]> git.proxmox.com Git - qemu.git/blame - hw/scsi/lsi53c895a.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge remote-tracking branch 'afaerber/tags/qom-cpu-for-anthony' into staging
[qemu.git] / hw / scsi / lsi53c895a.c
CommitLineData
5fafdf24 1/*
7d8406be
PB		 2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
8e31bf38 7 * This code is licensed under the LGPL.
7d8406be
PB		 8 */
9
10/* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
12
a15fdf86 13#include <assert.h>
777aec7a 14
83c9f4ca
PB		 15#include "hw/hw.h"
16#include "hw/pci/pci.h"
0d09e41a 17#include "hw/scsi/scsi.h"
9c17d615 18#include "sysemu/dma.h"
7d8406be
PB		 19
20//#define DEBUG_LSI
21//#define DEBUG_LSI_REG
22
23#ifdef DEBUG_LSI
001faf32
BS		 24#define DPRINTF(fmt, ...) \
25do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26#define BADF(fmt, ...) \
27do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
7d8406be 28#else
001faf32
BS		 29#define DPRINTF(fmt, ...) do {} while(0)
30#define BADF(fmt, ...) \
31do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
7d8406be
PB		 32#endif
33
18e08a55
MT		 34#define LSI_MAX_DEVS 7
35
7d8406be
PB		 36#define LSI_SCNTL0_TRG 0x01
37#define LSI_SCNTL0_AAP 0x02
38#define LSI_SCNTL0_EPC 0x08
39#define LSI_SCNTL0_WATN 0x10
40#define LSI_SCNTL0_START 0x20
41
42#define LSI_SCNTL1_SST 0x01
43#define LSI_SCNTL1_IARB 0x02
44#define LSI_SCNTL1_AESP 0x04
45#define LSI_SCNTL1_RST 0x08
46#define LSI_SCNTL1_CON 0x10
47#define LSI_SCNTL1_DHP 0x20
48#define LSI_SCNTL1_ADB 0x40
49#define LSI_SCNTL1_EXC 0x80
50
51#define LSI_SCNTL2_WSR 0x01
52#define LSI_SCNTL2_VUE0 0x02
53#define LSI_SCNTL2_VUE1 0x04
54#define LSI_SCNTL2_WSS 0x08
55#define LSI_SCNTL2_SLPHBEN 0x10
56#define LSI_SCNTL2_SLPMD 0x20
57#define LSI_SCNTL2_CHM 0x40
58#define LSI_SCNTL2_SDU 0x80
59
60#define LSI_ISTAT0_DIP 0x01
61#define LSI_ISTAT0_SIP 0x02
62#define LSI_ISTAT0_INTF 0x04
63#define LSI_ISTAT0_CON 0x08
64#define LSI_ISTAT0_SEM 0x10
65#define LSI_ISTAT0_SIGP 0x20
66#define LSI_ISTAT0_SRST 0x40
67#define LSI_ISTAT0_ABRT 0x80
68
69#define LSI_ISTAT1_SI 0x01
70#define LSI_ISTAT1_SRUN 0x02
71#define LSI_ISTAT1_FLSH 0x04
72
73#define LSI_SSTAT0_SDP0 0x01
74#define LSI_SSTAT0_RST 0x02
75#define LSI_SSTAT0_WOA 0x04
76#define LSI_SSTAT0_LOA 0x08
77#define LSI_SSTAT0_AIP 0x10
78#define LSI_SSTAT0_OLF 0x20
79#define LSI_SSTAT0_ORF 0x40
80#define LSI_SSTAT0_ILF 0x80
81
82#define LSI_SIST0_PAR 0x01
83#define LSI_SIST0_RST 0x02
84#define LSI_SIST0_UDC 0x04
85#define LSI_SIST0_SGE 0x08
86#define LSI_SIST0_RSL 0x10
87#define LSI_SIST0_SEL 0x20
88#define LSI_SIST0_CMP 0x40
89#define LSI_SIST0_MA 0x80
90
91#define LSI_SIST1_HTH 0x01
92#define LSI_SIST1_GEN 0x02
93#define LSI_SIST1_STO 0x04
94#define LSI_SIST1_SBMC 0x10
95
96#define LSI_SOCL_IO 0x01
97#define LSI_SOCL_CD 0x02
98#define LSI_SOCL_MSG 0x04
99#define LSI_SOCL_ATN 0x08
100#define LSI_SOCL_SEL 0x10
101#define LSI_SOCL_BSY 0x20
102#define LSI_SOCL_ACK 0x40
103#define LSI_SOCL_REQ 0x80
104
105#define LSI_DSTAT_IID 0x01
106#define LSI_DSTAT_SIR 0x04
107#define LSI_DSTAT_SSI 0x08
108#define LSI_DSTAT_ABRT 0x10
109#define LSI_DSTAT_BF 0x20
110#define LSI_DSTAT_MDPE 0x40
111#define LSI_DSTAT_DFE 0x80
112
113#define LSI_DCNTL_COM 0x01
114#define LSI_DCNTL_IRQD 0x02
115#define LSI_DCNTL_STD 0x04
116#define LSI_DCNTL_IRQM 0x08
117#define LSI_DCNTL_SSM 0x10
118#define LSI_DCNTL_PFEN 0x20
119#define LSI_DCNTL_PFF 0x40
120#define LSI_DCNTL_CLSE 0x80
121
122#define LSI_DMODE_MAN 0x01
123#define LSI_DMODE_BOF 0x02
124#define LSI_DMODE_ERMP 0x04
125#define LSI_DMODE_ERL 0x08
126#define LSI_DMODE_DIOM 0x10
127#define LSI_DMODE_SIOM 0x20
128
129#define LSI_CTEST2_DACK 0x01
130#define LSI_CTEST2_DREQ 0x02
131#define LSI_CTEST2_TEOP 0x04
132#define LSI_CTEST2_PCICIE 0x08
133#define LSI_CTEST2_CM 0x10
134#define LSI_CTEST2_CIO 0x20
135#define LSI_CTEST2_SIGP 0x40
136#define LSI_CTEST2_DDIR 0x80
137
138#define LSI_CTEST5_BL2 0x04
139#define LSI_CTEST5_DDIR 0x08
140#define LSI_CTEST5_MASR 0x10
141#define LSI_CTEST5_DFSN 0x20
142#define LSI_CTEST5_BBCK 0x40
143#define LSI_CTEST5_ADCK 0x80
144
145#define LSI_CCNTL0_DILS 0x01
146#define LSI_CCNTL0_DISFC 0x10
147#define LSI_CCNTL0_ENNDJ 0x20
148#define LSI_CCNTL0_PMJCTL 0x40
149#define LSI_CCNTL0_ENPMJ 0x80
150
b25cf589
AL		 151#define LSI_CCNTL1_EN64DBMV 0x01
152#define LSI_CCNTL1_EN64TIBMV 0x02
153#define LSI_CCNTL1_64TIMOD 0x04
154#define LSI_CCNTL1_DDAC 0x08
155#define LSI_CCNTL1_ZMOD 0x80
156
e560125e
LA		 157/* Enable Response to Reselection */
158#define LSI_SCID_RRE 0x60
159
b25cf589
AL		 160#define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
161
7d8406be
PB		 162#define PHASE_DO 0
163#define PHASE_DI 1
164#define PHASE_CMD 2
165#define PHASE_ST 3
166#define PHASE_MO 6
167#define PHASE_MI 7
168#define PHASE_MASK 7
169
a917d384
PB		 170/* Maximum length of MSG IN data. */
171#define LSI_MAX_MSGIN_LEN 8
172
173/* Flag set if this is a tagged command. */
174#define LSI_TAG_VALID (1 << 16)
175
042ec49d 176typedef struct lsi_request {
5c6c0e51 177 SCSIRequest *req;
a917d384 178 uint32_t tag;
b96a0da0
GH		 179 uint32_t dma_len;
180 uint8_t *dma_buf;
a917d384
PB		 181 uint32_t pending;
182 int out;
042ec49d
GH		 183 QTAILQ_ENTRY(lsi_request) next;
184} lsi_request;
4d611c9a 185
7d8406be 186typedef struct {
725eec70
AF		 187 /*< private >*/
188 PCIDevice parent_obj;
189 /*< public >*/
190
b0ce84e5
AK		 191 MemoryRegion mmio_io;
192 MemoryRegion ram_io;
193 MemoryRegion io_io;
7d8406be
PB		 194
195 int carry; /* ??? Should this be an a visible register somewhere? */
2f172849 196 int status;
a917d384 197 /* Action to take at the end of a MSG IN phase.
a15fdf86 198 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
a917d384
PB		 199 int msg_action;
200 int msg_len;
201 uint8_t msg[LSI_MAX_MSGIN_LEN];
4d611c9a
PB		 202 /* 0 if SCRIPTS are running or stopped.
203 * 1 if a Wait Reselect instruction has been issued.
a917d384
PB		 204 * 2 if processing DMA from lsi_execute_script.
