2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
18 #include "block_int.h"
21 //#define DEBUG_LSI_REG
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
34 #define LSI_MAX_DEVS 7
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
176 typedef struct lsi_request
{
183 QTAILQ_ENTRY(lsi_request
) next
;
190 uint32_t script_ram_base
;
192 int carry
; /* ??? Should this be an a visible register somewhere? */
194 /* Action to take at the end of a MSG IN phase.
195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
198 uint8_t msg
[LSI_MAX_MSGIN_LEN
];
199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
205 SCSIDevice
*select_dev
;
207 /* The tag is a combination of the device ID and the SCSI tag. */
209 int command_complete
;
210 QTAILQ_HEAD(, lsi_request
) queue
;
211 lsi_request
*current
;
272 uint32_t scratch
[18]; /* SCRATCHA-SCRATCHR */
275 /* Script ram is stored as 32-bit words in host byteorder. */
276 uint32_t script_ram
[2048];
279 static inline int lsi_irq_on_rsl(LSIState
*s
)
281 return (s
->sien0
& LSI_SIST0_RSL
) && (s
->scid
& LSI_SCID_RRE
);
284 static void lsi_soft_reset(LSIState
*s
)
296 memset(s
->scratch
, 0, sizeof(s
->scratch
));
350 while (!QTAILQ_EMPTY(&s
->queue
)) {
351 p
= QTAILQ_FIRST(&s
->queue
);
352 QTAILQ_REMOVE(&s
->queue
, p
, next
);
356 qemu_free(s
->current
);
361 static int lsi_dma_40bit(LSIState
*s
)
363 if ((s
->ccntl1
& LSI_CCNTL1_40BIT
) == LSI_CCNTL1_40BIT
)
368 static int lsi_dma_ti64bit(LSIState
*s
)
370 if ((s
->ccntl1
& LSI_CCNTL1_EN64TIBMV
) == LSI_CCNTL1_EN64TIBMV
)
375 static int lsi_dma_64bit(LSIState
*s
)
377 if ((s
->ccntl1
& LSI_CCNTL1_EN64DBMV
) == LSI_CCNTL1_EN64DBMV
)
382 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
);
383 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
);
384 static void lsi_execute_script(LSIState
*s
);
385 static void lsi_reselect(LSIState
*s
, lsi_request
*p
);
387 static inline uint32_t read_dword(LSIState
*s
, uint32_t addr
)
391 /* Optimize reading from SCRIPTS RAM. */
392 if ((addr
& 0xffffe000) == s
->script_ram_base
) {
393 return s
->script_ram
[(addr
& 0x1fff) >> 2];
395 cpu_physical_memory_read(addr
, (uint8_t *)&buf
, 4);
396 return cpu_to_le32(buf
);
399 static void lsi_stop_script(LSIState
*s
)
401 s
->istat1
&= ~LSI_ISTAT1_SRUN
;
404 static void lsi_update_irq(LSIState
*s
)
407 static int last_level
;
410 /* It's unclear whether the DIP/SIP bits should be cleared when the
411 Interrupt Status Registers are cleared or when istat0 is read.
412 We currently do the formwer, which seems to work. */
415 if (s
->dstat
& s
->dien
)
417 s
->istat0
|= LSI_ISTAT0_DIP
;
419 s
->istat0
&= ~LSI_ISTAT0_DIP
;
422 if (s
->sist0
|| s
->sist1
) {
423 if ((s
->sist0
& s
->sien0
) || (s
->sist1
& s
->sien1
))
425 s
->istat0
|= LSI_ISTAT0_SIP
;
427 s
->istat0
&= ~LSI_ISTAT0_SIP
;
429 if (s
->istat0
& LSI_ISTAT0_INTF
)
432 if (level
!= last_level
) {
433 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
434 level
, s
->dstat
, s
->sist1
, s
->sist0
);
437 qemu_set_irq(s
->dev
.irq
[0], level
);
439 if (!level
&& lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
)) {
440 DPRINTF("Handled IRQs & disconnected, looking for pending "
442 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
451 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
452 static void lsi_script_scsi_interrupt(LSIState
*s
, int stat0
, int stat1
)
457 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
458 stat1
, stat0
, s
->sist1
, s
->sist0
);
