]> git.proxmox.com Git - qemu.git/blame - hw/lsi53c895a.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
pci: introduce pcibus_t to represent pci bus address/size instead of uint32_t
[qemu.git] / hw / lsi53c895a.c
CommitLineData
5fafdf24 1/*
7d8406be
PB		 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10/* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
777aec7a
N		 13#include <assert.h> \
14
87ecb68b
PB		 15#include "hw.h"
16#include "pci.h"
43b443b6 17#include "scsi.h"
b0a7b120 18#include "block_int.h"
7d8406be
PB		 19
20//#define DEBUG_LSI
21//#define DEBUG_LSI_REG
22
23#ifdef DEBUG_LSI
001faf32
BS		 24#define DPRINTF(fmt, ...) \
25do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26#define BADF(fmt, ...) \
27do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
7d8406be 28#else
001faf32
BS		 29#define DPRINTF(fmt, ...) do {} while(0)
30#define BADF(fmt, ...) \
31do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
7d8406be
PB		 32#endif
33
34#define LSI_SCNTL0_TRG 0x01
35#define LSI_SCNTL0_AAP 0x02
36#define LSI_SCNTL0_EPC 0x08
37#define LSI_SCNTL0_WATN 0x10
38#define LSI_SCNTL0_START 0x20
39
40#define LSI_SCNTL1_SST 0x01
41#define LSI_SCNTL1_IARB 0x02
42#define LSI_SCNTL1_AESP 0x04
43#define LSI_SCNTL1_RST 0x08
44#define LSI_SCNTL1_CON 0x10
45#define LSI_SCNTL1_DHP 0x20
46#define LSI_SCNTL1_ADB 0x40
47#define LSI_SCNTL1_EXC 0x80
48
49#define LSI_SCNTL2_WSR 0x01
50#define LSI_SCNTL2_VUE0 0x02
51#define LSI_SCNTL2_VUE1 0x04
52#define LSI_SCNTL2_WSS 0x08
53#define LSI_SCNTL2_SLPHBEN 0x10
54#define LSI_SCNTL2_SLPMD 0x20
55#define LSI_SCNTL2_CHM 0x40
56#define LSI_SCNTL2_SDU 0x80
57
58#define LSI_ISTAT0_DIP 0x01
59#define LSI_ISTAT0_SIP 0x02
60#define LSI_ISTAT0_INTF 0x04
61#define LSI_ISTAT0_CON 0x08
62#define LSI_ISTAT0_SEM 0x10
63#define LSI_ISTAT0_SIGP 0x20
64#define LSI_ISTAT0_SRST 0x40
65#define LSI_ISTAT0_ABRT 0x80
66
67#define LSI_ISTAT1_SI 0x01
68#define LSI_ISTAT1_SRUN 0x02
69#define LSI_ISTAT1_FLSH 0x04
70
71#define LSI_SSTAT0_SDP0 0x01
72#define LSI_SSTAT0_RST 0x02
73#define LSI_SSTAT0_WOA 0x04
74#define LSI_SSTAT0_LOA 0x08
75#define LSI_SSTAT0_AIP 0x10
76#define LSI_SSTAT0_OLF 0x20
77#define LSI_SSTAT0_ORF 0x40
78#define LSI_SSTAT0_ILF 0x80
79
80#define LSI_SIST0_PAR 0x01
81#define LSI_SIST0_RST 0x02
82#define LSI_SIST0_UDC 0x04
83#define LSI_SIST0_SGE 0x08
84#define LSI_SIST0_RSL 0x10
85#define LSI_SIST0_SEL 0x20
86#define LSI_SIST0_CMP 0x40
87#define LSI_SIST0_MA 0x80
88
89#define LSI_SIST1_HTH 0x01
90#define LSI_SIST1_GEN 0x02
91#define LSI_SIST1_STO 0x04
92#define LSI_SIST1_SBMC 0x10
93
94#define LSI_SOCL_IO 0x01
95#define LSI_SOCL_CD 0x02
96#define LSI_SOCL_MSG 0x04
97#define LSI_SOCL_ATN 0x08
98#define LSI_SOCL_SEL 0x10
99#define LSI_SOCL_BSY 0x20
100#define LSI_SOCL_ACK 0x40
101#define LSI_SOCL_REQ 0x80
102
103#define LSI_DSTAT_IID 0x01
104#define LSI_DSTAT_SIR 0x04
105#define LSI_DSTAT_SSI 0x08
106#define LSI_DSTAT_ABRT 0x10
107#define LSI_DSTAT_BF 0x20
108#define LSI_DSTAT_MDPE 0x40
109#define LSI_DSTAT_DFE 0x80
110
111#define LSI_DCNTL_COM 0x01
112#define LSI_DCNTL_IRQD 0x02
113#define LSI_DCNTL_STD 0x04
114#define LSI_DCNTL_IRQM 0x08
115#define LSI_DCNTL_SSM 0x10
116#define LSI_DCNTL_PFEN 0x20
117#define LSI_DCNTL_PFF 0x40
118#define LSI_DCNTL_CLSE 0x80
119
120#define LSI_DMODE_MAN 0x01
121#define LSI_DMODE_BOF 0x02
122#define LSI_DMODE_ERMP 0x04
123#define LSI_DMODE_ERL 0x08
124#define LSI_DMODE_DIOM 0x10
125#define LSI_DMODE_SIOM 0x20
126
127#define LSI_CTEST2_DACK 0x01
128#define LSI_CTEST2_DREQ 0x02
129#define LSI_CTEST2_TEOP 0x04
130#define LSI_CTEST2_PCICIE 0x08
131#define LSI_CTEST2_CM 0x10
132#define LSI_CTEST2_CIO 0x20
133#define LSI_CTEST2_SIGP 0x40
134#define LSI_CTEST2_DDIR 0x80
135
136#define LSI_CTEST5_BL2 0x04
137#define LSI_CTEST5_DDIR 0x08
138#define LSI_CTEST5_MASR 0x10
139#define LSI_CTEST5_DFSN 0x20
140#define LSI_CTEST5_BBCK 0x40
141#define LSI_CTEST5_ADCK 0x80
142
143#define LSI_CCNTL0_DILS 0x01
144#define LSI_CCNTL0_DISFC 0x10
145#define LSI_CCNTL0_ENNDJ 0x20
146#define LSI_CCNTL0_PMJCTL 0x40
147#define LSI_CCNTL0_ENPMJ 0x80
148
b25cf589
AL		 149#define LSI_CCNTL1_EN64DBMV 0x01
150#define LSI_CCNTL1_EN64TIBMV 0x02
151#define LSI_CCNTL1_64TIMOD 0x04
152#define LSI_CCNTL1_DDAC 0x08
153#define LSI_CCNTL1_ZMOD 0x80
154
155#define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
156
7d8406be
PB		 157#define PHASE_DO 0
158#define PHASE_DI 1
159#define PHASE_CMD 2
160#define PHASE_ST 3
161#define PHASE_MO 6
162#define PHASE_MI 7
163#define PHASE_MASK 7
164
a917d384
PB		 165/* Maximum length of MSG IN data. */
166#define LSI_MAX_MSGIN_LEN 8
167
168/* Flag set if this is a tagged command. */
169#define LSI_TAG_VALID (1 << 16)
170
171typedef struct {
172 uint32_t tag;
173 uint32_t pending;
174 int out;
175} lsi_queue;
4d611c9a 176
7d8406be 177typedef struct {
f305261f 178 PCIDevice dev;
7d8406be
PB		 179 int mmio_io_addr;
180 int ram_io_addr;
181 uint32_t script_ram_base;
7d8406be
PB		 182
183 int carry; /* ??? Should this be an a visible register somewhere? */
184 int sense;
a917d384
PB		 185 /* Action to take at the end of a MSG IN phase.
186 0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN. */
187 int msg_action;
188 int msg_len;
189 uint8_t msg[LSI_MAX_MSGIN_LEN];
4d611c9a
PB		 190 /* 0 if SCRIPTS are running or stopped.
191 * 1 if a Wait Reselect instruction has been issued.
a917d384
PB		 192 * 2 if processing DMA from lsi_execute_script.