205 * 3 if a DMA operation is in progress. */
7d8406be 206 int waiting;
ca9c39fa 207 SCSIBus bus;
7d8406be 208 int current_lun;
a917d384 209 /* The tag is a combination of the device ID and the SCSI tag. */
af12ac98 210 uint32_t select_tag;
8ccc2ace 211 int command_complete;
042ec49d 212 QTAILQ_HEAD(, lsi_request) queue;
af12ac98 213 lsi_request *current;
7d8406be
PB		 214
215 uint32_t dsa;
216 uint32_t temp;
217 uint32_t dnad;
218 uint32_t dbc;
219 uint8_t istat0;
220 uint8_t istat1;
221 uint8_t dcmd;
222 uint8_t dstat;
223 uint8_t dien;
224 uint8_t sist0;
225 uint8_t sist1;
226 uint8_t sien0;
227 uint8_t sien1;
228 uint8_t mbox0;
229 uint8_t mbox1;
230 uint8_t dfifo;
9167a69a 231 uint8_t ctest2;
7d8406be
PB		 232 uint8_t ctest3;
233 uint8_t ctest4;
234 uint8_t ctest5;
235 uint8_t ccntl0;
236 uint8_t ccntl1;
237 uint32_t dsp;
238 uint32_t dsps;
239 uint8_t dmode;
240 uint8_t dcntl;
241 uint8_t scntl0;
242 uint8_t scntl1;
243 uint8_t scntl2;
244 uint8_t scntl3;
245 uint8_t sstat0;
246 uint8_t sstat1;
247 uint8_t scid;
248 uint8_t sxfer;
249 uint8_t socl;
250 uint8_t sdid;
a917d384 251 uint8_t ssid;
7d8406be
PB		 252 uint8_t sfbr;
253 uint8_t stest1;
254 uint8_t stest2;
255 uint8_t stest3;
a917d384 256 uint8_t sidl;
7d8406be
PB		 257 uint8_t stime0;
258 uint8_t respid0;
259 uint8_t respid1;
260 uint32_t mmrs;
261 uint32_t mmws;
262 uint32_t sfs;
263 uint32_t drs;
264 uint32_t sbms;
ab57d967 265 uint32_t dbms;
7d8406be
PB		 266 uint32_t dnad64;
267 uint32_t pmjad1;
268 uint32_t pmjad2;
269 uint32_t rbc;
270 uint32_t ua;
271 uint32_t ia;
272 uint32_t sbc;
273 uint32_t csbc;
dcfb9014 274 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
bd8ee11a 275 uint8_t sbr;
7d8406be
PB		 276
277 /* Script ram is stored as 32-bit words in host byteorder. */
278 uint32_t script_ram[2048];
279} LSIState;
280
71186c86
PC		 281#define TYPE_LSI53C895A "lsi53c895a"
282
283#define LSI53C895A(obj) \
284 OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A)
285
e560125e
LA		 286static inline int lsi_irq_on_rsl(LSIState *s)
287{
288 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
289}
290
7d8406be
PB		 291static void lsi_soft_reset(LSIState *s)
292{
293 DPRINTF("Reset\n");
294 s->carry = 0;
295
d43ba0af
JK		 296 s->msg_action = 0;
297 s->msg_len = 0;
7d8406be
PB		 298 s->waiting = 0;
299 s->dsa = 0;
300 s->dnad = 0;
301 s->dbc = 0;
302 s->temp = 0;
303 memset(s->scratch, 0, sizeof(s->scratch));
304 s->istat0 = 0;
305 s->istat1 = 0;
12aa6dd6
JK		 306 s->dcmd = 0x40;
307 s->dstat = LSI_DSTAT_DFE;
7d8406be
PB		 308 s->dien = 0;
309 s->sist0 = 0;
310 s->sist1 = 0;
311 s->sien0 = 0;
312 s->sien1 = 0;
313 s->mbox0 = 0;
314 s->mbox1 = 0;
315 s->dfifo = 0;
12aa6dd6 316 s->ctest2 = LSI_CTEST2_DACK;
7d8406be
PB		 317 s->ctest3 = 0;
318 s->ctest4 = 0;
319 s->ctest5 = 0;
320 s->ccntl0 = 0;
321 s->ccntl1 = 0;
322 s->dsp = 0;
323 s->dsps = 0;
324 s->dmode = 0;
325 s->dcntl = 0;
326 s->scntl0 = 0xc0;
327 s->scntl1 = 0;
328 s->scntl2 = 0;
329 s->scntl3 = 0;
330 s->sstat0 = 0;
331 s->sstat1 = 0;
332 s->scid = 7;
333 s->sxfer = 0;
334 s->socl = 0;
12aa6dd6
JK		 335 s->sdid = 0;
336 s->ssid = 0;
7d8406be
PB		 337 s->stest1 = 0;
338 s->stest2 = 0;
339 s->stest3 = 0;
a917d384 340 s->sidl = 0;
7d8406be
PB		 341 s->stime0 = 0;
342 s->respid0 = 0x80;
343 s->respid1 = 0;
344 s->mmrs = 0;
345 s->mmws = 0;
346 s->sfs = 0;
347 s->drs = 0;
348 s->sbms = 0;
ab57d967 349 s->dbms = 0;
7d8406be
PB		 350 s->dnad64 = 0;
351 s->pmjad1 = 0;
352 s->pmjad2 = 0;
353 s->rbc = 0;
354 s->ua = 0;
355 s->ia = 0;
356 s->sbc = 0;
357 s->csbc = 0;
bd8ee11a 358 s->sbr = 0;
2f0772c5
PB		 359 assert(QTAILQ_EMPTY(&s->queue));
360 assert(!s->current);
7d8406be
PB		 361}
362
b25cf589
AL		 363static int lsi_dma_40bit(LSIState *s)
364{
365 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
366 return 1;
367 return 0;
368}
369
dd8edf01
AL		 370static int lsi_dma_ti64bit(LSIState *s)
371{
372 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
373 return 1;
374 return 0;
375}
376
377static int lsi_dma_64bit(LSIState *s)
378{
379 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
380 return 1;
381 return 0;
382}
383
7d8406be
PB		 384static uint8_t lsi_reg_readb(LSIState *s, int offset);
385static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
4d611c9a 386static void lsi_execute_script(LSIState *s);
aa4d32c4 387static void lsi_reselect(LSIState *s, lsi_request *p);
7d8406be
PB		 388
389static inline uint32_t read_dword(LSIState *s, uint32_t addr)
390{
391 uint32_t buf;
392
725eec70 393 pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
7d8406be
PB		 394 return cpu_to_le32(buf);
395}
396
397static void lsi_stop_script(LSIState *s)
398{
399 s->istat1 &= ~LSI_ISTAT1_SRUN;
400}
401
402static void lsi_update_irq(LSIState *s)
403{
725eec70 404 PCIDevice *d = PCI_DEVICE(s);
7d8406be
PB		 405 int level;
406 static int last_level;
042ec49d 407 lsi_request *p;
7d8406be
PB		 408
409 /* It's unclear whether the DIP/SIP bits should be cleared when the
410 Interrupt Status Registers are cleared or when istat0 is read.
411 We currently do the formwer, which seems to work. */
412 level = 0;
413 if (s->dstat) {
414 if (s->dstat & s->dien)
415 level = 1;
416 s->istat0 |= LSI_ISTAT0_DIP;
417 } else {
418 s->istat0 &= ~LSI_ISTAT0_DIP;
419 }
420
421 if (s->sist0 || s->sist1) {
422 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
423 level = 1;
424 s->istat0 |= LSI_ISTAT0_SIP;
425 } else {
426 s->istat0 &= ~LSI_ISTAT0_SIP;
427 }
428 if (s->istat0 & LSI_ISTAT0_INTF)
429 level = 1;
430
431 if (level != last_level) {
432 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
433 level, s->dstat, s->sist1, s->sist0);
434 last_level = level;
435 }
725eec70 436 qemu_set_irq(d->irq[0], level);
e560125e
LA		 437
438 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
439 DPRINTF("Handled IRQs & disconnected, looking for pending "
440 "processes\n");
042ec49d
GH		 441 QTAILQ_FOREACH(p, &s->queue, next) {
442 if (p->pending) {
aa4d32c4 443 lsi_reselect(s, p);
e560125e
LA		 444 break;
445 }
446 }
447 }
7d8406be
PB		 448}
449
450/* Stop SCRIPTS execution and raise a SCSI interrupt. */
451static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
452{
453 uint32_t mask0;
454 uint32_t mask1;
455
456 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
457 stat1, stat0, s->sist1, s->sist0);
458 s->sist0 |= stat0;
459 s->sist1 |= stat1;
460 /* Stop processor on fatal or unmasked interrupt. As a special hack
461 we don't stop processing when raising STO. Instead continue
462 execution and stop at the next insn that accesses the SCSI bus. */
463 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
464 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
465 mask1 &= ~LSI_SIST1_STO;
466 if (s->sist0 & mask0 || s->sist1 & mask1) {
467 lsi_stop_script(s);
468 }
469 lsi_update_irq(s);
470}
471
472/* Stop SCRIPTS execution and raise a DMA interrupt. */
473static void lsi_script_dma_interrupt(LSIState *s, int stat)
474{
475 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
476 s->dstat |= stat;
477 lsi_update_irq(s);
478 lsi_stop_script(s);
479}
480
481static inline void lsi_set_phase(LSIState *s, int phase)
482{
483 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
484}
485
486static void lsi_bad_phase(LSIState *s, int out, int new_phase)
487{
488 /* Trigger a phase mismatch. */
489 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
d1d74664
PB		 490 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
491 s->dsp = out ? s->pmjad1 : s->pmjad2;
7d8406be 492 } else {
d1d74664 493 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
7d8406be
PB		 494 }
495 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
496 } else {
497 DPRINTF("Phase mismatch interrupt\n");
498 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
499 lsi_stop_script(s);
500 }
501 lsi_set_phase(s, new_phase);
502}
503
a917d384
PB		 504
505/* Resume SCRIPTS execution after a DMA operation. */
506static void lsi_resume_script(LSIState *s)
507{
508 if (s->waiting != 2) {
509 s->waiting = 0;
510 lsi_execute_script(s);
511 } else {
512 s->waiting = 0;
513 }
514}
515
64d56409
JK		 516static void lsi_disconnect(LSIState *s)
517{
518 s->scntl1 &= ~LSI_SCNTL1_CON;
519 s->sstat1 &= ~PHASE_MASK;
520}
521
522static void lsi_bad_selection(LSIState *s, uint32_t id)
523{
524 DPRINTF("Selected absent target %d\n", id);
525 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
526 lsi_disconnect(s);
527}
528
4d611c9a 529/* Initiate a SCSI layer data transfer. */
7d8406be
PB		 530static void lsi_do_dma(LSIState *s, int out)
531{
725eec70 532 PCIDevice *pci_dev;
f48a7a6e 533 uint32_t count;
9ba4524c 534 dma_addr_t addr;
64d56409 535 SCSIDevice *dev;
7d8406be 536
b96a0da0
GH		 537 assert(s->current);
538 if (!s->current->dma_len) {
a917d384
PB		 539 /* Wait until data is available. */
540 DPRINTF("DMA no data available\n");
541 return;
7d8406be
PB		 542 }
543
725eec70 544 pci_dev = PCI_DEVICE(s);
f48a7a6e
PB		 545 dev = s->current->req->dev;
546 assert(dev);
64d56409 547
a917d384 548 count = s->dbc;
b96a0da0
GH		 549 if (count > s->current->dma_len)
550 count = s->current->dma_len;
a917d384
PB		 551
552 addr = s->dnad;
dd8edf01
AL		 553 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
554 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
b25cf589 555 addr |= ((uint64_t)s->dnad64 << 32);
dd8edf01
AL		 556 else if (s->dbms)
557 addr |= ((uint64_t)s->dbms << 32);
b25cf589
AL		 558 else if (s->sbms)
559 addr |= ((uint64_t)s->sbms << 32);
560
9ba4524c 561 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
7d8406be 562 s->csbc += count;
a917d384
PB		 563 s->dnad += count;
564 s->dbc -= count;
5c6c0e51 565 if (s->current->dma_buf == NULL) {
0c34459b 566 s->current->dma_buf = scsi_req_get_buf(s->current->req);
a917d384 567 }
7d8406be 568 /* ??? Set SFBR to first data byte. */
a917d384 569 if (out) {
725eec70 570 pci_dma_read(pci_dev, addr, s->current->dma_buf, count);
