]> git.proxmox.com Git - qemu.git/blob - hw/lsi53c895a.c
projects / qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
lsi53c895a: Use alternative address when already reselected
[qemu.git] / hw / lsi53c895a.c
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
13 #include <assert.h>
14
15 #include "hw.h"
16 #include "pci.h"
17 #include "scsi.h"
18 #include "block_int.h"
19
20 //#define DEBUG_LSI
21 //#define DEBUG_LSI_REG
22
23 #ifdef DEBUG_LSI
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
28 #else
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #endif
33
34 #define LSI_MAX_DEVS 7
35
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
41
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
50
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
59
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
68
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
72
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
81
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
90
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
95
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
104
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
112
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
121
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
128
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
137
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
144
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
150
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
156
157 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
158
159 #define PHASE_DO 0
160 #define PHASE_DI 1
161 #define PHASE_CMD 2
162 #define PHASE_ST 3
163 #define PHASE_MO 6
164 #define PHASE_MI 7
165 #define PHASE_MASK 7
166
167 /* Maximum length of MSG IN data. */
168 #define LSI_MAX_MSGIN_LEN 8
169
170 /* Flag set if this is a tagged command. */
171 #define LSI_TAG_VALID (1 << 16)
172
173 typedef struct {
174 uint32_t tag;
175 uint32_t pending;
176 int out;
177 } lsi_queue;
178
179 typedef struct {
180 PCIDevice dev;
181 int mmio_io_addr;
182 int ram_io_addr;
183 uint32_t script_ram_base;
184
185 int carry; /* ??? Should this be an a visible register somewhere? */
186 int sense;
187 /* Action to take at the end of a MSG IN phase.
188 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
189 int msg_action;
190 int msg_len;
191 uint8_t msg[LSI_MAX_MSGIN_LEN];
192 /* 0 if SCRIPTS are running or stopped.
193 * 1 if a Wait Reselect instruction has been issued.
194 * 2 if processing DMA from lsi_execute_script.
195 * 3 if a DMA operation is in progress. */
196 int waiting;
197 SCSIBus bus;
198 SCSIDevice *current_dev;
199 int current_lun;
200 /* The tag is a combination of the device ID and the SCSI tag. */
201 uint32_t current_tag;
202 uint32_t current_dma_len;
203 int command_complete;
204 uint8_t *dma_buf;
205 lsi_queue *queue;
206 int queue_len;
207 int active_commands;
208
209 uint32_t dsa;
210 uint32_t temp;
211 uint32_t dnad;
212 uint32_t dbc;
213 uint8_t istat0;
214 uint8_t istat1;
215 uint8_t dcmd;
216 uint8_t dstat;
217 uint8_t dien;
218 uint8_t sist0;
219 uint8_t sist1;
220 uint8_t sien0;
221 uint8_t sien1;
222 uint8_t mbox0;
223 uint8_t mbox1;
224 uint8_t dfifo;
225 uint8_t ctest2;
226 uint8_t ctest3;
227 uint8_t ctest4;
228 uint8_t ctest5;
229 uint8_t ccntl0;
230 uint8_t ccntl1;
231 uint32_t dsp;
232 uint32_t dsps;
233 uint8_t dmode;
234 uint8_t dcntl;
235 uint8_t scntl0;
236 uint8_t scntl1;
237 uint8_t scntl2;
238 uint8_t scntl3;
239 uint8_t sstat0;
240 uint8_t sstat1;
241 uint8_t scid;
242 uint8_t sxfer;
243 uint8_t socl;
244 uint8_t sdid;
245 uint8_t ssid;
246 uint8_t sfbr;
247 uint8_t stest1;
248 uint8_t stest2;
249 uint8_t stest3;
250 uint8_t sidl;
251 uint8_t stime0;
252 uint8_t respid0;
253 uint8_t respid1;
254 uint32_t mmrs;
255 uint32_t mmws;
256 uint32_t sfs;
257 uint32_t drs;
258 uint32_t sbms;
259 uint32_t dbms;
260 uint32_t dnad64;
261 uint32_t pmjad1;
262 uint32_t pmjad2;
263 uint32_t rbc;
264 uint32_t ua;
265 uint32_t ia;
266 uint32_t sbc;
267 uint32_t csbc;
268 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
269 uint8_t sbr;
270
271 /* Script ram is stored as 32-bit words in host byteorder. */
272 uint32_t script_ram[2048];
273 } LSIState;
274
275 static void lsi_soft_reset(LSIState *s)
276 {
277 DPRINTF("Reset\n");
278 s->carry = 0;
279
280 s->waiting = 0;
281 s->dsa = 0;
282 s->dnad = 0;
283 s->dbc = 0;
284 s->temp = 0;
285 memset(s->scratch, 0, sizeof(s->scratch));
286 s->istat0 = 0;
287 s->istat1 = 0;
288 s->dcmd = 0;
289 s->dstat = 0;
290 s->dien = 0;
291 s->sist0 = 0;
292 s->sist1 = 0;
293 s->sien0 = 0;
294 s->sien1 = 0;
295 s->mbox0 = 0;
296 s->mbox1 = 0;
297 s->dfifo = 0;
298 s->ctest2 = 0;
299 s->ctest3 = 0;
300 s->ctest4 = 0;
301 s->ctest5 = 0;
302 s->ccntl0 = 0;
303 s->ccntl1 = 0;
304 s->dsp = 0;
305 s->dsps = 0;
306 s->dmode = 0;
307 s->dcntl = 0;
308 s->scntl0 = 0xc0;
309 s->scntl1 = 0;
310 s->scntl2 = 0;
311 s->scntl3 = 0;
312 s->sstat0 = 0;
313 s->sstat1 = 0;
314 s->scid = 7;
315 s->sxfer = 0;
316 s->socl = 0;
317 s->stest1 = 0;
318 s->stest2 = 0;
319 s->stest3 = 0;
320 s->sidl = 0;
321 s->stime0 = 0;
322 s->respid0 = 0x80;
323 s->respid1 = 0;
324 s->mmrs = 0;
325 s->mmws = 0;
326 s->sfs = 0;
327 s->drs = 0;
328 s->sbms = 0;
329 s->dbms = 0;
330 s->dnad64 = 0;
331 s->pmjad1 = 0;
332 s->pmjad2 = 0;
333 s->rbc = 0;
334 s->ua = 0;
335 s->ia = 0;
336 s->sbc = 0;
337 s->csbc = 0;
338 s->sbr = 0;
339 }
340
341 static int lsi_dma_40bit(LSIState *s)
342 {
343 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
344 return 1;
345 return 0;
346 }
347
348 static int lsi_dma_ti64bit(LSIState *s)
349 {
350 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
351 return 1;
352 return 0;
353 }
354
355 static int lsi_dma_64bit(LSIState *s)
356 {
357 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
358 return 1;
359 return 0;
360 }
361
362 static uint8_t lsi_reg_readb(LSIState *s, int offset);
363 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
364 static void lsi_execute_script(LSIState *s);
365
366 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
367 {
368 uint32_t buf;
369
370 /* Optimize reading from SCRIPTS RAM. */
371 if ((addr & 0xffffe000) == s->script_ram_base) {
372 return s->script_ram[(addr & 0x1fff) >> 2];
373 }
374 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
375 return cpu_to_le32(buf);
376 }
377
378 static void lsi_stop_script(LSIState *s)
379 {
380 s->istat1 &= ~LSI_ISTAT1_SRUN;
381 }
382
383 static void lsi_update_irq(LSIState *s)
384 {
385 int level;
386 static int last_level;
