?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ui: fix virtual timers
[qemu/ar7.git] / hw / scsi / lsi53c895a.c
blob996b40650d0c78cc67f2b0eed4a85b4b3c0a60f2
1 /*
2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
3 *
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the LGPL.
8 */
9
10 /* Note:
11 * LSI53C810 emulation is incorrect, in the sense that it supports
12 * features added in later evolutions. This should not be a problem,
13 * as well-behaved operating systems will not try to use them.
14 */
15
16 #include "qemu/osdep.h"
17
18 #include "hw/hw.h"
19 #include "hw/pci/pci.h"
20 #include "hw/scsi/scsi.h"
21 #include "sysemu/dma.h"
22 #include "qemu/log.h"
23
24 //#define DEBUG_LSI
25 //#define DEBUG_LSI_REG
26
27 #ifdef DEBUG_LSI
28 #define DPRINTF(fmt, ...) \
29 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
32 #else
33 #define DPRINTF(fmt, ...) do {} while(0)
34 #define BADF(fmt, ...) \
35 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
36 #endif
37
38 static const char *names[] = {
39 "SCNTL0", "SCNTL1", "SCNTL2", "SCNTL3", "SCID", "SXFER", "SDID", "GPREG",
40 "SFBR", "SOCL", "SSID", "SBCL", "DSTAT", "SSTAT0", "SSTAT1", "SSTAT2",
41 "DSA0", "DSA1", "DSA2", "DSA3", "ISTAT", "0x15", "0x16", "0x17",
42 "CTEST0", "CTEST1", "CTEST2", "CTEST3", "TEMP0", "TEMP1", "TEMP2", "TEMP3",
43 "DFIFO", "CTEST4", "CTEST5", "CTEST6", "DBC0", "DBC1", "DBC2", "DCMD",
44 "DNAD0", "DNAD1", "DNAD2", "DNAD3", "DSP0", "DSP1", "DSP2", "DSP3",
45 "DSPS0", "DSPS1", "DSPS2", "DSPS3", "SCRATCHA0", "SCRATCHA1", "SCRATCHA2", "SCRATCHA3",
46 "DMODE", "DIEN", "SBR", "DCNTL", "ADDER0", "ADDER1", "ADDER2", "ADDER3",
47 "SIEN0", "SIEN1", "SIST0", "SIST1", "SLPAR", "0x45", "MACNTL", "GPCNTL",
48 "STIME0", "STIME1", "RESPID", "0x4b", "STEST0", "STEST1", "STEST2", "STEST3",
49 "SIDL", "0x51", "0x52", "0x53", "SODL", "0x55", "0x56", "0x57",
50 "SBDL", "0x59", "0x5a", "0x5b", "SCRATCHB0", "SCRATCHB1", "SCRATCHB2", "SCRATCHB3",
51 };
52
53 #define LSI_MAX_DEVS 7
54
55 #define LSI_SCNTL0_TRG 0x01
56 #define LSI_SCNTL0_AAP 0x02
57 #define LSI_SCNTL0_EPC 0x08
58 #define LSI_SCNTL0_WATN 0x10
59 #define LSI_SCNTL0_START 0x20
60
61 #define LSI_SCNTL1_SST 0x01
62 #define LSI_SCNTL1_IARB 0x02
63 #define LSI_SCNTL1_AESP 0x04
64 #define LSI_SCNTL1_RST 0x08
65 #define LSI_SCNTL1_CON 0x10
66 #define LSI_SCNTL1_DHP 0x20
67 #define LSI_SCNTL1_ADB 0x40
68 #define LSI_SCNTL1_EXC 0x80
69
70 #define LSI_SCNTL2_WSR 0x01
71 #define LSI_SCNTL2_VUE0 0x02
72 #define LSI_SCNTL2_VUE1 0x04
73 #define LSI_SCNTL2_WSS 0x08
74 #define LSI_SCNTL2_SLPHBEN 0x10
75 #define LSI_SCNTL2_SLPMD 0x20
76 #define LSI_SCNTL2_CHM 0x40
77 #define LSI_SCNTL2_SDU 0x80
78
79 #define LSI_ISTAT0_DIP 0x01
80 #define LSI_ISTAT0_SIP 0x02
81 #define LSI_ISTAT0_INTF 0x04
82 #define LSI_ISTAT0_CON 0x08
83 #define LSI_ISTAT0_SEM 0x10
84 #define LSI_ISTAT0_SIGP 0x20
85 #define LSI_ISTAT0_SRST 0x40
86 #define LSI_ISTAT0_ABRT 0x80
87
88 #define LSI_ISTAT1_SI 0x01
89 #define LSI_ISTAT1_SRUN 0x02
90 #define LSI_ISTAT1_FLSH 0x04
91
92 #define LSI_SSTAT0_SDP0 0x01
93 #define LSI_SSTAT0_RST 0x02
94 #define LSI_SSTAT0_WOA 0x04
95 #define LSI_SSTAT0_LOA 0x08
96 #define LSI_SSTAT0_AIP 0x10
97 #define LSI_SSTAT0_OLF 0x20
98 #define LSI_SSTAT0_ORF 0x40
99 #define LSI_SSTAT0_ILF 0x80
100
101 #define LSI_SIST0_PAR 0x01
102 #define LSI_SIST0_RST 0x02
103 #define LSI_SIST0_UDC 0x04
104 #define LSI_SIST0_SGE 0x08
105 #define LSI_SIST0_RSL 0x10
106 #define LSI_SIST0_SEL 0x20
107 #define LSI_SIST0_CMP 0x40
108 #define LSI_SIST0_MA 0x80
109
110 #define LSI_SIST1_HTH 0x01
111 #define LSI_SIST1_GEN 0x02
112 #define LSI_SIST1_STO 0x04
113 #define LSI_SIST1_SBMC 0x10
114
115 #define LSI_SOCL_IO 0x01
116 #define LSI_SOCL_CD 0x02
117 #define LSI_SOCL_MSG 0x04
118 #define LSI_SOCL_ATN 0x08
119 #define LSI_SOCL_SEL 0x10
120 #define LSI_SOCL_BSY 0x20
121 #define LSI_SOCL_ACK 0x40
122 #define LSI_SOCL_REQ 0x80
123
124 #define LSI_DSTAT_IID 0x01
125 #define LSI_DSTAT_SIR 0x04
126 #define LSI_DSTAT_SSI 0x08
127 #define LSI_DSTAT_ABRT 0x10
128 #define LSI_DSTAT_BF 0x20
129 #define LSI_DSTAT_MDPE 0x40
130 #define LSI_DSTAT_DFE 0x80
131
132 #define LSI_DCNTL_COM 0x01
133 #define LSI_DCNTL_IRQD 0x02
134 #define LSI_DCNTL_STD 0x04
135 #define LSI_DCNTL_IRQM 0x08
136 #define LSI_DCNTL_SSM 0x10
137 #define LSI_DCNTL_PFEN 0x20
138 #define LSI_DCNTL_PFF 0x40
139 #define LSI_DCNTL_CLSE 0x80
140
141 #define LSI_DMODE_MAN 0x01
142 #define LSI_DMODE_BOF 0x02
143 #define LSI_DMODE_ERMP 0x04
144 #define LSI_DMODE_ERL 0x08
145 #define LSI_DMODE_DIOM 0x10
146 #define LSI_DMODE_SIOM 0x20
147
148 #define LSI_CTEST2_DACK 0x01
149 #define LSI_CTEST2_DREQ 0x02
150 #define LSI_CTEST2_TEOP 0x04
151 #define LSI_CTEST2_PCICIE 0x08
152 #define LSI_CTEST2_CM 0x10
153 #define LSI_CTEST2_CIO 0x20
154 #define LSI_CTEST2_SIGP 0x40
155 #define LSI_CTEST2_DDIR 0x80
156
157 #define LSI_CTEST5_BL2 0x04
158 #define LSI_CTEST5_DDIR 0x08
159 #define LSI_CTEST5_MASR 0x10
160 #define LSI_CTEST5_DFSN 0x20
161 #define LSI_CTEST5_BBCK 0x40
162 #define LSI_CTEST5_ADCK 0x80
163
164 #define LSI_CCNTL0_DILS 0x01
165 #define LSI_CCNTL0_DISFC 0x10
166 #define LSI_CCNTL0_ENNDJ 0x20
167 #define LSI_CCNTL0_PMJCTL 0x40
168 #define LSI_CCNTL0_ENPMJ 0x80
169
170 #define LSI_CCNTL1_EN64DBMV 0x01
171 #define LSI_CCNTL1_EN64TIBMV 0x02
172 #define LSI_CCNTL1_64TIMOD 0x04
173 #define LSI_CCNTL1_DDAC 0x08
174 #define LSI_CCNTL1_ZMOD 0x80
175
176 /* Enable Response to Reselection */
177 #define LSI_SCID_RRE 0x60
178
179 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
180
181 #define PHASE_DO 0
182 #define PHASE_DI 1
183 #define PHASE_CMD 2
184 #define PHASE_ST 3
185 #define PHASE_MO 6
186 #define PHASE_MI 7
187 #define PHASE_MASK 7
188
189 /* Maximum length of MSG IN data. */
190 #define LSI_MAX_MSGIN_LEN 8
191
192 /* Flag set if this is a tagged command. */
193 #define LSI_TAG_VALID (1 << 16)
194
195 typedef struct lsi_request {
196 SCSIRequest *req;
197 uint32_t tag;
198 uint32_t dma_len;
199 uint8_t *dma_buf;
200 uint32_t pending;
201 int out;
202 QTAILQ_ENTRY(lsi_request) next;
203 } lsi_request;
204
205 typedef struct {
206 /*< private >*/
207 PCIDevice parent_obj;
208 /*< public >*/
209
210 qemu_irq ext_irq;
211 MemoryRegion mmio_io;
212 MemoryRegion ram_io;
213 MemoryRegion io_io;
214 AddressSpace pci_io_as;
215
216 int carry; /* ??? Should this be an a visible register somewhere? */
217 int status;
218 /* Action to take at the end of a MSG IN phase.
