]> git.proxmox.com Git - qemu.git/blame - hw/lsi53c895a.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Break up vl.h.
[qemu.git] / hw / lsi53c895a.c
CommitLineData
5fafdf24 1/*
7d8406be
PB		 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licenced under the LGPL.
8 */
9
10/* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
87ecb68b
PB		 13#include "hw.h"
14#include "pci.h"
15#include "scsi-disk.h"
7d8406be
PB		 16
17//#define DEBUG_LSI
18//#define DEBUG_LSI_REG
19
20#ifdef DEBUG_LSI
21#define DPRINTF(fmt, args...) \
22do { printf("lsi_scsi: " fmt , ##args); } while (0)
23#define BADF(fmt, args...) \
a917d384 24do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
7d8406be
PB		 25#else
26#define DPRINTF(fmt, args...) do {} while(0)
27#define BADF(fmt, args...) \
a917d384 28do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
7d8406be
PB		 29#endif
30
31#define LSI_SCNTL0_TRG 0x01
32#define LSI_SCNTL0_AAP 0x02
33#define LSI_SCNTL0_EPC 0x08
34#define LSI_SCNTL0_WATN 0x10
35#define LSI_SCNTL0_START 0x20
36
37#define LSI_SCNTL1_SST 0x01
38#define LSI_SCNTL1_IARB 0x02
39#define LSI_SCNTL1_AESP 0x04
40#define LSI_SCNTL1_RST 0x08
41#define LSI_SCNTL1_CON 0x10
42#define LSI_SCNTL1_DHP 0x20
43#define LSI_SCNTL1_ADB 0x40
44#define LSI_SCNTL1_EXC 0x80
45
46#define LSI_SCNTL2_WSR 0x01
47#define LSI_SCNTL2_VUE0 0x02
48#define LSI_SCNTL2_VUE1 0x04
49#define LSI_SCNTL2_WSS 0x08
50#define LSI_SCNTL2_SLPHBEN 0x10
51#define LSI_SCNTL2_SLPMD 0x20
52#define LSI_SCNTL2_CHM 0x40
53#define LSI_SCNTL2_SDU 0x80
54
55#define LSI_ISTAT0_DIP 0x01
56#define LSI_ISTAT0_SIP 0x02
57#define LSI_ISTAT0_INTF 0x04
58#define LSI_ISTAT0_CON 0x08
59#define LSI_ISTAT0_SEM 0x10
60#define LSI_ISTAT0_SIGP 0x20
61#define LSI_ISTAT0_SRST 0x40
62#define LSI_ISTAT0_ABRT 0x80
63
64#define LSI_ISTAT1_SI 0x01
65#define LSI_ISTAT1_SRUN 0x02
66#define LSI_ISTAT1_FLSH 0x04
67
68#define LSI_SSTAT0_SDP0 0x01
69#define LSI_SSTAT0_RST 0x02
70#define LSI_SSTAT0_WOA 0x04
71#define LSI_SSTAT0_LOA 0x08
72#define LSI_SSTAT0_AIP 0x10
73#define LSI_SSTAT0_OLF 0x20
74#define LSI_SSTAT0_ORF 0x40
75#define LSI_SSTAT0_ILF 0x80
76
77#define LSI_SIST0_PAR 0x01
78#define LSI_SIST0_RST 0x02
79#define LSI_SIST0_UDC 0x04
80#define LSI_SIST0_SGE 0x08
81#define LSI_SIST0_RSL 0x10
82#define LSI_SIST0_SEL 0x20
83#define LSI_SIST0_CMP 0x40
84#define LSI_SIST0_MA 0x80
85
86#define LSI_SIST1_HTH 0x01
87#define LSI_SIST1_GEN 0x02
88#define LSI_SIST1_STO 0x04
89#define LSI_SIST1_SBMC 0x10
90
91#define LSI_SOCL_IO 0x01
92#define LSI_SOCL_CD 0x02
93#define LSI_SOCL_MSG 0x04
94#define LSI_SOCL_ATN 0x08
95#define LSI_SOCL_SEL 0x10
96#define LSI_SOCL_BSY 0x20
97#define LSI_SOCL_ACK 0x40
98#define LSI_SOCL_REQ 0x80
99
100#define LSI_DSTAT_IID 0x01
101#define LSI_DSTAT_SIR 0x04
102#define LSI_DSTAT_SSI 0x08
103#define LSI_DSTAT_ABRT 0x10
104#define LSI_DSTAT_BF 0x20
105#define LSI_DSTAT_MDPE 0x40
106#define LSI_DSTAT_DFE 0x80
107
108#define LSI_DCNTL_COM 0x01
109#define LSI_DCNTL_IRQD 0x02
110#define LSI_DCNTL_STD 0x04
111#define LSI_DCNTL_IRQM 0x08
112#define LSI_DCNTL_SSM 0x10
113#define LSI_DCNTL_PFEN 0x20
114#define LSI_DCNTL_PFF 0x40
115#define LSI_DCNTL_CLSE 0x80
116
117#define LSI_DMODE_MAN 0x01
118#define LSI_DMODE_BOF 0x02
119#define LSI_DMODE_ERMP 0x04
120#define LSI_DMODE_ERL 0x08
121#define LSI_DMODE_DIOM 0x10
122#define LSI_DMODE_SIOM 0x20
123
124#define LSI_CTEST2_DACK 0x01
125#define LSI_CTEST2_DREQ 0x02
126#define LSI_CTEST2_TEOP 0x04
127#define LSI_CTEST2_PCICIE 0x08
128#define LSI_CTEST2_CM 0x10
129#define LSI_CTEST2_CIO 0x20
130#define LSI_CTEST2_SIGP 0x40
131#define LSI_CTEST2_DDIR 0x80
132
133#define LSI_CTEST5_BL2 0x04
134#define LSI_CTEST5_DDIR 0x08
135#define LSI_CTEST5_MASR 0x10
136#define LSI_CTEST5_DFSN 0x20
137#define LSI_CTEST5_BBCK 0x40
138#define LSI_CTEST5_ADCK 0x80
139
140#define LSI_CCNTL0_DILS 0x01
141#define LSI_CCNTL0_DISFC 0x10
142#define LSI_CCNTL0_ENNDJ 0x20
143#define LSI_CCNTL0_PMJCTL 0x40
144#define LSI_CCNTL0_ENPMJ 0x80
145
146#define PHASE_DO 0
147#define PHASE_DI 1
148#define PHASE_CMD 2
149#define PHASE_ST 3
150#define PHASE_MO 6
151#define PHASE_MI 7
152#define PHASE_MASK 7
153
154/* The HBA is ID 7, so for simplicitly limit to 7 devices. */
155#define LSI_MAX_DEVS 7
156
a917d384
PB		 157/* Maximum length of MSG IN data. */
158#define LSI_MAX_MSGIN_LEN 8
159
160/* Flag set if this is a tagged command. */
161#define LSI_TAG_VALID (1 << 16)
162
163typedef struct {
164 uint32_t tag;
165 uint32_t pending;
166 int out;
167} lsi_queue;
4d611c9a 168
7d8406be
PB		 169typedef struct {
170 PCIDevice pci_dev;
171 int mmio_io_addr;
172 int ram_io_addr;
173 uint32_t script_ram_base;
7d8406be
PB		 174
175 int carry; /* ??? Should this be an a visible register somewhere? */
176 int sense;
a917d384
PB		 177 /* Action to take at the end of a MSG IN phase.
178 0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN. */
179 int msg_action;
180 int msg_len;
181 uint8_t msg[LSI_MAX_MSGIN_LEN];
4d611c9a
PB		 182 /* 0 if SCRIPTS are running or stopped.
183 * 1 if a Wait Reselect instruction has been issued.
a917d384
PB		 184 * 2 if processing DMA from lsi_execute_script.