193 * 3 if a DMA operation is in progress. */
7d8406be 194 int waiting;
ca9c39fa 195 SCSIBus bus;
7d8406be
PB		 196 SCSIDevice *current_dev;
197 int current_lun;
a917d384
PB		 198 /* The tag is a combination of the device ID and the SCSI tag. */
199 uint32_t current_tag;
200 uint32_t current_dma_len;
8ccc2ace 201 int command_complete;
a917d384
PB		 202 uint8_t *dma_buf;
203 lsi_queue *queue;
204 int queue_len;
205 int active_commands;
7d8406be
PB		 206
207 uint32_t dsa;
208 uint32_t temp;
209 uint32_t dnad;
210 uint32_t dbc;
211 uint8_t istat0;
212 uint8_t istat1;
213 uint8_t dcmd;
214 uint8_t dstat;
215 uint8_t dien;
216 uint8_t sist0;
217 uint8_t sist1;
218 uint8_t sien0;
219 uint8_t sien1;
220 uint8_t mbox0;
221 uint8_t mbox1;
222 uint8_t dfifo;
9167a69a 223 uint8_t ctest2;
7d8406be
PB		 224 uint8_t ctest3;
225 uint8_t ctest4;
226 uint8_t ctest5;
227 uint8_t ccntl0;
228 uint8_t ccntl1;
229 uint32_t dsp;
230 uint32_t dsps;
231 uint8_t dmode;
232 uint8_t dcntl;
233 uint8_t scntl0;
234 uint8_t scntl1;
235 uint8_t scntl2;
236 uint8_t scntl3;
237 uint8_t sstat0;
238 uint8_t sstat1;
239 uint8_t scid;
240 uint8_t sxfer;
241 uint8_t socl;
242 uint8_t sdid;
a917d384 243 uint8_t ssid;
7d8406be
PB		 244 uint8_t sfbr;
245 uint8_t stest1;
246 uint8_t stest2;
247 uint8_t stest3;
a917d384 248 uint8_t sidl;
7d8406be
PB		 249 uint8_t stime0;
250 uint8_t respid0;
251 uint8_t respid1;
252 uint32_t mmrs;
253 uint32_t mmws;
254 uint32_t sfs;
255 uint32_t drs;
256 uint32_t sbms;
ab57d967 257 uint32_t dbms;
7d8406be
PB		 258 uint32_t dnad64;
259 uint32_t pmjad1;
260 uint32_t pmjad2;
261 uint32_t rbc;
262 uint32_t ua;
263 uint32_t ia;
264 uint32_t sbc;
265 uint32_t csbc;
dcfb9014 266 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
bd8ee11a 267 uint8_t sbr;
7d8406be
PB		 268
269 /* Script ram is stored as 32-bit words in host byteorder. */
270 uint32_t script_ram[2048];
271} LSIState;
272
273static void lsi_soft_reset(LSIState *s)
274{
275 DPRINTF("Reset\n");
276 s->carry = 0;
277
278 s->waiting = 0;
279 s->dsa = 0;
280 s->dnad = 0;
281 s->dbc = 0;
282 s->temp = 0;
283 memset(s->scratch, 0, sizeof(s->scratch));
284 s->istat0 = 0;
285 s->istat1 = 0;
286 s->dcmd = 0;
287 s->dstat = 0;
288 s->dien = 0;
289 s->sist0 = 0;
290 s->sist1 = 0;
291 s->sien0 = 0;
292 s->sien1 = 0;
293 s->mbox0 = 0;
294 s->mbox1 = 0;
295 s->dfifo = 0;
9167a69a 296 s->ctest2 = 0;
7d8406be
PB		 297 s->ctest3 = 0;
298 s->ctest4 = 0;
299 s->ctest5 = 0;
300 s->ccntl0 = 0;
301 s->ccntl1 = 0;
302 s->dsp = 0;
303 s->dsps = 0;
304 s->dmode = 0;
305 s->dcntl = 0;
306 s->scntl0 = 0xc0;
307 s->scntl1 = 0;
308 s->scntl2 = 0;
309 s->scntl3 = 0;
310 s->sstat0 = 0;
311 s->sstat1 = 0;
312 s->scid = 7;
313 s->sxfer = 0;
314 s->socl = 0;
315 s->stest1 = 0;
316 s->stest2 = 0;
317 s->stest3 = 0;
a917d384 318 s->sidl = 0;
7d8406be
PB		 319 s->stime0 = 0;
320 s->respid0 = 0x80;
321 s->respid1 = 0;
322 s->mmrs = 0;
323 s->mmws = 0;
324 s->sfs = 0;
325 s->drs = 0;
326 s->sbms = 0;
ab57d967 327 s->dbms = 0;
7d8406be
PB		 328 s->dnad64 = 0;
329 s->pmjad1 = 0;
330 s->pmjad2 = 0;
331 s->rbc = 0;
332 s->ua = 0;
333 s->ia = 0;
334 s->sbc = 0;
335 s->csbc = 0;
bd8ee11a 336 s->sbr = 0;
7d8406be
PB		 337}
338
b25cf589
AL		 339static int lsi_dma_40bit(LSIState *s)
340{
341 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
342 return 1;
343 return 0;
344}
345
dd8edf01
AL		 346static int lsi_dma_ti64bit(LSIState *s)
347{
348 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
349 return 1;
350 return 0;
351}
352
353static int lsi_dma_64bit(LSIState *s)
354{
355 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
356 return 1;
357 return 0;
358}
359
7d8406be
PB		 360static uint8_t lsi_reg_readb(LSIState *s, int offset);
361static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
4d611c9a 362static void lsi_execute_script(LSIState *s);
7d8406be
PB		 363
364static inline uint32_t read_dword(LSIState *s, uint32_t addr)
365{
366 uint32_t buf;
367
368 /* Optimize reading from SCRIPTS RAM. */
369 if ((addr & 0xffffe000) == s->script_ram_base) {
370 return s->script_ram[(addr & 0x1fff) >> 2];
371 }
372 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
373 return cpu_to_le32(buf);
374}
375
376static void lsi_stop_script(LSIState *s)
377{
378 s->istat1 &= ~LSI_ISTAT1_SRUN;
379}
380
381static void lsi_update_irq(LSIState *s)
382{
383 int level;
384 static int last_level;
385
386 /* It's unclear whether the DIP/SIP bits should be cleared when the
387 Interrupt Status Registers are cleared or when istat0 is read.
388 We currently do the formwer, which seems to work. */
389 level = 0;
390 if (s->dstat) {
391 if (s->dstat & s->dien)
392 level = 1;
393 s->istat0 |= LSI_ISTAT0_DIP;
394 } else {
395 s->istat0 &= ~LSI_ISTAT0_DIP;
396 }
397
398 if (s->sist0 || s->sist1) {
399 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
400 level = 1;
401 s->istat0 |= LSI_ISTAT0_SIP;
402 } else {
403 s->istat0 &= ~LSI_ISTAT0_SIP;
404 }
405 if (s->istat0 & LSI_ISTAT0_INTF)
406 level = 1;
407
408 if (level != last_level) {
409 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
410 level, s->dstat, s->sist1, s->sist0);
411 last_level = level;
412 }
f305261f 413 qemu_set_irq(s->dev.irq[0], level);
7d8406be
PB		 414}
415
416/* Stop SCRIPTS execution and raise a SCSI interrupt. */
417static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
418{
419 uint32_t mask0;
420 uint32_t mask1;
421
422 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
423 stat1, stat0, s->sist1, s->sist0);
424 s->sist0 |= stat0;
425 s->sist1 |= stat1;
426 /* Stop processor on fatal or unmasked interrupt. As a special hack
427 we don't stop processing when raising STO. Instead continue
428 execution and stop at the next insn that accesses the SCSI bus. */
429 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
430 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
431 mask1 &= ~LSI_SIST1_STO;
432 if (s->sist0 & mask0 || s->sist1 & mask1) {
433 lsi_stop_script(s);
434 }
435 lsi_update_irq(s);
436}
437
438/* Stop SCRIPTS execution and raise a DMA interrupt. */
439static void lsi_script_dma_interrupt(LSIState *s, int stat)
440{
441 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
442 s->dstat |= stat;
443 lsi_update_irq(s);
444 lsi_stop_script(s);
445}
446
447static inline void lsi_set_phase(LSIState *s, int phase)
448{
449 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
450}
451
452static void lsi_bad_phase(LSIState *s, int out, int new_phase)
453{
454 /* Trigger a phase mismatch. */
455 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
456 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
457 s->dsp = s->pmjad1;
458 } else {
459 s->dsp = s->pmjad2;
460 }
461 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
462 } else {
463 DPRINTF("Phase mismatch interrupt\n");
464 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
465 lsi_stop_script(s);
466 }
467 lsi_set_phase(s, new_phase);
468}
469
a917d384
PB		 470
471/* Resume SCRIPTS execution after a DMA operation. */
472static void lsi_resume_script(LSIState *s)
473{
474 if (s->waiting != 2) {
475 s->waiting = 0;
476 lsi_execute_script(s);
477 } else {
478 s->waiting = 0;
479 }
480}
481
4d611c9a 482/* Initiate a SCSI layer data transfer. */
7d8406be
PB		 483static void lsi_do_dma(LSIState *s, int out)
484{
7d8406be 485 uint32_t count;
c227f099 486 target_phys_addr_t addr;
7d8406be 487
a917d384
PB		 488 if (!s->current_dma_len) {
489 /* Wait until data is available. */
490 DPRINTF("DMA no data available\n");
491 return;
7d8406be
PB		 492 }
493
a917d384
PB		 494 count = s->dbc;
495 if (count > s->current_dma_len)
496 count = s->current_dma_len;
a917d384
PB		 497
498 addr = s->dnad;
dd8edf01
AL		 499 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