219 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
220 int msg_action;
221 int msg_len;
222 uint8_t msg[LSI_MAX_MSGIN_LEN];
223 /* 0 if SCRIPTS are running or stopped.
224 * 1 if a Wait Reselect instruction has been issued.
225 * 2 if processing DMA from lsi_execute_script.
226 * 3 if a DMA operation is in progress. */
227 int waiting;
228 SCSIBus bus;
229 int current_lun;
230 /* The tag is a combination of the device ID and the SCSI tag. */
231 uint32_t select_tag;
232 int command_complete;
233 QTAILQ_HEAD(, lsi_request) queue;
234 lsi_request *current;
235
236 uint32_t dsa;
237 uint32_t temp;
238 uint32_t dnad;
239 uint32_t dbc;
240 uint8_t istat0;
241 uint8_t istat1;
242 uint8_t dcmd;
243 uint8_t dstat;
244 uint8_t dien;
245 uint8_t sist0;
246 uint8_t sist1;
247 uint8_t sien0;
248 uint8_t sien1;
249 uint8_t mbox0;
250 uint8_t mbox1;
251 uint8_t dfifo;
252 uint8_t ctest2;
253 uint8_t ctest3;
254 uint8_t ctest4;
255 uint8_t ctest5;
256 uint8_t ccntl0;
257 uint8_t ccntl1;
258 uint32_t dsp;
259 uint32_t dsps;
260 uint8_t dmode;
261 uint8_t dcntl;
262 uint8_t scntl0;
263 uint8_t scntl1;
264 uint8_t scntl2;
265 uint8_t scntl3;
266 uint8_t sstat0;
267 uint8_t sstat1;
268 uint8_t scid;
269 uint8_t sxfer;
270 uint8_t socl;
271 uint8_t sdid;
272 uint8_t ssid;
273 uint8_t sfbr;
274 uint8_t stest1;
275 uint8_t stest2;
276 uint8_t stest3;
277 uint8_t sidl;
278 uint8_t stime0;
279 uint8_t respid0;
280 uint8_t respid1;
281 uint32_t mmrs;
282 uint32_t mmws;
283 uint32_t sfs;
284 uint32_t drs;
285 uint32_t sbms;
286 uint32_t dbms;
287 uint32_t dnad64;
288 uint32_t pmjad1;
289 uint32_t pmjad2;
290 uint32_t rbc;
291 uint32_t ua;
292 uint32_t ia;
293 uint32_t sbc;
294 uint32_t csbc;
295 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
296 uint8_t sbr;
297 uint32_t adder;
298
299 /* Script ram is stored as 32-bit words in host byteorder. */
300 uint32_t script_ram[2048];
301 } LSIState;
302
303 #define TYPE_LSI53C810 "lsi53c810"
304 #define TYPE_LSI53C895A "lsi53c895a"
305
306 #define LSI53C895A(obj) \
307 OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A)
308
309 static inline int lsi_irq_on_rsl(LSIState *s)
310 {
311 return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
312 }
313
314 static void lsi_soft_reset(LSIState *s)
315 {
316 DPRINTF("Reset\n");
317 s->carry = 0;
318
319 s->msg_action = 0;
320 s->msg_len = 0;
321 s->waiting = 0;
322 s->dsa = 0;
323 s->dnad = 0;
324 s->dbc = 0;
325 s->temp = 0;
326 memset(s->scratch, 0, sizeof(s->scratch));
327 s->istat0 = 0;
328 s->istat1 = 0;
329 s->dcmd = 0x40;
330 s->dstat = 0;
331 s->dien = 0;
332 s->sist0 = 0;
333 s->sist1 = 0;
334 s->sien0 = 0;
335 s->sien1 = 0;
336 s->mbox0 = 0;
337 s->mbox1 = 0;
338 s->dfifo = 0;
339 s->ctest2 = LSI_CTEST2_DACK;
340 s->ctest3 = 0;
341 s->ctest4 = 0;
342 s->ctest5 = 0;
343 s->ccntl0 = 0;
344 s->ccntl1 = 0;
345 s->dsp = 0;
346 s->dsps = 0;
347 s->dmode = 0;
348 s->dcntl = 0;
349 s->scntl0 = 0xc0;
350 s->scntl1 = 0;
351 s->scntl2 = 0;
352 s->scntl3 = 0;
353 s->sstat0 = 0;
354 s->sstat1 = 0;
355 s->scid = 7;
356 s->sxfer = 0;
357 s->socl = 0;
358 s->sdid = 0;
359 s->ssid = 0;
360 s->stest1 = 0;
361 s->stest2 = 0;
362 s->stest3 = 0;
363 s->sidl = 0;
364 s->stime0 = 0;
365 s->respid0 = 0x80;
366 s->respid1 = 0;
367 s->mmrs = 0;
368 s->mmws = 0;
369 s->sfs = 0;
370 s->drs = 0;
371 s->sbms = 0;
372 s->dbms = 0;
373 s->dnad64 = 0;
374 s->pmjad1 = 0;
375 s->pmjad2 = 0;
376 s->rbc = 0;
377 s->ua = 0;
378 s->ia = 0;
379 s->sbc = 0;
380 s->csbc = 0;
381 s->sbr = 0;
382 assert(QTAILQ_EMPTY(&s->queue));
383 assert(!s->current);
384 }
385
386 static int lsi_dma_40bit(LSIState *s)
387 {
388 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
389 return 1;
390 return 0;
391 }
392
393 static int lsi_dma_ti64bit(LSIState *s)
394 {
395 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
396 return 1;
397 return 0;
398 }
399
400 static int lsi_dma_64bit(LSIState *s)
401 {
402 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
403 return 1;
404 return 0;
405 }
406
407 static uint8_t lsi_reg_readb(LSIState *s, int offset);
408 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
409 static void lsi_execute_script(LSIState *s);
410 static void lsi_reselect(LSIState *s, lsi_request *p);
411
412 static inline void lsi_mem_read(LSIState *s, dma_addr_t addr,
413 void *buf, dma_addr_t len)
414 {
415 if (s->dmode & LSI_DMODE_SIOM) {
416 address_space_read(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
417 buf, len);
418 } else {
419 pci_dma_read(PCI_DEVICE(s), addr, buf, len);
420 }
421 }
422
423 static inline void lsi_mem_write(LSIState *s, dma_addr_t addr,
424 const void *buf, dma_addr_t len)
425 {
426 if (s->dmode & LSI_DMODE_DIOM) {
427 address_space_write(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
428 buf, len);
429 } else {
430 pci_dma_write(PCI_DEVICE(s), addr, buf, len);
431 }
432 }
433
434 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
435 {
436 uint32_t buf;
437
438 pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
439 return cpu_to_le32(buf);
440 }
441
442 static void lsi_stop_script(LSIState *s)
443 {
444 s->istat1 &= ~LSI_ISTAT1_SRUN;
445 }
446
447 static void lsi_set_irq(LSIState *s, int level)
448 {
449 PCIDevice *d = PCI_DEVICE(s);
450
451 if (s->ext_irq) {
452 qemu_set_irq(s->ext_irq, level);
453 } else {
454 pci_set_irq(d, level);
455 }
456 }
457
458 static void lsi_update_irq(LSIState *s)
459 {
460 int level;
461 static int last_level;
462 lsi_request *p;