185 * 3 if a DMA operation is in progress. */
7d8406be
PB		 186 int waiting;
187 SCSIDevice *scsi_dev[LSI_MAX_DEVS];
188 SCSIDevice *current_dev;
189 int current_lun;
a917d384
PB		 190 /* The tag is a combination of the device ID and the SCSI tag. */
191 uint32_t current_tag;
192 uint32_t current_dma_len;
193 uint8_t *dma_buf;
194 lsi_queue *queue;
195 int queue_len;
196 int active_commands;
7d8406be
PB		 197
198 uint32_t dsa;
199 uint32_t temp;
200 uint32_t dnad;
201 uint32_t dbc;
202 uint8_t istat0;
203 uint8_t istat1;
204 uint8_t dcmd;
205 uint8_t dstat;
206 uint8_t dien;
207 uint8_t sist0;
208 uint8_t sist1;
209 uint8_t sien0;
210 uint8_t sien1;
211 uint8_t mbox0;
212 uint8_t mbox1;
213 uint8_t dfifo;
214 uint8_t ctest3;
215 uint8_t ctest4;
216 uint8_t ctest5;
217 uint8_t ccntl0;
218 uint8_t ccntl1;
219 uint32_t dsp;
220 uint32_t dsps;
221 uint8_t dmode;
222 uint8_t dcntl;
223 uint8_t scntl0;
224 uint8_t scntl1;
225 uint8_t scntl2;
226 uint8_t scntl3;
227 uint8_t sstat0;
228 uint8_t sstat1;
229 uint8_t scid;
230 uint8_t sxfer;
231 uint8_t socl;
232 uint8_t sdid;
a917d384 233 uint8_t ssid;
7d8406be
PB		 234 uint8_t sfbr;
235 uint8_t stest1;
236 uint8_t stest2;
237 uint8_t stest3;
a917d384 238 uint8_t sidl;
7d8406be
PB		 239 uint8_t stime0;
240 uint8_t respid0;
241 uint8_t respid1;
242 uint32_t mmrs;
243 uint32_t mmws;
244 uint32_t sfs;
245 uint32_t drs;
246 uint32_t sbms;
247 uint32_t dmbs;
248 uint32_t dnad64;
249 uint32_t pmjad1;
250 uint32_t pmjad2;
251 uint32_t rbc;
252 uint32_t ua;
253 uint32_t ia;
254 uint32_t sbc;
255 uint32_t csbc;
dcfb9014 256 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
7d8406be
PB		 257
258 /* Script ram is stored as 32-bit words in host byteorder. */
259 uint32_t script_ram[2048];
260} LSIState;
261
262static void lsi_soft_reset(LSIState *s)
263{
264 DPRINTF("Reset\n");
265 s->carry = 0;
266
267 s->waiting = 0;
268 s->dsa = 0;
269 s->dnad = 0;
270 s->dbc = 0;
271 s->temp = 0;
272 memset(s->scratch, 0, sizeof(s->scratch));
273 s->istat0 = 0;
274 s->istat1 = 0;
275 s->dcmd = 0;
276 s->dstat = 0;
277 s->dien = 0;
278 s->sist0 = 0;
279 s->sist1 = 0;
280 s->sien0 = 0;
281 s->sien1 = 0;
282 s->mbox0 = 0;
283 s->mbox1 = 0;
284 s->dfifo = 0;
285 s->ctest3 = 0;
286 s->ctest4 = 0;
287 s->ctest5 = 0;
288 s->ccntl0 = 0;
289 s->ccntl1 = 0;
290 s->dsp = 0;
291 s->dsps = 0;
292 s->dmode = 0;
293 s->dcntl = 0;
294 s->scntl0 = 0xc0;
295 s->scntl1 = 0;
296 s->scntl2 = 0;
297 s->scntl3 = 0;
298 s->sstat0 = 0;
299 s->sstat1 = 0;
300 s->scid = 7;
301 s->sxfer = 0;
302 s->socl = 0;
303 s->stest1 = 0;
304 s->stest2 = 0;
305 s->stest3 = 0;
a917d384 306 s->sidl = 0;
7d8406be
PB		 307 s->stime0 = 0;
308 s->respid0 = 0x80;
309 s->respid1 = 0;
310 s->mmrs = 0;
311 s->mmws = 0;
312 s->sfs = 0;
313 s->drs = 0;
314 s->sbms = 0;
315 s->dmbs = 0;
316 s->dnad64 = 0;
317 s->pmjad1 = 0;
318 s->pmjad2 = 0;
319 s->rbc = 0;
320 s->ua = 0;
321 s->ia = 0;
322 s->sbc = 0;
323 s->csbc = 0;
324}
325
326static uint8_t lsi_reg_readb(LSIState *s, int offset);
327static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
4d611c9a 328static void lsi_execute_script(LSIState *s);
7d8406be
PB		 329
330static inline uint32_t read_dword(LSIState *s, uint32_t addr)
331{
332 uint32_t buf;
333
334 /* Optimize reading from SCRIPTS RAM. */
335 if ((addr & 0xffffe000) == s->script_ram_base) {
336 return s->script_ram[(addr & 0x1fff) >> 2];
337 }
338 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
339 return cpu_to_le32(buf);
340}
341
342static void lsi_stop_script(LSIState *s)
343{
344 s->istat1 &= ~LSI_ISTAT1_SRUN;
345}
346
347static void lsi_update_irq(LSIState *s)
348{
349 int level;
350 static int last_level;
351
352 /* It's unclear whether the DIP/SIP bits should be cleared when the
353 Interrupt Status Registers are cleared or when istat0 is read.
354 We currently do the formwer, which seems to work. */
355 level = 0;
356 if (s->dstat) {
357 if (s->dstat & s->dien)
358 level = 1;
359 s->istat0 |= LSI_ISTAT0_DIP;
360 } else {
361 s->istat0 &= ~LSI_ISTAT0_DIP;
362 }
363
364 if (s->sist0 || s->sist1) {
365 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
366 level = 1;
367 s->istat0 |= LSI_ISTAT0_SIP;
368 } else {
369 s->istat0 &= ~LSI_ISTAT0_SIP;
370 }
371 if (s->istat0 & LSI_ISTAT0_INTF)
372 level = 1;
373
374 if (level != last_level) {
375 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
376 level, s->dstat, s->sist1, s->sist0);
377 last_level = level;
378 }
d537cf6c 379 qemu_set_irq(s->pci_dev.irq[0], level);
7d8406be
PB		 380}
381
382/* Stop SCRIPTS execution and raise a SCSI interrupt. */
383static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
384{
385 uint32_t mask0;
386 uint32_t mask1;
387
388 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
389 stat1, stat0, s->sist1, s->sist0);
390 s->sist0 |= stat0;
391 s->sist1 |= stat1;
392 /* Stop processor on fatal or unmasked interrupt. As a special hack
393 we don't stop processing when raising STO. Instead continue
394 execution and stop at the next insn that accesses the SCSI bus. */
395 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
396 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
397 mask1 &= ~LSI_SIST1_STO;
398 if (s->sist0 & mask0 || s->sist1 & mask1) {
399 lsi_stop_script(s);
400 }
401 lsi_update_irq(s);
402}
403
404/* Stop SCRIPTS execution and raise a DMA interrupt. */
405static void lsi_script_dma_interrupt(LSIState *s, int stat)
406{
407 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
408 s->dstat |= stat;
409 lsi_update_irq(s);
410 lsi_stop_script(s);
411}
412
413static inline void lsi_set_phase(LSIState *s, int phase)
414{
415 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
416}
417
418static void lsi_bad_phase(LSIState *s, int out, int new_phase)
419{
420 /* Trigger a phase mismatch. */
421 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
422 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
423 s->dsp = s->pmjad1;
424 } else {
425 s->dsp = s->pmjad2;
426 }
427 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
428 } else {
429 DPRINTF("Phase mismatch interrupt\n");
430 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
431 lsi_stop_script(s);
432 }
433 lsi_set_phase(s, new_phase);
434}
435
a917d384
PB		 436
437/* Resume SCRIPTS execution after a DMA operation. */
438static void lsi_resume_script(LSIState *s)
439{
440 if (s->waiting != 2) {
441 s->waiting = 0;
442 lsi_execute_script(s);
443 } else {
444 s->waiting = 0;
445 }
446}
447
4d611c9a 448/* Initiate a SCSI layer data transfer. */
7d8406be
PB		 449static void lsi_do_dma(LSIState *s, int out)
450{
7d8406be 451 uint32_t count;