500 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
b25cf589 501 addr |= ((uint64_t)s->dnad64 << 32);
dd8edf01
AL		 502 else if (s->dbms)
503 addr |= ((uint64_t)s->dbms << 32);
b25cf589
AL		 504 else if (s->sbms)
505 addr |= ((uint64_t)s->sbms << 32);
506
3adae656 507 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
7d8406be 508 s->csbc += count;
a917d384
PB		 509 s->dnad += count;
510 s->dbc -= count;
511
512 if (s->dma_buf == NULL) {
d52affa7
GH		 513 s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
514 s->current_tag);
a917d384 515 }
7d8406be
PB		 516
517 /* ??? Set SFBR to first data byte. */
a917d384
PB		 518 if (out) {
519 cpu_physical_memory_read(addr, s->dma_buf, count);
520 } else {
521 cpu_physical_memory_write(addr, s->dma_buf, count);
522 }
523 s->current_dma_len -= count;
524 if (s->current_dma_len == 0) {
525 s->dma_buf = NULL;
526 if (out) {
527 /* Write the data. */
d52affa7 528 s->current_dev->info->write_data(s->current_dev, s->current_tag);
a917d384
PB		 529 } else {
530 /* Request any remaining data. */
d52affa7 531 s->current_dev->info->read_data(s->current_dev, s->current_tag);
a917d384
PB		 532 }
533 } else {
534 s->dma_buf += count;
535 lsi_resume_script(s);
536 }
537}
538
539
540/* Add a command to the queue. */
541static void lsi_queue_command(LSIState *s)
542{
543 lsi_queue *p;
544
545 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
546 if (s->queue_len == s->active_commands) {
547 s->queue_len++;
2137b4cc 548 s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
a917d384
PB		 549 }
550 p = &s->queue[s->active_commands++];
551 p->tag = s->current_tag;
552 p->pending = 0;
553 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
554}
555
556/* Queue a byte for a MSG IN phase. */
557static void lsi_add_msg_byte(LSIState *s, uint8_t data)
558{
559 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
560 BADF("MSG IN data too long\n");
4d611c9a 561 } else {
a917d384
PB		 562 DPRINTF("MSG IN 0x%02x\n", data);
563 s->msg[s->msg_len++] = data;
7d8406be 564 }
a917d384
PB		 565}
566
567/* Perform reselection to continue a command. */
568static void lsi_reselect(LSIState *s, uint32_t tag)
569{
570 lsi_queue *p;
571 int n;
572 int id;
573
574 p = NULL;
575 for (n = 0; n < s->active_commands; n++) {
576 p = &s->queue[n];
577 if (p->tag == tag)
578 break;
579 }
580 if (n == s->active_commands) {
581 BADF("Reselected non-existant command tag=0x%x\n", tag);
582 return;
583 }
584 id = (tag >> 8) & 0xf;
585 s->ssid = id | 0x80;
586 DPRINTF("Reselected target %d\n", id);
ca9c39fa 587 s->current_dev = s->bus.devs[id];
a917d384
PB		 588 s->current_tag = tag;
589 s->scntl1 |= LSI_SCNTL1_CON;
590 lsi_set_phase(s, PHASE_MI);
591 s->msg_action = p->out ? 2 : 3;
592 s->current_dma_len = p->pending;
593 s->dma_buf = NULL;
594 lsi_add_msg_byte(s, 0x80);
595 if (s->current_tag & LSI_TAG_VALID) {
596 lsi_add_msg_byte(s, 0x20);
597 lsi_add_msg_byte(s, tag & 0xff);
598 }
599
600 s->active_commands--;
601 if (n != s->active_commands) {
602 s->queue[n] = s->queue[s->active_commands];
603 }
604}
605
606/* Record that data is available for a queued command. Returns zero if
607 the device was reselected, nonzero if the IO is deferred. */
608static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
609{
610 lsi_queue *p;
611 int i;
612 for (i = 0; i < s->active_commands; i++) {
613 p = &s->queue[i];
614 if (p->tag == tag) {
615 if (p->pending) {
616 BADF("Multiple IO pending for tag %d\n", tag);
617 }
618 p->pending = arg;
619 if (s->waiting == 1) {
620 /* Reselect device. */
621 lsi_reselect(s, tag);
622 return 0;
623 } else {
624 DPRINTF("Queueing IO tag=0x%x\n", tag);
625 p->pending = arg;
626 return 1;
627 }
628 }
629 }
630 BADF("IO with unknown tag %d\n", tag);
631 return 1;
7d8406be
PB		 632}
633
4d611c9a 634/* Callback to indicate that the SCSI layer has completed a transfer. */
d52affa7 635static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
a917d384 636 uint32_t arg)
4d611c9a 637{
d52affa7 638 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
4d611c9a
PB		 639 int out;
640
a917d384 641 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
4d611c9a 642 if (reason == SCSI_REASON_DONE) {
a917d384
PB		 643 DPRINTF("Command complete sense=%d\n", (int)arg);
644 s->sense = arg;
8ccc2ace 645 s->command_complete = 2;
a917d384
PB		 646 if (s->waiting && s->dbc != 0) {
647 /* Raise phase mismatch for short transfers. */
648 lsi_bad_phase(s, out, PHASE_ST);
649 } else {
650 lsi_set_phase(s, PHASE_ST);
651 }
652 lsi_resume_script(s);
653 return;
4d611c9a
PB		 654 }
655
a917d384
PB		 656 if (s->waiting == 1 || tag != s->current_tag) {
657 if (lsi_queue_tag(s, tag, arg))
658 return;
659 }
660 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
661 s->current_dma_len = arg;
8ccc2ace 662 s->command_complete = 1;
a917d384
PB		 663 if (!s->waiting)
664 return;
665 if (s->waiting == 1 || s->dbc == 0) {
666 lsi_resume_script(s);
667 } else {
4d611c9a 668 lsi_do_dma(s, out);
4d611c9a
PB		 669 }
670}
7d8406be
PB		 671
672static void lsi_do_command(LSIState *s)
673{
674 uint8_t buf[16];
675 int n;
676
677 DPRINTF("Send command len=%d\n", s->dbc);
678 if (s->dbc > 16)
679 s->dbc = 16;
680 cpu_physical_memory_read(s->dnad, buf, s->dbc);
681 s->sfbr = buf[0];
8ccc2ace 682 s->command_complete = 0;
d52affa7
GH		 683 n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
684 s->current_lun);
7d8406be 685 if (n > 0) {
7d8406be 686 lsi_set_phase(s, PHASE_DI);
d52affa7 687 s->current_dev->info->read_data(s->current_dev, s->current_tag);
7d8406be 688 } else if (n < 0) {
7d8406be 689 lsi_set_phase(s, PHASE_DO);
d52affa7 690 s->current_dev->info->write_data(s->current_dev, s->current_tag);
a917d384 691 }
8ccc2ace
TS		 692
693 if (!s->command_complete) {
694 if (n) {
695 /* Command did not complete immediately so disconnect. */
696 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
697 lsi_add_msg_byte(s, 4); /* DISCONNECT */
698 /* wait data */
699 lsi_set_phase(s, PHASE_MI);
700 s->msg_action = 1;
701 lsi_queue_command(s);
702 } else {
703 /* wait command complete */
704 lsi_set_phase(s, PHASE_DI);
705 }
7d8406be
PB		 706 }
707}
708
7d8406be
PB		 709static void lsi_do_status(LSIState *s)
710{
a917d384 711 uint8_t sense;
7d8406be
PB		 712 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
713 if (s->dbc != 1)
714 BADF("Bad Status move\n");
715 s->dbc = 1;
a917d384
PB		 716 sense = s->sense;
717 s->sfbr = sense;
718 cpu_physical_memory_write(s->dnad, &sense, 1);
7d8406be 719 lsi_set_phase(s, PHASE_MI);
a917d384
PB		 720 s->msg_action = 1;
721 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
7d8406be
PB		 722}
723
724static void lsi_disconnect(LSIState *s)
725{
726 s->scntl1 &= ~LSI_SCNTL1_CON;
727 s->sstat1 &= ~PHASE_MASK;
728}
729
730static void lsi_do_msgin(LSIState *s)
731{
a917d384
PB		 732 int len;
733 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
734 s->sfbr = s->msg[0];
735 len = s->msg_len;
736 if (len > s->dbc)
737 len = s->dbc;
738 cpu_physical_memory_write(s->dnad, s->msg, len);
739 /* Linux drivers rely on the last byte being in the SIDL. */
740 s->sidl = s->msg[len - 1];
741 s->msg_len -= len;
742 if (s->msg_len) {
743 memmove(s->msg, s->msg + len, s->msg_len);
7d8406be
PB		 744 } else {
745 /* ??? Check if ATN (not yet implemented) is asserted and maybe
746 switch to PHASE_MO. */
a917d384
PB		 747 switch (s->msg_action) {
748 case 0:
749 lsi_set_phase(s, PHASE_CMD);
750 break;
751 case 1:
752 lsi_disconnect(s);
753 break;
754 case 2:
755 lsi_set_phase(s, PHASE_DO);
756 break;
757 case 3:
758 lsi_set_phase(s, PHASE_DI);
759 break;
760 default:
761 abort();
762 }
7d8406be
PB		 763 }
764}
765
a917d384
PB		 766/* Read the next byte during a MSGOUT phase. */
767static uint8_t lsi_get_msgbyte(LSIState *s)
768{
