]> git.proxmox.com Git - qemu.git/blame - hw/lsi53c895a.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
qom: Unify type registration
[qemu.git] / hw / lsi53c895a.c
CommitLineData
5fafdf24 1/*
7d8406be
PB		 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
8e31bf38 7 * This code is licensed under the LGPL.
7d8406be
PB		 8 */
9
10/* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
a15fdf86 13#include <assert.h>
777aec7a 14
87ecb68b
PB		 15#include "hw.h"
16#include "pci.h"
43b443b6 17#include "scsi.h"
9ba4524c
EGM		 18#include "block_int.h"
19#include "dma.h"
7d8406be
PB		 20
21//#define DEBUG_LSI
22//#define DEBUG_LSI_REG
23
24#ifdef DEBUG_LSI
001faf32
BS		 25#define DPRINTF(fmt, ...) \
26do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
27#define BADF(fmt, ...) \
28do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
7d8406be 29#else
001faf32
BS		 30#define DPRINTF(fmt, ...) do {} while(0)
31#define BADF(fmt, ...) \
32do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
7d8406be
PB		 33#endif
34
18e08a55
MT		 35#define LSI_MAX_DEVS 7
36
7d8406be
PB		 37#define LSI_SCNTL0_TRG 0x01
38#define LSI_SCNTL0_AAP 0x02
39#define LSI_SCNTL0_EPC 0x08
40#define LSI_SCNTL0_WATN 0x10
41#define LSI_SCNTL0_START 0x20
42
43#define LSI_SCNTL1_SST 0x01
44#define LSI_SCNTL1_IARB 0x02
45#define LSI_SCNTL1_AESP 0x04
46#define LSI_SCNTL1_RST 0x08
47#define LSI_SCNTL1_CON 0x10
48#define LSI_SCNTL1_DHP 0x20
49#define LSI_SCNTL1_ADB 0x40
50#define LSI_SCNTL1_EXC 0x80
51
52#define LSI_SCNTL2_WSR 0x01
53#define LSI_SCNTL2_VUE0 0x02
54#define LSI_SCNTL2_VUE1 0x04
55#define LSI_SCNTL2_WSS 0x08
56#define LSI_SCNTL2_SLPHBEN 0x10
57#define LSI_SCNTL2_SLPMD 0x20
58#define LSI_SCNTL2_CHM 0x40
59#define LSI_SCNTL2_SDU 0x80
60
61#define LSI_ISTAT0_DIP 0x01
62#define LSI_ISTAT0_SIP 0x02
63#define LSI_ISTAT0_INTF 0x04
64#define LSI_ISTAT0_CON 0x08
65#define LSI_ISTAT0_SEM 0x10
66#define LSI_ISTAT0_SIGP 0x20
67#define LSI_ISTAT0_SRST 0x40
68#define LSI_ISTAT0_ABRT 0x80
69
70#define LSI_ISTAT1_SI 0x01
71#define LSI_ISTAT1_SRUN 0x02
72#define LSI_ISTAT1_FLSH 0x04
73
74#define LSI_SSTAT0_SDP0 0x01
75#define LSI_SSTAT0_RST 0x02
76#define LSI_SSTAT0_WOA 0x04
77#define LSI_SSTAT0_LOA 0x08
78#define LSI_SSTAT0_AIP 0x10
79#define LSI_SSTAT0_OLF 0x20
80#define LSI_SSTAT0_ORF 0x40
81#define LSI_SSTAT0_ILF 0x80
82
83#define LSI_SIST0_PAR 0x01
84#define LSI_SIST0_RST 0x02
85#define LSI_SIST0_UDC 0x04
86#define LSI_SIST0_SGE 0x08
87#define LSI_SIST0_RSL 0x10
88#define LSI_SIST0_SEL 0x20
89#define LSI_SIST0_CMP 0x40
90#define LSI_SIST0_MA 0x80
91
92#define LSI_SIST1_HTH 0x01
93#define LSI_SIST1_GEN 0x02
94#define LSI_SIST1_STO 0x04
95#define LSI_SIST1_SBMC 0x10
96
97#define LSI_SOCL_IO 0x01
98#define LSI_SOCL_CD 0x02
99#define LSI_SOCL_MSG 0x04
100#define LSI_SOCL_ATN 0x08
101#define LSI_SOCL_SEL 0x10
102#define LSI_SOCL_BSY 0x20
103#define LSI_SOCL_ACK 0x40
104#define LSI_SOCL_REQ 0x80
105
106#define LSI_DSTAT_IID 0x01
107#define LSI_DSTAT_SIR 0x04
108#define LSI_DSTAT_SSI 0x08
109#define LSI_DSTAT_ABRT 0x10
110#define LSI_DSTAT_BF 0x20
111#define LSI_DSTAT_MDPE 0x40
112#define LSI_DSTAT_DFE 0x80
113
114#define LSI_DCNTL_COM 0x01
115#define LSI_DCNTL_IRQD 0x02
116#define LSI_DCNTL_STD 0x04
117#define LSI_DCNTL_IRQM 0x08
118#define LSI_DCNTL_SSM 0x10
119#define LSI_DCNTL_PFEN 0x20
120#define LSI_DCNTL_PFF 0x40
121#define LSI_DCNTL_CLSE 0x80
122
123#define LSI_DMODE_MAN 0x01
124#define LSI_DMODE_BOF 0x02
125#define LSI_DMODE_ERMP 0x04
126#define LSI_DMODE_ERL 0x08
127#define LSI_DMODE_DIOM 0x10
128#define LSI_DMODE_SIOM 0x20
129
130#define LSI_CTEST2_DACK 0x01
131#define LSI_CTEST2_DREQ 0x02
132#define LSI_CTEST2_TEOP 0x04
133#define LSI_CTEST2_PCICIE 0x08
134#define LSI_CTEST2_CM 0x10
135#define LSI_CTEST2_CIO 0x20
136#define LSI_CTEST2_SIGP 0x40
137#define LSI_CTEST2_DDIR 0x80
138
139#define LSI_CTEST5_BL2 0x04
140#define LSI_CTEST5_DDIR 0x08
141#define LSI_CTEST5_MASR 0x10
142#define LSI_CTEST5_DFSN 0x20
143#define LSI_CTEST5_BBCK 0x40
144#define LSI_CTEST5_ADCK 0x80
145
146#define LSI_CCNTL0_DILS 0x01
147#define LSI_CCNTL0_DISFC 0x10
148#define LSI_CCNTL0_ENNDJ 0x20
149#define LSI_CCNTL0_PMJCTL 0x40
150#define LSI_CCNTL0_ENPMJ 0x80
151
b25cf589
AL		 152#define LSI_CCNTL1_EN64DBMV 0x01
153#define LSI_CCNTL1_EN64TIBMV 0x02
154#define LSI_CCNTL1_64TIMOD 0x04
155#define LSI_CCNTL1_DDAC 0x08
156#define LSI_CCNTL1_ZMOD 0x80
157
e560125e
LA		 158/* Enable Response to Reselection */
159#define LSI_SCID_RRE 0x60
160
b25cf589
AL		 161#define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
162
7d8406be
PB		 163#define PHASE_DO 0
164#define PHASE_DI 1
165#define PHASE_CMD 2
166#define PHASE_ST 3
167#define PHASE_MO 6
168#define PHASE_MI 7
169#define PHASE_MASK 7
170
a917d384
PB		 171/* Maximum length of MSG IN data. */
172#define LSI_MAX_MSGIN_LEN 8
173
174/* Flag set if this is a tagged command. */
175#define LSI_TAG_VALID (1 << 16)
176
042ec49d 177typedef struct lsi_request {
5c6c0e51 178 SCSIRequest *req;
a917d384 179 uint32_t tag;
b96a0da0
GH		 180 uint32_t dma_len;
181 uint8_t *dma_buf;
a917d384
PB		 182 uint32_t pending;
183 int out;
042ec49d
GH		 184 QTAILQ_ENTRY(lsi_request) next;
185} lsi_request;
4d611c9a 186
7d8406be 187typedef struct {
f305261f 188 PCIDevice dev;
b0ce84e5
AK		 189 MemoryRegion mmio_io;
190 MemoryRegion ram_io;
191 MemoryRegion io_io;
7d8406be
PB		 192
193 int carry; /* ??? Should this be an a visible register somewhere? */
2f172849 194 int status;
a917d384 195 /* Action to take at the end of a MSG IN phase.
a15fdf86 196 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
a917d384
PB		 197 int msg_action;
198 int msg_len;
199 uint8_t msg[LSI_MAX_MSGIN_LEN];
4d611c9a
PB		 200 /* 0 if SCRIPTS are running or stopped.
201 * 1 if a Wait Reselect instruction has been issued.
a917d384
PB		 202 * 2 if processing DMA from lsi_execute_script.