461 /* Stop processor on fatal or unmasked interrupt. As a special hack
462 we don't stop processing when raising STO. Instead continue
463 execution and stop at the next insn that accesses the SCSI bus. */
464 mask0
= s
->sien0
| ~(LSI_SIST0_CMP
| LSI_SIST0_SEL
| LSI_SIST0_RSL
);
465 mask1
= s
->sien1
| ~(LSI_SIST1_GEN
| LSI_SIST1_HTH
);
466 mask1
&= ~LSI_SIST1_STO
;
467 if (s
->sist0
& mask0
|| s
->sist1
& mask1
) {
473 /* Stop SCRIPTS execution and raise a DMA interrupt. */
474 static void lsi_script_dma_interrupt(LSIState
*s
, int stat
)
476 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat
, s
->dstat
);
482 static inline void lsi_set_phase(LSIState
*s
, int phase
)
484 s
->sstat1
= (s
->sstat1
& ~PHASE_MASK
) | phase
;
487 static void lsi_bad_phase(LSIState
*s
, int out
, int new_phase
)
489 /* Trigger a phase mismatch. */
490 if (s
->ccntl0
& LSI_CCNTL0_ENPMJ
) {
491 if ((s
->ccntl0
& LSI_CCNTL0_PMJCTL
) || out
) {
496 DPRINTF("Data phase mismatch jump to %08x\n", s
->dsp
);
498 DPRINTF("Phase mismatch interrupt\n");
499 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
502 lsi_set_phase(s
, new_phase
);
506 /* Resume SCRIPTS execution after a DMA operation. */
507 static void lsi_resume_script(LSIState
*s
)
509 if (s
->waiting
!= 2) {
511 lsi_execute_script(s
);
517 /* Initiate a SCSI layer data transfer. */
518 static void lsi_do_dma(LSIState
*s
, int out
)
521 target_phys_addr_t addr
;
524 if (!s
->current
->dma_len
) {
525 /* Wait until data is available. */
526 DPRINTF("DMA no data available\n");
531 if (count
> s
->current
->dma_len
)
532 count
= s
->current
->dma_len
;
535 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
536 if (lsi_dma_40bit(s
) || lsi_dma_ti64bit(s
))
537 addr
|= ((uint64_t)s
->dnad64
<< 32);
539 addr
|= ((uint64_t)s
->dbms
<< 32);
541 addr
|= ((uint64_t)s
->sbms
<< 32);
543 DPRINTF("DMA addr=0x" TARGET_FMT_plx
" len=%d\n", addr
, count
);
548 if (s
->current
->dma_buf
== NULL
) {
549 s
->current
->dma_buf
= s
->current
->dev
->info
->get_buf(s
->current
->dev
,
553 /* ??? Set SFBR to first data byte. */
555 cpu_physical_memory_read(addr
, s
->current
->dma_buf
, count
);
557 cpu_physical_memory_write(addr
, s
->current
->dma_buf
, count
);
559 s
->current
->dma_len
-= count
;
560 if (s
->current
->dma_len
== 0) {
561 s
->current
->dma_buf
= NULL
;
563 /* Write the data. */
564 s
->current
->dev
->info
->write_data(s
->current
->dev
, s
->current
->tag
);
566 /* Request any remaining data. */
567 s
->current
->dev
->info
->read_data(s
->current
->dev
, s
->current
->tag
);
570 s
->current
->dma_buf
+= count
;
571 lsi_resume_script(s
);
576 /* Add a command to the queue. */
577 static void lsi_queue_command(LSIState
*s
)
579 lsi_request
*p
= s
->current
;
581 DPRINTF("Queueing tag=0x%x\n", s
->current_tag
);
582 assert(s
->current
!= NULL
);
583 assert(s
->current
->dma_len
== 0);
584 QTAILQ_INSERT_TAIL(&s
->queue
, s
->current
, next
);
588 p
->out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
591 /* Queue a byte for a MSG IN phase. */
592 static void lsi_add_msg_byte(LSIState
*s
, uint8_t data
)
594 if (s
->msg_len
>= LSI_MAX_MSGIN_LEN
) {
595 BADF("MSG IN data too long\n");
597 DPRINTF("MSG IN 0x%02x\n", data
);
598 s
->msg
[s
->msg_len
++] = data
;
602 /* Perform reselection to continue a command. */
603 static void lsi_reselect(LSIState
*s
, lsi_request
*p
)
607 assert(s
->current
== NULL
);
608 QTAILQ_REMOVE(&s
->queue
, p
, next
);
611 id
= (p
->tag
>> 8) & 0xf;
613 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