769 uint8_t data;
770 cpu_physical_memory_read(s->dnad, &data, 1);
771 s->dnad++;
772 s->dbc--;
773 return data;
774}
775
7d8406be
PB		 776static void lsi_do_msgout(LSIState *s)
777{
778 uint8_t msg;
a917d384 779 int len;
7d8406be
PB		 780
781 DPRINTF("MSG out len=%d\n", s->dbc);
a917d384
PB		 782 while (s->dbc) {
783 msg = lsi_get_msgbyte(s);
784 s->sfbr = msg;
785
786 switch (msg) {
787 case 0x00:
788 DPRINTF("MSG: Disconnect\n");
789 lsi_disconnect(s);
790 break;
791 case 0x08:
792 DPRINTF("MSG: No Operation\n");
793 lsi_set_phase(s, PHASE_CMD);
794 break;
795 case 0x01:
796 len = lsi_get_msgbyte(s);
797 msg = lsi_get_msgbyte(s);
798 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
799 switch (msg) {
800 case 1:
801 DPRINTF("SDTR (ignored)\n");
802 s->dbc -= 2;
803 break;
804 case 3:
805 DPRINTF("WDTR (ignored)\n");
806 s->dbc -= 1;
807 break;
808 default:
809 goto bad;
810 }
811 break;
812 case 0x20: /* SIMPLE queue */
813 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
814 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
815 break;
816 case 0x21: /* HEAD of queue */
817 BADF("HEAD queue not implemented\n");
818 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
819 break;
820 case 0x22: /* ORDERED queue */
821 BADF("ORDERED queue not implemented\n");
822 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
823 break;
824 default:
825 if ((msg & 0x80) == 0) {
826 goto bad;
827 }
828 s->current_lun = msg & 7;
829 DPRINTF("Select LUN %d\n", s->current_lun);
830 lsi_set_phase(s, PHASE_CMD);
831 break;
832 }
7d8406be 833 }
a917d384
PB		 834 return;
835bad:
836 BADF("Unimplemented message 0x%02x\n", msg);
837 lsi_set_phase(s, PHASE_MI);
838 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
839 s->msg_action = 0;
7d8406be
PB		 840}
841
842/* Sign extend a 24-bit value. */
843static inline int32_t sxt24(int32_t n)
844{
845 return (n << 8) >> 8;
846}
847
e20a8dff 848#define LSI_BUF_SIZE 4096
7d8406be
PB		 849static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
850{
851 int n;
e20a8dff 852 uint8_t buf[LSI_BUF_SIZE];
7d8406be
PB		 853
854 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
855 while (count) {
e20a8dff 856 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
7d8406be
PB		 857 cpu_physical_memory_read(src, buf, n);
858 cpu_physical_memory_write(dest, buf, n);
859 src += n;
860 dest += n;
861 count -= n;
862 }
863}
864
a917d384
PB		 865static void lsi_wait_reselect(LSIState *s)
866{
867 int i;
868 DPRINTF("Wait Reselect\n");
869 if (s->current_dma_len)
870 BADF("Reselect with pending DMA\n");
871 for (i = 0; i < s->active_commands; i++) {
872 if (s->queue[i].pending) {
873 lsi_reselect(s, s->queue[i].tag);
874 break;
875 }
876 }
877 if (s->current_dma_len == 0) {
878 s->waiting = 1;
879 }
880}
881
7d8406be
PB		 882static void lsi_execute_script(LSIState *s)
883{
884 uint32_t insn;
b25cf589 885 uint32_t addr, addr_high;
7d8406be 886 int opcode;
ee4d919f 887 int insn_processed = 0;
7d8406be
PB		 888
889 s->istat1 |= LSI_ISTAT1_SRUN;
890again:
ee4d919f 891 insn_processed++;
7d8406be 892 insn = read_dword(s, s->dsp);
02b373ad
AZ		 893 if (!insn) {
894 /* If we receive an empty opcode increment the DSP by 4 bytes
895 instead of 8 and execute the next opcode at that location */
896 s->dsp += 4;
897 goto again;
898 }
7d8406be 899 addr = read_dword(s, s->dsp + 4);
b25cf589 900 addr_high = 0;
7d8406be
PB		 901 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
902 s->dsps = addr;
903 s->dcmd = insn >> 24;
904 s->dsp += 8;
905 switch (insn >> 30) {
906 case 0: /* Block move. */
907 if (s->sist1 & LSI_SIST1_STO) {
908 DPRINTF("Delayed select timeout\n");
909 lsi_stop_script(s);
910 break;
911 }
912 s->dbc = insn & 0xffffff;
913 s->rbc = s->dbc;
dd8edf01
AL		 914 /* ??? Set ESA. */
915 s->ia = s->dsp - 8;
7d8406be
PB		 916 if (insn & (1 << 29)) {
917 /* Indirect addressing. */
918 addr = read_dword(s, addr);
919 } else if (insn & (1 << 28)) {
920 uint32_t buf[2];
921 int32_t offset;
922 /* Table indirect addressing. */
dd8edf01
AL		 923
924 /* 32-bit Table indirect */
7d8406be
PB		 925 offset = sxt24(addr);
926 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
b25cf589
AL		 927 /* byte count is stored in bits 0:23 only */
928 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
7faa239c 929 s->rbc = s->dbc;
7d8406be 930 addr = cpu_to_le32(buf[1]);
b25cf589
AL		 931
932 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
933 * table, bits [31:24] */
934 if (lsi_dma_40bit(s))
935 addr_high = cpu_to_le32(buf[0]) >> 24;
dd8edf01
AL		 936 else if (lsi_dma_ti64bit(s)) {
937 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
938 switch (selector) {
939 case 0 ... 0x0f:
940 /* offset index into scratch registers since
941 * TI64 mode can use registers C to R */
942 addr_high = s->scratch[2 + selector];
943 break;
944 case 0x10:
945 addr_high = s->mmrs;
946 break;
947 case 0x11:
948 addr_high = s->mmws;
949 break;
950 case 0x12:
951 addr_high = s->sfs;
952 break;
953 case 0x13:
954 addr_high = s->drs;
955 break;
956 case 0x14:
957 addr_high = s->sbms;
958 break;
959 case 0x15:
960 addr_high = s->dbms;
961 break;
962 default:
963 BADF("Illegal selector specified (0x%x > 0x15)"
964 " for 64-bit DMA block move", selector);
965 break;
966 }
967 }
968 } else if (lsi_dma_64bit(s)) {
969 /* fetch a 3rd dword if 64-bit direct move is enabled and
970 only if we're not doing table indirect or indirect addressing */
971 s->dbms = read_dword(s, s->dsp);
972 s->dsp += 4;
973 s->ia = s->dsp - 12;
7d8406be
PB		 974 }
975 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
976 DPRINTF("Wrong phase got %d expected %d\n",
977 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
978 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
979 break;
980 }
981 s->dnad = addr;
b25cf589 982 s->dnad64 = addr_high;
7d8406be
PB		 983 switch (s->sstat1 & 0x7) {
984 case PHASE_DO:
a917d384 985 s->waiting = 2;
7d8406be 986 lsi_do_dma(s, 1);
a917d384
PB		 987 if (s->waiting)
988 s->waiting = 3;
7d8406be
PB		 989 break;
990 case PHASE_DI:
a917d384 991 s->waiting = 2;
7d8406be 992 lsi_do_dma(s, 0);
a917d384
PB		 993 if (s->waiting)
994 s->waiting = 3;
7d8406be
PB		 995 break;
996 case PHASE_CMD:
997 lsi_do_command(s);
998 break;
999 case PHASE_ST:
1000 lsi_do_status(s);
1001 break;
1002 case PHASE_MO:
1003 lsi_do_msgout(s);
1004 break;
1005 case PHASE_MI:
1006 lsi_do_msgin(s);
1007 break;
1008 default:
1009 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1010 exit(1);
1011 }
1012 s->dfifo = s->dbc & 0xff;
1013 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1014 s->sbc = s->dbc;
1015 s->rbc -= s->dbc;
1016 s->ua = addr + s->dbc;
7d8406be
PB		 1017 break;
1018
1019 case 1: /* IO or Read/Write instruction. */
1020 opcode = (insn >> 27) & 7;
1021 if (opcode < 5) {
1022 uint32_t id;
1023
1024 if (insn & (1 << 25)) {
1025 id = read_dword(s, s->dsa + sxt24(insn));
1026 } else {
1027 id = addr;
1028 }
1029 id = (id >> 16) & 0xf;
1030 if (insn & (1 << 26)) {
1031 addr = s->dsp + sxt24(addr);
1032 }
1033 s->dnad = addr;
1034 switch (opcode) {
1035 case 0: /* Select */
a917d384
PB		 1036 s->sdid = id;
1037 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1038 DPRINTF("Already reselected by target %d\n", id);
1039 break;
1040 }
7d8406be
PB		 1041 s->sstat0 |= LSI_SSTAT0_WOA;
1042 s->scntl1 &= ~LSI_SCNTL1_IARB;
ca9c39fa 1043 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
7d8406be
PB		 1044 DPRINTF("Selected absent target %d\n", id);
1045 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1046 lsi_disconnect(s);
1047 break;
1048 }
1049 DPRINTF("Selected target %d%s\n",
1050 id, insn & (1 << 3) ? " ATN" : "");
1051 /* ??? Linux drivers compain when this is set. Maybe
1052 it only applies in low-level mode (unimplemented).