463
464 /* It's unclear whether the DIP/SIP bits should be cleared when the
465 Interrupt Status Registers are cleared or when istat0 is read.
466 We currently do the formwer, which seems to work. */
467 level = 0;
468 if (s->dstat) {
469 if (s->dstat & s->dien)
470 level = 1;
471 s->istat0 |= LSI_ISTAT0_DIP;
472 } else {
473 s->istat0 &= ~LSI_ISTAT0_DIP;
474 }
475
476 if (s->sist0 || s->sist1) {
477 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
478 level = 1;
479 s->istat0 |= LSI_ISTAT0_SIP;
480 } else {
481 s->istat0 &= ~LSI_ISTAT0_SIP;
482 }
483 if (s->istat0 & LSI_ISTAT0_INTF)
484 level = 1;
485
486 if (level != last_level) {
487 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
488 level, s->dstat, s->sist1, s->sist0);
489 last_level = level;
490 }
491 lsi_set_irq(s, level);
492
493 if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
494 DPRINTF("Handled IRQs & disconnected, looking for pending "
495 "processes\n");
496 QTAILQ_FOREACH(p, &s->queue, next) {
497 if (p->pending) {
498 lsi_reselect(s, p);
499 break;
500 }
501 }
502 }
503 }
504
505 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
506 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
507 {
508 uint32_t mask0;
509 uint32_t mask1;
510
511 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
512 stat1, stat0, s->sist1, s->sist0);
513 s->sist0 |= stat0;
514 s->sist1 |= stat1;
515 /* Stop processor on fatal or unmasked interrupt. As a special hack
516 we don't stop processing when raising STO. Instead continue
517 execution and stop at the next insn that accesses the SCSI bus. */
518 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
519 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
520 mask1 &= ~LSI_SIST1_STO;
521 if (s->sist0 & mask0 || s->sist1 & mask1) {
522 lsi_stop_script(s);
523 }
524 lsi_update_irq(s);
525 }
526
527 /* Stop SCRIPTS execution and raise a DMA interrupt. */
528 static void lsi_script_dma_interrupt(LSIState *s, int stat)
529 {
530 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
531 s->dstat |= stat;
532 lsi_update_irq(s);
533 lsi_stop_script(s);
534 }
535
536 static inline void lsi_set_phase(LSIState *s, int phase)
537 {
538 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
539 }
540
541 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
542 {
543 /* Trigger a phase mismatch. */
544 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
545 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
546 s->dsp = out ? s->pmjad1 : s->pmjad2;
547 } else {
548 s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
549 }
550 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
551 } else {
552 DPRINTF("Phase mismatch interrupt\n");
553 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
554 lsi_stop_script(s);
555 }
556 lsi_set_phase(s, new_phase);
557 }
558
559
560 /* Resume SCRIPTS execution after a DMA operation. */
561 static void lsi_resume_script(LSIState *s)
562 {
563 if (s->waiting != 2) {
564 s->waiting = 0;
565 lsi_execute_script(s);
566 } else {
567 s->waiting = 0;
568 }
569 }
570
571 static void lsi_disconnect(LSIState *s)
572 {
573 s->scntl1 &= ~LSI_SCNTL1_CON;
574 s->sstat1 &= ~PHASE_MASK;
575 }
576
577 static void lsi_bad_selection(LSIState *s, uint32_t id)
578 {
579 DPRINTF("Selected absent target %d\n", id);
580 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
581 lsi_disconnect(s);
582 }
583
584 /* Initiate a SCSI layer data transfer. */
585 static void lsi_do_dma(LSIState *s, int out)
586 {
587 uint32_t count;
588 dma_addr_t addr;
589 SCSIDevice *dev;
590
591 assert(s->current);
592 if (!s->current->dma_len) {
593 /* Wait until data is available. */
594 DPRINTF("DMA no data available\n");
595 return;
596 }
597
598 dev = s->current->req->dev;
599 assert(dev);
600
601 count = s->dbc;
602 if (count > s->current->dma_len)
603 count = s->current->dma_len;
604
605 addr = s->dnad;
606 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
607 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
608 addr |= ((uint64_t)s->dnad64 << 32);
609 else if (s->dbms)
610 addr |= ((uint64_t)s->dbms << 32);
611 else if (s->sbms)
612 addr |= ((uint64_t)s->sbms << 32);
613
614 DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
615 s->csbc += count;
616 s->dnad += count;
617 s->dbc -= count;
618 if (s->current->dma_buf == NULL) {
619 s->current->dma_buf = scsi_req_get_buf(s->current->req);
620 }
621 /* ??? Set SFBR to first data byte. */
622 if (out) {
623 lsi_mem_read(s, addr, s->current->dma_buf, count);
624 } else {
625 lsi_mem_write(s, addr, s->current->dma_buf, count);
626 }
627 s->current->dma_len -= count;
628 if (s->current->dma_len == 0) {
629 s->current->dma_buf = NULL;
630 scsi_req_continue(s->current->req);
631 } else {
632 s->current->dma_buf += count;
633 lsi_resume_script(s);
634 }
635 }
636
637
638 /* Add a command to the queue. */
639 static void lsi_queue_command(LSIState *s)
640 {
641 lsi_request *p = s->current;
642
643 DPRINTF("Queueing tag=0x%x\n", p->tag);
644 assert(s->current != NULL);
645 assert(s->current->dma_len == 0);
646 QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
647 s->current = NULL;
648
649 p->pending = 0;
650 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
651 }
652
653 /* Queue a byte for a MSG IN phase. */
654 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
655 {
656 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
657 BADF("MSG IN data too long\n");
658 } else {
659 DPRINTF("MSG IN 0x%02x\n", data);
660 s->msg[s->msg_len++] = data;
661 }
662 }
663
664 /* Perform reselection to continue a command. */
665 static void lsi_reselect(LSIState *s, lsi_request *p)
666 {
667 int id;
668
669 assert(s->current == NULL);
670 QTAILQ_REMOVE(&s->queue, p, next);
671 s->current = p;
672
673 id = (p->tag >> 8) & 0xf;
674 s->ssid = id | 0x80;
675 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
676 if (!(s->dcntl & LSI_DCNTL_COM)) {
677 s->sfbr = 1 << (id & 0x7);
678 }
679 DPRINTF("Reselected target %d\n", id);
680 s->scntl1 |= LSI_SCNTL1_CON;
681 lsi_set_phase(s, PHASE_MI);
682 s->msg_action = p->out ? 2 : 3;
683 s->current->dma_len = p->pending;
684 lsi_add_msg_byte(s, 0x80);
685 if (s->current->tag & LSI_TAG_VALID) {
686 lsi_add_msg_byte(s, 0x20);
687 lsi_add_msg_byte(s, p->tag & 0xff);
688 }
689
690 if (lsi_irq_on_rsl(s)) {
691 lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
692 }
693 }
694
695 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
696 {
697 lsi_request *p;
698
699 QTAILQ_FOREACH(p, &s->queue, next) {
700 if (p->tag == tag) {
701 return p;
702 }
703 }
704
705 return NULL;
706 }
707
708 static void lsi_request_free(LSIState *s, lsi_request *p)
709 {
710 if (p == s->current) {
711 s->current = NULL;
712 } else {
713 QTAILQ_REMOVE(&s->queue, p, next);
714 }
715 g_free(p);
716 }
717
718 static void lsi_request_cancelled(SCSIRequest *req)
719 {
720 LSIState *s = LSI53C895A(req->bus->qbus.parent);
721 lsi_request *p = req->hba_private;
722
723 req->hba_private = NULL;
724 lsi_request_free(s, p);
725 scsi_req_unref(req);
726 }
727
728 /* Record that data is available for a queued command. Returns zero if
729 the device was reselected, nonzero if the IO is deferred. */
730 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
731 {
732 lsi_request *p = req->hba_private;
733
734 if (p->pending) {
735 BADF("Multiple IO pending for request %p\n", p);
736 }
737 p->pending = len;
738 /* Reselect if waiting for it, or if reselection triggers an IRQ
739 and the bus is free.
740 Since no interrupt stacking is implemented in the emulation, it
741 is also required that there are no pending interrupts waiting
742 for service from the device driver. */
743 if (s->waiting == 1 ||
744 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
745 !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
746 /* Reselect device. */
747 lsi_reselect(s, p);
748 return 0;
749 } else {
750 DPRINTF("Queueing IO tag=0x%x\n", p->tag);
751 p->pending = len;
752 return 1;
753 }
754 }
755
756 /* Callback to indicate that the SCSI layer has completed a command. */
757 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
758 {
759 LSIState *s = LSI53C895A(req->bus->qbus.parent);
760 int out;
761
762 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
763 DPRINTF("Command complete status=%d\n", (int)status);
764 s->status = status;
765 s->command_complete = 2;
766 if (s->waiting && s->dbc != 0) {
767 /* Raise phase mismatch for short transfers. */
768 lsi_bad_phase(s, out, PHASE_ST);
769 } else {
770 lsi_set_phase(s, PHASE_ST);
771 }
772
773 if (req->hba_private == s->current) {
774 req->hba_private = NULL;
775 lsi_request_free(s, s->current);
776 scsi_req_unref(req);
777 }
778 lsi_resume_script(s);
779 }
780
781 /* Callback to indicate that the SCSI layer has completed a transfer. */
782 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
783 {
784 LSIState *s = LSI53C895A(req->bus->qbus.parent);
785 int out;
786
787 assert(req->hba_private);
788 if (s->waiting == 1 || req->hba_private != s->current ||
789 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
790 if (lsi_queue_req(s, req, len)) {
791 return;
792 }
793 }
794
795 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
796
797 /* host adapter (re)connected */
798 DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
799 s->current->dma_len = len;
800 s->command_complete = 1;
801 if (s->waiting) {
802 if (s->waiting == 1 || s->dbc == 0) {
803 lsi_resume_script(s);
804 } else {
805 lsi_do_dma(s, out);
806 }
807 }
808 }
809
810 static void lsi_do_command(LSIState *s)
811 {
812 SCSIDevice *dev;
813 uint8_t buf[16];
814 uint32_t id;
815 int n;
816
817 DPRINTF("Send command len=%d\n", s->dbc);
818 if (s->dbc > 16)
819 s->dbc = 16;
820 pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
821 s->sfbr = buf[0];
822 s->command_complete = 0;
823
824 id = (s->select_tag >> 8) & 0xf;
825 dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
826 if (!dev) {
827 lsi_bad_selection(s, id);
828 return;
829 }
830
831 assert(s->current == NULL);
832 s->current = g_new0(lsi_request, 1);
833 s->current->tag = s->select_tag;
834 s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
835 s->current);
836
837 n = scsi_req_enqueue(s->current->req);
838 if (n) {
839 if (n > 0) {
840 lsi_set_phase(s, PHASE_DI);
841 } else if (n < 0) {
842 lsi_set_phase(s, PHASE_DO);
843 }
844 scsi_req_continue(s->current->req);
845 }
846 if (!s->command_complete) {
847 if (n) {
848 /* Command did not complete immediately so disconnect. */
849 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
850 lsi_add_msg_byte(s, 4); /* DISCONNECT */
851 /* wait data */
852 lsi_set_phase(s, PHASE_MI);
853 s->msg_action = 1;
854 lsi_queue_command(s);
855 } else {
856 /* wait command complete */
857 lsi_set_phase(s, PHASE_DI);
858 }
859 }