203 * 3 if a DMA operation is in progress. */
7d8406be 204 int waiting;
ca9c39fa 205 SCSIBus bus;
7d8406be 206 int current_lun;
a917d384 207 /* The tag is a combination of the device ID and the SCSI tag. */
af12ac98 208 uint32_t select_tag;
8ccc2ace 209 int command_complete;
042ec49d 210 QTAILQ_HEAD(, lsi_request) queue;
af12ac98 211 lsi_request *current;
7d8406be
PB		 212
213 uint32_t dsa;
214 uint32_t temp;
215 uint32_t dnad;
216 uint32_t dbc;
217 uint8_t istat0;
218 uint8_t istat1;
219 uint8_t dcmd;
220 uint8_t dstat;
221 uint8_t dien;
222 uint8_t sist0;
223 uint8_t sist1;
224 uint8_t sien0;
225 uint8_t sien1;
226 uint8_t mbox0;
227 uint8_t mbox1;
228 uint8_t dfifo;
9167a69a 229 uint8_t ctest2;
7d8406be
PB		 230 uint8_t ctest3;
231 uint8_t ctest4;
232 uint8_t ctest5;
233 uint8_t ccntl0;
234 uint8_t ccntl1;
235 uint32_t dsp;
236 uint32_t dsps;
237 uint8_t dmode;
238 uint8_t dcntl;
239 uint8_t scntl0;
240 uint8_t scntl1;
241 uint8_t scntl2;
242 uint8_t scntl3;
243 uint8_t sstat0;
244 uint8_t sstat1;
245 uint8_t scid;
246 uint8_t sxfer;
247 uint8_t socl;
248 uint8_t sdid;
a917d384 249 uint8_t ssid;
7d8406be
PB		 250 uint8_t sfbr;
251 uint8_t stest1;
252 uint8_t stest2;
253 uint8_t stest3;
a917d384 254 uint8_t sidl;
7d8406be
PB		 255 uint8_t stime0;
256 uint8_t respid0;
257 uint8_t respid1;
258 uint32_t mmrs;
259 uint32_t mmws;
260 uint32_t sfs;
261 uint32_t drs;
262 uint32_t sbms;
ab57d967 263 uint32_t dbms;
7d8406be
PB		 264 uint32_t dnad64;
265 uint32_t pmjad1;
266 uint32_t pmjad2;
267 uint32_t rbc;
268 uint32_t ua;
269 uint32_t ia;
270 uint32_t sbc;
271 uint32_t csbc;
dcfb9014 272 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
bd8ee11a 273 uint8_t sbr;
7d8406be
PB		 274
275 /* Script ram is stored as 32-bit words in host byteorder. */
276 uint32_t script_ram[2048];
277} LSIState;
278
e560125e
LA		 279static inline int lsi_irq_on_rsl(LSIState *s)
280{
281 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
282}
283
7d8406be
PB		 284static void lsi_soft_reset(LSIState *s)
285{
51336214
JK		 286 lsi_request *p;
287
7d8406be
PB		 288 DPRINTF("Reset\n");
289 s->carry = 0;
290
d43ba0af
JK		 291 s->msg_action = 0;
292 s->msg_len = 0;
7d8406be
PB		 293 s->waiting = 0;
294 s->dsa = 0;
295 s->dnad = 0;
296 s->dbc = 0;
297 s->temp = 0;
298 memset(s->scratch, 0, sizeof(s->scratch));
299 s->istat0 = 0;
300 s->istat1 = 0;
12aa6dd6
JK		 301 s->dcmd = 0x40;
302 s->dstat = LSI_DSTAT_DFE;
7d8406be
PB		 303 s->dien = 0;
304 s->sist0 = 0;
305 s->sist1 = 0;
306 s->sien0 = 0;
307 s->sien1 = 0;
308 s->mbox0 = 0;
309 s->mbox1 = 0;
310 s->dfifo = 0;
12aa6dd6 311 s->ctest2 = LSI_CTEST2_DACK;
7d8406be
PB		 312 s->ctest3 = 0;
313 s->ctest4 = 0;
314 s->ctest5 = 0;
315 s->ccntl0 = 0;
316 s->ccntl1 = 0;
317 s->dsp = 0;
318 s->dsps = 0;
319 s->dmode = 0;
320 s->dcntl = 0;
321 s->scntl0 = 0xc0;
322 s->scntl1 = 0;
323 s->scntl2 = 0;
324 s->scntl3 = 0;
325 s->sstat0 = 0;
326 s->sstat1 = 0;
327 s->scid = 7;
328 s->sxfer = 0;
329 s->socl = 0;
12aa6dd6
JK		 330 s->sdid = 0;
331 s->ssid = 0;
7d8406be
PB		 332 s->stest1 = 0;
333 s->stest2 = 0;
334 s->stest3 = 0;
a917d384 335 s->sidl = 0;
7d8406be
PB		 336 s->stime0 = 0;
337 s->respid0 = 0x80;
338 s->respid1 = 0;
339 s->mmrs = 0;
340 s->mmws = 0;
341 s->sfs = 0;
342 s->drs = 0;
343 s->sbms = 0;
ab57d967 344 s->dbms = 0;
7d8406be
PB		 345 s->dnad64 = 0;
346 s->pmjad1 = 0;
347 s->pmjad2 = 0;
348 s->rbc = 0;
349 s->ua = 0;
350 s->ia = 0;
351 s->sbc = 0;
352 s->csbc = 0;
bd8ee11a 353 s->sbr = 0;
51336214
JK		 354 while (!QTAILQ_EMPTY(&s->queue)) {
355 p = QTAILQ_FIRST(&s->queue);
356 QTAILQ_REMOVE(&s->queue, p, next);
7267c094 357 g_free(p);
51336214
JK		 358 }
359 if (s->current) {
7267c094 360 g_free(s->current);
51336214
JK		 361 s->current = NULL;
362 }
7d8406be
PB		 363}
364
b25cf589
AL		 365static int lsi_dma_40bit(LSIState *s)
366{
367 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
368 return 1;
369 return 0;
370}
371
dd8edf01
AL		 372static int lsi_dma_ti64bit(LSIState *s)
373{
374 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
375 return 1;
376 return 0;
377}
378
379static int lsi_dma_64bit(LSIState *s)
380{
381 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
382 return 1;
383 return 0;
384}
385
7d8406be
PB		 386static uint8_t lsi_reg_readb(LSIState *s, int offset);
387static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
4d611c9a 388static void lsi_execute_script(LSIState *s);
aa4d32c4 389static void lsi_reselect(LSIState *s, lsi_request *p);
7d8406be
PB		 390
391static inline uint32_t read_dword(LSIState *s, uint32_t addr)
392{
393 uint32_t buf;
394
9e486d67 395 pci_dma_read(&s->dev, addr, &buf, 4);
7d8406be
PB		 396 return cpu_to_le32(buf);
397}
398
399static void lsi_stop_script(LSIState *s)
400{
401 s->istat1 &= ~LSI_ISTAT1_SRUN;
402}
403
404static void lsi_update_irq(LSIState *s)
405{
406 int level;
407 static int last_level;
042ec49d 408 lsi_request *p;
7d8406be
PB		 409
410 /* It's unclear whether the DIP/SIP bits should be cleared when the
411 Interrupt Status Registers are cleared or when istat0 is read.
412 We currently do the formwer, which seems to work. */
413 level = 0;
414 if (s->dstat) {
415 if (s->dstat & s->dien)
416 level = 1;
417 s->istat0 |= LSI_ISTAT0_DIP;
418 } else {
419 s->istat0 &= ~LSI_ISTAT0_DIP;
420 }
421
422 if (s->sist0 || s->sist1) {
423 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
424 level = 1;
425 s->istat0 |= LSI_ISTAT0_SIP;
426 } else {
427 s->istat0 &= ~LSI_ISTAT0_SIP;
428 }
429 if (s->istat0 & LSI_ISTAT0_INTF)
430 level = 1;
431
432 if (level != last_level) {
433 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
434 level, s->dstat, s->sist1, s->sist0);
435 last_level = level;
436 }
f305261f 437 qemu_set_irq(s->dev.irq[0], level);
e560125e
LA		 438
439 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
440 DPRINTF("Handled IRQs & disconnected, looking for pending "
441 "processes\n");
042ec49d
GH		 442 QTAILQ_FOREACH(p, &s->queue, next) {
443 if (p->pending) {
aa4d32c4 444 lsi_reselect(s, p);
e560125e
LA		 445 break;
446 }
447 }
448 }
7d8406be
PB		 449}
450
451/* Stop SCRIPTS execution and raise a SCSI interrupt. */
452static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
453{
454 uint32_t mask0;
455 uint32_t mask1;
456
457 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
458 stat1, stat0, s->sist1, s->sist0);
459 s->sist0 |= stat0;
460 s->sist1 |= stat1;
461 /* Stop processor on fatal or unmasked interrupt. As a special hack
462 we don't stop processing when raising STO. Instead continue
463 execution and stop at the next insn that accesses the SCSI bus. */
464 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
465 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
466 mask1 &= ~LSI_SIST1_STO;
467 if (s->sist0 & mask0 || s->sist1 & mask1) {
468 lsi_stop_script(s);
469 }
470 lsi_update_irq(s);
471}
472
473/* Stop SCRIPTS execution and raise a DMA interrupt. */
474static void lsi_script_dma_interrupt(LSIState *s, int stat)
475{
476 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
477 s->dstat |= stat;
478 lsi_update_irq(s);
479 lsi_stop_script(s);
480}
481
482static inline void lsi_set_phase(LSIState *s, int phase)
483{
484 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
485}
486
487static void lsi_bad_phase(LSIState *s, int out, int new_phase)
488{
489 /* Trigger a phase mismatch. */
490 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
d1d74664
PB		 491 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
492 s->dsp = out ? s->pmjad1 : s->pmjad2;
7d8406be 493 } else {
d1d74664 494 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
7d8406be
PB		 495 }
496 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
497 } else {
498 DPRINTF("Phase mismatch interrupt\n");
499 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
500 lsi_stop_script(s);
501 }
502 lsi_set_phase(s, new_phase);
503}
504
a917d384
PB		 505
506/* Resume SCRIPTS execution after a DMA operation. */
507static void lsi_resume_script(LSIState *s)
508{
509 if (s->waiting != 2) {
510 s->waiting = 0;
511 lsi_execute_script(s);
512 } else {
513 s->waiting = 0;
514 }
515}
516
64d56409
JK		 517static void lsi_disconnect(LSIState *s)
518{
519 s->scntl1 &= ~LSI_SCNTL1_CON;
520 s->sstat1 &= ~PHASE_MASK;
521}
522
523static void lsi_bad_selection(LSIState *s, uint32_t id)
524{
525 DPRINTF("Selected absent target %d\n", id);
526 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
527 lsi_disconnect(s);
528}
529
4d611c9a 530/* Initiate a SCSI layer data transfer. */
7d8406be
PB		 531static void lsi_do_dma(LSIState *s, int out)
532{
f48a7a6e 533 uint32_t count;
9ba4524c 534 dma_addr_t addr;
64d56409 535 SCSIDevice *dev;
7d8406be 536
b96a0da0
GH		 537 assert(s->current);
538 if (!s->current->dma_len) {
a917d384
PB		 539 /* Wait until data is available. */
540 DPRINTF("DMA no data available\n");
541 return;
7d8406be
PB		 542 }
543
f48a7a6e
PB		 544 dev = s->current->req->dev;
545 assert(dev);
64d56409 546
a917d384 547 count = s->dbc;
b96a0da0
GH		 548 if (count > s->current->dma_len)
549 count = s->current->dma_len;
a917d384
PB		 550
551 addr = s->dnad;
dd8edf01
AL		 552 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
553 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
b25cf589 554 addr |= ((uint64_t)s->dnad64 << 32);
dd8edf01
AL		 555 else if (s->dbms)
556 addr |= ((uint64_t)s->dbms << 32);
b25cf589
AL		 557 else if (s->sbms)
558 addr |= ((uint64_t)s->sbms << 32);
559
9ba4524c 560 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
7d8406be 561 s->csbc += count;
a917d384
PB		 562 s->dnad += count;
563 s->dbc -= count;
5c6c0e51 564 if (s->current->dma_buf == NULL) {
0c34459b 565 s->current->dma_buf = scsi_req_get_buf(s->current->req);
a917d384 566 }
7d8406be 567 /* ??? Set SFBR to first data byte. */
a917d384 568 if (out) {
