 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2129
2130 DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
2131 s->script_ram_base = addr;
2132 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
2133 }
2134
2135 static void lsi_scsi_reset(DeviceState *dev)
2136 {
2137 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
2138
2139 lsi_soft_reset(s);
2140 }
2141
2142 static void lsi_pre_save(void *opaque)
2143 {
2144 LSIState *s = opaque;
2145
2146 if (s->current) {
2147 assert(s->current->dma_buf == NULL);
2148 assert(s->current->dma_len == 0);
2149 }
2150 assert(QTAILQ_EMPTY(&s->queue));
2151 }
2152
2153 static const VMStateDescription vmstate_lsi_scsi = {
2154 .name = "lsiscsi",
2155 .version_id = 0,
2156 .minimum_version_id = 0,
2157 .minimum_version_id_old = 0,
2158 .pre_save = lsi_pre_save,
2159 .fields = (VMStateField []) {
2160 VMSTATE_PCI_DEVICE(dev, LSIState),
2161
2162 VMSTATE_INT32(carry, LSIState),
2163 VMSTATE_INT32(status, LSIState),
2164 VMSTATE_INT32(msg_action, LSIState),
2165 VMSTATE_INT32(msg_len, LSIState),
2166 VMSTATE_BUFFER(msg, LSIState),
2167 VMSTATE_INT32(waiting, LSIState),
2168
2169 VMSTATE_UINT32(dsa, LSIState),
2170 VMSTATE_UINT32(temp, LSIState),
2171 VMSTATE_UINT32(dnad, LSIState),
2172 VMSTATE_UINT32(dbc, LSIState),
2173 VMSTATE_UINT8(istat0, LSIState),
2174 VMSTATE_UINT8(istat1, LSIState),
2175 VMSTATE_UINT8(dcmd, LSIState),
2176 VMSTATE_UINT8(dstat, LSIState),
2177 VMSTATE_UINT8(dien, LSIState),
2178 VMSTATE_UINT8(sist0, LSIState),
2179 VMSTATE_UINT8(sist1, LSIState),
2180 VMSTATE_UINT8(sien0, LSIState),
2181 VMSTATE_UINT8(sien1, LSIState),
2182 VMSTATE_UINT8(mbox0, LSIState),
2183 VMSTATE_UINT8(mbox1, LSIState),
2184 VMSTATE_UINT8(dfifo, LSIState),
2185 VMSTATE_UINT8(ctest2, LSIState),
2186 VMSTATE_UINT8(ctest3, LSIState),
2187 VMSTATE_UINT8(ctest4, LSIState),
2188 VMSTATE_UINT8(ctest5, LSIState),
2189 VMSTATE_UINT8(ccntl0, LSIState),
2190 VMSTATE_UINT8(ccntl1, LSIState),
2191 VMSTATE_UINT32(dsp, LSIState),
2192 VMSTATE_UINT32(dsps, LSIState),
2193 VMSTATE_UINT8(dmode, LSIState),
2194 VMSTATE_UINT8(dcntl, LSIState),
2195 VMSTATE_UINT8(scntl0, LSIState),
2196 VMSTATE_UINT8(scntl1, LSIState),
2197 VMSTATE_UINT8(scntl2, LSIState),
2198 VMSTATE_UINT8(scntl3, LSIState),
2199 VMSTATE_UINT8(sstat0, LSIState),
2200 VMSTATE_UINT8(sstat1, LSIState),
2201 VMSTATE_UINT8(scid, LSIState),
2202 VMSTATE_UINT8(sxfer, LSIState),
2203 VMSTATE_UINT8(socl, LSIState),
2204 VMSTATE_UINT8(sdid, LSIState),
2205 VMSTATE_UINT8(ssid, LSIState),
2206 VMSTATE_UINT8(sfbr, LSIState),
2207 VMSTATE_UINT8(stest1, LSIState),
2208 VMSTATE_UINT8(stest2, LSIState),
2209 VMSTATE_UINT8(stest3, LSIState),
2210 VMSTATE_UINT8(sidl, LSIState),
2211 VMSTATE_UINT8(stime0, LSIState),
2212 VMSTATE_UINT8(respid0, LSIState),
2213 VMSTATE_UINT8(respid1, LSIState),
2214 VMSTATE_UINT32(mmrs, LSIState),
