]> git.proxmox.com Git - qemu.git/blame - hw/lsi53c895a.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge remote-tracking branch 'riku/linux-user-for-upstream' into staging
[qemu.git] / hw / lsi53c895a.c
CommitLineData
5fafdf24 1/*
7d8406be
PB		 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
8e31bf38 7 * This code is licensed under the LGPL.
7d8406be
PB		 8 */
9
10/* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
a15fdf86 13#include <assert.h>
777aec7a 14
87ecb68b
PB		 15#include "hw.h"
16#include "pci.h"
43b443b6 17#include "scsi.h"
9ba4524c 18#include "dma.h"
7d8406be
PB		 19
20//#define DEBUG_LSI
21//#define DEBUG_LSI_REG
22
23#ifdef DEBUG_LSI
001faf32
BS		 24#define DPRINTF(fmt, ...) \
25do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26#define BADF(fmt, ...) \
27do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
7d8406be 28#else
001faf32
BS		 29#define DPRINTF(fmt, ...) do {} while(0)
30#define BADF(fmt, ...) \
31do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
7d8406be
PB		 32#endif
33
18e08a55
MT		 34#define LSI_MAX_DEVS 7
35
7d8406be
PB		 36#define LSI_SCNTL0_TRG 0x01
37#define LSI_SCNTL0_AAP 0x02
38#define LSI_SCNTL0_EPC 0x08
39#define LSI_SCNTL0_WATN 0x10
40#define LSI_SCNTL0_START 0x20
41
42#define LSI_SCNTL1_SST 0x01
43#define LSI_SCNTL1_IARB 0x02
44#define LSI_SCNTL1_AESP 0x04
45#define LSI_SCNTL1_RST 0x08
46#define LSI_SCNTL1_CON 0x10
47#define LSI_SCNTL1_DHP 0x20
48#define LSI_SCNTL1_ADB 0x40
49#define LSI_SCNTL1_EXC 0x80
50
51#define LSI_SCNTL2_WSR 0x01
52#define LSI_SCNTL2_VUE0 0x02
53#define LSI_SCNTL2_VUE1 0x04
54#define LSI_SCNTL2_WSS 0x08
55#define LSI_SCNTL2_SLPHBEN 0x10
56#define LSI_SCNTL2_SLPMD 0x20
57#define LSI_SCNTL2_CHM 0x40
58#define LSI_SCNTL2_SDU 0x80
59
60#define LSI_ISTAT0_DIP 0x01
61#define LSI_ISTAT0_SIP 0x02
62#define LSI_ISTAT0_INTF 0x04
63#define LSI_ISTAT0_CON 0x08
64#define LSI_ISTAT0_SEM 0x10
65#define LSI_ISTAT0_SIGP 0x20
66#define LSI_ISTAT0_SRST 0x40
67#define LSI_ISTAT0_ABRT 0x80
68
69#define LSI_ISTAT1_SI 0x01
70#define LSI_ISTAT1_SRUN 0x02
71#define LSI_ISTAT1_FLSH 0x04
72
73#define LSI_SSTAT0_SDP0 0x01
74#define LSI_SSTAT0_RST 0x02
75#define LSI_SSTAT0_WOA 0x04
76#define LSI_SSTAT0_LOA 0x08
77#define LSI_SSTAT0_AIP 0x10
78#define LSI_SSTAT0_OLF 0x20
79#define LSI_SSTAT0_ORF 0x40
80#define LSI_SSTAT0_ILF 0x80
81
82#define LSI_SIST0_PAR 0x01
83#define LSI_SIST0_RST 0x02
84#define LSI_SIST0_UDC 0x04
85#define LSI_SIST0_SGE 0x08
86#define LSI_SIST0_RSL 0x10
87#define LSI_SIST0_SEL 0x20
88#define LSI_SIST0_CMP 0x40
89#define LSI_SIST0_MA 0x80
90
91#define LSI_SIST1_HTH 0x01
92#define LSI_SIST1_GEN 0x02
93#define LSI_SIST1_STO 0x04
94#define LSI_SIST1_SBMC 0x10
95
96#define LSI_SOCL_IO 0x01
97#define LSI_SOCL_CD 0x02
98#define LSI_SOCL_MSG 0x04
99#define LSI_SOCL_ATN 0x08
100#define LSI_SOCL_SEL 0x10
101#define LSI_SOCL_BSY 0x20
102#define LSI_SOCL_ACK 0x40
103#define LSI_SOCL_REQ 0x80
104
105#define LSI_DSTAT_IID 0x01
106#define LSI_DSTAT_SIR 0x04
107#define LSI_DSTAT_SSI 0x08
108#define LSI_DSTAT_ABRT 0x10
109#define LSI_DSTAT_BF 0x20
110#define LSI_DSTAT_MDPE 0x40
111#define LSI_DSTAT_DFE 0x80
112
113#define LSI_DCNTL_COM 0x01
114#define LSI_DCNTL_IRQD 0x02
115#define LSI_DCNTL_STD 0x04
116#define LSI_DCNTL_IRQM 0x08
117#define LSI_DCNTL_SSM 0x10
118#define LSI_DCNTL_PFEN 0x20
119#define LSI_DCNTL_PFF 0x40
120#define LSI_DCNTL_CLSE 0x80
121
122#define LSI_DMODE_MAN 0x01
123#define LSI_DMODE_BOF 0x02
124#define LSI_DMODE_ERMP 0x04
125#define LSI_DMODE_ERL 0x08
126#define LSI_DMODE_DIOM 0x10
127#define LSI_DMODE_SIOM 0x20
128
129#define LSI_CTEST2_DACK 0x01
130#define LSI_CTEST2_DREQ 0x02
131#define LSI_CTEST2_TEOP 0x04
132#define LSI_CTEST2_PCICIE 0x08
133#define LSI_CTEST2_CM 0x10
134#define LSI_CTEST2_CIO 0x20
135#define LSI_CTEST2_SIGP 0x40
136#define LSI_CTEST2_DDIR 0x80
137
138#define LSI_CTEST5_BL2 0x04
139#define LSI_CTEST5_DDIR 0x08
140#define LSI_CTEST5_MASR 0x10
141#define LSI_CTEST5_DFSN 0x20
142#define LSI_CTEST5_BBCK 0x40
143#define LSI_CTEST5_ADCK 0x80
144
145#define LSI_CCNTL0_DILS 0x01
146#define LSI_CCNTL0_DISFC 0x10
147#define LSI_CCNTL0_ENNDJ 0x20
148#define LSI_CCNTL0_PMJCTL 0x40
149#define LSI_CCNTL0_ENPMJ 0x80
150
b25cf589
AL		 151#define LSI_CCNTL1_EN64DBMV 0x01
152#define LSI_CCNTL1_EN64TIBMV 0x02
153#define LSI_CCNTL1_64TIMOD 0x04
154#define LSI_CCNTL1_DDAC 0x08
155#define LSI_CCNTL1_ZMOD 0x80
156
e560125e
LA		 157/* Enable Response to Reselection */
158#define LSI_SCID_RRE 0x60
159
b25cf589
AL		 160#define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
7d8406be
PB		 162#define PHASE_DO 0
163#define PHASE_DI 1
164#define PHASE_CMD 2
165#define PHASE_ST 3
166#define PHASE_MO 6
167#define PHASE_MI 7
168#define PHASE_MASK 7
169
a917d384
PB		 170/* Maximum length of MSG IN data. */
171#define LSI_MAX_MSGIN_LEN 8
172
173/* Flag set if this is a tagged command. */
174#define LSI_TAG_VALID (1 << 16)
175
042ec49d 176typedef struct lsi_request {
5c6c0e51 177 SCSIRequest *req;
a917d384 178 uint32_t tag;
b96a0da0
GH		 179 uint32_t dma_len;
180 uint8_t *dma_buf;
a917d384
PB		 181 uint32_t pending;
182 int out;
042ec49d
GH		 183 QTAILQ_ENTRY(lsi_request) next;
184} lsi_request;
4d611c9a 185
7d8406be 186typedef struct {
f305261f 187 PCIDevice dev;
b0ce84e5
AK		 188 MemoryRegion mmio_io;
189 MemoryRegion ram_io;
190 MemoryRegion io_io;
7d8406be
PB		 191
192 int carry; /* ??? Should this be an a visible register somewhere? */
2f172849 193 int status;
a917d384 194 /* Action to take at the end of a MSG IN phase.