387
388 /* It's unclear whether the DIP/SIP bits should be cleared when the
389 Interrupt Status Registers are cleared or when istat0 is read.
390 We currently do the formwer, which seems to work. */
391 level = 0;
392 if (s->dstat) {
393 if (s->dstat & s->dien)
394 level = 1;
395 s->istat0 |= LSI_ISTAT0_DIP;
396 } else {
397 s->istat0 &= ~LSI_ISTAT0_DIP;
398 }
399
400 if (s->sist0 || s->sist1) {
401 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
402 level = 1;
403 s->istat0 |= LSI_ISTAT0_SIP;
404 } else {
405 s->istat0 &= ~LSI_ISTAT0_SIP;
406 }
407 if (s->istat0 & LSI_ISTAT0_INTF)
408 level = 1;
409
410 if (level != last_level) {
411 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
412 level, s->dstat, s->sist1, s->sist0);
413 last_level = level;
414 }
415 qemu_set_irq(s->dev.irq[0], level);
416 }
417
418 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
419 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
420 {
421 uint32_t mask0;
422 uint32_t mask1;
423
424 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
425 stat1, stat0, s->sist1, s->sist0);
426 s->sist0 |= stat0;
427 s->sist1 |= stat1;
428 /* Stop processor on fatal or unmasked interrupt. As a special hack
429 we don't stop processing when raising STO. Instead continue
430 execution and stop at the next insn that accesses the SCSI bus. */
431 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
432 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
433 mask1 &= ~LSI_SIST1_STO;
434 if (s->sist0 & mask0 || s->sist1 & mask1) {
435 lsi_stop_script(s);
436 }
437 lsi_update_irq(s);
438 }
439
440 /* Stop SCRIPTS execution and raise a DMA interrupt. */
441 static void lsi_script_dma_interrupt(LSIState *s, int stat)
442 {
443 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
444 s->dstat |= stat;
445 lsi_update_irq(s);
446 lsi_stop_script(s);
447 }
448
449 static inline void lsi_set_phase(LSIState *s, int phase)
450 {
451 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
452 }
453
454 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
455 {
456 /* Trigger a phase mismatch. */
457 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
458 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
459 s->dsp = s->pmjad1;
460 } else {
461 s->dsp = s->pmjad2;
462 }
463 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
464 } else {
465 DPRINTF("Phase mismatch interrupt\n");
466 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
467 lsi_stop_script(s);
468 }
469 lsi_set_phase(s, new_phase);
470 }
471
472
473 /* Resume SCRIPTS execution after a DMA operation. */
474 static void lsi_resume_script(LSIState *s)
475 {
476 if (s->waiting != 2) {
477 s->waiting = 0;
478 lsi_execute_script(s);
479 } else {
480 s->waiting = 0;
481 }
482 }
483
484 /* Initiate a SCSI layer data transfer. */
485 static void lsi_do_dma(LSIState *s, int out)
486 {
487 uint32_t count;
488 target_phys_addr_t addr;
489
490 if (!s->current_dma_len) {
491 /* Wait until data is available. */
492 DPRINTF("DMA no data available\n");
493 return;
494 }
495
496 count = s->dbc;
497 if (count > s->current_dma_len)
498 count = s->current_dma_len;
499
500 addr = s->dnad;
501 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
502 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
503 addr |= ((uint64_t)s->dnad64 << 32);
504 else if (s->dbms)
505 addr |= ((uint64_t)s->dbms << 32);
506 else if (s->sbms)
507 addr |= ((uint64_t)s->sbms << 32);
508
509 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
510 s->csbc += count;
511 s->dnad += count;
512 s->dbc -= count;
513
514 if (s->dma_buf == NULL) {
515 s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
516 s->current_tag);
517 }
518
519 /* ??? Set SFBR to first data byte. */
520 if (out) {
521 cpu_physical_memory_read(addr, s->dma_buf, count);
522 } else {
523 cpu_physical_memory_write(addr, s->dma_buf, count);
524 }
525 s->current_dma_len -= count;
526 if (s->current_dma_len == 0) {
527 s->dma_buf = NULL;
528 if (out) {
529 /* Write the data. */
530 s->current_dev->info->write_data(s->current_dev, s->current_tag);
531 } else {
532 /* Request any remaining data. */
533 s->current_dev->info->read_data(s->current_dev, s->current_tag);
534 }
535 } else {
536 s->dma_buf += count;
537 lsi_resume_script(s);
538 }
539 }
540
541
542 /* Add a command to the queue. */
543 static void lsi_queue_command(LSIState *s)
544 {
545 lsi_queue *p;
546
547 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
548 if (s->queue_len == s->active_commands) {
549 s->queue_len++;
550 s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
551 }
552 p = &s->queue[s->active_commands++];
553 p->tag = s->current_tag;
554 p->pending = 0;
555 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
556 }
557
558 /* Queue a byte for a MSG IN phase. */
559 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
560 {
561 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
562 BADF("MSG IN data too long\n");
563 } else {
564 DPRINTF("MSG IN 0x%02x\n", data);
565 s->msg[s->msg_len++] = data;
566 }
567 }
568
569 /* Perform reselection to continue a command. */
570 static void lsi_reselect(LSIState *s, uint32_t tag)
571 {
572 lsi_queue *p;
573 int n;
574 int id;
575
576 p = NULL;
577 for (n = 0; n < s->active_commands; n++) {
578 p = &s->queue[n];
579 if (p->tag == tag)
580 break;
581 }
582 if (n == s->active_commands) {
583 BADF("Reselected non-existant command tag=0x%x\n", tag);
584 return;
585 }
586 id = (tag >> 8) & 0xf;
587 s->ssid = id | 0x80;
588 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
589 if (!s->dcntl & LSI_DCNTL_COM) {
590 s->sfbr = 1 << (id & 0x7);
591 }
592 DPRINTF("Reselected target %d\n", id);
593 s->current_dev = s->bus.devs[id];
594 s->current_tag = tag;
595 s->scntl1 |= LSI_SCNTL1_CON;
596 lsi_set_phase(s, PHASE_MI);
597 s->msg_action = p->out ? 2 : 3;
598 s->current_dma_len = p->pending;
599 s->dma_buf = NULL;
600 lsi_add_msg_byte(s, 0x80);
601 if (s->current_tag & LSI_TAG_VALID) {
602 lsi_add_msg_byte(s, 0x20);
603 lsi_add_msg_byte(s, tag & 0xff);
604 }
605
606 s->active_commands--;
607 if (n != s->active_commands) {
608 s->queue[n] = s->queue[s->active_commands];
609 }
610 }
611
612 /* Record that data is available for a queued command. Returns zero if
613 the device was reselected, nonzero if the IO is deferred. */
614 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
615 {
616 lsi_queue *p;
617 int i;
618 for (i = 0; i < s->active_commands; i++) {
619 p = &s->queue[i];
620 if (p->tag == tag) {
621 if (p->pending) {
622 BADF("Multiple IO pending for tag %d\n", tag);
623 }
624 p->pending = arg;
625 if (s->waiting == 1) {
626 /* Reselect device. */
627 lsi_reselect(s, tag);
628 return 0;
629 } else {
630 DPRINTF("Queueing IO tag=0x%x\n", tag);