614 if (!(s
->dcntl
& LSI_DCNTL_COM
)) {
615 s
->sfbr
= 1 << (id
& 0x7);
617 DPRINTF("Reselected target %d\n", id
);
618 s
->scntl1
|= LSI_SCNTL1_CON
;
619 lsi_set_phase(s
, PHASE_MI
);
620 s
->msg_action
= p
->out
? 2 : 3;
621 s
->current
->dma_len
= p
->pending
;
622 lsi_add_msg_byte(s
, 0x80);
623 if (s
->current
->tag
& LSI_TAG_VALID
) {
624 lsi_add_msg_byte(s
, 0x20);
625 lsi_add_msg_byte(s
, p
->tag
& 0xff);
628 if (lsi_irq_on_rsl(s
)) {
629 lsi_script_scsi_interrupt(s
, LSI_SIST0_RSL
, 0);
633 /* Record that data is available for a queued command. Returns zero if
634 the device was reselected, nonzero if the IO is deferred. */
635 static int lsi_queue_tag(LSIState
*s
, uint32_t tag
, uint32_t arg
)
639 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
642 BADF("Multiple IO pending for tag %d\n", tag
);
645 /* Reselect if waiting for it, or if reselection triggers an IRQ
647 Since no interrupt stacking is implemented in the emulation, it
648 is also required that there are no pending interrupts waiting
649 for service from the device driver. */
650 if (s
->waiting
== 1 ||
651 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
) &&
652 !(s
->istat0
& (LSI_ISTAT0_SIP
| LSI_ISTAT0_DIP
)))) {
653 /* Reselect device. */
657 DPRINTF("Queueing IO tag=0x%x\n", tag
);
663 BADF("IO with unknown tag %d\n", tag
);
667 /* Callback to indicate that the SCSI layer has completed a transfer. */
668 static void lsi_command_complete(SCSIBus
*bus
, int reason
, uint32_t tag
,
671 LSIState
*s
= DO_UPCAST(LSIState
, dev
.qdev
, bus
->qbus
.parent
);
674 out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
675 if (reason
== SCSI_REASON_DONE
) {
676 DPRINTF("Command complete sense=%d\n", (int)arg
);
678 s
->command_complete
= 2;
679 if (s
->waiting
&& s
->dbc
!= 0) {
680 /* Raise phase mismatch for short transfers. */
681 lsi_bad_phase(s
, out
, PHASE_ST
);
683 lsi_set_phase(s
, PHASE_ST
);
686 qemu_free(s
->current
);
689 lsi_resume_script(s
);
693 if (s
->waiting
== 1 || !s
->current
|| tag
!= s
->current
->tag
||
694 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
))) {
695 if (lsi_queue_tag(s
, tag
, arg
))
699 /* host adapter (re)connected */
700 DPRINTF("Data ready tag=0x%x len=%d\n", tag
, arg
);
701 s
->current
->dma_len
= arg
;
702 s
->command_complete
= 1;
705 if (s
->waiting
== 1 || s
->dbc
== 0) {
706 lsi_resume_script(s
);
712 static void lsi_do_command(LSIState
*s
)
717 DPRINTF("Send command len=%d\n", s
->dbc
);
720 cpu_physical_memory_read(s
->dnad
, buf
, s
->dbc
);
722 s
->command_complete
= 0;
724 assert(s
->current
== NULL
);
725 s
->current
= qemu_mallocz(sizeof(lsi_request
));
726 s
->current
->tag
= s
->select_tag
;
727 s
->current
->dev
= s
->select_dev
;
729 n
= s
->current
->dev
->info
->send_command(s
->current
->dev
, s
->current
->tag
, buf
,
732 lsi_set_phase(s
, PHASE_DI
);
733 s
->current
->dev
->info
->read_data(s
->current
->dev
, s
->current
->tag
);
735 lsi_set_phase(s
, PHASE_DO
);
736 s
->current
->dev
->info
->write_data(s
->current
->dev
, s
->current
->tag
);
739 if (!s
->command_complete
) {
741 /* Command did not complete immediately so disconnect. */
742 lsi_add_msg_byte(s
, 2); /* SAVE DATA POINTER */
743 lsi_add_msg_byte(s
, 4); /* DISCONNECT */
745 lsi_set_phase(s
, PHASE_MI
);
747 lsi_queue_command(s
);
749 /* wait command complete */
750 lsi_set_phase(s
, PHASE_DI
);
755 static void lsi_do_status(LSIState
*s
)
758 DPRINTF("Get status len=%d sense=%d\n", s
->dbc
, s
->sense
);
760 BADF("Bad Status move\n");