a917d384 571 } else {
725eec70 572 pci_dma_write(pci_dev, addr, s->current->dma_buf, count);
a917d384 573 }
b96a0da0
GH		 574 s->current->dma_len -= count;
575 if (s->current->dma_len == 0) {
576 s->current->dma_buf = NULL;
ad3376cc 577 scsi_req_continue(s->current->req);
a917d384 578 } else {
b96a0da0 579 s->current->dma_buf += count;
a917d384
PB		 580 lsi_resume_script(s);
581 }
582}
583
584
585/* Add a command to the queue. */
586static void lsi_queue_command(LSIState *s)
587{
af12ac98 588 lsi_request *p = s->current;
a917d384 589
aa2b1e89 590 DPRINTF("Queueing tag=0x%x\n", p->tag);
af12ac98 591 assert(s->current != NULL);
b96a0da0 592 assert(s->current->dma_len == 0);
af12ac98
GH		 593 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
594 s->current = NULL;
595
a917d384
PB		 596 p->pending = 0;
597 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
598}
599
600/* Queue a byte for a MSG IN phase. */
601static void lsi_add_msg_byte(LSIState *s, uint8_t data)
602{
603 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
604 BADF("MSG IN data too long\n");
4d611c9a 605 } else {
a917d384
PB		 606 DPRINTF("MSG IN 0x%02x\n", data);
607 s->msg[s->msg_len++] = data;
7d8406be 608 }
a917d384
PB		 609}
610
611/* Perform reselection to continue a command. */
aa4d32c4 612static void lsi_reselect(LSIState *s, lsi_request *p)
a917d384 613{
a917d384
PB		 614 int id;
615
af12ac98
GH		 616 assert(s->current == NULL);
617 QTAILQ_REMOVE(&s->queue, p, next);
618 s->current = p;
619
aa4d32c4 620 id = (p->tag >> 8) & 0xf;
a917d384 621 s->ssid = id | 0x80;
cc9f28bc 622 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
f6dc18df 623 if (!(s->dcntl & LSI_DCNTL_COM)) {
cc9f28bc
LA		 624 s->sfbr = 1 << (id & 0x7);
625 }
a917d384 626 DPRINTF("Reselected target %d\n", id);
a917d384
PB		 627 s->scntl1 |= LSI_SCNTL1_CON;
628 lsi_set_phase(s, PHASE_MI);
629 s->msg_action = p->out ? 2 : 3;
b96a0da0 630 s->current->dma_len = p->pending;
a917d384 631 lsi_add_msg_byte(s, 0x80);
af12ac98 632 if (s->current->tag & LSI_TAG_VALID) {
a917d384 633 lsi_add_msg_byte(s, 0x20);
aa4d32c4 634 lsi_add_msg_byte(s, p->tag & 0xff);
a917d384
PB		 635 }
636
e560125e
LA		 637 if (lsi_irq_on_rsl(s)) {
638 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
639 }
a917d384
PB		 640}
641
11257187 642static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
a917d384 643{
042ec49d
GH		 644 lsi_request *p;
645
646 QTAILQ_FOREACH(p, &s->queue, next) {
a917d384 647 if (p->tag == tag) {
11257187 648 return p;
a917d384
PB		 649 }
650 }
11257187
PB		 651
652 return NULL;
653}
654
d2a9998f
PB		 655static void lsi_request_free(LSIState *s, lsi_request *p)
656{
657 if (p == s->current) {
658 s->current = NULL;
659 } else {
660 QTAILQ_REMOVE(&s->queue, p, next);
661 }
662 g_free(p);
663}
664
94d3f98a
PB		 665static void lsi_request_cancelled(SCSIRequest *req)
666{
71186c86 667 LSIState *s = LSI53C895A(req->bus->qbus.parent);
c5bf71a9 668 lsi_request *p = req->hba_private;
94d3f98a 669
d2a9998f
PB		 670 req->hba_private = NULL;
671 lsi_request_free(s, p);
672 scsi_req_unref(req);
94d3f98a
PB		 673}
674
11257187
PB		 675/* Record that data is available for a queued command. Returns zero if
676 the device was reselected, nonzero if the IO is deferred. */
c5bf71a9 677static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
11257187 678{
c5bf71a9 679 lsi_request *p = req->hba_private;
11257187
PB		 680
681 if (p->pending) {
c5bf71a9 682 BADF("Multiple IO pending for request %p\n", p);
11257187 683 }
aba1f023 684 p->pending = len;
11257187
PB		 685 /* Reselect if waiting for it, or if reselection triggers an IRQ
686 and the bus is free.
687 Since no interrupt stacking is implemented in the emulation, it
688 is also required that there are no pending interrupts waiting
689 for service from the device driver. */
690 if (s->waiting == 1 ||
691 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
692 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
693 /* Reselect device. */
694 lsi_reselect(s, p);
695 return 0;
696 } else {
4789bc39 697 DPRINTF("Queueing IO tag=0x%x\n", p->tag);
aba1f023 698 p->pending = len;
11257187
PB		 699 return 1;
700 }
7d8406be 701}
c6df7102
PB		 702
703 /* Callback to indicate that the SCSI layer has completed a command. */
01e95455 704static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
4d611c9a 705{
71186c86 706 LSIState *s = LSI53C895A(req->bus->qbus.parent);
4d611c9a
PB		 707 int out;
708
a917d384 709 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
aba1f023
PB		 710 DPRINTF("Command complete status=%d\n", (int)status);
711 s->status = status;
c6df7102
PB		 712 s->command_complete = 2;
713 if (s->waiting && s->dbc != 0) {
714 /* Raise phase mismatch for short transfers. */
715 lsi_bad_phase(s, out, PHASE_ST);
716 } else {
717 lsi_set_phase(s, PHASE_ST);
718 }
af12ac98 719
8f6e699d 720 if (req->hba_private == s->current) {
d2a9998f
PB		 721 req->hba_private = NULL;
722 lsi_request_free(s, s->current);
723 scsi_req_unref(req);
4d611c9a 724 }
c6df7102
PB		 725 lsi_resume_script(s);
726}
727
728 /* Callback to indicate that the SCSI layer has completed a transfer. */
aba1f023 729static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
c6df7102 730{
71186c86 731 LSIState *s = LSI53C895A(req->bus->qbus.parent);
c6df7102 732 int out;
4d611c9a 733
8f6e699d
PB		 734 assert(req->hba_private);
735 if (s->waiting == 1 || req->hba_private != s->current ||
e560125e 736 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
c5bf71a9 737 if (lsi_queue_req(s, req, len)) {
a917d384 738 return;
5c6c0e51 739 }
a917d384 740 }
e560125e 741
c6df7102
PB		 742 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
743
e560125e 744 /* host adapter (re)connected */
aba1f023
PB		 745 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
746 s->current->dma_len = len;
8ccc2ace 747 s->command_complete = 1;
c6df7102
PB		 748 if (s->waiting) {
749 if (s->waiting == 1 || s->dbc == 0) {
750 lsi_resume_script(s);
751 } else {
752 lsi_do_dma(s, out);
753 }
4d611c9a
PB		 754 }
755}
7d8406be
PB		 756
757static void lsi_do_command(LSIState *s)
758{
64d56409 759 SCSIDevice *dev;
7d8406be 760 uint8_t buf[16];
64d56409 761 uint32_t id;
7d8406be
PB		 762 int n;
763
764 DPRINTF("Send command len=%d\n", s->dbc);
765 if (s->dbc > 16)
766 s->dbc = 16;
725eec70 767 pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
7d8406be 768 s->sfbr = buf[0];
8ccc2ace 769 s->command_complete = 0;
af12ac98 770
259d5577 771 id = (s->select_tag >> 8) & 0xf;
0d3545e7 772 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
64d56409
JK		 773 if (!dev) {
774 lsi_bad_selection(s, id);
775 return;
776 }
777
af12ac98 778 assert(s->current == NULL);
7267c094 779 s->current = g_malloc0(sizeof(lsi_request));
af12ac98 780 s->current->tag = s->select_tag;
c39ce112 781 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
c5bf71a9 782 s->current);
af12ac98 783
c39ce112 784 n = scsi_req_enqueue(s->current->req);
ad3376cc
PB		 785 if (n) {
786 if (n > 0) {
787 lsi_set_phase(s, PHASE_DI);
788 } else if (n < 0) {
789 lsi_set_phase(s, PHASE_DO);
790 }
791 scsi_req_continue(s->current->req);
a917d384 792 }
8ccc2ace
TS		 793 if (!s->command_complete) {
794 if (n) {
795 /* Command did not complete immediately so disconnect. */
796 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
797 lsi_add_msg_byte(s, 4); /* DISCONNECT */
798 /* wait data */
799 lsi_set_phase(s, PHASE_MI);
800 s->msg_action = 1;
801 lsi_queue_command(s);
802 } else {
803 /* wait command complete */
804 lsi_set_phase(s, PHASE_DI);
805 }
7d8406be
PB		 806 }
807}
808
7d8406be
PB		 809static void lsi_do_status(LSIState *s)
810{
2f172849
HR		 811 uint8_t status;
812 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
7d8406be
PB		 813 if (s->dbc != 1)
814 BADF("Bad Status move\n");
815 s->dbc = 1;
2f172849
HR		 816 status = s->status;
817 s->sfbr = status;
725eec70 818 pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
7d8406be 819 lsi_set_phase(s, PHASE_MI);
a917d384
PB		 820 s->msg_action = 1;
821 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
7d8406be
PB		 822}
823
7d8406be
PB		 824static void lsi_do_msgin(LSIState *s)
825{
a917d384
PB		 826 int len;
827 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
828 s->sfbr = s->msg[0];
829 len = s->msg_len;
830 if (len > s->dbc)
831 len = s->dbc;
725eec70 832 pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
a917d384
PB		 833 /* Linux drivers rely on the last byte being in the SIDL. */
834 s->sidl = s->msg[len - 1];
835 s->msg_len -= len;
836 if (s->msg_len) {
837 memmove(s->msg, s->msg + len, s->msg_len);
7d8406be
PB		 838 } else {
839 /* ??? Check if ATN (not yet implemented) is asserted and maybe
840 switch to PHASE_MO. */
a917d384
PB		 841 switch (s->msg_action) {
842 case 0:
843 lsi_set_phase(s, PHASE_CMD);
844 break;
845 case 1:
846 lsi_disconnect(s);
847 break;
848 case 2:
849 lsi_set_phase(s, PHASE_DO);
850 break;
851 case 3:
852 lsi_set_phase(s, PHASE_DI);
853 break;
854 default:
855 abort();
856 }
7d8406be
PB		 857 }
858}
859
a917d384
PB		 860/* Read the next byte during a MSGOUT phase. */
861static uint8_t lsi_get_msgbyte(LSIState *s)
862{
863 uint8_t data;
725eec70 864 pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
a917d384
PB		 865 s->dnad++;
866 s->dbc--;
867 return data;
868}
869
444dd39b
SH		 870/* Skip the next n bytes during a MSGOUT phase. */
871static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
872{
873 s->dnad += n;
874 s->dbc -= n;
875}
876
7d8406be
PB		 877static void lsi_do_msgout(LSIState *s)
878{
879 uint8_t msg;
a917d384 880 int len;
508240c0 881 uint32_t current_tag;
5c6c0e51 882 lsi_request *current_req, *p, *p_next;
508240c0
BK		 883
884 if (s->current) {
885 current_tag = s->current->tag;
5c6c0e51 886 current_req = s->current;
508240c0
BK		 887 } else {
888 current_tag = s->select_tag;