9ba4524c 569 pci_dma_read(&s->dev, addr, s->current->dma_buf, count);
a917d384 570 } else {
9ba4524c 571 pci_dma_write(&s->dev, addr, s->current->dma_buf, count);
a917d384 572 }
b96a0da0
GH		 573 s->current->dma_len -= count;
574 if (s->current->dma_len == 0) {
575 s->current->dma_buf = NULL;
ad3376cc 576 scsi_req_continue(s->current->req);
a917d384 577 } else {
b96a0da0 578 s->current->dma_buf += count;
a917d384
PB		 579 lsi_resume_script(s);
580 }
581}
582
583
584/* Add a command to the queue. */
585static void lsi_queue_command(LSIState *s)
586{
af12ac98 587 lsi_request *p = s->current;
a917d384 588
aa2b1e89 589 DPRINTF("Queueing tag=0x%x\n", p->tag);
af12ac98 590 assert(s->current != NULL);
b96a0da0 591 assert(s->current->dma_len == 0);
af12ac98
GH		 592 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
593 s->current = NULL;
594
a917d384
PB		 595 p->pending = 0;
596 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
597}
598
599/* Queue a byte for a MSG IN phase. */
600static void lsi_add_msg_byte(LSIState *s, uint8_t data)
601{
602 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
603 BADF("MSG IN data too long\n");
4d611c9a 604 } else {
a917d384
PB		 605 DPRINTF("MSG IN 0x%02x\n", data);
606 s->msg[s->msg_len++] = data;
7d8406be 607 }
a917d384
PB		 608}
609
610/* Perform reselection to continue a command. */
aa4d32c4 611static void lsi_reselect(LSIState *s, lsi_request *p)
a917d384 612{
a917d384
PB		 613 int id;
614
af12ac98
GH		 615 assert(s->current == NULL);
616 QTAILQ_REMOVE(&s->queue, p, next);
617 s->current = p;
618
aa4d32c4 619 id = (p->tag >> 8) & 0xf;
a917d384 620 s->ssid = id | 0x80;
cc9f28bc 621 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
f6dc18df 622 if (!(s->dcntl & LSI_DCNTL_COM)) {
cc9f28bc
LA		 623 s->sfbr = 1 << (id & 0x7);
624 }
a917d384 625 DPRINTF("Reselected target %d\n", id);
a917d384
PB		 626 s->scntl1 |= LSI_SCNTL1_CON;
627 lsi_set_phase(s, PHASE_MI);
628 s->msg_action = p->out ? 2 : 3;
b96a0da0 629 s->current->dma_len = p->pending;
a917d384 630 lsi_add_msg_byte(s, 0x80);
af12ac98 631 if (s->current->tag & LSI_TAG_VALID) {
a917d384 632 lsi_add_msg_byte(s, 0x20);
aa4d32c4 633 lsi_add_msg_byte(s, p->tag & 0xff);
a917d384
PB		 634 }
635
e560125e
LA		 636 if (lsi_irq_on_rsl(s)) {
637 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
638 }
a917d384
PB		 639}
640
11257187 641static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
a917d384 642{
042ec49d
GH		 643 lsi_request *p;
644
645 QTAILQ_FOREACH(p, &s->queue, next) {
a917d384 646 if (p->tag == tag) {
11257187 647 return p;
a917d384
PB		 648 }
649 }
11257187
PB		 650
651 return NULL;
652}
653
94d3f98a
PB		 654static void lsi_request_cancelled(SCSIRequest *req)
655{
656 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
c5bf71a9 657 lsi_request *p = req->hba_private;
94d3f98a
PB		 658
659 if (s->current && req == s->current->req) {
660 scsi_req_unref(req);
7267c094 661 g_free(s->current);
94d3f98a
PB		 662 s->current = NULL;
663 return;
664 }
665
94d3f98a
PB		 666 if (p) {
667 QTAILQ_REMOVE(&s->queue, p, next);
668 scsi_req_unref(req);
7267c094 669 g_free(p);
94d3f98a
PB		 670 }
671}
672
11257187
PB		 673/* Record that data is available for a queued command. Returns zero if
674 the device was reselected, nonzero if the IO is deferred. */
c5bf71a9 675static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
11257187 676{
c5bf71a9 677 lsi_request *p = req->hba_private;
11257187
PB		 678
679 if (p->pending) {
c5bf71a9 680 BADF("Multiple IO pending for request %p\n", p);
11257187 681 }
aba1f023 682 p->pending = len;
11257187
PB		 683 /* Reselect if waiting for it, or if reselection triggers an IRQ
684 and the bus is free.
685 Since no interrupt stacking is implemented in the emulation, it
686 is also required that there are no pending interrupts waiting
687 for service from the device driver. */
688 if (s->waiting == 1 ||
689 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
690 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
691 /* Reselect device. */
692 lsi_reselect(s, p);
693 return 0;
694 } else {
4789bc39 695 DPRINTF("Queueing IO tag=0x%x\n", p->tag);
aba1f023 696 p->pending = len;
11257187
PB		 697 return 1;
698 }
7d8406be 699}
c6df7102
PB		 700
701 /* Callback to indicate that the SCSI layer has completed a command. */
aba1f023 702static void lsi_command_complete(SCSIRequest *req, uint32_t status)
4d611c9a 703{
5c6c0e51 704 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
4d611c9a
PB		 705 int out;
706
a917d384 707 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
aba1f023
PB		 708 DPRINTF("Command complete status=%d\n", (int)status);
709 s->status = status;
c6df7102
PB		 710 s->command_complete = 2;
711 if (s->waiting && s->dbc != 0) {
712 /* Raise phase mismatch for short transfers. */
713 lsi_bad_phase(s, out, PHASE_ST);
714 } else {
715 lsi_set_phase(s, PHASE_ST);
716 }
af12ac98 717
c6df7102
PB		 718 if (s->current && req == s->current->req) {
719 scsi_req_unref(s->current->req);
7267c094 720 g_free(s->current);
c6df7102 721 s->current = NULL;
4d611c9a 722 }
c6df7102
PB		 723 lsi_resume_script(s);
724}
725
726 /* Callback to indicate that the SCSI layer has completed a transfer. */
aba1f023 727static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
c6df7102
PB		 728{
729 LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
730 int out;
4d611c9a 731
c5bf71a9 732 if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
e560125e 733 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
c5bf71a9 734 if (lsi_queue_req(s, req, len)) {
a917d384 735 return;
5c6c0e51 736 }
a917d384 737 }
e560125e 738
c6df7102
PB		 739 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
740
e560125e 741 /* host adapter (re)connected */
aba1f023
PB		 742 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
743 s->current->dma_len = len;
8ccc2ace 744 s->command_complete = 1;
c6df7102
PB		 745 if (s->waiting) {
746 if (s->waiting == 1 || s->dbc == 0) {
747 lsi_resume_script(s);
748 } else {
749 lsi_do_dma(s, out);
750 }
4d611c9a
PB		 751 }
752}
7d8406be
PB		 753
754static void lsi_do_command(LSIState *s)
755{
64d56409 756 SCSIDevice *dev;
7d8406be 757 uint8_t buf[16];
64d56409 758 uint32_t id;
7d8406be
PB		 759 int n;
760
761 DPRINTF("Send command len=%d\n", s->dbc);
762 if (s->dbc > 16)
763 s->dbc = 16;
9ba4524c 764 pci_dma_read(&s->dev, s->dnad, buf, s->dbc);
7d8406be 765 s->sfbr = buf[0];
8ccc2ace 766 s->command_complete = 0;
af12ac98 767
259d5577 768 id = (s->select_tag >> 8) & 0xf;
0d3545e7 769 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
64d56409
JK		 770 if (!dev) {
771 lsi_bad_selection(s, id);
772 return;
773 }
774
af12ac98 775 assert(s->current == NULL);
7267c094 776 s->current = g_malloc0(sizeof(lsi_request));
af12ac98 777 s->current->tag = s->select_tag;
c39ce112 778 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
c5bf71a9 779 s->current);
af12ac98 780
c39ce112 781 n = scsi_req_enqueue(s->current->req);
ad3376cc
PB		 782 if (n) {
783 if (n > 0) {
784 lsi_set_phase(s, PHASE_DI);
785 } else if (n < 0) {
786 lsi_set_phase(s, PHASE_DO);
787 }
788 scsi_req_continue(s->current->req);
a917d384 789 }
8ccc2ace
TS		 790 if (!s->command_complete) {
791 if (n) {
792 /* Command did not complete immediately so disconnect. */
793 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
794 lsi_add_msg_byte(s, 4); /* DISCONNECT */
795 /* wait data */
796 lsi_set_phase(s, PHASE_MI);
797 s->msg_action = 1;
798 lsi_queue_command(s);
799 } else {
800 /* wait command complete */
801 lsi_set_phase(s, PHASE_DI);
802 }
7d8406be
PB		 803 }
804}
805
7d8406be
PB		 806static void lsi_do_status(LSIState *s)
807{
2f172849
HR		 808 uint8_t status;
809 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
7d8406be
PB		 810 if (s->dbc != 1)
811 BADF("Bad Status move\n");
812 s->dbc = 1;
2f172849
HR		 813 status = s->status;
814 s->sfbr = status;
9ba4524c 815 pci_dma_write(&s->dev, s->dnad, &status, 1);
7d8406be 816 lsi_set_phase(s, PHASE_MI);
a917d384
PB		 817 s->msg_action = 1;
818 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
7d8406be
PB		 819}
820
7d8406be
PB		 821static void lsi_do_msgin(LSIState *s)
822{
a917d384
PB		 823 int len;
824 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
825 s->sfbr = s->msg[0];
826 len = s->msg_len;
827 if (len > s->dbc)
828 len = s->dbc;
9ba4524c 829 pci_dma_write(&s->dev, s->dnad, s->msg, len);
a917d384
PB		 830 /* Linux drivers rely on the last byte being in the SIDL. */
831 s->sidl = s->msg[len - 1];
832 s->msg_len -= len;
833 if (s->msg_len) {
834 memmove(s->msg, s->msg + len, s->msg_len);
7d8406be
PB		 835 } else {
836 /* ??? Check if ATN (not yet implemented) is asserted and maybe
837 switch to PHASE_MO. */
a917d384
PB		 838 switch (s->msg_action) {
839 case 0:
840 lsi_set_phase(s, PHASE_CMD);
841 break;
842 case 1:
843 lsi_disconnect(s);
844 break;
845 case 2:
846 lsi_set_phase(s, PHASE_DO);
847 break;
848 case 3:
849 lsi_set_phase(s, PHASE_DI);
850 break;
851 default:
852 abort();
853 }
7d8406be
PB		 854 }
855}
856
a917d384
PB		 857/* Read the next byte during a MSGOUT phase. */
858static uint8_t lsi_get_msgbyte(LSIState *s)
859{
860 uint8_t data;
9ba4524c 861 pci_dma_read(&s->dev, s->dnad, &data, 1);
a917d384
PB		 862 s->dnad++;
863 s->dbc--;
864 return data;
865}
866
444dd39b
SH		 867/* Skip the next n bytes during a MSGOUT phase. */
868static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
869{
870 s->dnad += n;
871 s->dbc -= n;
872}
873
7d8406be
PB		 874static void lsi_do_msgout(LSIState *s)
875{
876 uint8_t msg;
a917d384 877 int len;
508240c0 878 uint32_t current_tag;
5c6c0e51 879 lsi_request *current_req, *p, *p_next;
508240c0
BK		 880
881 if (s->current) {
882 current_tag = s->current->tag;
5c6c0e51 883 current_req = s->current;
508240c0
BK		 884 } else {