631 p->pending = arg;
632 return 1;
633 }
634 }
635 }
636 BADF("IO with unknown tag %d\n", tag);
637 return 1;
638 }
639
640 /* Callback to indicate that the SCSI layer has completed a transfer. */
641 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
642 uint32_t arg)
643 {
644 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
645 int out;
646
647 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
648 if (reason == SCSI_REASON_DONE) {
649 DPRINTF("Command complete sense=%d\n", (int)arg);
650 s->sense = arg;
651 s->command_complete = 2;
652 if (s->waiting && s->dbc != 0) {
653 /* Raise phase mismatch for short transfers. */
654 lsi_bad_phase(s, out, PHASE_ST);
655 } else {
656 lsi_set_phase(s, PHASE_ST);
657 }
658 lsi_resume_script(s);
659 return;
660 }
661
662 if (s->waiting == 1 || tag != s->current_tag) {
663 if (lsi_queue_tag(s, tag, arg))
664 return;
665 }
666 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
667 s->current_dma_len = arg;
668 s->command_complete = 1;
669 if (!s->waiting)
670 return;
671 if (s->waiting == 1 || s->dbc == 0) {
672 lsi_resume_script(s);
673 } else {
674 lsi_do_dma(s, out);
675 }
676 }
677
678 static void lsi_do_command(LSIState *s)
679 {
680 uint8_t buf[16];
681 int n;
682
683 DPRINTF("Send command len=%d\n", s->dbc);
684 if (s->dbc > 16)
685 s->dbc = 16;
686 cpu_physical_memory_read(s->dnad, buf, s->dbc);
687 s->sfbr = buf[0];
688 s->command_complete = 0;
689 n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
690 s->current_lun);
691 if (n > 0) {
692 lsi_set_phase(s, PHASE_DI);
693 s->current_dev->info->read_data(s->current_dev, s->current_tag);
694 } else if (n < 0) {
695 lsi_set_phase(s, PHASE_DO);
696 s->current_dev->info->write_data(s->current_dev, s->current_tag);
697 }
698
699 if (!s->command_complete) {
700 if (n) {
701 /* Command did not complete immediately so disconnect. */
702 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
703 lsi_add_msg_byte(s, 4); /* DISCONNECT */
704 /* wait data */
705 lsi_set_phase(s, PHASE_MI);
706 s->msg_action = 1;
707 lsi_queue_command(s);
708 } else {
709 /* wait command complete */
710 lsi_set_phase(s, PHASE_DI);
711 }
712 }
713 }
714
715 static void lsi_do_status(LSIState *s)
716 {
717 uint8_t sense;
718 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
719 if (s->dbc != 1)
720 BADF("Bad Status move\n");
721 s->dbc = 1;
722 sense = s->sense;
723 s->sfbr = sense;
724 cpu_physical_memory_write(s->dnad, &sense, 1);
725 lsi_set_phase(s, PHASE_MI);
726 s->msg_action = 1;
727 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
728 }
729
730 static void lsi_disconnect(LSIState *s)
731 {
732 s->scntl1 &= ~LSI_SCNTL1_CON;
733 s->sstat1 &= ~PHASE_MASK;
734 }
735
736 static void lsi_do_msgin(LSIState *s)
737 {
738 int len;
739 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
740 s->sfbr = s->msg[0];
741 len = s->msg_len;
742 if (len > s->dbc)
743 len = s->dbc;
744 cpu_physical_memory_write(s->dnad, s->msg, len);
745 /* Linux drivers rely on the last byte being in the SIDL. */
746 s->sidl = s->msg[len - 1];
747 s->msg_len -= len;
748 if (s->msg_len) {
749 memmove(s->msg, s->msg + len, s->msg_len);
750 } else {
751 /* ??? Check if ATN (not yet implemented) is asserted and maybe
752 switch to PHASE_MO. */
753 switch (s->msg_action) {
754 case 0:
755 lsi_set_phase(s, PHASE_CMD);
756 break;
757 case 1:
758 lsi_disconnect(s);
759 break;
760 case 2:
761 lsi_set_phase(s, PHASE_DO);
762 break;
763 case 3:
764 lsi_set_phase(s, PHASE_DI);
765 break;
766 default:
767 abort();
768 }
769 }
770 }
771
772 /* Read the next byte during a MSGOUT phase. */
773 static uint8_t lsi_get_msgbyte(LSIState *s)
774 {
775 uint8_t data;
776 cpu_physical_memory_read(s->dnad, &data, 1);
777 s->dnad++;
778 s->dbc--;
779 return data;
780 }
781
782 static void lsi_do_msgout(LSIState *s)
783 {
784 uint8_t msg;
785 int len;
786
787 DPRINTF("MSG out len=%d\n", s->dbc);
788 while (s->dbc) {
789 msg = lsi_get_msgbyte(s);
790 s->sfbr = msg;
791
792 switch (msg) {
793 case 0x04:
794 DPRINTF("MSG: Disconnect\n");
795 lsi_disconnect(s);
796 break;
797 case 0x08:
798 DPRINTF("MSG: No Operation\n");
799 lsi_set_phase(s, PHASE_CMD);
800 break;
801 case 0x01:
802 len = lsi_get_msgbyte(s);
803 msg = lsi_get_msgbyte(s);
804 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
805 switch (msg) {
806 case 1:
807 DPRINTF("SDTR (ignored)\n");
808 s->dbc -= 2;
809 break;
810 case 3:
811 DPRINTF("WDTR (ignored)\n");
812 s->dbc -= 1;
813 break;
814 default:
815 goto bad;
816 }
817 break;
818 case 0x20: /* SIMPLE queue */
819 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
820 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
821 break;
822 case 0x21: /* HEAD of queue */
823 BADF("HEAD queue not implemented\n");
824 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
825 break;
826 case 0x22: /* ORDERED queue */
827 BADF("ORDERED queue not implemented\n");
828 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
829 break;
830 default:
831 if ((msg & 0x80) == 0) {
832 goto bad;
833 }
834 s->current_lun = msg & 7;
835 DPRINTF("Select LUN %d\n", s->current_lun);
836 lsi_set_phase(s, PHASE_CMD);
837 break;
838 }
839 }
840 return;
841 bad:
842 BADF("Unimplemented message 0x%02x\n", msg);
843 lsi_set_phase(s, PHASE_MI);
844 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
845 s->msg_action = 0;
846 }
847
848 /* Sign extend a 24-bit value. */
849 static inline int32_t sxt24(int32_t n)
850 {
851 return (n << 8) >> 8;
852 }
853
854 #define LSI_BUF_SIZE 4096
855 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
856 {
857 int n;
858 uint8_t buf[LSI_BUF_SIZE];
859
860 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
861 while (count) {
862 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
863 cpu_physical_memory_read(src, buf, n);
864 cpu_physical_memory_write(dest, buf, n);
865 src += n;
866 dest += n;
867 count -= n;
868 }
869 }
870
871 static void lsi_wait_reselect(LSIState *s)
872 {
873 int i;
874 DPRINTF("Wait Reselect\n");
875 if (s->current_dma_len)
876 BADF("Reselect with pending DMA\n");
877 for (i = 0; i < s->active_commands; i++) {
878 if (s->queue[i].pending) {
879 lsi_reselect(s, s->queue[i].tag);
880 break;
881 }
882 }
883 if (s->current_dma_len == 0) {
884 s->waiting = 1;
885 }
886 }
887
888 static void lsi_execute_script(LSIState *s)
889 {
890 uint32_t insn;
891 uint32_t addr, addr_high;
892 int opcode;
893 int insn_processed = 0;
894
895 s->istat1 |= LSI_ISTAT1_SRUN;
896 again:
897 insn_processed++;
898 insn = read_dword(s, s->dsp);
899 if (!insn) {
900 /* If we receive an empty opcode increment the DSP by 4 bytes
901 instead of 8 and execute the next opcode at that location */
902 s->dsp += 4;
903 goto again;
904 }
905 addr = read_dword(s, s->dsp + 4);
906 addr_high = 0;
