1 /*

     2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation

     3  *

     4  * Copyright (c) 2006 CodeSourcery.

     5  * Written by Paul Brook

     6  *

     7  * This code is licenced under the LGPL.

     8  */

     9 

    10 /* ??? Need to check if the {read,write}[wl] routines work properly on

    11    big-endian targets.  */

    12 

    13 #include "hw.h"

    14 #include "pci.h"

    15 #include "scsi-disk.h"

    16 

    17 //#define DEBUG_LSI

    18 //#define DEBUG_LSI_REG

    19 

    20 #ifdef DEBUG_LSI

    21 #define DPRINTF(fmt, args...) \

    22 do { printf("lsi_scsi: " fmt , ##args); } while (0)

    23 #define BADF(fmt, args...) \

    24 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)

    25 #else

    26 #define DPRINTF(fmt, args...) do {} while(0)

    27 #define BADF(fmt, args...) \

    28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)

    29 #endif

    30 

    31 #define LSI_SCNTL0_TRG    0x01

    32 #define LSI_SCNTL0_AAP    0x02

    33 #define LSI_SCNTL0_EPC    0x08

    34 #define LSI_SCNTL0_WATN   0x10

    35 #define LSI_SCNTL0_START  0x20

    36 

    37 #define LSI_SCNTL1_SST    0x01

    38 #define LSI_SCNTL1_IARB   0x02

    39 #define LSI_SCNTL1_AESP   0x04

    40 #define LSI_SCNTL1_RST    0x08

    41 #define LSI_SCNTL1_CON    0x10

    42 #define LSI_SCNTL1_DHP    0x20

    43 #define LSI_SCNTL1_ADB    0x40

    44 #define LSI_SCNTL1_EXC    0x80

    45 

    46 #define LSI_SCNTL2_WSR    0x01

    47 #define LSI_SCNTL2_VUE0   0x02

    48 #define LSI_SCNTL2_VUE1   0x04

    49 #define LSI_SCNTL2_WSS    0x08

    50 #define LSI_SCNTL2_SLPHBEN 0x10

    51 #define LSI_SCNTL2_SLPMD  0x20

    52 #define LSI_SCNTL2_CHM    0x40

    53 #define LSI_SCNTL2_SDU    0x80

    54 

    55 #define LSI_ISTAT0_DIP    0x01

    56 #define LSI_ISTAT0_SIP    0x02

    57 #define LSI_ISTAT0_INTF   0x04

    58 #define LSI_ISTAT0_CON    0x08

    59 #define LSI_ISTAT0_SEM    0x10

    60 #define LSI_ISTAT0_SIGP   0x20

    61 #define LSI_ISTAT0_SRST   0x40

    62 #define LSI_ISTAT0_ABRT   0x80

    63 

    64 #define LSI_ISTAT1_SI     0x01

    65 #define LSI_ISTAT1_SRUN   0x02

    66 #define LSI_ISTAT1_FLSH   0x04

    67 

    68 #define LSI_SSTAT0_SDP0   0x01

    69 #define LSI_SSTAT0_RST    0x02

    70 #define LSI_SSTAT0_WOA    0x04

    71 #define LSI_SSTAT0_LOA    0x08

    72 #define LSI_SSTAT0_AIP    0x10

    73 #define LSI_SSTAT0_OLF    0x20

    74 #define LSI_SSTAT0_ORF    0x40

    75 #define LSI_SSTAT0_ILF    0x80

    76 

    77 #define LSI_SIST0_PAR     0x01

    78 #define LSI_SIST0_RST     0x02

    79 #define LSI_SIST0_UDC     0x04

    80 #define LSI_SIST0_SGE     0x08

    81 #define LSI_SIST0_RSL     0x10

    82 #define LSI_SIST0_SEL     0x20

    83 #define LSI_SIST0_CMP     0x40

    84 #define LSI_SIST0_MA      0x80

    85 

    86 #define LSI_SIST1_HTH     0x01

    87 #define LSI_SIST1_GEN     0x02

    88 #define LSI_SIST1_STO     0x04

    89 #define LSI_SIST1_SBMC    0x10

    90 

    91 #define LSI_SOCL_IO       0x01

    92 #define LSI_SOCL_CD       0x02

    93 #define LSI_SOCL_MSG      0x04

    94 #define LSI_SOCL_ATN      0x08

    95 #define LSI_SOCL_SEL      0x10

    96 #define LSI_SOCL_BSY      0x20

    97 #define LSI_SOCL_ACK      0x40

    98 #define LSI_SOCL_REQ      0x80

    99 

   100 #define LSI_DSTAT_IID     0x01

   101 #define LSI_DSTAT_SIR     0x04

   102 #define LSI_DSTAT_SSI     0x08

   103 #define LSI_DSTAT_ABRT    0x10

   104 #define LSI_DSTAT_BF      0x20

   105 #define LSI_DSTAT_MDPE    0x40

   106 #define LSI_DSTAT_DFE     0x80

   107 

   108 #define LSI_DCNTL_COM     0x01

   109 #define LSI_DCNTL_IRQD    0x02

   110 #define LSI_DCNTL_STD     0x04

   111 #define LSI_DCNTL_IRQM    0x08

   112 #define LSI_DCNTL_SSM     0x10

   113 #define LSI_DCNTL_PFEN    0x20

   114 #define LSI_DCNTL_PFF     0x40

   115 #define LSI_DCNTL_CLSE    0x80

