]> git.proxmox.com Git - qemu.git/blame - hw/lsi53c895a.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
list MST as pci layer maintainer
[qemu.git] / hw / lsi53c895a.c
CommitLineData
5fafdf24 1/*
7d8406be
PB		 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10/* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
a15fdf86 13#include <assert.h>
777aec7a 14
87ecb68b
PB		 15#include "hw.h"
16#include "pci.h"
43b443b6 17#include "scsi.h"
b0a7b120 18#include "block_int.h"
7d8406be
PB		 19
20//#define DEBUG_LSI
21//#define DEBUG_LSI_REG
22
23#ifdef DEBUG_LSI
001faf32
BS		 24#define DPRINTF(fmt, ...) \
25do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26#define BADF(fmt, ...) \
27do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
7d8406be 28#else
001faf32
BS		 29#define DPRINTF(fmt, ...) do {} while(0)
30#define BADF(fmt, ...) \
31do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
7d8406be
PB		 32#endif
33
18e08a55
MT		 34#define LSI_MAX_DEVS 7
35
7d8406be
PB		 36#define LSI_SCNTL0_TRG 0x01
37#define LSI_SCNTL0_AAP 0x02
38#define LSI_SCNTL0_EPC 0x08
39#define LSI_SCNTL0_WATN 0x10
40#define LSI_SCNTL0_START 0x20
41
42#define LSI_SCNTL1_SST 0x01
43#define LSI_SCNTL1_IARB 0x02
44#define LSI_SCNTL1_AESP 0x04
45#define LSI_SCNTL1_RST 0x08
46#define LSI_SCNTL1_CON 0x10
47#define LSI_SCNTL1_DHP 0x20
48#define LSI_SCNTL1_ADB 0x40
49#define LSI_SCNTL1_EXC 0x80
50
51#define LSI_SCNTL2_WSR 0x01
52#define LSI_SCNTL2_VUE0 0x02
53#define LSI_SCNTL2_VUE1 0x04
54#define LSI_SCNTL2_WSS 0x08
55#define LSI_SCNTL2_SLPHBEN 0x10
56#define LSI_SCNTL2_SLPMD 0x20
57#define LSI_SCNTL2_CHM 0x40
58#define LSI_SCNTL2_SDU 0x80
59
60#define LSI_ISTAT0_DIP 0x01
61#define LSI_ISTAT0_SIP 0x02
62#define LSI_ISTAT0_INTF 0x04
63#define LSI_ISTAT0_CON 0x08
64#define LSI_ISTAT0_SEM 0x10
65#define LSI_ISTAT0_SIGP 0x20
66#define LSI_ISTAT0_SRST 0x40
67#define LSI_ISTAT0_ABRT 0x80
68
69#define LSI_ISTAT1_SI 0x01
70#define LSI_ISTAT1_SRUN 0x02
71#define LSI_ISTAT1_FLSH 0x04
72
73#define LSI_SSTAT0_SDP0 0x01
74#define LSI_SSTAT0_RST 0x02
75#define LSI_SSTAT0_WOA 0x04
76#define LSI_SSTAT0_LOA 0x08
77#define LSI_SSTAT0_AIP 0x10
78#define LSI_SSTAT0_OLF 0x20
79#define LSI_SSTAT0_ORF 0x40
80#define LSI_SSTAT0_ILF 0x80
81
82#define LSI_SIST0_PAR 0x01
83#define LSI_SIST0_RST 0x02
84#define LSI_SIST0_UDC 0x04
85#define LSI_SIST0_SGE 0x08
86#define LSI_SIST0_RSL 0x10
87#define LSI_SIST0_SEL 0x20
88#define LSI_SIST0_CMP 0x40
89#define LSI_SIST0_MA 0x80
90
91#define LSI_SIST1_HTH 0x01
92#define LSI_SIST1_GEN 0x02
93#define LSI_SIST1_STO 0x04
94#define LSI_SIST1_SBMC 0x10
95
96#define LSI_SOCL_IO 0x01
97#define LSI_SOCL_CD 0x02
98#define LSI_SOCL_MSG 0x04
99#define LSI_SOCL_ATN 0x08
100#define LSI_SOCL_SEL 0x10
101#define LSI_SOCL_BSY 0x20
102#define LSI_SOCL_ACK 0x40
103#define LSI_SOCL_REQ 0x80
104
105#define LSI_DSTAT_IID 0x01
106#define LSI_DSTAT_SIR 0x04
107#define LSI_DSTAT_SSI 0x08
108#define LSI_DSTAT_ABRT 0x10
109#define LSI_DSTAT_BF 0x20
110#define LSI_DSTAT_MDPE 0x40
111#define LSI_DSTAT_DFE 0x80
112
113#define LSI_DCNTL_COM 0x01
114#define LSI_DCNTL_IRQD 0x02
115#define LSI_DCNTL_STD 0x04
116#define LSI_DCNTL_IRQM 0x08
117#define LSI_DCNTL_SSM 0x10
118#define LSI_DCNTL_PFEN 0x20
119#define LSI_DCNTL_PFF 0x40
120#define LSI_DCNTL_CLSE 0x80
121
122#define LSI_DMODE_MAN 0x01
123#define LSI_DMODE_BOF 0x02
124#define LSI_DMODE_ERMP 0x04
125#define LSI_DMODE_ERL 0x08
126#define LSI_DMODE_DIOM 0x10
127#define LSI_DMODE_SIOM 0x20
128
129#define LSI_CTEST2_DACK 0x01
130#define LSI_CTEST2_DREQ 0x02
131#define LSI_CTEST2_TEOP 0x04
132#define LSI_CTEST2_PCICIE 0x08
133#define LSI_CTEST2_CM 0x10
134#define LSI_CTEST2_CIO 0x20
135#define LSI_CTEST2_SIGP 0x40
136#define LSI_CTEST2_DDIR 0x80
137
138#define LSI_CTEST5_BL2 0x04
139#define LSI_CTEST5_DDIR 0x08
140#define LSI_CTEST5_MASR 0x10
141#define LSI_CTEST5_DFSN 0x20
142#define LSI_CTEST5_BBCK 0x40
143#define LSI_CTEST5_ADCK 0x80
144
145#define LSI_CCNTL0_DILS 0x01
146#define LSI_CCNTL0_DISFC 0x10
147#define LSI_CCNTL0_ENNDJ 0x20
148#define LSI_CCNTL0_PMJCTL 0x40
149#define LSI_CCNTL0_ENPMJ 0x80
150
b25cf589
AL		 151#define LSI_CCNTL1_EN64DBMV 0x01
152#define LSI_CCNTL1_EN64TIBMV 0x02
153#define LSI_CCNTL1_64TIMOD 0x04
154#define LSI_CCNTL1_DDAC 0x08
155#define LSI_CCNTL1_ZMOD 0x80
156
e560125e
LA		 157/* Enable Response to Reselection */
158#define LSI_SCID_RRE 0x60
159
b25cf589
AL		 160#define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
7d8406be
PB		 162#define PHASE_DO 0
163#define PHASE_DI 1
164#define PHASE_CMD 2
165#define PHASE_ST 3
166#define PHASE_MO 6
167#define PHASE_MI 7
168#define PHASE_MASK 7
169
a917d384
PB		 170/* Maximum length of MSG IN data. */
171#define LSI_MAX_MSGIN_LEN 8
172
173/* Flag set if this is a tagged command. */
174#define LSI_TAG_VALID (1 << 16)
175
176typedef struct {
177 uint32_t tag;
178 uint32_t pending;
179 int out;
180} lsi_queue;
4d611c9a 181
7d8406be 182typedef struct {
f305261f 183 PCIDevice dev;
7d8406be
PB		 184 int mmio_io_addr;
185 int ram_io_addr;
186 uint32_t script_ram_base;
7d8406be
PB		 187
188 int carry; /* ??? Should this be an a visible register somewhere? */
189 int sense;
a917d384 190 /* Action to take at the end of a MSG IN phase.
a15fdf86 191 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
a917d384
PB		 192 int msg_action;
193 int msg_len;
194 uint8_t msg[LSI_MAX_MSGIN_LEN];
4d611c9a
PB		 195 /* 0 if SCRIPTS are running or stopped.
196 * 1 if a Wait Reselect instruction has been issued.
a917d384
PB		 197 * 2 if processing DMA from lsi_execute_script.
