]> git.proxmox.com Git - qemu.git/blame - hw/lsi53c895a.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
ac97: Use PCI DMA stub functions
[qemu.git] / hw / lsi53c895a.c
CommitLineData
5fafdf24 1/*
7d8406be
PB		 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
8e31bf38 7 * This code is licensed under the LGPL.
7d8406be
PB		 8 */
9
10/* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
a15fdf86 13#include <assert.h>
777aec7a 14
87ecb68b
PB		 15#include "hw.h"
16#include "pci.h"
43b443b6 17#include "scsi.h"
7d8406be
PB		 18
19//#define DEBUG_LSI
20//#define DEBUG_LSI_REG
21
22#ifdef DEBUG_LSI
001faf32
BS		 23#define DPRINTF(fmt, ...) \
24do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
25#define BADF(fmt, ...) \
26do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
7d8406be 27#else
001faf32
BS		 28#define DPRINTF(fmt, ...) do {} while(0)
29#define BADF(fmt, ...) \
30do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
7d8406be
PB		 31#endif
32
18e08a55
MT		 33#define LSI_MAX_DEVS 7
34
7d8406be
PB		 35#define LSI_SCNTL0_TRG 0x01
36#define LSI_SCNTL0_AAP 0x02
37#define LSI_SCNTL0_EPC 0x08
38#define LSI_SCNTL0_WATN 0x10
39#define LSI_SCNTL0_START 0x20
40
41#define LSI_SCNTL1_SST 0x01
42#define LSI_SCNTL1_IARB 0x02
43#define LSI_SCNTL1_AESP 0x04
44#define LSI_SCNTL1_RST 0x08
45#define LSI_SCNTL1_CON 0x10
46#define LSI_SCNTL1_DHP 0x20
47#define LSI_SCNTL1_ADB 0x40
48#define LSI_SCNTL1_EXC 0x80
49
50#define LSI_SCNTL2_WSR 0x01
51#define LSI_SCNTL2_VUE0 0x02
52#define LSI_SCNTL2_VUE1 0x04
53#define LSI_SCNTL2_WSS 0x08
54#define LSI_SCNTL2_SLPHBEN 0x10
55#define LSI_SCNTL2_SLPMD 0x20
56#define LSI_SCNTL2_CHM 0x40
57#define LSI_SCNTL2_SDU 0x80
58
59#define LSI_ISTAT0_DIP 0x01
60#define LSI_ISTAT0_SIP 0x02
61#define LSI_ISTAT0_INTF 0x04
62#define LSI_ISTAT0_CON 0x08
63#define LSI_ISTAT0_SEM 0x10
64#define LSI_ISTAT0_SIGP 0x20
65#define LSI_ISTAT0_SRST 0x40
66#define LSI_ISTAT0_ABRT 0x80
67
68#define LSI_ISTAT1_SI 0x01
69#define LSI_ISTAT1_SRUN 0x02
70#define LSI_ISTAT1_FLSH 0x04
71
72#define LSI_SSTAT0_SDP0 0x01
73#define LSI_SSTAT0_RST 0x02
74#define LSI_SSTAT0_WOA 0x04
75#define LSI_SSTAT0_LOA 0x08
76#define LSI_SSTAT0_AIP 0x10
77#define LSI_SSTAT0_OLF 0x20
78#define LSI_SSTAT0_ORF 0x40
79#define LSI_SSTAT0_ILF 0x80
80
81#define LSI_SIST0_PAR 0x01
82#define LSI_SIST0_RST 0x02
83#define LSI_SIST0_UDC 0x04
84#define LSI_SIST0_SGE 0x08
85#define LSI_SIST0_RSL 0x10
86#define LSI_SIST0_SEL 0x20
87#define LSI_SIST0_CMP 0x40
88#define LSI_SIST0_MA 0x80
89
90#define LSI_SIST1_HTH 0x01
91#define LSI_SIST1_GEN 0x02
92#define LSI_SIST1_STO 0x04
93#define LSI_SIST1_SBMC 0x10
94
95#define LSI_SOCL_IO 0x01
96#define LSI_SOCL_CD 0x02
97#define LSI_SOCL_MSG 0x04
98#define LSI_SOCL_ATN 0x08
99#define LSI_SOCL_SEL 0x10
100#define LSI_SOCL_BSY 0x20
101#define LSI_SOCL_ACK 0x40
102#define LSI_SOCL_REQ 0x80
103
104#define LSI_DSTAT_IID 0x01
105#define LSI_DSTAT_SIR 0x04
106#define LSI_DSTAT_SSI 0x08
107#define LSI_DSTAT_ABRT 0x10
108#define LSI_DSTAT_BF 0x20
109#define LSI_DSTAT_MDPE 0x40
110#define LSI_DSTAT_DFE 0x80
111
112#define LSI_DCNTL_COM 0x01
113#define LSI_DCNTL_IRQD 0x02
114#define LSI_DCNTL_STD 0x04
115#define LSI_DCNTL_IRQM 0x08
116#define LSI_DCNTL_SSM 0x10
117#define LSI_DCNTL_PFEN 0x20
118#define LSI_DCNTL_PFF 0x40
119#define LSI_DCNTL_CLSE 0x80
120
121#define LSI_DMODE_MAN 0x01
122#define LSI_DMODE_BOF 0x02
123#define LSI_DMODE_ERMP 0x04
124#define LSI_DMODE_ERL 0x08
125#define LSI_DMODE_DIOM 0x10
126#define LSI_DMODE_SIOM 0x20
127
128#define LSI_CTEST2_DACK 0x01
129#define LSI_CTEST2_DREQ 0x02
130#define LSI_CTEST2_TEOP 0x04
131#define LSI_CTEST2_PCICIE 0x08
132#define LSI_CTEST2_CM 0x10
133#define LSI_CTEST2_CIO 0x20
134#define LSI_CTEST2_SIGP 0x40
135#define LSI_CTEST2_DDIR 0x80
136
137#define LSI_CTEST5_BL2 0x04
138#define LSI_CTEST5_DDIR 0x08
139#define LSI_CTEST5_MASR 0x10
140#define LSI_CTEST5_DFSN 0x20
141#define LSI_CTEST5_BBCK 0x40
142#define LSI_CTEST5_ADCK 0x80
143
144#define LSI_CCNTL0_DILS 0x01
145#define LSI_CCNTL0_DISFC 0x10
146#define LSI_CCNTL0_ENNDJ 0x20
147#define LSI_CCNTL0_PMJCTL 0x40
148#define LSI_CCNTL0_ENPMJ 0x80
149
b25cf589
AL		 150#define LSI_CCNTL1_EN64DBMV 0x01
151#define LSI_CCNTL1_EN64TIBMV 0x02
152#define LSI_CCNTL1_64TIMOD 0x04
153#define LSI_CCNTL1_DDAC 0x08
154#define LSI_CCNTL1_ZMOD 0x80
155
e560125e
LA		 156/* Enable Response to Reselection */
157#define LSI_SCID_RRE 0x60
158
b25cf589
AL		 159#define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
160
7d8406be
PB		 161#define PHASE_DO 0
162#define PHASE_DI 1
163#define PHASE_CMD 2
164#define PHASE_ST 3
165#define PHASE_MO 6
166#define PHASE_MI 7
167#define PHASE_MASK 7
168
a917d384
PB		 169/* Maximum length of MSG IN data. */
170#define LSI_MAX_MSGIN_LEN 8
171
172/* Flag set if this is a tagged command. */
173#define LSI_TAG_VALID (1 << 16)
174
042ec49d 175typedef struct lsi_request {
5c6c0e51 176 SCSIRequest *req;
a917d384 177 uint32_t tag;
b96a0da0
GH		 178 uint32_t dma_len;
179 uint8_t *dma_buf;
a917d384
PB		 180 uint32_t pending;
181 int out;
042ec49d
GH		 182 QTAILQ_ENTRY(lsi_request) next;
183} lsi_request;
4d611c9a 184
7d8406be 185typedef struct {
f305261f 186 PCIDevice dev;
b0ce84e5
AK		 187 MemoryRegion mmio_io;
188 MemoryRegion ram_io;
189 MemoryRegion io_io;
7d8406be
PB		 190
191 int carry; /* ??? Should this be an a visible register somewhere? */
2f172849 192 int status;
a917d384 193 /* Action to take at the end of a MSG IN phase.
a15fdf86 194 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
a917d384
PB		 195 int msg_action;
196 int msg_len;
197 uint8_t msg[LSI_MAX_MSGIN_LEN];
4d611c9a
PB		 198 /* 0 if SCRIPTS are running or stopped.
199 * 1 if a Wait Reselect instruction has been issued.
a917d384
PB		 200 * 2 if processing DMA from lsi_execute_script.