   116 

   117 #define LSI_DMODE_MAN     0x01

   118 #define LSI_DMODE_BOF     0x02

   119 #define LSI_DMODE_ERMP    0x04

   120 #define LSI_DMODE_ERL     0x08

   121 #define LSI_DMODE_DIOM    0x10

   122 #define LSI_DMODE_SIOM    0x20

   123 

   124 #define LSI_CTEST2_DACK   0x01

   125 #define LSI_CTEST2_DREQ   0x02

   126 #define LSI_CTEST2_TEOP   0x04

   127 #define LSI_CTEST2_PCICIE 0x08

   128 #define LSI_CTEST2_CM     0x10

   129 #define LSI_CTEST2_CIO    0x20

   130 #define LSI_CTEST2_SIGP   0x40

   131 #define LSI_CTEST2_DDIR   0x80

   132 

   133 #define LSI_CTEST5_BL2    0x04

   134 #define LSI_CTEST5_DDIR   0x08

   135 #define LSI_CTEST5_MASR   0x10

   136 #define LSI_CTEST5_DFSN   0x20

   137 #define LSI_CTEST5_BBCK   0x40

   138 #define LSI_CTEST5_ADCK   0x80

   139 

   140 #define LSI_CCNTL0_DILS   0x01

   141 #define LSI_CCNTL0_DISFC  0x10

   142 #define LSI_CCNTL0_ENNDJ  0x20

   143 #define LSI_CCNTL0_PMJCTL 0x40

   144 #define LSI_CCNTL0_ENPMJ  0x80

   145 

   146 #define LSI_CCNTL1_EN64DBMV  0x01

   147 #define LSI_CCNTL1_EN64TIBMV 0x02

   148 #define LSI_CCNTL1_64TIMOD   0x04

   149 #define LSI_CCNTL1_DDAC      0x08

   150 #define LSI_CCNTL1_ZMOD      0x80

   151 

   152 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)

   153 

   154 #define PHASE_DO          0

   155 #define PHASE_DI          1

   156 #define PHASE_CMD         2

   157 #define PHASE_ST          3

   158 #define PHASE_MO          6

   159 #define PHASE_MI          7

   160 #define PHASE_MASK        7

   161 

   162 /* Maximum length of MSG IN data.  */

   163 #define LSI_MAX_MSGIN_LEN 8

   164 

   165 /* Flag set if this is a tagged command.  */

   166 #define LSI_TAG_VALID     (1 << 16)

   167 

   168 typedef struct {

   169     uint32_t tag;

   170     uint32_t pending;

   171     int out;

   172 } lsi_queue;

   173 

   174 typedef struct {

   175     PCIDevice pci_dev;

   176     int mmio_io_addr;

   177     int ram_io_addr;

   178     uint32_t script_ram_base;

   179 

   180     int carry; /* ??? Should this be an a visible register somewhere?  */

   181     int sense;

   182     /* Action to take at the end of a MSG IN phase.

   183        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */

   184     int msg_action;

   185     int msg_len;

   186     uint8_t msg[LSI_MAX_MSGIN_LEN];

   187     /* 0 if SCRIPTS are running or stopped.

   188      * 1 if a Wait Reselect instruction has been issued.

   189      * 2 if processing DMA from lsi_execute_script.

   190      * 3 if a DMA operation is in progress.  */

   191     int waiting;

   192     SCSIDevice *scsi_dev[LSI_MAX_DEVS];

   193     SCSIDevice *current_dev;

   194     int current_lun;

   195     /* The tag is a combination of the device ID and the SCSI tag.  */

   196     uint32_t current_tag;

   197     uint32_t current_dma_len;

   198     int command_complete;

   199     uint8_t *dma_buf;

   200     lsi_queue *queue;

   201     int queue_len;

   202     int active_commands;

   203 

   204     uint32_t dsa;

   205     uint32_t temp;

   206     uint32_t dnad;

   207     uint32_t dbc;

   208     uint8_t istat0;

   209     uint8_t istat1;

   210     uint8_t dcmd;

   211     uint8_t dstat;

   212     uint8_t dien;

   213     uint8_t sist0;

   214     uint8_t sist1;

   215     uint8_t sien0;

   216     uint8_t sien1;

   217     uint8_t mbox0;

   218     uint8_t mbox1;

   219     uint8_t dfifo;

   220     uint8_t ctest2;

   221     uint8_t ctest3;

   222     uint8_t ctest4;

   223     uint8_t ctest5;

   224     uint8_t ccntl0;

   225     uint8_t ccntl1;

   226     uint32_t dsp;

   227     uint32_t dsps;

   228     uint8_t dmode;

   229     uint8_t dcntl;

   230     uint8_t scntl0;

   231     uint8_t scntl1;

   232     uint8_t scntl2;

   233     uint8_t scntl3;

   234     uint8_t sstat0;

   235     uint8_t sstat1;