764 cpu_physical_memory_write(s
->dnad
, &sense
, 1);
765 lsi_set_phase(s
, PHASE_MI
);
767 lsi_add_msg_byte(s
, 0); /* COMMAND COMPLETE */
770 static void lsi_disconnect(LSIState
*s
)
772 s
->scntl1
&= ~LSI_SCNTL1_CON
;
773 s
->sstat1
&= ~PHASE_MASK
;
776 static void lsi_do_msgin(LSIState
*s
)
779 DPRINTF("Message in len=%d/%d\n", s
->dbc
, s
->msg_len
);
784 cpu_physical_memory_write(s
->dnad
, s
->msg
, len
);
785 /* Linux drivers rely on the last byte being in the SIDL. */
786 s
->sidl
= s
->msg
[len
- 1];
789 memmove(s
->msg
, s
->msg
+ len
, s
->msg_len
);
791 /* ??? Check if ATN (not yet implemented) is asserted and maybe
792 switch to PHASE_MO. */
793 switch (s
->msg_action
) {
795 lsi_set_phase(s
, PHASE_CMD
);
801 lsi_set_phase(s
, PHASE_DO
);
804 lsi_set_phase(s
, PHASE_DI
);
812 /* Read the next byte during a MSGOUT phase. */
813 static uint8_t lsi_get_msgbyte(LSIState
*s
)
816 cpu_physical_memory_read(s
->dnad
, &data
, 1);
822 static void lsi_do_msgout(LSIState
*s
)
827 DPRINTF("MSG out len=%d\n", s
->dbc
);
829 msg
= lsi_get_msgbyte(s
);
834 DPRINTF("MSG: Disconnect\n");
838 DPRINTF("MSG: No Operation\n");
839 lsi_set_phase(s
, PHASE_CMD
);
842 len
= lsi_get_msgbyte(s
);
843 msg
= lsi_get_msgbyte(s
);
844 DPRINTF("Extended message 0x%x (len %d)\n", msg
, len
);
847 DPRINTF("SDTR (ignored)\n");
851 DPRINTF("WDTR (ignored)\n");
858 case 0x20: /* SIMPLE queue */
859 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
860 DPRINTF("SIMPLE queue tag=0x%x\n", s
->current_tag
& 0xff);
862 case 0x21: /* HEAD of queue */
863 BADF("HEAD queue not implemented\n");
864 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
866 case 0x22: /* ORDERED queue */
867 BADF("ORDERED queue not implemented\n");
868 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
871 if ((msg
& 0x80) == 0) {
874 s
->current_lun
= msg
& 7;
875 DPRINTF("Select LUN %d\n", s
->current_lun
);
876 lsi_set_phase(s
, PHASE_CMD
);
882 BADF("Unimplemented message 0x%02x\n", msg
);
883 lsi_set_phase(s
, PHASE_MI
);
884 lsi_add_msg_byte(s
, 7); /* MESSAGE REJECT */
888 /* Sign extend a 24-bit value. */
889 static inline int32_t sxt24(int32_t n
)
891 return (n
<< 8) >> 8;
894 #define LSI_BUF_SIZE 4096
895 static void lsi_memcpy(LSIState
*s
, uint32_t dest
, uint32_t src
, int count
)
898 uint8_t buf
[LSI_BUF_SIZE
];
900 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest
, src
, count
);
902 n
= (count
> LSI_BUF_SIZE
) ? LSI_BUF_SIZE
: count
;
903 cpu_physical_memory_read(src
, buf
, n
);
904 cpu_physical_memory_write(dest
, buf
, n
);
911 static void lsi_wait_reselect(LSIState
*s
)
915 DPRINTF("Wait Reselect\n");
917 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
923 if (s
->current
== NULL
) {
928 static void lsi_execute_script(LSIState
*s
)
931 uint32_t addr
, addr_high
;
933 int insn_processed
= 0;
935 s
->istat1
|= LSI_ISTAT1_SRUN
;
938 insn
= read_dword(s
, s
->dsp
);
940 /* If we receive an empty opcode increment the DSP by 4 bytes
941 instead of 8 and execute the next opcode at that location */
945 addr
= read_dword(s
, s
->dsp
+ 4);
947 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s
->dsp
, insn
, addr
);
949 s
->dcmd
= insn
>> 24;
951 switch (insn
>> 30) {
952 case 0: /* Block move. */
953 if (s
->sist1
& LSI_SIST1_STO
) {
954 DPRINTF("Delayed select timeout\n");
958 s
->dbc
= insn
& 0xffffff;
962 if (insn
& (1 << 29)) {
963 /* Indirect addressing. */
964 addr
= read_dword(s
, addr
);
965 } else if (insn
& (1 << 28)) {
968 /* Table indirect addressing. */