201 * 3 if a DMA operation is in progress. */
7d8406be 202 int waiting;
ca9c39fa 203 SCSIBus bus;
7d8406be 204 int current_lun;
a917d384 205 /* The tag is a combination of the device ID and the SCSI tag. */
af12ac98 206 uint32_t select_tag;
8ccc2ace 207 int command_complete;
042ec49d 208 QTAILQ_HEAD(, lsi_request) queue;
af12ac98 209 lsi_request *current;
7d8406be
PB		 210
211 uint32_t dsa;
212 uint32_t temp;
213 uint32_t dnad;
214 uint32_t dbc;
215 uint8_t istat0;
216 uint8_t istat1;
217 uint8_t dcmd;
218 uint8_t dstat;
219 uint8_t dien;
220 uint8_t sist0;
221 uint8_t sist1;
222 uint8_t sien0;
223 uint8_t sien1;
224 uint8_t mbox0;
225 uint8_t mbox1;
226 uint8_t dfifo;
9167a69a 227 uint8_t ctest2;
7d8406be
PB		 228 uint8_t ctest3;
229 uint8_t ctest4;
230 uint8_t ctest5;
231 uint8_t ccntl0;
232 uint8_t ccntl1;
233 uint32_t dsp;
234 uint32_t dsps;
235 uint8_t dmode;
236 uint8_t dcntl;
237 uint8_t scntl0;
238 uint8_t scntl1;
239 uint8_t scntl2;
240 uint8_t scntl3;
241 uint8_t sstat0;
242 uint8_t sstat1;
243 uint8_t scid;
244 uint8_t sxfer;
245 uint8_t socl;
246 uint8_t sdid;
a917d384 247 uint8_t ssid;
7d8406be
PB		 248 uint8_t sfbr;
249 uint8_t stest1;
250 uint8_t stest2;
251 uint8_t stest3;
a917d384 252 uint8_t sidl;
7d8406be
PB		 253 uint8_t stime0;
254 uint8_t respid0;
255 uint8_t respid1;
256 uint32_t mmrs;
257 uint32_t mmws;
258 uint32_t sfs;
259 uint32_t drs;
260 uint32_t sbms;
ab57d967 261 uint32_t dbms;
7d8406be
PB		 262 uint32_t dnad64;
263 uint32_t pmjad1;
264 uint32_t pmjad2;
265 uint32_t rbc;
266 uint32_t ua;
267 uint32_t ia;
268 uint32_t sbc;
269 uint32_t csbc;
dcfb9014 270 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
bd8ee11a 271 uint8_t sbr;
7d8406be
PB		 272
273 /* Script ram is stored as 32-bit words in host byteorder. */
274 uint32_t script_ram[2048];
275} LSIState;
276
e560125e
LA		 277static inline int lsi_irq_on_rsl(LSIState *s)
278{
279 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
280}
281
7d8406be
PB		 282static void lsi_soft_reset(LSIState *s)
283{
51336214
JK		 284 lsi_request *p;
285
7d8406be
PB		 286 DPRINTF("Reset\n");
287 s->carry = 0;
288
d43ba0af
JK		 289 s->msg_action = 0;
290 s->msg_len = 0;
7d8406be
PB		 291 s->waiting = 0;
292 s->dsa = 0;
293 s->dnad = 0;
294 s->dbc = 0;
295 s->temp = 0;
296 memset(s->scratch, 0, sizeof(s->scratch));
297 s->istat0 = 0;
298 s->istat1 = 0;
12aa6dd6
JK		 299 s->dcmd = 0x40;
300 s->dstat = LSI_DSTAT_DFE;
7d8406be
PB		 301 s->dien = 0;
302 s->sist0 = 0;
303 s->sist1 = 0;
304 s->sien0 = 0;
305 s->sien1 = 0;
306 s->mbox0 = 0;
307 s->mbox1 = 0;
308 s->dfifo = 0;
12aa6dd6 309 s->ctest2 = LSI_CTEST2_DACK;
7d8406be
PB		 310 s->ctest3 = 0;
311 s->ctest4 = 0;
312 s->ctest5 = 0;
313 s->ccntl0 = 0;
314 s->ccntl1 = 0;
315 s->dsp = 0;
316 s->dsps = 0;
317 s->dmode = 0;
318 s->dcntl = 0;
319 s->scntl0 = 0xc0;
320 s->scntl1 = 0;
321 s->scntl2 = 0;
322 s->scntl3 = 0;
323 s->sstat0 = 0;
324 s->sstat1 = 0;
325 s->scid = 7;
326 s->sxfer = 0;
327 s->socl = 0;
12aa6dd6
JK		 328 s->sdid = 0;
329 s->ssid = 0;
7d8406be
PB		 330 s->stest1 = 0;
331 s->stest2 = 0;
332 s->stest3 = 0;
a917d384 333 s->sidl = 0;
7d8406be
PB		 334 s->stime0 = 0;
335 s->respid0 = 0x80;
336 s->respid1 = 0;
337 s->mmrs = 0;
338 s->mmws = 0;
339 s->sfs = 0;
340 s->drs = 0;
341 s->sbms = 0;
ab57d967 342 s->dbms = 0;
7d8406be
PB		 343 s->dnad64 = 0;
344 s->pmjad1 = 0;
345 s->pmjad2 = 0;
346 s->rbc = 0;
347 s->ua = 0;
348 s->ia = 0;
349 s->sbc = 0;
350 s->csbc = 0;
bd8ee11a 351 s->sbr = 0;
51336214
JK		 352 while (!QTAILQ_EMPTY(&s->queue)) {
353 p = QTAILQ_FIRST(&s->queue);
354 QTAILQ_REMOVE(&s->queue, p, next);
7267c094 355 g_free(p);
51336214
JK		 356 }
357 if (s->current) {
7267c094 358 g_free(s->current);
51336214
JK		 359 s->current = NULL;
360 }
7d8406be
PB		 361}
362
b25cf589
AL		 363static int lsi_dma_40bit(LSIState *s)
364{
365 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
366 return 1;
367 return 0;
368}
369
dd8edf01
AL		 370static int lsi_dma_ti64bit(LSIState *s)
371{
372 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
373 return 1;
374 return 0;
375}
376
377static int lsi_dma_64bit(LSIState *s)
378{
379 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
380 return 1;
381 return 0;
382}
383
7d8406be
PB		 384static uint8_t lsi_reg_readb(LSIState *s, int offset);
385static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
4d611c9a 386static void lsi_execute_script(LSIState *s);
aa4d32c4 387static void lsi_reselect(LSIState *s, lsi_request *p);
7d8406be
PB		 388
389static inline uint32_t read_dword(LSIState *s, uint32_t addr)
390{
391 uint32_t buf;
392
b0ce84e5
AK		 393 /* XXX: an optimization here used to fast-path the read from scripts
394 * memory. But that bypasses any iommu.
395 */
7d8406be
PB		 396 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
397 return cpu_to_le32(buf);
398}
399
400static void lsi_stop_script(LSIState *s)
401{
402 s->istat1 &= ~LSI_ISTAT1_SRUN;
403}
404
405static void lsi_update_irq(LSIState *s)
406{
407 int level;
408 static int last_level;
042ec49d 409 lsi_request *p;
7d8406be
PB		 410
411 /* It's unclear whether the DIP/SIP bits should be cleared when the
412 Interrupt Status Registers are cleared or when istat0 is read.
413 We currently do the formwer, which seems to work. */
414 level = 0;
415 if (s->dstat) {
416 if (s->dstat & s->dien)
417 level = 1;
418 s->istat0 |= LSI_ISTAT0_DIP;
419 } else {
420 s->istat0 &= ~LSI_ISTAT0_DIP;
421 }
422
423 if (s->sist0 || s->sist1) {
424 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
425 level = 1;
426 s->istat0 |= LSI_ISTAT0_SIP;
427 } else {
428 s->istat0 &= ~LSI_ISTAT0_SIP;
429 }
430 if (s->istat0 & LSI_ISTAT0_INTF)
431 level = 1;
432
433 if (level != last_level) {
434 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
435 level, s->dstat, s->sist1, s->sist0);
436 last_level = level;
437 }
f305261f 438 qemu_set_irq(s->dev.irq[0], level);
e560125e
LA		 439
440 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
441 DPRINTF("Handled IRQs & disconnected, looking for pending "
442 "processes\n");
042ec49d
GH		 443 QTAILQ_FOREACH(p, &s->queue, next) {
444 if (p->pending) {
aa4d32c4 445 lsi_reselect(s, p);
e560125e
LA		 446 break;
447 }
448 }
449 }
7d8406be
PB		 450}
451
452/* Stop SCRIPTS execution and raise a SCSI interrupt. */
453static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
454{
455 uint32_t mask0;
456 uint32_t mask1;
457
458 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
459 stat1, stat0, s->sist1, s->sist0);
460 s->sist0 |= stat0;
461 s->sist1 |= stat1;
462 /* Stop processor on fatal or unmasked interrupt. As a special hack
463 we don't stop processing when raising STO. Instead continue
464 execution and stop at the next insn that accesses the SCSI bus. */
465 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
466 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
467 mask1 &= ~LSI_SIST1_STO;
468 if (s->sist0 & mask0 || s->sist1 & mask1) {
469 lsi_stop_script(s);
470 }
471 lsi_update_irq(s);
472}
473
474/* Stop SCRIPTS execution and raise a DMA interrupt. */
475static void lsi_script_dma_interrupt(LSIState *s, int stat)
476{
477 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
478 s->dstat |= stat;
479 lsi_update_irq(s);
480 lsi_stop_script(s);
481}
482
483static inline void lsi_set_phase(LSIState *s, int phase)
484{
485 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
486}
487
488static void lsi_bad_phase(LSIState *s, int out, int new_phase)
489{
490 /* Trigger a phase mismatch. */
491 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
d1d74664
PB		 492 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
493 s->dsp = out ? s->pmjad1 : s->pmjad2;
7d8406be 494 } else {
d1d74664 495 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
7d8406be
PB		 496 }
497 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
498 } else {
499 DPRINTF("Phase mismatch interrupt\n");
500 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
501 lsi_stop_script(s);
502 }
503 lsi_set_phase(s, new_phase);
504}
505
a917d384
PB		 506
507/* Resume SCRIPTS execution after a DMA operation. */
508static void lsi_resume_script(LSIState *s)
509{
510 if (s->waiting != 2) {
511 s->waiting = 0;
512 lsi_execute_script(s);
513 } else {
514 s->waiting = 0;
515 }
516}
517
64d56409
JK		 518static void lsi_disconnect(LSIState *s)
519{
520 s->scntl1 &= ~LSI_SCNTL1_CON;
521 s->sstat1 &= ~PHASE_MASK;
522}
523
524static void lsi_bad_selection(LSIState *s, uint32_t id)
525{
526 DPRINTF("Selected absent target %d\n", id);
527 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
528 lsi_disconnect(s);
529}
530
4d611c9a 531/* Initiate a SCSI layer data transfer. */
7d8406be
PB		 532static void lsi_do_dma(LSIState *s, int out)
533{
f48a7a6e 534 uint32_t count;
c227f099 535 target_phys_addr_t addr;
64d56409 536 SCSIDevice *dev;
7d8406be 537
b96a0da0
GH		 538 assert(s->current);
539 if (!s->current->dma_len) {
a917d384
PB		 540 /* Wait until data is available. */
541 DPRINTF("DMA no data available\n");
542 return;
7d8406be
PB		 543 }
544
f48a7a6e
PB		 545 dev = s->current->req->dev;
546 assert(dev);
64d56409 547
a917d384 548 count = s->dbc;
b96a0da0
GH		 549 if (count > s->current->dma_len)
550 count = s->current->dma_len;
a917d384
PB		 551
552 addr = s->dnad;
dd8edf01
AL		 553 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
554 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
b25cf589 555 addr |= ((uint64_t)s->dnad64 << 32);
dd8edf01
AL		 556 else if (s->dbms)
557 addr |= ((uint64_t)s->dbms << 32);
b25cf589
AL		 558 else if (s->sbms)
559 addr |= ((uint64_t)s->sbms << 32);
560
3adae656 561 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
7d8406be 562 s->csbc += count;
a917d384
PB		 563 s->dnad += count;
564 s->dbc -= count;
5c6c0e51 565 if (s->current->dma_buf == NULL) {
0c34459b 566 s->current->dma_buf = scsi_req_get_buf(s->current->req);