   236     uint8_t scid;

   237     uint8_t sxfer;

   238     uint8_t socl;

   239     uint8_t sdid;

   240     uint8_t ssid;

   241     uint8_t sfbr;

   242     uint8_t stest1;

   243     uint8_t stest2;

   244     uint8_t stest3;

   245     uint8_t sidl;

   246     uint8_t stime0;

   247     uint8_t respid0;

   248     uint8_t respid1;

   249     uint32_t mmrs;

   250     uint32_t mmws;

   251     uint32_t sfs;

   252     uint32_t drs;

   253     uint32_t sbms;

   254     uint32_t dbms;

   255     uint32_t dnad64;

   256     uint32_t pmjad1;

   257     uint32_t pmjad2;

   258     uint32_t rbc;

   259     uint32_t ua;

   260     uint32_t ia;

   261     uint32_t sbc;

   262     uint32_t csbc;

   263     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */

   264 

   265     /* Script ram is stored as 32-bit words in host byteorder.  */

   266     uint32_t script_ram[2048];

   267 } LSIState;

   268 

   269 static void lsi_soft_reset(LSIState *s)

   270 {

   271     DPRINTF("Reset\n");

   272     s->carry = 0;

   273 

   274     s->waiting = 0;

   275     s->dsa = 0;

   276     s->dnad = 0;

   277     s->dbc = 0;

   278     s->temp = 0;

   279     memset(s->scratch, 0, sizeof(s->scratch));

   280     s->istat0 = 0;

   281     s->istat1 = 0;

   282     s->dcmd = 0;

   283     s->dstat = 0;

   284     s->dien = 0;

   285     s->sist0 = 0;

   286     s->sist1 = 0;

   287     s->sien0 = 0;

   288     s->sien1 = 0;

   289     s->mbox0 = 0;

   290     s->mbox1 = 0;

   291     s->dfifo = 0;

   292     s->ctest2 = 0;

   293     s->ctest3 = 0;

   294     s->ctest4 = 0;

   295     s->ctest5 = 0;

   296     s->ccntl0 = 0;

   297     s->ccntl1 = 0;

   298     s->dsp = 0;

   299     s->dsps = 0;

   300     s->dmode = 0;

   301     s->dcntl = 0;

   302     s->scntl0 = 0xc0;

   303     s->scntl1 = 0;

   304     s->scntl2 = 0;

   305     s->scntl3 = 0;

   306     s->sstat0 = 0;

   307     s->sstat1 = 0;

   308     s->scid = 7;

   309     s->sxfer = 0;

   310     s->socl = 0;

   311     s->stest1 = 0;

   312     s->stest2 = 0;

   313     s->stest3 = 0;

   314     s->sidl = 0;

   315     s->stime0 = 0;

   316     s->respid0 = 0x80;

   317     s->respid1 = 0;

   318     s->mmrs = 0;

   319     s->mmws = 0;

   320     s->sfs = 0;

   321     s->drs = 0;

   322     s->sbms = 0;

   323     s->dbms = 0;

   324     s->dnad64 = 0;

   325     s->pmjad1 = 0;

   326     s->pmjad2 = 0;

   327     s->rbc = 0;

   328     s->ua = 0;

   329     s->ia = 0;

   330     s->sbc = 0;

   331     s->csbc = 0;

   332 }

   333 

   334 static int lsi_dma_40bit(LSIState *s)

   335 {

   336     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)

   337         return 1;

   338     return 0;

   339 }

   340 

   341 static int lsi_dma_ti64bit(LSIState *s)

   342 {

   343     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)

   344         return 1;

   345     return 0;

   346 }

   347 

   348 static int lsi_dma_64bit(LSIState *s)

   349 {

   350     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)

   351         return 1;

   352     return 0;

   353 }

   354 

   355 static uint8_t lsi_reg_readb(LSIState *s, int offset);

   356 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);

   357 static void lsi_execute_script(LSIState *s);

   358 

   359 static inline uint32_t read_dword(LSIState *s, uint32_t addr)

   360 {

   361     uint32_t buf;

   362 

   363     /* Optimize reading from SCRIPTS RAM.  */

   364     if ((addr & 0xffffe000) == s->script_ram_base) {

   365         return s->script_ram[(addr & 0x1fff) >> 2];

   366     }

   367     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);

   368     return cpu_to_le32(buf);

   369 }

   370 

   371 static void lsi_stop_script(LSIState *s)

   372 {

   373     s->istat1 &= ~LSI_ISTAT1_SRUN;

   374 }

   375 

   376 static void lsi_update_irq(LSIState *s)

   377 {

   378     int level;

   379     static int last_level;

   380 

   381     /* It's unclear whether the DIP/SIP bits should be cleared when the

   382        Interrupt Status Registers are cleared or when istat0 is read.

   383        We currently do the formwer, which seems to work.  */

   384     level = 0;

   385     if (s->dstat) {

   386         if (s->dstat & s->dien)

   387             level = 1;

   388         s->istat0 |= LSI_ISTAT0_DIP;

   389     } else {

   390         s->istat0 &= ~LSI_ISTAT0_DIP;