970 /* 32-bit Table indirect */
971 offset
= sxt24(addr
);
972 cpu_physical_memory_read(s
->dsa
+ offset
, (uint8_t *)buf
, 8);
973 /* byte count is stored in bits 0:23 only */
974 s
->dbc
= cpu_to_le32(buf
[0]) & 0xffffff;
976 addr
= cpu_to_le32(buf
[1]);
978 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
979 * table, bits [31:24] */
980 if (lsi_dma_40bit(s
))
981 addr_high
= cpu_to_le32(buf
[0]) >> 24;
982 else if (lsi_dma_ti64bit(s
)) {
983 int selector
= (cpu_to_le32(buf
[0]) >> 24) & 0x1f;
986 /* offset index into scratch registers since
987 * TI64 mode can use registers C to R */
988 addr_high
= s
->scratch
[2 + selector
];
1003 addr_high
= s
->sbms
;
1006 addr_high
= s
->dbms
;
1009 BADF("Illegal selector specified (0x%x > 0x15)"
1010 " for 64-bit DMA block move", selector
);
1014 } else if (lsi_dma_64bit(s
)) {
1015 /* fetch a 3rd dword if 64-bit direct move is enabled and
1016 only if we're not doing table indirect or indirect addressing */
1017 s
->dbms
= read_dword(s
, s
->dsp
);
1019 s
->ia
= s
->dsp
- 12;
1021 if ((s
->sstat1
& PHASE_MASK
) != ((insn
>> 24) & 7)) {
1022 DPRINTF("Wrong phase got %d expected %d\n",
1023 s
->sstat1
& PHASE_MASK
, (insn
>> 24) & 7);
1024 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
1028 s
->dnad64
= addr_high
;
1029 switch (s
->sstat1
& 0x7) {
1055 BADF("Unimplemented phase %d\n", s
->sstat1
& PHASE_MASK
);
1058 s
->dfifo
= s
->dbc
& 0xff;
1059 s
->ctest5
= (s
->ctest5
& 0xfc) | ((s
->dbc
>> 8) & 3);
1062 s
->ua
= addr
+ s
->dbc
;
1065 case 1: /* IO or Read/Write instruction. */
1066 opcode
= (insn
>> 27) & 7;
1070 if (insn
& (1 << 25)) {
1071 id
= read_dword(s
, s
->dsa
+ sxt24(insn
));
1075 id
= (id
>> 16) & 0xf;
1076 if (insn
& (1 << 26)) {
1077 addr
= s
->dsp
+ sxt24(addr
);
1081 case 0: /* Select */
1083 if (s
->scntl1
& LSI_SCNTL1_CON
) {
1084 DPRINTF("Already reselected, jumping to alternative address\n");
1088 s
->sstat0
|= LSI_SSTAT0_WOA
;
1089 s
->scntl1
&= ~LSI_SCNTL1_IARB
;
1090 if (id
>= LSI_MAX_DEVS
|| !s
->bus
.devs
[id
]) {
1091 DPRINTF("Selected absent target %d\n", id
);
1092 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_STO
);
1096 DPRINTF("Selected target %d%s\n",
1097 id
, insn
& (1 << 3) ? " ATN" : "");
1098 /* ??? Linux drivers compain when this is set. Maybe
1099 it only applies in low-level mode (unimplemented).
1100 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1101 s
->select_dev
= s
->bus
.devs
[id
];
1102 s
->select_tag
= id
<< 8;
1103 s
->scntl1
|= LSI_SCNTL1_CON
;
1104 if (insn
& (1 << 3)) {
1105 s
->socl
|= LSI_SOCL_ATN
;
1107 lsi_set_phase(s
, PHASE_MO
);
1109 case 1: /* Disconnect */
1110 DPRINTF("Wait Disconnect\n");
1111 s
->scntl1
&= ~LSI_SCNTL1_CON
;
1113 case 2: /* Wait Reselect */
1114 if (!lsi_irq_on_rsl(s
)) {
1115 lsi_wait_reselect(s
);
1119 DPRINTF("Set%s%s%s%s\n",
1120 insn
& (1 << 3) ? " ATN" : "",
1121 insn
& (1 << 6) ? " ACK" : "",
1122 insn
& (1 << 9) ? " TM" : "",
1123 insn
& (1 << 10) ? " CC" : "");
1124 if (insn
& (1 << 3)) {
1125 s
->socl
|= LSI_SOCL_ATN
;
1126 lsi_set_phase(s
, PHASE_MO
);
1128 if (insn
& (1 << 9)) {
1129 BADF("Target mode not implemented\n");
1132 if (insn
& (1 << 10))
1136 DPRINTF("Clear%s%s%s%s\n",
1137 insn
& (1 << 3) ? " ATN" : "",
1138 insn
& (1 << 6) ? " ACK" : "",
1139 insn
& (1 << 9) ? " TM" : "",
1140 insn
& (1 << 10) ? " CC" : "");
1141 if (insn
& (1 << 3)) {
1142 s
->socl
&= ~LSI_SOCL_ATN
;
1144 if (insn
& (1 << 10))
1155 static const char *opcode_names
[3] =