907 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
908 s->dsps = addr;
909 s->dcmd = insn >> 24;
910 s->dsp += 8;
911 switch (insn >> 30) {
912 case 0: /* Block move. */
913 if (s->sist1 & LSI_SIST1_STO) {
914 DPRINTF("Delayed select timeout\n");
915 lsi_stop_script(s);
916 break;
917 }
918 s->dbc = insn & 0xffffff;
919 s->rbc = s->dbc;
920 /* ??? Set ESA. */
921 s->ia = s->dsp - 8;
922 if (insn & (1 << 29)) {
923 /* Indirect addressing. */
924 addr = read_dword(s, addr);
925 } else if (insn & (1 << 28)) {
926 uint32_t buf[2];
927 int32_t offset;
928 /* Table indirect addressing. */
929
930 /* 32-bit Table indirect */
931 offset = sxt24(addr);
932 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
933 /* byte count is stored in bits 0:23 only */
934 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
935 s->rbc = s->dbc;
936 addr = cpu_to_le32(buf[1]);
937
938 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
939 * table, bits [31:24] */
940 if (lsi_dma_40bit(s))
941 addr_high = cpu_to_le32(buf[0]) >> 24;
942 else if (lsi_dma_ti64bit(s)) {
943 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
944 switch (selector) {
945 case 0 ... 0x0f:
946 /* offset index into scratch registers since
947 * TI64 mode can use registers C to R */
948 addr_high = s->scratch[2 + selector];
949 break;
950 case 0x10:
951 addr_high = s->mmrs;
952 break;
953 case 0x11:
954 addr_high = s->mmws;
955 break;
956 case 0x12:
957 addr_high = s->sfs;
958 break;
959 case 0x13:
960 addr_high = s->drs;
961 break;
962 case 0x14:
963 addr_high = s->sbms;
964 break;
965 case 0x15:
966 addr_high = s->dbms;
967 break;
968 default:
969 BADF("Illegal selector specified (0x%x > 0x15)"
970 " for 64-bit DMA block move", selector);
971 break;
972 }
973 }
974 } else if (lsi_dma_64bit(s)) {
975 /* fetch a 3rd dword if 64-bit direct move is enabled and
976 only if we're not doing table indirect or indirect addressing */
977 s->dbms = read_dword(s, s->dsp);
978 s->dsp += 4;
979 s->ia = s->dsp - 12;
980 }
981 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
982 DPRINTF("Wrong phase got %d expected %d\n",
983 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
984 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
985 break;
986 }
987 s->dnad = addr;
988 s->dnad64 = addr_high;
989 switch (s->sstat1 & 0x7) {
990 case PHASE_DO:
991 s->waiting = 2;
992 lsi_do_dma(s, 1);
993 if (s->waiting)
994 s->waiting = 3;
995 break;
996 case PHASE_DI:
997 s->waiting = 2;
998 lsi_do_dma(s, 0);
999 if (s->waiting)
1000 s->waiting = 3;
1001 break;
1002 case PHASE_CMD:
1003 lsi_do_command(s);
1004 break;
1005 case PHASE_ST:
1006 lsi_do_status(s);
1007 break;
1008 case PHASE_MO:
1009 lsi_do_msgout(s);
1010 break;
1011 case PHASE_MI:
1012 lsi_do_msgin(s);
1013 break;
1014 default:
1015 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1016 exit(1);
1017 }
1018 s->dfifo = s->dbc & 0xff;
1019 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1020 s->sbc = s->dbc;
1021 s->rbc -= s->dbc;
1022 s->ua = addr + s->dbc;
1023 break;
1024
1025 case 1: /* IO or Read/Write instruction. */
1026 opcode = (insn >> 27) & 7;
1027 if (opcode < 5) {
1028 uint32_t id;
1029
1030 if (insn & (1 << 25)) {
1031 id = read_dword(s, s->dsa + sxt24(insn));
1032 } else {
1033 id = insn;
1034 }
1035 id = (id >> 16) & 0xf;
1036 if (insn & (1 << 26)) {
1037 addr = s->dsp + sxt24(addr);
1038 }
1039 s->dnad = addr;
1040 switch (opcode) {
1041 case 0: /* Select */
1042 s->sdid = id;
1043 if (s->scntl1 & LSI_SCNTL1_CON) {
1044 DPRINTF("Already reselected, jumping to alternative address\n");
1045 s->dsp = s->dnad;
1046 break;
1047 }
1048 s->sstat0 |= LSI_SSTAT0_WOA;
1049 s->scntl1 &= ~LSI_SCNTL1_IARB;
1050 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1051 DPRINTF("Selected absent target %d\n", id);
1052 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1053 lsi_disconnect(s);
1054 break;
1055 }
1056 DPRINTF("Selected target %d%s\n",
1057 id, insn & (1 << 3) ? " ATN" : "");
1058 /* ??? Linux drivers compain when this is set. Maybe
1059 it only applies in low-level mode (unimplemented).
1060 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1061 s->current_dev = s->bus.devs[id];
1062 s->current_tag = id << 8;
1063 s->scntl1 |= LSI_SCNTL1_CON;
1064 if (insn & (1 << 3)) {
1065 s->socl |= LSI_SOCL_ATN;
1066 }
1067 lsi_set_phase(s, PHASE_MO);
1068 break;
1069 case 1: /* Disconnect */
1070 DPRINTF("Wait Disconnect\n");
1071 s->scntl1 &= ~LSI_SCNTL1_CON;
1072 break;
1073 case 2: /* Wait Reselect */
1074 lsi_wait_reselect(s);
1075 break;
1076 case 3: /* Set */
1077 DPRINTF("Set%s%s%s%s\n",
1078 insn & (1 << 3) ? " ATN" : "",
1079 insn & (1 << 6) ? " ACK" : "",
1080 insn & (1 << 9) ? " TM" : "",
1081 insn & (1 << 10) ? " CC" : "");
1082 if (insn & (1 << 3)) {
1083 s->socl |= LSI_SOCL_ATN;
1084 lsi_set_phase(s, PHASE_MO);
1085 }
1086 if (insn & (1 << 9)) {
1087 BADF("Target mode not implemented\n");
1088 exit(1);
1089 }
1090 if (insn & (1 << 10))
1091 s->carry = 1;
1092 break;
1093 case 4: /* Clear */
1094 DPRINTF("Clear%s%s%s%s\n",
1095 insn & (1 << 3) ? " ATN" : "",
1096 insn & (1 << 6) ? " ACK" : "",
1097 insn & (1 << 9) ? " TM" : "",
1098 insn & (1 << 10) ? " CC" : "");
1099 if (insn & (1 << 3)) {
1100 s->socl &= ~LSI_SOCL_ATN;
1101 }
1102 if (insn & (1 << 10))
1103 s->carry = 0;
1104 break;
1105 }
1106 } else {
1107 uint8_t op0;
1108 uint8_t op1;
1109 uint8_t data8;
1110 int reg;
1111 int operator;
1112 #ifdef DEBUG_LSI
1113 static const char *opcode_names[3] =
1114 {"Write", "Read", "Read-Modify-Write"};
1115 static const char *operator_names[8] =
1116 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1117 #endif
1118
1119 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1120 data8 = (insn >> 8) & 0xff;
1121 opcode = (insn >> 27) & 7;
1122 operator = (insn >> 24) & 7;
1123 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1124 opcode_names[opcode - 5], reg,
1125 operator_names[operator], data8, s->sfbr,
1126 (insn & (1 << 23)) ? " SFBR" : "");
1127 op0 = op1 = 0;
1128 switch (opcode) {
1129 case 5: /* From SFBR */
1130 op0 = s->sfbr;
1131 op1 = data8;
1132 break;
1133 case 6: /* To SFBR */
1134 if (operator)
1135 op0 = lsi_reg_readb(s, reg);
1136 op1 = data8;
1137 break;
1138 case 7: /* Read-modify-write */
1139 if (operator)
1140 op0 = lsi_reg_readb(s, reg);
1141 if (insn & (1 << 23)) {
1142 op1 = s->sfbr;
1143 } else {
1144 op1 = data8;
1145 }
1146 break;
1147 }
1148
1149 switch (operator) {
1150 case 0: /* move */
1151 op0 = op1;
1152 break;
1153 case 1: /* Shift left */
1154 op1 = op0 >> 7;
1155 op0 = (op0 << 1) | s->carry;
1156 s->carry = op1;
1157 break;
1158 case 2: /* OR */
1159 op0 |= op1;
1160 break;
1161 case 3: /* XOR */
1162 op0 ^= op1;
1163 break;
1164 case 4: /* AND */
1165 op0 &= op1;