   391     }

   392 

   393     if (s->sist0 || s->sist1) {

   394         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))

   395             level = 1;

   396         s->istat0 |= LSI_ISTAT0_SIP;

   397     } else {

   398         s->istat0 &= ~LSI_ISTAT0_SIP;

   399     }

   400     if (s->istat0 & LSI_ISTAT0_INTF)

   401         level = 1;

   402 

   403     if (level != last_level) {

   404         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",

   405                 level, s->dstat, s->sist1, s->sist0);

   406         last_level = level;

   407     }

   408     qemu_set_irq(s->pci_dev.irq[0], level);

   409 }

   410 

   411 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */

   412 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)

   413 {

   414     uint32_t mask0;

   415     uint32_t mask1;

   416 

   417     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",

   418             stat1, stat0, s->sist1, s->sist0);

   419     s->sist0 |= stat0;

   420     s->sist1 |= stat1;

   421     /* Stop processor on fatal or unmasked interrupt.  As a special hack

   422        we don't stop processing when raising STO.  Instead continue

   423        execution and stop at the next insn that accesses the SCSI bus.  */

   424     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);

   425     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);

   426     mask1 &= ~LSI_SIST1_STO;

   427     if (s->sist0 & mask0 || s->sist1 & mask1) {

   428         lsi_stop_script(s);

   429     }

   430     lsi_update_irq(s);

   431 }

   432 

   433 /* Stop SCRIPTS execution and raise a DMA interrupt.  */

   434 static void lsi_script_dma_interrupt(LSIState *s, int stat)

   435 {

   436     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);

   437     s->dstat |= stat;

   438     lsi_update_irq(s);

   439     lsi_stop_script(s);

   440 }

   441 

   442 static inline void lsi_set_phase(LSIState *s, int phase)

   443 {

   444     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;

   445 }

   446 

   447 static void lsi_bad_phase(LSIState *s, int out, int new_phase)

   448 {

   449     /* Trigger a phase mismatch.  */

   450     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {

   451         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {

   452             s->dsp = s->pmjad1;

   453         } else {

   454             s->dsp = s->pmjad2;

   455         }

   456         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);

   457     } else {

   458         DPRINTF("Phase mismatch interrupt\n");

   459         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);

   460         lsi_stop_script(s);

   461     }

   462     lsi_set_phase(s, new_phase);

   463 }

   464 

   465 

   466 /* Resume SCRIPTS execution after a DMA operation.  */

   467 static void lsi_resume_script(LSIState *s)

   468 {

   469     if (s->waiting != 2) {

   470         s->waiting = 0;

   471         lsi_execute_script(s);

   472     } else {

   473         s->waiting = 0;

   474     }

   475 }

   476 

   477 /* Initiate a SCSI layer data transfer.  */

   478 static void lsi_do_dma(LSIState *s, int out)

   479 {

   480     uint32_t count;

   481     target_phys_addr_t addr;

   482 

   483     if (!s->current_dma_len) {

   484         /* Wait until data is available.  */

   485         DPRINTF("DMA no data available\n");

   486         return;

   487     }

   488 

   489     count = s->dbc;

   490     if (count > s->current_dma_len)

   491         count = s->current_dma_len;

   492 

   493     addr = s->dnad;

   494     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */

   495     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))

   496         addr |= ((uint64_t)s->dnad64 << 32);

   497     else if (s->dbms)

   498         addr |= ((uint64_t)s->dbms << 32);

   499     else if (s->sbms)

   500         addr |= ((uint64_t)s->sbms << 32);

   501 

   502     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);

   503     s->csbc += count;

   504     s->dnad += count;

   505     s->dbc -= count;

   506 

   507     if (s->dma_buf == NULL) {

   508         s->dma_buf = s->current_dev->get_buf(s->current_dev,

   509                                              s->current_tag);

   510     }

   511 

   512     /* ??? Set SFBR to first data byte.  */

   513     if (out) {

   514         cpu_physical_memory_read(addr, s->dma_buf, count);

   515     } else {

   516         cpu_physical_memory_write(addr, s->dma_buf, count);

   517     }

   518     s->current_dma_len -= count;

   519     if (s->current_dma_len == 0) {

   520         s->dma_buf = NULL;

   521         if (out) {

   522             /* Write the data.  */

   523             s->current_dev->write_data(s->current_dev, s->current_tag);

   524         } else {

   525             /* Request any remaining data.  */

   526             s->current_dev->read_data(s->current_dev, s->current_tag);

   527         }

   528     } else {

   529         s->dma_buf += count;

   530         lsi_resume_script(s);

   531     }

   532 }

   533 

   534 

   535 /* Add a command to the queue.  */

   536 static void lsi_queue_command(LSIState *s)

   537 {

   538     lsi_queue *p;

   539 

   540     DPRINTF("Queueing tag=0x%x\n", s->current_tag);

   541     if (s->queue_len == s->active_commands) {

   542         s->queue_len++;

   543         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));

   544     }

   545     p = &s->queue[s->active_commands++];

   546     p->tag = s->current_tag;

   547     p->pending = 0;

   548     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;