a15fdf86 195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
a917d384
PB		 196 int msg_action;
197 int msg_len;
198 uint8_t msg[LSI_MAX_MSGIN_LEN];
4d611c9a
PB		 199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
a917d384
PB		 201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
7d8406be 203 int waiting;
ca9c39fa 204 SCSIBus bus;
7d8406be 205 int current_lun;
a917d384 206 /* The tag is a combination of the device ID and the SCSI tag. */
af12ac98 207 uint32_t select_tag;
8ccc2ace 208 int command_complete;
042ec49d 209 QTAILQ_HEAD(, lsi_request) queue;
af12ac98 210 lsi_request *current;
7d8406be
PB		 211
212 uint32_t dsa;
213 uint32_t temp;
214 uint32_t dnad;
215 uint32_t dbc;
216 uint8_t istat0;
217 uint8_t istat1;
218 uint8_t dcmd;
219 uint8_t dstat;
220 uint8_t dien;
221 uint8_t sist0;
222 uint8_t sist1;
223 uint8_t sien0;
224 uint8_t sien1;
225 uint8_t mbox0;
226 uint8_t mbox1;
227 uint8_t dfifo;
9167a69a 228 uint8_t ctest2;
7d8406be
PB		 229 uint8_t ctest3;
230 uint8_t ctest4;
231 uint8_t ctest5;
232 uint8_t ccntl0;
233 uint8_t ccntl1;
234 uint32_t dsp;
235 uint32_t dsps;
236 uint8_t dmode;
237 uint8_t dcntl;
238 uint8_t scntl0;
239 uint8_t scntl1;
240 uint8_t scntl2;
241 uint8_t scntl3;
242 uint8_t sstat0;
243 uint8_t sstat1;
244 uint8_t scid;
245 uint8_t sxfer;
246 uint8_t socl;
247 uint8_t sdid;
a917d384 248 uint8_t ssid;
7d8406be
PB		 249 uint8_t sfbr;
250 uint8_t stest1;
251 uint8_t stest2;
252 uint8_t stest3;
a917d384 253 uint8_t sidl;
7d8406be
PB		 254 uint8_t stime0;
255 uint8_t respid0;
256 uint8_t respid1;
257 uint32_t mmrs;
258 uint32_t mmws;
259 uint32_t sfs;
260 uint32_t drs;
261 uint32_t sbms;
ab57d967 262 uint32_t dbms;
7d8406be
PB		 263 uint32_t dnad64;
264 uint32_t pmjad1;
265 uint32_t pmjad2;
266 uint32_t rbc;
267 uint32_t ua;
268 uint32_t ia;
269 uint32_t sbc;
270 uint32_t csbc;
dcfb9014 271 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
bd8ee11a 272 uint8_t sbr;
7d8406be
PB		 273
274 /* Script ram is stored as 32-bit words in host byteorder. */
275 uint32_t script_ram[2048];
276} LSIState;
277
e560125e
LA		 278static inline int lsi_irq_on_rsl(LSIState *s)
279{
280 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
281}
282
7d8406be
PB		 283static void lsi_soft_reset(LSIState *s)
284{
51336214
JK		 285 lsi_request *p;
286
7d8406be
PB		 287 DPRINTF("Reset\n");
288 s->carry = 0;
289
d43ba0af
JK		 290 s->msg_action = 0;
291 s->msg_len = 0;
7d8406be
PB		 292 s->waiting = 0;
293 s->dsa = 0;
294 s->dnad = 0;
295 s->dbc = 0;
296 s->temp = 0;
297 memset(s->scratch, 0, sizeof(s->scratch));
298 s->istat0 = 0;
299 s->istat1 = 0;
12aa6dd6
JK		 300 s->dcmd = 0x40;
301 s->dstat = LSI_DSTAT_DFE;
7d8406be
PB		 302 s->dien = 0;
303 s->sist0 = 0;
304 s->sist1 = 0;
305 s->sien0 = 0;
306 s->sien1 = 0;
307 s->mbox0 = 0;
308 s->mbox1 = 0;
309 s->dfifo = 0;
12aa6dd6 310 s->ctest2 = LSI_CTEST2_DACK;
7d8406be
PB		 311 s->ctest3 = 0;
312 s->ctest4 = 0;
313 s->ctest5 = 0;
314 s->ccntl0 = 0;
315 s->ccntl1 = 0;
316 s->dsp = 0;
317 s->dsps = 0;
318 s->dmode = 0;
319 s->dcntl = 0;
320 s->scntl0 = 0xc0;
321 s->scntl1 = 0;
322 s->scntl2 = 0;
323 s->scntl3 = 0;
324 s->sstat0 = 0;
325 s->sstat1 = 0;
326 s->scid = 7;
327 s->sxfer = 0;
328 s->socl = 0;
12aa6dd6
JK		 329 s->sdid = 0;
330 s->ssid = 0;
7d8406be
PB		 331 s->stest1 = 0;
332 s->stest2 = 0;
333 s->stest3 = 0;
a917d384 334 s->sidl = 0;
7d8406be
PB		 335 s->stime0 = 0;
336 s->respid0 = 0x80;
337 s->respid1 = 0;
338 s->mmrs = 0;
339 s->mmws = 0;
340 s->sfs = 0;
341 s->drs = 0;
342 s->sbms = 0;
ab57d967 343 s->dbms = 0;
7d8406be
PB		 344 s->dnad64 = 0;
345 s->pmjad1 = 0;
346 s->pmjad2 = 0;
347 s->rbc = 0;
348 s->ua = 0;
349 s->ia = 0;
350 s->sbc = 0;
351 s->csbc = 0;
bd8ee11a 352 s->sbr = 0;
51336214
JK		 353 while (!QTAILQ_EMPTY(&s->queue)) {
354 p = QTAILQ_FIRST(&s->queue);
355 QTAILQ_REMOVE(&s->queue, p, next);
7267c094 356 g_free(p);
51336214
JK		 357 }
358 if (s->current) {
7267c094 359 g_free(s->current);
51336214
JK		 360 s->current = NULL;
361 }
7d8406be
PB		 362}
363
b25cf589
AL		 364static int lsi_dma_40bit(LSIState *s)
365{
366 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
367 return 1;
368 return 0;
369}
370
dd8edf01
AL		 371static int lsi_dma_ti64bit(LSIState *s)
372{
373 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
374 return 1;
375 return 0;
376}
377
378static int lsi_dma_64bit(LSIState *s)
379{
380 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
381 return 1;
382 return 0;
383}
384
7d8406be
PB		 385static uint8_t lsi_reg_readb(LSIState *s, int offset);
386static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
4d611c9a 387static void lsi_execute_script(LSIState *s);
aa4d32c4 388static void lsi_reselect(LSIState *s, lsi_request *p);
7d8406be
PB		 389
390static inline uint32_t read_dword(LSIState *s, uint32_t addr)
391{
392 uint32_t buf;
393
9e486d67 394 pci_dma_read(&s->dev, addr, &buf, 4);
7d8406be
PB		 395 return cpu_to_le32(buf);
396}
397
398static void lsi_stop_script(LSIState *s)
399{
400 s->istat1 &= ~LSI_ISTAT1_SRUN;
401}
402
403static void lsi_update_irq(LSIState *s)
404{
405 int level;
406 static int last_level;
042ec49d 407 lsi_request *p;
7d8406be
PB		 408
409 /* It's unclear whether the DIP/SIP bits should be cleared when the
410 Interrupt Status Registers are cleared or when istat0 is read.
411 We currently do the formwer, which seems to work. */
412 level = 0;
413 if (s->dstat) {
414 if (s->dstat & s->dien)
415 level = 1;
416 s->istat0 |= LSI_ISTAT0_DIP;
417 } else {
418 s->istat0 &= ~LSI_ISTAT0_DIP;
419 }
420
421 if (s->sist0 || s->sist1) {
422 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
423 level = 1;
424 s->istat0 |= LSI_ISTAT0_SIP;
425 } else {
426 s->istat0 &= ~LSI_ISTAT0_SIP;
427 }
428 if (s->istat0 & LSI_ISTAT0_INTF)
429 level = 1;
430
431 if (level != last_level) {
432 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
433 level, s->dstat, s->sist1, s->sist0);
434 last_level = level;
435 }
f305261f 436 qemu_set_irq(s->dev.irq[0], level);
e560125e
LA		 437
438 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
439 DPRINTF("Handled IRQs & disconnected, looking for pending "
440 "processes\n");
042ec49d
GH		 441 QTAILQ_FOREACH(p, &s->queue, next) {
442 if (p->pending) {
aa4d32c4 443 lsi_reselect(s, p);
e560125e
LA		 444 break;
445 }
446 }
447 }
7d8406be
PB		 448}
449
450/* Stop SCRIPTS execution and raise a SCSI interrupt. */
451static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
452{
453 uint32_t mask0;
454 uint32_t mask1;
455
456 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
457 stat1, stat0, s->sist1, s->sist0);
458 s->sist0 |= stat0;
459 s->sist1 |= stat1;
460 /* Stop processor on fatal or unmasked interrupt. As a special hack
461 we don't stop processing when raising STO. Instead continue
462 execution and stop at the next insn that accesses the SCSI bus. */
463 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
464 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
465 mask1 &= ~LSI_SIST1_STO;
466 if (s->sist0 & mask0 || s->sist1 & mask1) {
467 lsi_stop_script(s);
468 }
469 lsi_update_irq(s);
470}
471
472/* Stop SCRIPTS execution and raise a DMA interrupt. */
473static void lsi_script_dma_interrupt(LSIState *s, int stat)
474{
475 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
476 s->dstat |= stat;
477 lsi_update_irq(s);
478 lsi_stop_script(s);
479}
480
481static inline void lsi_set_phase(LSIState *s, int phase)
482{
483 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
484}
485
486static void lsi_bad_phase(LSIState *s, int out, int new_phase)
487{
488 /* Trigger a phase mismatch. */
489 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
d1d74664
PB		 490 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
491 s->dsp = out ? s->pmjad1 : s->pmjad2;
7d8406be 492 } else {
d1d74664 493 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
7d8406be
PB		 494 }
495 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
496 } else {
497 DPRINTF("Phase mismatch interrupt\n");
498 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
499 lsi_stop_script(s);
500 }
501 lsi_set_phase(s, new_phase);
502}
503
a917d384
PB		 504
505/* Resume SCRIPTS execution after a DMA operation. */
506static void lsi_resume_script(LSIState *s)
507{
508 if (s->waiting != 2) {
509 s->waiting = 0;
510 lsi_execute_script(s);
511 } else {
512 s->waiting = 0;
513 }
514}
515
64d56409
JK		 516static void lsi_disconnect(LSIState *s)
517{
518 s->scntl1 &= ~LSI_SCNTL1_CON;
519 s->sstat1 &= ~PHASE_MASK;
520}
521
522static void lsi_bad_selection(LSIState *s, uint32_t id)
523{
524 DPRINTF("Selected absent target %d\n", id);
525 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
526 lsi_disconnect(s);
527}
528
4d611c9a 529/* Initiate a SCSI layer data transfer. */
7d8406be
PB		 530static void lsi_do_dma(LSIState *s, int out)
531{
f48a7a6e 532 uint32_t count;
9ba4524c 533 dma_addr_t addr;
64d56409 534 SCSIDevice *dev;
7d8406be 535
b96a0da0
GH		 536 assert(s->current);
537 if (!s->current->dma_len) {
a917d384
PB		 538 /* Wait until data is available. */
539 DPRINTF("DMA no data available\n");
540 return;
7d8406be
PB		 541 }
542
f48a7a6e
PB		 543 dev = s->current->req->dev;
544 assert(dev);
64d56409 545
a917d384 546 count = s->dbc;
b96a0da0
GH		 547 if (count > s->current->dma_len)
548 count = s->current->dma_len;
a917d384
PB		 549
550 addr = s->dnad;
dd8edf01
AL		 551 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
552 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
b25cf589 553 addr |= ((uint64_t)s->dnad64 << 32);
dd8edf01
AL		 554 else if (s->dbms)
555 addr |= ((uint64_t)s->dbms << 32);
b25cf589
AL		 556 else if (s->sbms)
557 addr |= ((uint64_t)s->sbms << 32);
558
9ba4524c 559 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
7d8406be 560 s->csbc += count;
a917d384
PB		 561 s->dnad += count;
562 s->dbc -= count;
5c6c0e51 563 if (s->current->dma_buf == NULL) {