885 current_tag = s->select_tag;
5c6c0e51 886 current_req = lsi_find_by_tag(s, current_tag);
508240c0 887 }
7d8406be
PB		 888
889 DPRINTF("MSG out len=%d\n", s->dbc);
a917d384
PB		 890 while (s->dbc) {
891 msg = lsi_get_msgbyte(s);
892 s->sfbr = msg;
893
894 switch (msg) {
77203ea0 895 case 0x04:
a917d384
PB		 896 DPRINTF("MSG: Disconnect\n");
897 lsi_disconnect(s);
898 break;
899 case 0x08:
900 DPRINTF("MSG: No Operation\n");
901 lsi_set_phase(s, PHASE_CMD);
902 break;
903 case 0x01:
904 len = lsi_get_msgbyte(s);
905 msg = lsi_get_msgbyte(s);
f3f5b867 906 (void)len; /* avoid a warning about unused variable*/
a917d384
PB		 907 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
908 switch (msg) {
909 case 1:
910 DPRINTF("SDTR (ignored)\n");
444dd39b 911 lsi_skip_msgbytes(s, 2);
a917d384
PB		 912 break;
913 case 3:
914 DPRINTF("WDTR (ignored)\n");
444dd39b 915 lsi_skip_msgbytes(s, 1);
a917d384
PB		 916 break;
917 default:
918 goto bad;
919 }
920 break;
921 case 0x20: /* SIMPLE queue */
af12ac98 922 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
aa2b1e89 923 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
a917d384
PB		 924 break;
925 case 0x21: /* HEAD of queue */
926 BADF("HEAD queue not implemented\n");
af12ac98 927 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384
PB		 928 break;
929 case 0x22: /* ORDERED queue */
930 BADF("ORDERED queue not implemented\n");
af12ac98 931 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384 932 break;
508240c0
BK		 933 case 0x0d:
934 /* The ABORT TAG message clears the current I/O process only. */
935 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
5c6c0e51 936 if (current_req) {
94d3f98a 937 scsi_req_cancel(current_req->req);
5c6c0e51 938 }
508240c0
BK		 939 lsi_disconnect(s);
940 break;
941 case 0x06:
942 case 0x0e:
943 case 0x0c:
944 /* The ABORT message clears all I/O processes for the selecting
945 initiator on the specified logical unit of the target. */
946 if (msg == 0x06) {
947 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
948 }
949 /* The CLEAR QUEUE message clears all I/O processes for all
950 initiators on the specified logical unit of the target. */
951 if (msg == 0x0e) {
952 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
953 }
954 /* The BUS DEVICE RESET message clears all I/O processes for all
955 initiators on all logical units of the target. */
956 if (msg == 0x0c) {
957 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
958 }
959
960 /* clear the current I/O process */
5c6c0e51 961 if (s->current) {
94d3f98a 962 scsi_req_cancel(s->current->req);
5c6c0e51 963 }
508240c0
BK		 964
965 /* As the current implemented devices scsi_disk and scsi_generic
966 only support one LUN, we don't need to keep track of LUNs.
967 Clearing I/O processes for other initiators could be possible
968 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
969 device, but this is currently not implemented (and seems not
970 to be really necessary). So let's simply clear all queued
971 commands for the current device: */
508240c0 972 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
a6c6f44a 973 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
94d3f98a 974 scsi_req_cancel(p->req);
508240c0
BK		 975 }
976 }
977
978 lsi_disconnect(s);
979 break;
a917d384
PB		 980 default:
981 if ((msg & 0x80) == 0) {
982 goto bad;
983 }
984 s->current_lun = msg & 7;
985 DPRINTF("Select LUN %d\n", s->current_lun);
986 lsi_set_phase(s, PHASE_CMD);
987 break;
988 }
7d8406be 989 }
a917d384
PB		 990 return;
991bad:
992 BADF("Unimplemented message 0x%02x\n", msg);
993 lsi_set_phase(s, PHASE_MI);
994 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
995 s->msg_action = 0;
7d8406be
PB		 996}
997
998/* Sign extend a 24-bit value. */
999static inline int32_t sxt24(int32_t n)
1000{
1001 return (n << 8) >> 8;
1002}
1003
e20a8dff 1004#define LSI_BUF_SIZE 4096
7d8406be
PB		 1005static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1006{
1007 int n;
e20a8dff 1008 uint8_t buf[LSI_BUF_SIZE];
7d8406be
PB		 1009
1010 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1011 while (count) {
e20a8dff 1012 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
9ba4524c
EGM		 1013 pci_dma_read(&s->dev, src, buf, n);
1014 pci_dma_write(&s->dev, dest, buf, n);
7d8406be
PB		 1015 src += n;
1016 dest += n;
1017 count -= n;
1018 }
1019}
1020
a917d384
PB		 1021static void lsi_wait_reselect(LSIState *s)
1022{
042ec49d
GH		 1023 lsi_request *p;
1024
a917d384 1025 DPRINTF("Wait Reselect\n");
042ec49d
GH		 1026
1027 QTAILQ_FOREACH(p, &s->queue, next) {
1028 if (p->pending) {
aa4d32c4 1029 lsi_reselect(s, p);
a917d384
PB		 1030 break;
1031 }
1032 }
b96a0da0 1033 if (s->current == NULL) {
a917d384
PB		 1034 s->waiting = 1;
1035 }
1036}
1037
7d8406be
PB		 1038static void lsi_execute_script(LSIState *s)
1039{
1040 uint32_t insn;
b25cf589 1041 uint32_t addr, addr_high;
7d8406be 1042 int opcode;
ee4d919f 1043 int insn_processed = 0;
7d8406be
PB		 1044
1045 s->istat1 |= LSI_ISTAT1_SRUN;
1046again:
ee4d919f 1047 insn_processed++;
7d8406be 1048 insn = read_dword(s, s->dsp);
02b373ad
AZ		 1049 if (!insn) {
1050 /* If we receive an empty opcode increment the DSP by 4 bytes
1051 instead of 8 and execute the next opcode at that location */
1052 s->dsp += 4;
1053 goto again;
1054 }
7d8406be 1055 addr = read_dword(s, s->dsp + 4);
b25cf589 1056 addr_high = 0;
7d8406be
PB		 1057 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1058 s->dsps = addr;
1059 s->dcmd = insn >> 24;
1060 s->dsp += 8;
1061 switch (insn >> 30) {
1062 case 0: /* Block move. */
1063 if (s->sist1 & LSI_SIST1_STO) {
1064 DPRINTF("Delayed select timeout\n");
1065 lsi_stop_script(s);
1066 break;
1067 }
1068 s->dbc = insn & 0xffffff;
1069 s->rbc = s->dbc;
dd8edf01
AL		 1070 /* ??? Set ESA. */
1071 s->ia = s->dsp - 8;
7d8406be
PB		 1072 if (insn & (1 << 29)) {
1073 /* Indirect addressing. */
1074 addr = read_dword(s, addr);
1075 } else if (insn & (1 << 28)) {
1076 uint32_t buf[2];
1077 int32_t offset;
1078 /* Table indirect addressing. */
dd8edf01
AL		 1079
1080 /* 32-bit Table indirect */
7d8406be 1081 offset = sxt24(addr);
9e486d67 1082 pci_dma_read(&s->dev, s->dsa + offset, buf, 8);
b25cf589
AL		 1083 /* byte count is stored in bits 0:23 only */
1084 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
7faa239c 1085 s->rbc = s->dbc;
7d8406be 1086 addr = cpu_to_le32(buf[1]);
b25cf589
AL		 1087
1088 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1089 * table, bits [31:24] */
1090 if (lsi_dma_40bit(s))
1091 addr_high = cpu_to_le32(buf[0]) >> 24;
dd8edf01
AL		 1092 else if (lsi_dma_ti64bit(s)) {
1093 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1094 switch (selector) {
1095 case 0 ... 0x0f:
1096 /* offset index into scratch registers since
1097 * TI64 mode can use registers C to R */
1098 addr_high = s->scratch[2 + selector];
1099 break;
1100 case 0x10:
1101 addr_high = s->mmrs;
1102 break;
1103 case 0x11:
1104 addr_high = s->mmws;
1105 break;
1106 case 0x12:
1107 addr_high = s->sfs;
1108 break;
1109 case 0x13:
1110 addr_high = s->drs;
1111 break;
1112 case 0x14:
1113 addr_high = s->sbms;
1114 break;
1115 case 0x15:
1116 addr_high = s->dbms;
1117 break;
1118 default:
1119 BADF("Illegal selector specified (0x%x > 0x15)"
1120 " for 64-bit DMA block move", selector);
1121 break;
1122 }
1123 }
1124 } else if (lsi_dma_64bit(s)) {
1125 /* fetch a 3rd dword if 64-bit direct move is enabled and
1126 only if we're not doing table indirect or indirect addressing */
1127 s->dbms = read_dword(s, s->dsp);
1128 s->dsp += 4;
1129 s->ia = s->dsp - 12;
7d8406be
PB		 1130 }
1131 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1132 DPRINTF("Wrong phase got %d expected %d\n",
1133 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1134 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1135 break;
1136 }
1137 s->dnad = addr;
b25cf589 1138 s->dnad64 = addr_high;
7d8406be
PB		 1139 switch (s->sstat1 & 0x7) {
1140 case PHASE_DO:
a917d384 1141 s->waiting = 2;
7d8406be 1142 lsi_do_dma(s, 1);
a917d384
PB		 1143 if (s->waiting)
1144 s->waiting = 3;
7d8406be
PB		 1145 break;
1146 case PHASE_DI:
a917d384 1147 s->waiting = 2;
7d8406be 1148 lsi_do_dma(s, 0);
a917d384
PB		 1149 if (s->waiting)
1150 s->waiting = 3;
7d8406be
PB		 1151 break;
1152 case PHASE_CMD:
1153 lsi_do_command(s);
1154 break;
1155 case PHASE_ST:
1156 lsi_do_status(s);
1157 break;
1158 case PHASE_MO:
1159 lsi_do_msgout(s);
1160 break;
1161 case PHASE_MI:
1162 lsi_do_msgin(s);
1163 break;
1164 default:
1165 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1166 exit(1);
1167 }
1168 s->dfifo = s->dbc & 0xff;
1169 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1170 s->sbc = s->dbc;
1171 s->rbc -= s->dbc;
1172 s->ua = addr + s->dbc;
7d8406be
PB		 1173 break;
1174
1175 case 1: /* IO or Read/Write instruction. */
1176 opcode = (insn >> 27) & 7;
1177 if (opcode < 5) {
1178 uint32_t id;
1179
1180 if (insn & (1 << 25)) {
1181 id = read_dword(s, s->dsa + sxt24(insn));
1182 } else {
07a1bea8 1183 id = insn;
7d8406be
PB		 1184 }
1185 id = (id >> 16) & 0xf;
1186 if (insn & (1 << 26)) {
1187 addr = s->dsp + sxt24(addr);
1188 }
1189 s->dnad = addr;
1190 switch (opcode) {
1191 case 0: /* Select */
a917d384 1192 s->sdid = id;
38f5b2b8
LA		 1193 if (s->scntl1 & LSI_SCNTL1_CON) {
1194 DPRINTF("Already reselected, jumping to alternative address\n");
1195 s->dsp = s->dnad;
a917d384
PB		 1196 break;
1197 }
7d8406be
PB		 1198 s->sstat0 |= LSI_SSTAT0_WOA;
1199 s->scntl1 &= ~LSI_SCNTL1_IARB;
0d3545e7 1200 if (!scsi_device_find(&s->bus, 0, id, 0)) {
64d56409 1201 lsi_bad_selection(s, id);
7d8406be
PB		 1202 break;
1203 }
1204 DPRINTF("Selected target %d%s\n",
1205 id, insn & (1 << 3) ? " ATN" : "");
1206 /* ??? Linux drivers compain when this is set. Maybe
1207 it only applies in low-level mode (unimplemented).