   549 }

   550 

   551 /* Queue a byte for a MSG IN phase.  */

   552 static void lsi_add_msg_byte(LSIState *s, uint8_t data)

   553 {

   554     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {

   555         BADF("MSG IN data too long\n");

   556     } else {

   557         DPRINTF("MSG IN 0x%02x\n", data);

   558         s->msg[s->msg_len++] = data;

   559     }

   560 }

   561 

   562 /* Perform reselection to continue a command.  */

   563 static void lsi_reselect(LSIState *s, uint32_t tag)

   564 {

   565     lsi_queue *p;

   566     int n;

   567     int id;

   568 

   569     p = NULL;

   570     for (n = 0; n < s->active_commands; n++) {

   571         p = &s->queue[n];

   572         if (p->tag == tag)

   573             break;

   574     }

   575     if (n == s->active_commands) {

   576         BADF("Reselected non-existant command tag=0x%x\n", tag);

   577         return;

   578     }

   579     id = (tag >> 8) & 0xf;

   580     s->ssid = id | 0x80;

   581     DPRINTF("Reselected target %d\n", id);

   582     s->current_dev = s->scsi_dev[id];

   583     s->current_tag = tag;

   584     s->scntl1 |= LSI_SCNTL1_CON;

   585     lsi_set_phase(s, PHASE_MI);

   586     s->msg_action = p->out ? 2 : 3;

   587     s->current_dma_len = p->pending;

   588     s->dma_buf = NULL;

   589     lsi_add_msg_byte(s, 0x80);

   590     if (s->current_tag & LSI_TAG_VALID) {

   591         lsi_add_msg_byte(s, 0x20);

   592         lsi_add_msg_byte(s, tag & 0xff);

   593     }

   594 

   595     s->active_commands--;

   596     if (n != s->active_commands) {

   597         s->queue[n] = s->queue[s->active_commands];

   598     }

   599 }

   600 

   601 /* Record that data is available for a queued command.  Returns zero if

   602    the device was reselected, nonzero if the IO is deferred.  */

   603 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)

   604 {

   605     lsi_queue *p;

   606     int i;

   607     for (i = 0; i < s->active_commands; i++) {

   608         p = &s->queue[i];

   609         if (p->tag == tag) {

   610             if (p->pending) {

   611                 BADF("Multiple IO pending for tag %d\n", tag);

   612             }

   613             p->pending = arg;

   614             if (s->waiting == 1) {

   615                 /* Reselect device.  */

   616                 lsi_reselect(s, tag);

   617                 return 0;

   618             } else {

   619                DPRINTF("Queueing IO tag=0x%x\n", tag);

   620                 p->pending = arg;

   621                 return 1;

   622             }

   623         }

   624     }

   625     BADF("IO with unknown tag %d\n", tag);

   626     return 1;

   627 }

   628 

   629 /* Callback to indicate that the SCSI layer has completed a transfer.  */

   630 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,

   631                                  uint32_t arg)

   632 {

   633     LSIState *s = (LSIState *)opaque;

   634     int out;

   635 

   636     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;

   637     if (reason == SCSI_REASON_DONE) {

   638         DPRINTF("Command complete sense=%d\n", (int)arg);

   639         s->sense = arg;

   640         s->command_complete = 2;

   641         if (s->waiting && s->dbc != 0) {

   642             /* Raise phase mismatch for short transfers.  */

   643             lsi_bad_phase(s, out, PHASE_ST);

   644         } else {

   645             lsi_set_phase(s, PHASE_ST);

   646         }

   647         lsi_resume_script(s);

   648         return;

   649     }

   650 

   651     if (s->waiting == 1 || tag != s->current_tag) {

   652         if (lsi_queue_tag(s, tag, arg))

   653             return;

   654     }

   655     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);

   656     s->current_dma_len = arg;

   657     s->command_complete = 1;

   658     if (!s->waiting)

   659         return;

   660     if (s->waiting == 1 || s->dbc == 0) {

   661         lsi_resume_script(s);

   662     } else {

   663         lsi_do_dma(s, out);

   664     }

   665 }

   666 

   667 static void lsi_do_command(LSIState *s)

   668 {

   669     uint8_t buf[16];

   670     int n;

   671 

   672     DPRINTF("Send command len=%d\n", s->dbc);

   673     if (s->dbc > 16)

   674         s->dbc = 16;

   675     cpu_physical_memory_read(s->dnad, buf, s->dbc);

   676     s->sfbr = buf[0];

   677     s->command_complete = 0;

   678     n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,

   679                                      s->current_lun);

   680     if (n > 0) {

   681         lsi_set_phase(s, PHASE_DI);

   682         s->current_dev->read_data(s->current_dev, s->current_tag);

   683     } else if (n < 0) {

   684         lsi_set_phase(s, PHASE_DO);

   685         s->current_dev->write_data(s->current_dev, s->current_tag);

   686     }

   687 

   688     if (!s->command_complete) {

   689         if (n) {

   690             /* Command did not complete immediately so disconnect.  */

   691             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */

   692             lsi_add_msg_byte(s, 4); /* DISCONNECT */

   693             /* wait data */

   694             lsi_set_phase(s, PHASE_MI);

   695             s->msg_action = 1;