1156 {"Write", "Read", "Read-Modify-Write"};
1157 static const char *operator_names
[8] =
1158 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1161 reg
= ((insn
>> 16) & 0x7f) | (insn
& 0x80);
1162 data8
= (insn
>> 8) & 0xff;
1163 opcode
= (insn
>> 27) & 7;
1164 operator = (insn
>> 24) & 7;
1165 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1166 opcode_names
[opcode
- 5], reg
,
1167 operator_names
[operator], data8
, s
->sfbr
,
1168 (insn
& (1 << 23)) ? " SFBR" : "");
1171 case 5: /* From SFBR */
1175 case 6: /* To SFBR */
1177 op0
= lsi_reg_readb(s
, reg
);
1180 case 7: /* Read-modify-write */
1182 op0
= lsi_reg_readb(s
, reg
);
1183 if (insn
& (1 << 23)) {
1195 case 1: /* Shift left */
1197 op0
= (op0
<< 1) | s
->carry
;
1211 op0
= (op0
>> 1) | (s
->carry
<< 7);
1216 s
->carry
= op0
< op1
;
1219 op0
+= op1
+ s
->carry
;
1221 s
->carry
= op0
<= op1
;
1223 s
->carry
= op0
< op1
;
1228 case 5: /* From SFBR */
1229 case 7: /* Read-modify-write */
1230 lsi_reg_writeb(s
, reg
, op0
);
1232 case 6: /* To SFBR */
1239 case 2: /* Transfer Control. */
1244 if ((insn
& 0x002e0000) == 0) {
1248 if (s
->sist1
& LSI_SIST1_STO
) {
1249 DPRINTF("Delayed select timeout\n");
1253 cond
= jmp
= (insn
& (1 << 19)) != 0;
1254 if (cond
== jmp
&& (insn
& (1 << 21))) {
1255 DPRINTF("Compare carry %d\n", s
->carry
== jmp
);
1256 cond
= s
->carry
!= 0;
1258 if (cond
== jmp
&& (insn
& (1 << 17))) {
1259 DPRINTF("Compare phase %d %c= %d\n",
1260 (s
->sstat1
& PHASE_MASK
),
1262 ((insn
>> 24) & 7));
1263 cond
= (s
->sstat1
& PHASE_MASK
) == ((insn
>> 24) & 7);
1265 if (cond
== jmp
&& (insn
& (1 << 18))) {
1268 mask
= (~insn
>> 8) & 0xff;
1269 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1270 s
->sfbr
, mask
, jmp
? '=' : '!', insn
& mask
);
1271 cond
= (s
->sfbr
& mask
) == (insn
& mask
);
1274 if (insn
& (1 << 23)) {
1275 /* Relative address. */
1276 addr
= s
->dsp
+ sxt24(addr
);
1278 switch ((insn
>> 27) & 7) {
1280 DPRINTF("Jump to 0x%08x\n", addr
);
1284 DPRINTF("Call 0x%08x\n", addr
);
1288 case 2: /* Return */
1289 DPRINTF("Return to 0x%08x\n", s
->temp
);
1292 case 3: /* Interrupt */
1293 DPRINTF("Interrupt 0x%08x\n", s
->dsps
);
1294 if ((insn
& (1 << 20)) != 0) {
1295 s
->istat0
|= LSI_ISTAT0_INTF
;
1298 lsi_script_dma_interrupt(s
, LSI_DSTAT_SIR
);
1302 DPRINTF("Illegal transfer control\n");
1303 lsi_script_dma_interrupt(s
, LSI_DSTAT_IID
);
1307 DPRINTF("Control condition failed\n");
1313 if ((insn
& (1 << 29)) == 0) {
1316 /* ??? The docs imply the destination address is loaded into
1317 the TEMP register. However the Linux drivers rely on
1318 the value being presrved. */
1319 dest
= read_dword(s
, s
->dsp
);
1321 lsi_memcpy(s
, dest
, addr
, insn
& 0xffffff);
1328 if (insn
& (1 << 28)) {
1329 addr
= s
->dsa
+ sxt24(addr
);
1332 reg
= (insn
>> 16) & 0xff;
1333 if (insn
& (1 << 24)) {
1334 cpu_physical_memory_read(addr
, data
, n
);
1335 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg
, n
,
1336 addr
, *(int *)data
);
1337 for (i
= 0; i
< n
; i
++) {
1338 lsi_reg_writeb(s
, reg
+ i
, data
[i
]);
1341 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg
, n
, addr
);
1342 for (i
= 0; i
< n
; i
++) {
1343 data
[i
] = lsi_reg_readb(s
, reg
+ i
);
1345 cpu_physical_memory_write(addr
, data
, n
);
1349 if (insn_processed
> 10000 && !s
->waiting
) {
1350 /* Some windows drivers make the device spin waiting for a memory
1351 location to change. If we have been executed a lot of code then
1352 assume this is the case and force an unexpected device disconnect.