1053 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
ca9c39fa 1054 s->current_dev = s->bus.devs[id];
a917d384 1055 s->current_tag = id << 8;
7d8406be
PB		 1056 s->scntl1 |= LSI_SCNTL1_CON;
1057 if (insn & (1 << 3)) {
1058 s->socl |= LSI_SOCL_ATN;
1059 }
1060 lsi_set_phase(s, PHASE_MO);
1061 break;
1062 case 1: /* Disconnect */
1063 DPRINTF("Wait Disconect\n");
1064 s->scntl1 &= ~LSI_SCNTL1_CON;
1065 break;
1066 case 2: /* Wait Reselect */
a917d384 1067 lsi_wait_reselect(s);
7d8406be
PB		 1068 break;
1069 case 3: /* Set */
1070 DPRINTF("Set%s%s%s%s\n",
1071 insn & (1 << 3) ? " ATN" : "",
1072 insn & (1 << 6) ? " ACK" : "",
1073 insn & (1 << 9) ? " TM" : "",
1074 insn & (1 << 10) ? " CC" : "");
1075 if (insn & (1 << 3)) {
1076 s->socl |= LSI_SOCL_ATN;
1077 lsi_set_phase(s, PHASE_MO);
1078 }
1079 if (insn & (1 << 9)) {
1080 BADF("Target mode not implemented\n");
1081 exit(1);
1082 }
1083 if (insn & (1 << 10))
1084 s->carry = 1;
1085 break;
1086 case 4: /* Clear */
1087 DPRINTF("Clear%s%s%s%s\n",
1088 insn & (1 << 3) ? " ATN" : "",
1089 insn & (1 << 6) ? " ACK" : "",
1090 insn & (1 << 9) ? " TM" : "",
1091 insn & (1 << 10) ? " CC" : "");
1092 if (insn & (1 << 3)) {
1093 s->socl &= ~LSI_SOCL_ATN;
1094 }
1095 if (insn & (1 << 10))
1096 s->carry = 0;
1097 break;
1098 }
1099 } else {
1100 uint8_t op0;
1101 uint8_t op1;
1102 uint8_t data8;
1103 int reg;
1104 int operator;
1105#ifdef DEBUG_LSI
1106 static const char *opcode_names[3] =
1107 {"Write", "Read", "Read-Modify-Write"};
1108 static const char *operator_names[8] =
1109 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1110#endif
1111
1112 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1113 data8 = (insn >> 8) & 0xff;
1114 opcode = (insn >> 27) & 7;
1115 operator = (insn >> 24) & 7;
a917d384 1116 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
7d8406be 1117 opcode_names[opcode - 5], reg,
a917d384 1118 operator_names[operator], data8, s->sfbr,
7d8406be
PB		 1119 (insn & (1 << 23)) ? " SFBR" : "");
1120 op0 = op1 = 0;
1121 switch (opcode) {
1122 case 5: /* From SFBR */
1123 op0 = s->sfbr;
1124 op1 = data8;
1125 break;
1126 case 6: /* To SFBR */
1127 if (operator)
1128 op0 = lsi_reg_readb(s, reg);
1129 op1 = data8;
1130 break;
1131 case 7: /* Read-modify-write */
1132 if (operator)
1133 op0 = lsi_reg_readb(s, reg);
1134 if (insn & (1 << 23)) {
1135 op1 = s->sfbr;
1136 } else {
1137 op1 = data8;
1138 }
1139 break;
1140 }
1141
1142 switch (operator) {
1143 case 0: /* move */
1144 op0 = op1;
1145 break;
1146 case 1: /* Shift left */
1147 op1 = op0 >> 7;
1148 op0 = (op0 << 1) | s->carry;
1149 s->carry = op1;
1150 break;
1151 case 2: /* OR */
1152 op0 |= op1;
1153 break;
1154 case 3: /* XOR */
dcfb9014 1155 op0 ^= op1;
7d8406be
PB		 1156 break;
1157 case 4: /* AND */
1158 op0 &= op1;
1159 break;
1160 case 5: /* SHR */
1161 op1 = op0 & 1;
1162 op0 = (op0 >> 1) | (s->carry << 7);
687fa640 1163 s->carry = op1;
7d8406be
PB		 1164 break;
1165 case 6: /* ADD */
1166 op0 += op1;
1167 s->carry = op0 < op1;
1168 break;
1169 case 7: /* ADC */
1170 op0 += op1 + s->carry;
1171 if (s->carry)
1172 s->carry = op0 <= op1;
1173 else
1174 s->carry = op0 < op1;
1175 break;
1176 }
1177
1178 switch (opcode) {
1179 case 5: /* From SFBR */
1180 case 7: /* Read-modify-write */
1181 lsi_reg_writeb(s, reg, op0);
1182 break;
1183 case 6: /* To SFBR */
1184 s->sfbr = op0;
1185 break;
1186 }
1187 }
1188 break;
1189
1190 case 2: /* Transfer Control. */
1191 {
1192 int cond;
1193 int jmp;
1194
1195 if ((insn & 0x002e0000) == 0) {
1196 DPRINTF("NOP\n");
1197 break;
1198 }
1199 if (s->sist1 & LSI_SIST1_STO) {
1200 DPRINTF("Delayed select timeout\n");
1201 lsi_stop_script(s);
1202 break;
1203 }
1204 cond = jmp = (insn & (1 << 19)) != 0;
1205 if (cond == jmp && (insn & (1 << 21))) {
1206 DPRINTF("Compare carry %d\n", s->carry == jmp);
1207 cond = s->carry != 0;
1208 }
1209 if (cond == jmp && (insn & (1 << 17))) {
1210 DPRINTF("Compare phase %d %c= %d\n",
1211 (s->sstat1 & PHASE_MASK),
1212 jmp ? '=' : '!',
1213 ((insn >> 24) & 7));
1214 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1215 }
1216 if (cond == jmp && (insn & (1 << 18))) {
1217 uint8_t mask;
1218
1219 mask = (~insn >> 8) & 0xff;
1220 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1221 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1222 cond = (s->sfbr & mask) == (insn & mask);
1223 }
1224 if (cond == jmp) {
1225 if (insn & (1 << 23)) {
1226 /* Relative address. */
1227 addr = s->dsp + sxt24(addr);
1228 }
1229 switch ((insn >> 27) & 7) {
1230 case 0: /* Jump */
1231 DPRINTF("Jump to 0x%08x\n", addr);
1232 s->dsp = addr;
1233 break;
1234 case 1: /* Call */
1235 DPRINTF("Call 0x%08x\n", addr);
1236 s->temp = s->dsp;
1237 s->dsp = addr;
1238 break;
1239 case 2: /* Return */
1240 DPRINTF("Return to 0x%08x\n", s->temp);
1241 s->dsp = s->temp;
1242 break;
1243 case 3: /* Interrupt */
1244 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1245 if ((insn & (1 << 20)) != 0) {
1246 s->istat0 |= LSI_ISTAT0_INTF;
1247 lsi_update_irq(s);
1248 } else {
1249 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1250 }
1251 break;
1252 default:
1253 DPRINTF("Illegal transfer control\n");
1254 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1255 break;
1256 }
1257 } else {
1258 DPRINTF("Control condition failed\n");
1259 }
1260 }
1261 break;
1262
1263 case 3:
1264 if ((insn & (1 << 29)) == 0) {
1265 /* Memory move. */
1266 uint32_t dest;
1267 /* ??? The docs imply the destination address is loaded into
1268 the TEMP register. However the Linux drivers rely on
1269 the value being presrved. */
1270 dest = read_dword(s, s->dsp);
1271 s->dsp += 4;
1272 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1273 } else {
1274 uint8_t data[7];
1275 int reg;
1276 int n;
1277 int i;
1278
1279 if (insn & (1 << 28)) {
1280 addr = s->dsa + sxt24(addr);
1281 }
1282 n = (insn & 7);
1283 reg = (insn >> 16) & 0xff;
1284 if (insn & (1 << 24)) {
7d8406be 1285 cpu_physical_memory_read(addr, data, n);
a917d384
PB		 1286 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1287 addr, *(int *)data);
7d8406be
PB		 1288 for (i = 0; i < n; i++) {
1289 lsi_reg_writeb(s, reg + i, data[i]);
1290 }
1291 } else {
1292 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1293 for (i = 0; i < n; i++) {
1294 data[i] = lsi_reg_readb(s, reg + i);
1295 }
1296 cpu_physical_memory_write(addr, data, n);
1297 }
1298 }
1299 }
ee4d919f 1300 if (insn_processed > 10000 && !s->waiting) {
64c68080
PB		 1301 /* Some windows drivers make the device spin waiting for a memory
1302 location to change. If we have been executed a lot of code then
1303 assume this is the case and force an unexpected device disconnect.
1304 This is apparently sufficient to beat the drivers into submission.
1305 */
ee4d919f
AL		 1306 if (!(s->sien0 & LSI_SIST0_UDC))
1307 fprintf(stderr, "inf. loop with UDC masked\n");
1308 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1309 lsi_disconnect(s);
1310 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
7d8406be
PB		 1311 if (s->dcntl & LSI_DCNTL_SSM) {
1312 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1313 } else {
1314 goto again;
1315 }
1316 }
1317 DPRINTF("SCRIPTS execution stopped\n");
1318}
1319
1320static uint8_t lsi_reg_readb(LSIState *s, int offset)
1321{
1322 uint8_t tmp;
75f76531
AJ		 1323#define CASE_GET_REG24(name, addr) \
1324 case addr: return s->name & 0xff; \
1325 case addr + 1: return (s->name >> 8) & 0xff; \
1326 case addr + 2: return (s->name >> 16) & 0xff;
1327
7d8406be
PB		 1328#define CASE_GET_REG32(name, addr) \
1329 case addr: return s->name & 0xff; \
1330 case addr + 1: return (s->name >> 8) & 0xff; \
1331 case addr + 2: return (s->name >> 16) & 0xff; \
1332 case addr + 3: return (s->name >> 24) & 0xff;
1333
1334#ifdef DEBUG_LSI_REG
1335 DPRINTF("Read reg %x\n", offset);
1336#endif
1337 switch (offset) {
1338 case 0x00: /* SCNTL0 */
1339 return s->scntl0;
1340 case 0x01: /* SCNTL1 */
1341 return s->scntl1;
1342 case 0x02: /* SCNTL2 */
1343 return s->scntl2;
1344 case 0x03: /* SCNTL3 */