198 * 3 if a DMA operation is in progress. */
7d8406be 199 int waiting;
ca9c39fa 200 SCSIBus bus;
7d8406be
PB		 201 SCSIDevice *current_dev;
202 int current_lun;
a917d384
PB		 203 /* The tag is a combination of the device ID and the SCSI tag. */
204 uint32_t current_tag;
205 uint32_t current_dma_len;
8ccc2ace 206 int command_complete;
a917d384
PB		 207 uint8_t *dma_buf;
208 lsi_queue *queue;
209 int queue_len;
210 int active_commands;
7d8406be
PB		 211
212 uint32_t dsa;
213 uint32_t temp;
214 uint32_t dnad;
215 uint32_t dbc;
216 uint8_t istat0;
217 uint8_t istat1;
218 uint8_t dcmd;
219 uint8_t dstat;
220 uint8_t dien;
221 uint8_t sist0;
222 uint8_t sist1;
223 uint8_t sien0;
224 uint8_t sien1;
225 uint8_t mbox0;
226 uint8_t mbox1;
227 uint8_t dfifo;
9167a69a 228 uint8_t ctest2;
7d8406be
PB		 229 uint8_t ctest3;
230 uint8_t ctest4;
231 uint8_t ctest5;
232 uint8_t ccntl0;
233 uint8_t ccntl1;
234 uint32_t dsp;
235 uint32_t dsps;
236 uint8_t dmode;
237 uint8_t dcntl;
238 uint8_t scntl0;
239 uint8_t scntl1;
240 uint8_t scntl2;
241 uint8_t scntl3;
242 uint8_t sstat0;
243 uint8_t sstat1;
244 uint8_t scid;
245 uint8_t sxfer;
246 uint8_t socl;
247 uint8_t sdid;
a917d384 248 uint8_t ssid;
7d8406be
PB		 249 uint8_t sfbr;
250 uint8_t stest1;
251 uint8_t stest2;
252 uint8_t stest3;
a917d384 253 uint8_t sidl;
7d8406be
PB		 254 uint8_t stime0;
255 uint8_t respid0;
256 uint8_t respid1;
257 uint32_t mmrs;
258 uint32_t mmws;
259 uint32_t sfs;
260 uint32_t drs;
261 uint32_t sbms;
ab57d967 262 uint32_t dbms;
7d8406be
PB		 263 uint32_t dnad64;
264 uint32_t pmjad1;
265 uint32_t pmjad2;
266 uint32_t rbc;
267 uint32_t ua;
268 uint32_t ia;
269 uint32_t sbc;
270 uint32_t csbc;
dcfb9014 271 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
bd8ee11a 272 uint8_t sbr;
7d8406be
PB		 273
274 /* Script ram is stored as 32-bit words in host byteorder. */
275 uint32_t script_ram[2048];
276} LSIState;
277
e560125e
LA		 278static inline int lsi_irq_on_rsl(LSIState *s)
279{
280 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
281}
282
7d8406be
PB		 283static void lsi_soft_reset(LSIState *s)
284{
285 DPRINTF("Reset\n");
286 s->carry = 0;
287
288 s->waiting = 0;
289 s->dsa = 0;
290 s->dnad = 0;
291 s->dbc = 0;
292 s->temp = 0;
293 memset(s->scratch, 0, sizeof(s->scratch));
294 s->istat0 = 0;
295 s->istat1 = 0;
296 s->dcmd = 0;
297 s->dstat = 0;
298 s->dien = 0;
299 s->sist0 = 0;
300 s->sist1 = 0;
301 s->sien0 = 0;
302 s->sien1 = 0;
303 s->mbox0 = 0;
304 s->mbox1 = 0;
305 s->dfifo = 0;
9167a69a 306 s->ctest2 = 0;
7d8406be
PB		 307 s->ctest3 = 0;
308 s->ctest4 = 0;
309 s->ctest5 = 0;
310 s->ccntl0 = 0;
311 s->ccntl1 = 0;
312 s->dsp = 0;
313 s->dsps = 0;
314 s->dmode = 0;
315 s->dcntl = 0;
316 s->scntl0 = 0xc0;
317 s->scntl1 = 0;
318 s->scntl2 = 0;
319 s->scntl3 = 0;
320 s->sstat0 = 0;
321 s->sstat1 = 0;
322 s->scid = 7;
323 s->sxfer = 0;
324 s->socl = 0;
325 s->stest1 = 0;
326 s->stest2 = 0;
327 s->stest3 = 0;
a917d384 328 s->sidl = 0;
7d8406be
PB		 329 s->stime0 = 0;
330 s->respid0 = 0x80;
331 s->respid1 = 0;
332 s->mmrs = 0;
333 s->mmws = 0;
334 s->sfs = 0;
335 s->drs = 0;
336 s->sbms = 0;
ab57d967 337 s->dbms = 0;
7d8406be
PB		 338 s->dnad64 = 0;
339 s->pmjad1 = 0;
340 s->pmjad2 = 0;
341 s->rbc = 0;
342 s->ua = 0;
343 s->ia = 0;
344 s->sbc = 0;
345 s->csbc = 0;
bd8ee11a 346 s->sbr = 0;
7d8406be
PB		 347}
348
b25cf589
AL		 349static int lsi_dma_40bit(LSIState *s)
350{
351 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
352 return 1;
353 return 0;
354}
355
dd8edf01
AL		 356static int lsi_dma_ti64bit(LSIState *s)
357{
358 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
359 return 1;
360 return 0;
361}
362
363static int lsi_dma_64bit(LSIState *s)
364{
365 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
366 return 1;
367 return 0;
368}
369
7d8406be
PB		 370static uint8_t lsi_reg_readb(LSIState *s, int offset);
371static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
4d611c9a 372static void lsi_execute_script(LSIState *s);
e560125e 373static void lsi_reselect(LSIState *s, uint32_t tag);
7d8406be
PB		 374
375static inline uint32_t read_dword(LSIState *s, uint32_t addr)
376{
377 uint32_t buf;
378
379 /* Optimize reading from SCRIPTS RAM. */
380 if ((addr & 0xffffe000) == s->script_ram_base) {
381 return s->script_ram[(addr & 0x1fff) >> 2];
382 }
383 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
384 return cpu_to_le32(buf);
385}
386
387static void lsi_stop_script(LSIState *s)
388{
389 s->istat1 &= ~LSI_ISTAT1_SRUN;
390}
391
392static void lsi_update_irq(LSIState *s)
393{
e560125e 394 int i;
7d8406be
PB		 395 int level;
396 static int last_level;
397
398 /* It's unclear whether the DIP/SIP bits should be cleared when the
399 Interrupt Status Registers are cleared or when istat0 is read.
400 We currently do the formwer, which seems to work. */
401 level = 0;
402 if (s->dstat) {
403 if (s->dstat & s->dien)
404 level = 1;
405 s->istat0 |= LSI_ISTAT0_DIP;
406 } else {
407 s->istat0 &= ~LSI_ISTAT0_DIP;
408 }
409
410 if (s->sist0 || s->sist1) {
411 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
412 level = 1;
413 s->istat0 |= LSI_ISTAT0_SIP;
414 } else {
415 s->istat0 &= ~LSI_ISTAT0_SIP;
416 }
417 if (s->istat0 & LSI_ISTAT0_INTF)
418 level = 1;
419
420 if (level != last_level) {
421 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
422 level, s->dstat, s->sist1, s->sist0);
423 last_level = level;
424 }
f305261f 425 qemu_set_irq(s->dev.irq[0], level);
e560125e
LA		 426
427 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
428 DPRINTF("Handled IRQs & disconnected, looking for pending "
429 "processes\n");
430 for (i = 0; i < s->active_commands; i++) {
431 if (s->queue[i].pending) {
432 lsi_reselect(s, s->queue[i].tag);
433 break;
434 }
435 }
436 }
7d8406be
PB		 437}
438
439/* Stop SCRIPTS execution and raise a SCSI interrupt. */
440static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
441{
442 uint32_t mask0;
443 uint32_t mask1;
444
445 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
446 stat1, stat0, s->sist1, s->sist0);
447 s->sist0 |= stat0;
448 s->sist1 |= stat1;
449 /* Stop processor on fatal or unmasked interrupt. As a special hack
450 we don't stop processing when raising STO. Instead continue
451 execution and stop at the next insn that accesses the SCSI bus. */
452 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
453 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
454 mask1 &= ~LSI_SIST1_STO;
455 if (s->sist0 & mask0 || s->sist1 & mask1) {
456 lsi_stop_script(s);
457 }
458 lsi_update_irq(s);
459}
460
461/* Stop SCRIPTS execution and raise a DMA interrupt. */
462static void lsi_script_dma_interrupt(LSIState *s, int stat)
463{
464 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
465 s->dstat |= stat;
466 lsi_update_irq(s);
467 lsi_stop_script(s);
468}
469
470static inline void lsi_set_phase(LSIState *s, int phase)
471{
472 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
473}
474
475static void lsi_bad_phase(LSIState *s, int out, int new_phase)
476{
477 /* Trigger a phase mismatch. */
478 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
479 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
480 s->dsp = s->pmjad1;
481 } else {
482 s->dsp = s->pmjad2;
483 }
484 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
485 } else {
486 DPRINTF("Phase mismatch interrupt\n");
487 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
488 lsi_stop_script(s);
489 }
490 lsi_set_phase(s, new_phase);
491}
492
a917d384
PB		 493
494/* Resume SCRIPTS execution after a DMA operation. */
495static void lsi_resume_script(LSIState *s)
496{
497 if (s->waiting != 2) {
498 s->waiting = 0;
499 lsi_execute_script(s);
500 } else {
501 s->waiting = 0;
502 }
503}
504
4d611c9a 505/* Initiate a SCSI layer data transfer. */
7d8406be
PB		 506static void lsi_do_dma(LSIState *s, int out)
507{
7d8406be 508 uint32_t count;
c227f099 509 target_phys_addr_t addr;
7d8406be 510
a917d384
PB		 511 if (!s->current_dma_len) {
512 /* Wait until data is available. */
513 DPRINTF("DMA no data available\n");
514 return;
7d8406be
PB		 515 }
516
a917d384
PB		 517 count = s->dbc;
518 if (count > s->current_dma_len)
519 count = s->current_dma_len;
a917d384
PB		 520
521 addr = s->dnad;
dd8edf01
AL		 522 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