1353 This is apparently sufficient to beat the drivers into submission.
1355 if (!(s
->sien0
& LSI_SIST0_UDC
))
1356 fprintf(stderr
, "inf. loop with UDC masked\n");
1357 lsi_script_scsi_interrupt(s
, LSI_SIST0_UDC
, 0);
1359 } else if (s
->istat1
& LSI_ISTAT1_SRUN
&& !s
->waiting
) {
1360 if (s
->dcntl
& LSI_DCNTL_SSM
) {
1361 lsi_script_dma_interrupt(s
, LSI_DSTAT_SSI
);
1366 DPRINTF("SCRIPTS execution stopped\n");
1369 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
)
1372 #define CASE_GET_REG24(name, addr) \
1373 case addr: return s->name & 0xff; \
1374 case addr + 1: return (s->name >> 8) & 0xff; \
1375 case addr + 2: return (s->name >> 16) & 0xff;
1377 #define CASE_GET_REG32(name, addr) \
1378 case addr: return s->name & 0xff; \
1379 case addr + 1: return (s->name >> 8) & 0xff; \
1380 case addr + 2: return (s->name >> 16) & 0xff; \
1381 case addr + 3: return (s->name >> 24) & 0xff;
1383 #ifdef DEBUG_LSI_REG
1384 DPRINTF("Read reg %x\n", offset
);
1387 case 0x00: /* SCNTL0 */
1389 case 0x01: /* SCNTL1 */
1391 case 0x02: /* SCNTL2 */
1393 case 0x03: /* SCNTL3 */
1395 case 0x04: /* SCID */
1397 case 0x05: /* SXFER */
1399 case 0x06: /* SDID */
1401 case 0x07: /* GPREG0 */
1403 case 0x08: /* Revision ID */
1405 case 0xa: /* SSID */
1407 case 0xb: /* SBCL */
1408 /* ??? This is not correct. However it's (hopefully) only
1409 used for diagnostics, so should be ok. */
1411 case 0xc: /* DSTAT */
1412 tmp
= s
->dstat
| 0x80;
1413 if ((s
->istat0
& LSI_ISTAT0_INTF
) == 0)
1417 case 0x0d: /* SSTAT0 */
1419 case 0x0e: /* SSTAT1 */
1421 case 0x0f: /* SSTAT2 */
1422 return s
->scntl1
& LSI_SCNTL1_CON
? 0 : 2;
1423 CASE_GET_REG32(dsa
, 0x10)
1424 case 0x14: /* ISTAT0 */
1426 case 0x15: /* ISTAT1 */
1428 case 0x16: /* MBOX0 */
1430 case 0x17: /* MBOX1 */
1432 case 0x18: /* CTEST0 */
1434 case 0x19: /* CTEST1 */
1436 case 0x1a: /* CTEST2 */
1437 tmp
= s
->ctest2
| LSI_CTEST2_DACK
| LSI_CTEST2_CM
;
1438 if (s
->istat0
& LSI_ISTAT0_SIGP
) {
1439 s
->istat0
&= ~LSI_ISTAT0_SIGP
;
1440 tmp
|= LSI_CTEST2_SIGP
;
1443 case 0x1b: /* CTEST3 */
1445 CASE_GET_REG32(temp
, 0x1c)
1446 case 0x20: /* DFIFO */
1448 case 0x21: /* CTEST4 */
1450 case 0x22: /* CTEST5 */
1452 case 0x23: /* CTEST6 */
1454 CASE_GET_REG24(dbc
, 0x24)
1455 case 0x27: /* DCMD */
1457 CASE_GET_REG32(dnad
, 0x28)
1458 CASE_GET_REG32(dsp
, 0x2c)
1459 CASE_GET_REG32(dsps
, 0x30)
1460 CASE_GET_REG32(scratch
[0], 0x34)
1461 case 0x38: /* DMODE */
1463 case 0x39: /* DIEN */
1465 case 0x3a: /* SBR */
1467 case 0x3b: /* DCNTL */
1469 case 0x40: /* SIEN0 */
1471 case 0x41: /* SIEN1 */
1473 case 0x42: /* SIST0 */
1478 case 0x43: /* SIST1 */
1483 case 0x46: /* MACNTL */
1485 case 0x47: /* GPCNTL0 */
1487 case 0x48: /* STIME0 */
1489 case 0x4a: /* RESPID0 */
1491 case 0x4b: /* RESPID1 */
1493 case 0x4d: /* STEST1 */
1495 case 0x4e: /* STEST2 */
1497 case 0x4f: /* STEST3 */
1499 case 0x50: /* SIDL */
1500 /* This is needed by the linux drivers. We currently only update it
1501 during the MSG IN phase. */
1503 case 0x52: /* STEST4 */
1505 case 0x56: /* CCNTL0 */
1507 case 0x57: /* CCNTL1 */
1509 case 0x58: /* SBDL */
1510 /* Some drivers peek at the data bus during the MSG IN phase. */