1166 break;
1167 case 5: /* SHR */
1168 op1 = op0 & 1;
1169 op0 = (op0 >> 1) | (s->carry << 7);
1170 s->carry = op1;
1171 break;
1172 case 6: /* ADD */
1173 op0 += op1;
1174 s->carry = op0 < op1;
1175 break;
1176 case 7: /* ADC */
1177 op0 += op1 + s->carry;
1178 if (s->carry)
1179 s->carry = op0 <= op1;
1180 else
1181 s->carry = op0 < op1;
1182 break;
1183 }
1184
1185 switch (opcode) {
1186 case 5: /* From SFBR */
1187 case 7: /* Read-modify-write */
1188 lsi_reg_writeb(s, reg, op0);
1189 break;
1190 case 6: /* To SFBR */
1191 s->sfbr = op0;
1192 break;
1193 }
1194 }
1195 break;
1196
1197 case 2: /* Transfer Control. */
1198 {
1199 int cond;
1200 int jmp;
1201
1202 if ((insn & 0x002e0000) == 0) {
1203 DPRINTF("NOP\n");
1204 break;
1205 }
1206 if (s->sist1 & LSI_SIST1_STO) {
1207 DPRINTF("Delayed select timeout\n");
1208 lsi_stop_script(s);
1209 break;
1210 }
1211 cond = jmp = (insn & (1 << 19)) != 0;
1212 if (cond == jmp && (insn & (1 << 21))) {
1213 DPRINTF("Compare carry %d\n", s->carry == jmp);
1214 cond = s->carry != 0;
1215 }
1216 if (cond == jmp && (insn & (1 << 17))) {
1217 DPRINTF("Compare phase %d %c= %d\n",
1218 (s->sstat1 & PHASE_MASK),
1219 jmp ? '=' : '!',
1220 ((insn >> 24) & 7));
1221 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1222 }
1223 if (cond == jmp && (insn & (1 << 18))) {
1224 uint8_t mask;
1225
1226 mask = (~insn >> 8) & 0xff;
1227 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1228 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1229 cond = (s->sfbr & mask) == (insn & mask);
1230 }
1231 if (cond == jmp) {
1232 if (insn & (1 << 23)) {
1233 /* Relative address. */
1234 addr = s->dsp + sxt24(addr);
1235 }
1236 switch ((insn >> 27) & 7) {
1237 case 0: /* Jump */
1238 DPRINTF("Jump to 0x%08x\n", addr);
1239 s->dsp = addr;
1240 break;
1241 case 1: /* Call */
1242 DPRINTF("Call 0x%08x\n", addr);
1243 s->temp = s->dsp;
1244 s->dsp = addr;
1245 break;
1246 case 2: /* Return */
1247 DPRINTF("Return to 0x%08x\n", s->temp);
1248 s->dsp = s->temp;
1249 break;
1250 case 3: /* Interrupt */
1251 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1252 if ((insn & (1 << 20)) != 0) {
1253 s->istat0 |= LSI_ISTAT0_INTF;
1254 lsi_update_irq(s);
1255 } else {
1256 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1257 }
1258 break;
1259 default:
1260 DPRINTF("Illegal transfer control\n");
1261 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1262 break;
1263 }
1264 } else {
1265 DPRINTF("Control condition failed\n");
1266 }
1267 }
1268 break;
1269
1270 case 3:
1271 if ((insn & (1 << 29)) == 0) {
1272 /* Memory move. */
1273 uint32_t dest;
1274 /* ??? The docs imply the destination address is loaded into
1275 the TEMP register. However the Linux drivers rely on
1276 the value being presrved. */
1277 dest = read_dword(s, s->dsp);
1278 s->dsp += 4;
1279 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1280 } else {
1281 uint8_t data[7];
1282 int reg;
1283 int n;
1284 int i;
1285
1286 if (insn & (1 << 28)) {
1287 addr = s->dsa + sxt24(addr);
1288 }
1289 n = (insn & 7);
1290 reg = (insn >> 16) & 0xff;
1291 if (insn & (1 << 24)) {
1292 cpu_physical_memory_read(addr, data, n);
1293 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1294 addr, *(int *)data);
1295 for (i = 0; i < n; i++) {
1296 lsi_reg_writeb(s, reg + i, data[i]);
1297 }
1298 } else {
1299 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1300 for (i = 0; i < n; i++) {
1301 data[i] = lsi_reg_readb(s, reg + i);
1302 }
1303 cpu_physical_memory_write(addr, data, n);
1304 }
1305 }
1306 }
1307 if (insn_processed > 10000 && !s->waiting) {
1308 /* Some windows drivers make the device spin waiting for a memory
1309 location to change. If we have been executed a lot of code then
1310 assume this is the case and force an unexpected device disconnect.
1311 This is apparently sufficient to beat the drivers into submission.
1312 */
1313 if (!(s->sien0 & LSI_SIST0_UDC))
1314 fprintf(stderr, "inf. loop with UDC masked\n");
1315 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1316 lsi_disconnect(s);
1317 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1318 if (s->dcntl & LSI_DCNTL_SSM) {
1319 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1320 } else {
1321 goto again;
1322 }
1323 }
1324 DPRINTF("SCRIPTS execution stopped\n");
1325 }
1326
1327 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1328 {
1329 uint8_t tmp;
1330 #define CASE_GET_REG24(name, addr) \
1331 case addr: return s->name & 0xff; \
1332 case addr + 1: return (s->name >> 8) & 0xff; \
1333 case addr + 2: return (s->name >> 16) & 0xff;
1334
1335 #define CASE_GET_REG32(name, addr) \
1336 case addr: return s->name & 0xff; \
1337 case addr + 1: return (s->name >> 8) & 0xff; \
1338 case addr + 2: return (s->name >> 16) & 0xff; \
1339 case addr + 3: return (s->name >> 24) & 0xff;
1340
1341 #ifdef DEBUG_LSI_REG
1342 DPRINTF("Read reg %x\n", offset);
1343 #endif
1344 switch (offset) {
1345 case 0x00: /* SCNTL0 */
1346 return s->scntl0;
1347 case 0x01: /* SCNTL1 */
1348 return s->scntl1;
1349 case 0x02: /* SCNTL2 */
1350 return s->scntl2;
1351 case 0x03: /* SCNTL3 */
1352 return s->scntl3;
1353 case 0x04: /* SCID */
1354 return s->scid;
1355 case 0x05: /* SXFER */
1356 return s->sxfer;
1357 case 0x06: /* SDID */
1358 return s->sdid;
1359 case 0x07: /* GPREG0 */
1360 return 0x7f;
1361 case 0x08: /* Revision ID */
1362 return 0x00;
1363 case 0xa: /* SSID */
1364 return s->ssid;
1365 case 0xb: /* SBCL */
1366 /* ??? This is not correct. However it's (hopefully) only
1367 used for diagnostics, so should be ok. */
1368 return 0;
1369 case 0xc: /* DSTAT */
1370 tmp = s->dstat | 0x80;
1371 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1372 s->dstat = 0;
1373 lsi_update_irq(s);
1374 return tmp;
1375 case 0x0d: /* SSTAT0 */
1376 return s->sstat0;
1377 case 0x0e: /* SSTAT1 */
1378 return s->sstat1;
1379 case 0x0f: /* SSTAT2 */
1380 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1381 CASE_GET_REG32(dsa, 0x10)
1382 case 0x14: /* ISTAT0 */
1383 return s->istat0;
1384 case 0x15: /* ISTAT1 */
1385 return s->istat1;
1386 case 0x16: /* MBOX0 */
1387 return s->mbox0;
1388 case 0x17: /* MBOX1 */
1389 return s->mbox1;
1390 case 0x18: /* CTEST0 */
1391 return 0xff;
1392 case 0x19: /* CTEST1 */
1393 return 0;
1394 case 0x1a: /* CTEST2 */
1395 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1396 if (s->istat0 & LSI_ISTAT0_SIGP) {
1397 s->istat0 &= ~LSI_ISTAT0_SIGP;
1398 tmp |= LSI_CTEST2_SIGP;
1399 }
1400 return tmp;
1401 case 0x1b: /* CTEST3 */
1402 return s->ctest3;
1403 CASE_GET_REG32(temp, 0x1c)
1404 case 0x20: /* DFIFO */
1405 return 0;
1406 case 0x21: /* CTEST4 */
1407 return s->ctest4;
1408 case 0x22: /* CTEST5 */
1409 return s->ctest5;
1410 case 0x23: /* CTEST6 */
1411 return 0;