5c6c0e51 889 current_req = lsi_find_by_tag(s, current_tag);
508240c0 890 }
7d8406be
PB		 891
892 DPRINTF("MSG out len=%d\n", s->dbc);
a917d384
PB		 893 while (s->dbc) {
894 msg = lsi_get_msgbyte(s);
895 s->sfbr = msg;
896
897 switch (msg) {
77203ea0 898 case 0x04:
a917d384
PB		 899 DPRINTF("MSG: Disconnect\n");
900 lsi_disconnect(s);
901 break;
902 case 0x08:
903 DPRINTF("MSG: No Operation\n");
904 lsi_set_phase(s, PHASE_CMD);
905 break;
906 case 0x01:
907 len = lsi_get_msgbyte(s);
908 msg = lsi_get_msgbyte(s);
f3f5b867 909 (void)len; /* avoid a warning about unused variable*/
a917d384
PB		 910 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
911 switch (msg) {
912 case 1:
913 DPRINTF("SDTR (ignored)\n");
444dd39b 914 lsi_skip_msgbytes(s, 2);
a917d384
PB		 915 break;
916 case 3:
917 DPRINTF("WDTR (ignored)\n");
444dd39b 918 lsi_skip_msgbytes(s, 1);
a917d384
PB		 919 break;
920 default:
921 goto bad;
922 }
923 break;
924 case 0x20: /* SIMPLE queue */
af12ac98 925 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
aa2b1e89 926 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
a917d384
PB		 927 break;
928 case 0x21: /* HEAD of queue */
929 BADF("HEAD queue not implemented\n");
af12ac98 930 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384
PB		 931 break;
932 case 0x22: /* ORDERED queue */
933 BADF("ORDERED queue not implemented\n");
af12ac98 934 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
a917d384 935 break;
508240c0
BK		 936 case 0x0d:
937 /* The ABORT TAG message clears the current I/O process only. */
938 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
5c6c0e51 939 if (current_req) {
94d3f98a 940 scsi_req_cancel(current_req->req);
5c6c0e51 941 }
508240c0
BK		 942 lsi_disconnect(s);
943 break;
944 case 0x06:
945 case 0x0e:
946 case 0x0c:
947 /* The ABORT message clears all I/O processes for the selecting
948 initiator on the specified logical unit of the target. */
949 if (msg == 0x06) {
950 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
951 }
952 /* The CLEAR QUEUE message clears all I/O processes for all
953 initiators on the specified logical unit of the target. */
954 if (msg == 0x0e) {
955 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
956 }
957 /* The BUS DEVICE RESET message clears all I/O processes for all
958 initiators on all logical units of the target. */
959 if (msg == 0x0c) {
960 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
961 }
962
963 /* clear the current I/O process */
5c6c0e51 964 if (s->current) {
94d3f98a 965 scsi_req_cancel(s->current->req);
5c6c0e51 966 }
508240c0
BK		 967
968 /* As the current implemented devices scsi_disk and scsi_generic
969 only support one LUN, we don't need to keep track of LUNs.
970 Clearing I/O processes for other initiators could be possible
971 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
972 device, but this is currently not implemented (and seems not
973 to be really necessary). So let's simply clear all queued
974 commands for the current device: */
508240c0 975 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
a6c6f44a 976 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
94d3f98a 977 scsi_req_cancel(p->req);
508240c0
BK		 978 }
979 }
980
981 lsi_disconnect(s);
982 break;
a917d384
PB		 983 default:
984 if ((msg & 0x80) == 0) {
985 goto bad;
986 }
987 s->current_lun = msg & 7;
988 DPRINTF("Select LUN %d\n", s->current_lun);
989 lsi_set_phase(s, PHASE_CMD);
990 break;
991 }
7d8406be 992 }
a917d384
PB		 993 return;
994bad:
995 BADF("Unimplemented message 0x%02x\n", msg);
996 lsi_set_phase(s, PHASE_MI);
997 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
998 s->msg_action = 0;
7d8406be
PB		 999}
1000
1001/* Sign extend a 24-bit value. */
1002static inline int32_t sxt24(int32_t n)
1003{
1004 return (n << 8) >> 8;
1005}
1006
e20a8dff 1007#define LSI_BUF_SIZE 4096
7d8406be
PB		 1008static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1009{
725eec70 1010 PCIDevice *d = PCI_DEVICE(s);
7d8406be 1011 int n;
e20a8dff 1012 uint8_t buf[LSI_BUF_SIZE];
7d8406be
PB		 1013
1014 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1015 while (count) {
e20a8dff 1016 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
725eec70
AF		 1017 pci_dma_read(d, src, buf, n);
1018 pci_dma_write(d, dest, buf, n);
7d8406be
PB		 1019 src += n;
1020 dest += n;
1021 count -= n;
1022 }
1023}
1024
a917d384
PB		 1025static void lsi_wait_reselect(LSIState *s)
1026{
042ec49d
GH		 1027 lsi_request *p;
1028
a917d384 1029 DPRINTF("Wait Reselect\n");
042ec49d
GH		 1030
1031 QTAILQ_FOREACH(p, &s->queue, next) {
1032 if (p->pending) {
aa4d32c4 1033 lsi_reselect(s, p);
a917d384
PB		 1034 break;
1035 }
1036 }
b96a0da0 1037 if (s->current == NULL) {
a917d384
PB		 1038 s->waiting = 1;
1039 }
1040}
1041
7d8406be
PB		 1042static void lsi_execute_script(LSIState *s)
1043{
725eec70 1044 PCIDevice *pci_dev = PCI_DEVICE(s);
7d8406be 1045 uint32_t insn;
b25cf589 1046 uint32_t addr, addr_high;
7d8406be 1047 int opcode;
ee4d919f 1048 int insn_processed = 0;
7d8406be
PB		 1049
1050 s->istat1 |= LSI_ISTAT1_SRUN;
1051again:
ee4d919f 1052 insn_processed++;
7d8406be 1053 insn = read_dword(s, s->dsp);
02b373ad
AZ		 1054 if (!insn) {
1055 /* If we receive an empty opcode increment the DSP by 4 bytes
1056 instead of 8 and execute the next opcode at that location */
1057 s->dsp += 4;
1058 goto again;
1059 }
7d8406be 1060 addr = read_dword(s, s->dsp + 4);
b25cf589 1061 addr_high = 0;
7d8406be
PB		 1062 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1063 s->dsps = addr;
1064 s->dcmd = insn >> 24;
1065 s->dsp += 8;
1066 switch (insn >> 30) {
1067 case 0: /* Block move. */
1068 if (s->sist1 & LSI_SIST1_STO) {
1069 DPRINTF("Delayed select timeout\n");
1070 lsi_stop_script(s);
1071 break;
1072 }
1073 s->dbc = insn & 0xffffff;
1074 s->rbc = s->dbc;
dd8edf01
AL		 1075 /* ??? Set ESA. */
1076 s->ia = s->dsp - 8;
7d8406be
PB		 1077 if (insn & (1 << 29)) {
1078 /* Indirect addressing. */
1079 addr = read_dword(s, addr);
1080 } else if (insn & (1 << 28)) {
1081 uint32_t buf[2];
1082 int32_t offset;
1083 /* Table indirect addressing. */
dd8edf01
AL		 1084
1085 /* 32-bit Table indirect */
7d8406be 1086 offset = sxt24(addr);
725eec70 1087 pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
b25cf589
AL		 1088 /* byte count is stored in bits 0:23 only */
1089 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
7faa239c 1090 s->rbc = s->dbc;
7d8406be 1091 addr = cpu_to_le32(buf[1]);
b25cf589
AL		 1092
1093 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1094 * table, bits [31:24] */
1095 if (lsi_dma_40bit(s))
1096 addr_high = cpu_to_le32(buf[0]) >> 24;
dd8edf01
AL		 1097 else if (lsi_dma_ti64bit(s)) {
1098 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1099 switch (selector) {
1100 case 0 ... 0x0f:
1101 /* offset index into scratch registers since
1102 * TI64 mode can use registers C to R */
1103 addr_high = s->scratch[2 + selector];
1104 break;
1105 case 0x10:
1106 addr_high = s->mmrs;
1107 break;
1108 case 0x11:
1109 addr_high = s->mmws;
1110 break;
1111 case 0x12:
1112 addr_high = s->sfs;
1113 break;
1114 case 0x13:
1115 addr_high = s->drs;
1116 break;
1117 case 0x14:
1118 addr_high = s->sbms;
1119 break;
1120 case 0x15:
1121 addr_high = s->dbms;
1122 break;
1123 default:
1124 BADF("Illegal selector specified (0x%x > 0x15)"
1125 " for 64-bit DMA block move", selector);
1126 break;
1127 }
1128 }
1129 } else if (lsi_dma_64bit(s)) {
1130 /* fetch a 3rd dword if 64-bit direct move is enabled and
1131 only if we're not doing table indirect or indirect addressing */
1132 s->dbms = read_dword(s, s->dsp);
1133 s->dsp += 4;
1134 s->ia = s->dsp - 12;
7d8406be
PB		 1135 }
1136 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1137 DPRINTF("Wrong phase got %d expected %d\n",
1138 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1139 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1140 break;
1141 }
1142 s->dnad = addr;
b25cf589 1143 s->dnad64 = addr_high;
7d8406be
PB		 1144 switch (s->sstat1 & 0x7) {
1145 case PHASE_DO:
a917d384 1146 s->waiting = 2;
7d8406be 1147 lsi_do_dma(s, 1);
a917d384
PB		 1148 if (s->waiting)
1149 s->waiting = 3;
7d8406be
PB		 1150 break;
1151 case PHASE_DI:
a917d384 1152 s->waiting = 2;
7d8406be 1153 lsi_do_dma(s, 0);
a917d384
PB		 1154 if (s->waiting)
1155 s->waiting = 3;
7d8406be
PB		 1156 break;
1157 case PHASE_CMD:
1158 lsi_do_command(s);
1159 break;
1160 case PHASE_ST:
1161 lsi_do_status(s);
1162 break;
1163 case PHASE_MO:
1164 lsi_do_msgout(s);
1165 break;
1166 case PHASE_MI:
1167 lsi_do_msgin(s);
1168 break;
1169 default:
1170 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1171 exit(1);
1172 }
1173 s->dfifo = s->dbc & 0xff;
1174 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1175 s->sbc = s->dbc;
1176 s->rbc -= s->dbc;
1177 s->ua = addr + s->dbc;
7d8406be
PB		 1178 break;
1179
1180 case 1: /* IO or Read/Write instruction. */
1181 opcode = (insn >> 27) & 7;
1182 if (opcode < 5) {
1183 uint32_t id;
1184
1185 if (insn & (1 << 25)) {
1186 id = read_dword(s, s->dsa + sxt24(insn));
1187 } else {
07a1bea8 1188 id = insn;
7d8406be
PB		 1189 }
1190 id = (id >> 16) & 0xf;
1191 if (insn & (1 << 26)) {
1192 addr = s->dsp + sxt24(addr);
1193 }
1194 s->dnad = addr;
1195 switch (opcode) {
1196 case 0: /* Select */
a917d384 1197 s->sdid = id;
38f5b2b8
LA		 1198 if (s->scntl1 & LSI_SCNTL1_CON) {
1199 DPRINTF("Already reselected, jumping to alternative address\n");
1200 s->dsp = s->dnad;
a917d384
PB		 1201 break;
1202 }
7d8406be
PB		 1203 s->sstat0 |= LSI_SSTAT0_WOA;
1204 s->scntl1 &= ~LSI_SCNTL1_IARB;
0d3545e7 1205 if (!scsi_device_find(&s->bus, 0, id, 0)) {
64d56409 1206 lsi_bad_selection(s, id);
7d8406be
PB		 1207 break;
1208 }
1209 DPRINTF("Selected target %d%s\n",
1210 id, insn & (1 << 3) ? " ATN" : "");
1211 /* ??? Linux drivers compain when this is set. Maybe
1212 it only applies in low-level mode (unimplemented).