523 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
b25cf589 524 addr |= ((uint64_t)s->dnad64 << 32);
dd8edf01
AL		 525 else if (s->dbms)
526 addr |= ((uint64_t)s->dbms << 32);
b25cf589
AL		 527 else if (s->sbms)
528 addr |= ((uint64_t)s->sbms << 32);
529
3adae656 530 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
7d8406be 531 s->csbc += count;
a917d384
PB		 532 s->dnad += count;
533 s->dbc -= count;
534
535 if (s->dma_buf == NULL) {
d52affa7
GH		 536 s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
537 s->current_tag);
a917d384 538 }
7d8406be
PB		 539
540 /* ??? Set SFBR to first data byte. */
a917d384
PB		 541 if (out) {
542 cpu_physical_memory_read(addr, s->dma_buf, count);
543 } else {
544 cpu_physical_memory_write(addr, s->dma_buf, count);
545 }
546 s->current_dma_len -= count;
547 if (s->current_dma_len == 0) {
548 s->dma_buf = NULL;
549 if (out) {
550 /* Write the data. */
d52affa7 551 s->current_dev->info->write_data(s->current_dev, s->current_tag);
a917d384
PB		 552 } else {
553 /* Request any remaining data. */
d52affa7 554 s->current_dev->info->read_data(s->current_dev, s->current_tag);
a917d384
PB		 555 }
556 } else {
557 s->dma_buf += count;
558 lsi_resume_script(s);
559 }
560}
561
562
563/* Add a command to the queue. */
564static void lsi_queue_command(LSIState *s)
565{
566 lsi_queue *p;
567
568 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
569 if (s->queue_len == s->active_commands) {
570 s->queue_len++;
2137b4cc 571 s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
a917d384
PB		 572 }
573 p = &s->queue[s->active_commands++];
574 p->tag = s->current_tag;
575 p->pending = 0;
576 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
577}
578
579/* Queue a byte for a MSG IN phase. */
580static void lsi_add_msg_byte(LSIState *s, uint8_t data)
581{
582 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
583 BADF("MSG IN data too long\n");
4d611c9a 584 } else {
a917d384
PB		 585 DPRINTF("MSG IN 0x%02x\n", data);
586 s->msg[s->msg_len++] = data;
7d8406be 587 }
a917d384
PB		 588}
589
590/* Perform reselection to continue a command. */
591static void lsi_reselect(LSIState *s, uint32_t tag)
592{
593 lsi_queue *p;
594 int n;
595 int id;
596
597 p = NULL;
598 for (n = 0; n < s->active_commands; n++) {
599 p = &s->queue[n];
600 if (p->tag == tag)
601 break;
602 }
603 if (n == s->active_commands) {
604 BADF("Reselected non-existant command tag=0x%x\n", tag);
605 return;
606 }
607 id = (tag >> 8) & 0xf;
608 s->ssid = id | 0x80;
cc9f28bc
LA		 609 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
610 if (!s->dcntl & LSI_DCNTL_COM) {
611 s->sfbr = 1 << (id & 0x7);
612 }
a917d384 613 DPRINTF("Reselected target %d\n", id);
ca9c39fa 614 s->current_dev = s->bus.devs[id];
a917d384
PB		 615 s->current_tag = tag;
616 s->scntl1 |= LSI_SCNTL1_CON;
617 lsi_set_phase(s, PHASE_MI);
618 s->msg_action = p->out ? 2 : 3;
619 s->current_dma_len = p->pending;
620 s->dma_buf = NULL;
621 lsi_add_msg_byte(s, 0x80);
622 if (s->current_tag & LSI_TAG_VALID) {
623 lsi_add_msg_byte(s, 0x20);
624 lsi_add_msg_byte(s, tag & 0xff);
625 }
626
627 s->active_commands--;
628 if (n != s->active_commands) {
629 s->queue[n] = s->queue[s->active_commands];
630 }
e560125e
LA		 631
632 if (lsi_irq_on_rsl(s)) {
633 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
634 }
a917d384
PB		 635}
636
637/* Record that data is available for a queued command. Returns zero if
638 the device was reselected, nonzero if the IO is deferred. */
639static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
640{
641 lsi_queue *p;
642 int i;
643 for (i = 0; i < s->active_commands; i++) {
644 p = &s->queue[i];
645 if (p->tag == tag) {
646 if (p->pending) {
647 BADF("Multiple IO pending for tag %d\n", tag);
648 }
649 p->pending = arg;
e560125e
LA		 650 /* Reselect if waiting for it, or if reselection triggers an IRQ
651 and the bus is free.
652 Since no interrupt stacking is implemented in the emulation, it
653 is also required that there are no pending interrupts waiting
654 for service from the device driver. */
655 if (s->waiting == 1 ||
656 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
657 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
a917d384
PB		 658 /* Reselect device. */
659 lsi_reselect(s, tag);
660 return 0;
661 } else {
662 DPRINTF("Queueing IO tag=0x%x\n", tag);
663 p->pending = arg;
664 return 1;
665 }
666 }
667 }
668 BADF("IO with unknown tag %d\n", tag);
669 return 1;
7d8406be
PB		 670}
671
4d611c9a 672/* Callback to indicate that the SCSI layer has completed a transfer. */
d52affa7 673static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
a917d384 674 uint32_t arg)
4d611c9a 675{
d52affa7 676 LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
4d611c9a
PB		 677 int out;
678
a917d384 679 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
4d611c9a 680 if (reason == SCSI_REASON_DONE) {
a917d384
PB		 681 DPRINTF("Command complete sense=%d\n", (int)arg);
682 s->sense = arg;
8ccc2ace 683 s->command_complete = 2;
a917d384
PB		 684 if (s->waiting && s->dbc != 0) {
685 /* Raise phase mismatch for short transfers. */
686 lsi_bad_phase(s, out, PHASE_ST);
687 } else {
688 lsi_set_phase(s, PHASE_ST);
689 }
690 lsi_resume_script(s);
691 return;
4d611c9a
PB		 692 }
693
e560125e
LA		 694 if (s->waiting == 1 || tag != s->current_tag ||
695 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
a917d384
PB		 696 if (lsi_queue_tag(s, tag, arg))
697 return;
698 }
e560125e
LA		 699
700 /* host adapter (re)connected */
a917d384
PB		 701 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
702 s->current_dma_len = arg;
8ccc2ace 703 s->command_complete = 1;
a917d384
PB		 704 if (!s->waiting)
705 return;
706 if (s->waiting == 1 || s->dbc == 0) {
707 lsi_resume_script(s);
708 } else {
4d611c9a 709 lsi_do_dma(s, out);
4d611c9a
PB		 710 }
711}
7d8406be
PB		 712
713static void lsi_do_command(LSIState *s)
714{
715 uint8_t buf[16];
716 int n;
717
718 DPRINTF("Send command len=%d\n", s->dbc);
719 if (s->dbc > 16)
720 s->dbc = 16;
721 cpu_physical_memory_read(s->dnad, buf, s->dbc);
722 s->sfbr = buf[0];
8ccc2ace 723 s->command_complete = 0;
d52affa7
GH		 724 n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
725 s->current_lun);
7d8406be 726 if (n > 0) {
7d8406be 727 lsi_set_phase(s, PHASE_DI);
d52affa7 728 s->current_dev->info->read_data(s->current_dev, s->current_tag);
7d8406be 729 } else if (n < 0) {
7d8406be 730 lsi_set_phase(s, PHASE_DO);
d52affa7 731 s->current_dev->info->write_data(s->current_dev, s->current_tag);
a917d384 732 }
8ccc2ace
TS		 733
734 if (!s->command_complete) {
735 if (n) {
736 /* Command did not complete immediately so disconnect. */
737 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
738 lsi_add_msg_byte(s, 4); /* DISCONNECT */
739 /* wait data */
740 lsi_set_phase(s, PHASE_MI);
741 s->msg_action = 1;
742 lsi_queue_command(s);
743 } else {
744 /* wait command complete */
745 lsi_set_phase(s, PHASE_DI);
746 }
7d8406be
PB		 747 }
748}
749
7d8406be
PB		 750static void lsi_do_status(LSIState *s)
751{
a917d384 752 uint8_t sense;
7d8406be
PB		 753 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
754 if (s->dbc != 1)
755 BADF("Bad Status move\n");
756 s->dbc = 1;
a917d384
PB		 757 sense = s->sense;
758 s->sfbr = sense;
759 cpu_physical_memory_write(s->dnad, &sense, 1);
7d8406be 760 lsi_set_phase(s, PHASE_MI);
a917d384
PB		 761 s->msg_action = 1;
762 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
7d8406be
PB		 763}
764
765static void lsi_disconnect(LSIState *s)
766{
767 s->scntl1 &= ~LSI_SCNTL1_CON;
768 s->sstat1 &= ~PHASE_MASK;
769}
770
771static void lsi_do_msgin(LSIState *s)
772{
a917d384
PB		 773 int len;
774 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
775 s->sfbr = s->msg[0];
776 len = s->msg_len;
777 if (len > s->dbc)
778 len = s->dbc;
779 cpu_physical_memory_write(s->dnad, s->msg, len);
780 /* Linux drivers rely on the last byte being in the SIDL. */
781 s->sidl = s->msg[len - 1];
782 s->msg_len -= len;
783 if (s->msg_len) {
784 memmove(s->msg, s->msg + len, s->msg_len);
7d8406be
PB		 785 } else {
786 /* ??? Check if ATN (not yet implemented) is asserted and maybe
787 switch to PHASE_MO. */
a917d384
PB		 788 switch (s->msg_action) {
789 case 0:
790 lsi_set_phase(s, PHASE_CMD);
791 break;
792 case 1:
793 lsi_disconnect(s);
794 break;
795 case 2:
796 lsi_set_phase(s, PHASE_DO);
797 break;
798 case 3:
799 lsi_set_phase(s, PHASE_DI);
800 break;
801 default:
802 abort();
803 }
7d8406be
PB		 804 }
805}
806
a917d384
PB		 807/* Read the next byte during a MSGOUT phase. */
808static uint8_t lsi_get_msgbyte(LSIState *s)
809{
810 uint8_t data;
811 cpu_physical_memory_read(s->dnad, &data, 1);
812 s->dnad++;
813 s->dbc--;
814 return data;
815}
816
7d8406be
PB		 817static void lsi_do_msgout(LSIState *s)
818{
819 uint8_t msg;
a917d384 820 int len;
7d8406be
PB		 821
822 DPRINTF("MSG out len=%d\n", s->dbc);
a917d384
PB		 823 while (s->dbc) {
824 msg = lsi_get_msgbyte(s);
825 s->sfbr = msg;
826
827 switch (msg) {
77203ea0 828 case 0x04:
a917d384
PB		 829 DPRINTF("MSG: Disconnect\n");
830 lsi_disconnect(s);
831 break;
832 case 0x08:
833 DPRINTF("MSG: No Operation\n");
834 lsi_set_phase(s, PHASE_CMD);
835 break;
836 case 0x01:
837 len = lsi_get_msgbyte(s);
838 msg = lsi_get_msgbyte(s);
839 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
840 switch (msg) {
841 case 1:
842 DPRINTF("SDTR (ignored)\n");
843 s->dbc -= 2;
844 break;
845 case 3:
846 DPRINTF("WDTR (ignored)\n");
847 s->dbc -= 1;
848 break;
849 default:
850 goto bad;
851 }
852 break;
853 case 0x20: /* SIMPLE queue */
854 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
855 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
856 break;
857 case 0x21: /* HEAD of queue */
858 BADF("HEAD queue not implemented\n");
859 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
860 break;
861 case 0x22: /* ORDERED queue */
862 BADF("ORDERED queue not implemented\n");
863 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
864 break;
865 default:
866 if ((msg & 0x80) == 0) {
867 goto bad;
868 }
869 s->current_lun = msg & 7;
870 DPRINTF("Select LUN %d\n", s->current_lun);
871 lsi_set_phase(s, PHASE_CMD);
872 break;
873 }
7d8406be 874 }
a917d384
PB		 875 return;
876bad:
877 BADF("Unimplemented message 0x%02x\n", msg);
878 lsi_set_phase(s, PHASE_MI);
879 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
880 s->msg_action = 0;
7d8406be
PB		 881}
882
883/* Sign extend a 24-bit value. */
884static inline int32_t sxt24(int32_t n)
885{
886 return (n << 8) >> 8;
887}
888
e20a8dff 889#define LSI_BUF_SIZE 4096
7d8406be
PB		 890static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
891{
892 int n;
e20a8dff 893 uint8_t buf[LSI_BUF_SIZE];
7d8406be
PB		 894
895 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
896 while (count) {
e20a8dff 897 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
7d8406be
PB		 898 cpu_physical_memory_read(src, buf, n);
899 cpu_physical_memory_write(dest, buf, n);
900 src += n;
901 dest += n;
902 count -= n;
903 }
904}
905
a917d384
PB		 906static void lsi_wait_reselect(LSIState *s)
907{
908 int i;
909 DPRINTF("Wait Reselect\n");
910 if (s->current_dma_len)
911 BADF("Reselect with pending DMA\n");
912 for (i = 0; i < s->active_commands; i++) {
913 if (s->queue[i].pending) {
914 lsi_reselect(s, s->queue[i].tag);
915 break;
916 }
917 }
918 if (s->current_dma_len == 0) {
919 s->waiting = 1;
920 }
921}
922
7d8406be
PB		 923static void lsi_execute_script(LSIState *s)
924{
925 uint32_t insn;
b25cf589 926 uint32_t addr, addr_high;
7d8406be 927 int opcode;
ee4d919f 928 int insn_processed = 0;
7d8406be
PB		 929
930 s->istat1 |= LSI_ISTAT1_SRUN;
931again:
ee4d919f 932 insn_processed++;
7d8406be 933 insn = read_dword(s, s->dsp);
02b373ad
AZ		 934 if (!insn) {
935 /* If we receive an empty opcode increment the DSP by 4 bytes
936 instead of 8 and execute the next opcode at that location */
937 s->dsp += 4;
938 goto again;
939 }
7d8406be 940 addr = read_dword(s, s->dsp + 4);
b25cf589 941 addr_high = 0;
7d8406be
PB		 942 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
943 s->dsps = addr;
944 s->dcmd = insn >> 24;
945 s->dsp += 8;
946 switch (insn >> 30) {
947 case 0: /* Block move. */
948 if (s->sist1 & LSI_SIST1_STO) {
949 DPRINTF("Delayed select timeout\n");
950 lsi_stop_script(s);
951 break;
952 }
953 s->dbc = insn & 0xffffff;
954 s->rbc = s->dbc;
dd8edf01
AL		 955 /* ??? Set ESA. */
956 s->ia = s->dsp - 8;
7d8406be
PB		 957 if (insn & (1 << 29)) {
958 /* Indirect addressing. */
959 addr = read_dword(s, addr);
960 } else if (insn & (1 << 28)) {
961 uint32_t buf[2];
962 int32_t offset;
963 /* Table indirect addressing. */
dd8edf01
AL		 964
965 /* 32-bit Table indirect */
7d8406be
PB		 966 offset = sxt24(addr);
967 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
b25cf589
AL		 968 /* byte count is stored in bits 0:23 only */
969 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
7faa239c 970 s->rbc = s->dbc;
7d8406be 971 addr = cpu_to_le32(buf[1]);
b25cf589
AL		 972
973 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
974 * table, bits [31:24] */
975 if (lsi_dma_40bit(s))
976 addr_high = cpu_to_le32(buf[0]) >> 24;
dd8edf01
AL		 977 else if (lsi_dma_ti64bit(s)) {
978 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
979 switch (selector) {
980 case 0 ... 0x0f:
981 /* offset index into scratch registers since
982 * TI64 mode can use registers C to R */
983 addr_high = s->scratch[2 + selector];
984 break;
985 case 0x10:
986 addr_high = s->mmrs;
987 break;
988 case 0x11:
989 addr_high = s->mmws;
990 break;
991 case 0x12:
992 addr_high = s->sfs;
993 break;
994 case 0x13:
995 addr_high = s->drs;
996 break;
997 case 0x14:
998 addr_high = s->sbms;
999 break;
1000 case 0x15:
1001 addr_high = s->dbms;
1002 break;
1003 default:
1004 BADF("Illegal selector specified (0x%x > 0x15)"
1005 " for 64-bit DMA block move", selector);
1006 break;
1007 }
1008 }
1009 } else if (lsi_dma_64bit(s)) {
1010 /* fetch a 3rd dword if 64-bit direct move is enabled and
1011 only if we're not doing table indirect or indirect addressing */
1012 s->dbms = read_dword(s, s->dsp);
1013 s->dsp += 4;
1014 s->ia = s->dsp - 12;
7d8406be
PB		 1015 }
1016 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1017 DPRINTF("Wrong phase got %d expected %d\n",
1018 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1019 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1020 break;
1021 }
1022 s->dnad = addr;
b25cf589 1023 s->dnad64 = addr_high;
7d8406be
PB		 1024 switch (s->sstat1 & 0x7) {
1025 case PHASE_DO:
a917d384 1026 s->waiting = 2;
7d8406be 1027 lsi_do_dma(s, 1);
a917d384
PB		 1028 if (s->waiting)
1029 s->waiting = 3;
7d8406be
PB		 1030 break;
1031 case PHASE_DI:
a917d384 1032 s->waiting = 2;
7d8406be 1033 lsi_do_dma(s, 0);
a917d384
PB		 1034 if (s->waiting)
1035 s->waiting = 3;
7d8406be
PB		 1036 break;
1037 case PHASE_CMD:
1038 lsi_do_command(s);
1039 break;
1040 case PHASE_ST:
1041 lsi_do_status(s);
1042 break;
1043 case PHASE_MO:
1044 lsi_do_msgout(s);
1045 break;
1046 case PHASE_MI:
1047 lsi_do_msgin(s);
1048 break;
1049 default:
1050 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1051 exit(1);
1052 }
1053 s->dfifo = s->dbc & 0xff;
1054 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1055 s->sbc = s->dbc;
1056 s->rbc -= s->dbc;
1057 s->ua = addr + s->dbc;
7d8406be
PB		 1058 break;
1059
1060 case 1: /* IO or Read/Write instruction. */
1061 opcode = (insn >> 27) & 7;
1062 if (opcode < 5) {
1063 uint32_t id;
1064
1065 if (insn & (1 << 25)) {
1066 id = read_dword(s, s->dsa + sxt24(insn));
1067 } else {
07a1bea8 1068 id = insn;
7d8406be
PB		 1069 }
1070 id = (id >> 16) & 0xf;
1071 if (insn & (1 << 26)) {
1072 addr = s->dsp + sxt24(addr);
1073 }
1074 s->dnad = addr;
1075 switch (opcode) {
1076 case 0: /* Select */
a917d384 1077 s->sdid = id;
38f5b2b8
LA		 1078 if (s->scntl1 & LSI_SCNTL1_CON) {
1079 DPRINTF("Already reselected, jumping to alternative address\n");
1080 s->dsp = s->dnad;
a917d384
PB		 1081 break;
1082 }
7d8406be
PB		 1083 s->sstat0 |= LSI_SSTAT0_WOA;
1084 s->scntl1 &= ~LSI_SCNTL1_IARB;
ca9c39fa 1085 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
7d8406be
PB		 1086 DPRINTF("Selected absent target %d\n", id);
1087 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1088 lsi_disconnect(s);
1089 break;
1090 }
1091 DPRINTF("Selected target %d%s\n",
1092 id, insn & (1 << 3) ? " ATN" : "");
1093 /* ??? Linux drivers compain when this is set. Maybe
1094 it only applies in low-level mode (unimplemented).