1412 CASE_GET_REG24(dbc, 0x24)
1413 case 0x27: /* DCMD */
1414 return s->dcmd;
1415 CASE_GET_REG32(dnad, 0x28)
1416 CASE_GET_REG32(dsp, 0x2c)
1417 CASE_GET_REG32(dsps, 0x30)
1418 CASE_GET_REG32(scratch[0], 0x34)
1419 case 0x38: /* DMODE */
1420 return s->dmode;
1421 case 0x39: /* DIEN */
1422 return s->dien;
1423 case 0x3a: /* SBR */
1424 return s->sbr;
1425 case 0x3b: /* DCNTL */
1426 return s->dcntl;
1427 case 0x40: /* SIEN0 */
1428 return s->sien0;
1429 case 0x41: /* SIEN1 */
1430 return s->sien1;
1431 case 0x42: /* SIST0 */
1432 tmp = s->sist0;
1433 s->sist0 = 0;
1434 lsi_update_irq(s);
1435 return tmp;
1436 case 0x43: /* SIST1 */
1437 tmp = s->sist1;
1438 s->sist1 = 0;
1439 lsi_update_irq(s);
1440 return tmp;
1441 case 0x46: /* MACNTL */
1442 return 0x0f;
1443 case 0x47: /* GPCNTL0 */
1444 return 0x0f;
1445 case 0x48: /* STIME0 */
1446 return s->stime0;
1447 case 0x4a: /* RESPID0 */
1448 return s->respid0;
1449 case 0x4b: /* RESPID1 */
1450 return s->respid1;
1451 case 0x4d: /* STEST1 */
1452 return s->stest1;
1453 case 0x4e: /* STEST2 */
1454 return s->stest2;
1455 case 0x4f: /* STEST3 */
1456 return s->stest3;
1457 case 0x50: /* SIDL */
1458 /* This is needed by the linux drivers. We currently only update it
1459 during the MSG IN phase. */
1460 return s->sidl;
1461 case 0x52: /* STEST4 */
1462 return 0xe0;
1463 case 0x56: /* CCNTL0 */
1464 return s->ccntl0;
1465 case 0x57: /* CCNTL1 */
1466 return s->ccntl1;
1467 case 0x58: /* SBDL */
1468 /* Some drivers peek at the data bus during the MSG IN phase. */
1469 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1470 return s->msg[0];
1471 return 0;
1472 case 0x59: /* SBDL high */
1473 return 0;
1474 CASE_GET_REG32(mmrs, 0xa0)
1475 CASE_GET_REG32(mmws, 0xa4)
1476 CASE_GET_REG32(sfs, 0xa8)
1477 CASE_GET_REG32(drs, 0xac)
1478 CASE_GET_REG32(sbms, 0xb0)
1479 CASE_GET_REG32(dbms, 0xb4)
1480 CASE_GET_REG32(dnad64, 0xb8)
1481 CASE_GET_REG32(pmjad1, 0xc0)
1482 CASE_GET_REG32(pmjad2, 0xc4)
1483 CASE_GET_REG32(rbc, 0xc8)
1484 CASE_GET_REG32(ua, 0xcc)
1485 CASE_GET_REG32(ia, 0xd4)
1486 CASE_GET_REG32(sbc, 0xd8)
1487 CASE_GET_REG32(csbc, 0xdc)
1488 }
1489 if (offset >= 0x5c && offset < 0xa0) {
1490 int n;
1491 int shift;
1492 n = (offset - 0x58) >> 2;
1493 shift = (offset & 3) * 8;
1494 return (s->scratch[n] >> shift) & 0xff;
1495 }
1496 BADF("readb 0x%x\n", offset);
1497 exit(1);
1498 #undef CASE_GET_REG24
1499 #undef CASE_GET_REG32
1500 }
1501
1502 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1503 {
1504 #define CASE_SET_REG24(name, addr) \
1505 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1506 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1507 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1508
1509 #define CASE_SET_REG32(name, addr) \
1510 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1511 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1512 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1513 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1514
1515 #ifdef DEBUG_LSI_REG
1516 DPRINTF("Write reg %x = %02x\n", offset, val);
1517 #endif
1518 switch (offset) {
1519 case 0x00: /* SCNTL0 */
1520 s->scntl0 = val;
1521 if (val & LSI_SCNTL0_START) {
1522 BADF("Start sequence not implemented\n");
1523 }
1524 break;
1525 case 0x01: /* SCNTL1 */
1526 s->scntl1 = val & ~LSI_SCNTL1_SST;
1527 if (val & LSI_SCNTL1_IARB) {
1528 BADF("Immediate Arbritration not implemented\n");
1529 }
1530 if (val & LSI_SCNTL1_RST) {
1531 s->sstat0 |= LSI_SSTAT0_RST;
1532 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1533 } else {
1534 s->sstat0 &= ~LSI_SSTAT0_RST;
1535 }
1536 break;
1537 case 0x02: /* SCNTL2 */
1538 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1539 s->scntl2 = val;
1540 break;
1541 case 0x03: /* SCNTL3 */
1542 s->scntl3 = val;
1543 break;
1544 case 0x04: /* SCID */
1545 s->scid = val;
1546 break;
1547 case 0x05: /* SXFER */
1548 s->sxfer = val;
1549 break;
1550 case 0x06: /* SDID */
1551 if ((val & 0xf) != (s->ssid & 0xf))
1552 BADF("Destination ID does not match SSID\n");
1553 s->sdid = val & 0xf;
1554 break;
1555 case 0x07: /* GPREG0 */
1556 break;
1557 case 0x08: /* SFBR */
1558 /* The CPU is not allowed to write to this register. However the
1559 SCRIPTS register move instructions are. */
1560 s->sfbr = val;
1561 break;
1562 case 0x0a: case 0x0b:
1563 /* Openserver writes to these readonly registers on startup */
1564 return;
1565 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1566 /* Linux writes to these readonly registers on startup. */
1567 return;
1568 CASE_SET_REG32(dsa, 0x10)
1569 case 0x14: /* ISTAT0 */
1570 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1571 if (val & LSI_ISTAT0_ABRT) {
1572 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1573 }
1574 if (val & LSI_ISTAT0_INTF) {
1575 s->istat0 &= ~LSI_ISTAT0_INTF;
1576 lsi_update_irq(s);
1577 }
1578 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1579 DPRINTF("Woken by SIGP\n");
1580 s->waiting = 0;
1581 s->dsp = s->dnad;
1582 lsi_execute_script(s);
1583 }
1584 if (val & LSI_ISTAT0_SRST) {
1585 lsi_soft_reset(s);
1586 }
1587 break;
1588 case 0x16: /* MBOX0 */
1589 s->mbox0 = val;
1590 break;
1591 case 0x17: /* MBOX1 */
1592 s->mbox1 = val;
1593 break;
1594 case 0x1a: /* CTEST2 */
1595 s->ctest2 = val & LSI_CTEST2_PCICIE;
1596 break;
1597 case 0x1b: /* CTEST3 */
1598 s->ctest3 = val & 0x0f;
1599 break;
1600 CASE_SET_REG32(temp, 0x1c)
1601 case 0x21: /* CTEST4 */
1602 if (val & 7) {
1603 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1604 }
1605 s->ctest4 = val;
1606 break;
1607 case 0x22: /* CTEST5 */
1608 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1609 BADF("CTEST5 DMA increment not implemented\n");
1610 }
1611 s->ctest5 = val;
1612 break;
1613 CASE_SET_REG24(dbc, 0x24)
1614 CASE_SET_REG32(dnad, 0x28)
1615 case 0x2c: /* DSP[0:7] */
1616 s->dsp &= 0xffffff00;
1617 s->dsp |= val;
1618 break;
1619 case 0x2d: /* DSP[8:15] */
1620 s->dsp &= 0xffff00ff;
1621 s->dsp |= val << 8;
1622 break;
1623 case 0x2e: /* DSP[16:23] */
1624 s->dsp &= 0xff00ffff;
1625 s->dsp |= val << 16;
1626 break;
1627 case 0x2f: /* DSP[24:31] */
1628 s->dsp &= 0x00ffffff;
1629 s->dsp |= val << 24;
1630 if ((s->dmode & LSI_DMODE_MAN) == 0
1631 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1632 lsi_execute_script(s);
1633 break;
1634 CASE_SET_REG32(dsps, 0x30)
1635 CASE_SET_REG32(scratch[0], 0x34)
1636 case 0x38: /* DMODE */
1637 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1638 BADF("IO mappings not implemented\n");
1639 }
1640 s->dmode = val;
1641 break;
1642 case 0x39: /* DIEN */
1643 s->dien = val;
1644 lsi_update_irq(s);
1645 break;
1646 case 0x3a: /* SBR */
1647 s->sbr = val;
1648 break;
1649 case 0x3b: /* DCNTL */