1213 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
af12ac98 1214 s->select_tag = id << 8;
7d8406be
PB		 1215 s->scntl1 |= LSI_SCNTL1_CON;
1216 if (insn & (1 << 3)) {
1217 s->socl |= LSI_SOCL_ATN;
1218 }
1219 lsi_set_phase(s, PHASE_MO);
1220 break;
1221 case 1: /* Disconnect */
a15fdf86 1222 DPRINTF("Wait Disconnect\n");
7d8406be
PB		 1223 s->scntl1 &= ~LSI_SCNTL1_CON;
1224 break;
1225 case 2: /* Wait Reselect */
e560125e
LA		 1226 if (!lsi_irq_on_rsl(s)) {
1227 lsi_wait_reselect(s);
1228 }
7d8406be
PB		 1229 break;
1230 case 3: /* Set */
1231 DPRINTF("Set%s%s%s%s\n",
1232 insn & (1 << 3) ? " ATN" : "",
1233 insn & (1 << 6) ? " ACK" : "",
1234 insn & (1 << 9) ? " TM" : "",
1235 insn & (1 << 10) ? " CC" : "");
1236 if (insn & (1 << 3)) {
1237 s->socl |= LSI_SOCL_ATN;
1238 lsi_set_phase(s, PHASE_MO);
1239 }
1240 if (insn & (1 << 9)) {
1241 BADF("Target mode not implemented\n");
1242 exit(1);
1243 }
1244 if (insn & (1 << 10))
1245 s->carry = 1;
1246 break;
1247 case 4: /* Clear */
1248 DPRINTF("Clear%s%s%s%s\n",
1249 insn & (1 << 3) ? " ATN" : "",
1250 insn & (1 << 6) ? " ACK" : "",
1251 insn & (1 << 9) ? " TM" : "",
1252 insn & (1 << 10) ? " CC" : "");
1253 if (insn & (1 << 3)) {
1254 s->socl &= ~LSI_SOCL_ATN;
1255 }
1256 if (insn & (1 << 10))
1257 s->carry = 0;
1258 break;
1259 }
1260 } else {
1261 uint8_t op0;
1262 uint8_t op1;
1263 uint8_t data8;
1264 int reg;
1265 int operator;
1266#ifdef DEBUG_LSI
1267 static const char *opcode_names[3] =
1268 {"Write", "Read", "Read-Modify-Write"};
1269 static const char *operator_names[8] =
1270 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1271#endif
1272
1273 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1274 data8 = (insn >> 8) & 0xff;
1275 opcode = (insn >> 27) & 7;
1276 operator = (insn >> 24) & 7;
a917d384 1277 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
7d8406be 1278 opcode_names[opcode - 5], reg,
a917d384 1279 operator_names[operator], data8, s->sfbr,
7d8406be
PB		 1280 (insn & (1 << 23)) ? " SFBR" : "");
1281 op0 = op1 = 0;
1282 switch (opcode) {
1283 case 5: /* From SFBR */
1284 op0 = s->sfbr;
1285 op1 = data8;
1286 break;
1287 case 6: /* To SFBR */
1288 if (operator)
1289 op0 = lsi_reg_readb(s, reg);
1290 op1 = data8;
1291 break;
1292 case 7: /* Read-modify-write */
1293 if (operator)
1294 op0 = lsi_reg_readb(s, reg);
1295 if (insn & (1 << 23)) {
1296 op1 = s->sfbr;
1297 } else {
1298 op1 = data8;
1299 }
1300 break;
1301 }
1302
1303 switch (operator) {
1304 case 0: /* move */
1305 op0 = op1;
1306 break;
1307 case 1: /* Shift left */
1308 op1 = op0 >> 7;
1309 op0 = (op0 << 1) | s->carry;
1310 s->carry = op1;
1311 break;
1312 case 2: /* OR */
1313 op0 |= op1;
1314 break;
1315 case 3: /* XOR */
dcfb9014 1316 op0 ^= op1;
7d8406be
PB		 1317 break;
1318 case 4: /* AND */
1319 op0 &= op1;
1320 break;
1321 case 5: /* SHR */
1322 op1 = op0 & 1;
1323 op0 = (op0 >> 1) | (s->carry << 7);
687fa640 1324 s->carry = op1;
7d8406be
PB		 1325 break;
1326 case 6: /* ADD */
1327 op0 += op1;
1328 s->carry = op0 < op1;
1329 break;
1330 case 7: /* ADC */
1331 op0 += op1 + s->carry;
1332 if (s->carry)
1333 s->carry = op0 <= op1;
1334 else
1335 s->carry = op0 < op1;
1336 break;
1337 }
1338
1339 switch (opcode) {
1340 case 5: /* From SFBR */
1341 case 7: /* Read-modify-write */
1342 lsi_reg_writeb(s, reg, op0);
1343 break;
1344 case 6: /* To SFBR */
1345 s->sfbr = op0;
1346 break;
1347 }
1348 }
1349 break;
1350
1351 case 2: /* Transfer Control. */
1352 {
1353 int cond;
1354 int jmp;
1355
1356 if ((insn & 0x002e0000) == 0) {
1357 DPRINTF("NOP\n");
1358 break;
1359 }
1360 if (s->sist1 & LSI_SIST1_STO) {
1361 DPRINTF("Delayed select timeout\n");
1362 lsi_stop_script(s);
1363 break;
1364 }
1365 cond = jmp = (insn & (1 << 19)) != 0;
1366 if (cond == jmp && (insn & (1 << 21))) {
1367 DPRINTF("Compare carry %d\n", s->carry == jmp);
1368 cond = s->carry != 0;
1369 }
1370 if (cond == jmp && (insn & (1 << 17))) {
1371 DPRINTF("Compare phase %d %c= %d\n",
1372 (s->sstat1 & PHASE_MASK),
1373 jmp ? '=' : '!',
1374 ((insn >> 24) & 7));
1375 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1376 }
1377 if (cond == jmp && (insn & (1 << 18))) {
1378 uint8_t mask;
1379
1380 mask = (~insn >> 8) & 0xff;
1381 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1382 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1383 cond = (s->sfbr & mask) == (insn & mask);
1384 }
1385 if (cond == jmp) {
1386 if (insn & (1 << 23)) {
1387 /* Relative address. */
1388 addr = s->dsp + sxt24(addr);
1389 }
1390 switch ((insn >> 27) & 7) {
1391 case 0: /* Jump */
1392 DPRINTF("Jump to 0x%08x\n", addr);
1393 s->dsp = addr;
1394 break;
1395 case 1: /* Call */
1396 DPRINTF("Call 0x%08x\n", addr);
1397 s->temp = s->dsp;
1398 s->dsp = addr;
1399 break;
1400 case 2: /* Return */
1401 DPRINTF("Return to 0x%08x\n", s->temp);
1402 s->dsp = s->temp;
1403 break;
1404 case 3: /* Interrupt */
1405 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1406 if ((insn & (1 << 20)) != 0) {
1407 s->istat0 |= LSI_ISTAT0_INTF;
1408 lsi_update_irq(s);
1409 } else {
1410 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1411 }
1412 break;
1413 default:
1414 DPRINTF("Illegal transfer control\n");
1415 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1416 break;
1417 }
1418 } else {
1419 DPRINTF("Control condition failed\n");
1420 }
1421 }
1422 break;
1423
1424 case 3:
1425 if ((insn & (1 << 29)) == 0) {
1426 /* Memory move. */
1427 uint32_t dest;
1428 /* ??? The docs imply the destination address is loaded into
1429 the TEMP register. However the Linux drivers rely on
1430 the value being presrved. */
1431 dest = read_dword(s, s->dsp);
1432 s->dsp += 4;
1433 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1434 } else {
1435 uint8_t data[7];
1436 int reg;
1437 int n;
1438 int i;
1439
1440 if (insn & (1 << 28)) {
1441 addr = s->dsa + sxt24(addr);
1442 }
1443 n = (insn & 7);
1444 reg = (insn >> 16) & 0xff;
1445 if (insn & (1 << 24)) {
725eec70 1446 pci_dma_read(pci_dev, addr, data, n);
a917d384
PB		 1447 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1448 addr, *(int *)data);
7d8406be
PB		 1449 for (i = 0; i < n; i++) {
1450 lsi_reg_writeb(s, reg + i, data[i]);
1451 }
1452 } else {
1453 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1454 for (i = 0; i < n; i++) {
1455 data[i] = lsi_reg_readb(s, reg + i);
1456 }
725eec70 1457 pci_dma_write(pci_dev, addr, data, n);
7d8406be
PB		 1458 }
1459 }
1460 }
ee4d919f 1461 if (insn_processed > 10000 && !s->waiting) {
64c68080
PB		 1462 /* Some windows drivers make the device spin waiting for a memory
1463 location to change. If we have been executed a lot of code then
1464 assume this is the case and force an unexpected device disconnect.