a917d384 567 }
7d8406be 568 /* ??? Set SFBR to first data byte. */
a917d384 569 if (out) {
b96a0da0 570 cpu_physical_memory_read(addr, s->current->dma_buf, count);
a917d384 571 } else {
b96a0da0 572 cpu_physical_memory_write(addr, s->current->dma_buf, count);
a917d384 573 }
b96a0da0
GH		 574 s->current->dma_len -= count;
575 if (s->current->dma_len == 0) {
576 s->current->dma_buf = NULL;
ad3376cc 577 scsi_req_continue(s->current->req);
a917d384 578 } else {
b96a0da0 579 s->current->dma_buf += count;
a917d384
PB		 580 lsi_resume_script(s);
581 }
582}
583
584
585/* Add a command to the queue. */
586static void lsi_queue_command(LSIState *s)
587{
af12ac98 588 lsi_request *p = s->current;
a917d384 589
aa2b1e89 590 DPRINTF("Queueing tag=0x%x\n", p->tag);
af12ac98 591 assert(s->current != NULL);
b96a0da0 592 assert(s->current->dma_len == 0);
af12ac98
GH		 593 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
594 s->current = NULL;
595
a917d384
PB		 596 p->pending = 0;
597 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
598}
599
600/* Queue a byte for a MSG IN phase. */
601static void lsi_add_msg_byte(LSIState *s, uint8_t data)
602{
603 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
604 BADF("MSG IN data too long\n");
4d611c9a 605 } else {
a917d384
PB		 606 DPRINTF("MSG IN 0x%02x\n", data);
607 s->msg[s->msg_len++] = data;
7d8406be 608 }
a917d384
PB		 609}
610
611/* Perform reselection to continue a command. */
aa4d32c4 612static void lsi_reselect(LSIState *s, lsi_request *p)
a917d384 613{
a917d384
PB		 614 int id;
615
af12ac98
GH		 616 assert(s->current == NULL);
617 QTAILQ_REMOVE(&s->queue, p, next);
618 s->current = p;
619
aa4d32c4 620 id = (p->tag >> 8) & 0xf;
a917d384 621 s->ssid = id | 0x80;
cc9f28bc 622 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
f6dc18df 623 if (!(s->dcntl & LSI_DCNTL_COM)) {
cc9f28bc
LA		 624 s->sfbr = 1 << (id & 0x7);
625 }
a917d384 626 DPRINTF("Reselected target %d\n", id);
a917d384
PB		 627 s->scntl1 |= LSI_SCNTL1_CON;
628 lsi_set_phase(s, PHASE_MI);
629 s->msg_action = p->out ? 2 : 3;
b96a0da0 630 s->current->dma_len = p->pending;
a917d384 631 lsi_add_msg_byte(s, 0x80);
af12ac98 632 if (s->current->tag & LSI_TAG_VALID) {
a917d384 633 lsi_add_msg_byte(s, 0x20);
aa4d32c4 634 lsi_add_msg_byte(s, p->tag & 0xff);
a917d384
PB		 635 }
636
e560125e
LA		 637 if (lsi_irq_on_rsl(s)) {
638 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
639 }
a917d384
PB		 640}
641
11257187 642static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
a917d384 643{
042ec49d
GH		 644 lsi_request *p;
645
646 QTAILQ_FOREACH(p, &s->queue, next) {
a917d384 647 if (p->tag == tag) {
11257187 648 return p;
a917d384
PB		 649 }
650 }
11257187
PB		 651
652 return NULL;
653}
654
94d3f98a
PB		 655static void lsi_request_cancelled(SCSIRequest *req)
656{
657 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
c5bf71a9 658 lsi_request *p = req->hba_private;
94d3f98a
PB		 659
660 if (s->current && req == s->current->req) {
661 scsi_req_unref(req);
7267c094 662 g_free(s->current);
94d3f98a
PB		 663 s->current = NULL;
664 return;
665 }
666
94d3f98a
PB		 667 if (p) {
668 QTAILQ_REMOVE(&s->queue, p, next);
669 scsi_req_unref(req);
7267c094 670 g_free(p);
94d3f98a
PB		 671 }
672}
673
11257187
PB		 674/* Record that data is available for a queued command. Returns zero if
675 the device was reselected, nonzero if the IO is deferred. */
c5bf71a9 676static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
11257187 677{
c5bf71a9 678 lsi_request *p = req->hba_private;
11257187
PB		 679
680 if (p->pending) {
c5bf71a9 681 BADF("Multiple IO pending for request %p\n", p);
11257187 682 }
aba1f023 683 p->pending = len;
11257187
PB		 684 /* Reselect if waiting for it, or if reselection triggers an IRQ
685 and the bus is free.
686 Since no interrupt stacking is implemented in the emulation, it
687 is also required that there are no pending interrupts waiting
688 for service from the device driver. */
689 if (s->waiting == 1 ||
690 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
691 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
692 /* Reselect device. */
693 lsi_reselect(s, p);
694 return 0;
695 } else {
4789bc39 696 DPRINTF("Queueing IO tag=0x%x\n", p->tag);
aba1f023 697 p->pending = len;
11257187
PB		 698 return 1;
699 }
7d8406be 700}
c6df7102
PB		 701
702 /* Callback to indicate that the SCSI layer has completed a command. */
aba1f023 703static void lsi_command_complete(SCSIRequest *req, uint32_t status)
4d611c9a 704{
5c6c0e51 705 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
4d611c9a
PB		 706 int out;
707
a917d384 708 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
aba1f023
PB		 709 DPRINTF("Command complete status=%d\n", (int)status);
710 s->status = status;
c6df7102
PB		 711 s->command_complete = 2;
712 if (s->waiting && s->dbc != 0) {
713 /* Raise phase mismatch for short transfers. */
714 lsi_bad_phase(s, out, PHASE_ST);
715 } else {
716 lsi_set_phase(s, PHASE_ST);
717 }
af12ac98 718
c6df7102
PB		 719 if (s->current && req == s->current->req) {
720 scsi_req_unref(s->current->req);
7267c094 721 g_free(s->current);
c6df7102 722 s->current = NULL;
4d611c9a 723 }
c6df7102
PB		 724 lsi_resume_script(s);
725}
726
727 /* Callback to indicate that the SCSI layer has completed a transfer. */
aba1f023 728static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
c6df7102
PB		 729{
730 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
731 int out;
4d611c9a 732
c5bf71a9 733 if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
e560125e 734 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
c5bf71a9 735 if (lsi_queue_req(s, req, len)) {
a917d384 736 return;
5c6c0e51 737 }
a917d384 738 }
e560125e 739
c6df7102
PB		 740 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
741
e560125e 742 /* host adapter (re)connected */
aba1f023
PB		 743 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
744 s->current->dma_len = len;
8ccc2ace 745 s->command_complete = 1;
c6df7102
PB		 746 if (s->waiting) {
747 if (s->waiting == 1 || s->dbc == 0) {
748 lsi_resume_script(s);
749 } else {
750 lsi_do_dma(s, out);
751 }
4d611c9a
PB		 752 }
753}
7d8406be
PB		 754
755static void lsi_do_command(LSIState *s)
756{
64d56409 757 SCSIDevice *dev;
7d8406be 758 uint8_t buf[16];
64d56409 759 uint32_t id;
7d8406be
PB		 760 int n;
761
762 DPRINTF("Send command len=%d\n", s->dbc);
763 if (s->dbc > 16)
764 s->dbc = 16;
765 cpu_physical_memory_read(s->dnad, buf, s->dbc);
766 s->sfbr = buf[0];
8ccc2ace 767 s->command_complete = 0;
af12ac98 768
259d5577 769 id = (s->select_tag >> 8) & 0xf;
0d3545e7 770 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
64d56409
JK		 771 if (!dev) {
772 lsi_bad_selection(s, id);
773 return;
774 }
775
af12ac98 776 assert(s->current == NULL);
7267c094 777 s->current = g_malloc0(sizeof(lsi_request));
af12ac98 778 s->current->tag = s->select_tag;
c39ce112 779 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
c5bf71a9 780 s->current);
af12ac98 781
c39ce112 782 n = scsi_req_enqueue(s->current->req);
ad3376cc
PB		 783 if (n) {
784 if (n > 0) {
785 lsi_set_phase(s, PHASE_DI);
786 } else if (n < 0) {
787 lsi_set_phase(s, PHASE_DO);
788 }
789 scsi_req_continue(s->current->req);
a917d384 790 }
8ccc2ace
TS		 791 if (!s->command_complete) {
792 if (n) {
793 /* Command did not complete immediately so disconnect. */
794 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
795 lsi_add_msg_byte(s, 4); /* DISCONNECT */
796 /* wait data */
797 lsi_set_phase(s, PHASE_MI);
798 s->msg_action = 1;
799 lsi_queue_command(s);
800 } else {
801 /* wait command complete */
802 lsi_set_phase(s, PHASE_DI);
803 }
7d8406be
PB		 804 }
805}
806
7d8406be
PB		 807static void lsi_do_status(LSIState *s)
808{
2f172849
HR		 809 uint8_t status;
810 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
7d8406be
PB		 811 if (s->dbc != 1)
812 BADF("Bad Status move\n");
813 s->dbc = 1;
2f172849
HR		 814 status = s->status;
815 s->sfbr = status;
816 cpu_physical_memory_write(s->dnad, &status, 1);
7d8406be 817 lsi_set_phase(s, PHASE_MI);
a917d384
PB		 818 s->msg_action = 1;
819 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
7d8406be
PB		 820}
821
7d8406be
PB		 822static void lsi_do_msgin(LSIState *s)
823{
a917d384
PB		 824 int len;
825 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
826 s->sfbr = s->msg[0];
827 len = s->msg_len;
828 if (len > s->dbc)
829 len = s->dbc;
830 cpu_physical_memory_write(s->dnad, s->msg, len);
831 /* Linux drivers rely on the last byte being in the SIDL. */
832 s->sidl = s->msg[len - 1];
833 s->msg_len -= len;
834 if (s->msg_len) {
835 memmove(s->msg, s->msg + len, s->msg_len);
7d8406be
PB		 836 } else {
837 /* ??? Check if ATN (not yet implemented) is asserted and maybe
838 switch to PHASE_MO. */
a917d384
PB		 839 switch (s->msg_action) {
840 case 0:
841 lsi_set_phase(s, PHASE_CMD);
842 break;
843 case 1:
844 lsi_disconnect(s);
845 break;
846 case 2:
847 lsi_set_phase(s, PHASE_DO);
848 break;
849 case 3:
850 lsi_set_phase(s, PHASE_DI);
851 break;
852 default:
853 abort();
854 }
7d8406be
PB		 855 }
856}
857
a917d384
PB		 858/* Read the next byte during a MSGOUT phase. */
859static uint8_t lsi_get_msgbyte(LSIState *s)
860{
861 uint8_t data;
862 cpu_physical_memory_read(s->dnad, &data, 1);
863 s->dnad++;
864 s->dbc--;
865 return data;
866}
867
444dd39b
SH		 868/* Skip the next n bytes during a MSGOUT phase. */
869static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
870{
871 s->dnad += n;
872 s->dbc -= n;
873}
874
7d8406be
PB		 875static void lsi_do_msgout(LSIState *s)
876{
877 uint8_t msg;
a917d384 878 int len;
508240c0 879 uint32_t current_tag;
5c6c0e51 880 lsi_request *current_req, *p, *p_next;
508240c0
BK		 881
882 if (s->current) {
883 current_tag = s->current->tag;
5c6c0e51 884 current_req = s->current;