1650 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1651 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1652 lsi_execute_script(s);
1653 break;
1654 case 0x40: /* SIEN0 */
1655 s->sien0 = val;
1656 lsi_update_irq(s);
1657 break;
1658 case 0x41: /* SIEN1 */
1659 s->sien1 = val;
1660 lsi_update_irq(s);
1661 break;
1662 case 0x47: /* GPCNTL0 */
1663 break;
1664 case 0x48: /* STIME0 */
1665 s->stime0 = val;
1666 break;
1667 case 0x49: /* STIME1 */
1668 if (val & 0xf) {
1669 DPRINTF("General purpose timer not implemented\n");
1670 /* ??? Raising the interrupt immediately seems to be sufficient
1671 to keep the FreeBSD driver happy. */
1672 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1673 }
1674 break;
1675 case 0x4a: /* RESPID0 */
1676 s->respid0 = val;
1677 break;
1678 case 0x4b: /* RESPID1 */
1679 s->respid1 = val;
1680 break;
1681 case 0x4d: /* STEST1 */
1682 s->stest1 = val;
1683 break;
1684 case 0x4e: /* STEST2 */
1685 if (val & 1) {
1686 BADF("Low level mode not implemented\n");
1687 }
1688 s->stest2 = val;
1689 break;
1690 case 0x4f: /* STEST3 */
1691 if (val & 0x41) {
1692 BADF("SCSI FIFO test mode not implemented\n");
1693 }
1694 s->stest3 = val;
1695 break;
1696 case 0x56: /* CCNTL0 */
1697 s->ccntl0 = val;
1698 break;
1699 case 0x57: /* CCNTL1 */
1700 s->ccntl1 = val;
1701 break;
1702 CASE_SET_REG32(mmrs, 0xa0)
1703 CASE_SET_REG32(mmws, 0xa4)
1704 CASE_SET_REG32(sfs, 0xa8)
1705 CASE_SET_REG32(drs, 0xac)
1706 CASE_SET_REG32(sbms, 0xb0)
1707 CASE_SET_REG32(dbms, 0xb4)
1708 CASE_SET_REG32(dnad64, 0xb8)
1709 CASE_SET_REG32(pmjad1, 0xc0)
1710 CASE_SET_REG32(pmjad2, 0xc4)
1711 CASE_SET_REG32(rbc, 0xc8)
1712 CASE_SET_REG32(ua, 0xcc)
1713 CASE_SET_REG32(ia, 0xd4)
1714 CASE_SET_REG32(sbc, 0xd8)
1715 CASE_SET_REG32(csbc, 0xdc)
1716 default:
1717 if (offset >= 0x5c && offset < 0xa0) {
1718 int n;
1719 int shift;
1720 n = (offset - 0x58) >> 2;
1721 shift = (offset & 3) * 8;
1722 s->scratch[n] &= ~(0xff << shift);
1723 s->scratch[n] |= (val & 0xff) << shift;
1724 } else {
1725 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1726 }
1727 }
1728 #undef CASE_SET_REG24
1729 #undef CASE_SET_REG32
1730 }
1731
1732 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1733 {
1734 LSIState *s = opaque;
1735
1736 lsi_reg_writeb(s, addr & 0xff, val);
1737 }
1738
1739 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1740 {
1741 LSIState *s = opaque;
1742
1743 addr &= 0xff;
1744 lsi_reg_writeb(s, addr, val & 0xff);
1745 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1746 }
1747
1748 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1749 {
1750 LSIState *s = opaque;
1751
1752 addr &= 0xff;
1753 lsi_reg_writeb(s, addr, val & 0xff);
1754 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1755 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1756 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1757 }
1758
1759 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1760 {
1761 LSIState *s = opaque;
1762
1763 return lsi_reg_readb(s, addr & 0xff);
1764 }
1765
1766 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1767 {
1768 LSIState *s = opaque;
1769 uint32_t val;
1770
1771 addr &= 0xff;
1772 val = lsi_reg_readb(s, addr);
1773 val |= lsi_reg_readb(s, addr + 1) << 8;
1774 return val;
1775 }
1776
1777 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1778 {
1779 LSIState *s = opaque;
1780 uint32_t val;
1781 addr &= 0xff;
1782 val = lsi_reg_readb(s, addr);
1783 val |= lsi_reg_readb(s, addr + 1) << 8;
1784 val |= lsi_reg_readb(s, addr + 2) << 16;
1785 val |= lsi_reg_readb(s, addr + 3) << 24;
1786 return val;
1787 }
1788
1789 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1790 lsi_mmio_readb,
1791 lsi_mmio_readw,
1792 lsi_mmio_readl,
1793 };
1794
1795 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1796 lsi_mmio_writeb,
1797 lsi_mmio_writew,
1798 lsi_mmio_writel,
1799 };
1800
1801 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1802 {
1803 LSIState *s = opaque;
1804 uint32_t newval;
1805 int shift;
1806
1807 addr &= 0x1fff;
1808 newval = s->script_ram[addr >> 2];
1809 shift = (addr & 3) * 8;
1810 newval &= ~(0xff << shift);
1811 newval |= val << shift;
1812 s->script_ram[addr >> 2] = newval;
1813 }
1814
1815 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1816 {
1817 LSIState *s = opaque;
1818 uint32_t newval;
1819
1820 addr &= 0x1fff;
1821 newval = s->script_ram[addr >> 2];
1822 if (addr & 2) {
1823 newval = (newval & 0xffff) | (val << 16);
1824 } else {
1825 newval = (newval & 0xffff0000) | val;
1826 }
1827 s->script_ram[addr >> 2] = newval;
1828 }
1829
1830
1831 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1832 {
1833 LSIState *s = opaque;
1834
1835 addr &= 0x1fff;
1836 s->script_ram[addr >> 2] = val;
1837 }
1838
1839 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1840 {
1841 LSIState *s = opaque;
1842 uint32_t val;
1843
1844 addr &= 0x1fff;
1845 val = s->script_ram[addr >> 2];
1846 val >>= (addr & 3) * 8;
1847 return val & 0xff;
1848 }
1849
1850 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1851 {
1852 LSIState *s = opaque;
1853 uint32_t val;
1854
1855 addr &= 0x1fff;
1856 val = s->script_ram[addr >> 2];
1857 if (addr & 2)
1858 val >>= 16;
1859 return le16_to_cpu(val);
1860 }
1861
1862 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1863 {
1864 LSIState *s = opaque;
1865
1866 addr &= 0x1fff;
1867 return le32_to_cpu(s->script_ram[addr >> 2]);
1868 }
1869
1870 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1871 lsi_ram_readb,
1872 lsi_ram_readw,
1873 lsi_ram_readl,
1874 };
1875
1876 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1877 lsi_ram_writeb,
1878 lsi_ram_writew,
1879 lsi_ram_writel,
1880 };
1881
1882 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1883 {
1884 LSIState *s = opaque;
1885 return lsi_reg_readb(s, addr & 0xff);
1886 }
1887
1888 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1889 {
1890 LSIState *s = opaque;
1891 uint32_t val;
1892 addr &= 0xff;
1893 val = lsi_reg_readb(s, addr);
1894 val |= lsi_reg_readb(s, addr + 1) << 8;
1895 return val;
1896 }
1897
1898 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1899 {
1900 LSIState *s = opaque;
1901 uint32_t val;
1902 addr &= 0xff;
1903 val = lsi_reg_readb(s, addr);
1904 val |= lsi_reg_readb(s, addr + 1) << 8;
1905 val |= lsi_reg_readb(s, addr + 2) << 16;
1906 val |= lsi_reg_readb(s, addr + 3) << 24;
1907 return val;
1908 }
1909
1910 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1911 {
1912 LSIState *s = opaque;
1913 lsi_reg_writeb(s, addr & 0xff, val);
1914 }
1915
1916 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1917 {
1918 LSIState *s = opaque;
1919 addr &= 0xff;
1920 lsi_reg_writeb(s, addr, val & 0xff);
1921 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1922 }
1923
1924 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1925 {