1095 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
ca9c39fa 1096 s->current_dev = s->bus.devs[id];
a917d384 1097 s->current_tag = id << 8;
7d8406be
PB		 1098 s->scntl1 |= LSI_SCNTL1_CON;
1099 if (insn & (1 << 3)) {
1100 s->socl |= LSI_SOCL_ATN;
1101 }
1102 lsi_set_phase(s, PHASE_MO);
1103 break;
1104 case 1: /* Disconnect */
a15fdf86 1105 DPRINTF("Wait Disconnect\n");
7d8406be
PB		 1106 s->scntl1 &= ~LSI_SCNTL1_CON;
1107 break;
1108 case 2: /* Wait Reselect */
e560125e
LA		 1109 if (!lsi_irq_on_rsl(s)) {
1110 lsi_wait_reselect(s);
1111 }
7d8406be
PB		 1112 break;
1113 case 3: /* Set */
1114 DPRINTF("Set%s%s%s%s\n",
1115 insn & (1 << 3) ? " ATN" : "",
1116 insn & (1 << 6) ? " ACK" : "",
1117 insn & (1 << 9) ? " TM" : "",
1118 insn & (1 << 10) ? " CC" : "");
1119 if (insn & (1 << 3)) {
1120 s->socl |= LSI_SOCL_ATN;
1121 lsi_set_phase(s, PHASE_MO);
1122 }
1123 if (insn & (1 << 9)) {
1124 BADF("Target mode not implemented\n");
1125 exit(1);
1126 }
1127 if (insn & (1 << 10))
1128 s->carry = 1;
1129 break;
1130 case 4: /* Clear */
1131 DPRINTF("Clear%s%s%s%s\n",
1132 insn & (1 << 3) ? " ATN" : "",
1133 insn & (1 << 6) ? " ACK" : "",
1134 insn & (1 << 9) ? " TM" : "",
1135 insn & (1 << 10) ? " CC" : "");
1136 if (insn & (1 << 3)) {
1137 s->socl &= ~LSI_SOCL_ATN;
1138 }
1139 if (insn & (1 << 10))
1140 s->carry = 0;
1141 break;
1142 }
1143 } else {
1144 uint8_t op0;
1145 uint8_t op1;
1146 uint8_t data8;
1147 int reg;
1148 int operator;
1149#ifdef DEBUG_LSI
1150 static const char *opcode_names[3] =
1151 {"Write", "Read", "Read-Modify-Write"};
1152 static const char *operator_names[8] =
1153 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1154#endif
1155
1156 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1157 data8 = (insn >> 8) & 0xff;
1158 opcode = (insn >> 27) & 7;
1159 operator = (insn >> 24) & 7;
a917d384 1160 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
7d8406be 1161 opcode_names[opcode - 5], reg,
a917d384 1162 operator_names[operator], data8, s->sfbr,
7d8406be
PB		 1163 (insn & (1 << 23)) ? " SFBR" : "");
1164 op0 = op1 = 0;
1165 switch (opcode) {
1166 case 5: /* From SFBR */
1167 op0 = s->sfbr;
1168 op1 = data8;
1169 break;
1170 case 6: /* To SFBR */
1171 if (operator)
1172 op0 = lsi_reg_readb(s, reg);
1173 op1 = data8;
1174 break;
1175 case 7: /* Read-modify-write */
1176 if (operator)
1177 op0 = lsi_reg_readb(s, reg);
1178 if (insn & (1 << 23)) {
1179 op1 = s->sfbr;
1180 } else {
1181 op1 = data8;
1182 }
1183 break;
1184 }
1185
1186 switch (operator) {
1187 case 0: /* move */
1188 op0 = op1;
1189 break;
1190 case 1: /* Shift left */
1191 op1 = op0 >> 7;
1192 op0 = (op0 << 1) | s->carry;
1193 s->carry = op1;
1194 break;
1195 case 2: /* OR */
1196 op0 |= op1;
1197 break;
1198 case 3: /* XOR */
dcfb9014 1199 op0 ^= op1;
7d8406be
PB		 1200 break;
1201 case 4: /* AND */
1202 op0 &= op1;
1203 break;
1204 case 5: /* SHR */
1205 op1 = op0 & 1;
1206 op0 = (op0 >> 1) | (s->carry << 7);
687fa640 1207 s->carry = op1;
7d8406be
PB		 1208 break;
1209 case 6: /* ADD */
1210 op0 += op1;
1211 s->carry = op0 < op1;
1212 break;
1213 case 7: /* ADC */
1214 op0 += op1 + s->carry;
1215 if (s->carry)
1216 s->carry = op0 <= op1;
1217 else
1218 s->carry = op0 < op1;
1219 break;
1220 }
1221
1222 switch (opcode) {
1223 case 5: /* From SFBR */
1224 case 7: /* Read-modify-write */
1225 lsi_reg_writeb(s, reg, op0);
1226 break;
1227 case 6: /* To SFBR */
1228 s->sfbr = op0;
1229 break;
1230 }
1231 }
1232 break;
1233
1234 case 2: /* Transfer Control. */
1235 {
1236 int cond;
1237 int jmp;
1238
1239 if ((insn & 0x002e0000) == 0) {
1240 DPRINTF("NOP\n");
1241 break;
1242 }
1243 if (s->sist1 & LSI_SIST1_STO) {
1244 DPRINTF("Delayed select timeout\n");
1245 lsi_stop_script(s);
1246 break;
1247 }
1248 cond = jmp = (insn & (1 << 19)) != 0;
1249 if (cond == jmp && (insn & (1 << 21))) {
1250 DPRINTF("Compare carry %d\n", s->carry == jmp);
1251 cond = s->carry != 0;
1252 }
1253 if (cond == jmp && (insn & (1 << 17))) {
1254 DPRINTF("Compare phase %d %c= %d\n",
1255 (s->sstat1 & PHASE_MASK),
1256 jmp ? '=' : '!',
1257 ((insn >> 24) & 7));
1258 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1259 }
1260 if (cond == jmp && (insn & (1 << 18))) {
1261 uint8_t mask;
1262
1263 mask = (~insn >> 8) & 0xff;
1264 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1265 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1266 cond = (s->sfbr & mask) == (insn & mask);
1267 }
1268 if (cond == jmp) {
1269 if (insn & (1 << 23)) {
1270 /* Relative address. */
1271 addr = s->dsp + sxt24(addr);
1272 }
1273 switch ((insn >> 27) & 7) {
1274 case 0: /* Jump */
1275 DPRINTF("Jump to 0x%08x\n", addr);
1276 s->dsp = addr;
1277 break;
1278 case 1: /* Call */
1279 DPRINTF("Call 0x%08x\n", addr);
1280 s->temp = s->dsp;
1281 s->dsp = addr;
1282 break;
1283 case 2: /* Return */
1284 DPRINTF("Return to 0x%08x\n", s->temp);
1285 s->dsp = s->temp;
1286 break;
1287 case 3: /* Interrupt */
1288 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1289 if ((insn & (1 << 20)) != 0) {
1290 s->istat0 |= LSI_ISTAT0_INTF;
1291 lsi_update_irq(s);
1292 } else {
1293 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1294 }
1295 break;
1296 default:
1297 DPRINTF("Illegal transfer control\n");
1298 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1299 break;
1300 }
1301 } else {
1302 DPRINTF("Control condition failed\n");
1303 }
1304 }
1305 break;
1306
1307 case 3:
1308 if ((insn & (1 << 29)) == 0) {
1309 /* Memory move. */
1310 uint32_t dest;
1311 /* ??? The docs imply the destination address is loaded into
1312 the TEMP register. However the Linux drivers rely on
1313 the value being presrved. */
1314 dest = read_dword(s, s->dsp);
1315 s->dsp += 4;
1316 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1317 } else {
1318 uint8_t data[7];
1319 int reg;
1320 int n;
1321 int i;
1322
1323 if (insn & (1 << 28)) {
1324 addr = s->dsa + sxt24(addr);
1325 }
1326 n = (insn & 7);
1327 reg = (insn >> 16) & 0xff;
1328 if (insn & (1 << 24)) {
7d8406be 1329 cpu_physical_memory_read(addr, data, n);
a917d384
PB		 1330 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1331 addr, *(int *)data);
7d8406be
PB		 1332 for (i = 0; i < n; i++) {
1333 lsi_reg_writeb(s, reg + i, data[i]);
1334 }
1335 } else {
1336 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1337 for (i = 0; i < n; i++) {
1338 data[i] = lsi_reg_readb(s, reg + i);
1339 }
1340 cpu_physical_memory_write(addr, data, n);
1341 }
1342 }
1343 }
ee4d919f 1344 if (insn_processed > 10000 && !s->waiting) {
64c68080
PB		 1345 /* Some windows drivers make the device spin waiting for a memory
1346 location to change. If we have been executed a lot of code then
1347 assume this is the case and force an unexpected device disconnect.