508240c0
BK		 885 } else {
886 current_tag = s->select_tag;
5c6c0e51 887 current_req = lsi_find_by_tag(s, current_tag);
508240c0 888 }
7d8406be
PB		 889
890 DPRINTF("MSG out len=%d\n", s->dbc);
a917d384
PB		 891 while (s->dbc) {
892 msg = lsi_get_msgbyte(s);
893 s->sfbr = msg;
894
895 switch (msg) {
77203ea0 896 case 0x04:
a917d384
PB		 897 DPRINTF("MSG: Disconnect\n");
898 lsi_disconnect(s);
899 break;
900 case 0x08:
901 DPRINTF("MSG: No Operation\n");
902 lsi_set_phase(s, PHASE_CMD);
903 break;
904 case 0x01:
905 len = lsi_get_msgbyte(s);
906 msg = lsi_get_msgbyte(s);
f3f5b867 907 (void)len; /* avoid a warning about unused variable*/
a917d384
PB		 908 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
909 switch (msg) {
910 case 1:
911 DPRINTF("SDTR (ignored)\n");
444dd39b 912 lsi_skip_msgbytes(s, 2);
a917d384
PB		 913 break;
914 case 3:
915 DPRINTF("WDTR (ignored)\n");
444dd39b 916 lsi_skip_msgbytes(s, 1);
a917d384
PB		 917 break;
918 default:
919 goto bad;
920 }
921 break;
922 case 0x20: /* SIMPLE queue */
af12ac98 923 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
aa2b1e89 924 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
a917d384
PB		 925 break;
926 case 0x21: /* HEAD of queue */
927 BADF("HEAD queue not implemented\n");
af12ac98 928 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384
PB		 929 break;
930 case 0x22: /* ORDERED queue */
931 BADF("ORDERED queue not implemented\n");
af12ac98 932 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384 933 break;
508240c0
BK		 934 case 0x0d:
935 /* The ABORT TAG message clears the current I/O process only. */
936 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
5c6c0e51 937 if (current_req) {
94d3f98a 938 scsi_req_cancel(current_req->req);
5c6c0e51 939 }
508240c0
BK		 940 lsi_disconnect(s);
941 break;
942 case 0x06:
943 case 0x0e:
944 case 0x0c:
945 /* The ABORT message clears all I/O processes for the selecting
946 initiator on the specified logical unit of the target. */
947 if (msg == 0x06) {
948 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
949 }
950 /* The CLEAR QUEUE message clears all I/O processes for all
951 initiators on the specified logical unit of the target. */
952 if (msg == 0x0e) {
953 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
954 }
955 /* The BUS DEVICE RESET message clears all I/O processes for all
956 initiators on all logical units of the target. */
957 if (msg == 0x0c) {
958 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
959 }
960
961 /* clear the current I/O process */
5c6c0e51 962 if (s->current) {
94d3f98a 963 scsi_req_cancel(s->current->req);
5c6c0e51 964 }
508240c0
BK		 965
966 /* As the current implemented devices scsi_disk and scsi_generic
967 only support one LUN, we don't need to keep track of LUNs.
968 Clearing I/O processes for other initiators could be possible
969 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
970 device, but this is currently not implemented (and seems not
971 to be really necessary). So let's simply clear all queued
972 commands for the current device: */
508240c0 973 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
a6c6f44a 974 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
94d3f98a 975 scsi_req_cancel(p->req);
508240c0
BK		 976 }
977 }
978
979 lsi_disconnect(s);
980 break;
a917d384
PB		 981 default:
982 if ((msg & 0x80) == 0) {
983 goto bad;
984 }
985 s->current_lun = msg & 7;
986 DPRINTF("Select LUN %d\n", s->current_lun);
987 lsi_set_phase(s, PHASE_CMD);
988 break;
989 }
7d8406be 990 }
a917d384
PB		 991 return;
992bad:
993 BADF("Unimplemented message 0x%02x\n", msg);
994 lsi_set_phase(s, PHASE_MI);
995 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
996 s->msg_action = 0;
7d8406be
PB		 997}
998
999/* Sign extend a 24-bit value. */
1000static inline int32_t sxt24(int32_t n)
1001{
1002 return (n << 8) >> 8;
1003}
1004
e20a8dff 1005#define LSI_BUF_SIZE 4096
7d8406be
PB		 1006static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1007{
1008 int n;
e20a8dff 1009 uint8_t buf[LSI_BUF_SIZE];
7d8406be
PB		 1010
1011 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1012 while (count) {
e20a8dff 1013 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
7d8406be
PB		 1014 cpu_physical_memory_read(src, buf, n);
1015 cpu_physical_memory_write(dest, buf, n);
1016 src += n;
1017 dest += n;
1018 count -= n;
1019 }
1020}
1021
a917d384
PB		 1022static void lsi_wait_reselect(LSIState *s)
1023{
042ec49d
GH		 1024 lsi_request *p;
1025
a917d384 1026 DPRINTF("Wait Reselect\n");
042ec49d
GH		 1027
1028 QTAILQ_FOREACH(p, &s->queue, next) {
1029 if (p->pending) {
aa4d32c4 1030 lsi_reselect(s, p);
a917d384
PB		 1031 break;
1032 }
1033 }
b96a0da0 1034 if (s->current == NULL) {
a917d384
PB		 1035 s->waiting = 1;
1036 }
1037}
1038
7d8406be
PB		 1039static void lsi_execute_script(LSIState *s)
1040{
1041 uint32_t insn;
b25cf589 1042 uint32_t addr, addr_high;
7d8406be 1043 int opcode;
ee4d919f 1044 int insn_processed = 0;
7d8406be
PB		 1045
1046 s->istat1 |= LSI_ISTAT1_SRUN;
1047again:
ee4d919f 1048 insn_processed++;
7d8406be 1049 insn = read_dword(s, s->dsp);
02b373ad
AZ		 1050 if (!insn) {
1051 /* If we receive an empty opcode increment the DSP by 4 bytes
1052 instead of 8 and execute the next opcode at that location */
1053 s->dsp += 4;
1054 goto again;
1055 }
7d8406be 1056 addr = read_dword(s, s->dsp + 4);
b25cf589 1057 addr_high = 0;
7d8406be
PB		 1058 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1059 s->dsps = addr;
1060 s->dcmd = insn >> 24;
1061 s->dsp += 8;
1062 switch (insn >> 30) {
1063 case 0: /* Block move. */
1064 if (s->sist1 & LSI_SIST1_STO) {
1065 DPRINTF("Delayed select timeout\n");
1066 lsi_stop_script(s);
1067 break;
1068 }
1069 s->dbc = insn & 0xffffff;
1070 s->rbc = s->dbc;
dd8edf01
AL		 1071 /* ??? Set ESA. */
1072 s->ia = s->dsp - 8;
7d8406be
PB		 1073 if (insn & (1 << 29)) {
1074 /* Indirect addressing. */
1075 addr = read_dword(s, addr);
1076 } else if (insn & (1 << 28)) {
1077 uint32_t buf[2];
1078 int32_t offset;
1079 /* Table indirect addressing. */
dd8edf01
AL		 1080
1081 /* 32-bit Table indirect */
7d8406be
PB		 1082 offset = sxt24(addr);
1083 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
b25cf589
AL		 1084 /* byte count is stored in bits 0:23 only */
1085 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
7faa239c 1086 s->rbc = s->dbc;
7d8406be 1087 addr = cpu_to_le32(buf[1]);
b25cf589
AL		 1088
1089 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1090 * table, bits [31:24] */
1091 if (lsi_dma_40bit(s))
1092 addr_high = cpu_to_le32(buf[0]) >> 24;
dd8edf01
AL		 1093 else if (lsi_dma_ti64bit(s)) {
1094 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1095 switch (selector) {
1096 case 0 ... 0x0f:
1097 /* offset index into scratch registers since
1098 * TI64 mode can use registers C to R */
1099 addr_high = s->scratch[2 + selector];
1100 break;
1101 case 0x10:
1102 addr_high = s->mmrs;
1103 break;
1104 case 0x11:
1105 addr_high = s->mmws;
1106 break;
1107 case 0x12:
1108 addr_high = s->sfs;
1109 break;
1110 case 0x13:
1111 addr_high = s->drs;
1112 break;
1113 case 0x14:
1114 addr_high = s->sbms;
1115 break;
1116 case 0x15:
1117 addr_high = s->dbms;
1118 break;
1119 default:
1120 BADF("Illegal selector specified (0x%x > 0x15)"
1121 " for 64-bit DMA block move", selector);
1122 break;
1123 }
1124 }
1125 } else if (lsi_dma_64bit(s)) {
1126 /* fetch a 3rd dword if 64-bit direct move is enabled and
1127 only if we're not doing table indirect or indirect addressing */
1128 s->dbms = read_dword(s, s->dsp);
1129 s->dsp += 4;
1130 s->ia = s->dsp - 12;
7d8406be
PB		 1131 }
1132 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1133 DPRINTF("Wrong phase got %d expected %d\n",
1134 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1135 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1136 break;
1137 }
1138 s->dnad = addr;
b25cf589 1139 s->dnad64 = addr_high;
7d8406be
PB		 1140 switch (s->sstat1 & 0x7) {
1141 case PHASE_DO:
a917d384 1142 s->waiting = 2;
7d8406be 1143 lsi_do_dma(s, 1);
a917d384
PB		 1144 if (s->waiting)
1145 s->waiting = 3;
7d8406be
PB		 1146 break;
1147 case PHASE_DI:
a917d384 1148 s->waiting = 2;
7d8406be 1149 lsi_do_dma(s, 0);
a917d384
PB		 1150 if (s->waiting)
1151 s->waiting = 3;
7d8406be
PB		 1152 break;
1153 case PHASE_CMD:
1154 lsi_do_command(s);
1155 break;
1156 case PHASE_ST:
1157 lsi_do_status(s);
1158 break;
1159 case PHASE_MO:
1160 lsi_do_msgout(s);
1161 break;
1162 case PHASE_MI:
1163 lsi_do_msgin(s);
1164 break;
1165 default:
1166 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1167 exit(1);
1168 }
1169 s->dfifo = s->dbc & 0xff;
1170 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1171 s->sbc = s->dbc;
1172 s->rbc -= s->dbc;
1173 s->ua = addr + s->dbc;
7d8406be
PB		 1174 break;
1175
1176 case 1: /* IO or Read/Write instruction. */
1177 opcode = (insn >> 27) & 7;
1178 if (opcode < 5) {
1179 uint32_t id;
1180
1181 if (insn & (1 << 25)) {
1182 id = read_dword(s, s->dsa + sxt24(insn));
1183 } else {
07a1bea8 1184 id = insn;
7d8406be
PB		 1185 }
1186 id = (id >> 16) & 0xf;
1187 if (insn & (1 << 26)) {
1188 addr = s->dsp + sxt24(addr);
1189 }
1190 s->dnad = addr;
1191 switch (opcode) {
1192 case 0: /* Select */
a917d384 1193 s->sdid = id;
38f5b2b8
LA		 1194 if (s->scntl1 & LSI_SCNTL1_CON) {
1195 DPRINTF("Already reselected, jumping to alternative address\n");
1196 s->dsp = s->dnad;
a917d384
PB		 1197 break;
1198 }
7d8406be
PB		 1199 s->sstat0 |= LSI_SSTAT0_WOA;
1200 s->scntl1 &= ~LSI_SCNTL1_IARB;
0d3545e7 1201 if (!scsi_device_find(&s->bus, 0, id, 0)) {
64d56409 1202 lsi_bad_selection(s, id);
7d8406be
PB		 1203 break;
1204 }
1205 DPRINTF("Selected target %d%s\n",
1206 id, insn & (1 << 3) ? " ATN" : "");
1207 /* ??? Linux drivers compain when this is set. Maybe
1208 it only applies in low-level mode (unimplemented).