1465 This is apparently sufficient to beat the drivers into submission.
1466 */
ee4d919f
AL		 1467 if (!(s->sien0 & LSI_SIST0_UDC))
1468 fprintf(stderr, "inf. loop with UDC masked\n");
1469 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1470 lsi_disconnect(s);
1471 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
7d8406be
PB		 1472 if (s->dcntl & LSI_DCNTL_SSM) {
1473 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1474 } else {
1475 goto again;
1476 }
1477 }
1478 DPRINTF("SCRIPTS execution stopped\n");
1479}
1480
1481static uint8_t lsi_reg_readb(LSIState *s, int offset)
1482{
1483 uint8_t tmp;
75f76531
AJ		 1484#define CASE_GET_REG24(name, addr) \
1485 case addr: return s->name & 0xff; \
1486 case addr + 1: return (s->name >> 8) & 0xff; \
1487 case addr + 2: return (s->name >> 16) & 0xff;
1488
7d8406be
PB		 1489#define CASE_GET_REG32(name, addr) \
1490 case addr: return s->name & 0xff; \
1491 case addr + 1: return (s->name >> 8) & 0xff; \
1492 case addr + 2: return (s->name >> 16) & 0xff; \
1493 case addr + 3: return (s->name >> 24) & 0xff;
1494
1495#ifdef DEBUG_LSI_REG
1496 DPRINTF("Read reg %x\n", offset);
1497#endif
1498 switch (offset) {
1499 case 0x00: /* SCNTL0 */
1500 return s->scntl0;
1501 case 0x01: /* SCNTL1 */
1502 return s->scntl1;
1503 case 0x02: /* SCNTL2 */
1504 return s->scntl2;
1505 case 0x03: /* SCNTL3 */
1506 return s->scntl3;
1507 case 0x04: /* SCID */
1508 return s->scid;
1509 case 0x05: /* SXFER */
1510 return s->sxfer;
1511 case 0x06: /* SDID */
1512 return s->sdid;
1513 case 0x07: /* GPREG0 */
1514 return 0x7f;
985a03b0
TS		 1515 case 0x08: /* Revision ID */
1516 return 0x00;
a917d384
PB		 1517 case 0xa: /* SSID */
1518 return s->ssid;
7d8406be
PB		 1519 case 0xb: /* SBCL */
1520 /* ??? This is not correct. However it's (hopefully) only
1521 used for diagnostics, so should be ok. */
1522 return 0;
1523 case 0xc: /* DSTAT */
1524 tmp = s->dstat | 0x80;
1525 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1526 s->dstat = 0;
1527 lsi_update_irq(s);
1528 return tmp;
1529 case 0x0d: /* SSTAT0 */
1530 return s->sstat0;
1531 case 0x0e: /* SSTAT1 */
1532 return s->sstat1;
1533 case 0x0f: /* SSTAT2 */
1534 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1535 CASE_GET_REG32(dsa, 0x10)
1536 case 0x14: /* ISTAT0 */
1537 return s->istat0;
ecabe8cc
AL		 1538 case 0x15: /* ISTAT1 */
1539 return s->istat1;
7d8406be
PB		 1540 case 0x16: /* MBOX0 */
1541 return s->mbox0;
1542 case 0x17: /* MBOX1 */
1543 return s->mbox1;
1544 case 0x18: /* CTEST0 */
1545 return 0xff;
1546 case 0x19: /* CTEST1 */
1547 return 0;
1548 case 0x1a: /* CTEST2 */
9167a69a 1549 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
7d8406be
PB		 1550 if (s->istat0 & LSI_ISTAT0_SIGP) {
1551 s->istat0 &= ~LSI_ISTAT0_SIGP;
1552 tmp |= LSI_CTEST2_SIGP;
1553 }
1554 return tmp;
1555 case 0x1b: /* CTEST3 */
1556 return s->ctest3;
1557 CASE_GET_REG32(temp, 0x1c)
1558 case 0x20: /* DFIFO */
1559 return 0;
1560 case 0x21: /* CTEST4 */
1561 return s->ctest4;
1562 case 0x22: /* CTEST5 */
1563 return s->ctest5;
985a03b0
TS		 1564 case 0x23: /* CTEST6 */
1565 return 0;
75f76531 1566 CASE_GET_REG24(dbc, 0x24)
7d8406be
PB		 1567 case 0x27: /* DCMD */
1568 return s->dcmd;
4b9a2d6d 1569 CASE_GET_REG32(dnad, 0x28)
7d8406be
PB		 1570 CASE_GET_REG32(dsp, 0x2c)
1571 CASE_GET_REG32(dsps, 0x30)
1572 CASE_GET_REG32(scratch[0], 0x34)
1573 case 0x38: /* DMODE */
1574 return s->dmode;
1575 case 0x39: /* DIEN */
1576 return s->dien;
bd8ee11a
SH		 1577 case 0x3a: /* SBR */
1578 return s->sbr;
7d8406be
PB		 1579 case 0x3b: /* DCNTL */
1580 return s->dcntl;
1581 case 0x40: /* SIEN0 */
1582 return s->sien0;
1583 case 0x41: /* SIEN1 */
1584 return s->sien1;
1585 case 0x42: /* SIST0 */
1586 tmp = s->sist0;
1587 s->sist0 = 0;
1588 lsi_update_irq(s);
1589 return tmp;
1590 case 0x43: /* SIST1 */
1591 tmp = s->sist1;
1592 s->sist1 = 0;
1593 lsi_update_irq(s);
1594 return tmp;
9167a69a
AZ		 1595 case 0x46: /* MACNTL */
1596 return 0x0f;
7d8406be
PB		 1597 case 0x47: /* GPCNTL0 */
1598 return 0x0f;
1599 case 0x48: /* STIME0 */
1600 return s->stime0;
1601 case 0x4a: /* RESPID0 */
1602 return s->respid0;
1603 case 0x4b: /* RESPID1 */
1604 return s->respid1;
1605 case 0x4d: /* STEST1 */
1606 return s->stest1;
1607 case 0x4e: /* STEST2 */
1608 return s->stest2;
1609 case 0x4f: /* STEST3 */
1610 return s->stest3;
a917d384
PB		 1611 case 0x50: /* SIDL */
1612 /* This is needed by the linux drivers. We currently only update it
1613 during the MSG IN phase. */
1614 return s->sidl;
7d8406be
PB		 1615 case 0x52: /* STEST4 */
1616 return 0xe0;
1617 case 0x56: /* CCNTL0 */
1618 return s->ccntl0;
1619 case 0x57: /* CCNTL1 */
1620 return s->ccntl1;
a917d384
PB		 1621 case 0x58: /* SBDL */
1622 /* Some drivers peek at the data bus during the MSG IN phase. */
1623 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1624 return s->msg[0];
1625 return 0;
1626 case 0x59: /* SBDL high */
7d8406be
PB		 1627 return 0;
1628 CASE_GET_REG32(mmrs, 0xa0)
1629 CASE_GET_REG32(mmws, 0xa4)
1630 CASE_GET_REG32(sfs, 0xa8)
1631 CASE_GET_REG32(drs, 0xac)
1632 CASE_GET_REG32(sbms, 0xb0)
ab57d967 1633 CASE_GET_REG32(dbms, 0xb4)
7d8406be
PB		 1634 CASE_GET_REG32(dnad64, 0xb8)
1635 CASE_GET_REG32(pmjad1, 0xc0)
1636 CASE_GET_REG32(pmjad2, 0xc4)
1637 CASE_GET_REG32(rbc, 0xc8)
1638 CASE_GET_REG32(ua, 0xcc)
1639 CASE_GET_REG32(ia, 0xd4)
1640 CASE_GET_REG32(sbc, 0xd8)
1641 CASE_GET_REG32(csbc, 0xdc)
1642 }
1643 if (offset >= 0x5c && offset < 0xa0) {
1644 int n;
1645 int shift;
1646 n = (offset - 0x58) >> 2;
1647 shift = (offset & 3) * 8;
1648 return (s->scratch[n] >> shift) & 0xff;
1649 }
1650 BADF("readb 0x%x\n", offset);
1651 exit(1);
75f76531 1652#undef CASE_GET_REG24
7d8406be
PB		 1653#undef CASE_GET_REG32
1654}
1655
1656static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1657{
49c47daa
SH		 1658#define CASE_SET_REG24(name, addr) \
1659 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1660 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1661 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1662
7d8406be
PB		 1663#define CASE_SET_REG32(name, addr) \
1664 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1665 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1666 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1667 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1668
1669#ifdef DEBUG_LSI_REG
1670 DPRINTF("Write reg %x = %02x\n", offset, val);
1671#endif
1672 switch (offset) {
1673 case 0x00: /* SCNTL0 */
1674 s->scntl0 = val;
1675 if (val & LSI_SCNTL0_START) {
1676 BADF("Start sequence not implemented\n");
1677 }
1678 break;
1679 case 0x01: /* SCNTL1 */
1680 s->scntl1 = val & ~LSI_SCNTL1_SST;
1681 if (val & LSI_SCNTL1_IARB) {
1682 BADF("Immediate Arbritration not implemented\n");
1683 }
1684 if (val & LSI_SCNTL1_RST) {
680a34ee 1685 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
032f0101 1686 qbus_reset_all(&s->bus.qbus);
680a34ee
JK		 1687 s->sstat0 |= LSI_SSTAT0_RST;
1688 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1689 }
7d8406be
PB		 1690 } else {
1691 s->sstat0 &= ~LSI_SSTAT0_RST;
1692 }
1693 break;
1694 case 0x02: /* SCNTL2 */
1695 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
3d834c78 1696 s->scntl2 = val;
7d8406be
PB		 1697 break;