1345 return s->scntl3;
1346 case 0x04: /* SCID */
1347 return s->scid;
1348 case 0x05: /* SXFER */
1349 return s->sxfer;
1350 case 0x06: /* SDID */
1351 return s->sdid;
1352 case 0x07: /* GPREG0 */
1353 return 0x7f;
985a03b0
TS		 1354 case 0x08: /* Revision ID */
1355 return 0x00;
a917d384
PB		 1356 case 0xa: /* SSID */
1357 return s->ssid;
7d8406be
PB		 1358 case 0xb: /* SBCL */
1359 /* ??? This is not correct. However it's (hopefully) only
1360 used for diagnostics, so should be ok. */
1361 return 0;
1362 case 0xc: /* DSTAT */
1363 tmp = s->dstat | 0x80;
1364 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1365 s->dstat = 0;
1366 lsi_update_irq(s);
1367 return tmp;
1368 case 0x0d: /* SSTAT0 */
1369 return s->sstat0;
1370 case 0x0e: /* SSTAT1 */
1371 return s->sstat1;
1372 case 0x0f: /* SSTAT2 */
1373 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1374 CASE_GET_REG32(dsa, 0x10)
1375 case 0x14: /* ISTAT0 */
1376 return s->istat0;
ecabe8cc
AL		 1377 case 0x15: /* ISTAT1 */
1378 return s->istat1;
7d8406be
PB		 1379 case 0x16: /* MBOX0 */
1380 return s->mbox0;
1381 case 0x17: /* MBOX1 */
1382 return s->mbox1;
1383 case 0x18: /* CTEST0 */
1384 return 0xff;
1385 case 0x19: /* CTEST1 */
1386 return 0;
1387 case 0x1a: /* CTEST2 */
9167a69a 1388 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
7d8406be
PB		 1389 if (s->istat0 & LSI_ISTAT0_SIGP) {
1390 s->istat0 &= ~LSI_ISTAT0_SIGP;
1391 tmp |= LSI_CTEST2_SIGP;
1392 }
1393 return tmp;
1394 case 0x1b: /* CTEST3 */
1395 return s->ctest3;
1396 CASE_GET_REG32(temp, 0x1c)
1397 case 0x20: /* DFIFO */
1398 return 0;
1399 case 0x21: /* CTEST4 */
1400 return s->ctest4;
1401 case 0x22: /* CTEST5 */
1402 return s->ctest5;
985a03b0
TS		 1403 case 0x23: /* CTEST6 */
1404 return 0;
75f76531 1405 CASE_GET_REG24(dbc, 0x24)
7d8406be
PB		 1406 case 0x27: /* DCMD */
1407 return s->dcmd;
4b9a2d6d 1408 CASE_GET_REG32(dnad, 0x28)
7d8406be
PB		 1409 CASE_GET_REG32(dsp, 0x2c)
1410 CASE_GET_REG32(dsps, 0x30)
1411 CASE_GET_REG32(scratch[0], 0x34)
1412 case 0x38: /* DMODE */
1413 return s->dmode;
1414 case 0x39: /* DIEN */
1415 return s->dien;
bd8ee11a
SH		 1416 case 0x3a: /* SBR */
1417 return s->sbr;
7d8406be
PB		 1418 case 0x3b: /* DCNTL */
1419 return s->dcntl;
1420 case 0x40: /* SIEN0 */
1421 return s->sien0;
1422 case 0x41: /* SIEN1 */
1423 return s->sien1;
1424 case 0x42: /* SIST0 */
1425 tmp = s->sist0;
1426 s->sist0 = 0;
1427 lsi_update_irq(s);
1428 return tmp;
1429 case 0x43: /* SIST1 */
1430 tmp = s->sist1;
1431 s->sist1 = 0;
1432 lsi_update_irq(s);
1433 return tmp;
9167a69a
AZ		 1434 case 0x46: /* MACNTL */
1435 return 0x0f;
7d8406be
PB		 1436 case 0x47: /* GPCNTL0 */
1437 return 0x0f;
1438 case 0x48: /* STIME0 */
1439 return s->stime0;
1440 case 0x4a: /* RESPID0 */
1441 return s->respid0;
1442 case 0x4b: /* RESPID1 */
1443 return s->respid1;
1444 case 0x4d: /* STEST1 */
1445 return s->stest1;
1446 case 0x4e: /* STEST2 */
1447 return s->stest2;
1448 case 0x4f: /* STEST3 */
1449 return s->stest3;
a917d384
PB		 1450 case 0x50: /* SIDL */
1451 /* This is needed by the linux drivers. We currently only update it
1452 during the MSG IN phase. */
1453 return s->sidl;
7d8406be
PB		 1454 case 0x52: /* STEST4 */
1455 return 0xe0;
1456 case 0x56: /* CCNTL0 */
1457 return s->ccntl0;
1458 case 0x57: /* CCNTL1 */
1459 return s->ccntl1;
a917d384
PB		 1460 case 0x58: /* SBDL */
1461 /* Some drivers peek at the data bus during the MSG IN phase. */
1462 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1463 return s->msg[0];
1464 return 0;
1465 case 0x59: /* SBDL high */
7d8406be
PB		 1466 return 0;
1467 CASE_GET_REG32(mmrs, 0xa0)
1468 CASE_GET_REG32(mmws, 0xa4)
1469 CASE_GET_REG32(sfs, 0xa8)
1470 CASE_GET_REG32(drs, 0xac)
1471 CASE_GET_REG32(sbms, 0xb0)
ab57d967 1472 CASE_GET_REG32(dbms, 0xb4)
7d8406be
PB		 1473 CASE_GET_REG32(dnad64, 0xb8)
1474 CASE_GET_REG32(pmjad1, 0xc0)
1475 CASE_GET_REG32(pmjad2, 0xc4)
1476 CASE_GET_REG32(rbc, 0xc8)
1477 CASE_GET_REG32(ua, 0xcc)
1478 CASE_GET_REG32(ia, 0xd4)
1479 CASE_GET_REG32(sbc, 0xd8)
1480 CASE_GET_REG32(csbc, 0xdc)
1481 }
1482 if (offset >= 0x5c && offset < 0xa0) {
1483 int n;
1484 int shift;
1485 n = (offset - 0x58) >> 2;
1486 shift = (offset & 3) * 8;
1487 return (s->scratch[n] >> shift) & 0xff;
1488 }
1489 BADF("readb 0x%x\n", offset);
1490 exit(1);
75f76531 1491#undef CASE_GET_REG24
7d8406be
PB		 1492#undef CASE_GET_REG32
1493}
1494
1495static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1496{
49c47daa
SH		 1497#define CASE_SET_REG24(name, addr) \
1498 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1499 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1500 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1501
7d8406be
PB		 1502#define CASE_SET_REG32(name, addr) \
1503 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1504 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1505 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1506 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1507
1508#ifdef DEBUG_LSI_REG
1509 DPRINTF("Write reg %x = %02x\n", offset, val);
1510#endif
1511 switch (offset) {
1512 case 0x00: /* SCNTL0 */
1513 s->scntl0 = val;
1514 if (val & LSI_SCNTL0_START) {
1515 BADF("Start sequence not implemented\n");
1516 }
1517 break;
1518 case 0x01: /* SCNTL1 */
1519 s->scntl1 = val & ~LSI_SCNTL1_SST;
1520 if (val & LSI_SCNTL1_IARB) {
1521 BADF("Immediate Arbritration not implemented\n");
1522 }
1523 if (val & LSI_SCNTL1_RST) {
1524 s->sstat0 |= LSI_SSTAT0_RST;
1525 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1526 } else {
1527 s->sstat0 &= ~LSI_SSTAT0_RST;
1528 }
1529 break;
1530 case 0x02: /* SCNTL2 */
1531 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
3d834c78 1532 s->scntl2 = val;
7d8406be
PB		 1533 break;
1534 case 0x03: /* SCNTL3 */
1535 s->scntl3 = val;
1536 break;
1537 case 0x04: /* SCID */
1538 s->scid = val;
1539 break;
1540 case 0x05: /* SXFER */
1541 s->sxfer = val;
1542 break;
a917d384
PB		 1543 case 0x06: /* SDID */
1544 if ((val & 0xf) != (s->ssid & 0xf))
1545 BADF("Destination ID does not match SSID\n");
1546 s->sdid = val & 0xf;
1547 break;
7d8406be
PB		 1548 case 0x07: /* GPREG0 */
1549 break;
a917d384
PB		 1550 case 0x08: /* SFBR */
1551 /* The CPU is not allowed to write to this register. However the
1552 SCRIPTS register move instructions are. */
1553 s->sfbr = val;
1554 break;
9167a69a
AZ		 1555 case 0x0a: case 0x0b:
1556 /* Openserver writes to these readonly registers on startup */
1557 return;
7d8406be
PB		 1558 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1559 /* Linux writes to these readonly registers on startup. */
1560 return;
1561 CASE_SET_REG32(dsa, 0x10)
1562 case 0x14: /* ISTAT0 */
1563 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1564 if (val & LSI_ISTAT0_ABRT) {
1565 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1566 }
1567 if (val & LSI_ISTAT0_INTF) {
1568 s->istat0 &= ~LSI_ISTAT0_INTF;
1569 lsi_update_irq(s);
1570 }
4d611c9a 1571 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
7d8406be
PB		 1572 DPRINTF("Woken by SIGP\n");
1573 s->waiting = 0;
1574 s->dsp = s->dnad;
1575 lsi_execute_script(s);
1576 }
1577 if (val & LSI_ISTAT0_SRST) {
1578 lsi_soft_reset(s);
1579 }
92d88ecb 1580 break;
7d8406be
PB		 1581 case 0x16: /* MBOX0 */
1582 s->mbox0 = val;
92d88ecb 1583 break;
7d8406be
PB		 1584 case 0x17: /* MBOX1 */
1585 s->mbox1 = val;
92d88ecb 1586 break;
9167a69a
AZ		 1587 case 0x1a: /* CTEST2 */
1588 s->ctest2 = val & LSI_CTEST2_PCICIE;
1589 break;
7d8406be
PB		 1590 case 0x1b: /* CTEST3 */
1591 s->ctest3 = val & 0x0f;
1592 break;
1593 CASE_SET_REG32(temp, 0x1c)
1594 case 0x21: /* CTEST4 */
1595 if (val & 7) {
1596 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1597 }
1598 s->ctest4 = val;
1599 break;
1600 case 0x22: /* CTEST5 */
1601 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1602 BADF("CTEST5 DMA increment not implemented\n");
1603 }
1604 s->ctest5 = val;
1605 break;
49c47daa 1606 CASE_SET_REG24(dbc, 0x24)
4b9a2d6d 1607 CASE_SET_REG32(dnad, 0x28)
3d834c78 1608 case 0x2c: /* DSP[0:7] */
7d8406be