860 }
861
862 static void lsi_do_status(LSIState *s)
863 {
864 uint8_t status;
865 DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
866 if (s->dbc != 1)
867 BADF("Bad Status move\n");
868 s->dbc = 1;
869 status = s->status;
870 s->sfbr = status;
871 pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
872 lsi_set_phase(s, PHASE_MI);
873 s->msg_action = 1;
874 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
875 }
876
877 static void lsi_do_msgin(LSIState *s)
878 {
879 int len;
880 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
881 s->sfbr = s->msg[0];
882 len = s->msg_len;
883 if (len > s->dbc)
884 len = s->dbc;
885 pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
886 /* Linux drivers rely on the last byte being in the SIDL. */
887 s->sidl = s->msg[len - 1];
888 s->msg_len -= len;
889 if (s->msg_len) {
890 memmove(s->msg, s->msg + len, s->msg_len);
891 } else {
892 /* ??? Check if ATN (not yet implemented) is asserted and maybe
893 switch to PHASE_MO. */
894 switch (s->msg_action) {
895 case 0:
896 lsi_set_phase(s, PHASE_CMD);
897 break;
898 case 1:
899 lsi_disconnect(s);
900 break;
901 case 2:
902 lsi_set_phase(s, PHASE_DO);
903 break;
904 case 3:
905 lsi_set_phase(s, PHASE_DI);
906 break;
907 default:
908 abort();
909 }
910 }
911 }
912
913 /* Read the next byte during a MSGOUT phase. */
914 static uint8_t lsi_get_msgbyte(LSIState *s)
915 {
916 uint8_t data;
917 pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
918 s->dnad++;
919 s->dbc--;
920 return data;
921 }
922
923 /* Skip the next n bytes during a MSGOUT phase. */
924 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
925 {
926 s->dnad += n;
927 s->dbc -= n;
928 }
929
930 static void lsi_do_msgout(LSIState *s)
931 {
932 uint8_t msg;
933 int len;
934 uint32_t current_tag;
935 lsi_request *current_req, *p, *p_next;
936
937 if (s->current) {
938 current_tag = s->current->tag;
939 current_req = s->current;
940 } else {
941 current_tag = s->select_tag;
942 current_req = lsi_find_by_tag(s, current_tag);
943 }
944
945 DPRINTF("MSG out len=%d\n", s->dbc);
946 while (s->dbc) {
947 msg = lsi_get_msgbyte(s);
948 s->sfbr = msg;
949
950 switch (msg) {
951 case 0x04:
952 DPRINTF("MSG: Disconnect\n");
953 lsi_disconnect(s);
954 break;
955 case 0x08:
956 DPRINTF("MSG: No Operation\n");
957 lsi_set_phase(s, PHASE_CMD);
958 break;
959 case 0x01:
960 len = lsi_get_msgbyte(s);
961 msg = lsi_get_msgbyte(s);
962 (void)len; /* avoid a warning about unused variable*/
963 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
964 switch (msg) {
965 case 1:
966 DPRINTF("SDTR (ignored)\n");
967 lsi_skip_msgbytes(s, 2);
968 break;
969 case 3:
970 DPRINTF("WDTR (ignored)\n");
971 lsi_skip_msgbytes(s, 1);
972 break;
973 case 4:
974 DPRINTF("PPR (ignored)\n");
975 lsi_skip_msgbytes(s, 5);
976 break;
977 default:
978 goto bad;
979 }
980 break;
981 case 0x20: /* SIMPLE queue */
982 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
983 DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
984 break;
985 case 0x21: /* HEAD of queue */
986 BADF("HEAD queue not implemented\n");
987 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
988 break;
989 case 0x22: /* ORDERED queue */
990 BADF("ORDERED queue not implemented\n");
991 s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
992 break;
993 case 0x0d:
994 /* The ABORT TAG message clears the current I/O process only. */
995 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
996 if (current_req) {
997 scsi_req_cancel(current_req->req);
998 }
999 lsi_disconnect(s);
1000 break;
1001 case 0x06:
1002 case 0x0e:
1003 case 0x0c:
1004 /* The ABORT message clears all I/O processes for the selecting
1005 initiator on the specified logical unit of the target. */
1006 if (msg == 0x06) {
1007 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
1008 }
1009 /* The CLEAR QUEUE message clears all I/O processes for all
1010 initiators on the specified logical unit of the target. */
1011 if (msg == 0x0e) {
1012 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
1013 }
1014 /* The BUS DEVICE RESET message clears all I/O processes for all
1015 initiators on all logical units of the target. */
1016 if (msg == 0x0c) {
1017 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
1018 }
1019
1020 /* clear the current I/O process */
1021 if (s->current) {
1022 scsi_req_cancel(s->current->req);
1023 }
1024
1025 /* As the current implemented devices scsi_disk and scsi_generic
1026 only support one LUN, we don't need to keep track of LUNs.
1027 Clearing I/O processes for other initiators could be possible
1028 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
1029 device, but this is currently not implemented (and seems not
1030 to be really necessary). So let's simply clear all queued
1031 commands for the current device: */
1032 QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
1033 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
1034 scsi_req_cancel(p->req);
1035 }
1036 }
1037
1038 lsi_disconnect(s);
1039 break;
1040 default:
1041 if ((msg & 0x80) == 0) {
1042 goto bad;
1043 }
1044 s->current_lun = msg & 7;
1045 DPRINTF("Select LUN %d\n", s->current_lun);
1046 lsi_set_phase(s, PHASE_CMD);
1047 break;
1048 }
1049 }
1050 return;
1051 bad:
1052 BADF("Unimplemented message 0x%02x\n", msg);
1053 lsi_set_phase(s, PHASE_MI);
1054 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1055 s->msg_action = 0;
1056 }
1057
1058 #define LSI_BUF_SIZE 4096
1059 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1060 {
1061 int n;
1062 uint8_t buf[LSI_BUF_SIZE];
1063
1064 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1065 while (count) {
1066 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1067 lsi_mem_read(s, src, buf, n);
1068 lsi_mem_write(s, dest, buf, n);
1069 src += n;
1070 dest += n;
1071 count -= n;
1072 }
1073 }
1074
1075 static void lsi_wait_reselect(LSIState *s)
1076 {
1077 lsi_request *p;
1078
1079 DPRINTF("Wait Reselect\n");
1080
1081 QTAILQ_FOREACH(p, &s->queue, next) {
1082 if (p->pending) {
1083 lsi_reselect(s, p);
1084 break;
1085 }
1086 }
1087 if (s->current == NULL) {
1088 s->waiting = 1;
1089 }
1090 }
1091
1092 static void lsi_execute_script(LSIState *s)
1093 {
1094 PCIDevice *pci_dev = PCI_DEVICE(s);
1095 uint32_t insn;
1096 uint32_t addr, addr_high;
1097 int opcode;
1098 int insn_processed = 0;
1099
1100 s->istat1 |= LSI_ISTAT1_SRUN;
1101 again:
1102 insn_processed++;
1103 insn = read_dword(s, s->dsp);
1104 if (!insn) {
1105 /* If we receive an empty opcode increment the DSP by 4 bytes
1106 instead of 8 and execute the next opcode at that location */
1107 s->dsp += 4;
1108 goto again;
1109 }
1110 addr = read_dword(s, s->dsp + 4);
1111 addr_high = 0;
1112 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1113 s->dsps = addr;
1114 s->dcmd = insn >> 24;
1115 s->dsp += 8;
1116 switch (insn >> 30) {
1117 case 0: /* Block move. */
1118 if (s->sist1 & LSI_SIST1_STO) {
1119 DPRINTF("Delayed select timeout\n");
1120 lsi_stop_script(s);
1121 break;
1122 }
1123 s->dbc = insn & 0xffffff;
1124 s->rbc = s->dbc;
1125 /* ??? Set ESA. */
1126 s->ia = s->dsp - 8;
1127 if (insn & (1 << 29)) {
1128 /* Indirect addressing. */
1129 addr = read_dword(s, addr);
1130 } else if (insn & (1 << 28)) {
1131 uint32_t buf[2];
1132 int32_t offset;
1133 /* Table indirect addressing. */
1134
1135 /* 32-bit Table indirect */
1136 offset = sextract32(addr, 0, 24);
1137 pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
1138 /* byte count is stored in bits 0:23 only */
1139 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1140 s->rbc = s->dbc;
1141 addr = cpu_to_le32(buf[1]);
1142
1143 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1144 * table, bits [31:24] */
1145 if (lsi_dma_40bit(s))
1146 addr_high = cpu_to_le32(buf[0]) >> 24;
1147 else if (lsi_dma_ti64bit(s)) {
1148 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1149 switch (selector) {
1150 case 0 ... 0x0f:
1151 /* offset index into scratch registers since
1152 * TI64 mode can use registers C to R */
1153 addr_high = s->scratch[2 + selector];
1154 break;
1155 case 0x10:
1156 addr_high = s->mmrs;
1157 break;
1158 case 0x11:
1159 addr_high = s->mmws;
1160 break;
1161 case 0x12:
1162 addr_high = s->sfs;
1163 break;
1164 case 0x13:
1165 addr_high = s->drs;
1166 break;
1167 case 0x14:
1168 addr_high = s->sbms;
1169 break;
1170 case 0x15:
1171 addr_high = s->dbms;
1172 break;
1173 default:
1174 BADF("Illegal selector specified (0x%x > 0x15)"
1175 " for 64-bit DMA block move", selector);
1176 break;
1177 }
1178 }
1179 } else if (lsi_dma_64bit(s)) {
1180 /* fetch a 3rd dword if 64-bit direct move is enabled and
1181 only if we're not doing table indirect or indirect addressing */
1182 s->dbms = read_dword(s, s->dsp);
1183 s->dsp += 4;
1184 s->ia = s->dsp - 12;
1185 }
1186 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1187 DPRINTF("Wrong phase got %d expected %d\n",
1188 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1189 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1190 break;
1191 }
1192 s->dnad = addr;
1193 s->dnad64 = addr_high;
1194 switch (s->sstat1 & 0x7) {
1195 case PHASE_DO:
1196 s->waiting = 2;
1197 lsi_do_dma(s, 1);
1198 if (s->waiting)
1199 s->waiting = 3;
1200 break;
1201 case PHASE_DI:
1202 s->waiting = 2;
1203 lsi_do_dma(s, 0);
1204 if (s->waiting)
1205 s->waiting = 3;
1206 break;
1207 case PHASE_CMD:
1208 lsi_do_command(s);
1209 break;
1210 case PHASE_ST:
1211 lsi_do_status(s);
1212 break;
1213 case PHASE_MO:
1214 lsi_do_msgout(s);
1215 break;
1216 case PHASE_MI:
1217 lsi_do_msgin(s);
1218 break;
1219 default:
1220 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1221 exit(1);
1222 }
1223 s->dfifo = s->dbc & 0xff;
1224 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1225 s->sbc = s->dbc;
1226 s->rbc -= s->dbc;
1227 s->ua = addr + s->dbc;
1228 break;
1229
1230 case 1: /* IO or Read/Write instruction. */
1231 opcode = (insn >> 27) & 7;
1232 if (opcode < 5) {
1233 uint32_t id;
1234
1235 if (insn & (1 << 25)) {
1236 id = read_dword(s, s->dsa + sextract32(insn, 0, 24));
1237 } else {
1238 id = insn;
1239 }
1240 id = (id >> 16) & 0xf;
1241 if (insn & (1 << 26)) {
1242 addr = s->dsp + sextract32(addr, 0, 24);
1243 }
1244 s->dnad = addr;
1245 switch (opcode) {
1246 case 0: /* Select */
1247 s->sdid = id;
1248 if (s->scntl1 & LSI_SCNTL1_CON) {
1249 DPRINTF("Already reselected, jumping to alternative address\n");
1250 s->dsp = s->dnad;
1251 break;
1252 }
1253 s->sstat0 |= LSI_SSTAT0_WOA;
1254 s->scntl1 &= ~LSI_SCNTL1_IARB;
1255 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1256 lsi_bad_selection(s, id);
1257 break;
1258 }
1259 DPRINTF("Selected target %d%s\n",
1260 id, insn & (1 << 3) ? " ATN" : "");
1261 /* ??? Linux drivers compain when this is set. Maybe
1262 it only applies in low-level mode (unimplemented).