1698 case 0x03: /* SCNTL3 */
1699 s->scntl3 = val;
1700 break;
1701 case 0x04: /* SCID */
1702 s->scid = val;
1703 break;
1704 case 0x05: /* SXFER */
1705 s->sxfer = val;
1706 break;
a917d384
PB		 1707 case 0x06: /* SDID */
1708 if ((val & 0xf) != (s->ssid & 0xf))
1709 BADF("Destination ID does not match SSID\n");
1710 s->sdid = val & 0xf;
1711 break;
7d8406be
PB		 1712 case 0x07: /* GPREG0 */
1713 break;
a917d384
PB		 1714 case 0x08: /* SFBR */
1715 /* The CPU is not allowed to write to this register. However the
1716 SCRIPTS register move instructions are. */
1717 s->sfbr = val;
1718 break;
a15fdf86 1719 case 0x0a: case 0x0b:
9167a69a 1720 /* Openserver writes to these readonly registers on startup */
a15fdf86 1721 return;
7d8406be
PB		 1722 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1723 /* Linux writes to these readonly registers on startup. */
1724 return;
1725 CASE_SET_REG32(dsa, 0x10)
1726 case 0x14: /* ISTAT0 */
1727 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1728 if (val & LSI_ISTAT0_ABRT) {
1729 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1730 }
1731 if (val & LSI_ISTAT0_INTF) {
1732 s->istat0 &= ~LSI_ISTAT0_INTF;
1733 lsi_update_irq(s);
1734 }
4d611c9a 1735 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
7d8406be
PB		 1736 DPRINTF("Woken by SIGP\n");
1737 s->waiting = 0;
1738 s->dsp = s->dnad;
1739 lsi_execute_script(s);
1740 }
1741 if (val & LSI_ISTAT0_SRST) {
71186c86 1742 qdev_reset_all(DEVICE(s));
7d8406be 1743 }
92d88ecb 1744 break;
7d8406be
PB		 1745 case 0x16: /* MBOX0 */
1746 s->mbox0 = val;
92d88ecb 1747 break;
7d8406be
PB		 1748 case 0x17: /* MBOX1 */
1749 s->mbox1 = val;
92d88ecb 1750 break;
9167a69a
AZ		 1751 case 0x1a: /* CTEST2 */
1752 s->ctest2 = val & LSI_CTEST2_PCICIE;
1753 break;
7d8406be
PB		 1754 case 0x1b: /* CTEST3 */
1755 s->ctest3 = val & 0x0f;
1756 break;
1757 CASE_SET_REG32(temp, 0x1c)
1758 case 0x21: /* CTEST4 */
1759 if (val & 7) {
1760 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1761 }
1762 s->ctest4 = val;
1763 break;
1764 case 0x22: /* CTEST5 */
1765 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1766 BADF("CTEST5 DMA increment not implemented\n");
1767 }
1768 s->ctest5 = val;
1769 break;
49c47daa 1770 CASE_SET_REG24(dbc, 0x24)
4b9a2d6d 1771 CASE_SET_REG32(dnad, 0x28)
3d834c78 1772 case 0x2c: /* DSP[0:7] */
7d8406be
PB		 1773 s->dsp &= 0xffffff00;
1774 s->dsp |= val;
1775 break;
3d834c78 1776 case 0x2d: /* DSP[8:15] */
7d8406be
PB		 1777 s->dsp &= 0xffff00ff;
1778 s->dsp |= val << 8;
1779 break;
3d834c78 1780 case 0x2e: /* DSP[16:23] */
7d8406be
PB		 1781 s->dsp &= 0xff00ffff;
1782 s->dsp |= val << 16;
1783 break;
3d834c78 1784 case 0x2f: /* DSP[24:31] */
7d8406be
PB		 1785 s->dsp &= 0x00ffffff;
1786 s->dsp |= val << 24;
1787 if ((s->dmode & LSI_DMODE_MAN) == 0
1788 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1789 lsi_execute_script(s);
1790 break;
1791 CASE_SET_REG32(dsps, 0x30)
1792 CASE_SET_REG32(scratch[0], 0x34)
1793 case 0x38: /* DMODE */
1794 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1795 BADF("IO mappings not implemented\n");
1796 }
1797 s->dmode = val;
1798 break;
1799 case 0x39: /* DIEN */
1800 s->dien = val;
1801 lsi_update_irq(s);
1802 break;
bd8ee11a
SH		 1803 case 0x3a: /* SBR */
1804 s->sbr = val;
1805 break;
7d8406be
PB		 1806 case 0x3b: /* DCNTL */
1807 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1808 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1809 lsi_execute_script(s);
1810 break;
1811 case 0x40: /* SIEN0 */
1812 s->sien0 = val;
1813 lsi_update_irq(s);
1814 break;
1815 case 0x41: /* SIEN1 */
1816 s->sien1 = val;
1817 lsi_update_irq(s);
1818 break;
1819 case 0x47: /* GPCNTL0 */
1820 break;
1821 case 0x48: /* STIME0 */
1822 s->stime0 = val;
1823 break;
1824 case 0x49: /* STIME1 */
1825 if (val & 0xf) {
1826 DPRINTF("General purpose timer not implemented\n");
1827 /* ??? Raising the interrupt immediately seems to be sufficient
1828 to keep the FreeBSD driver happy. */
1829 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1830 }
1831 break;
1832 case 0x4a: /* RESPID0 */
1833 s->respid0 = val;
1834 break;
1835 case 0x4b: /* RESPID1 */
1836 s->respid1 = val;
1837 break;
1838 case 0x4d: /* STEST1 */
1839 s->stest1 = val;
1840 break;
1841 case 0x4e: /* STEST2 */
1842 if (val & 1) {
1843 BADF("Low level mode not implemented\n");
1844 }
1845 s->stest2 = val;
1846 break;
1847 case 0x4f: /* STEST3 */
1848 if (val & 0x41) {
1849 BADF("SCSI FIFO test mode not implemented\n");
1850 }
1851 s->stest3 = val;
1852 break;
1853 case 0x56: /* CCNTL0 */
1854 s->ccntl0 = val;
1855 break;
1856 case 0x57: /* CCNTL1 */
1857 s->ccntl1 = val;
1858 break;
1859 CASE_SET_REG32(mmrs, 0xa0)
1860 CASE_SET_REG32(mmws, 0xa4)
1861 CASE_SET_REG32(sfs, 0xa8)
1862 CASE_SET_REG32(drs, 0xac)
1863 CASE_SET_REG32(sbms, 0xb0)
ab57d967 1864 CASE_SET_REG32(dbms, 0xb4)
7d8406be
PB		 1865 CASE_SET_REG32(dnad64, 0xb8)
1866 CASE_SET_REG32(pmjad1, 0xc0)
1867 CASE_SET_REG32(pmjad2, 0xc4)
1868 CASE_SET_REG32(rbc, 0xc8)
1869 CASE_SET_REG32(ua, 0xcc)
1870 CASE_SET_REG32(ia, 0xd4)
1871 CASE_SET_REG32(sbc, 0xd8)
1872 CASE_SET_REG32(csbc, 0xdc)
1873 default:
1874 if (offset >= 0x5c && offset < 0xa0) {
1875 int n;
1876 int shift;
1877 n = (offset - 0x58) >> 2;
1878 shift = (offset & 3) * 8;
1879 s->scratch[n] &= ~(0xff << shift);
1880 s->scratch[n] |= (val & 0xff) << shift;
1881 } else {
1882 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1883 }
1884 }
49c47daa 1885#undef CASE_SET_REG24
7d8406be
PB		 1886#undef CASE_SET_REG32
1887}
1888
a8170e5e 1889static void lsi_mmio_write(void *opaque, hwaddr addr,
b0ce84e5 1890 uint64_t val, unsigned size)
7d8406be 1891{
eb40f984 1892 LSIState *s = opaque;
7d8406be
PB		 1893
1894 lsi_reg_writeb(s, addr & 0xff, val);
1895}
1896
a8170e5e 1897static uint64_t lsi_mmio_read(void *opaque, hwaddr addr,
b0ce84e5 1898 unsigned size)
7d8406be 1899{
eb40f984 1900 LSIState *s = opaque;
7d8406be
PB		 1901
1902 return lsi_reg_readb(s, addr & 0xff);
1903}
1904
b0ce84e5
AK		 1905static const MemoryRegionOps lsi_mmio_ops = {
1906 .read = lsi_mmio_read,
1907 .write = lsi_mmio_write,
1908 .endianness = DEVICE_NATIVE_ENDIAN,
1909 .impl = {
1910 .min_access_size = 1,
1911 .max_access_size = 1,
1912 },
7d8406be
PB		 1913};
1914
a8170e5e 1915static void lsi_ram_write(void *opaque, hwaddr addr,
b0ce84e5 1916 uint64_t val, unsigned size)
7d8406be 1917{
eb40f984 1918 LSIState *s = opaque;
7d8406be 1919 uint32_t newval;
b0ce84e5 1920 uint32_t mask;
7d8406be
PB		 1921 int shift;
1922
7d8406be
PB		 1923 newval = s->script_ram[addr >> 2];
1924 shift = (addr & 3) * 8;
b0ce84e5
AK		 1925 mask = ((uint64_t)1 << (size * 8)) - 1;
1926 newval &= ~(mask << shift);
7d8406be
PB		 1927 newval |= val << shift;
1928 s->script_ram[addr >> 2] = newval;
1929}
1930
a8170e5e 1931static uint64_t lsi_ram_read(void *opaque, hwaddr addr,
b0ce84e5 1932 unsigned size)
7d8406be 1933{
eb40f984 1934 LSIState *s = opaque;
7d8406be 1935 uint32_t val;
b0ce84e5 1936 uint32_t mask;
7d8406be 1937
7d8406be 1938 val = s->script_ram[addr >> 2];
b0ce84e5 1939 mask = ((uint64_t)1 << (size * 8)) - 1;
7d8406be 1940 val >>= (addr & 3) * 8;
b0ce84e5 1941 return val & mask;
7d8406be
PB		 1942}
1943
b0ce84e5
AK		 1944static const MemoryRegionOps lsi_ram_ops = {