1208 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
af12ac98 1209 s->select_tag = id << 8;
7d8406be
PB		 1210 s->scntl1 |= LSI_SCNTL1_CON;
1211 if (insn & (1 << 3)) {
1212 s->socl |= LSI_SOCL_ATN;
1213 }
1214 lsi_set_phase(s, PHASE_MO);
1215 break;
1216 case 1: /* Disconnect */
a15fdf86 1217 DPRINTF("Wait Disconnect\n");
7d8406be
PB		 1218 s->scntl1 &= ~LSI_SCNTL1_CON;
1219 break;
1220 case 2: /* Wait Reselect */
e560125e
LA		 1221 if (!lsi_irq_on_rsl(s)) {
1222 lsi_wait_reselect(s);
1223 }
7d8406be
PB		 1224 break;
1225 case 3: /* Set */
1226 DPRINTF("Set%s%s%s%s\n",
1227 insn & (1 << 3) ? " ATN" : "",
1228 insn & (1 << 6) ? " ACK" : "",
1229 insn & (1 << 9) ? " TM" : "",
1230 insn & (1 << 10) ? " CC" : "");
1231 if (insn & (1 << 3)) {
1232 s->socl |= LSI_SOCL_ATN;
1233 lsi_set_phase(s, PHASE_MO);
1234 }
1235 if (insn & (1 << 9)) {
1236 BADF("Target mode not implemented\n");
1237 exit(1);
1238 }
1239 if (insn & (1 << 10))
1240 s->carry = 1;
1241 break;
1242 case 4: /* Clear */
1243 DPRINTF("Clear%s%s%s%s\n",
1244 insn & (1 << 3) ? " ATN" : "",
1245 insn & (1 << 6) ? " ACK" : "",
1246 insn & (1 << 9) ? " TM" : "",
1247 insn & (1 << 10) ? " CC" : "");
1248 if (insn & (1 << 3)) {
1249 s->socl &= ~LSI_SOCL_ATN;
1250 }
1251 if (insn & (1 << 10))
1252 s->carry = 0;
1253 break;
1254 }
1255 } else {
1256 uint8_t op0;
1257 uint8_t op1;
1258 uint8_t data8;
1259 int reg;
1260 int operator;
1261#ifdef DEBUG_LSI
1262 static const char *opcode_names[3] =
1263 {"Write", "Read", "Read-Modify-Write"};
1264 static const char *operator_names[8] =
1265 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1266#endif
1267
1268 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1269 data8 = (insn >> 8) & 0xff;
1270 opcode = (insn >> 27) & 7;
1271 operator = (insn >> 24) & 7;
a917d384 1272 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
7d8406be 1273 opcode_names[opcode - 5], reg,
a917d384 1274 operator_names[operator], data8, s->sfbr,
7d8406be
PB		 1275 (insn & (1 << 23)) ? " SFBR" : "");
1276 op0 = op1 = 0;
1277 switch (opcode) {
1278 case 5: /* From SFBR */
1279 op0 = s->sfbr;
1280 op1 = data8;
1281 break;
1282 case 6: /* To SFBR */
1283 if (operator)
1284 op0 = lsi_reg_readb(s, reg);
1285 op1 = data8;
1286 break;
1287 case 7: /* Read-modify-write */
1288 if (operator)
1289 op0 = lsi_reg_readb(s, reg);
1290 if (insn & (1 << 23)) {
1291 op1 = s->sfbr;
1292 } else {
1293 op1 = data8;
1294 }
1295 break;
1296 }
1297
1298 switch (operator) {
1299 case 0: /* move */
1300 op0 = op1;
1301 break;
1302 case 1: /* Shift left */
1303 op1 = op0 >> 7;
1304 op0 = (op0 << 1) | s->carry;
1305 s->carry = op1;
1306 break;
1307 case 2: /* OR */
1308 op0 |= op1;
1309 break;
1310 case 3: /* XOR */
dcfb9014 1311 op0 ^= op1;
7d8406be
PB		 1312 break;
1313 case 4: /* AND */
1314 op0 &= op1;
1315 break;
1316 case 5: /* SHR */
1317 op1 = op0 & 1;
1318 op0 = (op0 >> 1) | (s->carry << 7);
687fa640 1319 s->carry = op1;
7d8406be
PB		 1320 break;
1321 case 6: /* ADD */
1322 op0 += op1;
1323 s->carry = op0 < op1;
1324 break;
1325 case 7: /* ADC */
1326 op0 += op1 + s->carry;
1327 if (s->carry)
1328 s->carry = op0 <= op1;
1329 else
1330 s->carry = op0 < op1;
1331 break;
1332 }
1333
1334 switch (opcode) {
1335 case 5: /* From SFBR */
1336 case 7: /* Read-modify-write */
1337 lsi_reg_writeb(s, reg, op0);
1338 break;
1339 case 6: /* To SFBR */
1340 s->sfbr = op0;
1341 break;
1342 }
1343 }
1344 break;
1345
1346 case 2: /* Transfer Control. */
1347 {
1348 int cond;
1349 int jmp;
1350
1351 if ((insn & 0x002e0000) == 0) {
1352 DPRINTF("NOP\n");
1353 break;
1354 }
1355 if (s->sist1 & LSI_SIST1_STO) {
1356 DPRINTF("Delayed select timeout\n");
1357 lsi_stop_script(s);
1358 break;
1359 }
1360 cond = jmp = (insn & (1 << 19)) != 0;
1361 if (cond == jmp && (insn & (1 << 21))) {
1362 DPRINTF("Compare carry %d\n", s->carry == jmp);
1363 cond = s->carry != 0;
1364 }
1365 if (cond == jmp && (insn & (1 << 17))) {
1366 DPRINTF("Compare phase %d %c= %d\n",
1367 (s->sstat1 & PHASE_MASK),
1368 jmp ? '=' : '!',
1369 ((insn >> 24) & 7));
1370 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1371 }
1372 if (cond == jmp && (insn & (1 << 18))) {
1373 uint8_t mask;
1374
1375 mask = (~insn >> 8) & 0xff;
1376 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1377 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1378 cond = (s->sfbr & mask) == (insn & mask);
1379 }
1380 if (cond == jmp) {
1381 if (insn & (1 << 23)) {
1382 /* Relative address. */
1383 addr = s->dsp + sxt24(addr);
1384 }
1385 switch ((insn >> 27) & 7) {
1386 case 0: /* Jump */
1387 DPRINTF("Jump to 0x%08x\n", addr);
1388 s->dsp = addr;
1389 break;
1390 case 1: /* Call */
1391 DPRINTF("Call 0x%08x\n", addr);
1392 s->temp = s->dsp;
1393 s->dsp = addr;
1394 break;
1395 case 2: /* Return */
1396 DPRINTF("Return to 0x%08x\n", s->temp);
1397 s->dsp = s->temp;
1398 break;
1399 case 3: /* Interrupt */
1400 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1401 if ((insn & (1 << 20)) != 0) {
1402 s->istat0 |= LSI_ISTAT0_INTF;
1403 lsi_update_irq(s);
1404 } else {
1405 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1406 }
1407 break;
1408 default:
1409 DPRINTF("Illegal transfer control\n");
1410 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1411 break;
1412 }
1413 } else {
1414 DPRINTF("Control condition failed\n");
1415 }
1416 }
1417 break;
1418
1419 case 3:
1420 if ((insn & (1 << 29)) == 0) {
1421 /* Memory move. */
1422 uint32_t dest;
1423 /* ??? The docs imply the destination address is loaded into
1424 the TEMP register. However the Linux drivers rely on
1425 the value being presrved. */
1426 dest = read_dword(s, s->dsp);
1427 s->dsp += 4;
1428 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1429 } else {
1430 uint8_t data[7];
1431 int reg;
1432 int n;
1433 int i;
1434
1435 if (insn & (1 << 28)) {
1436 addr = s->dsa + sxt24(addr);
1437 }
1438 n = (insn & 7);
1439 reg = (insn >> 16) & 0xff;
1440 if (insn & (1 << 24)) {
9ba4524c 1441 pci_dma_read(&s->dev, addr, data, n);
a917d384
PB		 1442 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1443 addr, *(int *)data);
7d8406be
PB		 1444 for (i = 0; i < n; i++) {
1445 lsi_reg_writeb(s, reg + i, data[i]);
1446 }
1447 } else {
1448 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1449 for (i = 0; i < n; i++) {
1450 data[i] = lsi_reg_readb(s, reg + i);
1451 }
9ba4524c 1452 pci_dma_write(&s->dev, addr, data, n);
7d8406be
PB		 1453 }
1454 }
1455 }
ee4d919f 1456 if (insn_processed > 10000 && !s->waiting) {
64c68080
PB		 1457 /* Some windows drivers make the device spin waiting for a memory
1458 location to change. If we have been executed a lot of code then
1459 assume this is the case and force an unexpected device disconnect.