1263 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1264 s->select_tag = id << 8;
1265 s->scntl1 |= LSI_SCNTL1_CON;
1266 if (insn & (1 << 3)) {
1267 s->socl |= LSI_SOCL_ATN;
1268 }
1269 lsi_set_phase(s, PHASE_MO);
1270 break;
1271 case 1: /* Disconnect */
1272 DPRINTF("Wait Disconnect\n");
1273 s->scntl1 &= ~LSI_SCNTL1_CON;
1274 break;
1275 case 2: /* Wait Reselect */
1276 if (!lsi_irq_on_rsl(s)) {
1277 lsi_wait_reselect(s);
1278 }
1279 break;
1280 case 3: /* Set */
1281 DPRINTF("Set%s%s%s%s\n",
1282 insn & (1 << 3) ? " ATN" : "",
1283 insn & (1 << 6) ? " ACK" : "",
1284 insn & (1 << 9) ? " TM" : "",
1285 insn & (1 << 10) ? " CC" : "");
1286 if (insn & (1 << 3)) {
1287 s->socl |= LSI_SOCL_ATN;
1288 lsi_set_phase(s, PHASE_MO);
1289 }
1290 if (insn & (1 << 9)) {
1291 BADF("Target mode not implemented\n");
1292 exit(1);
1293 }
1294 if (insn & (1 << 10))
1295 s->carry = 1;
1296 break;
1297 case 4: /* Clear */
1298 DPRINTF("Clear%s%s%s%s\n",
1299 insn & (1 << 3) ? " ATN" : "",
1300 insn & (1 << 6) ? " ACK" : "",
1301 insn & (1 << 9) ? " TM" : "",
1302 insn & (1 << 10) ? " CC" : "");
1303 if (insn & (1 << 3)) {
1304 s->socl &= ~LSI_SOCL_ATN;
1305 }
1306 if (insn & (1 << 10))
1307 s->carry = 0;
1308 break;
1309 }
1310 } else {
1311 uint8_t op0;
1312 uint8_t op1;
1313 uint8_t data8;
1314 int reg;
1315 int operator;
1316 #ifdef DEBUG_LSI
1317 static const char *opcode_names[3] =
1318 {"Write", "Read", "Read-Modify-Write"};
1319 static const char *operator_names[8] =
1320 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1321 #endif
1322
1323 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1324 data8 = (insn >> 8) & 0xff;
1325 opcode = (insn >> 27) & 7;
1326 operator = (insn >> 24) & 7;
1327 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1328 opcode_names[opcode - 5], reg,
1329 operator_names[operator], data8, s->sfbr,
1330 (insn & (1 << 23)) ? " SFBR" : "");
1331 op0 = op1 = 0;
1332 switch (opcode) {
1333 case 5: /* From SFBR */
1334 op0 = s->sfbr;
1335 op1 = data8;
1336 break;
1337 case 6: /* To SFBR */
1338 if (operator)
1339 op0 = lsi_reg_readb(s, reg);
1340 op1 = data8;
1341 break;
1342 case 7: /* Read-modify-write */
1343 if (operator)
1344 op0 = lsi_reg_readb(s, reg);
1345 if (insn & (1 << 23)) {
1346 op1 = s->sfbr;
1347 } else {
1348 op1 = data8;
1349 }
1350 break;
1351 }
1352
1353 switch (operator) {
1354 case 0: /* move */
1355 op0 = op1;
1356 break;
1357 case 1: /* Shift left */
1358 op1 = op0 >> 7;
1359 op0 = (op0 << 1) | s->carry;
1360 s->carry = op1;
1361 break;
1362 case 2: /* OR */
1363 op0 |= op1;
1364 break;
1365 case 3: /* XOR */
1366 op0 ^= op1;
1367 break;
1368 case 4: /* AND */
1369 op0 &= op1;
1370 break;
1371 case 5: /* SHR */
1372 op1 = op0 & 1;
1373 op0 = (op0 >> 1) | (s->carry << 7);
1374 s->carry = op1;
1375 break;
1376 case 6: /* ADD */
1377 op0 += op1;
1378 s->carry = op0 < op1;
1379 break;
1380 case 7: /* ADC */
1381 op0 += op1 + s->carry;
1382 if (s->carry)
1383 s->carry = op0 <= op1;
1384 else
1385 s->carry = op0 < op1;
1386 break;
1387 }
1388
1389 switch (opcode) {
1390 case 5: /* From SFBR */
1391 case 7: /* Read-modify-write */
1392 lsi_reg_writeb(s, reg, op0);
1393 break;
1394 case 6: /* To SFBR */
1395 s->sfbr = op0;
1396 break;
1397 }
1398 }
1399 break;
1400
1401 case 2: /* Transfer Control. */
1402 {
1403 int cond;
1404 int jmp;
1405
1406 if ((insn & 0x002e0000) == 0) {
1407 DPRINTF("NOP\n");
1408 break;
1409 }
1410 if (s->sist1 & LSI_SIST1_STO) {
1411 DPRINTF("Delayed select timeout\n");
1412 lsi_stop_script(s);
1413 break;
1414 }
1415 cond = jmp = (insn & (1 << 19)) != 0;
1416 if (cond == jmp && (insn & (1 << 21))) {
1417 DPRINTF("Compare carry %d\n", s->carry == jmp);
1418 cond = s->carry != 0;
1419 }
1420 if (cond == jmp && (insn & (1 << 17))) {
1421 DPRINTF("Compare phase %d %c= %d\n",
1422 (s->sstat1 & PHASE_MASK),
1423 jmp ? '=' : '!',
1424 ((insn >> 24) & 7));
1425 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1426 }
1427 if (cond == jmp && (insn & (1 << 18))) {
1428 uint8_t mask;
1429
1430 mask = (~insn >> 8) & 0xff;
1431 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1432 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1433 cond = (s->sfbr & mask) == (insn & mask);
1434 }
1435 if (cond == jmp) {
1436 if (insn & (1 << 23)) {
1437 /* Relative address. */
1438 addr = s->dsp + sextract32(addr, 0, 24);
1439 }
1440 switch ((insn >> 27) & 7) {
1441 case 0: /* Jump */
1442 DPRINTF("Jump to 0x%08x\n", addr);
1443 s->adder = addr;
1444 s->dsp = addr;
1445 break;
1446 case 1: /* Call */
1447 DPRINTF("Call 0x%08x\n", addr);
1448 s->temp = s->dsp;
1449 s->dsp = addr;
1450 break;
1451 case 2: /* Return */
1452 DPRINTF("Return to 0x%08x\n", s->temp);
1453 s->dsp = s->temp;
1454 break;
1455 case 3: /* Interrupt */
1456 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1457 if ((insn & (1 << 20)) != 0) {
1458 s->istat0 |= LSI_ISTAT0_INTF;
1459 lsi_update_irq(s);
1460 } else {
1461 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1462 }
1463 break;
1464 default:
1465 DPRINTF("Illegal transfer control\n");
1466 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1467 break;
1468 }
1469 } else {
1470 DPRINTF("Control condition failed\n");
1471 }
1472 }
1473 break;
1474
1475 case 3:
1476 if ((insn & (1 << 29)) == 0) {
1477 /* Memory move. */
1478 uint32_t dest;
1479 /* ??? The docs imply the destination address is loaded into
1480 the TEMP register. However the Linux drivers rely on
1481 the value being presrved. */
1482 dest = read_dword(s, s->dsp);
1483 s->dsp += 4;
1484 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1485 } else {
1486 uint8_t data[7];
1487 int reg;
1488 int n;
1489 int i;
1490
1491 if (insn & (1 << 28)) {
1492 addr = s->dsa + sextract32(addr, 0, 24);
1493 }
1494 n = (insn & 7);
1495 reg = (insn >> 16) & 0xff;
1496 if (insn & (1 << 24)) {
1497 pci_dma_read(pci_dev, addr, data, n);
1498 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1499 addr, *(int *)data);
1500 for (i = 0; i < n; i++) {
1501 lsi_reg_writeb(s, reg + i, data[i]);
1502 }
1503 } else {
1504 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1505 for (i = 0; i < n; i++) {
1506 data[i] = lsi_reg_readb(s, reg + i);
1507 }
1508 pci_dma_write(pci_dev, addr, data, n);
1509 }
1510 }
1511 }
1512 if (insn_processed > 10000 && !s->waiting) {
1513 /* Some windows drivers make the device spin waiting for a memory
1514 location to change. If we have been executed a lot of code then
1515 assume this is the case and force an unexpected device disconnect.