PB		 1609 s->dsp &= 0xffffff00;
1610 s->dsp |= val;
1611 break;
3d834c78 1612 case 0x2d: /* DSP[8:15] */
7d8406be
PB		 1613 s->dsp &= 0xffff00ff;
1614 s->dsp |= val << 8;
1615 break;
3d834c78 1616 case 0x2e: /* DSP[16:23] */
7d8406be
PB		 1617 s->dsp &= 0xff00ffff;
1618 s->dsp |= val << 16;
1619 break;
3d834c78 1620 case 0x2f: /* DSP[24:31] */
7d8406be
PB		 1621 s->dsp &= 0x00ffffff;
1622 s->dsp |= val << 24;
1623 if ((s->dmode & LSI_DMODE_MAN) == 0
1624 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1625 lsi_execute_script(s);
1626 break;
1627 CASE_SET_REG32(dsps, 0x30)
1628 CASE_SET_REG32(scratch[0], 0x34)
1629 case 0x38: /* DMODE */
1630 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1631 BADF("IO mappings not implemented\n");
1632 }
1633 s->dmode = val;
1634 break;
1635 case 0x39: /* DIEN */
1636 s->dien = val;
1637 lsi_update_irq(s);
1638 break;
bd8ee11a
SH		 1639 case 0x3a: /* SBR */
1640 s->sbr = val;
1641 break;
7d8406be
PB		 1642 case 0x3b: /* DCNTL */
1643 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1644 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1645 lsi_execute_script(s);
1646 break;
1647 case 0x40: /* SIEN0 */
1648 s->sien0 = val;
1649 lsi_update_irq(s);
1650 break;
1651 case 0x41: /* SIEN1 */
1652 s->sien1 = val;
1653 lsi_update_irq(s);
1654 break;
1655 case 0x47: /* GPCNTL0 */
1656 break;
1657 case 0x48: /* STIME0 */
1658 s->stime0 = val;
1659 break;
1660 case 0x49: /* STIME1 */
1661 if (val & 0xf) {
1662 DPRINTF("General purpose timer not implemented\n");
1663 /* ??? Raising the interrupt immediately seems to be sufficient
1664 to keep the FreeBSD driver happy. */
1665 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1666 }
1667 break;
1668 case 0x4a: /* RESPID0 */
1669 s->respid0 = val;
1670 break;
1671 case 0x4b: /* RESPID1 */
1672 s->respid1 = val;
1673 break;
1674 case 0x4d: /* STEST1 */
1675 s->stest1 = val;
1676 break;
1677 case 0x4e: /* STEST2 */
1678 if (val & 1) {
1679 BADF("Low level mode not implemented\n");
1680 }
1681 s->stest2 = val;
1682 break;
1683 case 0x4f: /* STEST3 */
1684 if (val & 0x41) {
1685 BADF("SCSI FIFO test mode not implemented\n");
1686 }
1687 s->stest3 = val;
1688 break;
1689 case 0x56: /* CCNTL0 */
1690 s->ccntl0 = val;
1691 break;
1692 case 0x57: /* CCNTL1 */
1693 s->ccntl1 = val;
1694 break;
1695 CASE_SET_REG32(mmrs, 0xa0)
1696 CASE_SET_REG32(mmws, 0xa4)
1697 CASE_SET_REG32(sfs, 0xa8)
1698 CASE_SET_REG32(drs, 0xac)
1699 CASE_SET_REG32(sbms, 0xb0)
ab57d967 1700 CASE_SET_REG32(dbms, 0xb4)
7d8406be
PB		 1701 CASE_SET_REG32(dnad64, 0xb8)
1702 CASE_SET_REG32(pmjad1, 0xc0)
1703 CASE_SET_REG32(pmjad2, 0xc4)
1704 CASE_SET_REG32(rbc, 0xc8)
1705 CASE_SET_REG32(ua, 0xcc)
1706 CASE_SET_REG32(ia, 0xd4)
1707 CASE_SET_REG32(sbc, 0xd8)
1708 CASE_SET_REG32(csbc, 0xdc)
1709 default:
1710 if (offset >= 0x5c && offset < 0xa0) {
1711 int n;
1712 int shift;
1713 n = (offset - 0x58) >> 2;
1714 shift = (offset & 3) * 8;
1715 s->scratch[n] &= ~(0xff << shift);
1716 s->scratch[n] |= (val & 0xff) << shift;
1717 } else {
1718 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1719 }
1720 }
49c47daa 1721#undef CASE_SET_REG24
7d8406be
PB		 1722#undef CASE_SET_REG32
1723}
1724
c227f099 1725static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1726{
eb40f984 1727 LSIState *s = opaque;
7d8406be
PB		 1728
1729 lsi_reg_writeb(s, addr & 0xff, val);
1730}
1731
c227f099 1732static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1733{
eb40f984 1734 LSIState *s = opaque;
7d8406be
PB		 1735
1736 addr &= 0xff;
1737 lsi_reg_writeb(s, addr, val & 0xff);
1738 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1739}
1740
c227f099 1741static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1742{
eb40f984 1743 LSIState *s = opaque;
7d8406be
PB		 1744
1745 addr &= 0xff;
1746 lsi_reg_writeb(s, addr, val & 0xff);
1747 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1748 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1749 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1750}
1751
c227f099 1752static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
7d8406be 1753{
eb40f984 1754 LSIState *s = opaque;
7d8406be
PB		 1755
1756 return lsi_reg_readb(s, addr & 0xff);
1757}
1758
c227f099 1759static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
7d8406be 1760{
eb40f984 1761 LSIState *s = opaque;
7d8406be
PB		 1762 uint32_t val;
1763
1764 addr &= 0xff;
1765 val = lsi_reg_readb(s, addr);
1766 val |= lsi_reg_readb(s, addr + 1) << 8;
1767 return val;
1768}
1769
c227f099 1770static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
7d8406be 1771{
eb40f984 1772 LSIState *s = opaque;
7d8406be
PB		 1773 uint32_t val;
1774 addr &= 0xff;
1775 val = lsi_reg_readb(s, addr);
1776 val |= lsi_reg_readb(s, addr + 1) << 8;
1777 val |= lsi_reg_readb(s, addr + 2) << 16;
1778 val |= lsi_reg_readb(s, addr + 3) << 24;
1779 return val;
1780}
1781
d60efc6b 1782static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
7d8406be
PB		 1783 lsi_mmio_readb,
1784 lsi_mmio_readw,
1785 lsi_mmio_readl,
1786};
1787
d60efc6b 1788static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
7d8406be
PB		 1789 lsi_mmio_writeb,
1790 lsi_mmio_writew,
1791 lsi_mmio_writel,
1792};
1793
c227f099 1794static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1795{
eb40f984 1796 LSIState *s = opaque;
7d8406be
PB		 1797 uint32_t newval;
1798 int shift;
1799
1800 addr &= 0x1fff;
1801 newval = s->script_ram[addr >> 2];
1802 shift = (addr & 3) * 8;
1803 newval &= ~(0xff << shift);
1804 newval |= val << shift;
1805 s->script_ram[addr >> 2] = newval;
1806}
1807
c227f099 1808static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1809{
eb40f984 1810 LSIState *s = opaque;
7d8406be
PB		 1811 uint32_t newval;
1812
1813 addr &= 0x1fff;
1814 newval = s->script_ram[addr >> 2];
1815 if (addr & 2) {
1816 newval = (newval & 0xffff) | (val << 16);
1817 } else {
1818 newval = (newval & 0xffff0000) | val;
1819 }
1820 s->script_ram[addr >> 2] = newval;
1821}
1822
1823
c227f099 1824static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1825{
eb40f984 1826 LSIState *s = opaque;
7d8406be
PB		 1827
1828 addr &= 0x1fff;
1829 s->script_ram[addr >> 2] = val;
1830}
1831
c227f099 1832static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
7d8406be 1833{
eb40f984 1834 LSIState *s = opaque;
7d8406be
PB		 1835 uint32_t val;
1836
1837 addr &= 0x1fff;
1838 val = s->script_ram[addr >> 2];
1839 val >>= (addr & 3) * 8;
1840 return val & 0xff;
1841}
1842
c227f099 1843static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
7d8406be 1844{
eb40f984 1845 LSIState *s = opaque;
7d8406be
PB		 1846 uint32_t val;
1847
1848 addr &= 0x1fff;
1849 val = s->script_ram[addr >> 2];
1850 if (addr & 2)
1851 val >>= 16;
1852 return le16_to_cpu(val);
1853}
1854
c227f099 1855static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
7d8406be 1856{
eb40f984 1857 LSIState *s = opaque;
7d8406be
PB		 1858
1859 addr &= 0x1fff;
1860 return le32_to_cpu(s->script_ram[addr >> 2]);
1861}
1862
d60efc6b 1863static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
7d8406be
PB		 1864 lsi_ram_readb,
1865 lsi_ram_readw,
1866 lsi_ram_readl,
1867};
1868
d60efc6b 1869static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
7d8406be
PB		 1870 lsi_ram_writeb,
1871 lsi_ram_writew,
1872 lsi_ram_writel,
1873};
1874
1875static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1876{
eb40f984 1877 LSIState *s = opaque;
7d8406be
PB		 1878 return lsi_reg_readb(s, addr & 0xff);
1879}
1880
1881static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1882{
eb40f984 1883 LSIState *s = opaque;
7d8406be
PB		 1884 uint32_t val;
1885 addr &= 0xff;
1886 val = lsi_reg_readb(s, addr);
1887 val |= lsi_reg_readb(s, addr + 1) << 8;
1888 return val;
1889}
1890
1891static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1892{
eb40f984 1893 LSIState *s = opaque;
7d8406be
PB		 1894 uint32_t val;
1895 addr &= 0xff;
1896 val = lsi_reg_readb(s, addr);
1897 val |= lsi_reg_readb(s, addr + 1) << 8;
1898 val |= lsi_reg_readb(s, addr + 2) << 16;