1460 This is apparently sufficient to beat the drivers into submission.
1461 */
ee4d919f
AL		 1462 if (!(s->sien0 & LSI_SIST0_UDC))
1463 fprintf(stderr, "inf. loop with UDC masked\n");
1464 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1465 lsi_disconnect(s);
1466 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
7d8406be
PB		 1467 if (s->dcntl & LSI_DCNTL_SSM) {
1468 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1469 } else {
1470 goto again;
1471 }
1472 }
1473 DPRINTF("SCRIPTS execution stopped\n");
1474}
1475
1476static uint8_t lsi_reg_readb(LSIState *s, int offset)
1477{
1478 uint8_t tmp;
75f76531
AJ		 1479#define CASE_GET_REG24(name, addr) \
1480 case addr: return s->name & 0xff; \
1481 case addr + 1: return (s->name >> 8) & 0xff; \
1482 case addr + 2: return (s->name >> 16) & 0xff;
1483
7d8406be
PB		 1484#define CASE_GET_REG32(name, addr) \
1485 case addr: return s->name & 0xff; \
1486 case addr + 1: return (s->name >> 8) & 0xff; \
1487 case addr + 2: return (s->name >> 16) & 0xff; \
1488 case addr + 3: return (s->name >> 24) & 0xff;
1489
1490#ifdef DEBUG_LSI_REG
1491 DPRINTF("Read reg %x\n", offset);
1492#endif
1493 switch (offset) {
1494 case 0x00: /* SCNTL0 */
1495 return s->scntl0;
1496 case 0x01: /* SCNTL1 */
1497 return s->scntl1;
1498 case 0x02: /* SCNTL2 */
1499 return s->scntl2;
1500 case 0x03: /* SCNTL3 */
1501 return s->scntl3;
1502 case 0x04: /* SCID */
1503 return s->scid;
1504 case 0x05: /* SXFER */
1505 return s->sxfer;
1506 case 0x06: /* SDID */
1507 return s->sdid;
1508 case 0x07: /* GPREG0 */
1509 return 0x7f;
985a03b0
TS		 1510 case 0x08: /* Revision ID */
1511 return 0x00;
a917d384
PB		 1512 case 0xa: /* SSID */
1513 return s->ssid;
7d8406be
PB		 1514 case 0xb: /* SBCL */
1515 /* ??? This is not correct. However it's (hopefully) only
1516 used for diagnostics, so should be ok. */
1517 return 0;
1518 case 0xc: /* DSTAT */
1519 tmp = s->dstat | 0x80;
1520 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1521 s->dstat = 0;
1522 lsi_update_irq(s);
1523 return tmp;
1524 case 0x0d: /* SSTAT0 */
1525 return s->sstat0;
1526 case 0x0e: /* SSTAT1 */
1527 return s->sstat1;
1528 case 0x0f: /* SSTAT2 */
1529 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1530 CASE_GET_REG32(dsa, 0x10)
1531 case 0x14: /* ISTAT0 */
1532 return s->istat0;
ecabe8cc
AL		 1533 case 0x15: /* ISTAT1 */
1534 return s->istat1;
7d8406be
PB		 1535 case 0x16: /* MBOX0 */
1536 return s->mbox0;
1537 case 0x17: /* MBOX1 */
1538 return s->mbox1;
1539 case 0x18: /* CTEST0 */
1540 return 0xff;
1541 case 0x19: /* CTEST1 */
1542 return 0;
1543 case 0x1a: /* CTEST2 */
9167a69a 1544 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
7d8406be
PB		 1545 if (s->istat0 & LSI_ISTAT0_SIGP) {
1546 s->istat0 &= ~LSI_ISTAT0_SIGP;
1547 tmp |= LSI_CTEST2_SIGP;
1548 }
1549 return tmp;
1550 case 0x1b: /* CTEST3 */
1551 return s->ctest3;
1552 CASE_GET_REG32(temp, 0x1c)
1553 case 0x20: /* DFIFO */
1554 return 0;
1555 case 0x21: /* CTEST4 */
1556 return s->ctest4;
1557 case 0x22: /* CTEST5 */
1558 return s->ctest5;
985a03b0
TS		 1559 case 0x23: /* CTEST6 */
1560 return 0;
75f76531 1561 CASE_GET_REG24(dbc, 0x24)
7d8406be
PB		 1562 case 0x27: /* DCMD */
1563 return s->dcmd;
4b9a2d6d 1564 CASE_GET_REG32(dnad, 0x28)
7d8406be
PB		 1565 CASE_GET_REG32(dsp, 0x2c)
1566 CASE_GET_REG32(dsps, 0x30)
1567 CASE_GET_REG32(scratch[0], 0x34)
1568 case 0x38: /* DMODE */
1569 return s->dmode;
1570 case 0x39: /* DIEN */
1571 return s->dien;
bd8ee11a
SH		 1572 case 0x3a: /* SBR */
1573 return s->sbr;
7d8406be
PB		 1574 case 0x3b: /* DCNTL */
1575 return s->dcntl;
1576 case 0x40: /* SIEN0 */
1577 return s->sien0;
1578 case 0x41: /* SIEN1 */
1579 return s->sien1;
1580 case 0x42: /* SIST0 */
1581 tmp = s->sist0;
1582 s->sist0 = 0;
1583 lsi_update_irq(s);
1584 return tmp;
1585 case 0x43: /* SIST1 */
1586 tmp = s->sist1;
1587 s->sist1 = 0;
1588 lsi_update_irq(s);
1589 return tmp;
9167a69a
AZ		 1590 case 0x46: /* MACNTL */
1591 return 0x0f;
7d8406be
PB		 1592 case 0x47: /* GPCNTL0 */
1593 return 0x0f;
1594 case 0x48: /* STIME0 */
1595 return s->stime0;
1596 case 0x4a: /* RESPID0 */
1597 return s->respid0;
1598 case 0x4b: /* RESPID1 */
1599 return s->respid1;
1600 case 0x4d: /* STEST1 */
1601 return s->stest1;
1602 case 0x4e: /* STEST2 */
1603 return s->stest2;
1604 case 0x4f: /* STEST3 */
1605 return s->stest3;
a917d384
PB		 1606 case 0x50: /* SIDL */
1607 /* This is needed by the linux drivers. We currently only update it
1608 during the MSG IN phase. */
1609 return s->sidl;
7d8406be
PB		 1610 case 0x52: /* STEST4 */
1611 return 0xe0;
1612 case 0x56: /* CCNTL0 */
1613 return s->ccntl0;
1614 case 0x57: /* CCNTL1 */
1615 return s->ccntl1;
a917d384
PB		 1616 case 0x58: /* SBDL */
1617 /* Some drivers peek at the data bus during the MSG IN phase. */
1618 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1619 return s->msg[0];
1620 return 0;
1621 case 0x59: /* SBDL high */
7d8406be
PB		 1622 return 0;
1623 CASE_GET_REG32(mmrs, 0xa0)
1624 CASE_GET_REG32(mmws, 0xa4)
1625 CASE_GET_REG32(sfs, 0xa8)
1626 CASE_GET_REG32(drs, 0xac)
1627 CASE_GET_REG32(sbms, 0xb0)
ab57d967 1628 CASE_GET_REG32(dbms, 0xb4)
7d8406be
PB		 1629 CASE_GET_REG32(dnad64, 0xb8)
1630 CASE_GET_REG32(pmjad1, 0xc0)
1631 CASE_GET_REG32(pmjad2, 0xc4)
1632 CASE_GET_REG32(rbc, 0xc8)
1633 CASE_GET_REG32(ua, 0xcc)
1634 CASE_GET_REG32(ia, 0xd4)
1635 CASE_GET_REG32(sbc, 0xd8)
1636 CASE_GET_REG32(csbc, 0xdc)
1637 }
1638 if (offset >= 0x5c && offset < 0xa0) {
1639 int n;
1640 int shift;
1641 n = (offset - 0x58) >> 2;
1642 shift = (offset & 3) * 8;
1643 return (s->scratch[n] >> shift) & 0xff;
1644 }
1645 BADF("readb 0x%x\n", offset);
1646 exit(1);
75f76531 1647#undef CASE_GET_REG24
7d8406be
PB		 1648#undef CASE_GET_REG32
1649}
1650
1651static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1652{
49c47daa
SH		 1653#define CASE_SET_REG24(name, addr) \
1654 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1655 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1656 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1657
7d8406be
PB		 1658#define CASE_SET_REG32(name, addr) \
1659 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1660 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1661 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1662 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1663
1664#ifdef DEBUG_LSI_REG
1665 DPRINTF("Write reg %x = %02x\n", offset, val);
1666#endif
1667 switch (offset) {
1668 case 0x00: /* SCNTL0 */
1669 s->scntl0 = val;
1670 if (val & LSI_SCNTL0_START) {
1671 BADF("Start sequence not implemented\n");
1672 }
1673 break;
1674 case 0x01: /* SCNTL1 */
1675 s->scntl1 = val & ~LSI_SCNTL1_SST;
1676 if (val & LSI_SCNTL1_IARB) {
1677 BADF("Immediate Arbritration not implemented\n");
1678 }
1679 if (val & LSI_SCNTL1_RST) {
680a34ee
JK		 1680 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1681 DeviceState *dev;
680a34ee 1682
f48a7a6e 1683 QTAILQ_FOREACH(dev, &s->bus.qbus.children, sibling) {
94afdadc 1684 device_reset(dev);
680a34ee
JK		 1685 }
1686 s->sstat0 |= LSI_SSTAT0_RST;
1687 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1688 }
7d8406be
PB		 1689 } else {
1690 s->sstat0 &= ~LSI_SSTAT0_RST;
1691 }
1692 break;
1693 case 0x02: /* SCNTL2 */