a917d384 452 uint32_t addr;
7d8406be 453
a917d384
PB		 454 if (!s->current_dma_len) {
455 /* Wait until data is available. */
456 DPRINTF("DMA no data available\n");
457 return;
7d8406be
PB		 458 }
459
a917d384
PB		 460 count = s->dbc;
461 if (count > s->current_dma_len)
462 count = s->current_dma_len;
463 DPRINTF("DMA addr=0x%08x len=%d\n", s->dnad, count);
464
465 addr = s->dnad;
7d8406be 466 s->csbc += count;
a917d384
PB		 467 s->dnad += count;
468 s->dbc -= count;
469
470 if (s->dma_buf == NULL) {
471 s->dma_buf = scsi_get_buf(s->current_dev, s->current_tag);
472 }
7d8406be
PB		 473
474 /* ??? Set SFBR to first data byte. */
a917d384
PB		 475 if (out) {
476 cpu_physical_memory_read(addr, s->dma_buf, count);
477 } else {
478 cpu_physical_memory_write(addr, s->dma_buf, count);
479 }
480 s->current_dma_len -= count;
481 if (s->current_dma_len == 0) {
482 s->dma_buf = NULL;
483 if (out) {
484 /* Write the data. */
485 scsi_write_data(s->current_dev, s->current_tag);
486 } else {
487 /* Request any remaining data. */
488 scsi_read_data(s->current_dev, s->current_tag);
489 }
490 } else {
491 s->dma_buf += count;
492 lsi_resume_script(s);
493 }
494}
495
496
497/* Add a command to the queue. */
498static void lsi_queue_command(LSIState *s)
499{
500 lsi_queue *p;
501
502 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
503 if (s->queue_len == s->active_commands) {
504 s->queue_len++;
505 s->queue = realloc(s->queue, s->queue_len * sizeof(lsi_queue));
506 }
507 p = &s->queue[s->active_commands++];
508 p->tag = s->current_tag;
509 p->pending = 0;
510 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
511}
512
513/* Queue a byte for a MSG IN phase. */
514static void lsi_add_msg_byte(LSIState *s, uint8_t data)
515{
516 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
517 BADF("MSG IN data too long\n");
4d611c9a 518 } else {
a917d384
PB		 519 DPRINTF("MSG IN 0x%02x\n", data);
520 s->msg[s->msg_len++] = data;
7d8406be 521 }
a917d384
PB		 522}
523
524/* Perform reselection to continue a command. */
525static void lsi_reselect(LSIState *s, uint32_t tag)
526{
527 lsi_queue *p;
528 int n;
529 int id;
530
531 p = NULL;
532 for (n = 0; n < s->active_commands; n++) {
533 p = &s->queue[n];
534 if (p->tag == tag)
535 break;
536 }
537 if (n == s->active_commands) {
538 BADF("Reselected non-existant command tag=0x%x\n", tag);
539 return;
540 }
541 id = (tag >> 8) & 0xf;
542 s->ssid = id | 0x80;
543 DPRINTF("Reselected target %d\n", id);
544 s->current_dev = s->scsi_dev[id];
545 s->current_tag = tag;
546 s->scntl1 |= LSI_SCNTL1_CON;
547 lsi_set_phase(s, PHASE_MI);
548 s->msg_action = p->out ? 2 : 3;
549 s->current_dma_len = p->pending;
550 s->dma_buf = NULL;
551 lsi_add_msg_byte(s, 0x80);
552 if (s->current_tag & LSI_TAG_VALID) {
553 lsi_add_msg_byte(s, 0x20);
554 lsi_add_msg_byte(s, tag & 0xff);
555 }
556
557 s->active_commands--;
558 if (n != s->active_commands) {
559 s->queue[n] = s->queue[s->active_commands];
560 }
561}
562
563/* Record that data is available for a queued command. Returns zero if
564 the device was reselected, nonzero if the IO is deferred. */
565static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
566{
567 lsi_queue *p;
568 int i;
569 for (i = 0; i < s->active_commands; i++) {
570 p = &s->queue[i];
571 if (p->tag == tag) {
572 if (p->pending) {
573 BADF("Multiple IO pending for tag %d\n", tag);
574 }
575 p->pending = arg;
576 if (s->waiting == 1) {
577 /* Reselect device. */
578 lsi_reselect(s, tag);
579 return 0;
580 } else {
581 DPRINTF("Queueing IO tag=0x%x\n", tag);
582 p->pending = arg;
583 return 1;
584 }
585 }
586 }
587 BADF("IO with unknown tag %d\n", tag);
588 return 1;
7d8406be
PB		 589}
590
4d611c9a 591/* Callback to indicate that the SCSI layer has completed a transfer. */
a917d384
PB		 592static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
593 uint32_t arg)
4d611c9a
PB		 594{
595 LSIState *s = (LSIState *)opaque;
4d611c9a
PB		 596 int out;
597
a917d384 598 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
4d611c9a 599 if (reason == SCSI_REASON_DONE) {
a917d384
PB		 600 DPRINTF("Command complete sense=%d\n", (int)arg);
601 s->sense = arg;
602 if (s->waiting && s->dbc != 0) {
603 /* Raise phase mismatch for short transfers. */
604 lsi_bad_phase(s, out, PHASE_ST);
605 } else {
606 lsi_set_phase(s, PHASE_ST);
607 }
608 lsi_resume_script(s);
609 return;
4d611c9a
PB		 610 }
611
a917d384
PB		 612 if (s->waiting == 1 || tag != s->current_tag) {
613 if (lsi_queue_tag(s, tag, arg))
614 return;
615 }
616 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
617 s->current_dma_len = arg;
618 if (!s->waiting)
619 return;
620 if (s->waiting == 1 || s->dbc == 0) {
621 lsi_resume_script(s);
622 } else {
4d611c9a 623 lsi_do_dma(s, out);
4d611c9a
PB		 624 }
625}
7d8406be
PB		 626
627static void lsi_do_command(LSIState *s)
628{
629 uint8_t buf[16];
630 int n;
631
632 DPRINTF("Send command len=%d\n", s->dbc);
633 if (s->dbc > 16)
634 s->dbc = 16;
635 cpu_physical_memory_read(s->dnad, buf, s->dbc);
636 s->sfbr = buf[0];
a917d384 637 n = scsi_send_command(s->current_dev, s->current_tag, buf, s->current_lun);
7d8406be 638 if (n > 0) {
7d8406be 639 lsi_set_phase(s, PHASE_DI);
a917d384 640 scsi_read_data(s->current_dev, s->current_tag);
7d8406be 641 } else if (n < 0) {
7d8406be 642 lsi_set_phase(s, PHASE_DO);
a917d384
PB		 643 scsi_write_data(s->current_dev, s->current_tag);
644 }
645 if (n && s->current_dma_len == 0) {
646 /* Command did not complete immediately so disconnect. */
647 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
648 lsi_add_msg_byte(s, 4); /* DISCONNECT */
649 lsi_set_phase(s, PHASE_MI);
650 s->msg_action = 1;
651 lsi_queue_command(s);
7d8406be
PB		 652 }
653}
654
7d8406be
PB		 655static void lsi_do_status(LSIState *s)
656{
a917d384 657 uint8_t sense;
7d8406be
PB		 658 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
659 if (s->dbc != 1)
660 BADF("Bad Status move\n");
661 s->dbc = 1;
a917d384
PB		 662 sense = s->sense;
663 s->sfbr = sense;
664 cpu_physical_memory_write(s->dnad, &sense, 1);
7d8406be 665 lsi_set_phase(s, PHASE_MI);
a917d384
PB		 666 s->msg_action = 1;
667 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
7d8406be
PB		 668}
669
670static void lsi_disconnect(LSIState *s)
671{
672 s->scntl1 &= ~LSI_SCNTL1_CON;
673 s->sstat1 &= ~PHASE_MASK;
674}
675
676static void lsi_do_msgin(LSIState *s)
677{
a917d384
PB		 678 int len;
679 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
680 s->sfbr = s->msg[0];
681 len = s->msg_len;
682 if (len > s->dbc)
683 len = s->dbc;
684 cpu_physical_memory_write(s->dnad, s->msg, len);