1209 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
af12ac98 1210 s->select_tag = id << 8;
7d8406be
PB		 1211 s->scntl1 |= LSI_SCNTL1_CON;
1212 if (insn & (1 << 3)) {
1213 s->socl |= LSI_SOCL_ATN;
1214 }
1215 lsi_set_phase(s, PHASE_MO);
1216 break;
1217 case 1: /* Disconnect */
a15fdf86 1218 DPRINTF("Wait Disconnect\n");
7d8406be
PB		 1219 s->scntl1 &= ~LSI_SCNTL1_CON;
1220 break;
1221 case 2: /* Wait Reselect */
e560125e
LA		 1222 if (!lsi_irq_on_rsl(s)) {
1223 lsi_wait_reselect(s);
1224 }
7d8406be
PB		 1225 break;
1226 case 3: /* Set */
1227 DPRINTF("Set%s%s%s%s\n",
1228 insn & (1 << 3) ? " ATN" : "",
1229 insn & (1 << 6) ? " ACK" : "",
1230 insn & (1 << 9) ? " TM" : "",
1231 insn & (1 << 10) ? " CC" : "");
1232 if (insn & (1 << 3)) {
1233 s->socl |= LSI_SOCL_ATN;
1234 lsi_set_phase(s, PHASE_MO);
1235 }
1236 if (insn & (1 << 9)) {
1237 BADF("Target mode not implemented\n");
1238 exit(1);
1239 }
1240 if (insn & (1 << 10))
1241 s->carry = 1;
1242 break;
1243 case 4: /* Clear */
1244 DPRINTF("Clear%s%s%s%s\n",
1245 insn & (1 << 3) ? " ATN" : "",
1246 insn & (1 << 6) ? " ACK" : "",
1247 insn & (1 << 9) ? " TM" : "",
1248 insn & (1 << 10) ? " CC" : "");
1249 if (insn & (1 << 3)) {
1250 s->socl &= ~LSI_SOCL_ATN;
1251 }
1252 if (insn & (1 << 10))
1253 s->carry = 0;
1254 break;
1255 }
1256 } else {
1257 uint8_t op0;
1258 uint8_t op1;
1259 uint8_t data8;
1260 int reg;
1261 int operator;
1262#ifdef DEBUG_LSI
1263 static const char *opcode_names[3] =
1264 {"Write", "Read", "Read-Modify-Write"};
1265 static const char *operator_names[8] =
1266 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1267#endif
1268
1269 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1270 data8 = (insn >> 8) & 0xff;
1271 opcode = (insn >> 27) & 7;
1272 operator = (insn >> 24) & 7;
a917d384 1273 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
7d8406be 1274 opcode_names[opcode - 5], reg,
a917d384 1275 operator_names[operator], data8, s->sfbr,
7d8406be
PB		 1276 (insn & (1 << 23)) ? " SFBR" : "");
1277 op0 = op1 = 0;
1278 switch (opcode) {
1279 case 5: /* From SFBR */
1280 op0 = s->sfbr;
1281 op1 = data8;
1282 break;
1283 case 6: /* To SFBR */
1284 if (operator)
1285 op0 = lsi_reg_readb(s, reg);
1286 op1 = data8;
1287 break;
1288 case 7: /* Read-modify-write */
1289 if (operator)
1290 op0 = lsi_reg_readb(s, reg);
1291 if (insn & (1 << 23)) {
1292 op1 = s->sfbr;
1293 } else {
1294 op1 = data8;
1295 }
1296 break;
1297 }
1298
1299 switch (operator) {
1300 case 0: /* move */
1301 op0 = op1;
1302 break;
1303 case 1: /* Shift left */
1304 op1 = op0 >> 7;
1305 op0 = (op0 << 1) | s->carry;
1306 s->carry = op1;
1307 break;
1308 case 2: /* OR */
1309 op0 |= op1;
1310 break;
1311 case 3: /* XOR */
dcfb9014 1312 op0 ^= op1;
7d8406be
PB		 1313 break;
1314 case 4: /* AND */
1315 op0 &= op1;
1316 break;
1317 case 5: /* SHR */
1318 op1 = op0 & 1;
1319 op0 = (op0 >> 1) | (s->carry << 7);
687fa640 1320 s->carry = op1;
7d8406be
PB		 1321 break;
1322 case 6: /* ADD */
1323 op0 += op1;
1324 s->carry = op0 < op1;
1325 break;
1326 case 7: /* ADC */
1327 op0 += op1 + s->carry;
1328 if (s->carry)
1329 s->carry = op0 <= op1;
1330 else
1331 s->carry = op0 < op1;
1332 break;
1333 }
1334
1335 switch (opcode) {
1336 case 5: /* From SFBR */
1337 case 7: /* Read-modify-write */
1338 lsi_reg_writeb(s, reg, op0);
1339 break;
1340 case 6: /* To SFBR */
1341 s->sfbr = op0;
1342 break;
1343 }
1344 }
1345 break;
1346
1347 case 2: /* Transfer Control. */
1348 {
1349 int cond;
1350 int jmp;
1351
1352 if ((insn & 0x002e0000) == 0) {
1353 DPRINTF("NOP\n");
1354 break;
1355 }
1356 if (s->sist1 & LSI_SIST1_STO) {
1357 DPRINTF("Delayed select timeout\n");
1358 lsi_stop_script(s);
1359 break;
1360 }
1361 cond = jmp = (insn & (1 << 19)) != 0;
1362 if (cond == jmp && (insn & (1 << 21))) {
1363 DPRINTF("Compare carry %d\n", s->carry == jmp);
1364 cond = s->carry != 0;
1365 }
1366 if (cond == jmp && (insn & (1 << 17))) {
1367 DPRINTF("Compare phase %d %c= %d\n",
1368 (s->sstat1 & PHASE_MASK),
1369 jmp ? '=' : '!',
1370 ((insn >> 24) & 7));
1371 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1372 }
1373 if (cond == jmp && (insn & (1 << 18))) {
1374 uint8_t mask;
1375
1376 mask = (~insn >> 8) & 0xff;
1377 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1378 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1379 cond = (s->sfbr & mask) == (insn & mask);
1380 }
1381 if (cond == jmp) {
1382 if (insn & (1 << 23)) {
1383 /* Relative address. */
1384 addr = s->dsp + sxt24(addr);
1385 }
1386 switch ((insn >> 27) & 7) {
1387 case 0: /* Jump */
1388 DPRINTF("Jump to 0x%08x\n", addr);
1389 s->dsp = addr;
1390 break;
1391 case 1: /* Call */
1392 DPRINTF("Call 0x%08x\n", addr);
1393 s->temp = s->dsp;
1394 s->dsp = addr;
1395 break;
1396 case 2: /* Return */
1397 DPRINTF("Return to 0x%08x\n", s->temp);
1398 s->dsp = s->temp;
1399 break;
1400 case 3: /* Interrupt */
1401 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1402 if ((insn & (1 << 20)) != 0) {
1403 s->istat0 |= LSI_ISTAT0_INTF;
1404 lsi_update_irq(s);
1405 } else {
1406 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1407 }
1408 break;
1409 default:
1410 DPRINTF("Illegal transfer control\n");
1411 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1412 break;
1413 }
1414 } else {
1415 DPRINTF("Control condition failed\n");
1416 }
1417 }
1418 break;
1419
1420 case 3:
1421 if ((insn & (1 << 29)) == 0) {
1422 /* Memory move. */
1423 uint32_t dest;
1424 /* ??? The docs imply the destination address is loaded into
1425 the TEMP register. However the Linux drivers rely on
1426 the value being presrved. */
1427 dest = read_dword(s, s->dsp);
1428 s->dsp += 4;
1429 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1430 } else {
1431 uint8_t data[7];
1432 int reg;
1433 int n;
1434 int i;
1435
1436 if (insn & (1 << 28)) {
1437 addr = s->dsa + sxt24(addr);
1438 }
1439 n = (insn & 7);
1440 reg = (insn >> 16) & 0xff;
1441 if (insn & (1 << 24)) {
7d8406be 1442 cpu_physical_memory_read(addr, data, n);
a917d384
PB		 1443 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1444 addr, *(int *)data);
7d8406be
PB		 1445 for (i = 0; i < n; i++) {
1446 lsi_reg_writeb(s, reg + i, data[i]);
1447 }
1448 } else {
1449 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1450 for (i = 0; i < n; i++) {
1451 data[i] = lsi_reg_readb(s, reg + i);
1452 }
1453 cpu_physical_memory_write(addr, data, n);
1454 }
1455 }
1456 }
ee4d919f 1457 if (insn_processed > 10000 && !s->waiting) {
64c68080
PB		 1458 /* Some windows drivers make the device spin waiting for a memory
1459 location to change. If we have been executed a lot of code then
1460 assume this is the case and force an unexpected device disconnect.