1694 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
3d834c78 1695 s->scntl2 = val;
7d8406be
PB		 1696 break;
1697 case 0x03: /* SCNTL3 */
1698 s->scntl3 = val;
1699 break;
1700 case 0x04: /* SCID */
1701 s->scid = val;
1702 break;
1703 case 0x05: /* SXFER */
1704 s->sxfer = val;
1705 break;
a917d384
PB		 1706 case 0x06: /* SDID */
1707 if ((val & 0xf) != (s->ssid & 0xf))
1708 BADF("Destination ID does not match SSID\n");
1709 s->sdid = val & 0xf;
1710 break;
7d8406be
PB		 1711 case 0x07: /* GPREG0 */
1712 break;
a917d384
PB		 1713 case 0x08: /* SFBR */
1714 /* The CPU is not allowed to write to this register. However the
1715 SCRIPTS register move instructions are. */
1716 s->sfbr = val;
1717 break;
a15fdf86 1718 case 0x0a: case 0x0b:
9167a69a 1719 /* Openserver writes to these readonly registers on startup */
a15fdf86 1720 return;
7d8406be
PB		 1721 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1722 /* Linux writes to these readonly registers on startup. */
1723 return;
1724 CASE_SET_REG32(dsa, 0x10)
1725 case 0x14: /* ISTAT0 */
1726 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1727 if (val & LSI_ISTAT0_ABRT) {
1728 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1729 }
1730 if (val & LSI_ISTAT0_INTF) {
1731 s->istat0 &= ~LSI_ISTAT0_INTF;
1732 lsi_update_irq(s);
1733 }
4d611c9a 1734 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
7d8406be
PB		 1735 DPRINTF("Woken by SIGP\n");
1736 s->waiting = 0;
1737 s->dsp = s->dnad;
1738 lsi_execute_script(s);
1739 }
1740 if (val & LSI_ISTAT0_SRST) {
1741 lsi_soft_reset(s);
1742 }
92d88ecb 1743 break;
7d8406be
PB		 1744 case 0x16: /* MBOX0 */
1745 s->mbox0 = val;
92d88ecb 1746 break;
7d8406be
PB		 1747 case 0x17: /* MBOX1 */
1748 s->mbox1 = val;
92d88ecb 1749 break;
9167a69a
AZ		 1750 case 0x1a: /* CTEST2 */
1751 s->ctest2 = val & LSI_CTEST2_PCICIE;
1752 break;
7d8406be
PB		 1753 case 0x1b: /* CTEST3 */
1754 s->ctest3 = val & 0x0f;
1755 break;
1756 CASE_SET_REG32(temp, 0x1c)
1757 case 0x21: /* CTEST4 */
1758 if (val & 7) {
1759 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1760 }
1761 s->ctest4 = val;
1762 break;
1763 case 0x22: /* CTEST5 */
1764 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1765 BADF("CTEST5 DMA increment not implemented\n");
1766 }
1767 s->ctest5 = val;
1768 break;
49c47daa 1769 CASE_SET_REG24(dbc, 0x24)
4b9a2d6d 1770 CASE_SET_REG32(dnad, 0x28)
3d834c78 1771 case 0x2c: /* DSP[0:7] */
7d8406be
PB		 1772 s->dsp &= 0xffffff00;
1773 s->dsp |= val;
1774 break;
3d834c78 1775 case 0x2d: /* DSP[8:15] */
7d8406be
PB		 1776 s->dsp &= 0xffff00ff;
1777 s->dsp |= val << 8;
1778 break;
3d834c78 1779 case 0x2e: /* DSP[16:23] */
7d8406be
PB		 1780 s->dsp &= 0xff00ffff;
1781 s->dsp |= val << 16;
1782 break;
3d834c78 1783 case 0x2f: /* DSP[24:31] */
7d8406be
PB		 1784 s->dsp &= 0x00ffffff;
1785 s->dsp |= val << 24;
1786 if ((s->dmode & LSI_DMODE_MAN) == 0
1787 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1788 lsi_execute_script(s);
1789 break;
1790 CASE_SET_REG32(dsps, 0x30)
1791 CASE_SET_REG32(scratch[0], 0x34)
1792 case 0x38: /* DMODE */
1793 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1794 BADF("IO mappings not implemented\n");
1795 }
1796 s->dmode = val;
1797 break;
1798 case 0x39: /* DIEN */
1799 s->dien = val;
1800 lsi_update_irq(s);
1801 break;
bd8ee11a
SH		 1802 case 0x3a: /* SBR */
1803 s->sbr = val;
1804 break;
7d8406be
PB		 1805 case 0x3b: /* DCNTL */
1806 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1807 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1808 lsi_execute_script(s);
1809 break;
1810 case 0x40: /* SIEN0 */
1811 s->sien0 = val;
1812 lsi_update_irq(s);
1813 break;
1814 case 0x41: /* SIEN1 */
1815 s->sien1 = val;
1816 lsi_update_irq(s);
1817 break;
1818 case 0x47: /* GPCNTL0 */
1819 break;
1820 case 0x48: /* STIME0 */
1821 s->stime0 = val;
1822 break;
1823 case 0x49: /* STIME1 */
1824 if (val & 0xf) {
1825 DPRINTF("General purpose timer not implemented\n");
1826 /* ??? Raising the interrupt immediately seems to be sufficient
1827 to keep the FreeBSD driver happy. */
1828 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1829 }
1830 break;
1831 case 0x4a: /* RESPID0 */
1832 s->respid0 = val;
1833 break;
1834 case 0x4b: /* RESPID1 */
1835 s->respid1 = val;
1836 break;
1837 case 0x4d: /* STEST1 */
1838 s->stest1 = val;
1839 break;
1840 case 0x4e: /* STEST2 */
1841 if (val & 1) {
1842 BADF("Low level mode not implemented\n");
1843 }
1844 s->stest2 = val;
1845 break;
1846 case 0x4f: /* STEST3 */
1847 if (val & 0x41) {
1848 BADF("SCSI FIFO test mode not implemented\n");
1849 }
1850 s->stest3 = val;
1851 break;
1852 case 0x56: /* CCNTL0 */
1853 s->ccntl0 = val;
1854 break;
1855 case 0x57: /* CCNTL1 */
1856 s->ccntl1 = val;
1857 break;
1858 CASE_SET_REG32(mmrs, 0xa0)
1859 CASE_SET_REG32(mmws, 0xa4)
1860 CASE_SET_REG32(sfs, 0xa8)
1861 CASE_SET_REG32(drs, 0xac)
1862 CASE_SET_REG32(sbms, 0xb0)
ab57d967 1863 CASE_SET_REG32(dbms, 0xb4)
7d8406be
PB		 1864 CASE_SET_REG32(dnad64, 0xb8)
1865 CASE_SET_REG32(pmjad1, 0xc0)
1866 CASE_SET_REG32(pmjad2, 0xc4)
1867 CASE_SET_REG32(rbc, 0xc8)
1868 CASE_SET_REG32(ua, 0xcc)
1869 CASE_SET_REG32(ia, 0xd4)
1870 CASE_SET_REG32(sbc, 0xd8)
1871 CASE_SET_REG32(csbc, 0xdc)
1872 default:
1873 if (offset >= 0x5c && offset < 0xa0) {
1874 int n;
1875 int shift;
1876 n = (offset - 0x58) >> 2;
1877 shift = (offset & 3) * 8;
1878 s->scratch[n] &= ~(0xff << shift);
1879 s->scratch[n] |= (val & 0xff) << shift;
1880 } else {
1881 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1882 }
1883 }
49c47daa 1884#undef CASE_SET_REG24
7d8406be
PB		 1885#undef CASE_SET_REG32
1886}
1887
b0ce84e5
AK		 1888static void lsi_mmio_write(void *opaque, target_phys_addr_t addr,
1889 uint64_t val, unsigned size)
7d8406be 1890{
eb40f984 1891 LSIState *s = opaque;
7d8406be
PB		 1892
1893 lsi_reg_writeb(s, addr & 0xff, val);
1894}
1895
b0ce84e5
AK		 1896static uint64_t lsi_mmio_read(void *opaque, target_phys_addr_t addr,
1897 unsigned size)
7d8406be 1898{
eb40f984 1899 LSIState *s = opaque;
7d8406be
PB		 1900
1901 return lsi_reg_readb(s, addr & 0xff);
1902}
1903
b0ce84e5
AK		 1904static const MemoryRegionOps lsi_mmio_ops = {
1905 .read = lsi_mmio_read,
1906 .write = lsi_mmio_write,
1907 .endianness = DEVICE_NATIVE_ENDIAN,
1908 .impl = {
1909 .min_access_size = 1,
1910 .max_access_size = 1,
1911 },
7d8406be
PB		 1912};
1913
b0ce84e5
AK		 1914static void lsi_ram_write(void *opaque, target_phys_addr_t addr,
1915 uint64_t val, unsigned size)
7d8406be 1916{
eb40f984 1917 LSIState *s = opaque;
7d8406be 1918 uint32_t newval;
b0ce84e5 1919 uint32_t mask;
7d8406be
PB		 1920 int shift;
1921
7d8406be
PB		 1922 newval = s->script_ram[addr >> 2];
1923 shift = (addr & 3) * 8;
b0ce84e5
AK		 1924 mask = ((uint64_t)1 << (size * 8)) - 1;
1925 newval &= ~(mask << shift);
7d8406be
PB		 1926 newval |= val << shift;
1927 s->script_ram[addr >> 2] = newval;
1928}
1929
b0ce84e5
AK		 1930static uint64_t lsi_ram_read(void *opaque, target_phys_addr_t addr,
1931 unsigned size)
7d8406be 1932{
eb40f984 1933 LSIState *s = opaque;
7d8406be 1934 uint32_t val;
b0ce84e5 1935 uint32_t mask;
7d8406be 1936
7d8406be 1937 val = s->script_ram[addr >> 2];
b0ce84e5 1938 mask = ((uint64_t)1 << (size * 8)) - 1;