685 /* Linux drivers rely on the last byte being in the SIDL. */
686 s->sidl = s->msg[len - 1];
687 s->msg_len -= len;
688 if (s->msg_len) {
689 memmove(s->msg, s->msg + len, s->msg_len);
7d8406be
PB		 690 } else {
691 /* ??? Check if ATN (not yet implemented) is asserted and maybe
692 switch to PHASE_MO. */
a917d384
PB		 693 switch (s->msg_action) {
694 case 0:
695 lsi_set_phase(s, PHASE_CMD);
696 break;
697 case 1:
698 lsi_disconnect(s);
699 break;
700 case 2:
701 lsi_set_phase(s, PHASE_DO);
702 break;
703 case 3:
704 lsi_set_phase(s, PHASE_DI);
705 break;
706 default:
707 abort();
708 }
7d8406be
PB		 709 }
710}
711
a917d384
PB		 712/* Read the next byte during a MSGOUT phase. */
713static uint8_t lsi_get_msgbyte(LSIState *s)
714{
715 uint8_t data;
716 cpu_physical_memory_read(s->dnad, &data, 1);
717 s->dnad++;
718 s->dbc--;
719 return data;
720}
721
7d8406be
PB		 722static void lsi_do_msgout(LSIState *s)
723{
724 uint8_t msg;
a917d384 725 int len;
7d8406be
PB		 726
727 DPRINTF("MSG out len=%d\n", s->dbc);
a917d384
PB		 728 while (s->dbc) {
729 msg = lsi_get_msgbyte(s);
730 s->sfbr = msg;
731
732 switch (msg) {
733 case 0x00:
734 DPRINTF("MSG: Disconnect\n");
735 lsi_disconnect(s);
736 break;
737 case 0x08:
738 DPRINTF("MSG: No Operation\n");
739 lsi_set_phase(s, PHASE_CMD);
740 break;
741 case 0x01:
742 len = lsi_get_msgbyte(s);
743 msg = lsi_get_msgbyte(s);
744 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
745 switch (msg) {
746 case 1:
747 DPRINTF("SDTR (ignored)\n");
748 s->dbc -= 2;
749 break;
750 case 3:
751 DPRINTF("WDTR (ignored)\n");
752 s->dbc -= 1;
753 break;
754 default:
755 goto bad;
756 }
757 break;
758 case 0x20: /* SIMPLE queue */
759 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
760 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
761 break;
762 case 0x21: /* HEAD of queue */
763 BADF("HEAD queue not implemented\n");
764 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
765 break;
766 case 0x22: /* ORDERED queue */
767 BADF("ORDERED queue not implemented\n");
768 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
769 break;
770 default:
771 if ((msg & 0x80) == 0) {
772 goto bad;
773 }
774 s->current_lun = msg & 7;
775 DPRINTF("Select LUN %d\n", s->current_lun);
776 lsi_set_phase(s, PHASE_CMD);
777 break;
778 }
7d8406be 779 }
a917d384
PB		 780 return;
781bad:
782 BADF("Unimplemented message 0x%02x\n", msg);
783 lsi_set_phase(s, PHASE_MI);
784 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
785 s->msg_action = 0;
7d8406be
PB		 786}
787
788/* Sign extend a 24-bit value. */
789static inline int32_t sxt24(int32_t n)
790{
791 return (n << 8) >> 8;
792}
793
794static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
795{
796 int n;
797 uint8_t buf[TARGET_PAGE_SIZE];
798
799 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
800 while (count) {
801 n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
802 cpu_physical_memory_read(src, buf, n);
803 cpu_physical_memory_write(dest, buf, n);
804 src += n;
805 dest += n;
806 count -= n;
807 }
808}
809
a917d384
PB		 810static void lsi_wait_reselect(LSIState *s)
811{
812 int i;
813 DPRINTF("Wait Reselect\n");
814 if (s->current_dma_len)
815 BADF("Reselect with pending DMA\n");
816 for (i = 0; i < s->active_commands; i++) {
817 if (s->queue[i].pending) {
818 lsi_reselect(s, s->queue[i].tag);
819 break;
820 }
821 }
822 if (s->current_dma_len == 0) {
823 s->waiting = 1;
824 }
825}
826
7d8406be
PB		 827static void lsi_execute_script(LSIState *s)
828{
829 uint32_t insn;
830 uint32_t addr;
831 int opcode;
832
833 s->istat1 |= LSI_ISTAT1_SRUN;
834again:
835 insn = read_dword(s, s->dsp);
836 addr = read_dword(s, s->dsp + 4);
837 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
838 s->dsps = addr;
839 s->dcmd = insn >> 24;
840 s->dsp += 8;
841 switch (insn >> 30) {
842 case 0: /* Block move. */
843 if (s->sist1 & LSI_SIST1_STO) {
844 DPRINTF("Delayed select timeout\n");
845 lsi_stop_script(s);
846 break;
847 }
848 s->dbc = insn & 0xffffff;
849 s->rbc = s->dbc;
850 if (insn & (1 << 29)) {
851 /* Indirect addressing. */
852 addr = read_dword(s, addr);
853 } else if (insn & (1 << 28)) {
854 uint32_t buf[2];
855 int32_t offset;
856 /* Table indirect addressing. */
857 offset = sxt24(addr);
858 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
859 s->dbc = cpu_to_le32(buf[0]);
7faa239c 860 s->rbc = s->dbc;
7d8406be
PB		 861 addr = cpu_to_le32(buf[1]);
862 }
863 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
864 DPRINTF("Wrong phase got %d expected %d\n",
865 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
866 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
867 break;
868 }
869 s->dnad = addr;
7faa239c
TS		 870 /* ??? Set ESA. */
871 s->ia = s->dsp - 8;
7d8406be
PB		 872 switch (s->sstat1 & 0x7) {
873 case PHASE_DO:
a917d384 874 s->waiting = 2;
7d8406be 875 lsi_do_dma(s, 1);
a917d384
PB		 876 if (s->waiting)
877 s->waiting = 3;
7d8406be
PB		 878 break;
879 case PHASE_DI:
a917d384 880 s->waiting = 2;
7d8406be 881 lsi_do_dma(s, 0);
a917d384
PB		 882 if (s->waiting)
883 s->waiting = 3;
7d8406be
PB		 884 break;
885 case PHASE_CMD:
886 lsi_do_command(s);
887 break;
888 case PHASE_ST:
889 lsi_do_status(s);
890 break;
891 case PHASE_MO:
892 lsi_do_msgout(s);
893 break;
894 case PHASE_MI:
895 lsi_do_msgin(s);
896 break;
897 default:
898 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
899 exit(1);
900 }
901 s->dfifo = s->dbc & 0xff;
902 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
903 s->sbc = s->dbc;
904 s->rbc -= s->dbc;
905 s->ua = addr + s->dbc;
7d8406be
PB		 906 break;
907
908 case 1: /* IO or Read/Write instruction. */
909 opcode = (insn >> 27) & 7;
910 if (opcode < 5) {
911 uint32_t id;
912
913 if (insn & (1 << 25)) {
914 id = read_dword(s, s->dsa + sxt24(insn));
915 } else {
916 id = addr;
917 }
918 id = (id >> 16) & 0xf;
919 if (insn & (1 << 26)) {
920 addr = s->dsp + sxt24(addr);
921 }
922 s->dnad = addr;
923 switch (opcode) {
924 case 0: /* Select */
a917d384
PB		 925 s->sdid = id;
926 if (s->current_dma_len && (s->ssid & 0xf) == id) {
927 DPRINTF("Already reselected by target %d\n", id);
928 break;
929 }
7d8406be
PB		 930 s->sstat0 |= LSI_SSTAT0_WOA;
931 s->scntl1 &= ~LSI_SCNTL1_IARB;
7d8406be
PB		 932 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
933 DPRINTF("Selected absent target %d\n", id);
934 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
935 lsi_disconnect(s);
936 break;
937 }
938 DPRINTF("Selected target %d%s\n",
939 id, insn & (1 << 3) ? " ATN" : "");
940 /* ??? Linux drivers compain when this is set. Maybe
941 it only applies in low-level mode (unimplemented).