1461 This is apparently sufficient to beat the drivers into submission.
1462 */
ee4d919f
AL		 1463 if (!(s->sien0 & LSI_SIST0_UDC))
1464 fprintf(stderr, "inf. loop with UDC masked\n");
1465 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1466 lsi_disconnect(s);
1467 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
7d8406be
PB		 1468 if (s->dcntl & LSI_DCNTL_SSM) {
1469 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1470 } else {
1471 goto again;
1472 }
1473 }
1474 DPRINTF("SCRIPTS execution stopped\n");
1475}
1476
1477static uint8_t lsi_reg_readb(LSIState *s, int offset)
1478{
1479 uint8_t tmp;
75f76531
AJ		 1480#define CASE_GET_REG24(name, addr) \
1481 case addr: return s->name & 0xff; \
1482 case addr + 1: return (s->name >> 8) & 0xff; \
1483 case addr + 2: return (s->name >> 16) & 0xff;
1484
7d8406be
PB		 1485#define CASE_GET_REG32(name, addr) \
1486 case addr: return s->name & 0xff; \
1487 case addr + 1: return (s->name >> 8) & 0xff; \
1488 case addr + 2: return (s->name >> 16) & 0xff; \
1489 case addr + 3: return (s->name >> 24) & 0xff;
1490
1491#ifdef DEBUG_LSI_REG
1492 DPRINTF("Read reg %x\n", offset);
1493#endif
1494 switch (offset) {
1495 case 0x00: /* SCNTL0 */
1496 return s->scntl0;
1497 case 0x01: /* SCNTL1 */
1498 return s->scntl1;
1499 case 0x02: /* SCNTL2 */
1500 return s->scntl2;
1501 case 0x03: /* SCNTL3 */
1502 return s->scntl3;
1503 case 0x04: /* SCID */
1504 return s->scid;
1505 case 0x05: /* SXFER */
1506 return s->sxfer;
1507 case 0x06: /* SDID */
1508 return s->sdid;
1509 case 0x07: /* GPREG0 */
1510 return 0x7f;
985a03b0
TS		 1511 case 0x08: /* Revision ID */
1512 return 0x00;
a917d384
PB		 1513 case 0xa: /* SSID */
1514 return s->ssid;
7d8406be
PB		 1515 case 0xb: /* SBCL */
1516 /* ??? This is not correct. However it's (hopefully) only
1517 used for diagnostics, so should be ok. */
1518 return 0;
1519 case 0xc: /* DSTAT */
1520 tmp = s->dstat | 0x80;
1521 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1522 s->dstat = 0;
1523 lsi_update_irq(s);
1524 return tmp;
1525 case 0x0d: /* SSTAT0 */
1526 return s->sstat0;
1527 case 0x0e: /* SSTAT1 */
1528 return s->sstat1;
1529 case 0x0f: /* SSTAT2 */
1530 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1531 CASE_GET_REG32(dsa, 0x10)
1532 case 0x14: /* ISTAT0 */
1533 return s->istat0;
ecabe8cc
AL		 1534 case 0x15: /* ISTAT1 */
1535 return s->istat1;
7d8406be
PB		 1536 case 0x16: /* MBOX0 */
1537 return s->mbox0;
1538 case 0x17: /* MBOX1 */
1539 return s->mbox1;
1540 case 0x18: /* CTEST0 */
1541 return 0xff;
1542 case 0x19: /* CTEST1 */
1543 return 0;
1544 case 0x1a: /* CTEST2 */
9167a69a 1545 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
7d8406be
PB		 1546 if (s->istat0 & LSI_ISTAT0_SIGP) {
1547 s->istat0 &= ~LSI_ISTAT0_SIGP;
1548 tmp |= LSI_CTEST2_SIGP;
1549 }
1550 return tmp;
1551 case 0x1b: /* CTEST3 */
1552 return s->ctest3;
1553 CASE_GET_REG32(temp, 0x1c)
1554 case 0x20: /* DFIFO */
1555 return 0;
1556 case 0x21: /* CTEST4 */
1557 return s->ctest4;
1558 case 0x22: /* CTEST5 */
1559 return s->ctest5;
985a03b0
TS		 1560 case 0x23: /* CTEST6 */
1561 return 0;
75f76531 1562 CASE_GET_REG24(dbc, 0x24)
7d8406be
PB		 1563 case 0x27: /* DCMD */
1564 return s->dcmd;
4b9a2d6d 1565 CASE_GET_REG32(dnad, 0x28)
7d8406be
PB		 1566 CASE_GET_REG32(dsp, 0x2c)
1567 CASE_GET_REG32(dsps, 0x30)
1568 CASE_GET_REG32(scratch[0], 0x34)
1569 case 0x38: /* DMODE */
1570 return s->dmode;
1571 case 0x39: /* DIEN */
1572 return s->dien;
bd8ee11a
SH		 1573 case 0x3a: /* SBR */
1574 return s->sbr;
7d8406be
PB		 1575 case 0x3b: /* DCNTL */
1576 return s->dcntl;
1577 case 0x40: /* SIEN0 */
1578 return s->sien0;
1579 case 0x41: /* SIEN1 */
1580 return s->sien1;
1581 case 0x42: /* SIST0 */
1582 tmp = s->sist0;
1583 s->sist0 = 0;
1584 lsi_update_irq(s);
1585 return tmp;
1586 case 0x43: /* SIST1 */
1587 tmp = s->sist1;
1588 s->sist1 = 0;
1589 lsi_update_irq(s);
1590 return tmp;
9167a69a
AZ		 1591 case 0x46: /* MACNTL */
1592 return 0x0f;
7d8406be
PB		 1593 case 0x47: /* GPCNTL0 */
1594 return 0x0f;
1595 case 0x48: /* STIME0 */
1596 return s->stime0;
1597 case 0x4a: /* RESPID0 */
1598 return s->respid0;
1599 case 0x4b: /* RESPID1 */
1600 return s->respid1;
1601 case 0x4d: /* STEST1 */
1602 return s->stest1;
1603 case 0x4e: /* STEST2 */
1604 return s->stest2;
1605 case 0x4f: /* STEST3 */
1606 return s->stest3;
a917d384
PB		 1607 case 0x50: /* SIDL */
1608 /* This is needed by the linux drivers. We currently only update it
1609 during the MSG IN phase. */
1610 return s->sidl;
7d8406be
PB		 1611 case 0x52: /* STEST4 */
1612 return 0xe0;
1613 case 0x56: /* CCNTL0 */
1614 return s->ccntl0;
1615 case 0x57: /* CCNTL1 */
1616 return s->ccntl1;
a917d384
PB		 1617 case 0x58: /* SBDL */
1618 /* Some drivers peek at the data bus during the MSG IN phase. */
1619 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1620 return s->msg[0];
1621 return 0;
1622 case 0x59: /* SBDL high */
7d8406be
PB		 1623 return 0;
1624 CASE_GET_REG32(mmrs, 0xa0)
1625 CASE_GET_REG32(mmws, 0xa4)
1626 CASE_GET_REG32(sfs, 0xa8)
1627 CASE_GET_REG32(drs, 0xac)
1628 CASE_GET_REG32(sbms, 0xb0)
ab57d967 1629 CASE_GET_REG32(dbms, 0xb4)
7d8406be
PB		 1630 CASE_GET_REG32(dnad64, 0xb8)
1631 CASE_GET_REG32(pmjad1, 0xc0)
1632 CASE_GET_REG32(pmjad2, 0xc4)
1633 CASE_GET_REG32(rbc, 0xc8)
1634 CASE_GET_REG32(ua, 0xcc)
1635 CASE_GET_REG32(ia, 0xd4)
1636 CASE_GET_REG32(sbc, 0xd8)
1637 CASE_GET_REG32(csbc, 0xdc)
1638 }
1639 if (offset >= 0x5c && offset < 0xa0) {
1640 int n;
1641 int shift;
1642 n = (offset - 0x58) >> 2;
1643 shift = (offset & 3) * 8;
1644 return (s->scratch[n] >> shift) & 0xff;
1645 }
1646 BADF("readb 0x%x\n", offset);
1647 exit(1);
75f76531 1648#undef CASE_GET_REG24
7d8406be
PB		 1649#undef CASE_GET_REG32
1650}
1651
1652static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1653{
49c47daa
SH		 1654#define CASE_SET_REG24(name, addr) \
1655 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1656 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1657 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1658
7d8406be
PB		 1659#define CASE_SET_REG32(name, addr) \
1660 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1661 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1662 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1663 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1664
1665#ifdef DEBUG_LSI_REG
1666 DPRINTF("Write reg %x = %02x\n", offset, val);
1667#endif
1668 switch (offset) {
1669 case 0x00: /* SCNTL0 */
1670 s->scntl0 = val;
1671 if (val & LSI_SCNTL0_START) {
1672 BADF("Start sequence not implemented\n");
1673 }
1674 break;
1675 case 0x01: /* SCNTL1 */
1676 s->scntl1 = val & ~LSI_SCNTL1_SST;
1677 if (val & LSI_SCNTL1_IARB) {
1678 BADF("Immediate Arbritration not implemented\n");
1679 }
1680 if (val & LSI_SCNTL1_RST) {
680a34ee
JK		 1681 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1682 DeviceState *dev;
680a34ee 1683
f48a7a6e
PB		 1684 QTAILQ_FOREACH(dev, &s->bus.qbus.children, sibling) {
1685 dev->info->reset(dev);
680a34ee
JK		 1686 }
1687 s->sstat0 |= LSI_SSTAT0_RST;
1688 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1689 }
7d8406be