1516 This is apparently sufficient to beat the drivers into submission.
1517 */
1518 if (!(s->sien0 & LSI_SIST0_UDC))
1519 fprintf(stderr, "inf. loop with UDC masked\n");
1520 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1521 lsi_disconnect(s);
1522 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1523 if (s->dcntl & LSI_DCNTL_SSM) {
1524 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1525 } else {
1526 goto again;
1527 }
1528 }
1529 DPRINTF("SCRIPTS execution stopped\n");
1530 }
1531
1532 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1533 {
1534 uint8_t ret;
1535
1536 #define CASE_GET_REG24(name, addr) \
1537 case addr: ret = s->name & 0xff; break; \
1538 case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1539 case addr + 2: ret = (s->name >> 16) & 0xff; break;
1540
1541 #define CASE_GET_REG32(name, addr) \
1542 case addr: ret = s->name & 0xff; break; \
1543 case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1544 case addr + 2: ret = (s->name >> 16) & 0xff; break; \
1545 case addr + 3: ret = (s->name >> 24) & 0xff; break;
1546
1547 switch (offset) {
1548 case 0x00: /* SCNTL0 */
1549 ret = s->scntl0;
1550 break;
1551 case 0x01: /* SCNTL1 */
1552 ret = s->scntl1;
1553 break;
1554 case 0x02: /* SCNTL2 */
1555 ret = s->scntl2;
1556 break;
1557 case 0x03: /* SCNTL3 */
1558 ret = s->scntl3;
1559 break;
1560 case 0x04: /* SCID */
1561 ret = s->scid;
1562 break;
1563 case 0x05: /* SXFER */
1564 ret = s->sxfer;
1565 break;
1566 case 0x06: /* SDID */
1567 ret = s->sdid;
1568 break;
1569 case 0x07: /* GPREG0 */
1570 ret = 0x7f;
1571 break;
1572 case 0x08: /* Revision ID */
1573 ret = 0x00;
1574 break;
1575 case 0x09: /* SOCL */
1576 ret = s->socl;
1577 break;
1578 case 0xa: /* SSID */
1579 ret = s->ssid;
1580 break;
1581 case 0xb: /* SBCL */
1582 /* ??? This is not correct. However it's (hopefully) only
1583 used for diagnostics, so should be ok. */
1584 ret = 0;
1585 break;
1586 case 0xc: /* DSTAT */
1587 ret = s->dstat | LSI_DSTAT_DFE;
1588 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1589 s->dstat = 0;
1590 lsi_update_irq(s);
1591 break;
1592 case 0x0d: /* SSTAT0 */
1593 ret = s->sstat0;
1594 break;
1595 case 0x0e: /* SSTAT1 */
1596 ret = s->sstat1;
1597 break;
1598 case 0x0f: /* SSTAT2 */
1599 ret = s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1600 break;
1601 CASE_GET_REG32(dsa, 0x10)
1602 case 0x14: /* ISTAT0 */
1603 ret = s->istat0;
1604 break;
1605 case 0x15: /* ISTAT1 */
1606 ret = s->istat1;
1607 break;
1608 case 0x16: /* MBOX0 */
1609 ret = s->mbox0;
1610 break;
1611 case 0x17: /* MBOX1 */
1612 ret = s->mbox1;
1613 break;
1614 case 0x18: /* CTEST0 */
1615 ret = 0xff;
1616 break;
1617 case 0x19: /* CTEST1 */
1618 ret = 0;
1619 break;
1620 case 0x1a: /* CTEST2 */
1621 ret = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1622 if (s->istat0 & LSI_ISTAT0_SIGP) {
1623 s->istat0 &= ~LSI_ISTAT0_SIGP;
1624 ret |= LSI_CTEST2_SIGP;
1625 }
1626 break;
1627 case 0x1b: /* CTEST3 */
1628 ret = s->ctest3;
1629 break;
1630 CASE_GET_REG32(temp, 0x1c)
1631 case 0x20: /* DFIFO */
1632 ret = 0;
1633 break;
1634 case 0x21: /* CTEST4 */
1635 ret = s->ctest4;
1636 break;
1637 case 0x22: /* CTEST5 */
1638 ret = s->ctest5;
1639 break;
1640 case 0x23: /* CTEST6 */
1641 ret = 0;
1642 break;
1643 CASE_GET_REG24(dbc, 0x24)
1644 case 0x27: /* DCMD */
1645 ret = s->dcmd;
1646 break;
1647 CASE_GET_REG32(dnad, 0x28)
1648 CASE_GET_REG32(dsp, 0x2c)
1649 CASE_GET_REG32(dsps, 0x30)
1650 CASE_GET_REG32(scratch[0], 0x34)
1651 case 0x38: /* DMODE */
1652 ret = s->dmode;
1653 break;
1654 case 0x39: /* DIEN */
1655 ret = s->dien;
1656 break;
1657 case 0x3a: /* SBR */
1658 ret = s->sbr;
1659 break;
1660 case 0x3b: /* DCNTL */
1661 ret = s->dcntl;
1662 break;
1663 /* ADDER Output (Debug of relative jump address) */
1664 CASE_GET_REG32(adder, 0x3c)
1665 case 0x40: /* SIEN0 */
1666 ret = s->sien0;
1667 break;
1668 case 0x41: /* SIEN1 */
1669 ret = s->sien1;
1670 break;
1671 case 0x42: /* SIST0 */
1672 ret = s->sist0;
1673 s->sist0 = 0;
1674 lsi_update_irq(s);
1675 break;
1676 case 0x43: /* SIST1 */
1677 ret = s->sist1;
1678 s->sist1 = 0;
1679 lsi_update_irq(s);
1680 break;
1681 case 0x46: /* MACNTL */
1682 ret = 0x0f;
1683 break;
1684 case 0x47: /* GPCNTL0 */
1685 ret = 0x0f;
1686 break;
1687 case 0x48: /* STIME0 */
1688 ret = s->stime0;
1689 break;
1690 case 0x4a: /* RESPID0 */
1691 ret = s->respid0;
1692 break;
1693 case 0x4b: /* RESPID1 */
1694 ret = s->respid1;
1695 break;
1696 case 0x4d: /* STEST1 */
1697 ret = s->stest1;
1698 break;
1699 case 0x4e: /* STEST2 */
1700 ret = s->stest2;
1701 break;
1702 case 0x4f: /* STEST3 */
1703 ret = s->stest3;
1704 break;
1705 case 0x50: /* SIDL */
1706 /* This is needed by the linux drivers. We currently only update it
1707 during the MSG IN phase. */
1708 ret = s->sidl;
1709 break;
1710 case 0x52: /* STEST4 */
1711 ret = 0xe0;
1712 break;
1713 case 0x56: /* CCNTL0 */
1714 ret = s->ccntl0;
1715 break;
1716 case 0x57: /* CCNTL1 */
1717 ret = s->ccntl1;
1718 break;
1719 case 0x58: /* SBDL */
1720 /* Some drivers peek at the data bus during the MSG IN phase. */
1721 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1722 return s->msg[0];
1723 ret = 0;
1724 break;
1725 case 0x59: /* SBDL high */
1726 ret = 0;
1727 break;
1728 CASE_GET_REG32(mmrs, 0xa0)
1729 CASE_GET_REG32(mmws, 0xa4)
1730 CASE_GET_REG32(sfs, 0xa8)
1731 CASE_GET_REG32(drs, 0xac)
1732 CASE_GET_REG32(sbms, 0xb0)
1733 CASE_GET_REG32(dbms, 0xb4)
1734 CASE_GET_REG32(dnad64, 0xb8)
1735 CASE_GET_REG32(pmjad1, 0xc0)
1736 CASE_GET_REG32(pmjad2, 0xc4)
1737 CASE_GET_REG32(rbc, 0xc8)
1738 CASE_GET_REG32(ua, 0xcc)
1739 CASE_GET_REG32(ia, 0xd4)
1740 CASE_GET_REG32(sbc, 0xd8)
1741 CASE_GET_REG32(csbc, 0xdc)
1742 case 0x5c ... 0x9f:
1743 {
1744 int n;
1745 int shift;
1746 n = (offset - 0x58) >> 2;
1747 shift = (offset & 3) * 8;
1748 ret = (s->scratch[n] >> shift) & 0xff;
1749 break;
1750 }
1751 default:
1752 {
1753 qemu_log_mask(LOG_GUEST_ERROR,
1754 "lsi_scsi: invalid read from reg %s %x\n",
1755 offset < ARRAY_SIZE(names) ? names[offset] : "???",
1756 offset);
1757 ret = 0xff;
1758 break;
1759 }
1760 }
1761 #undef CASE_GET_REG24
1762 #undef CASE_GET_REG32
1763
1764 #ifdef DEBUG_LSI_REG
1765 DPRINTF("Read reg %s %x = %02x\n",
1766 offset < ARRAY_SIZE(names) ? names[offset] : "???", offset, ret);
1767 #endif
1768
1769 return ret;
1770 }
1771
1772 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1773 {
1774 #define CASE_SET_REG24(name, addr) \
1775 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1776 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1777 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1778
1779 #define CASE_SET_REG32(name, addr) \
1780 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1781 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1782 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1783 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1784
1785 #ifdef DEBUG_LSI_REG
1786 DPRINTF("Write reg %s %x = %02x\n",
1787 offset < ARRAY_SIZE(names) ? names[offset] : "???", offset, val);
1788 #endif
1789 switch (offset) {
1790 case 0x00: /* SCNTL0 */
1791 s->scntl0 = val;
1792 if (val & LSI_SCNTL0_START) {