   696             lsi_queue_command(s);

   697         } else {

   698             /* wait command complete */

   699             lsi_set_phase(s, PHASE_DI);

   700         }

   701     }

   702 }

   703 

   704 static void lsi_do_status(LSIState *s)

   705 {

   706     uint8_t sense;

   707     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);

   708     if (s->dbc != 1)

   709         BADF("Bad Status move\n");

   710     s->dbc = 1;

   711     sense = s->sense;

   712     s->sfbr = sense;

   713     cpu_physical_memory_write(s->dnad, &sense, 1);

   714     lsi_set_phase(s, PHASE_MI);

   715     s->msg_action = 1;

   716     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */

   717 }

   718 

   719 static void lsi_disconnect(LSIState *s)

   720 {

   721     s->scntl1 &= ~LSI_SCNTL1_CON;

   722     s->sstat1 &= ~PHASE_MASK;

   723 }

   724 

   725 static void lsi_do_msgin(LSIState *s)

   726 {

   727     int len;

   728     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);

   729     s->sfbr = s->msg[0];

   730     len = s->msg_len;

   731     if (len > s->dbc)

   732         len = s->dbc;

   733     cpu_physical_memory_write(s->dnad, s->msg, len);

   734     /* Linux drivers rely on the last byte being in the SIDL.  */

   735     s->sidl = s->msg[len - 1];

   736     s->msg_len -= len;

   737     if (s->msg_len) {

   738         memmove(s->msg, s->msg + len, s->msg_len);

   739     } else {

   740         /* ??? Check if ATN (not yet implemented) is asserted and maybe

   741            switch to PHASE_MO.  */

   742         switch (s->msg_action) {

   743         case 0:

   744             lsi_set_phase(s, PHASE_CMD);

   745             break;

   746         case 1:

   747             lsi_disconnect(s);

   748             break;

   749         case 2:

   750             lsi_set_phase(s, PHASE_DO);

   751             break;

   752         case 3:

   753             lsi_set_phase(s, PHASE_DI);

   754             break;

   755         default:

   756             abort();

   757         }

   758     }

   759 }

   760 

   761 /* Read the next byte during a MSGOUT phase.  */

   762 static uint8_t lsi_get_msgbyte(LSIState *s)

   763 {

   764     uint8_t data;

   765     cpu_physical_memory_read(s->dnad, &data, 1);

   766     s->dnad++;

   767     s->dbc--;

   768     return data;

   769 }

   770 

   771 static void lsi_do_msgout(LSIState *s)

   772 {

   773     uint8_t msg;

   774     int len;

   775 

   776     DPRINTF("MSG out len=%d\n", s->dbc);

   777     while (s->dbc) {

   778         msg = lsi_get_msgbyte(s);

   779         s->sfbr = msg;

   780 

   781         switch (msg) {

   782         case 0x00:

   783             DPRINTF("MSG: Disconnect\n");

   784             lsi_disconnect(s);

   785             break;

   786         case 0x08:

   787             DPRINTF("MSG: No Operation\n");

   788             lsi_set_phase(s, PHASE_CMD);

   789             break;

   790         case 0x01:

   791             len = lsi_get_msgbyte(s);

   792             msg = lsi_get_msgbyte(s);

   793             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);

   794             switch (msg) {

   795             case 1:

   796                 DPRINTF("SDTR (ignored)\n");

   797                 s->dbc -= 2;

   798                 break;

   799             case 3:

   800                 DPRINTF("WDTR (ignored)\n");

   801                 s->dbc -= 1;

   802                 break;

   803             default:

   804                 goto bad;

   805             }

   806             break;

   807         case 0x20: /* SIMPLE queue */

   808             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;

   809             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);

   810             break;

   811         case 0x21: /* HEAD of queue */

   812             BADF("HEAD queue not implemented\n");

   813             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;

   814             break;

   815         case 0x22: /* ORDERED queue */

   816             BADF("ORDERED queue not implemented\n");

   817             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;

   818             break;

   819         default:

   820             if ((msg & 0x80) == 0) {

   821                 goto bad;

   822             }

   823             s->current_lun = msg & 7;

   824             DPRINTF("Select LUN %d\n", s->current_lun);

   825             lsi_set_phase(s, PHASE_CMD);

   826             break;

   827         }

   828     }

   829     return;

   830 bad:

   831     BADF("Unimplemented message 0x%02x\n", msg);

   832     lsi_set_phase(s, PHASE_MI);

   833     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */

   834     s->msg_action = 0;

   835 }

   836 

   837 /* Sign extend a 24-bit value.  */

   838 static inline int32_t sxt24(int32_t n)

   839 {

   840     return (n << 8) >> 8;

   841 }

   842 

   843 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)

   844 {

   845     int n;

   846     uint8_t buf[TARGET_PAGE_SIZE];

   847 

   848     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);

   849     while (count) {

   850         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;

   851         cpu_physical_memory_read(src, buf, n);

   852         cpu_physical_memory_write(dest, buf, n);

   853         src += n;

   854         dest += n;

   855         count -= n;

   856     }

   857 }

   858 

   859 static void lsi_wait_reselect(LSIState *s)