1899 val |= lsi_reg_readb(s, addr + 3) << 24;
1900 return val;
1901}
1902
1903static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1904{
eb40f984 1905 LSIState *s = opaque;
7d8406be
PB		 1906 lsi_reg_writeb(s, addr & 0xff, val);
1907}
1908
1909static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1910{
eb40f984 1911 LSIState *s = opaque;
7d8406be
PB		 1912 addr &= 0xff;
1913 lsi_reg_writeb(s, addr, val & 0xff);
1914 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1915}
1916
1917static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1918{
eb40f984 1919 LSIState *s = opaque;
7d8406be
PB		 1920 addr &= 0xff;
1921 lsi_reg_writeb(s, addr, val & 0xff);
1922 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1923 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
dcfb9014 1924 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
7d8406be
PB		 1925}
1926
5fafdf24 1927static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
6e355d90 1928 pcibus_t addr, pcibus_t size, int type)
7d8406be 1929{
f305261f 1930 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
7d8406be
PB		 1931
1932 DPRINTF("Mapping IO at %08x\n", addr);
1933
1934 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1935 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1936 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1937 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1938 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1939 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1940}
1941
5fafdf24 1942static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
6e355d90 1943 pcibus_t addr, pcibus_t size, int type)
7d8406be 1944{
f305261f 1945 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
7d8406be
PB		 1946
1947 DPRINTF("Mapping ram at %08x\n", addr);
1948 s->script_ram_base = addr;
1949 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1950}
1951
5fafdf24 1952static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
6e355d90 1953 pcibus_t addr, pcibus_t size, int type)
7d8406be 1954{
f305261f 1955 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
7d8406be
PB		 1956
1957 DPRINTF("Mapping registers at %08x\n", addr);
1958 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1959}
1960
4a1b0f1c 1961static void lsi_pre_save(void *opaque)
777aec7a
N		 1962{
1963 LSIState *s = opaque;
1964
1965 assert(s->dma_buf == NULL);
1966 assert(s->current_dma_len == 0);
1967 assert(s->active_commands == 0);
777aec7a
N		 1968}
1969
4a1b0f1c
JQ		 1970static const VMStateDescription vmstate_lsi_scsi = {
1971 .name = "lsiscsi",
1972 .version_id = 0,
1973 .minimum_version_id = 0,
1974 .minimum_version_id_old = 0,
1975 .pre_save = lsi_pre_save,
1976 .fields = (VMStateField []) {
1977 VMSTATE_PCI_DEVICE(dev, LSIState),
1978
1979 VMSTATE_INT32(carry, LSIState),
1980 VMSTATE_INT32(sense, LSIState),
1981 VMSTATE_INT32(msg_action, LSIState),
1982 VMSTATE_INT32(msg_len, LSIState),
1983 VMSTATE_BUFFER(msg, LSIState),
1984 VMSTATE_INT32(waiting, LSIState),
1985
1986 VMSTATE_UINT32(dsa, LSIState),
1987 VMSTATE_UINT32(temp, LSIState),
1988 VMSTATE_UINT32(dnad, LSIState),
1989 VMSTATE_UINT32(dbc, LSIState),
1990 VMSTATE_UINT8(istat0, LSIState),
1991 VMSTATE_UINT8(istat1, LSIState),
1992 VMSTATE_UINT8(dcmd, LSIState),
1993 VMSTATE_UINT8(dstat, LSIState),
1994 VMSTATE_UINT8(dien, LSIState),
1995 VMSTATE_UINT8(sist0, LSIState),
1996 VMSTATE_UINT8(sist1, LSIState),
1997 VMSTATE_UINT8(sien0, LSIState),
1998 VMSTATE_UINT8(sien1, LSIState),
1999 VMSTATE_UINT8(mbox0, LSIState),
2000 VMSTATE_UINT8(mbox1, LSIState),
2001 VMSTATE_UINT8(dfifo, LSIState),
2002 VMSTATE_UINT8(ctest2, LSIState),
2003 VMSTATE_UINT8(ctest3, LSIState),
2004 VMSTATE_UINT8(ctest4, LSIState),
2005 VMSTATE_UINT8(ctest5, LSIState),
2006 VMSTATE_UINT8(ccntl0, LSIState),
2007 VMSTATE_UINT8(ccntl1, LSIState),
2008 VMSTATE_UINT32(dsp, LSIState),
2009 VMSTATE_UINT32(dsps, LSIState),
2010 VMSTATE_UINT8(dmode, LSIState),
2011 VMSTATE_UINT8(dcntl, LSIState),
2012 VMSTATE_UINT8(scntl0, LSIState),
2013 VMSTATE_UINT8(scntl1, LSIState),
2014 VMSTATE_UINT8(scntl2, LSIState),
2015 VMSTATE_UINT8(scntl3, LSIState),
2016 VMSTATE_UINT8(sstat0, LSIState),
2017 VMSTATE_UINT8(sstat1, LSIState),
2018 VMSTATE_UINT8(scid, LSIState),
2019 VMSTATE_UINT8(sxfer, LSIState),
2020 VMSTATE_UINT8(socl, LSIState),
2021 VMSTATE_UINT8(sdid, LSIState),
2022 VMSTATE_UINT8(ssid, LSIState),
2023 VMSTATE_UINT8(sfbr, LSIState),
2024 VMSTATE_UINT8(stest1, LSIState),
2025 VMSTATE_UINT8(stest2, LSIState),
2026 VMSTATE_UINT8(stest3, LSIState),
2027 VMSTATE_UINT8(sidl, LSIState),
2028 VMSTATE_UINT8(stime0, LSIState),
2029 VMSTATE_UINT8(respid0, LSIState),
2030 VMSTATE_UINT8(respid1, LSIState),
2031 VMSTATE_UINT32(mmrs, LSIState),
2032 VMSTATE_UINT32(mmws, LSIState),
2033 VMSTATE_UINT32(sfs, LSIState),
2034 VMSTATE_UINT32(drs, LSIState),
2035 VMSTATE_UINT32(sbms, LSIState),
2036 VMSTATE_UINT32(dbms, LSIState),
2037 VMSTATE_UINT32(dnad64, LSIState),
2038 VMSTATE_UINT32(pmjad1, LSIState),
2039 VMSTATE_UINT32(pmjad2, LSIState),
2040 VMSTATE_UINT32(rbc, LSIState),
2041 VMSTATE_UINT32(ua, LSIState),
2042 VMSTATE_UINT32(ia, LSIState),
2043 VMSTATE_UINT32(sbc, LSIState),
2044 VMSTATE_UINT32(csbc, LSIState),
2045 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2046 VMSTATE_UINT8(sbr, LSIState),
2047
2048 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2049 VMSTATE_END_OF_LIST()
777aec7a 2050 }
4a1b0f1c 2051};
777aec7a 2052
4b09be85
AL		 2053static int lsi_scsi_uninit(PCIDevice *d)
2054{
f305261f 2055 LSIState *s = DO_UPCAST(LSIState, dev, d);
4b09be85
AL		 2056
2057 cpu_unregister_io_memory(s->mmio_io_addr);
2058 cpu_unregister_io_memory(s->ram_io_addr);
2059
2060 qemu_free(s->queue);
2061
2062 return 0;
2063}
2064
81a322d4 2065static int lsi_scsi_init(PCIDevice *dev)
7d8406be 2066{
f305261f 2067 LSIState *s = DO_UPCAST(LSIState, dev, dev);
deb54399 2068 uint8_t *pci_conf;
7d8406be 2069
f305261f 2070 pci_conf = s->dev.config;
deb54399 2071
9167a69a 2072 /* PCI Vendor ID (word) */
deb54399 2073 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
9167a69a 2074 /* PCI device ID (word) */
deb54399 2075 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
9167a69a 2076 /* PCI base class code */
173a543b 2077 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
9167a69a 2078 /* PCI subsystem ID */
deb54399
AL		 2079 pci_conf[0x2e] = 0x00;
2080 pci_conf[0x2f] = 0x10;
9167a69a 2081 /* PCI latency timer = 255 */
deb54399 2082 pci_conf[0x0d] = 0xff;
9167a69a 2083 /* Interrupt pin 1 */
deb54399 2084 pci_conf[0x3d] = 0x01;
7d8406be 2085
1eed09cb 2086 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
7d8406be 2087 lsi_mmio_writefn, s);
1eed09cb 2088 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
7d8406be
PB		 2089 lsi_ram_writefn, s);
2090
28c2c264 2091 pci_register_bar((struct PCIDevice *)s, 0, 256,
0392a017 2092 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
28c2c264 2093 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
0392a017 2094 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
28c2c264 2095 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
0392a017 2096 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
a917d384
PB		 2097 s->queue = qemu_malloc(sizeof(lsi_queue));
2098 s->queue_len = 1;
2099 s->active_commands = 0;
7d8406be
PB		 2100
2101 lsi_soft_reset(s);
2102
ca9c39fa 2103 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
5b684b5a
GH		 2104 if (!dev->qdev.hotplugged) {
2105 scsi_bus_legacy_handle_cmdline(&s->bus);
2106 }
4a1b0f1c 2107 vmstate_register(-1, &vmstate_lsi_scsi, s);
81a322d4 2108 return 0;
7d8406be 2109}
9be5dafe 2110
0aab0d3a 2111static PCIDeviceInfo lsi_info = {
d52affa7
GH		 2112 .qdev.name = "lsi53c895a",
2113 .qdev.alias = "lsi",
2114 .qdev.size = sizeof(LSIState),
2115 .init = lsi_scsi_init,
e3936fa5 2116 .exit = lsi_scsi_uninit,
0aab0d3a
GH		 2117};
2118
9be5dafe
PB		 2119static void lsi53c895a_register_devices(void)
2120{
0aab0d3a 2121 pci_qdev_register(&lsi_info);
9be5dafe
PB		 2122}
2123
2124device_init(lsi53c895a_register_devices);
Qemu copy for testing