1793 BADF("Start sequence not implemented\n");
1794 }
1795 break;
1796 case 0x01: /* SCNTL1 */
1797 s->scntl1 = val & ~LSI_SCNTL1_SST;
1798 if (val & LSI_SCNTL1_IARB) {
1799 BADF("Immediate Arbritration not implemented\n");
1800 }
1801 if (val & LSI_SCNTL1_RST) {
1802 if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1803 qbus_reset_all(&s->bus.qbus);
1804 s->sstat0 |= LSI_SSTAT0_RST;
1805 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1806 }
1807 } else {
1808 s->sstat0 &= ~LSI_SSTAT0_RST;
1809 }
1810 break;
1811 case 0x02: /* SCNTL2 */
1812 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1813 s->scntl2 = val;
1814 break;
1815 case 0x03: /* SCNTL3 */
1816 s->scntl3 = val;
1817 break;
1818 case 0x04: /* SCID */
1819 s->scid = val;
1820 break;
1821 case 0x05: /* SXFER */
1822 s->sxfer = val;
1823 break;
1824 case 0x06: /* SDID */
1825 if ((s->ssid & 0x80) && (val & 0xf) != (s->ssid & 0xf)) {
1826 BADF("Destination ID does not match SSID\n");
1827 }
1828 s->sdid = val & 0xf;
1829 break;
1830 case 0x07: /* GPREG0 */
1831 break;
1832 case 0x08: /* SFBR */
1833 /* The CPU is not allowed to write to this register. However the
1834 SCRIPTS register move instructions are. */
1835 s->sfbr = val;
1836 break;
1837 case 0x0a: case 0x0b:
1838 /* Openserver writes to these readonly registers on startup */
1839 return;
1840 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1841 /* Linux writes to these readonly registers on startup. */
1842 return;
1843 CASE_SET_REG32(dsa, 0x10)
1844 case 0x14: /* ISTAT0 */
1845 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1846 if (val & LSI_ISTAT0_ABRT) {
1847 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1848 }
1849 if (val & LSI_ISTAT0_INTF) {
1850 s->istat0 &= ~LSI_ISTAT0_INTF;
1851 lsi_update_irq(s);
1852 }
1853 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1854 DPRINTF("Woken by SIGP\n");
1855 s->waiting = 0;
1856 s->dsp = s->dnad;
1857 lsi_execute_script(s);
1858 }
1859 if (val & LSI_ISTAT0_SRST) {
1860 qdev_reset_all(DEVICE(s));
1861 }
1862 break;
1863 case 0x16: /* MBOX0 */
1864 s->mbox0 = val;
1865 break;
1866 case 0x17: /* MBOX1 */
1867 s->mbox1 = val;
1868 break;
1869 case 0x18: /* CTEST0 */
1870 /* nothing to do */
1871 break;
1872 case 0x1a: /* CTEST2 */
1873 s->ctest2 = val & LSI_CTEST2_PCICIE;
1874 break;
1875 case 0x1b: /* CTEST3 */
1876 s->ctest3 = val & 0x0f;
1877 break;
1878 CASE_SET_REG32(temp, 0x1c)
1879 case 0x21: /* CTEST4 */
1880 if (val & 7) {
1881 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1882 }
1883 s->ctest4 = val;
1884 break;
1885 case 0x22: /* CTEST5 */
1886 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1887 BADF("CTEST5 DMA increment not implemented\n");
1888 }
1889 s->ctest5 = val;
1890 break;
1891 CASE_SET_REG24(dbc, 0x24)
1892 CASE_SET_REG32(dnad, 0x28)
1893 case 0x2c: /* DSP[0:7] */
1894 s->dsp &= 0xffffff00;
1895 s->dsp |= val;
1896 break;
1897 case 0x2d: /* DSP[8:15] */
1898 s->dsp &= 0xffff00ff;
1899 s->dsp |= val << 8;
1900 break;
1901 case 0x2e: /* DSP[16:23] */
1902 s->dsp &= 0xff00ffff;
1903 s->dsp |= val << 16;
1904 break;
1905 case 0x2f: /* DSP[24:31] */
1906 s->dsp &= 0x00ffffff;
1907 s->dsp |= val << 24;
1908 if ((s->dmode & LSI_DMODE_MAN) == 0
1909 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1910 lsi_execute_script(s);
1911 break;
1912 CASE_SET_REG32(dsps, 0x30)
1913 CASE_SET_REG32(scratch[0], 0x34)
1914 case 0x38: /* DMODE */
1915 s->dmode = val;
1916 break;
1917 case 0x39: /* DIEN */
1918 s->dien = val;
1919 lsi_update_irq(s);
1920 break;
1921 case 0x3a: /* SBR */
1922 s->sbr = val;
1923 break;
1924 case 0x3b: /* DCNTL */
1925 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1926 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1927 lsi_execute_script(s);
1928 break;
1929 case 0x40: /* SIEN0 */
1930 s->sien0 = val;
1931 lsi_update_irq(s);
1932 break;
1933 case 0x41: /* SIEN1 */
1934 s->sien1 = val;
1935 lsi_update_irq(s);
1936 break;
1937 case 0x47: /* GPCNTL0 */
1938 break;
1939 case 0x48: /* STIME0 */
1940 s->stime0 = val;
1941 break;
1942 case 0x49: /* STIME1 */
1943 if (val & 0xf) {
1944 DPRINTF("General purpose timer not implemented\n");
1945 /* ??? Raising the interrupt immediately seems to be sufficient
1946 to keep the FreeBSD driver happy. */
1947 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1948 }
1949 break;
1950 case 0x4a: /* RESPID0 */
1951 s->respid0 = val;
1952 break;
1953 case 0x4b: /* RESPID1 */
1954 s->respid1 = val;
1955 break;
1956 case 0x4d: /* STEST1 */
1957 s->stest1 = val;
1958 break;
1959 case 0x4e: /* STEST2 */
1960 if (val & 1) {
1961 BADF("Low level mode not implemented\n");
1962 }
1963 s->stest2 = val;
1964 break;
1965 case 0x4f: /* STEST3 */
1966 if (val & 0x41) {
1967 BADF("SCSI FIFO test mode not implemented\n");
1968 }
1969 s->stest3 = val;
1970 break;
1971 case 0x56: /* CCNTL0 */
1972 s->ccntl0 = val;
1973 break;
1974 case 0x57: /* CCNTL1 */
1975 s->ccntl1 = val;
1976 break;
1977 CASE_SET_REG32(mmrs, 0xa0)
1978 CASE_SET_REG32(mmws, 0xa4)
1979 CASE_SET_REG32(sfs, 0xa8)
1980 CASE_SET_REG32(drs, 0xac)
1981 CASE_SET_REG32(sbms, 0xb0)
1982 CASE_SET_REG32(dbms, 0xb4)
1983 CASE_SET_REG32(dnad64, 0xb8)
1984 CASE_SET_REG32(pmjad1, 0xc0)
1985 CASE_SET_REG32(pmjad2, 0xc4)
1986 CASE_SET_REG32(rbc, 0xc8)
1987 CASE_SET_REG32(ua, 0xcc)
1988 CASE_SET_REG32(ia, 0xd4)
1989 CASE_SET_REG32(sbc, 0xd8)
1990 CASE_SET_REG32(csbc, 0xdc)
1991 default:
1992 if (offset >= 0x5c && offset < 0xa0) {
1993 int n;
1994 int shift;
1995 n = (offset - 0x58) >> 2;
1996 shift = (offset & 3) * 8;
1997 s->scratch[n] = deposit32(s->scratch[n], shift, 8, val);
1998 } else {
1999 qemu_log_mask(LOG_GUEST_ERROR,
2000 "lsi_scsi: invalid write to reg %s %x (0x%02x)\n",
2001 offset < ARRAY_SIZE(names) ? names[offset] : "???",
2002 offset, val);
2003 }
2004 }
2005 #undef CASE_SET_REG24
2006 #undef CASE_SET_REG32
2007 }
2008
2009 static void lsi_mmio_write(void *opaque, hwaddr addr,
2010 uint64_t val, unsigned size)
2011 {
2012 LSIState *s = opaque;
2013
2014 lsi_reg_writeb(s, addr & 0xff, val);
2015 }
2016
2017 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr,
2018 unsigned size)
2019 {
2020 LSIState *s = opaque;
2021
2022 return lsi_reg_readb(s, addr & 0xff);
2023 }
2024
2025 static const MemoryRegionOps lsi_mmio_ops = {
2026 .read = lsi_mmio_read,
2027 .write = lsi_mmio_write,
2028 .endianness = DEVICE_NATIVE_ENDIAN,
2029 .impl = {
2030 .min_access_size = 1,
2031 .max_access_size = 1,
2032 },
2033 };
2034
2035 static void lsi_ram_write(void *opaque, hwaddr addr,
2036 uint64_t val, unsigned size)
2037 {
2038 LSIState *s = opaque;
2039 uint32_t newval;
2040 uint32_t mask;
2041 int shift;
2042
2043 newval = s->script_ram[addr >> 2];
2044 shift = (addr & 3) * 8;
2045 mask = ((uint64_t)1 << (size * 8)) - 1;
2046 newval &= ~(mask << shift);
2047 newval |= val << shift;
2048 s->script_ram[addr >> 2] = newval;
2049 }
2050
2051 static uint64_t lsi_ram_read(void *opaque, hwaddr addr,
2052 unsigned size)
2053 {
2054 LSIState *s = opaque;
2055 uint32_t val;
2056 uint32_t mask;
2057
2058 val = s->script_ram[addr >> 2];
2059 mask = ((uint64_t)1 << (size * 8)) - 1;
2060 val >>= (addr & 3) * 8;
2061 return val & mask;