1945 .read = lsi_ram_read,
1946 .write = lsi_ram_write,
1947 .endianness = DEVICE_NATIVE_ENDIAN,
7d8406be
PB		 1948};
1949
a8170e5e 1950static uint64_t lsi_io_read(void *opaque, hwaddr addr,
b0ce84e5 1951 unsigned size)
7d8406be 1952{
eb40f984 1953 LSIState *s = opaque;
7d8406be
PB		 1954 return lsi_reg_readb(s, addr & 0xff);
1955}
1956
a8170e5e 1957static void lsi_io_write(void *opaque, hwaddr addr,
b0ce84e5 1958 uint64_t val, unsigned size)
7d8406be 1959{
eb40f984 1960 LSIState *s = opaque;
7d8406be
PB		 1961 lsi_reg_writeb(s, addr & 0xff, val);
1962}
1963
b0ce84e5
AK		 1964static const MemoryRegionOps lsi_io_ops = {
1965 .read = lsi_io_read,
1966 .write = lsi_io_write,
1967 .endianness = DEVICE_NATIVE_ENDIAN,
1968 .impl = {
1969 .min_access_size = 1,
1970 .max_access_size = 1,
1971 },
1972};
7d8406be 1973
54eefd72
JK		 1974static void lsi_scsi_reset(DeviceState *dev)
1975{
71186c86 1976 LSIState *s = LSI53C895A(dev);
54eefd72
JK		 1977
1978 lsi_soft_reset(s);
1979}
1980
4a1b0f1c 1981static void lsi_pre_save(void *opaque)
777aec7a
N		 1982{
1983 LSIState *s = opaque;
1984
b96a0da0
GH		 1985 if (s->current) {
1986 assert(s->current->dma_buf == NULL);
1987 assert(s->current->dma_len == 0);
1988 }
042ec49d 1989 assert(QTAILQ_EMPTY(&s->queue));
777aec7a
N		 1990}
1991
4a1b0f1c
JQ		 1992static const VMStateDescription vmstate_lsi_scsi = {
1993 .name = "lsiscsi",
1994 .version_id = 0,
1995 .minimum_version_id = 0,
1996 .minimum_version_id_old = 0,
1997 .pre_save = lsi_pre_save,
1998 .fields = (VMStateField []) {
725eec70 1999 VMSTATE_PCI_DEVICE(parent_obj, LSIState),
4a1b0f1c
JQ		 2000
2001 VMSTATE_INT32(carry, LSIState),
2f172849 2002 VMSTATE_INT32(status, LSIState),
4a1b0f1c
JQ		 2003 VMSTATE_INT32(msg_action, LSIState),
2004 VMSTATE_INT32(msg_len, LSIState),
2005 VMSTATE_BUFFER(msg, LSIState),
2006 VMSTATE_INT32(waiting, LSIState),
2007
2008 VMSTATE_UINT32(dsa, LSIState),
2009 VMSTATE_UINT32(temp, LSIState),
2010 VMSTATE_UINT32(dnad, LSIState),
2011 VMSTATE_UINT32(dbc, LSIState),
2012 VMSTATE_UINT8(istat0, LSIState),
2013 VMSTATE_UINT8(istat1, LSIState),
2014 VMSTATE_UINT8(dcmd, LSIState),
2015 VMSTATE_UINT8(dstat, LSIState),
2016 VMSTATE_UINT8(dien, LSIState),
2017 VMSTATE_UINT8(sist0, LSIState),
2018 VMSTATE_UINT8(sist1, LSIState),
2019 VMSTATE_UINT8(sien0, LSIState),
2020 VMSTATE_UINT8(sien1, LSIState),
2021 VMSTATE_UINT8(mbox0, LSIState),
2022 VMSTATE_UINT8(mbox1, LSIState),
2023 VMSTATE_UINT8(dfifo, LSIState),
2024 VMSTATE_UINT8(ctest2, LSIState),
2025 VMSTATE_UINT8(ctest3, LSIState),
2026 VMSTATE_UINT8(ctest4, LSIState),
2027 VMSTATE_UINT8(ctest5, LSIState),
2028 VMSTATE_UINT8(ccntl0, LSIState),
2029 VMSTATE_UINT8(ccntl1, LSIState),
2030 VMSTATE_UINT32(dsp, LSIState),
2031 VMSTATE_UINT32(dsps, LSIState),
2032 VMSTATE_UINT8(dmode, LSIState),
2033 VMSTATE_UINT8(dcntl, LSIState),
2034 VMSTATE_UINT8(scntl0, LSIState),
2035 VMSTATE_UINT8(scntl1, LSIState),
2036 VMSTATE_UINT8(scntl2, LSIState),
2037 VMSTATE_UINT8(scntl3, LSIState),
2038 VMSTATE_UINT8(sstat0, LSIState),
2039 VMSTATE_UINT8(sstat1, LSIState),
2040 VMSTATE_UINT8(scid, LSIState),
2041 VMSTATE_UINT8(sxfer, LSIState),
2042 VMSTATE_UINT8(socl, LSIState),
2043 VMSTATE_UINT8(sdid, LSIState),
2044 VMSTATE_UINT8(ssid, LSIState),
2045 VMSTATE_UINT8(sfbr, LSIState),
2046 VMSTATE_UINT8(stest1, LSIState),
2047 VMSTATE_UINT8(stest2, LSIState),
2048 VMSTATE_UINT8(stest3, LSIState),
2049 VMSTATE_UINT8(sidl, LSIState),
2050 VMSTATE_UINT8(stime0, LSIState),
2051 VMSTATE_UINT8(respid0, LSIState),
2052 VMSTATE_UINT8(respid1, LSIState),
2053 VMSTATE_UINT32(mmrs, LSIState),
2054 VMSTATE_UINT32(mmws, LSIState),
2055 VMSTATE_UINT32(sfs, LSIState),
2056 VMSTATE_UINT32(drs, LSIState),
2057 VMSTATE_UINT32(sbms, LSIState),
2058 VMSTATE_UINT32(dbms, LSIState),
2059 VMSTATE_UINT32(dnad64, LSIState),
2060 VMSTATE_UINT32(pmjad1, LSIState),
2061 VMSTATE_UINT32(pmjad2, LSIState),
2062 VMSTATE_UINT32(rbc, LSIState),
2063 VMSTATE_UINT32(ua, LSIState),
2064 VMSTATE_UINT32(ia, LSIState),
2065 VMSTATE_UINT32(sbc, LSIState),
2066 VMSTATE_UINT32(csbc, LSIState),
2067 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2068 VMSTATE_UINT8(sbr, LSIState),
2069
2070 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2071 VMSTATE_END_OF_LIST()
777aec7a 2072 }
4a1b0f1c 2073};
777aec7a 2074
f90c2bcd 2075static void lsi_scsi_uninit(PCIDevice *d)
4b09be85 2076{
71186c86 2077 LSIState *s = LSI53C895A(d);
4b09be85 2078
b0ce84e5
AK		 2079 memory_region_destroy(&s->mmio_io);
2080 memory_region_destroy(&s->ram_io);
2081 memory_region_destroy(&s->io_io);
4b09be85
AL		 2082}
2083
afd4030c
PB		 2084static const struct SCSIBusInfo lsi_scsi_info = {
2085 .tcq = true,
7e0380b9
PB		 2086 .max_target = LSI_MAX_DEVS,
2087 .max_lun = 0, /* LUN support is buggy */
afd4030c 2088
c6df7102 2089 .transfer_data = lsi_transfer_data,
94d3f98a
PB		 2090 .complete = lsi_command_complete,
2091 .cancel = lsi_request_cancelled
cfdc1bb0
PB		 2092};
2093
81a322d4 2094static int lsi_scsi_init(PCIDevice *dev)
7d8406be 2095{
71186c86
PC		 2096 LSIState *s = LSI53C895A(dev);
2097 DeviceState *d = DEVICE(dev);
deb54399 2098 uint8_t *pci_conf;
caad4eb3 2099 Error *err = NULL;
7d8406be 2100
725eec70 2101 pci_conf = dev->config;
deb54399 2102
9167a69a 2103 /* PCI latency timer = 255 */
5845f0e5 2104 pci_conf[PCI_LATENCY_TIMER] = 0xff;
817e0b6f 2105 /* Interrupt pin A */
5845f0e5 2106 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
7d8406be 2107
29776739
PB		 2108 memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
2109 "lsi-mmio", 0x400);
2110 memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
2111 "lsi-ram", 0x2000);
2112 memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
2113 "lsi-io", 256);
b0ce84e5 2114
725eec70
AF		 2115 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2116 pci_register_bar(dev, 1, 0, &s->mmio_io);
2117 pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
042ec49d 2118 QTAILQ_INIT(&s->queue);
7d8406be 2119
71186c86
PC		 2120 scsi_bus_new(&s->bus, d, &lsi_scsi_info, NULL);
2121 if (!d->hotplugged) {
caad4eb3
AF		 2122 scsi_bus_legacy_handle_cmdline(&s->bus, &err);
2123 if (err != NULL) {
2124 error_free(err);
2125 return -1;
2126 }
5b684b5a 2127 }
81a322d4 2128 return 0;
7d8406be 2129}
9be5dafe 2130
40021f08
AL		 2131static void lsi_class_init(ObjectClass *klass, void *data)
2132{
39bffca2 2133 DeviceClass *dc = DEVICE_CLASS(klass);
40021f08
AL		 2134 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2135
2136 k->init = lsi_scsi_init;
2137 k->exit = lsi_scsi_uninit;
2138 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2139 k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2140 k->class_id = PCI_CLASS_STORAGE_SCSI;
2141 k->subsystem_id = 0x1000;
39bffca2
AL		 2142 dc->reset = lsi_scsi_reset;
2143 dc->vmsd = &vmstate_lsi_scsi;
40021f08
AL		 2144}
2145
8c43a6f0 2146static const TypeInfo lsi_info = {
71186c86 2147 .name = TYPE_LSI53C895A,
39bffca2
AL		 2148 .parent = TYPE_PCI_DEVICE,
2149 .instance_size = sizeof(LSIState),
2150 .class_init = lsi_class_init,
0aab0d3a
GH		 2151};
2152
83f7d43a 2153static void lsi53c895a_register_types(void)
9be5dafe 2154{
39bffca2 2155 type_register_static(&lsi_info);
9be5dafe
PB		 2156}
2157
83f7d43a 2158type_init(lsi53c895a_register_types)
Qemu copy for testing