0c34459b 564 s->current->dma_buf = scsi_req_get_buf(s->current->req);
a917d384 565 }
7d8406be 566 /* ??? Set SFBR to first data byte. */
a917d384 567 if (out) {
9ba4524c 568 pci_dma_read(&s->dev, addr, s->current->dma_buf, count);
a917d384 569 } else {
9ba4524c 570 pci_dma_write(&s->dev, addr, s->current->dma_buf, count);
a917d384 571 }
b96a0da0
GH		 572 s->current->dma_len -= count;
573 if (s->current->dma_len == 0) {
574 s->current->dma_buf = NULL;
ad3376cc 575 scsi_req_continue(s->current->req);
a917d384 576 } else {
b96a0da0 577 s->current->dma_buf += count;
a917d384
PB		 578 lsi_resume_script(s);
579 }
580}
581
582
583/* Add a command to the queue. */
584static void lsi_queue_command(LSIState *s)
585{
af12ac98 586 lsi_request *p = s->current;
a917d384 587
aa2b1e89 588 DPRINTF("Queueing tag=0x%x\n", p->tag);
af12ac98 589 assert(s->current != NULL);
b96a0da0 590 assert(s->current->dma_len == 0);
af12ac98
GH		 591 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
592 s->current = NULL;
593
a917d384
PB		 594 p->pending = 0;
595 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
596}
597
598/* Queue a byte for a MSG IN phase. */
599static void lsi_add_msg_byte(LSIState *s, uint8_t data)
600{
601 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
602 BADF("MSG IN data too long\n");
4d611c9a 603 } else {
a917d384
PB		 604 DPRINTF("MSG IN 0x%02x\n", data);
605 s->msg[s->msg_len++] = data;
7d8406be 606 }
a917d384
PB		 607}
608
609/* Perform reselection to continue a command. */
aa4d32c4 610static void lsi_reselect(LSIState *s, lsi_request *p)
a917d384 611{
a917d384
PB		 612 int id;
613
af12ac98
GH		 614 assert(s->current == NULL);
615 QTAILQ_REMOVE(&s->queue, p, next);
616 s->current = p;
617
aa4d32c4 618 id = (p->tag >> 8) & 0xf;
a917d384 619 s->ssid = id | 0x80;
cc9f28bc 620 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
f6dc18df 621 if (!(s->dcntl & LSI_DCNTL_COM)) {
cc9f28bc
LA		 622 s->sfbr = 1 << (id & 0x7);
623 }
a917d384 624 DPRINTF("Reselected target %d\n", id);
a917d384
PB		 625 s->scntl1 |= LSI_SCNTL1_CON;
626 lsi_set_phase(s, PHASE_MI);
627 s->msg_action = p->out ? 2 : 3;
b96a0da0 628 s->current->dma_len = p->pending;
a917d384 629 lsi_add_msg_byte(s, 0x80);
af12ac98 630 if (s->current->tag & LSI_TAG_VALID) {
a917d384 631 lsi_add_msg_byte(s, 0x20);
aa4d32c4 632 lsi_add_msg_byte(s, p->tag & 0xff);
a917d384
PB		 633 }
634
e560125e
LA		 635 if (lsi_irq_on_rsl(s)) {
636 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
637 }
a917d384
PB		 638}
639
11257187 640static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
a917d384 641{
042ec49d
GH		 642 lsi_request *p;
643
644 QTAILQ_FOREACH(p, &s->queue, next) {
a917d384 645 if (p->tag == tag) {
11257187 646 return p;
a917d384
PB		 647 }
648 }
11257187
PB		 649
650 return NULL;
651}
652
94d3f98a
PB		 653static void lsi_request_cancelled(SCSIRequest *req)
654{
655 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
c5bf71a9 656 lsi_request *p = req->hba_private;
94d3f98a
PB		 657
658 if (s->current && req == s->current->req) {
659 scsi_req_unref(req);
7267c094 660 g_free(s->current);
94d3f98a
PB		 661 s->current = NULL;
662 return;
663 }
664
94d3f98a
PB		 665 if (p) {
666 QTAILQ_REMOVE(&s->queue, p, next);
667 scsi_req_unref(req);
7267c094 668 g_free(p);
94d3f98a
PB		 669 }
670}
671
11257187
PB		 672/* Record that data is available for a queued command. Returns zero if
673 the device was reselected, nonzero if the IO is deferred. */
c5bf71a9 674static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
11257187 675{
c5bf71a9 676 lsi_request *p = req->hba_private;
11257187
PB		 677
678 if (p->pending) {
c5bf71a9 679 BADF("Multiple IO pending for request %p\n", p);
11257187 680 }
aba1f023 681 p->pending = len;
11257187
PB		 682 /* Reselect if waiting for it, or if reselection triggers an IRQ
683 and the bus is free.
684 Since no interrupt stacking is implemented in the emulation, it
685 is also required that there are no pending interrupts waiting
686 for service from the device driver. */
687 if (s->waiting == 1 ||
688 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
689 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
690 /* Reselect device. */
691 lsi_reselect(s, p);
692 return 0;
693 } else {
4789bc39 694 DPRINTF("Queueing IO tag=0x%x\n", p->tag);
aba1f023 695 p->pending = len;
11257187
PB		 696 return 1;
697 }
7d8406be 698}
c6df7102
PB		 699
700 /* Callback to indicate that the SCSI layer has completed a command. */
01e95455 701static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
4d611c9a 702{
5c6c0e51 703 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
4d611c9a
PB		 704 int out;
705
a917d384 706 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
aba1f023
PB		 707 DPRINTF("Command complete status=%d\n", (int)status);
708 s->status = status;
c6df7102
PB		 709 s->command_complete = 2;
710 if (s->waiting && s->dbc != 0) {
711 /* Raise phase mismatch for short transfers. */
712 lsi_bad_phase(s, out, PHASE_ST);
713 } else {
714 lsi_set_phase(s, PHASE_ST);
715 }
af12ac98 716
c6df7102
PB		 717 if (s->current && req == s->current->req) {
718 scsi_req_unref(s->current->req);
7267c094 719 g_free(s->current);
c6df7102 720 s->current = NULL;
4d611c9a 721 }
c6df7102
PB		 722 lsi_resume_script(s);
723}
724
725 /* Callback to indicate that the SCSI layer has completed a transfer. */
aba1f023 726static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
c6df7102
PB		 727{
728 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
729 int out;
4d611c9a 730
c5bf71a9 731 if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
e560125e 732 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
c5bf71a9 733 if (lsi_queue_req(s, req, len)) {
a917d384 734 return;
5c6c0e51 735 }
a917d384 736 }
e560125e 737
c6df7102
PB		 738 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
739
e560125e 740 /* host adapter (re)connected */
aba1f023
PB		 741 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
742 s->current->dma_len = len;
8ccc2ace 743 s->command_complete = 1;
c6df7102
PB		 744 if (s->waiting) {
745 if (s->waiting == 1 || s->dbc == 0) {
746 lsi_resume_script(s);
747 } else {
748 lsi_do_dma(s, out);
749 }
4d611c9a
PB		 750 }
751}
7d8406be
PB		 752
753static void lsi_do_command(LSIState *s)
754{
64d56409 755 SCSIDevice *dev;
7d8406be 756 uint8_t buf[16];
64d56409 757 uint32_t id;
7d8406be
PB		 758 int n;
759
760 DPRINTF("Send command len=%d\n", s->dbc);
761 if (s->dbc > 16)
762 s->dbc = 16;
9ba4524c 763 pci_dma_read(&s->dev, s->dnad, buf, s->dbc);
7d8406be 764 s->sfbr = buf[0];
8ccc2ace 765 s->command_complete = 0;
af12ac98 766
259d5577 767 id = (s->select_tag >> 8) & 0xf;
0d3545e7 768 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
64d56409
JK		 769 if (!dev) {
770 lsi_bad_selection(s, id);
771 return;
772 }
773
af12ac98 774 assert(s->current == NULL);
7267c094 775 s->current = g_malloc0(sizeof(lsi_request));
af12ac98 776 s->current->tag = s->select_tag;
c39ce112 777 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
c5bf71a9 778 s->current);
af12ac98 779
c39ce112 780 n = scsi_req_enqueue(s->current->req);
ad3376cc
PB		 781 if (n) {
782 if (n > 0) {
783 lsi_set_phase(s, PHASE_DI);
784 } else if (n < 0) {
785 lsi_set_phase(s, PHASE_DO);
786 }
787 scsi_req_continue(s->current->req);
a917d384 788 }
8ccc2ace
TS		 789 if (!s->command_complete) {
790 if (n) {
791 /* Command did not complete immediately so disconnect. */
792 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
793 lsi_add_msg_byte(s, 4); /* DISCONNECT */
794 /* wait data */
795 lsi_set_phase(s, PHASE_MI);
796 s->msg_action = 1;
797 lsi_queue_command(s);
798 } else {
799 /* wait command complete */
800 lsi_set_phase(s, PHASE_DI);
801 }
7d8406be
PB		 802 }
803}
804
7d8406be
PB		 805static void lsi_do_status(LSIState *s)
806{
2f172849
HR		 807 uint8_t status;
808 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
7d8406be
PB		 809 if (s->dbc != 1)
810 BADF("Bad Status move\n");
811 s->dbc = 1;
2f172849
HR		 812 status = s->status;
813 s->sfbr = status;
9ba4524c 814 pci_dma_write(&s->dev, s->dnad, &status, 1);
7d8406be 815 lsi_set_phase(s, PHASE_MI);
a917d384
PB		 816 s->msg_action = 1;
817 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
7d8406be
PB		 818}
819
7d8406be
PB		 820static void lsi_do_msgin(LSIState *s)
821{
a917d384
PB		 822 int len;
823 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
824 s->sfbr = s->msg[0];
825 len = s->msg_len;
826 if (len > s->dbc)
827 len = s->dbc;
9ba4524c 828 pci_dma_write(&s->dev, s->dnad, s->msg, len);
a917d384
PB		 829 /* Linux drivers rely on the last byte being in the SIDL. */
830 s->sidl = s->msg[len - 1];
831 s->msg_len -= len;
832 if (s->msg_len) {
833 memmove(s->msg, s->msg + len, s->msg_len);
7d8406be
PB		 834 } else {
835 /* ??? Check if ATN (not yet implemented) is asserted and maybe
836 switch to PHASE_MO. */
a917d384
PB		 837 switch (s->msg_action) {
838 case 0:
839 lsi_set_phase(s, PHASE_CMD);
840 break;
841 case 1:
842 lsi_disconnect(s);
843 break;
844 case 2:
845 lsi_set_phase(s, PHASE_DO);
846 break;
847 case 3:
848 lsi_set_phase(s, PHASE_DI);
849 break;
850 default:
851 abort();
852 }
7d8406be
PB		 853 }
854}
855
a917d384
PB		 856/* Read the next byte during a MSGOUT phase. */
857static uint8_t lsi_get_msgbyte(LSIState *s)
858{
859 uint8_t data;
9ba4524c 860 pci_dma_read(&s->dev, s->dnad, &data, 1);
a917d384
PB		 861 s->dnad++;
862 s->dbc--;
863 return data;
864}
865
444dd39b
SH		 866/* Skip the next n bytes during a MSGOUT phase. */
867static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
868{
869 s->dnad += n;
870 s->dbc -= n;
871}
872
7d8406be
PB		 873static void lsi_do_msgout(LSIState *s)
874{
875 uint8_t msg;
a917d384 876 int len;
508240c0 877 uint32_t current_tag;
5c6c0e51 878 lsi_request *current_req, *p, *p_next;
508240c0
BK		 879
880 if (s->current) {
881 current_tag = s->current->tag;