2062 }
2063
2064 static const MemoryRegionOps lsi_ram_ops = {
2065 .read = lsi_ram_read,
2066 .write = lsi_ram_write,
2067 .endianness = DEVICE_NATIVE_ENDIAN,
2068 };
2069
2070 static uint64_t lsi_io_read(void *opaque, hwaddr addr,
2071 unsigned size)
2072 {
2073 LSIState *s = opaque;
2074 return lsi_reg_readb(s, addr & 0xff);
2075 }
2076
2077 static void lsi_io_write(void *opaque, hwaddr addr,
2078 uint64_t val, unsigned size)
2079 {
2080 LSIState *s = opaque;
2081 lsi_reg_writeb(s, addr & 0xff, val);
2082 }
2083
2084 static const MemoryRegionOps lsi_io_ops = {
2085 .read = lsi_io_read,
2086 .write = lsi_io_write,
2087 .endianness = DEVICE_NATIVE_ENDIAN,
2088 .impl = {
2089 .min_access_size = 1,
2090 .max_access_size = 1,
2091 },
2092 };
2093
2094 static void lsi_scsi_reset(DeviceState *dev)
2095 {
2096 LSIState *s = LSI53C895A(dev);
2097
2098 lsi_soft_reset(s);
2099 }
2100
2101 static int lsi_pre_save(void *opaque)
2102 {
2103 LSIState *s = opaque;
2104
2105 if (s->current) {
2106 assert(s->current->dma_buf == NULL);
2107 assert(s->current->dma_len == 0);
2108 }
2109 assert(QTAILQ_EMPTY(&s->queue));
2110
2111 return 0;
2112 }
2113
2114 static const VMStateDescription vmstate_lsi_scsi = {
2115 .name = "lsiscsi",
2116 .version_id = 0,
2117 .minimum_version_id = 0,
2118 .pre_save = lsi_pre_save,
2119 .fields = (VMStateField[]) {
2120 VMSTATE_PCI_DEVICE(parent_obj, LSIState),
2121
2122 VMSTATE_INT32(carry, LSIState),
2123 VMSTATE_INT32(status, LSIState),
2124 VMSTATE_INT32(msg_action, LSIState),
2125 VMSTATE_INT32(msg_len, LSIState),
2126 VMSTATE_BUFFER(msg, LSIState),
2127 VMSTATE_INT32(waiting, LSIState),
2128
2129 VMSTATE_UINT32(dsa, LSIState),
2130 VMSTATE_UINT32(temp, LSIState),
2131 VMSTATE_UINT32(dnad, LSIState),
2132 VMSTATE_UINT32(dbc, LSIState),
2133 VMSTATE_UINT8(istat0, LSIState),
2134 VMSTATE_UINT8(istat1, LSIState),
2135 VMSTATE_UINT8(dcmd, LSIState),
2136 VMSTATE_UINT8(dstat, LSIState),
2137 VMSTATE_UINT8(dien, LSIState),
2138 VMSTATE_UINT8(sist0, LSIState),
2139 VMSTATE_UINT8(sist1, LSIState),
2140 VMSTATE_UINT8(sien0, LSIState),
2141 VMSTATE_UINT8(sien1, LSIState),
2142 VMSTATE_UINT8(mbox0, LSIState),
2143 VMSTATE_UINT8(mbox1, LSIState),
2144 VMSTATE_UINT8(dfifo, LSIState),
2145 VMSTATE_UINT8(ctest2, LSIState),
2146 VMSTATE_UINT8(ctest3, LSIState),
2147 VMSTATE_UINT8(ctest4, LSIState),
2148 VMSTATE_UINT8(ctest5, LSIState),
2149 VMSTATE_UINT8(ccntl0, LSIState),
2150 VMSTATE_UINT8(ccntl1, LSIState),
2151 VMSTATE_UINT32(dsp, LSIState),
2152 VMSTATE_UINT32(dsps, LSIState),
2153 VMSTATE_UINT8(dmode, LSIState),
2154 VMSTATE_UINT8(dcntl, LSIState),
2155 VMSTATE_UINT8(scntl0, LSIState),
2156 VMSTATE_UINT8(scntl1, LSIState),
2157 VMSTATE_UINT8(scntl2, LSIState),
2158 VMSTATE_UINT8(scntl3, LSIState),
2159 VMSTATE_UINT8(sstat0, LSIState),
2160 VMSTATE_UINT8(sstat1, LSIState),
2161 VMSTATE_UINT8(scid, LSIState),
2162 VMSTATE_UINT8(sxfer, LSIState),
2163 VMSTATE_UINT8(socl, LSIState),
2164 VMSTATE_UINT8(sdid, LSIState),
2165 VMSTATE_UINT8(ssid, LSIState),
2166 VMSTATE_UINT8(sfbr, LSIState),
2167 VMSTATE_UINT8(stest1, LSIState),
2168 VMSTATE_UINT8(stest2, LSIState),
2169 VMSTATE_UINT8(stest3, LSIState),
2170 VMSTATE_UINT8(sidl, LSIState),
2171 VMSTATE_UINT8(stime0, LSIState),
2172 VMSTATE_UINT8(respid0, LSIState),
2173 VMSTATE_UINT8(respid1, LSIState),
2174 VMSTATE_UINT32(mmrs, LSIState),
2175 VMSTATE_UINT32(mmws, LSIState),
2176 VMSTATE_UINT32(sfs, LSIState),
2177 VMSTATE_UINT32(drs, LSIState),
2178 VMSTATE_UINT32(sbms, LSIState),
2179 VMSTATE_UINT32(dbms, LSIState),
2180 VMSTATE_UINT32(dnad64, LSIState),
2181 VMSTATE_UINT32(pmjad1, LSIState),
2182 VMSTATE_UINT32(pmjad2, LSIState),
2183 VMSTATE_UINT32(rbc, LSIState),
2184 VMSTATE_UINT32(ua, LSIState),
2185 VMSTATE_UINT32(ia, LSIState),
2186 VMSTATE_UINT32(sbc, LSIState),
2187 VMSTATE_UINT32(csbc, LSIState),
2188 VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2189 VMSTATE_UINT8(sbr, LSIState),
2190
2191 VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2192 VMSTATE_END_OF_LIST()
2193 }
2194 };
2195
2196 static const struct SCSIBusInfo lsi_scsi_info = {
2197 .tcq = true,
2198 .max_target = LSI_MAX_DEVS,
2199 .max_lun = 0, /* LUN support is buggy */
2200
2201 .transfer_data = lsi_transfer_data,
2202 .complete = lsi_command_complete,
2203 .cancel = lsi_request_cancelled
2204 };
2205
2206 static void lsi_scsi_realize(PCIDevice *dev, Error **errp)
2207 {
2208 LSIState *s = LSI53C895A(dev);
2209 DeviceState *d = DEVICE(dev);
2210 uint8_t *pci_conf;
2211
2212 pci_conf = dev->config;
2213
2214 /* PCI latency timer = 255 */
2215 pci_conf[PCI_LATENCY_TIMER] = 0xff;
2216 /* Interrupt pin A */
2217 pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2218
2219 memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
2220 "lsi-mmio", 0x400);
2221 memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
2222 "lsi-ram", 0x2000);
2223 memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
2224 "lsi-io", 256);
2225
2226 address_space_init(&s->pci_io_as, pci_address_space_io(dev), "lsi-pci-io");
2227 qdev_init_gpio_out(d, &s->ext_irq, 1);
2228
2229 pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2230 pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio_io);
2231 pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2232 QTAILQ_INIT(&s->queue);
2233
2234 scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL);
2235 }
2236
2237 static void lsi_scsi_unrealize(DeviceState *dev, Error **errp)
2238 {
2239 LSIState *s = LSI53C895A(dev);
2240
2241 address_space_destroy(&s->pci_io_as);
2242 }
2243
2244 static void lsi_class_init(ObjectClass *klass, void *data)
2245 {
2246 DeviceClass *dc = DEVICE_CLASS(klass);
2247 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2248
2249 k->realize = lsi_scsi_realize;
2250 k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2251 k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2252 k->class_id = PCI_CLASS_STORAGE_SCSI;
2253 k->subsystem_id = 0x1000;
2254 dc->unrealize = lsi_scsi_unrealize;
2255 dc->reset = lsi_scsi_reset;
2256 dc->vmsd = &vmstate_lsi_scsi;
2257 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2258 }
2259
2260 static const TypeInfo lsi_info = {
2261 .name = TYPE_LSI53C895A,
2262 .parent = TYPE_PCI_DEVICE,
2263 .instance_size = sizeof(LSIState),
2264 .class_init = lsi_class_init,
2265 .interfaces = (InterfaceInfo[]) {
2266 { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2267 { },
2268 },
2269 };
2270
2271 static void lsi53c810_class_init(ObjectClass *klass, void *data)
2272 {
2273 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2274
2275 k->device_id = PCI_DEVICE_ID_LSI_53C810;
2276 }
2277
2278 static TypeInfo lsi53c810_info = {
2279 .name = TYPE_LSI53C810,
2280 .parent = TYPE_LSI53C895A,
2281 .class_init = lsi53c810_class_init,
2282 };
2283
2284 static void lsi53c895a_register_types(void)
2285 {
2286 type_register_static(&lsi_info);
2287 type_register_static(&lsi53c810_info);
2288 }
2289
2290 type_init(lsi53c895a_register_types)
2291
2292 void lsi53c8xx_handle_legacy_cmdline(DeviceState *lsi_dev)
2293 {
2294 LSIState *s = LSI53C895A(lsi_dev);
2295
2296 scsi_bus_legacy_handle_cmdline(&s->bus);
2297 }
AR7 emulation for QEMU