942 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
943 s->current_dev = s->scsi_dev[id];
a917d384 944 s->current_tag = id << 8;
7d8406be
PB		 945 s->scntl1 |= LSI_SCNTL1_CON;
946 if (insn & (1 << 3)) {
947 s->socl |= LSI_SOCL_ATN;
948 }
949 lsi_set_phase(s, PHASE_MO);
950 break;
951 case 1: /* Disconnect */
952 DPRINTF("Wait Disconect\n");
953 s->scntl1 &= ~LSI_SCNTL1_CON;
954 break;
955 case 2: /* Wait Reselect */
a917d384 956 lsi_wait_reselect(s);
7d8406be
PB		 957 break;
958 case 3: /* Set */
959 DPRINTF("Set%s%s%s%s\n",
960 insn & (1 << 3) ? " ATN" : "",
961 insn & (1 << 6) ? " ACK" : "",
962 insn & (1 << 9) ? " TM" : "",
963 insn & (1 << 10) ? " CC" : "");
964 if (insn & (1 << 3)) {
965 s->socl |= LSI_SOCL_ATN;
966 lsi_set_phase(s, PHASE_MO);
967 }
968 if (insn & (1 << 9)) {
969 BADF("Target mode not implemented\n");
970 exit(1);
971 }
972 if (insn & (1 << 10))
973 s->carry = 1;
974 break;
975 case 4: /* Clear */
976 DPRINTF("Clear%s%s%s%s\n",
977 insn & (1 << 3) ? " ATN" : "",
978 insn & (1 << 6) ? " ACK" : "",
979 insn & (1 << 9) ? " TM" : "",
980 insn & (1 << 10) ? " CC" : "");
981 if (insn & (1 << 3)) {
982 s->socl &= ~LSI_SOCL_ATN;
983 }
984 if (insn & (1 << 10))
985 s->carry = 0;
986 break;
987 }
988 } else {
989 uint8_t op0;
990 uint8_t op1;
991 uint8_t data8;
992 int reg;
993 int operator;
994#ifdef DEBUG_LSI
995 static const char *opcode_names[3] =
996 {"Write", "Read", "Read-Modify-Write"};
997 static const char *operator_names[8] =
998 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
999#endif
1000
1001 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1002 data8 = (insn >> 8) & 0xff;
1003 opcode = (insn >> 27) & 7;
1004 operator = (insn >> 24) & 7;
a917d384 1005 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
7d8406be 1006 opcode_names[opcode - 5], reg,
a917d384 1007 operator_names[operator], data8, s->sfbr,
7d8406be
PB		 1008 (insn & (1 << 23)) ? " SFBR" : "");
1009 op0 = op1 = 0;
1010 switch (opcode) {
1011 case 5: /* From SFBR */
1012 op0 = s->sfbr;
1013 op1 = data8;
1014 break;
1015 case 6: /* To SFBR */
1016 if (operator)
1017 op0 = lsi_reg_readb(s, reg);
1018 op1 = data8;
1019 break;
1020 case 7: /* Read-modify-write */
1021 if (operator)
1022 op0 = lsi_reg_readb(s, reg);
1023 if (insn & (1 << 23)) {
1024 op1 = s->sfbr;
1025 } else {
1026 op1 = data8;
1027 }
1028 break;
1029 }
1030
1031 switch (operator) {
1032 case 0: /* move */
1033 op0 = op1;
1034 break;
1035 case 1: /* Shift left */
1036 op1 = op0 >> 7;
1037 op0 = (op0 << 1) | s->carry;
1038 s->carry = op1;
1039 break;
1040 case 2: /* OR */
1041 op0 |= op1;
1042 break;
1043 case 3: /* XOR */
dcfb9014 1044 op0 ^= op1;
7d8406be
PB		 1045 break;
1046 case 4: /* AND */
1047 op0 &= op1;
1048 break;
1049 case 5: /* SHR */
1050 op1 = op0 & 1;
1051 op0 = (op0 >> 1) | (s->carry << 7);
687fa640 1052 s->carry = op1;
7d8406be
PB		 1053 break;
1054 case 6: /* ADD */
1055 op0 += op1;
1056 s->carry = op0 < op1;
1057 break;
1058 case 7: /* ADC */
1059 op0 += op1 + s->carry;
1060 if (s->carry)
1061 s->carry = op0 <= op1;
1062 else
1063 s->carry = op0 < op1;
1064 break;
1065 }
1066
1067 switch (opcode) {
1068 case 5: /* From SFBR */
1069 case 7: /* Read-modify-write */
1070 lsi_reg_writeb(s, reg, op0);
1071 break;
1072 case 6: /* To SFBR */
1073 s->sfbr = op0;
1074 break;
1075 }
1076 }
1077 break;
1078
1079 case 2: /* Transfer Control. */
1080 {
1081 int cond;
1082 int jmp;
1083
1084 if ((insn & 0x002e0000) == 0) {
1085 DPRINTF("NOP\n");
1086 break;
1087 }
1088 if (s->sist1 & LSI_SIST1_STO) {
1089 DPRINTF("Delayed select timeout\n");
1090 lsi_stop_script(s);
1091 break;
1092 }
1093 cond = jmp = (insn & (1 << 19)) != 0;
1094 if (cond == jmp && (insn & (1 << 21))) {
1095 DPRINTF("Compare carry %d\n", s->carry == jmp);
1096 cond = s->carry != 0;
1097 }
1098 if (cond == jmp && (insn & (1 << 17))) {
1099 DPRINTF("Compare phase %d %c= %d\n",
1100 (s->sstat1 & PHASE_MASK),
1101 jmp ? '=' : '!',
1102 ((insn >> 24) & 7));
1103 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1104 }
1105 if (cond == jmp && (insn & (1 << 18))) {
1106 uint8_t mask;
1107
1108 mask = (~insn >> 8) & 0xff;
1109 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1110 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1111 cond = (s->sfbr & mask) == (insn & mask);
1112 }
1113 if (cond == jmp) {
1114 if (insn & (1 << 23)) {
1115 /* Relative address. */
1116 addr = s->dsp + sxt24(addr);
1117 }
1118 switch ((insn >> 27) & 7) {
1119 case 0: /* Jump */
1120 DPRINTF("Jump to 0x%08x\n", addr);
1121 s->dsp = addr;
1122 break;
1123 case 1: /* Call */
1124 DPRINTF("Call 0x%08x\n", addr);
1125 s->temp = s->dsp;
1126 s->dsp = addr;
1127 break;
1128 case 2: /* Return */
1129 DPRINTF("Return to 0x%08x\n", s->temp);
1130 s->dsp = s->temp;
1131 break;
1132 case 3: /* Interrupt */
1133 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1134 if ((insn & (1 << 20)) != 0) {
1135 s->istat0 |= LSI_ISTAT0_INTF;
1136 lsi_update_irq(s);
1137 } else {
1138 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1139 }
1140 break;
1141 default:
1142 DPRINTF("Illegal transfer control\n");
1143 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1144 break;
1145 }
1146 } else {
1147 DPRINTF("Control condition failed\n");
1148 }
1149 }
1150 break;
1151
1152 case 3:
1153 if ((insn & (1 << 29)) == 0) {
1154 /* Memory move. */
1155 uint32_t dest;
1156 /* ??? The docs imply the destination address is loaded into
1157 the TEMP register. However the Linux drivers rely on
1158 the value being presrved. */
1159 dest = read_dword(s, s->dsp);
1160 s->dsp += 4;
1161 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1162 } else {
1163 uint8_t data[7];
1164 int reg;
1165 int n;
1166 int i;
1167
1168 if (insn & (1 << 28)) {
1169 addr = s->dsa + sxt24(addr);
1170 }
1171 n = (insn & 7);
1172 reg = (insn >> 16) & 0xff;
1173 if (insn & (1 << 24)) {
7d8406be 1174 cpu_physical_memory_read(addr, data, n);
a917d384
PB		 1175 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1176 addr, *(int *)data);
7d8406be
PB		 1177 for (i = 0; i < n; i++) {
1178 lsi_reg_writeb(s, reg + i, data[i]);
1179 }
1180 } else {
1181 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1182 for (i = 0; i < n; i++) {
1183 data[i] = lsi_reg_readb(s, reg + i);
1184 }
1185 cpu_physical_memory_write(addr, data, n);
1186 }
1187 }
1188 }
1189 /* ??? Need to avoid infinite loops. */
1190 if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1191 if (s->dcntl & LSI_DCNTL_SSM) {