   860 {

   861     int i;

   862     DPRINTF("Wait Reselect\n");

   863     if (s->current_dma_len)

   864         BADF("Reselect with pending DMA\n");

   865     for (i = 0; i < s->active_commands; i++) {

   866         if (s->queue[i].pending) {

   867             lsi_reselect(s, s->queue[i].tag);

   868             break;

   869         }

   870     }

   871     if (s->current_dma_len == 0) {

   872         s->waiting = 1;

   873     }

   874 }

   875 

   876 static void lsi_execute_script(LSIState *s)

   877 {

   878     uint32_t insn;

   879     uint32_t addr, addr_high;

   880     int opcode;

   881     int insn_processed = 0;

   882 

   883     s->istat1 |= LSI_ISTAT1_SRUN;

   884 again:

   885     insn_processed++;

   886     insn = read_dword(s, s->dsp);

   887     if (!insn) {

   888         /* If we receive an empty opcode increment the DSP by 4 bytes

   889            instead of 8 and execute the next opcode at that location */

   890         s->dsp += 4;

   891         goto again;

   892     }

   893     addr = read_dword(s, s->dsp + 4);

   894     addr_high = 0;

   895     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);

   896     s->dsps = addr;

   897     s->dcmd = insn >> 24;

   898     s->dsp += 8;

   899     switch (insn >> 30) {

   900     case 0: /* Block move.  */

   901         if (s->sist1 & LSI_SIST1_STO) {

   902             DPRINTF("Delayed select timeout\n");

   903             lsi_stop_script(s);

   904             break;

   905         }

   906         s->dbc = insn & 0xffffff;

   907         s->rbc = s->dbc;

   908         /* ??? Set ESA.  */

   909         s->ia = s->dsp - 8;

   910         if (insn & (1 << 29)) {

   911             /* Indirect addressing.  */

   912             addr = read_dword(s, addr);

   913         } else if (insn & (1 << 28)) {

   914             uint32_t buf[2];

   915             int32_t offset;

   916             /* Table indirect addressing.  */

   917 

   918             /* 32-bit Table indirect */

   919             offset = sxt24(addr);

   920             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);

   921             /* byte count is stored in bits 0:23 only */

   922             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;

   923             s->rbc = s->dbc;

   924             addr = cpu_to_le32(buf[1]);

   925 

   926             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of

   927              * table, bits [31:24] */

   928             if (lsi_dma_40bit(s))

   929                 addr_high = cpu_to_le32(buf[0]) >> 24;

   930             else if (lsi_dma_ti64bit(s)) {

   931                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;

   932                 switch (selector) {

   933                 case 0 ... 0x0f:

   934                     /* offset index into scratch registers since

   935                      * TI64 mode can use registers C to R */

   936                     addr_high = s->scratch[2 + selector];

   937                     break;

   938                 case 0x10:

   939                     addr_high = s->mmrs;

   940                     break;

   941                 case 0x11:

   942                     addr_high = s->mmws;

   943                     break;

   944                 case 0x12:

   945                     addr_high = s->sfs;

   946                     break;

   947                 case 0x13:

   948                     addr_high = s->drs;

   949                     break;

   950                 case 0x14:

   951                     addr_high = s->sbms;

   952                     break;

   953                 case 0x15:

   954                     addr_high = s->dbms;

   955                     break;

   956                 default:

   957                     BADF("Illegal selector specified (0x%x > 0x15)"

   958                          " for 64-bit DMA block move", selector);

   959                     break;

   960                 }

   961             }

   962         } else if (lsi_dma_64bit(s)) {

   963             /* fetch a 3rd dword if 64-bit direct move is enabled and

   964                only if we're not doing table indirect or indirect addressing */

   965             s->dbms = read_dword(s, s->dsp);

   966             s->dsp += 4;

   967             s->ia = s->dsp - 12;

   968         }

   969         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {

   970             DPRINTF("Wrong phase got %d expected %d\n",

   971                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);

   972             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);

   973             break;

   974         }

   975         s->dnad = addr;

   976         s->dnad64 = addr_high;

   977         switch (s->sstat1 & 0x7) {

   978         case PHASE_DO:

   979             s->waiting = 2;

   980             lsi_do_dma(s, 1);

   981             if (s->waiting)

   982                 s->waiting = 3;

   983             break;

   984         case PHASE_DI:

   985             s->waiting = 2;

   986             lsi_do_dma(s, 0);

   987             if (s->waiting)

   988                 s->waiting = 3;

   989             break;

   990         case PHASE_CMD:

   991             lsi_do_command(s);

   992             break;

   993         case PHASE_ST:

   994             lsi_do_status(s);

   995             break;

   996         case PHASE_MO:

   997             lsi_do_msgout(s);

   998             break;

   999         case PHASE_MI:

  1000             lsi_do_msgin(s);

  1001             break;

  1002         default:

  1003             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);

  1004             exit(1);

  1005         }

  1006         s->dfifo = s->dbc & 0xff;

  1007         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);

  1008         s->sbc = s->dbc;

  1009         s->rbc -= s->dbc;

  1010         s->ua = addr + s->dbc;

  1011         break;