5c6c0e51 882 current_req = s->current;
508240c0
BK		 883 } else {
884 current_tag = s->select_tag;
5c6c0e51 885 current_req = lsi_find_by_tag(s, current_tag);
508240c0 886 }
7d8406be
PB		 887
888 DPRINTF("MSG out len=%d\n", s->dbc);
a917d384
PB		 889 while (s->dbc) {
890 msg = lsi_get_msgbyte(s);
891 s->sfbr = msg;
892
893 switch (msg) {
77203ea0 894 case 0x04:
a917d384
PB		 895 DPRINTF("MSG: Disconnect\n");
896 lsi_disconnect(s);
897 break;
898 case 0x08:
899 DPRINTF("MSG: No Operation\n");
900 lsi_set_phase(s, PHASE_CMD);
901 break;
902 case 0x01:
903 len = lsi_get_msgbyte(s);
904 msg = lsi_get_msgbyte(s);
f3f5b867 905 (void)len; /* avoid a warning about unused variable*/
a917d384
PB		 906 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
907 switch (msg) {
908 case 1:
909 DPRINTF("SDTR (ignored)\n");
444dd39b 910 lsi_skip_msgbytes(s, 2);
a917d384
PB		 911 break;
912 case 3:
913 DPRINTF("WDTR (ignored)\n");
444dd39b 914 lsi_skip_msgbytes(s, 1);
a917d384
PB		 915 break;
916 default:
917 goto bad;
918 }
919 break;
920 case 0x20: /* SIMPLE queue */
af12ac98 921 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
aa2b1e89 922 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
a917d384
PB		 923 break;
924 case 0x21: /* HEAD of queue */
925 BADF("HEAD queue not implemented\n");
af12ac98 926 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384
PB		 927 break;
928 case 0x22: /* ORDERED queue */
929 BADF("ORDERED queue not implemented\n");
af12ac98 930 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384 931 break;
508240c0
BK		 932 case 0x0d:
933 /* The ABORT TAG message clears the current I/O process only. */
934 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
5c6c0e51 935 if (current_req) {
94d3f98a 936 scsi_req_cancel(current_req->req);
5c6c0e51 937 }
508240c0
BK		 938 lsi_disconnect(s);
939 break;
940 case 0x06:
941 case 0x0e:
942 case 0x0c:
943 /* The ABORT message clears all I/O processes for the selecting
944 initiator on the specified logical unit of the target. */
945 if (msg == 0x06) {
946 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
947 }
948 /* The CLEAR QUEUE message clears all I/O processes for all
949 initiators on the specified logical unit of the target. */
950 if (msg == 0x0e) {
951 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
952 }
953 /* The BUS DEVICE RESET message clears all I/O processes for all
954 initiators on all logical units of the target. */
955 if (msg == 0x0c) {
956 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
957 }
958
959 /* clear the current I/O process */
5c6c0e51 960 if (s->current) {
94d3f98a 961 scsi_req_cancel(s->current->req);
5c6c0e51 962 }
508240c0
BK		 963
964 /* As the current implemented devices scsi_disk and scsi_generic
965 only support one LUN, we don't need to keep track of LUNs.
966 Clearing I/O processes for other initiators could be possible
967 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
968 device, but this is currently not implemented (and seems not
969 to be really necessary). So let's simply clear all queued
970 commands for the current device: */
508240c0 971 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
a6c6f44a 972 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
94d3f98a 973 scsi_req_cancel(p->req);
508240c0
BK		 974 }
975 }
976
977 lsi_disconnect(s);
978 break;
a917d384
PB		 979 default:
980 if ((msg & 0x80) == 0) {
981 goto bad;
982 }
983 s->current_lun = msg & 7;
984 DPRINTF("Select LUN %d\n", s->current_lun);
985 lsi_set_phase(s, PHASE_CMD);
986 break;
987 }
7d8406be 988 }
a917d384
PB		 989 return;
990bad:
991 BADF("Unimplemented message 0x%02x\n", msg);
992 lsi_set_phase(s, PHASE_MI);
993 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
994 s->msg_action = 0;
7d8406be
PB		 995}
996
997/* Sign extend a 24-bit value. */
998static inline int32_t sxt24(int32_t n)
999{
1000 return (n << 8) >> 8;
1001}
1002
e20a8dff 1003#define LSI_BUF_SIZE 4096
7d8406be
PB		 1004static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1005{
1006 int n;
e20a8dff 1007 uint8_t buf[LSI_BUF_SIZE];
7d8406be
PB		 1008
1009 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1010 while (count) {
e20a8dff 1011 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
9ba4524c
EGM		 1012 pci_dma_read(&s->dev, src, buf, n);
1013 pci_dma_write(&s->dev, dest, buf, n);
7d8406be
PB		 1014 src += n;
1015 dest += n;
1016 count -= n;
1017 }
1018}
1019
a917d384
PB		 1020static void lsi_wait_reselect(LSIState *s)
1021{
042ec49d
GH		 1022 lsi_request *p;
1023
a917d384 1024 DPRINTF("Wait Reselect\n");
042ec49d
GH		 1025
1026 QTAILQ_FOREACH(p, &s->queue, next) {
1027 if (p->pending) {
aa4d32c4 1028 lsi_reselect(s, p);
a917d384
PB		 1029 break;
1030 }
1031 }
b96a0da0 1032 if (s->current == NULL) {
a917d384
PB		 1033 s->waiting = 1;
1034 }
1035}
1036
7d8406be
PB		 1037static void lsi_execute_script(LSIState *s)
1038{
1039 uint32_t insn;
b25cf589 1040 uint32_t addr, addr_high;
7d8406be 1041 int opcode;
ee4d919f 1042 int insn_processed = 0;
7d8406be
PB		 1043
1044 s->istat1 |= LSI_ISTAT1_SRUN;
1045again:
ee4d919f 1046 insn_processed++;
7d8406be 1047 insn = read_dword(s, s->dsp);
02b373ad
AZ		 1048 if (!insn) {
1049 /* If we receive an empty opcode increment the DSP by 4 bytes
1050 instead of 8 and execute the next opcode at that location */
1051 s->dsp += 4;
1052 goto again;
1053 }
7d8406be 1054 addr = read_dword(s, s->dsp + 4);
b25cf589 1055 addr_high = 0;
7d8406be
PB		 1056 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1057 s->dsps = addr;
1058 s->dcmd = insn >> 24;
1059 s->dsp += 8;
1060 switch (insn >> 30) {
1061 case 0: /* Block move. */
1062 if (s->sist1 & LSI_SIST1_STO) {
1063 DPRINTF("Delayed select timeout\n");
1064 lsi_stop_script(s);
1065 break;
1066 }
1067 s->dbc = insn & 0xffffff;
1068 s->rbc = s->dbc;
dd8edf01
AL		 1069 /* ??? Set ESA. */
1070 s->ia = s->dsp - 8;
7d8406be
PB		 1071 if (insn & (1 << 29)) {
1072 /* Indirect addressing. */
1073 addr = read_dword(s, addr);
1074 } else if (insn & (1 << 28)) {
1075 uint32_t buf[2];
1076 int32_t offset;
1077 /* Table indirect addressing. */
dd8edf01
AL		 1078
1079 /* 32-bit Table indirect */
7d8406be 1080 offset = sxt24(addr);
9e486d67 1081 pci_dma_read(&s->dev, s->dsa + offset, buf, 8);
b25cf589
AL		 1082 /* byte count is stored in bits 0:23 only */
1083 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
7faa239c 1084 s->rbc = s->dbc;
7d8406be 1085 addr = cpu_to_le32(buf[1]);
b25cf589
AL		 1086
1087 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1088 * table, bits [31:24] */
1089 if (lsi_dma_40bit(s))
1090 addr_high = cpu_to_le32(buf[0]) >> 24;
dd8edf01
AL		 1091 else if (lsi_dma_ti64bit(s)) {
1092 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1093 switch (selector) {
1094 case 0 ... 0x0f:
1095 /* offset index into scratch registers since
1096 * TI64 mode can use registers C to R */
1097 addr_high = s->scratch[2 + selector];
1098 break;
1099 case 0x10:
1100 addr_high = s->mmrs;
1101 break;
1102 case 0x11:
1103 addr_high = s->mmws;
1104 break;
1105 case 0x12:
1106 addr_high = s->sfs;
1107 break;
1108 case 0x13:
1109 addr_high = s->drs;
1110 break;
1111 case 0x14:
1112 addr_high = s->sbms;
1113 break;
1114 case 0x15:
1115 addr_high = s->dbms;
1116 break;
1117 default:
1118 BADF("Illegal selector specified (0x%x > 0x15)"
1119 " for 64-bit DMA block move", selector);
1120 break;
1121 }
1122 }
1123 } else if (lsi_dma_64bit(s)) {
1124 /* fetch a 3rd dword if 64-bit direct move is enabled and
1125 only if we're not doing table indirect or indirect addressing */
1126 s->dbms = read_dword(s, s->dsp);
1127 s->dsp += 4;
1128 s->ia = s->dsp - 12;
7d8406be
PB		 1129 }
1130 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1131 DPRINTF("Wrong phase got %d expected %d\n",
1132 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1133 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1134 break;
1135 }
1136 s->dnad = addr;
b25cf589 1137 s->dnad64 = addr_high;
7d8406be
PB		 1138 switch (s->sstat1 & 0x7) {
1139 case PHASE_DO:
a917d384 1140 s->waiting = 2;
7d8406be 1141 lsi_do_dma(s, 1);
a917d384
PB		 1142 if (s->waiting)
1143 s->waiting = 3;
7d8406be
PB		 1144 break;
1145 case PHASE_DI:
a917d384 1146 s->waiting = 2;
7d8406be 1147 lsi_do_dma(s, 0);
a917d384
PB		 1148 if (s->waiting)
1149 s->waiting = 3;
7d8406be
PB		 1150 break;
1151 case PHASE_CMD:
1152 lsi_do_command(s);
1153 break;
1154 case PHASE_ST:
1155 lsi_do_status(s);
1156 break;
1157 case PHASE_MO:
1158 lsi_do_msgout(s);
1159 break;
1160 case PHASE_MI:
1161 lsi_do_msgin(s);
1162 break;
1163 default:
1164 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1165 exit(1);
1166 }
1167 s->dfifo = s->dbc & 0xff;
1168 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1169 s->sbc = s->dbc;
1170 s->rbc -= s->dbc;
1171 s->ua = addr + s->dbc;
7d8406be
PB		 1172 break;
1173
1174 case 1: /* IO or Read/Write instruction. */
1175 opcode = (insn >> 27) & 7;
1176 if (opcode < 5) {
1177 uint32_t id;
1178
1179 if (insn & (1 << 25)) {
1180 id = read_dword(s, s->dsa + sxt24(insn));
1181 } else {
07a1bea8 1182 id = insn;
7d8406be
PB		 1183 }
1184 id = (id >> 16) & 0xf;
1185 if (insn & (1 << 26)) {
1186 addr = s->dsp + sxt24(addr);
1187 }
1188 s->dnad = addr;
1189 switch (opcode) {
1190 case 0: /* Select */
a917d384 1191 s->sdid = id;
38f5b2b8
LA		 1192 if (s->scntl1 & LSI_SCNTL1_CON) {
1193 DPRINTF("Already reselected, jumping to alternative address\n");
1194 s->dsp = s->dnad;
a917d384
PB		 1195 break;
1196 }
7d8406be
PB		 1197 s->sstat0 |= LSI_SSTAT0_WOA;
1198 s->scntl1 &= ~LSI_SCNTL1_IARB;
0d3545e7 1199 if (!scsi_device_find(&s->bus, 0, id, 0)) {
64d56409 1200 lsi_bad_selection(s, id);
7d8406be
PB		 1201 break;
1202 }
1203 DPRINTF("Selected target %d%s\n",
1204 id, insn & (1 << 3) ? " ATN" : "");
1205 /* ??? Linux drivers compain when this is set. Maybe
1206 it only applies in low-level mode (unimplemented).