7d8406be 1939 val >>= (addr & 3) * 8;
b0ce84e5 1940 return val & mask;
7d8406be
PB		 1941}
1942
b0ce84e5
AK		 1943static const MemoryRegionOps lsi_ram_ops = {
1944 .read = lsi_ram_read,
1945 .write = lsi_ram_write,
1946 .endianness = DEVICE_NATIVE_ENDIAN,
7d8406be
PB		 1947};
1948
b0ce84e5
AK		 1949static uint64_t lsi_io_read(void *opaque, target_phys_addr_t addr,
1950 unsigned size)
7d8406be 1951{
eb40f984 1952 LSIState *s = opaque;
7d8406be
PB		 1953 return lsi_reg_readb(s, addr & 0xff);
1954}
1955
b0ce84e5
AK		 1956static void lsi_io_write(void *opaque, target_phys_addr_t addr,
1957 uint64_t val, unsigned size)
7d8406be 1958{
eb40f984 1959 LSIState *s = opaque;
7d8406be
PB		 1960 lsi_reg_writeb(s, addr & 0xff, val);
1961}
1962
b0ce84e5
AK		 1963static const MemoryRegionOps lsi_io_ops = {
1964 .read = lsi_io_read,
1965 .write = lsi_io_write,
1966 .endianness = DEVICE_NATIVE_ENDIAN,
1967 .impl = {
1968 .min_access_size = 1,
1969 .max_access_size = 1,
1970 },
1971};
7d8406be 1972
54eefd72
JK		 1973static void lsi_scsi_reset(DeviceState *dev)
1974{
1975 LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
1976
1977 lsi_soft_reset(s);
1978}
1979
4a1b0f1c 1980static void lsi_pre_save(void *opaque)
777aec7a
N		 1981{
1982 LSIState *s = opaque;
1983
b96a0da0
GH		 1984 if (s->current) {
1985 assert(s->current->dma_buf == NULL);
1986 assert(s->current->dma_len == 0);
1987 }
042ec49d 1988 assert(QTAILQ_EMPTY(&s->queue));
777aec7a
N		 1989}
1990
4a1b0f1c
JQ		 1991static const VMStateDescription vmstate_lsi_scsi = {
1992 .name = "lsiscsi",
1993 .version_id = 0,
1994 .minimum_version_id = 0,
1995 .minimum_version_id_old = 0,
1996 .pre_save = lsi_pre_save,
1997 .fields = (VMStateField []) {
1998 VMSTATE_PCI_DEVICE(dev, LSIState),
1999
2000 VMSTATE_INT32(carry, LSIState),
2f172849 2001 VMSTATE_INT32(status, LSIState),
4a1b0f1c
JQ		 2002 VMSTATE_INT32(msg_action, LSIState),
2003 VMSTATE_INT32(msg_len, LSIState),
2004 VMSTATE_BUFFER(msg, LSIState),
2005 VMSTATE_INT32(waiting, LSIState),
2006
2007 VMSTATE_UINT32(dsa, LSIState),
2008 VMSTATE_UINT32(temp, LSIState),
2009 VMSTATE_UINT32(dnad, LSIState),
2010 VMSTATE_UINT32(dbc, LSIState),
2011 VMSTATE_UINT8(istat0, LSIState),
2012 VMSTATE_UINT8(istat1, LSIState),
2013 VMSTATE_UINT8(dcmd, LSIState),
2014 VMSTATE_UINT8(dstat, LSIState),
2015 VMSTATE_UINT8(dien, LSIState),
2016 VMSTATE_UINT8(sist0, LSIState),
2017 VMSTATE_UINT8(sist1, LSIState),
2018 VMSTATE_UINT8(sien0, LSIState),
2019 VMSTATE_UINT8(sien1, LSIState),
2020 VMSTATE_UINT8(mbox0, LSIState),
2021 VMSTATE_UINT8(mbox1, LSIState),
2022 VMSTATE_UINT8(dfifo, LSIState),
2023 VMSTATE_UINT8(ctest2, LSIState),
2024 VMSTATE_UINT8(ctest3, LSIState),
2025 VMSTATE_UINT8(ctest4, LSIState),
2026 VMSTATE_UINT8(ctest5, LSIState),
2027 VMSTATE_UINT8(ccntl0, LSIState),
2028 VMSTATE_UINT8(ccntl1, LSIState),
2029 VMSTATE_UINT32(dsp, LSIState),
2030 VMSTATE_UINT32(dsps, LSIState),
2031 VMSTATE_UINT8(dmode, LSIState),
2032 VMSTATE_UINT8(dcntl, LSIState),
2033 VMSTATE_UINT8(scntl0, LSIState),
2034 VMSTATE_UINT8(scntl1, LSIState),
2035 VMSTATE_UINT8(scntl2, LSIState),
2036 VMSTATE_UINT8(scntl3, LSIState),
2037 VMSTATE_UINT8(sstat0, LSIState),
2038 VMSTATE_UINT8(sstat1, LSIState),
2039 VMSTATE_UINT8(scid, LSIState),
2040 VMSTATE_UINT8(sxfer, LSIState),
2041 VMSTATE_UINT8(socl, LSIState),
2042 VMSTATE_UINT8(sdid, LSIState),
2043 VMSTATE_UINT8(ssid, LSIState),
2044 VMSTATE_UINT8(sfbr, LSIState),
2045 VMSTATE_UINT8(stest1, LSIState),
2046 VMSTATE_UINT8(stest2, LSIState),
2047 VMSTATE_UINT8(stest3, LSIState),
2048 VMSTATE_UINT8(sidl, LSIState),
2049 VMSTATE_UINT8(stime0, LSIState),
2050 VMSTATE_UINT8(respid0, LSIState),
2051 VMSTATE_UINT8(respid1, LSIState),
2052 VMSTATE_UINT32(mmrs, LSIState),
2053 VMSTATE_UINT32(mmws, LSIState),
2054 VMSTATE_UINT32(sfs, LSIState),
2055 VMSTATE_UINT32(drs, LSIState),
2056 VMSTATE_UINT32(sbms, LSIState),
2057 VMSTATE_UINT32(dbms, LSIState),
2058 VMSTATE_UINT32(dnad64, LSIState),
2059 VMSTATE_UINT32(pmjad1, LSIState),
2060 VMSTATE_UINT32(pmjad2, LSIState),
2061 VMSTATE_UINT32(rbc, LSIState),
2062 VMSTATE_UINT32(ua, LSIState),
2063 VMSTATE_UINT32(ia, LSIState),
2064 VMSTATE_UINT32(sbc, LSIState),
2065 VMSTATE_UINT32(csbc, LSIState),
2066 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2067 VMSTATE_UINT8(sbr, LSIState),
2068
2069 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2070 VMSTATE_END_OF_LIST()
777aec7a 2071 }
4a1b0f1c 2072};
777aec7a 2073
4b09be85
AL		 2074static int lsi_scsi_uninit(PCIDevice *d)
2075{
f305261f 2076 LSIState *s = DO_UPCAST(LSIState, dev, d);
4b09be85 2077
b0ce84e5
AK		 2078 memory_region_destroy(&s->mmio_io);
2079 memory_region_destroy(&s->ram_io);
2080 memory_region_destroy(&s->io_io);
4b09be85 2081
4b09be85
AL		 2082 return 0;
2083}
2084
afd4030c
PB		 2085static const struct SCSIBusInfo lsi_scsi_info = {
2086 .tcq = true,
7e0380b9
PB		 2087 .max_target = LSI_MAX_DEVS,
2088 .max_lun = 0, /* LUN support is buggy */
afd4030c 2089
c6df7102 2090 .transfer_data = lsi_transfer_data,
94d3f98a
PB		 2091 .complete = lsi_command_complete,
2092 .cancel = lsi_request_cancelled
cfdc1bb0
PB		 2093};
2094
81a322d4 2095static int lsi_scsi_init(PCIDevice *dev)
7d8406be 2096{
f305261f 2097 LSIState *s = DO_UPCAST(LSIState, dev, dev);
deb54399 2098 uint8_t *pci_conf;
7d8406be 2099
f305261f 2100 pci_conf = s->dev.config;
deb54399 2101
9167a69a 2102 /* PCI latency timer = 255 */
5845f0e5 2103 pci_conf[PCI_LATENCY_TIMER] = 0xff;
817e0b6f 2104 /* Interrupt pin A */
5845f0e5 2105 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
7d8406be 2106
b0ce84e5
AK		 2107 memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
2108 memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
2109 memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
2110
e824b2cc
AK		 2111 pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2112 pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
2113 pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
042ec49d 2114 QTAILQ_INIT(&s->queue);
7d8406be 2115
afd4030c 2116 scsi_bus_new(&s->bus, &dev->qdev, &lsi_scsi_info);
5b684b5a 2117 if (!dev->qdev.hotplugged) {
fa66b909 2118 return scsi_bus_legacy_handle_cmdline(&s->bus);
5b684b5a 2119 }
81a322d4 2120 return 0;
7d8406be 2121}
9be5dafe 2122
40021f08
AL		 2123static void lsi_class_init(ObjectClass *klass, void *data)
2124{
39bffca2 2125 DeviceClass *dc = DEVICE_CLASS(klass);
40021f08
AL		 2126 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2127
2128 k->init = lsi_scsi_init;
2129 k->exit = lsi_scsi_uninit;
2130 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2131 k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2132 k->class_id = PCI_CLASS_STORAGE_SCSI;
2133 k->subsystem_id = 0x1000;
39bffca2
AL		 2134 dc->reset = lsi_scsi_reset;
2135 dc->vmsd = &vmstate_lsi_scsi;
40021f08
AL		 2136}
2137
39bffca2
AL		 2138static TypeInfo lsi_info = {
2139 .name = "lsi53c895a",
2140 .parent = TYPE_PCI_DEVICE,
2141 .instance_size = sizeof(LSIState),
2142 .class_init = lsi_class_init,
0aab0d3a
GH		 2143};
2144
83f7d43a 2145static void lsi53c895a_register_types(void)
9be5dafe 2146{
39bffca2 2147 type_register_static(&lsi_info);
9be5dafe
PB		 2148}
2149
83f7d43a 2150type_init(lsi53c895a_register_types)
Qemu copy for testing