1348 This is apparently sufficient to beat the drivers into submission.
1349 */
ee4d919f
AL		 1350 if (!(s->sien0 & LSI_SIST0_UDC))
1351 fprintf(stderr, "inf. loop with UDC masked\n");
1352 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1353 lsi_disconnect(s);
1354 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
7d8406be
PB		 1355 if (s->dcntl & LSI_DCNTL_SSM) {
1356 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1357 } else {
1358 goto again;
1359 }
1360 }
1361 DPRINTF("SCRIPTS execution stopped\n");
1362}
1363
1364static uint8_t lsi_reg_readb(LSIState *s, int offset)
1365{
1366 uint8_t tmp;
75f76531
AJ		 1367#define CASE_GET_REG24(name, addr) \
1368 case addr: return s->name & 0xff; \
1369 case addr + 1: return (s->name >> 8) & 0xff; \
1370 case addr + 2: return (s->name >> 16) & 0xff;
1371
7d8406be
PB		 1372#define CASE_GET_REG32(name, addr) \
1373 case addr: return s->name & 0xff; \
1374 case addr + 1: return (s->name >> 8) & 0xff; \
1375 case addr + 2: return (s->name >> 16) & 0xff; \
1376 case addr + 3: return (s->name >> 24) & 0xff;
1377
1378#ifdef DEBUG_LSI_REG
1379 DPRINTF("Read reg %x\n", offset);
1380#endif
1381 switch (offset) {
1382 case 0x00: /* SCNTL0 */
1383 return s->scntl0;
1384 case 0x01: /* SCNTL1 */
1385 return s->scntl1;
1386 case 0x02: /* SCNTL2 */
1387 return s->scntl2;
1388 case 0x03: /* SCNTL3 */
1389 return s->scntl3;
1390 case 0x04: /* SCID */
1391 return s->scid;
1392 case 0x05: /* SXFER */
1393 return s->sxfer;
1394 case 0x06: /* SDID */
1395 return s->sdid;
1396 case 0x07: /* GPREG0 */
1397 return 0x7f;
985a03b0
TS		 1398 case 0x08: /* Revision ID */
1399 return 0x00;
a917d384
PB		 1400 case 0xa: /* SSID */
1401 return s->ssid;
7d8406be
PB		 1402 case 0xb: /* SBCL */
1403 /* ??? This is not correct. However it's (hopefully) only
1404 used for diagnostics, so should be ok. */
1405 return 0;
1406 case 0xc: /* DSTAT */
1407 tmp = s->dstat | 0x80;
1408 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1409 s->dstat = 0;
1410 lsi_update_irq(s);
1411 return tmp;
1412 case 0x0d: /* SSTAT0 */
1413 return s->sstat0;
1414 case 0x0e: /* SSTAT1 */
1415 return s->sstat1;
1416 case 0x0f: /* SSTAT2 */
1417 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1418 CASE_GET_REG32(dsa, 0x10)
1419 case 0x14: /* ISTAT0 */
1420 return s->istat0;
ecabe8cc
AL		 1421 case 0x15: /* ISTAT1 */
1422 return s->istat1;
7d8406be
PB		 1423 case 0x16: /* MBOX0 */
1424 return s->mbox0;
1425 case 0x17: /* MBOX1 */
1426 return s->mbox1;
1427 case 0x18: /* CTEST0 */
1428 return 0xff;
1429 case 0x19: /* CTEST1 */
1430 return 0;
1431 case 0x1a: /* CTEST2 */
9167a69a 1432 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
7d8406be
PB		 1433 if (s->istat0 & LSI_ISTAT0_SIGP) {
1434 s->istat0 &= ~LSI_ISTAT0_SIGP;
1435 tmp |= LSI_CTEST2_SIGP;
1436 }
1437 return tmp;
1438 case 0x1b: /* CTEST3 */
1439 return s->ctest3;
1440 CASE_GET_REG32(temp, 0x1c)
1441 case 0x20: /* DFIFO */
1442 return 0;
1443 case 0x21: /* CTEST4 */
1444 return s->ctest4;
1445 case 0x22: /* CTEST5 */
1446 return s->ctest5;
985a03b0
TS		 1447 case 0x23: /* CTEST6 */
1448 return 0;
75f76531 1449 CASE_GET_REG24(dbc, 0x24)
7d8406be
PB		 1450 case 0x27: /* DCMD */
1451 return s->dcmd;
4b9a2d6d 1452 CASE_GET_REG32(dnad, 0x28)
7d8406be
PB		 1453 CASE_GET_REG32(dsp, 0x2c)
1454 CASE_GET_REG32(dsps, 0x30)
1455 CASE_GET_REG32(scratch[0], 0x34)
1456 case 0x38: /* DMODE */
1457 return s->dmode;
1458 case 0x39: /* DIEN */
1459 return s->dien;
bd8ee11a
SH		 1460 case 0x3a: /* SBR */
1461 return s->sbr;
7d8406be
PB		 1462 case 0x3b: /* DCNTL */
1463 return s->dcntl;
1464 case 0x40: /* SIEN0 */
1465 return s->sien0;
1466 case 0x41: /* SIEN1 */
1467 return s->sien1;
1468 case 0x42: /* SIST0 */
1469 tmp = s->sist0;
1470 s->sist0 = 0;
1471 lsi_update_irq(s);
1472 return tmp;
1473 case 0x43: /* SIST1 */
1474 tmp = s->sist1;
1475 s->sist1 = 0;
1476 lsi_update_irq(s);
1477 return tmp;
9167a69a
AZ		 1478 case 0x46: /* MACNTL */
1479 return 0x0f;
7d8406be
PB		 1480 case 0x47: /* GPCNTL0 */
1481 return 0x0f;
1482 case 0x48: /* STIME0 */
1483 return s->stime0;
1484 case 0x4a: /* RESPID0 */
1485 return s->respid0;
1486 case 0x4b: /* RESPID1 */
1487 return s->respid1;
1488 case 0x4d: /* STEST1 */
1489 return s->stest1;
1490 case 0x4e: /* STEST2 */
1491 return s->stest2;
1492 case 0x4f: /* STEST3 */
1493 return s->stest3;
a917d384
PB		 1494 case 0x50: /* SIDL */
1495 /* This is needed by the linux drivers. We currently only update it
1496 during the MSG IN phase. */
1497 return s->sidl;
7d8406be
PB		 1498 case 0x52: /* STEST4 */
1499 return 0xe0;
1500 case 0x56: /* CCNTL0 */
1501 return s->ccntl0;
1502 case 0x57: /* CCNTL1 */
1503 return s->ccntl1;
a917d384
PB		 1504 case 0x58: /* SBDL */
1505 /* Some drivers peek at the data bus during the MSG IN phase. */
1506 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1507 return s->msg[0];
1508 return 0;
1509 case 0x59: /* SBDL high */
7d8406be
PB		 1510 return 0;
1511 CASE_GET_REG32(mmrs, 0xa0)
1512 CASE_GET_REG32(mmws, 0xa4)
1513 CASE_GET_REG32(sfs, 0xa8)
1514 CASE_GET_REG32(drs, 0xac)
1515 CASE_GET_REG32(sbms, 0xb0)
ab57d967 1516 CASE_GET_REG32(dbms, 0xb4)
7d8406be
PB		 1517 CASE_GET_REG32(dnad64, 0xb8)
1518 CASE_GET_REG32(pmjad1, 0xc0)
1519 CASE_GET_REG32(pmjad2, 0xc4)
1520 CASE_GET_REG32(rbc, 0xc8)
1521 CASE_GET_REG32(ua, 0xcc)
1522 CASE_GET_REG32(ia, 0xd4)
1523 CASE_GET_REG32(sbc, 0xd8)
1524 CASE_GET_REG32(csbc, 0xdc)
1525 }
1526 if (offset >= 0x5c && offset < 0xa0) {
1527 int n;
1528 int shift;
1529 n = (offset - 0x58) >> 2;
1530 shift = (offset & 3) * 8;
1531 return (s->scratch[n] >> shift) & 0xff;
1532 }
1533 BADF("readb 0x%x\n", offset);
1534 exit(1);
75f76531 1535#undef CASE_GET_REG24
7d8406be
PB		 1536#undef CASE_GET_REG32
1537}
1538
1539static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1540{
49c47daa
SH		 1541#define CASE_SET_REG24(name, addr) \
1542 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1543 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1544 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1545
7d8406be
PB		 1546#define CASE_SET_REG32(name, addr) \
1547 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1548 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1549 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1550 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1551
1552#ifdef DEBUG_LSI_REG
1553 DPRINTF("Write reg %x = %02x\n", offset, val);
1554#endif
1555 switch (offset) {
1556 case 0x00: /* SCNTL0 */
1557 s->scntl0 = val;
1558 if (val & LSI_SCNTL0_START) {
1559 BADF("Start sequence not implemented\n");
1560 }
1561 break;
1562 case 0x01: /* SCNTL1 */
1563 s->scntl1 = val & ~LSI_SCNTL1_SST;
1564 if (val & LSI_SCNTL1_IARB) {
1565 BADF("Immediate Arbritration not implemented\n");
1566 }
1567 if (val & LSI_SCNTL1_RST) {
1568 s->sstat0 |= LSI_SSTAT0_RST;
1569 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1570 } else {
1571 s->sstat0 &= ~LSI_SSTAT0_RST;
1572 }
1573 break;
1574 case 0x02: /* SCNTL2 */
1575 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
3d834c78 1576 s->scntl2 = val;
7d8406be
PB		 1577 break;
1578 case 0x03: /* SCNTL3 */
1579 s->scntl3 = val;
1580 break;
1581 case 0x04: /* SCID */
1582 s->scid = val;
1583 break;
1584 case 0x05: /* SXFER */
1585 s->sxfer = val;
1586 break;
a917d384
PB		 1587 case 0x06: /* SDID */
1588 if ((val & 0xf) != (s->ssid & 0xf))
1589 BADF("Destination ID does not match SSID\n");
1590 s->sdid = val & 0xf;
1591 break;
7d8406be
PB		 1592 case 0x07: /* GPREG0 */
1593 break;
a917d384
PB		 1594 case 0x08: /* SFBR */
1595 /* The CPU is not allowed to write to this register. However the
1596 SCRIPTS register move instructions are. */
1597 s->sfbr = val;
1598 break;
a15fdf86 1599 case 0x0a: case 0x0b:
9167a69a 1600 /* Openserver writes to these readonly registers on startup */
a15fdf86 1601 return;
7d8406be
PB		 1602 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1603 /* Linux writes to these readonly registers on startup. */
1604 return;
1605 CASE_SET_REG32(dsa, 0x10)
1606 case 0x14: /* ISTAT0 */
1607 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1608 if (val & LSI_ISTAT0_ABRT) {
1609 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1610 }
1611 if (val & LSI_ISTAT0_INTF) {
1612 s->istat0 &= ~LSI_ISTAT0_INTF;
1613 lsi_update_irq(s);
1614 }
4d611c9a 1615 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
7d8406be
PB		 1616 DPRINTF("Woken by SIGP\n");
1617 s->waiting = 0;
1618 s->dsp = s->dnad;
1619 lsi_execute_script(s);
1620 }
1621 if (val & LSI_ISTAT0_SRST) {
1622 lsi_soft_reset(s);
1623 }
92d88ecb 1624 break;
7d8406be
PB		 1625 case 0x16: /* MBOX0 */