1207 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
af12ac98 1208 s->select_tag = id << 8;
7d8406be
PB		 1209 s->scntl1 |= LSI_SCNTL1_CON;
1210 if (insn & (1 << 3)) {
1211 s->socl |= LSI_SOCL_ATN;
1212 }
1213 lsi_set_phase(s, PHASE_MO);
1214 break;
1215 case 1: /* Disconnect */
a15fdf86 1216 DPRINTF("Wait Disconnect\n");
7d8406be
PB		 1217 s->scntl1 &= ~LSI_SCNTL1_CON;
1218 break;
1219 case 2: /* Wait Reselect */
e560125e
LA		 1220 if (!lsi_irq_on_rsl(s)) {
1221 lsi_wait_reselect(s);
1222 }
7d8406be
PB		 1223 break;
1224 case 3: /* Set */
1225 DPRINTF("Set%s%s%s%s\n",
1226 insn & (1 << 3) ? " ATN" : "",
1227 insn & (1 << 6) ? " ACK" : "",
1228 insn & (1 << 9) ? " TM" : "",
1229 insn & (1 << 10) ? " CC" : "");
1230 if (insn & (1 << 3)) {
1231 s->socl |= LSI_SOCL_ATN;
1232 lsi_set_phase(s, PHASE_MO);
1233 }
1234 if (insn & (1 << 9)) {
1235 BADF("Target mode not implemented\n");
1236 exit(1);
1237 }
1238 if (insn & (1 << 10))
1239 s->carry = 1;
1240 break;
1241 case 4: /* Clear */
1242 DPRINTF("Clear%s%s%s%s\n",
1243 insn & (1 << 3) ? " ATN" : "",
1244 insn & (1 << 6) ? " ACK" : "",
1245 insn & (1 << 9) ? " TM" : "",
1246 insn & (1 << 10) ? " CC" : "");
1247 if (insn & (1 << 3)) {
1248 s->socl &= ~LSI_SOCL_ATN;
1249 }
1250 if (insn & (1 << 10))
1251 s->carry = 0;
1252 break;
1253 }
1254 } else {
1255 uint8_t op0;
1256 uint8_t op1;
1257 uint8_t data8;
1258 int reg;
1259 int operator;
1260#ifdef DEBUG_LSI
1261 static const char *opcode_names[3] =
1262 {"Write", "Read", "Read-Modify-Write"};
1263 static const char *operator_names[8] =
1264 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1265#endif
1266
1267 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1268 data8 = (insn >> 8) & 0xff;
1269 opcode = (insn >> 27) & 7;
1270 operator = (insn >> 24) & 7;
a917d384 1271 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
7d8406be 1272 opcode_names[opcode - 5], reg,
a917d384 1273 operator_names[operator], data8, s->sfbr,
7d8406be
PB		 1274 (insn & (1 << 23)) ? " SFBR" : "");
1275 op0 = op1 = 0;
1276 switch (opcode) {
1277 case 5: /* From SFBR */
1278 op0 = s->sfbr;
1279 op1 = data8;
1280 break;
1281 case 6: /* To SFBR */
1282 if (operator)
1283 op0 = lsi_reg_readb(s, reg);
1284 op1 = data8;
1285 break;
1286 case 7: /* Read-modify-write */
1287 if (operator)
1288 op0 = lsi_reg_readb(s, reg);
1289 if (insn & (1 << 23)) {
1290 op1 = s->sfbr;
1291 } else {
1292 op1 = data8;
1293 }
1294 break;
1295 }
1296
1297 switch (operator) {
1298 case 0: /* move */
1299 op0 = op1;
1300 break;
1301 case 1: /* Shift left */
1302 op1 = op0 >> 7;
1303 op0 = (op0 << 1) | s->carry;
1304 s->carry = op1;
1305 break;
1306 case 2: /* OR */
1307 op0 |= op1;
1308 break;
1309 case 3: /* XOR */
dcfb9014 1310 op0 ^= op1;
7d8406be
PB		 1311 break;
1312 case 4: /* AND */
1313 op0 &= op1;
1314 break;
1315 case 5: /* SHR */
1316 op1 = op0 & 1;
1317 op0 = (op0 >> 1) | (s->carry << 7);
687fa640 1318 s->carry = op1;
7d8406be
PB		 1319 break;
1320 case 6: /* ADD */
1321 op0 += op1;
1322 s->carry = op0 < op1;
1323 break;
1324 case 7: /* ADC */
1325 op0 += op1 + s->carry;
1326 if (s->carry)
1327 s->carry = op0 <= op1;
1328 else
1329 s->carry = op0 < op1;
1330 break;
1331 }
1332
1333 switch (opcode) {
1334 case 5: /* From SFBR */
1335 case 7: /* Read-modify-write */
1336 lsi_reg_writeb(s, reg, op0);
1337 break;
1338 case 6: /* To SFBR */
1339 s->sfbr = op0;
1340 break;
1341 }
1342 }
1343 break;
1344
1345 case 2: /* Transfer Control. */
1346 {
1347 int cond;
1348 int jmp;
1349
1350 if ((insn & 0x002e0000) == 0) {
1351 DPRINTF("NOP\n");
1352 break;
1353 }
1354 if (s->sist1 & LSI_SIST1_STO) {
1355 DPRINTF("Delayed select timeout\n");
1356 lsi_stop_script(s);
1357 break;
1358 }
1359 cond = jmp = (insn & (1 << 19)) != 0;
1360 if (cond == jmp && (insn & (1 << 21))) {
1361 DPRINTF("Compare carry %d\n", s->carry == jmp);
1362 cond = s->carry != 0;
1363 }
1364 if (cond == jmp && (insn & (1 << 17))) {
1365 DPRINTF("Compare phase %d %c= %d\n",
1366 (s->sstat1 & PHASE_MASK),
1367 jmp ? '=' : '!',
1368 ((insn >> 24) & 7));
1369 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1370 }
1371 if (cond == jmp && (insn & (1 << 18))) {
1372 uint8_t mask;
1373
1374 mask = (~insn >> 8) & 0xff;
1375 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1376 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1377 cond = (s->sfbr & mask) == (insn & mask);
1378 }
1379 if (cond == jmp) {
1380 if (insn & (1 << 23)) {
1381 /* Relative address. */
1382 addr = s->dsp + sxt24(addr);
1383 }
1384 switch ((insn >> 27) & 7) {
1385 case 0: /* Jump */
1386 DPRINTF("Jump to 0x%08x\n", addr);
1387 s->dsp = addr;
1388 break;
1389 case 1: /* Call */
1390 DPRINTF("Call 0x%08x\n", addr);
1391 s->temp = s->dsp;
1392 s->dsp = addr;
1393 break;
1394 case 2: /* Return */
1395 DPRINTF("Return to 0x%08x\n", s->temp);
1396 s->dsp = s->temp;
1397 break;
1398 case 3: /* Interrupt */
1399 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1400 if ((insn & (1 << 20)) != 0) {
1401 s->istat0 |= LSI_ISTAT0_INTF;
1402 lsi_update_irq(s);
1403 } else {
1404 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1405 }
1406 break;
1407 default:
1408 DPRINTF("Illegal transfer control\n");
1409 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1410 break;
1411 }
1412 } else {
1413 DPRINTF("Control condition failed\n");
1414 }
1415 }
1416 break;
1417
1418 case 3:
1419 if ((insn & (1 << 29)) == 0) {
1420 /* Memory move. */
1421 uint32_t dest;
1422 /* ??? The docs imply the destination address is loaded into
1423 the TEMP register. However the Linux drivers rely on
1424 the value being presrved. */
1425 dest = read_dword(s, s->dsp);
1426 s->dsp += 4;
1427 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1428 } else {
1429 uint8_t data[7];
1430 int reg;
1431 int n;
1432 int i;
1433
1434 if (insn & (1 << 28)) {
1435 addr = s->dsa + sxt24(addr);
1436 }
1437 n = (insn & 7);
1438 reg = (insn >> 16) & 0xff;
1439 if (insn & (1 << 24)) {
9ba4524c 1440 pci_dma_read(&s->dev, addr, data, n);
a917d384
PB		 1441 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1442 addr, *(int *)data);
7d8406be
PB		 1443 for (i = 0; i < n; i++) {
1444 lsi_reg_writeb(s, reg + i, data[i]);
1445 }
1446 } else {
1447 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1448 for (i = 0; i < n; i++) {
1449 data[i] = lsi_reg_readb(s, reg + i);
1450 }
9ba4524c 1451 pci_dma_write(&s->dev, addr, data, n);
7d8406be
PB		 1452 }
1453 }
1454 }
ee4d919f 1455 if (insn_processed > 10000 && !s->waiting) {
64c68080
PB		 1456 /* Some windows drivers make the device spin waiting for a memory
1457 location to change. If we have been executed a lot of code then
1458 assume this is the case and force an unexpected device disconnect.