PB		 1690 } else {
1691 s->sstat0 &= ~LSI_SSTAT0_RST;
1692 }
1693 break;
1694 case 0x02: /* SCNTL2 */
1695 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
3d834c78 1696 s->scntl2 = val;
7d8406be
PB		 1697 break;
1698 case 0x03: /* SCNTL3 */
1699 s->scntl3 = val;
1700 break;
1701 case 0x04: /* SCID */
1702 s->scid = val;
1703 break;
1704 case 0x05: /* SXFER */
1705 s->sxfer = val;
1706 break;
a917d384
PB		 1707 case 0x06: /* SDID */
1708 if ((val & 0xf) != (s->ssid & 0xf))
1709 BADF("Destination ID does not match SSID\n");
1710 s->sdid = val & 0xf;
1711 break;
7d8406be
PB		 1712 case 0x07: /* GPREG0 */
1713 break;
a917d384
PB		 1714 case 0x08: /* SFBR */
1715 /* The CPU is not allowed to write to this register. However the
1716 SCRIPTS register move instructions are. */
1717 s->sfbr = val;
1718 break;
a15fdf86 1719 case 0x0a: case 0x0b:
9167a69a 1720 /* Openserver writes to these readonly registers on startup */
a15fdf86 1721 return;
7d8406be
PB		 1722 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1723 /* Linux writes to these readonly registers on startup. */
1724 return;
1725 CASE_SET_REG32(dsa, 0x10)
1726 case 0x14: /* ISTAT0 */
1727 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1728 if (val & LSI_ISTAT0_ABRT) {
1729 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1730 }
1731 if (val & LSI_ISTAT0_INTF) {
1732 s->istat0 &= ~LSI_ISTAT0_INTF;
1733 lsi_update_irq(s);
1734 }
4d611c9a 1735 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
7d8406be
PB		 1736 DPRINTF("Woken by SIGP\n");
1737 s->waiting = 0;
1738 s->dsp = s->dnad;
1739 lsi_execute_script(s);
1740 }
1741 if (val & LSI_ISTAT0_SRST) {
1742 lsi_soft_reset(s);
1743 }
92d88ecb 1744 break;
7d8406be
PB		 1745 case 0x16: /* MBOX0 */
1746 s->mbox0 = val;
92d88ecb 1747 break;
7d8406be
PB		 1748 case 0x17: /* MBOX1 */
1749 s->mbox1 = val;
92d88ecb 1750 break;
9167a69a
AZ		 1751 case 0x1a: /* CTEST2 */
1752 s->ctest2 = val & LSI_CTEST2_PCICIE;
1753 break;
7d8406be
PB		 1754 case 0x1b: /* CTEST3 */
1755 s->ctest3 = val & 0x0f;
1756 break;
1757 CASE_SET_REG32(temp, 0x1c)
1758 case 0x21: /* CTEST4 */
1759 if (val & 7) {
1760 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1761 }
1762 s->ctest4 = val;
1763 break;
1764 case 0x22: /* CTEST5 */
1765 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1766 BADF("CTEST5 DMA increment not implemented\n");
1767 }
1768 s->ctest5 = val;
1769 break;
49c47daa 1770 CASE_SET_REG24(dbc, 0x24)
4b9a2d6d 1771 CASE_SET_REG32(dnad, 0x28)
3d834c78 1772 case 0x2c: /* DSP[0:7] */
7d8406be
PB		 1773 s->dsp &= 0xffffff00;
1774 s->dsp |= val;
1775 break;
3d834c78 1776 case 0x2d: /* DSP[8:15] */
7d8406be
PB		 1777 s->dsp &= 0xffff00ff;
1778 s->dsp |= val << 8;
1779 break;
3d834c78 1780 case 0x2e: /* DSP[16:23] */
7d8406be
PB		 1781 s->dsp &= 0xff00ffff;
1782 s->dsp |= val << 16;
1783 break;
3d834c78 1784 case 0x2f: /* DSP[24:31] */
7d8406be
PB		 1785 s->dsp &= 0x00ffffff;
1786 s->dsp |= val << 24;
1787 if ((s->dmode & LSI_DMODE_MAN) == 0
1788 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1789 lsi_execute_script(s);
1790 break;
1791 CASE_SET_REG32(dsps, 0x30)
1792 CASE_SET_REG32(scratch[0], 0x34)
1793 case 0x38: /* DMODE */
1794 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1795 BADF("IO mappings not implemented\n");
1796 }
1797 s->dmode = val;
1798 break;
1799 case 0x39: /* DIEN */
1800 s->dien = val;
1801 lsi_update_irq(s);
1802 break;
bd8ee11a
SH		 1803 case 0x3a: /* SBR */
1804 s->sbr = val;
1805 break;
7d8406be
PB		 1806 case 0x3b: /* DCNTL */
1807 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1808 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1809 lsi_execute_script(s);
1810 break;
1811 case 0x40: /* SIEN0 */
1812 s->sien0 = val;
1813 lsi_update_irq(s);
1814 break;
1815 case 0x41: /* SIEN1 */
1816 s->sien1 = val;
1817 lsi_update_irq(s);
1818 break;
1819 case 0x47: /* GPCNTL0 */
1820 break;
1821 case 0x48: /* STIME0 */
1822 s->stime0 = val;
1823 break;
1824 case 0x49: /* STIME1 */
1825 if (val & 0xf) {
1826 DPRINTF("General purpose timer not implemented\n");
1827 /* ??? Raising the interrupt immediately seems to be sufficient
1828 to keep the FreeBSD driver happy. */
1829 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1830 }
1831 break;
1832 case 0x4a: /* RESPID0 */
1833 s->respid0 = val;
1834 break;
1835 case 0x4b: /* RESPID1 */
1836 s->respid1 = val;
1837 break;
1838 case 0x4d: /* STEST1 */
1839 s->stest1 = val;
1840 break;
1841 case 0x4e: /* STEST2 */
1842 if (val & 1) {
1843 BADF("Low level mode not implemented\n");
1844 }
1845 s->stest2 = val;
1846 break;
1847 case 0x4f: /* STEST3 */
1848 if (val & 0x41) {
1849 BADF("SCSI FIFO test mode not implemented\n");
1850 }
1851 s->stest3 = val;
1852 break;
1853 case 0x56: /* CCNTL0 */
1854 s->ccntl0 = val;
1855 break;
1856 case 0x57: /* CCNTL1 */
1857 s->ccntl1 = val;
1858 break;
1859 CASE_SET_REG32(mmrs, 0xa0)
1860 CASE_SET_REG32(mmws, 0xa4)
1861 CASE_SET_REG32(sfs, 0xa8)
1862 CASE_SET_REG32(drs, 0xac)
1863 CASE_SET_REG32(sbms, 0xb0)
ab57d967 1864 CASE_SET_REG32(dbms, 0xb4)
7d8406be
PB		 1865 CASE_SET_REG32(dnad64, 0xb8)
1866 CASE_SET_REG32(pmjad1, 0xc0)
1867 CASE_SET_REG32(pmjad2, 0xc4)
1868 CASE_SET_REG32(rbc, 0xc8)
1869 CASE_SET_REG32(ua, 0xcc)
1870 CASE_SET_REG32(ia, 0xd4)
1871 CASE_SET_REG32(sbc, 0xd8)
1872 CASE_SET_REG32(csbc, 0xdc)
1873 default:
1874 if (offset >= 0x5c && offset < 0xa0) {
1875 int n;
1876 int shift;
1877 n = (offset - 0x58) >> 2;
1878 shift = (offset & 3) * 8;
1879 s->scratch[n] &= ~(0xff << shift);
1880 s->scratch[n] |= (val & 0xff) << shift;
1881 } else {
1882 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1883 }
1884 }
49c47daa 1885#undef CASE_SET_REG24
7d8406be
PB		 1886#undef CASE_SET_REG32
1887}
1888
b0ce84e5
AK		 1889static void lsi_mmio_write(void *opaque, target_phys_addr_t addr,
1890 uint64_t val, unsigned size)
7d8406be 1891{
eb40f984 1892 LSIState *s = opaque;
7d8406be
PB		 1893
1894 lsi_reg_writeb(s, addr & 0xff, val);
1895}
1896
b0ce84e5
AK		 1897static uint64_t lsi_mmio_read(void *opaque, target_phys_addr_t addr,
1898 unsigned size)
7d8406be 1899{
eb40f984 1900 LSIState *s = opaque;
7d8406be
PB		 1901
1902 return lsi_reg_readb(s, addr & 0xff);
1903}
1904
b0ce84e5
AK		 1905static const MemoryRegionOps lsi_mmio_ops = {
1906 .read = lsi_mmio_read,
1907 .write = lsi_mmio_write,
1908 .endianness = DEVICE_NATIVE_ENDIAN,
1909 .impl = {
1910 .min_access_size = 1,
1911 .max_access_size = 1,
1912 },
7d8406be
PB		 1913};
1914
b0ce84e5
AK		 1915static void lsi_ram_write(void *opaque, target_phys_addr_t addr,
1916 uint64_t val, unsigned size)
7d8406be 1917{
eb40f984 1918 LSIState *s = opaque;
7d8406be 1919 uint32_t newval;
b0ce84e5 1920 uint32_t mask;
7d8406be
PB		 1921 int shift;
1922
7d8406be
PB		 1923 newval = s->script_ram[addr >> 2];
1924 shift = (addr & 3) * 8;
b0ce84e5
AK		 1925 mask = ((uint64_t)1 << (size * 8)) - 1;
1926 newval &= ~(mask << shift);
7d8406be
PB		 1927 newval |= val << shift;
1928 s->script_ram[addr >> 2] = newval;
1929}
1930
b0ce84e5
AK		 1931static uint64_t lsi_ram_read(void *opaque, target_phys_addr_t addr,
1932 unsigned size)
7d8406be 1933{
eb40f984 1934 LSIState *s = opaque;