1192 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1193 } else {
1194 goto again;
1195 }
1196 }
1197 DPRINTF("SCRIPTS execution stopped\n");
1198}
1199
1200static uint8_t lsi_reg_readb(LSIState *s, int offset)
1201{
1202 uint8_t tmp;
1203#define CASE_GET_REG32(name, addr) \
1204 case addr: return s->name & 0xff; \
1205 case addr + 1: return (s->name >> 8) & 0xff; \
1206 case addr + 2: return (s->name >> 16) & 0xff; \
1207 case addr + 3: return (s->name >> 24) & 0xff;
1208
1209#ifdef DEBUG_LSI_REG
1210 DPRINTF("Read reg %x\n", offset);
1211#endif
1212 switch (offset) {
1213 case 0x00: /* SCNTL0 */
1214 return s->scntl0;
1215 case 0x01: /* SCNTL1 */
1216 return s->scntl1;
1217 case 0x02: /* SCNTL2 */
1218 return s->scntl2;
1219 case 0x03: /* SCNTL3 */
1220 return s->scntl3;
1221 case 0x04: /* SCID */
1222 return s->scid;
1223 case 0x05: /* SXFER */
1224 return s->sxfer;
1225 case 0x06: /* SDID */
1226 return s->sdid;
1227 case 0x07: /* GPREG0 */
1228 return 0x7f;
a917d384
PB		 1229 case 0xa: /* SSID */
1230 return s->ssid;
7d8406be
PB		 1231 case 0xb: /* SBCL */
1232 /* ??? This is not correct. However it's (hopefully) only
1233 used for diagnostics, so should be ok. */
1234 return 0;
1235 case 0xc: /* DSTAT */
1236 tmp = s->dstat | 0x80;
1237 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1238 s->dstat = 0;
1239 lsi_update_irq(s);
1240 return tmp;
1241 case 0x0d: /* SSTAT0 */
1242 return s->sstat0;
1243 case 0x0e: /* SSTAT1 */
1244 return s->sstat1;
1245 case 0x0f: /* SSTAT2 */
1246 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1247 CASE_GET_REG32(dsa, 0x10)
1248 case 0x14: /* ISTAT0 */
1249 return s->istat0;
1250 case 0x16: /* MBOX0 */
1251 return s->mbox0;
1252 case 0x17: /* MBOX1 */
1253 return s->mbox1;
1254 case 0x18: /* CTEST0 */
1255 return 0xff;
1256 case 0x19: /* CTEST1 */
1257 return 0;
1258 case 0x1a: /* CTEST2 */
1259 tmp = LSI_CTEST2_DACK | LSI_CTEST2_CM;
1260 if (s->istat0 & LSI_ISTAT0_SIGP) {
1261 s->istat0 &= ~LSI_ISTAT0_SIGP;
1262 tmp |= LSI_CTEST2_SIGP;
1263 }
1264 return tmp;
1265 case 0x1b: /* CTEST3 */
1266 return s->ctest3;
1267 CASE_GET_REG32(temp, 0x1c)
1268 case 0x20: /* DFIFO */
1269 return 0;
1270 case 0x21: /* CTEST4 */
1271 return s->ctest4;
1272 case 0x22: /* CTEST5 */
1273 return s->ctest5;
1274 case 0x24: /* DBC[0:7] */
1275 return s->dbc & 0xff;
1276 case 0x25: /* DBC[8:15] */
1277 return (s->dbc >> 8) & 0xff;
1278 case 0x26: /* DBC[16->23] */
1279 return (s->dbc >> 16) & 0xff;
1280 case 0x27: /* DCMD */
1281 return s->dcmd;
1282 CASE_GET_REG32(dsp, 0x2c)
1283 CASE_GET_REG32(dsps, 0x30)
1284 CASE_GET_REG32(scratch[0], 0x34)
1285 case 0x38: /* DMODE */
1286 return s->dmode;
1287 case 0x39: /* DIEN */
1288 return s->dien;
1289 case 0x3b: /* DCNTL */
1290 return s->dcntl;
1291 case 0x40: /* SIEN0 */
1292 return s->sien0;
1293 case 0x41: /* SIEN1 */
1294 return s->sien1;
1295 case 0x42: /* SIST0 */
1296 tmp = s->sist0;
1297 s->sist0 = 0;
1298 lsi_update_irq(s);
1299 return tmp;
1300 case 0x43: /* SIST1 */
1301 tmp = s->sist1;
1302 s->sist1 = 0;
1303 lsi_update_irq(s);
1304 return tmp;
1305 case 0x47: /* GPCNTL0 */
1306 return 0x0f;
1307 case 0x48: /* STIME0 */
1308 return s->stime0;
1309 case 0x4a: /* RESPID0 */
1310 return s->respid0;
1311 case 0x4b: /* RESPID1 */
1312 return s->respid1;
1313 case 0x4d: /* STEST1 */
1314 return s->stest1;
1315 case 0x4e: /* STEST2 */
1316 return s->stest2;
1317 case 0x4f: /* STEST3 */
1318 return s->stest3;
a917d384
PB		 1319 case 0x50: /* SIDL */
1320 /* This is needed by the linux drivers. We currently only update it
1321 during the MSG IN phase. */
1322 return s->sidl;
7d8406be
PB		 1323 case 0x52: /* STEST4 */
1324 return 0xe0;
1325 case 0x56: /* CCNTL0 */
1326 return s->ccntl0;
1327 case 0x57: /* CCNTL1 */
1328 return s->ccntl1;
a917d384
PB		 1329 case 0x58: /* SBDL */
1330 /* Some drivers peek at the data bus during the MSG IN phase. */
1331 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1332 return s->msg[0];
1333 return 0;
1334 case 0x59: /* SBDL high */
7d8406be
PB		 1335 return 0;
1336 CASE_GET_REG32(mmrs, 0xa0)
1337 CASE_GET_REG32(mmws, 0xa4)
1338 CASE_GET_REG32(sfs, 0xa8)
1339 CASE_GET_REG32(drs, 0xac)
1340 CASE_GET_REG32(sbms, 0xb0)
1341 CASE_GET_REG32(dmbs, 0xb4)
1342 CASE_GET_REG32(dnad64, 0xb8)
1343 CASE_GET_REG32(pmjad1, 0xc0)
1344 CASE_GET_REG32(pmjad2, 0xc4)
1345 CASE_GET_REG32(rbc, 0xc8)
1346 CASE_GET_REG32(ua, 0xcc)
1347 CASE_GET_REG32(ia, 0xd4)
1348 CASE_GET_REG32(sbc, 0xd8)
1349 CASE_GET_REG32(csbc, 0xdc)
1350 }
1351 if (offset >= 0x5c && offset < 0xa0) {
1352 int n;
1353 int shift;
1354 n = (offset - 0x58) >> 2;
1355 shift = (offset & 3) * 8;
1356 return (s->scratch[n] >> shift) & 0xff;
1357 }
1358 BADF("readb 0x%x\n", offset);
1359 exit(1);
1360#undef CASE_GET_REG32
1361}
1362
1363static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1364{
1365#define CASE_SET_REG32(name, addr) \
1366 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1367 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1368 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1369 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1370
1371#ifdef DEBUG_LSI_REG
1372 DPRINTF("Write reg %x = %02x\n", offset, val);
1373#endif
1374 switch (offset) {
1375 case 0x00: /* SCNTL0 */
1376 s->scntl0 = val;
1377 if (val & LSI_SCNTL0_START) {
1378 BADF("Start sequence not implemented\n");
1379 }
1380 break;
1381 case 0x01: /* SCNTL1 */
1382 s->scntl1 = val & ~LSI_SCNTL1_SST;
1383 if (val & LSI_SCNTL1_IARB) {
1384 BADF("Immediate Arbritration not implemented\n");
1385 }
1386 if (val & LSI_SCNTL1_RST) {
1387 s->sstat0 |= LSI_SSTAT0_RST;
1388 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1389 } else {
1390 s->sstat0 &= ~LSI_SSTAT0_RST;
1391 }
1392 break;
1393 case 0x02: /* SCNTL2 */
1394 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
3d834c78 1395 s->scntl2 = val;
7d8406be
PB		 1396 break;
1397 case 0x03: /* SCNTL3 */
1398 s->scntl3 = val;
1399 break;
1400 case 0x04: /* SCID */
1401 s->scid = val;
1402 break;
1403 case 0x05: /* SXFER */
1404 s->sxfer = val;
1405 break;
a917d384
PB		 1406 case 0x06: /* SDID */
1407 if ((val & 0xf) != (s->ssid & 0xf))
1408 BADF("Destination ID does not match SSID\n");
1409 s->sdid = val & 0xf;
1410 break;
7d8406be
PB		 1411 case 0x07: /* GPREG0 */
1412 break;
a917d384
PB		 1413 case 0x08: /* SFBR */
1414 /* The CPU is not allowed to write to this register. However the