1459 This is apparently sufficient to beat the drivers into submission.
1460 */
ee4d919f
AL		 1461 if (!(s->sien0 & LSI_SIST0_UDC))
1462 fprintf(stderr, "inf. loop with UDC masked\n");
1463 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1464 lsi_disconnect(s);
1465 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
7d8406be
PB		 1466 if (s->dcntl & LSI_DCNTL_SSM) {
1467 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1468 } else {
1469 goto again;
1470 }
1471 }
1472 DPRINTF("SCRIPTS execution stopped\n");
1473}
1474
1475static uint8_t lsi_reg_readb(LSIState *s, int offset)
1476{
1477 uint8_t tmp;
75f76531
AJ		 1478#define CASE_GET_REG24(name, addr) \
1479 case addr: return s->name & 0xff; \
1480 case addr + 1: return (s->name >> 8) & 0xff; \
1481 case addr + 2: return (s->name >> 16) & 0xff;
1482
7d8406be
PB		 1483#define CASE_GET_REG32(name, addr) \
1484 case addr: return s->name & 0xff; \
1485 case addr + 1: return (s->name >> 8) & 0xff; \
1486 case addr + 2: return (s->name >> 16) & 0xff; \
1487 case addr + 3: return (s->name >> 24) & 0xff;
1488
1489#ifdef DEBUG_LSI_REG
1490 DPRINTF("Read reg %x\n", offset);
1491#endif
1492 switch (offset) {
1493 case 0x00: /* SCNTL0 */
1494 return s->scntl0;
1495 case 0x01: /* SCNTL1 */
1496 return s->scntl1;
1497 case 0x02: /* SCNTL2 */
1498 return s->scntl2;
1499 case 0x03: /* SCNTL3 */
1500 return s->scntl3;
1501 case 0x04: /* SCID */
1502 return s->scid;
1503 case 0x05: /* SXFER */
1504 return s->sxfer;
1505 case 0x06: /* SDID */
1506 return s->sdid;
1507 case 0x07: /* GPREG0 */
1508 return 0x7f;
985a03b0
TS		 1509 case 0x08: /* Revision ID */
1510 return 0x00;
a917d384
PB		 1511 case 0xa: /* SSID */
1512 return s->ssid;
7d8406be
PB		 1513 case 0xb: /* SBCL */
1514 /* ??? This is not correct. However it's (hopefully) only
1515 used for diagnostics, so should be ok. */
1516 return 0;
1517 case 0xc: /* DSTAT */
1518 tmp = s->dstat | 0x80;
1519 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1520 s->dstat = 0;
1521 lsi_update_irq(s);
1522 return tmp;
1523 case 0x0d: /* SSTAT0 */
1524 return s->sstat0;
1525 case 0x0e: /* SSTAT1 */
1526 return s->sstat1;
1527 case 0x0f: /* SSTAT2 */
1528 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1529 CASE_GET_REG32(dsa, 0x10)
1530 case 0x14: /* ISTAT0 */
1531 return s->istat0;
ecabe8cc
AL		 1532 case 0x15: /* ISTAT1 */
1533 return s->istat1;
7d8406be
PB		 1534 case 0x16: /* MBOX0 */
1535 return s->mbox0;
1536 case 0x17: /* MBOX1 */
1537 return s->mbox1;
1538 case 0x18: /* CTEST0 */
1539 return 0xff;
1540 case 0x19: /* CTEST1 */
1541 return 0;
1542 case 0x1a: /* CTEST2 */
9167a69a 1543 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
7d8406be
PB		 1544 if (s->istat0 & LSI_ISTAT0_SIGP) {
1545 s->istat0 &= ~LSI_ISTAT0_SIGP;
1546 tmp |= LSI_CTEST2_SIGP;
1547 }
1548 return tmp;
1549 case 0x1b: /* CTEST3 */
1550 return s->ctest3;
1551 CASE_GET_REG32(temp, 0x1c)
1552 case 0x20: /* DFIFO */
1553 return 0;
1554 case 0x21: /* CTEST4 */
1555 return s->ctest4;
1556 case 0x22: /* CTEST5 */
1557 return s->ctest5;
985a03b0
TS		 1558 case 0x23: /* CTEST6 */
1559 return 0;
75f76531 1560 CASE_GET_REG24(dbc, 0x24)
7d8406be
PB		 1561 case 0x27: /* DCMD */
1562 return s->dcmd;
4b9a2d6d 1563 CASE_GET_REG32(dnad, 0x28)
7d8406be
PB		 1564 CASE_GET_REG32(dsp, 0x2c)
1565 CASE_GET_REG32(dsps, 0x30)
1566 CASE_GET_REG32(scratch[0], 0x34)
1567 case 0x38: /* DMODE */
1568 return s->dmode;
1569 case 0x39: /* DIEN */
1570 return s->dien;
bd8ee11a
SH		 1571 case 0x3a: /* SBR */
1572 return s->sbr;
7d8406be
PB		 1573 case 0x3b: /* DCNTL */
1574 return s->dcntl;
1575 case 0x40: /* SIEN0 */
1576 return s->sien0;
1577 case 0x41: /* SIEN1 */
1578 return s->sien1;
1579 case 0x42: /* SIST0 */
1580 tmp = s->sist0;
1581 s->sist0 = 0;
1582 lsi_update_irq(s);
1583 return tmp;
1584 case 0x43: /* SIST1 */
1585 tmp = s->sist1;
1586 s->sist1 = 0;
1587 lsi_update_irq(s);
1588 return tmp;
9167a69a
AZ		 1589 case 0x46: /* MACNTL */
1590 return 0x0f;
7d8406be
PB		 1591 case 0x47: /* GPCNTL0 */
1592 return 0x0f;
1593 case 0x48: /* STIME0 */
1594 return s->stime0;
1595 case 0x4a: /* RESPID0 */
1596 return s->respid0;
1597 case 0x4b: /* RESPID1 */
1598 return s->respid1;
1599 case 0x4d: /* STEST1 */
1600 return s->stest1;
1601 case 0x4e: /* STEST2 */
1602 return s->stest2;
1603 case 0x4f: /* STEST3 */
1604 return s->stest3;
a917d384
PB		 1605 case 0x50: /* SIDL */
1606 /* This is needed by the linux drivers. We currently only update it
1607 during the MSG IN phase. */
1608 return s->sidl;
7d8406be
PB		 1609 case 0x52: /* STEST4 */
1610 return 0xe0;
1611 case 0x56: /* CCNTL0 */
1612 return s->ccntl0;
1613 case 0x57: /* CCNTL1 */
1614 return s->ccntl1;
a917d384
PB		 1615 case 0x58: /* SBDL */
1616 /* Some drivers peek at the data bus during the MSG IN phase. */
1617 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1618 return s->msg[0];
1619 return 0;
1620 case 0x59: /* SBDL high */
7d8406be
PB		 1621 return 0;
1622 CASE_GET_REG32(mmrs, 0xa0)
1623 CASE_GET_REG32(mmws, 0xa4)
1624 CASE_GET_REG32(sfs, 0xa8)
1625 CASE_GET_REG32(drs, 0xac)
1626 CASE_GET_REG32(sbms, 0xb0)
ab57d967 1627 CASE_GET_REG32(dbms, 0xb4)
7d8406be
PB		 1628 CASE_GET_REG32(dnad64, 0xb8)
1629 CASE_GET_REG32(pmjad1, 0xc0)
1630 CASE_GET_REG32(pmjad2, 0xc4)
1631 CASE_GET_REG32(rbc, 0xc8)
1632 CASE_GET_REG32(ua, 0xcc)
1633 CASE_GET_REG32(ia, 0xd4)
1634 CASE_GET_REG32(sbc, 0xd8)
1635 CASE_GET_REG32(csbc, 0xdc)
1636 }
1637 if (offset >= 0x5c && offset < 0xa0) {
1638 int n;
1639 int shift;
1640 n = (offset - 0x58) >> 2;
1641 shift = (offset & 3) * 8;
1642 return (s->scratch[n] >> shift) & 0xff;
1643 }
1644 BADF("readb 0x%x\n", offset);
1645 exit(1);
75f76531 1646#undef CASE_GET_REG24
7d8406be
PB		 1647#undef CASE_GET_REG32
1648}
1649
1650static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1651{
49c47daa
SH		 1652#define CASE_SET_REG24(name, addr) \
1653 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1654 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1655 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1656
7d8406be
PB		 1657#define CASE_SET_REG32(name, addr) \
1658 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1659 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1660 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1661 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1662
1663#ifdef DEBUG_LSI_REG
1664 DPRINTF("Write reg %x = %02x\n", offset, val);
1665#endif
1666 switch (offset) {
1667 case 0x00: /* SCNTL0 */
1668 s->scntl0 = val;
1669 if (val & LSI_SCNTL0_START) {
1670 BADF("Start sequence not implemented\n");
1671 }
1672 break;
1673 case 0x01: /* SCNTL1 */
1674 s->scntl1 = val & ~LSI_SCNTL1_SST;
1675 if (val & LSI_SCNTL1_IARB) {
1676 BADF("Immediate Arbritration not implemented\n");
1677 }
1678 if (val & LSI_SCNTL1_RST) {
680a34ee
JK		 1679 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1680 DeviceState *dev;
680a34ee 1681
f48a7a6e 1682 QTAILQ_FOREACH(dev, &s->bus.qbus.children, sibling) {
94afdadc 1683 device_reset(dev);
680a34ee
JK		 1684 }
1685 s->sstat0 |= LSI_SSTAT0_RST;
1686 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1687 }
7d8406be
PB		 1688 } else {
1689 s->sstat0 &= ~LSI_SSTAT0_RST;
1690 }
1691 break;
1692 case 0x02: /* SCNTL2 */