2215 VMSTATE_UINT32(mmws, LSIState),
2216 VMSTATE_UINT32(sfs, LSIState),
2217 VMSTATE_UINT32(drs, LSIState),
2218 VMSTATE_UINT32(sbms, LSIState),
2219 VMSTATE_UINT32(dbms, LSIState),
2220 VMSTATE_UINT32(dnad64, LSIState),
2221 VMSTATE_UINT32(pmjad1, LSIState),
2222 VMSTATE_UINT32(pmjad2, LSIState),
2223 VMSTATE_UINT32(rbc, LSIState),
2224 VMSTATE_UINT32(ua, LSIState),
2225 VMSTATE_UINT32(ia, LSIState),
2226 VMSTATE_UINT32(sbc, LSIState),
2227 VMSTATE_UINT32(csbc, LSIState),
2228 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2229 VMSTATE_UINT8(sbr, LSIState),
2230
2231 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2232 VMSTATE_END_OF_LIST()
2233 }
2234 };
2235
2236 static int lsi_scsi_uninit(PCIDevice *d)
2237 {
2238 LSIState *s = DO_UPCAST(LSIState, dev, d);
2239
2240 cpu_unregister_io_memory(s->mmio_io_addr);
2241 cpu_unregister_io_memory(s->ram_io_addr);
2242
2243 return 0;
2244 }
2245
2246 static const struct SCSIBusOps lsi_scsi_ops = {
2247 .transfer_data = lsi_transfer_data,
2248 .complete = lsi_command_complete,
2249 .cancel = lsi_request_cancelled
2250 };
2251
2252 static int lsi_scsi_init(PCIDevice *dev)
2253 {
2254 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2255 uint8_t *pci_conf;
2256
2257 pci_conf = s->dev.config;
2258
2259 /* PCI latency timer = 255 */
2260 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2261 /* TODO: RST# value should be 0 */
2262 /* Interrupt pin 1 */
2263 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2264
2265 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2266 lsi_mmio_writefn, s,
2267 DEVICE_NATIVE_ENDIAN);
2268 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2269 lsi_ram_writefn, s,
2270 DEVICE_NATIVE_ENDIAN);
2271
2272 pci_register_bar(&s->dev, 0, 256,
2273 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2274 pci_register_bar_simple(&s->dev, 1, 0x400, 0, s->mmio_io_addr);
2275 pci_register_bar(&s->dev, 2, 0x2000,
2276 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2277 QTAILQ_INIT(&s->queue);
2278
2279 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, &lsi_scsi_ops);
2280 if (!dev->qdev.hotplugged) {
2281 return scsi_bus_legacy_handle_cmdline(&s->bus);
2282 }
2283 return 0;
2284 }
2285
2286 static PCIDeviceInfo lsi_info = {
2287 .qdev.name = "lsi53c895a",
2288 .qdev.alias = "lsi",
2289 .qdev.size = sizeof(LSIState),
2290 .qdev.reset = lsi_scsi_reset,
2291 .qdev.vmsd = &vmstate_lsi_scsi,
2292 .init = lsi_scsi_init,
2293 .exit = lsi_scsi_uninit,
2294 .vendor_id = PCI_VENDOR_ID_LSI_LOGIC,
2295 .device_id = PCI_DEVICE_ID_LSI_53C895A,
2296 .class_id = PCI_CLASS_STORAGE_SCSI,
2297 .subsystem_id = 0x1000,
2298 };
2299
2300 static void lsi53c895a_register_devices(void)
2301 {
2302 pci_qdev_register(&lsi_info);
2303 }
2304
2305 device_init(lsi53c895a_register_devices);
9p server code using virtio transport