1415 SCRIPTS register move instructions are. */
1416 s->sfbr = val;
1417 break;
7d8406be
PB		 1418 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1419 /* Linux writes to these readonly registers on startup. */
1420 return;
1421 CASE_SET_REG32(dsa, 0x10)
1422 case 0x14: /* ISTAT0 */
1423 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1424 if (val & LSI_ISTAT0_ABRT) {
1425 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1426 }
1427 if (val & LSI_ISTAT0_INTF) {
1428 s->istat0 &= ~LSI_ISTAT0_INTF;
1429 lsi_update_irq(s);
1430 }
4d611c9a 1431 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
7d8406be
PB		 1432 DPRINTF("Woken by SIGP\n");
1433 s->waiting = 0;
1434 s->dsp = s->dnad;
1435 lsi_execute_script(s);
1436 }
1437 if (val & LSI_ISTAT0_SRST) {
1438 lsi_soft_reset(s);
1439 }
92d88ecb 1440 break;
7d8406be
PB		 1441 case 0x16: /* MBOX0 */
1442 s->mbox0 = val;
92d88ecb 1443 break;
7d8406be
PB		 1444 case 0x17: /* MBOX1 */
1445 s->mbox1 = val;
92d88ecb 1446 break;
7d8406be
PB		 1447 case 0x1b: /* CTEST3 */
1448 s->ctest3 = val & 0x0f;
1449 break;
1450 CASE_SET_REG32(temp, 0x1c)
1451 case 0x21: /* CTEST4 */
1452 if (val & 7) {
1453 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1454 }
1455 s->ctest4 = val;
1456 break;
1457 case 0x22: /* CTEST5 */
1458 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1459 BADF("CTEST5 DMA increment not implemented\n");
1460 }
1461 s->ctest5 = val;
1462 break;
3d834c78 1463 case 0x2c: /* DSP[0:7] */
7d8406be
PB		 1464 s->dsp &= 0xffffff00;
1465 s->dsp |= val;
1466 break;
3d834c78 1467 case 0x2d: /* DSP[8:15] */
7d8406be
PB		 1468 s->dsp &= 0xffff00ff;
1469 s->dsp |= val << 8;
1470 break;
3d834c78 1471 case 0x2e: /* DSP[16:23] */
7d8406be
PB		 1472 s->dsp &= 0xff00ffff;
1473 s->dsp |= val << 16;
1474 break;
3d834c78 1475 case 0x2f: /* DSP[24:31] */
7d8406be
PB		 1476 s->dsp &= 0x00ffffff;
1477 s->dsp |= val << 24;
1478 if ((s->dmode & LSI_DMODE_MAN) == 0
1479 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1480 lsi_execute_script(s);
1481 break;
1482 CASE_SET_REG32(dsps, 0x30)
1483 CASE_SET_REG32(scratch[0], 0x34)
1484 case 0x38: /* DMODE */
1485 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1486 BADF("IO mappings not implemented\n");
1487 }
1488 s->dmode = val;
1489 break;
1490 case 0x39: /* DIEN */
1491 s->dien = val;
1492 lsi_update_irq(s);
1493 break;
1494 case 0x3b: /* DCNTL */
1495 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1496 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1497 lsi_execute_script(s);
1498 break;
1499 case 0x40: /* SIEN0 */
1500 s->sien0 = val;
1501 lsi_update_irq(s);
1502 break;
1503 case 0x41: /* SIEN1 */
1504 s->sien1 = val;
1505 lsi_update_irq(s);
1506 break;
1507 case 0x47: /* GPCNTL0 */
1508 break;
1509 case 0x48: /* STIME0 */
1510 s->stime0 = val;
1511 break;
1512 case 0x49: /* STIME1 */
1513 if (val & 0xf) {
1514 DPRINTF("General purpose timer not implemented\n");
1515 /* ??? Raising the interrupt immediately seems to be sufficient
1516 to keep the FreeBSD driver happy. */
1517 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1518 }
1519 break;
1520 case 0x4a: /* RESPID0 */
1521 s->respid0 = val;
1522 break;
1523 case 0x4b: /* RESPID1 */
1524 s->respid1 = val;
1525 break;
1526 case 0x4d: /* STEST1 */
1527 s->stest1 = val;
1528 break;
1529 case 0x4e: /* STEST2 */
1530 if (val & 1) {
1531 BADF("Low level mode not implemented\n");
1532 }
1533 s->stest2 = val;
1534 break;
1535 case 0x4f: /* STEST3 */
1536 if (val & 0x41) {
1537 BADF("SCSI FIFO test mode not implemented\n");
1538 }
1539 s->stest3 = val;
1540 break;
1541 case 0x56: /* CCNTL0 */
1542 s->ccntl0 = val;
1543 break;
1544 case 0x57: /* CCNTL1 */
1545 s->ccntl1 = val;
1546 break;
1547 CASE_SET_REG32(mmrs, 0xa0)
1548 CASE_SET_REG32(mmws, 0xa4)
1549 CASE_SET_REG32(sfs, 0xa8)
1550 CASE_SET_REG32(drs, 0xac)
1551 CASE_SET_REG32(sbms, 0xb0)
1552 CASE_SET_REG32(dmbs, 0xb4)
1553 CASE_SET_REG32(dnad64, 0xb8)
1554 CASE_SET_REG32(pmjad1, 0xc0)
1555 CASE_SET_REG32(pmjad2, 0xc4)
1556 CASE_SET_REG32(rbc, 0xc8)
1557 CASE_SET_REG32(ua, 0xcc)
1558 CASE_SET_REG32(ia, 0xd4)
1559 CASE_SET_REG32(sbc, 0xd8)
1560 CASE_SET_REG32(csbc, 0xdc)
1561 default:
1562 if (offset >= 0x5c && offset < 0xa0) {
1563 int n;
1564 int shift;
1565 n = (offset - 0x58) >> 2;
1566 shift = (offset & 3) * 8;
1567 s->scratch[n] &= ~(0xff << shift);
1568 s->scratch[n] |= (val & 0xff) << shift;
1569 } else {
1570 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1571 }
1572 }
1573#undef CASE_SET_REG32
1574}
1575
1576static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1577{
1578 LSIState *s = (LSIState *)opaque;
1579
1580 lsi_reg_writeb(s, addr & 0xff, val);
1581}
1582
1583static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1584{
1585 LSIState *s = (LSIState *)opaque;
1586
1587 addr &= 0xff;
1588 lsi_reg_writeb(s, addr, val & 0xff);
1589 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1590}
1591
1592static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1593{
1594 LSIState *s = (LSIState *)opaque;
1595
1596 addr &= 0xff;
1597 lsi_reg_writeb(s, addr, val & 0xff);
1598 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1599 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1600 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1601}
1602
1603static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1604{
1605 LSIState *s = (LSIState *)opaque;
1606
1607 return lsi_reg_readb(s, addr & 0xff);
1608}
1609
1610static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1611{
1612 LSIState *s = (LSIState *)opaque;
1613 uint32_t val;
1614
1615 addr &= 0xff;
1616 val = lsi_reg_readb(s, addr);
1617 val |= lsi_reg_readb(s, addr + 1) << 8;
1618 return val;
1619}
1620
1621static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1622{
1623 LSIState *s = (LSIState *)opaque;
1624 uint32_t val;
1625 addr &= 0xff;
1626 val = lsi_reg_readb(s, addr);
1627 val |= lsi_reg_readb(s, addr + 1) << 8;
1628 val |= lsi_reg_readb(s, addr + 2) << 16;
1629 val |= lsi_reg_readb(s, addr + 3) << 24;
1630 return val;
1631}
1632
1633static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1634 lsi_mmio_readb,
1635 lsi_mmio_readw,
1636 lsi_mmio_readl,
1637};
1638
1639static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1640 lsi_mmio_writeb,
1641 lsi_mmio_writew,
1642 lsi_mmio_writel,
1643};
1644
1645static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1646{
1647 LSIState *s = (LSIState *)opaque;