1693 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
3d834c78 1694 s->scntl2 = val;
7d8406be
PB		 1695 break;
1696 case 0x03: /* SCNTL3 */
1697 s->scntl3 = val;
1698 break;
1699 case 0x04: /* SCID */
1700 s->scid = val;
1701 break;
1702 case 0x05: /* SXFER */
1703 s->sxfer = val;
1704 break;
a917d384
PB		 1705 case 0x06: /* SDID */
1706 if ((val & 0xf) != (s->ssid & 0xf))
1707 BADF("Destination ID does not match SSID\n");
1708 s->sdid = val & 0xf;
1709 break;
7d8406be
PB		 1710 case 0x07: /* GPREG0 */
1711 break;
a917d384
PB		 1712 case 0x08: /* SFBR */
1713 /* The CPU is not allowed to write to this register. However the
1714 SCRIPTS register move instructions are. */
1715 s->sfbr = val;
1716 break;
a15fdf86 1717 case 0x0a: case 0x0b:
9167a69a 1718 /* Openserver writes to these readonly registers on startup */
a15fdf86 1719 return;
7d8406be
PB		 1720 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1721 /* Linux writes to these readonly registers on startup. */
1722 return;
1723 CASE_SET_REG32(dsa, 0x10)
1724 case 0x14: /* ISTAT0 */
1725 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1726 if (val & LSI_ISTAT0_ABRT) {
1727 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1728 }
1729 if (val & LSI_ISTAT0_INTF) {
1730 s->istat0 &= ~LSI_ISTAT0_INTF;
1731 lsi_update_irq(s);
1732 }
4d611c9a 1733 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
7d8406be
PB		 1734 DPRINTF("Woken by SIGP\n");
1735 s->waiting = 0;
1736 s->dsp = s->dnad;
1737 lsi_execute_script(s);
1738 }
1739 if (val & LSI_ISTAT0_SRST) {
1740 lsi_soft_reset(s);
1741 }
92d88ecb 1742 break;
7d8406be
PB		 1743 case 0x16: /* MBOX0 */
1744 s->mbox0 = val;
92d88ecb 1745 break;
7d8406be
PB		 1746 case 0x17: /* MBOX1 */
1747 s->mbox1 = val;
92d88ecb 1748 break;
9167a69a
AZ		 1749 case 0x1a: /* CTEST2 */
1750 s->ctest2 = val & LSI_CTEST2_PCICIE;
1751 break;
7d8406be
PB		 1752 case 0x1b: /* CTEST3 */
1753 s->ctest3 = val & 0x0f;
1754 break;
1755 CASE_SET_REG32(temp, 0x1c)
1756 case 0x21: /* CTEST4 */
1757 if (val & 7) {
1758 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1759 }
1760 s->ctest4 = val;
1761 break;
1762 case 0x22: /* CTEST5 */
1763 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1764 BADF("CTEST5 DMA increment not implemented\n");
1765 }
1766 s->ctest5 = val;
1767 break;
49c47daa 1768 CASE_SET_REG24(dbc, 0x24)
4b9a2d6d 1769 CASE_SET_REG32(dnad, 0x28)
3d834c78 1770 case 0x2c: /* DSP[0:7] */
7d8406be
PB		 1771 s->dsp &= 0xffffff00;
1772 s->dsp |= val;
1773 break;
3d834c78 1774 case 0x2d: /* DSP[8:15] */
7d8406be
PB		 1775 s->dsp &= 0xffff00ff;
1776 s->dsp |= val << 8;
1777 break;
3d834c78 1778 case 0x2e: /* DSP[16:23] */
7d8406be
PB		 1779 s->dsp &= 0xff00ffff;
1780 s->dsp |= val << 16;
1781 break;
3d834c78 1782 case 0x2f: /* DSP[24:31] */
7d8406be
PB		 1783 s->dsp &= 0x00ffffff;
1784 s->dsp |= val << 24;
1785 if ((s->dmode & LSI_DMODE_MAN) == 0
1786 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1787 lsi_execute_script(s);
1788 break;
1789 CASE_SET_REG32(dsps, 0x30)
1790 CASE_SET_REG32(scratch[0], 0x34)
1791 case 0x38: /* DMODE */
1792 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1793 BADF("IO mappings not implemented\n");
1794 }
1795 s->dmode = val;
1796 break;
1797 case 0x39: /* DIEN */
1798 s->dien = val;
1799 lsi_update_irq(s);
1800 break;
bd8ee11a
SH		 1801 case 0x3a: /* SBR */
1802 s->sbr = val;
1803 break;
7d8406be
PB		 1804 case 0x3b: /* DCNTL */
1805 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1806 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1807 lsi_execute_script(s);
1808 break;
1809 case 0x40: /* SIEN0 */
1810 s->sien0 = val;
1811 lsi_update_irq(s);
1812 break;
1813 case 0x41: /* SIEN1 */
1814 s->sien1 = val;
1815 lsi_update_irq(s);
1816 break;
1817 case 0x47: /* GPCNTL0 */
1818 break;
1819 case 0x48: /* STIME0 */
1820 s->stime0 = val;
1821 break;
1822 case 0x49: /* STIME1 */
1823 if (val & 0xf) {
1824 DPRINTF("General purpose timer not implemented\n");
1825 /* ??? Raising the interrupt immediately seems to be sufficient
1826 to keep the FreeBSD driver happy. */
1827 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1828 }
1829 break;
1830 case 0x4a: /* RESPID0 */
1831 s->respid0 = val;
1832 break;
1833 case 0x4b: /* RESPID1 */
1834 s->respid1 = val;
1835 break;
1836 case 0x4d: /* STEST1 */
1837 s->stest1 = val;
1838 break;
1839 case 0x4e: /* STEST2 */
1840 if (val & 1) {
1841 BADF("Low level mode not implemented\n");
1842 }
1843 s->stest2 = val;
1844 break;
1845 case 0x4f: /* STEST3 */
1846 if (val & 0x41) {
1847 BADF("SCSI FIFO test mode not implemented\n");
1848 }
1849 s->stest3 = val;
1850 break;
1851 case 0x56: /* CCNTL0 */
1852 s->ccntl0 = val;
1853 break;
1854 case 0x57: /* CCNTL1 */
1855 s->ccntl1 = val;
1856 break;
1857 CASE_SET_REG32(mmrs, 0xa0)
1858 CASE_SET_REG32(mmws, 0xa4)
1859 CASE_SET_REG32(sfs, 0xa8)
1860 CASE_SET_REG32(drs, 0xac)
1861 CASE_SET_REG32(sbms, 0xb0)
ab57d967 1862 CASE_SET_REG32(dbms, 0xb4)
7d8406be
PB		 1863 CASE_SET_REG32(dnad64, 0xb8)
1864 CASE_SET_REG32(pmjad1, 0xc0)
1865 CASE_SET_REG32(pmjad2, 0xc4)
1866 CASE_SET_REG32(rbc, 0xc8)
1867 CASE_SET_REG32(ua, 0xcc)
1868 CASE_SET_REG32(ia, 0xd4)
1869 CASE_SET_REG32(sbc, 0xd8)
1870 CASE_SET_REG32(csbc, 0xdc)
1871 default:
1872 if (offset >= 0x5c && offset < 0xa0) {
1873 int n;
1874 int shift;
1875 n = (offset - 0x58) >> 2;
1876 shift = (offset & 3) * 8;
1877 s->scratch[n] &= ~(0xff << shift);
1878 s->scratch[n] |= (val & 0xff) << shift;
1879 } else {
1880 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1881 }
1882 }
49c47daa 1883#undef CASE_SET_REG24
7d8406be
PB		 1884#undef CASE_SET_REG32
1885}
1886
b0ce84e5
AK		 1887static void lsi_mmio_write(void *opaque, target_phys_addr_t addr,
1888 uint64_t val, unsigned size)
7d8406be 1889{
eb40f984 1890 LSIState *s = opaque;
7d8406be
PB		 1891
1892 lsi_reg_writeb(s, addr & 0xff, val);
1893}
1894
b0ce84e5
AK		 1895static uint64_t lsi_mmio_read(void *opaque, target_phys_addr_t addr,
1896 unsigned size)
7d8406be 1897{
eb40f984 1898 LSIState *s = opaque;
7d8406be
PB		 1899
1900 return lsi_reg_readb(s, addr & 0xff);
1901}
1902
b0ce84e5
AK		 1903static const MemoryRegionOps lsi_mmio_ops = {
1904 .read = lsi_mmio_read,
1905 .write = lsi_mmio_write,
1906 .endianness = DEVICE_NATIVE_ENDIAN,
1907 .impl = {
1908 .min_access_size = 1,
1909 .max_access_size = 1,
1910 },
7d8406be
PB		 1911};
1912
b0ce84e5
AK		 1913static void lsi_ram_write(void *opaque, target_phys_addr_t addr,
1914 uint64_t val, unsigned size)
7d8406be 1915{
eb40f984 1916 LSIState *s = opaque;
7d8406be 1917 uint32_t newval;
b0ce84e5 1918 uint32_t mask;
7d8406be
PB		 1919 int shift;
1920
7d8406be
PB		 1921 newval = s->script_ram[addr >> 2];
1922 shift = (addr & 3) * 8;
b0ce84e5
AK		 1923 mask = ((uint64_t)1 << (size * 8)) - 1;
1924 newval &= ~(mask << shift);
7d8406be
PB		 1925 newval |= val << shift;
1926 s->script_ram[addr >> 2] = newval;
1927}
1928
b0ce84e5
AK		 1929static uint64_t lsi_ram_read(void *opaque, target_phys_addr_t addr,
1930 unsigned size)
7d8406be 1931{
eb40f984 1932 LSIState *s = opaque;
7d8406be 1933 uint32_t val;
b0ce84e5 1934 uint32_t mask;
7d8406be 1935
7d8406be 1936 val = s->script_ram[addr >> 2];
b0ce84e5 1937 mask = ((uint64_t)1 << (size * 8)) - 1;