7d8406be 1935 uint32_t val;
b0ce84e5 1936 uint32_t mask;
7d8406be 1937
7d8406be 1938 val = s->script_ram[addr >> 2];
b0ce84e5 1939 mask = ((uint64_t)1 << (size * 8)) - 1;
7d8406be 1940 val >>= (addr & 3) * 8;
b0ce84e5 1941 return val & mask;
7d8406be
PB		 1942}
1943
b0ce84e5
AK		 1944static const MemoryRegionOps lsi_ram_ops = {
1945 .read = lsi_ram_read,
1946 .write = lsi_ram_write,
1947 .endianness = DEVICE_NATIVE_ENDIAN,
7d8406be
PB		 1948};
1949
b0ce84e5
AK		 1950static uint64_t lsi_io_read(void *opaque, target_phys_addr_t addr,
1951 unsigned size)
7d8406be 1952{
eb40f984 1953 LSIState *s = opaque;
7d8406be
PB		 1954 return lsi_reg_readb(s, addr & 0xff);
1955}
1956
b0ce84e5
AK		 1957static void lsi_io_write(void *opaque, target_phys_addr_t addr,
1958 uint64_t val, unsigned size)
7d8406be 1959{
eb40f984 1960 LSIState *s = opaque;
7d8406be
PB		 1961 lsi_reg_writeb(s, addr & 0xff, val);
1962}
1963
b0ce84e5
AK		 1964static const MemoryRegionOps lsi_io_ops = {
1965 .read = lsi_io_read,
1966 .write = lsi_io_write,
1967 .endianness = DEVICE_NATIVE_ENDIAN,
1968 .impl = {
1969 .min_access_size = 1,
1970 .max_access_size = 1,
1971 },
1972};
7d8406be 1973
54eefd72
JK		 1974static void lsi_scsi_reset(DeviceState *dev)
1975{
1976 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
1977
1978 lsi_soft_reset(s);
1979}
1980
4a1b0f1c 1981static void lsi_pre_save(void *opaque)
777aec7a
N		 1982{
1983 LSIState *s = opaque;
1984
b96a0da0
GH		 1985 if (s->current) {
1986 assert(s->current->dma_buf == NULL);
1987 assert(s->current->dma_len == 0);
1988 }
042ec49d 1989 assert(QTAILQ_EMPTY(&s->queue));
777aec7a
N		 1990}
1991
4a1b0f1c
JQ		 1992static const VMStateDescription vmstate_lsi_scsi = {
1993 .name = "lsiscsi",
1994 .version_id = 0,
1995 .minimum_version_id = 0,
1996 .minimum_version_id_old = 0,
1997 .pre_save = lsi_pre_save,
1998 .fields = (VMStateField []) {
1999 VMSTATE_PCI_DEVICE(dev, LSIState),
2000
2001 VMSTATE_INT32(carry, LSIState),
2f172849 2002 VMSTATE_INT32(status, LSIState),
4a1b0f1c
JQ		 2003 VMSTATE_INT32(msg_action, LSIState),
2004 VMSTATE_INT32(msg_len, LSIState),
2005 VMSTATE_BUFFER(msg, LSIState),
2006 VMSTATE_INT32(waiting, LSIState),
2007
2008 VMSTATE_UINT32(dsa, LSIState),
2009 VMSTATE_UINT32(temp, LSIState),
2010 VMSTATE_UINT32(dnad, LSIState),
2011 VMSTATE_UINT32(dbc, LSIState),
2012 VMSTATE_UINT8(istat0, LSIState),
2013 VMSTATE_UINT8(istat1, LSIState),
2014 VMSTATE_UINT8(dcmd, LSIState),
2015 VMSTATE_UINT8(dstat, LSIState),
2016 VMSTATE_UINT8(dien, LSIState),
2017 VMSTATE_UINT8(sist0, LSIState),
2018 VMSTATE_UINT8(sist1, LSIState),
2019 VMSTATE_UINT8(sien0, LSIState),
2020 VMSTATE_UINT8(sien1, LSIState),
2021 VMSTATE_UINT8(mbox0, LSIState),
2022 VMSTATE_UINT8(mbox1, LSIState),
2023 VMSTATE_UINT8(dfifo, LSIState),
2024 VMSTATE_UINT8(ctest2, LSIState),
2025 VMSTATE_UINT8(ctest3, LSIState),
2026 VMSTATE_UINT8(ctest4, LSIState),
2027 VMSTATE_UINT8(ctest5, LSIState),
2028 VMSTATE_UINT8(ccntl0, LSIState),
2029 VMSTATE_UINT8(ccntl1, LSIState),
2030 VMSTATE_UINT32(dsp, LSIState),
2031 VMSTATE_UINT32(dsps, LSIState),
2032 VMSTATE_UINT8(dmode, LSIState),
2033 VMSTATE_UINT8(dcntl, LSIState),
2034 VMSTATE_UINT8(scntl0, LSIState),
2035 VMSTATE_UINT8(scntl1, LSIState),
2036 VMSTATE_UINT8(scntl2, LSIState),
2037 VMSTATE_UINT8(scntl3, LSIState),
2038 VMSTATE_UINT8(sstat0, LSIState),
2039 VMSTATE_UINT8(sstat1, LSIState),
2040 VMSTATE_UINT8(scid, LSIState),
2041 VMSTATE_UINT8(sxfer, LSIState),
2042 VMSTATE_UINT8(socl, LSIState),
2043 VMSTATE_UINT8(sdid, LSIState),
2044 VMSTATE_UINT8(ssid, LSIState),
2045 VMSTATE_UINT8(sfbr, LSIState),
2046 VMSTATE_UINT8(stest1, LSIState),
2047 VMSTATE_UINT8(stest2, LSIState),
2048 VMSTATE_UINT8(stest3, LSIState),
2049 VMSTATE_UINT8(sidl, LSIState),
2050 VMSTATE_UINT8(stime0, LSIState),
2051 VMSTATE_UINT8(respid0, LSIState),
2052 VMSTATE_UINT8(respid1, LSIState),
2053 VMSTATE_UINT32(mmrs, LSIState),
2054 VMSTATE_UINT32(mmws, LSIState),
2055 VMSTATE_UINT32(sfs, LSIState),
2056 VMSTATE_UINT32(drs, LSIState),
2057 VMSTATE_UINT32(sbms, LSIState),
2058 VMSTATE_UINT32(dbms, LSIState),
2059 VMSTATE_UINT32(dnad64, LSIState),
2060 VMSTATE_UINT32(pmjad1, LSIState),
2061 VMSTATE_UINT32(pmjad2, LSIState),
2062 VMSTATE_UINT32(rbc, LSIState),
2063 VMSTATE_UINT32(ua, LSIState),
2064 VMSTATE_UINT32(ia, LSIState),
2065 VMSTATE_UINT32(sbc, LSIState),
2066 VMSTATE_UINT32(csbc, LSIState),
2067 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2068 VMSTATE_UINT8(sbr, LSIState),
2069
2070 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2071 VMSTATE_END_OF_LIST()
777aec7a 2072 }
4a1b0f1c 2073};
777aec7a 2074
4b09be85
AL		 2075static int lsi_scsi_uninit(PCIDevice *d)
2076{
f305261f 2077 LSIState *s = DO_UPCAST(LSIState, dev, d);
4b09be85 2078
b0ce84e5
AK		 2079 memory_region_destroy(&s->mmio_io);
2080 memory_region_destroy(&s->ram_io);
2081 memory_region_destroy(&s->io_io);
4b09be85 2082
4b09be85
AL		 2083 return 0;
2084}
2085
afd4030c
PB		 2086static const struct SCSIBusInfo lsi_scsi_info = {
2087 .tcq = true,
7e0380b9
PB		 2088 .max_target = LSI_MAX_DEVS,
2089 .max_lun = 0, /* LUN support is buggy */
afd4030c 2090
c6df7102 2091 .transfer_data = lsi_transfer_data,
94d3f98a
PB		 2092 .complete = lsi_command_complete,
2093 .cancel = lsi_request_cancelled
cfdc1bb0
PB		 2094};
2095
81a322d4 2096static int lsi_scsi_init(PCIDevice *dev)
7d8406be 2097{
f305261f 2098 LSIState *s = DO_UPCAST(LSIState, dev, dev);
deb54399 2099 uint8_t *pci_conf;
7d8406be 2100
f305261f 2101 pci_conf = s->dev.config;
deb54399 2102
9167a69a 2103 /* PCI latency timer = 255 */
5845f0e5 2104 pci_conf[PCI_LATENCY_TIMER] = 0xff;
817e0b6f 2105 /* Interrupt pin A */
5845f0e5 2106 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
7d8406be 2107
b0ce84e5
AK		 2108 memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
2109 memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
2110 memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
2111
e824b2cc
AK		 2112 pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2113 pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
2114 pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
042ec49d 2115 QTAILQ_INIT(&s->queue);
7d8406be 2116
afd4030c 2117 scsi_bus_new(&s->bus, &dev->qdev, &lsi_scsi_info);
5b684b5a 2118 if (!dev->qdev.hotplugged) {
fa66b909 2119 return scsi_bus_legacy_handle_cmdline(&s->bus);
5b684b5a 2120 }
81a322d4 2121 return 0;
7d8406be 2122}
9be5dafe 2123
0aab0d3a 2124static PCIDeviceInfo lsi_info = {
d52affa7
GH		 2125 .qdev.name = "lsi53c895a",
2126 .qdev.alias = "lsi",
2127 .qdev.size = sizeof(LSIState),
54eefd72 2128 .qdev.reset = lsi_scsi_reset,
be73cfe2 2129 .qdev.vmsd = &vmstate_lsi_scsi,
d52affa7 2130 .init = lsi_scsi_init,
e3936fa5 2131 .exit = lsi_scsi_uninit,
af5374aa
IY		 2132 .vendor_id = PCI_VENDOR_ID_LSI_LOGIC,
2133 .device_id = PCI_DEVICE_ID_LSI_53C895A,
2134 .class_id = PCI_CLASS_STORAGE_SCSI,
2135 .subsystem_id = 0x1000,
0aab0d3a
GH		 2136};
2137
9be5dafe
PB		 2138static void lsi53c895a_register_devices(void)
2139{
0aab0d3a 2140 pci_qdev_register(&lsi_info);
9be5dafe
PB		 2141}
2142
2143device_init(lsi53c895a_register_devices);
Qemu copy for testing