1648 uint32_t newval;
1649 int shift;
1650
1651 addr &= 0x1fff;
1652 newval = s->script_ram[addr >> 2];
1653 shift = (addr & 3) * 8;
1654 newval &= ~(0xff << shift);
1655 newval |= val << shift;
1656 s->script_ram[addr >> 2] = newval;
1657}
1658
1659static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1660{
1661 LSIState *s = (LSIState *)opaque;
1662 uint32_t newval;
1663
1664 addr &= 0x1fff;
1665 newval = s->script_ram[addr >> 2];
1666 if (addr & 2) {
1667 newval = (newval & 0xffff) | (val << 16);
1668 } else {
1669 newval = (newval & 0xffff0000) | val;
1670 }
1671 s->script_ram[addr >> 2] = newval;
1672}
1673
1674
1675static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1676{
1677 LSIState *s = (LSIState *)opaque;
1678
1679 addr &= 0x1fff;
1680 s->script_ram[addr >> 2] = val;
1681}
1682
1683static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1684{
1685 LSIState *s = (LSIState *)opaque;
1686 uint32_t val;
1687
1688 addr &= 0x1fff;
1689 val = s->script_ram[addr >> 2];
1690 val >>= (addr & 3) * 8;
1691 return val & 0xff;
1692}
1693
1694static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1695{
1696 LSIState *s = (LSIState *)opaque;
1697 uint32_t val;
1698
1699 addr &= 0x1fff;
1700 val = s->script_ram[addr >> 2];
1701 if (addr & 2)
1702 val >>= 16;
1703 return le16_to_cpu(val);
1704}
1705
1706static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1707{
1708 LSIState *s = (LSIState *)opaque;
1709
1710 addr &= 0x1fff;
1711 return le32_to_cpu(s->script_ram[addr >> 2]);
1712}
1713
1714static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1715 lsi_ram_readb,
1716 lsi_ram_readw,
1717 lsi_ram_readl,
1718};
1719
1720static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1721 lsi_ram_writeb,
1722 lsi_ram_writew,
1723 lsi_ram_writel,
1724};
1725
1726static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1727{
1728 LSIState *s = (LSIState *)opaque;
1729 return lsi_reg_readb(s, addr & 0xff);
1730}
1731
1732static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1733{
1734 LSIState *s = (LSIState *)opaque;
1735 uint32_t val;
1736 addr &= 0xff;
1737 val = lsi_reg_readb(s, addr);
1738 val |= lsi_reg_readb(s, addr + 1) << 8;
1739 return val;
1740}
1741
1742static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1743{
1744 LSIState *s = (LSIState *)opaque;
1745 uint32_t val;
1746 addr &= 0xff;
1747 val = lsi_reg_readb(s, addr);
1748 val |= lsi_reg_readb(s, addr + 1) << 8;
1749 val |= lsi_reg_readb(s, addr + 2) << 16;
1750 val |= lsi_reg_readb(s, addr + 3) << 24;
1751 return val;
1752}
1753
1754static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1755{
1756 LSIState *s = (LSIState *)opaque;
1757 lsi_reg_writeb(s, addr & 0xff, val);
1758}
1759
1760static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1761{
1762 LSIState *s = (LSIState *)opaque;
1763 addr &= 0xff;
1764 lsi_reg_writeb(s, addr, val & 0xff);
1765 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1766}
1767
1768static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1769{
1770 LSIState *s = (LSIState *)opaque;
1771 addr &= 0xff;
1772 lsi_reg_writeb(s, addr, val & 0xff);
1773 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1774 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
dcfb9014 1775 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
7d8406be
PB		 1776}
1777
5fafdf24 1778static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
7d8406be
PB		 1779 uint32_t addr, uint32_t size, int type)
1780{
1781 LSIState *s = (LSIState *)pci_dev;
1782
1783 DPRINTF("Mapping IO at %08x\n", addr);
1784
1785 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1786 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1787 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1788 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1789 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1790 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1791}
1792
5fafdf24 1793static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
7d8406be
PB		 1794 uint32_t addr, uint32_t size, int type)
1795{
1796 LSIState *s = (LSIState *)pci_dev;
1797
1798 DPRINTF("Mapping ram at %08x\n", addr);
1799 s->script_ram_base = addr;
1800 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1801}
1802
5fafdf24 1803static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
7d8406be
PB		 1804 uint32_t addr, uint32_t size, int type)
1805{
1806 LSIState *s = (LSIState *)pci_dev;
1807
1808 DPRINTF("Mapping registers at %08x\n", addr);
1809 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1810}
1811
1812void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1813{
1814 LSIState *s = (LSIState *)opaque;
1815
1816 if (id < 0) {
1817 for (id = 0; id < LSI_MAX_DEVS; id++) {
1818 if (s->scsi_dev[id] == NULL)
1819 break;
1820 }
1821 }
1822 if (id >= LSI_MAX_DEVS) {
1823 BADF("Bad Device ID %d\n", id);
1824 return;
1825 }
1826 if (s->scsi_dev[id]) {
1827 DPRINTF("Destroying device %d\n", id);
1828 scsi_disk_destroy(s->scsi_dev[id]);
1829 }
1830 DPRINTF("Attaching block device %d\n", id);
a917d384 1831 s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
7d8406be
PB		 1832}
1833
1834void *lsi_scsi_init(PCIBus *bus, int devfn)
1835{
1836 LSIState *s;
1837
1838 s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1839 sizeof(*s), devfn, NULL, NULL);
1840 if (s == NULL) {
1841 fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1842 return NULL;
1843 }
1844
1845 s->pci_dev.config[0x00] = 0x00;
1846 s->pci_dev.config[0x01] = 0x10;
1847 s->pci_dev.config[0x02] = 0x12;
1848 s->pci_dev.config[0x03] = 0x00;
1849 s->pci_dev.config[0x0b] = 0x01;
1850 s->pci_dev.config[0x3d] = 0x01; /* interrupt pin 1 */
1851
1852 s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1853 lsi_mmio_writefn, s);
1854 s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1855 lsi_ram_writefn, s);
1856
1857 pci_register_io_region((struct PCIDevice *)s, 0, 256,
1858 PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1859 pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1860 PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
1861 pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
1862 PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
a917d384
PB		 1863 s->queue = qemu_malloc(sizeof(lsi_queue));
1864 s->queue_len = 1;
1865 s->active_commands = 0;
7d8406be
PB		 1866
1867 lsi_soft_reset(s);
1868
1869 return s;
1870}
1871
Qemu copy for testing