  1012 

  1013     case 1: /* IO or Read/Write instruction.  */

  1014         opcode = (insn >> 27) & 7;

  1015         if (opcode < 5) {

  1016             uint32_t id;

  1017 

  1018             if (insn & (1 << 25)) {

  1019                 id = read_dword(s, s->dsa + sxt24(insn));

  1020             } else {

  1021                 id = addr;

  1022             }

  1023             id = (id >> 16) & 0xf;

  1024             if (insn & (1 << 26)) {

  1025                 addr = s->dsp + sxt24(addr);

  1026             }

  1027             s->dnad = addr;

  1028             switch (opcode) {

  1029             case 0: /* Select */

  1030                 s->sdid = id;

  1031                 if (s->current_dma_len && (s->ssid & 0xf) == id) {

  1032                     DPRINTF("Already reselected by target %d\n", id);

  1033                     break;

  1034                 }

  1035                 s->sstat0 |= LSI_SSTAT0_WOA;

  1036                 s->scntl1 &= ~LSI_SCNTL1_IARB;

  1037                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {

  1038                     DPRINTF("Selected absent target %d\n", id);

  1039                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);

  1040                     lsi_disconnect(s);

  1041                     break;

  1042                 }

  1043                 DPRINTF("Selected target %d%s\n",

  1044                         id, insn & (1 << 3) ? " ATN" : "");

  1045                 /* ??? Linux drivers compain when this is set.  Maybe

  1046                    it only applies in low-level mode (unimplemented).

  1047                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */

  1048                 s->current_dev = s->scsi_dev[id];

  1049                 s->current_tag = id << 8;

  1050                 s->scntl1 |= LSI_SCNTL1_CON;

  1051                 if (insn & (1 << 3)) {

  1052                     s->socl |= LSI_SOCL_ATN;

  1053                 }

  1054                 lsi_set_phase(s, PHASE_MO);

  1055                 break;

  1056             case 1: /* Disconnect */

  1057                 DPRINTF("Wait Disconect\n");

  1058                 s->scntl1 &= ~LSI_SCNTL1_CON;

  1059                 break;

  1060             case 2: /* Wait Reselect */

  1061                 lsi_wait_reselect(s);

  1062                 break;

  1063             case 3: /* Set */

  1064                 DPRINTF("Set%s%s%s%s\n",

  1065                         insn & (1 << 3) ? " ATN" : "",

  1066                         insn & (1 << 6) ? " ACK" : "",

  1067                         insn & (1 << 9) ? " TM" : "",

  1068                         insn & (1 << 10) ? " CC" : "");

  1069                 if (insn & (1 << 3)) {

  1070                     s->socl |= LSI_SOCL_ATN;

  1071                     lsi_set_phase(s, PHASE_MO);

  1072                 }

  1073                 if (insn & (1 << 9)) {

  1074                     BADF("Target mode not implemented\n");

  1075                     exit(1);

  1076                 }

  1077                 if (insn & (1 << 10))

  1078                     s->carry = 1;

  1079                 break;

  1080             case 4: /* Clear */

  1081                 DPRINTF("Clear%s%s%s%s\n",

  1082                         insn & (1 << 3) ? " ATN" : "",

  1083                         insn & (1 << 6) ? " ACK" : "",

  1084                         insn & (1 << 9) ? " TM" : "",

  1085                         insn & (1 << 10) ? " CC" : "");

  1086                 if (insn & (1 << 3)) {

  1087                     s->socl &= ~LSI_SOCL_ATN;

  1088                 }

  1089                 if (insn & (1 << 10))

  1090                     s->carry = 0;

  1091                 break;

  1092             }

  1093         } else {

  1094             uint8_t op0;

  1095             uint8_t op1;

  1096             uint8_t data8;

  1097             int reg;

  1098             int operator;

  1099 #ifdef DEBUG_LSI

  1100             static const char *opcode_names[3] =

  1101                 {"Write", "Read", "Read-Modify-Write"};

  1102             static const char *operator_names[8] =

  1103                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};

  1104 #endif

  1105 

  1106             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);

  1107             data8 = (insn >> 8) & 0xff;

  1108             opcode = (insn >> 27) & 7;

  1109             operator = (insn >> 24) & 7;

  1110             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",

  1111                     opcode_names[opcode - 5], reg,

  1112                     operator_names[operator], data8, s->sfbr,

  1113                     (insn & (1 << 23)) ? " SFBR" : "");

  1114             op0 = op1 = 0;

  1115             switch (opcode) {

  1116             case 5: /* From SFBR */

  1117                 op0 = s->sfbr;

  1118                 op1 = data8;

  1119                 break;

  1120             case 6: /* To SFBR */

  1121                 if (operator)

  1122                     op0 = lsi_reg_readb(s, reg);

  1123                 op1 = data8;

  1124                 break;

  1125             case 7: /* Read-modify-write */

  1126                 if (operator)

  1127                     op0 = lsi_reg_readb(s, reg);

  1128                 if (insn & (1 << 23)) {

  1129                     op1 = s->sfbr;

  1130                 } else {

  1131                     op1 = data8;

  1132                 }

  1133                 break;

  1134             }

  1135