1626 s->mbox0 = val;
92d88ecb 1627 break;
7d8406be
PB		 1628 case 0x17: /* MBOX1 */
1629 s->mbox1 = val;
92d88ecb 1630 break;
9167a69a
AZ		 1631 case 0x1a: /* CTEST2 */
1632 s->ctest2 = val & LSI_CTEST2_PCICIE;
1633 break;
7d8406be
PB		 1634 case 0x1b: /* CTEST3 */
1635 s->ctest3 = val & 0x0f;
1636 break;
1637 CASE_SET_REG32(temp, 0x1c)
1638 case 0x21: /* CTEST4 */
1639 if (val & 7) {
1640 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1641 }
1642 s->ctest4 = val;
1643 break;
1644 case 0x22: /* CTEST5 */
1645 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1646 BADF("CTEST5 DMA increment not implemented\n");
1647 }
1648 s->ctest5 = val;
1649 break;
49c47daa 1650 CASE_SET_REG24(dbc, 0x24)
4b9a2d6d 1651 CASE_SET_REG32(dnad, 0x28)
3d834c78 1652 case 0x2c: /* DSP[0:7] */
7d8406be
PB		 1653 s->dsp &= 0xffffff00;
1654 s->dsp |= val;
1655 break;
3d834c78 1656 case 0x2d: /* DSP[8:15] */
7d8406be
PB		 1657 s->dsp &= 0xffff00ff;
1658 s->dsp |= val << 8;
1659 break;
3d834c78 1660 case 0x2e: /* DSP[16:23] */
7d8406be
PB		 1661 s->dsp &= 0xff00ffff;
1662 s->dsp |= val << 16;
1663 break;
3d834c78 1664 case 0x2f: /* DSP[24:31] */
7d8406be
PB		 1665 s->dsp &= 0x00ffffff;
1666 s->dsp |= val << 24;
1667 if ((s->dmode & LSI_DMODE_MAN) == 0
1668 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1669 lsi_execute_script(s);
1670 break;
1671 CASE_SET_REG32(dsps, 0x30)
1672 CASE_SET_REG32(scratch[0], 0x34)
1673 case 0x38: /* DMODE */
1674 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1675 BADF("IO mappings not implemented\n");
1676 }
1677 s->dmode = val;
1678 break;
1679 case 0x39: /* DIEN */
1680 s->dien = val;
1681 lsi_update_irq(s);
1682 break;
bd8ee11a
SH		 1683 case 0x3a: /* SBR */
1684 s->sbr = val;
1685 break;
7d8406be
PB		 1686 case 0x3b: /* DCNTL */
1687 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1688 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1689 lsi_execute_script(s);
1690 break;
1691 case 0x40: /* SIEN0 */
1692 s->sien0 = val;
1693 lsi_update_irq(s);
1694 break;
1695 case 0x41: /* SIEN1 */
1696 s->sien1 = val;
1697 lsi_update_irq(s);
1698 break;
1699 case 0x47: /* GPCNTL0 */
1700 break;
1701 case 0x48: /* STIME0 */
1702 s->stime0 = val;
1703 break;
1704 case 0x49: /* STIME1 */
1705 if (val & 0xf) {
1706 DPRINTF("General purpose timer not implemented\n");
1707 /* ??? Raising the interrupt immediately seems to be sufficient
1708 to keep the FreeBSD driver happy. */
1709 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1710 }
1711 break;
1712 case 0x4a: /* RESPID0 */
1713 s->respid0 = val;
1714 break;
1715 case 0x4b: /* RESPID1 */
1716 s->respid1 = val;
1717 break;
1718 case 0x4d: /* STEST1 */
1719 s->stest1 = val;
1720 break;
1721 case 0x4e: /* STEST2 */
1722 if (val & 1) {
1723 BADF("Low level mode not implemented\n");
1724 }
1725 s->stest2 = val;
1726 break;
1727 case 0x4f: /* STEST3 */
1728 if (val & 0x41) {
1729 BADF("SCSI FIFO test mode not implemented\n");
1730 }
1731 s->stest3 = val;
1732 break;
1733 case 0x56: /* CCNTL0 */
1734 s->ccntl0 = val;
1735 break;
1736 case 0x57: /* CCNTL1 */
1737 s->ccntl1 = val;
1738 break;
1739 CASE_SET_REG32(mmrs, 0xa0)
1740 CASE_SET_REG32(mmws, 0xa4)
1741 CASE_SET_REG32(sfs, 0xa8)
1742 CASE_SET_REG32(drs, 0xac)
1743 CASE_SET_REG32(sbms, 0xb0)
ab57d967 1744 CASE_SET_REG32(dbms, 0xb4)
7d8406be
PB		 1745 CASE_SET_REG32(dnad64, 0xb8)
1746 CASE_SET_REG32(pmjad1, 0xc0)
1747 CASE_SET_REG32(pmjad2, 0xc4)
1748 CASE_SET_REG32(rbc, 0xc8)
1749 CASE_SET_REG32(ua, 0xcc)
1750 CASE_SET_REG32(ia, 0xd4)
1751 CASE_SET_REG32(sbc, 0xd8)
1752 CASE_SET_REG32(csbc, 0xdc)
1753 default:
1754 if (offset >= 0x5c && offset < 0xa0) {
1755 int n;
1756 int shift;
1757 n = (offset - 0x58) >> 2;
1758 shift = (offset & 3) * 8;
1759 s->scratch[n] &= ~(0xff << shift);
1760 s->scratch[n] |= (val & 0xff) << shift;
1761 } else {
1762 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1763 }
1764 }
49c47daa 1765#undef CASE_SET_REG24
7d8406be
PB		 1766#undef CASE_SET_REG32
1767}
1768
c227f099 1769static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1770{
eb40f984 1771 LSIState *s = opaque;
7d8406be
PB		 1772
1773 lsi_reg_writeb(s, addr & 0xff, val);
1774}
1775
c227f099 1776static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1777{
eb40f984 1778 LSIState *s = opaque;
7d8406be
PB		 1779
1780 addr &= 0xff;
1781 lsi_reg_writeb(s, addr, val & 0xff);
1782 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1783}
1784
c227f099 1785static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1786{
eb40f984 1787 LSIState *s = opaque;
7d8406be
PB		 1788
1789 addr &= 0xff;
1790 lsi_reg_writeb(s, addr, val & 0xff);
1791 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1792 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1793 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1794}
1795
c227f099 1796static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
7d8406be 1797{
eb40f984 1798 LSIState *s = opaque;
7d8406be
PB		 1799
1800 return lsi_reg_readb(s, addr & 0xff);
1801}
1802
c227f099 1803static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
7d8406be 1804{
eb40f984 1805 LSIState *s = opaque;
7d8406be
PB		 1806 uint32_t val;
1807
1808 addr &= 0xff;
1809 val = lsi_reg_readb(s, addr);
1810 val |= lsi_reg_readb(s, addr + 1) << 8;
1811 return val;
1812}
1813
c227f099 1814static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
7d8406be 1815{
eb40f984 1816 LSIState *s = opaque;
7d8406be
PB		 1817 uint32_t val;
1818 addr &= 0xff;
1819 val = lsi_reg_readb(s, addr);
1820 val |= lsi_reg_readb(s, addr + 1) << 8;
1821 val |= lsi_reg_readb(s, addr + 2) << 16;
1822 val |= lsi_reg_readb(s, addr + 3) << 24;
1823 return val;
1824}
1825
d60efc6b 1826static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
7d8406be
PB		 1827 lsi_mmio_readb,
1828 lsi_mmio_readw,
1829 lsi_mmio_readl,
1830};
1831
d60efc6b 1832static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
7d8406be
PB		 1833 lsi_mmio_writeb,
1834 lsi_mmio_writew,
1835 lsi_mmio_writel,
1836};
1837
c227f099 1838static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1839{
eb40f984 1840 LSIState *s = opaque;
7d8406be
PB		 1841 uint32_t newval;
1842 int shift;
1843
1844 addr &= 0x1fff;
1845 newval = s->script_ram[addr >> 2];
1846 shift = (addr & 3) * 8;
1847 newval &= ~(0xff << shift);
1848 newval |= val << shift;
1849 s->script_ram[addr >> 2] = newval;
1850}
1851
c227f099 1852static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1853{
eb40f984 1854 LSIState *s = opaque;
7d8406be
PB		 1855 uint32_t newval;
1856
1857 addr &= 0x1fff;
1858 newval = s->script_ram[addr >> 2];
1859 if (addr & 2) {
1860 newval = (newval & 0xffff) | (val << 16);
1861 } else {
1862 newval = (newval & 0xffff0000) | val;
1863 }
1864 s->script_ram[addr >> 2] = newval;
1865}
1866
1867
c227f099 1868static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
7d8406be 1869{
eb40f984 1870 LSIState *s = opaque;
7d8406be
PB		 1871
1872 addr &= 0x1fff;
1873 s->script_ram[addr >> 2] = val;
1874}
1875
c227f099 1876static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
7d8406be 1877{
eb40f984 1878 LSIState *s = opaque;
7d8406be
PB		 1879 uint32_t val;
1880
1881 addr &= 0x1fff;
1882 val = s->script_ram[addr >> 2];
1883 val >>= (addr & 3) * 8;
1884 return val & 0xff;
1885}
1886
c227f099 1887static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
7d8406be 1888{
eb40f984 1889 LSIState *s = opaque;
7d8406be
PB		 1890 uint32_t val;
1891
1892 addr &= 0x1fff;
1893 val = s->script_ram[addr >> 2];
1894 if (addr & 2)
1895 val >>= 16;
1896 return le16_to_cpu(val);
1897}
1898
c227f099 1899static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
7d8406be 1900{
eb40f984 1901 LSIState *s = opaque;
7d8406be
PB		 1902
1903 addr &= 0x1fff;
1904 return le32_to_cpu(s->script_ram[addr >> 2]);
1905}
1906
d60efc6b 1907static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
7d8406be
PB		 1908 lsi_ram_readb,
1909 lsi_ram_readw,
1910 lsi_ram_readl,
1911};
1912
d60efc6b 1913static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
7d8406be
PB		 1914 lsi_ram_writeb,
1915 lsi_ram_writew,
1916 lsi_ram_writel,
1917};
1918
1919static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1920{
eb40f984 1921 LSIState *s = opaque;
7d8406be
PB		 1922 return lsi_reg_readb(s, addr & 0xff);
1923}
1924
1925static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1926{
eb40f984 1927 LSIState *s = opaque;
7d8406be
PB		 1928 uint32_t val;
1929 addr &= 0xff;
1930 val = lsi_reg_readb(s, addr);
1931 val |= lsi_reg_readb(s, addr + 1) << 8;
1932 return val;
1933}
1934
1935static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1936{