7d8406be 1938 val >>= (addr & 3) * 8;
b0ce84e5 1939 return val & mask;
7d8406be
PB		 1940}
1941
b0ce84e5
AK		 1942static const MemoryRegionOps lsi_ram_ops = {
1943 .read = lsi_ram_read,
1944 .write = lsi_ram_write,
1945 .endianness = DEVICE_NATIVE_ENDIAN,
7d8406be
PB		 1946};
1947
b0ce84e5
AK		 1948static uint64_t lsi_io_read(void *opaque, target_phys_addr_t addr,
1949 unsigned size)
7d8406be 1950{
eb40f984 1951 LSIState *s = opaque;
7d8406be
PB		 1952 return lsi_reg_readb(s, addr & 0xff);
1953}
1954
b0ce84e5
AK		 1955static void lsi_io_write(void *opaque, target_phys_addr_t addr,
1956 uint64_t val, unsigned size)
7d8406be 1957{
eb40f984 1958 LSIState *s = opaque;
7d8406be
PB		 1959 lsi_reg_writeb(s, addr & 0xff, val);
1960}
1961
b0ce84e5
AK		 1962static const MemoryRegionOps lsi_io_ops = {
1963 .read = lsi_io_read,
1964 .write = lsi_io_write,
1965 .endianness = DEVICE_NATIVE_ENDIAN,
1966 .impl = {
1967 .min_access_size = 1,
1968 .max_access_size = 1,
1969 },
1970};
7d8406be 1971
54eefd72
JK		 1972static void lsi_scsi_reset(DeviceState *dev)
1973{
1974 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
1975
1976 lsi_soft_reset(s);
1977}
1978
4a1b0f1c 1979static void lsi_pre_save(void *opaque)
777aec7a
N		 1980{
1981 LSIState *s = opaque;
1982
b96a0da0
GH		 1983 if (s->current) {
1984 assert(s->current->dma_buf == NULL);
1985 assert(s->current->dma_len == 0);
1986 }
042ec49d 1987 assert(QTAILQ_EMPTY(&s->queue));
777aec7a
N		 1988}
1989
4a1b0f1c
JQ		 1990static const VMStateDescription vmstate_lsi_scsi = {
1991 .name = "lsiscsi",
1992 .version_id = 0,
1993 .minimum_version_id = 0,
1994 .minimum_version_id_old = 0,
1995 .pre_save = lsi_pre_save,
1996 .fields = (VMStateField []) {
1997 VMSTATE_PCI_DEVICE(dev, LSIState),
1998
1999 VMSTATE_INT32(carry, LSIState),
2f172849 2000 VMSTATE_INT32(status, LSIState),
4a1b0f1c
JQ		 2001 VMSTATE_INT32(msg_action, LSIState),
2002 VMSTATE_INT32(msg_len, LSIState),
2003 VMSTATE_BUFFER(msg, LSIState),
2004 VMSTATE_INT32(waiting, LSIState),
2005
2006 VMSTATE_UINT32(dsa, LSIState),
2007 VMSTATE_UINT32(temp, LSIState),
2008 VMSTATE_UINT32(dnad, LSIState),
2009 VMSTATE_UINT32(dbc, LSIState),
2010 VMSTATE_UINT8(istat0, LSIState),
2011 VMSTATE_UINT8(istat1, LSIState),
2012 VMSTATE_UINT8(dcmd, LSIState),
2013 VMSTATE_UINT8(dstat, LSIState),
2014 VMSTATE_UINT8(dien, LSIState),
2015 VMSTATE_UINT8(sist0, LSIState),
2016 VMSTATE_UINT8(sist1, LSIState),
2017 VMSTATE_UINT8(sien0, LSIState),
2018 VMSTATE_UINT8(sien1, LSIState),
2019 VMSTATE_UINT8(mbox0, LSIState),
2020 VMSTATE_UINT8(mbox1, LSIState),
2021 VMSTATE_UINT8(dfifo, LSIState),
2022 VMSTATE_UINT8(ctest2, LSIState),
2023 VMSTATE_UINT8(ctest3, LSIState),
2024 VMSTATE_UINT8(ctest4, LSIState),
2025 VMSTATE_UINT8(ctest5, LSIState),
2026 VMSTATE_UINT8(ccntl0, LSIState),
2027 VMSTATE_UINT8(ccntl1, LSIState),
2028 VMSTATE_UINT32(dsp, LSIState),
2029 VMSTATE_UINT32(dsps, LSIState),
2030 VMSTATE_UINT8(dmode, LSIState),
2031 VMSTATE_UINT8(dcntl, LSIState),
2032 VMSTATE_UINT8(scntl0, LSIState),
2033 VMSTATE_UINT8(scntl1, LSIState),
2034 VMSTATE_UINT8(scntl2, LSIState),
2035 VMSTATE_UINT8(scntl3, LSIState),
2036 VMSTATE_UINT8(sstat0, LSIState),
2037 VMSTATE_UINT8(sstat1, LSIState),
2038 VMSTATE_UINT8(scid, LSIState),
2039 VMSTATE_UINT8(sxfer, LSIState),
2040 VMSTATE_UINT8(socl, LSIState),
2041 VMSTATE_UINT8(sdid, LSIState),
2042 VMSTATE_UINT8(ssid, LSIState),
2043 VMSTATE_UINT8(sfbr, LSIState),
2044 VMSTATE_UINT8(stest1, LSIState),
2045 VMSTATE_UINT8(stest2, LSIState),
2046 VMSTATE_UINT8(stest3, LSIState),
2047 VMSTATE_UINT8(sidl, LSIState),
2048 VMSTATE_UINT8(stime0, LSIState),
2049 VMSTATE_UINT8(respid0, LSIState),
2050 VMSTATE_UINT8(respid1, LSIState),
2051 VMSTATE_UINT32(mmrs, LSIState),
2052 VMSTATE_UINT32(mmws, LSIState),
2053 VMSTATE_UINT32(sfs, LSIState),
2054 VMSTATE_UINT32(drs, LSIState),
2055 VMSTATE_UINT32(sbms, LSIState),
2056 VMSTATE_UINT32(dbms, LSIState),
2057 VMSTATE_UINT32(dnad64, LSIState),
2058 VMSTATE_UINT32(pmjad1, LSIState),
2059 VMSTATE_UINT32(pmjad2, LSIState),
2060 VMSTATE_UINT32(rbc, LSIState),
2061 VMSTATE_UINT32(ua, LSIState),
2062 VMSTATE_UINT32(ia, LSIState),
2063 VMSTATE_UINT32(sbc, LSIState),
2064 VMSTATE_UINT32(csbc, LSIState),
2065 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2066 VMSTATE_UINT8(sbr, LSIState),
2067
2068 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2069 VMSTATE_END_OF_LIST()
777aec7a 2070 }
4a1b0f1c 2071};
777aec7a 2072
4b09be85
AL		 2073static int lsi_scsi_uninit(PCIDevice *d)
2074{
f305261f 2075 LSIState *s = DO_UPCAST(LSIState, dev, d);
4b09be85 2076
b0ce84e5
AK		 2077 memory_region_destroy(&s->mmio_io);
2078 memory_region_destroy(&s->ram_io);
2079 memory_region_destroy(&s->io_io);
4b09be85 2080
4b09be85
AL		 2081 return 0;
2082}
2083
afd4030c
PB		 2084static const struct SCSIBusInfo lsi_scsi_info = {
2085 .tcq = true,
7e0380b9
PB		 2086 .max_target = LSI_MAX_DEVS,
2087 .max_lun = 0, /* LUN support is buggy */
afd4030c 2088
c6df7102 2089 .transfer_data = lsi_transfer_data,
94d3f98a
PB		 2090 .complete = lsi_command_complete,
2091 .cancel = lsi_request_cancelled
cfdc1bb0
PB		 2092};
2093
81a322d4 2094static int lsi_scsi_init(PCIDevice *dev)
7d8406be 2095{
f305261f 2096 LSIState *s = DO_UPCAST(LSIState, dev, dev);
deb54399 2097 uint8_t *pci_conf;
7d8406be 2098
f305261f 2099 pci_conf = s->dev.config;
deb54399 2100
9167a69a 2101 /* PCI latency timer = 255 */
5845f0e5 2102 pci_conf[PCI_LATENCY_TIMER] = 0xff;
817e0b6f 2103 /* Interrupt pin A */
5845f0e5 2104 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
7d8406be 2105
b0ce84e5
AK		 2106 memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
2107 memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
2108 memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
2109
e824b2cc
AK		 2110 pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2111 pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
2112 pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
042ec49d 2113 QTAILQ_INIT(&s->queue);
7d8406be 2114
afd4030c 2115 scsi_bus_new(&s->bus, &dev->qdev, &lsi_scsi_info);
5b684b5a 2116 if (!dev->qdev.hotplugged) {
fa66b909 2117 return scsi_bus_legacy_handle_cmdline(&s->bus);
5b684b5a 2118 }
81a322d4 2119 return 0;
7d8406be 2120}
9be5dafe 2121
40021f08
AL		 2122static void lsi_class_init(ObjectClass *klass, void *data)
2123{
39bffca2 2124 DeviceClass *dc = DEVICE_CLASS(klass);
40021f08
AL		 2125 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2126
2127 k->init = lsi_scsi_init;
2128 k->exit = lsi_scsi_uninit;
2129 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2130 k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2131 k->class_id = PCI_CLASS_STORAGE_SCSI;
2132 k->subsystem_id = 0x1000;
39bffca2
AL		 2133 dc->reset = lsi_scsi_reset;
2134 dc->vmsd = &vmstate_lsi_scsi;
40021f08
AL		 2135}
2136
39bffca2
AL		 2137static TypeInfo lsi_info = {
2138 .name = "lsi53c895a",
2139 .parent = TYPE_PCI_DEVICE,
2140 .instance_size = sizeof(LSIState),
2141 .class_init = lsi_class_init,
0aab0d3a
GH		 2142};
2143
83f7d43a 2144static void lsi53c895a_register_types(void)
9be5dafe 2145{
39bffca2 2146 type_register_static(&lsi_info);
9be5dafe
PB		 2147}
2148
83f7d43a 2149type_init(lsi53c895a_register_types)
Qemu copy for testing