1926 LSIState *s = opaque;
1927 addr &= 0xff;
1928 lsi_reg_writeb(s, addr, val & 0xff);
1929 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1930 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1931 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1932 }
1933
1934 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1935 pcibus_t addr, pcibus_t size, int type)
1936 {
1937 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1938
1939 DPRINTF("Mapping IO at %08x\n", addr);
1940
1941 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1942 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1943 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1944 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1945 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1946 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1947 }
1948
1949 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1950 pcibus_t addr, pcibus_t size, int type)
1951 {
1952 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1953
1954 DPRINTF("Mapping ram at %08x\n", addr);
1955 s->script_ram_base = addr;
1956 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1957 }
1958
1959 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1960 pcibus_t addr, pcibus_t size, int type)
1961 {
1962 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1963
1964 DPRINTF("Mapping registers at %08x\n", addr);
1965 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1966 }
1967
1968 static void lsi_pre_save(void *opaque)
1969 {
1970 LSIState *s = opaque;
1971
1972 assert(s->dma_buf == NULL);
1973 assert(s->current_dma_len == 0);
1974 assert(s->active_commands == 0);
1975 }
1976
1977 static const VMStateDescription vmstate_lsi_scsi = {
1978 .name = "lsiscsi",
1979 .version_id = 0,
1980 .minimum_version_id = 0,
1981 .minimum_version_id_old = 0,
1982 .pre_save = lsi_pre_save,
1983 .fields = (VMStateField []) {
1984 VMSTATE_PCI_DEVICE(dev, LSIState),
1985
1986 VMSTATE_INT32(carry, LSIState),
1987 VMSTATE_INT32(sense, LSIState),
1988 VMSTATE_INT32(msg_action, LSIState),
1989 VMSTATE_INT32(msg_len, LSIState),
1990 VMSTATE_BUFFER(msg, LSIState),
1991 VMSTATE_INT32(waiting, LSIState),
1992
1993 VMSTATE_UINT32(dsa, LSIState),
1994 VMSTATE_UINT32(temp, LSIState),
1995 VMSTATE_UINT32(dnad, LSIState),
1996 VMSTATE_UINT32(dbc, LSIState),
1997 VMSTATE_UINT8(istat0, LSIState),
1998 VMSTATE_UINT8(istat1, LSIState),
1999 VMSTATE_UINT8(dcmd, LSIState),
2000 VMSTATE_UINT8(dstat, LSIState),
2001 VMSTATE_UINT8(dien, LSIState),
2002 VMSTATE_UINT8(sist0, LSIState),
2003 VMSTATE_UINT8(sist1, LSIState),
2004 VMSTATE_UINT8(sien0, LSIState),
2005 VMSTATE_UINT8(sien1, LSIState),
2006 VMSTATE_UINT8(mbox0, LSIState),
2007 VMSTATE_UINT8(mbox1, LSIState),
2008 VMSTATE_UINT8(dfifo, LSIState),
2009 VMSTATE_UINT8(ctest2, LSIState),
2010 VMSTATE_UINT8(ctest3, LSIState),
2011 VMSTATE_UINT8(ctest4, LSIState),
2012 VMSTATE_UINT8(ctest5, LSIState),
2013 VMSTATE_UINT8(ccntl0, LSIState),
2014 VMSTATE_UINT8(ccntl1, LSIState),
2015 VMSTATE_UINT32(dsp, LSIState),
2016 VMSTATE_UINT32(dsps, LSIState),
2017 VMSTATE_UINT8(dmode, LSIState),
2018 VMSTATE_UINT8(dcntl, LSIState),
2019 VMSTATE_UINT8(scntl0, LSIState),
2020 VMSTATE_UINT8(scntl1, LSIState),
2021 VMSTATE_UINT8(scntl2, LSIState),
2022 VMSTATE_UINT8(scntl3, LSIState),
2023 VMSTATE_UINT8(sstat0, LSIState),
2024 VMSTATE_UINT8(sstat1, LSIState),
2025 VMSTATE_UINT8(scid, LSIState),
2026 VMSTATE_UINT8(sxfer, LSIState),
2027 VMSTATE_UINT8(socl, LSIState),
2028 VMSTATE_UINT8(sdid, LSIState),
2029 VMSTATE_UINT8(ssid, LSIState),
2030 VMSTATE_UINT8(sfbr, LSIState),
2031 VMSTATE_UINT8(stest1, LSIState),
2032 VMSTATE_UINT8(stest2, LSIState),
2033 VMSTATE_UINT8(stest3, LSIState),
2034 VMSTATE_UINT8(sidl, LSIState),
2035 VMSTATE_UINT8(stime0, LSIState),
2036 VMSTATE_UINT8(respid0, LSIState),
2037 VMSTATE_UINT8(respid1, LSIState),
2038 VMSTATE_UINT32(mmrs, LSIState),
2039 VMSTATE_UINT32(mmws, LSIState),
2040 VMSTATE_UINT32(sfs, LSIState),
2041 VMSTATE_UINT32(drs, LSIState),
2042 VMSTATE_UINT32(sbms, LSIState),
2043 VMSTATE_UINT32(dbms, LSIState),
2044 VMSTATE_UINT32(dnad64, LSIState),
2045 VMSTATE_UINT32(pmjad1, LSIState),
2046 VMSTATE_UINT32(pmjad2, LSIState),
2047 VMSTATE_UINT32(rbc, LSIState),
2048 VMSTATE_UINT32(ua, LSIState),
2049 VMSTATE_UINT32(ia, LSIState),
2050 VMSTATE_UINT32(sbc, LSIState),
2051 VMSTATE_UINT32(csbc, LSIState),
2052 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2053 VMSTATE_UINT8(sbr, LSIState),
2054
2055 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2056 VMSTATE_END_OF_LIST()
2057 }
2058 };
2059
2060 static int lsi_scsi_uninit(PCIDevice *d)
2061 {
2062 LSIState *s = DO_UPCAST(LSIState, dev, d);
2063
2064 cpu_unregister_io_memory(s->mmio_io_addr);
2065 cpu_unregister_io_memory(s->ram_io_addr);
2066
2067 qemu_free(s->queue);
2068
2069 return 0;
2070 }
2071
2072 static int lsi_scsi_init(PCIDevice *dev)
2073 {
2074 LSIState *s = DO_UPCAST(LSIState, dev, dev);
2075 uint8_t *pci_conf;
2076
2077 pci_conf = s->dev.config;
2078
2079 /* PCI Vendor ID (word) */
2080 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2081 /* PCI device ID (word) */
2082 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2083 /* PCI base class code */
2084 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2085 /* PCI subsystem ID */
2086 pci_conf[0x2e] = 0x00;
2087 pci_conf[0x2f] = 0x10;
2088 /* PCI latency timer = 255 */
2089 pci_conf[0x0d] = 0xff;
2090 /* Interrupt pin 1 */
2091 pci_conf[0x3d] = 0x01;
2092
2093 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2094 lsi_mmio_writefn, s);
2095 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2096 lsi_ram_writefn, s);
2097
2098 pci_register_bar((struct PCIDevice *)s, 0, 256,
2099 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2100 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2101 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2102 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2103 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2104 s->queue = qemu_malloc(sizeof(lsi_queue));
2105 s->queue_len = 1;
2106 s->active_commands = 0;
2107
2108 lsi_soft_reset(s);
2109
2110 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2111 if (!dev->qdev.hotplugged) {
2112 scsi_bus_legacy_handle_cmdline(&s->bus);
2113 }
2114 vmstate_register(-1, &vmstate_lsi_scsi, s);
2115 return 0;
2116 }
2117
2118 static PCIDeviceInfo lsi_info = {
2119 .qdev.name = "lsi53c895a",
2120 .qdev.alias = "lsi",
2121 .qdev.size = sizeof(LSIState),
2122 .init = lsi_scsi_init,
2123 .exit = lsi_scsi_uninit,
2124 };
2125
2126 static void lsi53c895a_register_devices(void)
2127 {
2128 pci_qdev_register(&lsi_info);
2129 }
2130
2131 device_init(lsi53c895a_register_devices);
Qemu copy for testing