eb40f984 1937 LSIState *s = opaque;
7d8406be
PB		 1938 uint32_t val;
1939 addr &= 0xff;
1940 val = lsi_reg_readb(s, addr);
1941 val |= lsi_reg_readb(s, addr + 1) << 8;
1942 val |= lsi_reg_readb(s, addr + 2) << 16;
1943 val |= lsi_reg_readb(s, addr + 3) << 24;
1944 return val;
1945}
1946
1947static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1948{
eb40f984 1949 LSIState *s = opaque;
7d8406be
PB		 1950 lsi_reg_writeb(s, addr & 0xff, val);
1951}
1952
1953static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1954{
eb40f984 1955 LSIState *s = opaque;
7d8406be
PB		 1956 addr &= 0xff;
1957 lsi_reg_writeb(s, addr, val & 0xff);
1958 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1959}
1960
1961static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1962{
eb40f984 1963 LSIState *s = opaque;
7d8406be
PB		 1964 addr &= 0xff;
1965 lsi_reg_writeb(s, addr, val & 0xff);
1966 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1967 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
dcfb9014 1968 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
7d8406be
PB		 1969}
1970
5fafdf24 1971static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
6e355d90 1972 pcibus_t addr, pcibus_t size, int type)
7d8406be 1973{
f305261f 1974 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
7d8406be 1975
b4b2f054 1976 DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
7d8406be
PB		 1977
1978 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1979 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1980 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1981 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1982 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1983 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1984}
1985
5fafdf24 1986static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
6e355d90 1987 pcibus_t addr, pcibus_t size, int type)
7d8406be 1988{
f305261f 1989 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
7d8406be 1990
b4b2f054 1991 DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
7d8406be
PB		 1992 s->script_ram_base = addr;
1993 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1994}
1995
5fafdf24 1996static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
6e355d90 1997 pcibus_t addr, pcibus_t size, int type)
7d8406be 1998{
f305261f 1999 LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
7d8406be 2000
b4b2f054 2001 DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
7d8406be
PB		 2002 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
2003}
2004
4a1b0f1c 2005static void lsi_pre_save(void *opaque)
777aec7a
N		 2006{
2007 LSIState *s = opaque;
2008
2009 assert(s->dma_buf == NULL);
2010 assert(s->current_dma_len == 0);
2011 assert(s->active_commands == 0);
777aec7a
N		 2012}
2013
4a1b0f1c
JQ		 2014static const VMStateDescription vmstate_lsi_scsi = {
2015 .name = "lsiscsi",
2016 .version_id = 0,
2017 .minimum_version_id = 0,
2018 .minimum_version_id_old = 0,
2019 .pre_save = lsi_pre_save,
2020 .fields = (VMStateField []) {
2021 VMSTATE_PCI_DEVICE(dev, LSIState),
2022
2023 VMSTATE_INT32(carry, LSIState),
2024 VMSTATE_INT32(sense, LSIState),
2025 VMSTATE_INT32(msg_action, LSIState),
2026 VMSTATE_INT32(msg_len, LSIState),
2027 VMSTATE_BUFFER(msg, LSIState),
2028 VMSTATE_INT32(waiting, LSIState),
2029
2030 VMSTATE_UINT32(dsa, LSIState),
2031 VMSTATE_UINT32(temp, LSIState),
2032 VMSTATE_UINT32(dnad, LSIState),
2033 VMSTATE_UINT32(dbc, LSIState),
2034 VMSTATE_UINT8(istat0, LSIState),
2035 VMSTATE_UINT8(istat1, LSIState),
2036 VMSTATE_UINT8(dcmd, LSIState),
2037 VMSTATE_UINT8(dstat, LSIState),
2038 VMSTATE_UINT8(dien, LSIState),
2039 VMSTATE_UINT8(sist0, LSIState),
2040 VMSTATE_UINT8(sist1, LSIState),
2041 VMSTATE_UINT8(sien0, LSIState),
2042 VMSTATE_UINT8(sien1, LSIState),
2043 VMSTATE_UINT8(mbox0, LSIState),
2044 VMSTATE_UINT8(mbox1, LSIState),
2045 VMSTATE_UINT8(dfifo, LSIState),
2046 VMSTATE_UINT8(ctest2, LSIState),
2047 VMSTATE_UINT8(ctest3, LSIState),
2048 VMSTATE_UINT8(ctest4, LSIState),
2049 VMSTATE_UINT8(ctest5, LSIState),
2050 VMSTATE_UINT8(ccntl0, LSIState),
2051 VMSTATE_UINT8(ccntl1, LSIState),
2052 VMSTATE_UINT32(dsp, LSIState),
2053 VMSTATE_UINT32(dsps, LSIState),
2054 VMSTATE_UINT8(dmode, LSIState),
2055 VMSTATE_UINT8(dcntl, LSIState),
2056 VMSTATE_UINT8(scntl0, LSIState),
2057 VMSTATE_UINT8(scntl1, LSIState),
2058 VMSTATE_UINT8(scntl2, LSIState),
2059 VMSTATE_UINT8(scntl3, LSIState),
2060 VMSTATE_UINT8(sstat0, LSIState),
2061 VMSTATE_UINT8(sstat1, LSIState),
2062 VMSTATE_UINT8(scid, LSIState),
2063 VMSTATE_UINT8(sxfer, LSIState),
2064 VMSTATE_UINT8(socl, LSIState),
2065 VMSTATE_UINT8(sdid, LSIState),
2066 VMSTATE_UINT8(ssid, LSIState),
2067 VMSTATE_UINT8(sfbr, LSIState),
2068 VMSTATE_UINT8(stest1, LSIState),
2069 VMSTATE_UINT8(stest2, LSIState),
2070 VMSTATE_UINT8(stest3, LSIState),
2071 VMSTATE_UINT8(sidl, LSIState),
2072 VMSTATE_UINT8(stime0, LSIState),
2073 VMSTATE_UINT8(respid0, LSIState),
2074 VMSTATE_UINT8(respid1, LSIState),
2075 VMSTATE_UINT32(mmrs, LSIState),
2076 VMSTATE_UINT32(mmws, LSIState),
2077 VMSTATE_UINT32(sfs, LSIState),
2078 VMSTATE_UINT32(drs, LSIState),
2079 VMSTATE_UINT32(sbms, LSIState),
2080 VMSTATE_UINT32(dbms, LSIState),
2081 VMSTATE_UINT32(dnad64, LSIState),
2082 VMSTATE_UINT32(pmjad1, LSIState),
2083 VMSTATE_UINT32(pmjad2, LSIState),
2084 VMSTATE_UINT32(rbc, LSIState),
2085 VMSTATE_UINT32(ua, LSIState),
2086 VMSTATE_UINT32(ia, LSIState),
2087 VMSTATE_UINT32(sbc, LSIState),
2088 VMSTATE_UINT32(csbc, LSIState),
2089 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2090 VMSTATE_UINT8(sbr, LSIState),
2091
2092 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2093 VMSTATE_END_OF_LIST()
777aec7a 2094 }
4a1b0f1c 2095};
777aec7a 2096
4b09be85
AL		 2097static int lsi_scsi_uninit(PCIDevice *d)
2098{
f305261f 2099 LSIState *s = DO_UPCAST(LSIState, dev, d);
4b09be85
AL		 2100
2101 cpu_unregister_io_memory(s->mmio_io_addr);
2102 cpu_unregister_io_memory(s->ram_io_addr);
2103
2104 qemu_free(s->queue);
2105
2106 return 0;
2107}
2108
81a322d4 2109static int lsi_scsi_init(PCIDevice *dev)
7d8406be 2110{
f305261f 2111 LSIState *s = DO_UPCAST(LSIState, dev, dev);
deb54399 2112 uint8_t *pci_conf;
7d8406be 2113
f305261f 2114 pci_conf = s->dev.config;
deb54399 2115
9167a69a 2116 /* PCI Vendor ID (word) */
deb54399 2117 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
9167a69a 2118 /* PCI device ID (word) */
deb54399 2119 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
9167a69a 2120 /* PCI base class code */
173a543b 2121 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
9167a69a 2122 /* PCI subsystem ID */
5845f0e5
MT		 2123 pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2124 pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
9167a69a 2125 /* PCI latency timer = 255 */
5845f0e5
MT		 2126 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2127 /* TODO: RST# value should be 0 */
9167a69a 2128 /* Interrupt pin 1 */
5845f0e5 2129 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
7d8406be 2130
1eed09cb 2131 s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
7d8406be 2132 lsi_mmio_writefn, s);
1eed09cb 2133 s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
7d8406be
PB		 2134 lsi_ram_writefn, s);
2135
5845f0e5 2136 /* TODO: use dev and get rid of cast below */
28c2c264 2137 pci_register_bar((struct PCIDevice *)s, 0, 256,
0392a017 2138 PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
28c2c264 2139 pci_register_bar((struct PCIDevice *)s, 1, 0x400,
0392a017 2140 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
28c2c264 2141 pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
0392a017 2142 PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
a917d384
PB		 2143 s->queue = qemu_malloc(sizeof(lsi_queue));
2144 s->queue_len = 1;
2145 s->active_commands = 0;
7d8406be
PB		 2146
2147 lsi_soft_reset(s);
2148
ca9c39fa 2149 scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
5b684b5a
GH		 2150 if (!dev->qdev.hotplugged) {
2151 scsi_bus_legacy_handle_cmdline(&s->bus);
2152 }
81a322d4 2153 return 0;
7d8406be 2154}
9be5dafe 2155
0aab0d3a 2156static PCIDeviceInfo lsi_info = {
d52affa7
GH		 2157 .qdev.name = "lsi53c895a",
2158 .qdev.alias = "lsi",
2159 .qdev.size = sizeof(LSIState),
be73cfe2 2160 .qdev.vmsd = &vmstate_lsi_scsi,
d52affa7 2161 .init = lsi_scsi_init,
e3936fa5 2162 .exit = lsi_scsi_uninit,
0aab0d3a
GH		 2163};
2164
9be5dafe
PB		 2165static void lsi53c895a_register_devices(void)
2166{
0aab0d3a 2167 pci_qdev_register(&lsi_info);
9be5dafe
PB		 2168}
2169
2170device_init(lsi53c895a_register_devices);
Qemu copy for testing