1511 if ((s
->sstat1
& PHASE_MASK
) == PHASE_MI
)
1514 case 0x59: /* SBDL high */
1516 CASE_GET_REG32(mmrs
, 0xa0)
1517 CASE_GET_REG32(mmws
, 0xa4)
1518 CASE_GET_REG32(sfs
, 0xa8)
1519 CASE_GET_REG32(drs
, 0xac)
1520 CASE_GET_REG32(sbms
, 0xb0)
1521 CASE_GET_REG32(dbms
, 0xb4)
1522 CASE_GET_REG32(dnad64
, 0xb8)
1523 CASE_GET_REG32(pmjad1
, 0xc0)
1524 CASE_GET_REG32(pmjad2
, 0xc4)
1525 CASE_GET_REG32(rbc
, 0xc8)
1526 CASE_GET_REG32(ua
, 0xcc)
1527 CASE_GET_REG32(ia
, 0xd4)
1528 CASE_GET_REG32(sbc
, 0xd8)
1529 CASE_GET_REG32(csbc
, 0xdc)
1531 if (offset
>= 0x5c && offset
< 0xa0) {
1534 n
= (offset
- 0x58) >> 2;
1535 shift
= (offset
& 3) * 8;
1536 return (s
->scratch
[n
] >> shift
) & 0xff;
1538 BADF("readb 0x%x\n", offset
);
1540 #undef CASE_GET_REG24
1541 #undef CASE_GET_REG32
1544 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
)
1546 #define CASE_SET_REG24(name, addr) \
1547 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1548 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1549 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1551 #define CASE_SET_REG32(name, addr) \
1552 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1553 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1554 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1555 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1557 #ifdef DEBUG_LSI_REG
1558 DPRINTF("Write reg %x = %02x\n", offset
, val
);
1561 case 0x00: /* SCNTL0 */
1563 if (val
& LSI_SCNTL0_START
) {
1564 BADF("Start sequence not implemented\n");
1567 case 0x01: /* SCNTL1 */
1568 s
->scntl1
= val
& ~LSI_SCNTL1_SST
;
1569 if (val
& LSI_SCNTL1_IARB
) {
1570 BADF("Immediate Arbritration not implemented\n");
1572 if (val
& LSI_SCNTL1_RST
) {
1573 s
->sstat0
|= LSI_SSTAT0_RST
;
1574 lsi_script_scsi_interrupt(s
, LSI_SIST0_RST
, 0);
1576 s
->sstat0
&= ~LSI_SSTAT0_RST
;
1579 case 0x02: /* SCNTL2 */
1580 val
&= ~(LSI_SCNTL2_WSR
| LSI_SCNTL2_WSS
);
1583 case 0x03: /* SCNTL3 */
1586 case 0x04: /* SCID */
1589 case 0x05: /* SXFER */
1592 case 0x06: /* SDID */
1593 if ((val
& 0xf) != (s
->ssid
& 0xf))
1594 BADF("Destination ID does not match SSID\n");
1595 s
->sdid
= val
& 0xf;
1597 case 0x07: /* GPREG0 */
1599 case 0x08: /* SFBR */
1600 /* The CPU is not allowed to write to this register. However the
1601 SCRIPTS register move instructions are. */
1604 case 0x0a: case 0x0b:
1605 /* Openserver writes to these readonly registers on startup */
1607 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1608 /* Linux writes to these readonly registers on startup. */
1610 CASE_SET_REG32(dsa
, 0x10)
1611 case 0x14: /* ISTAT0 */
1612 s
->istat0
= (s
->istat0
& 0x0f) | (val
& 0xf0);
1613 if (val
& LSI_ISTAT0_ABRT
) {
1614 lsi_script_dma_interrupt(s
, LSI_DSTAT_ABRT
);
1616 if (val
& LSI_ISTAT0_INTF
) {
1617 s
->istat0
&= ~LSI_ISTAT0_INTF
;
1620 if (s
->waiting
== 1 && val
& LSI_ISTAT0_SIGP
) {
1621 DPRINTF("Woken by SIGP\n");
1624 lsi_execute_script(s
);
1626 if (val
& LSI_ISTAT0_SRST
) {
1630 case 0x16: /* MBOX0 */
1633 case 0x17: /* MBOX1 */
1636 case 0x1a: /* CTEST2 */
1637 s
->ctest2
= val
& LSI_CTEST2_PCICIE
;
1639 case 0x1b: /* CTEST3 */
1640 s
->ctest3
= val
& 0x0f;
1642 CASE_SET_REG32(temp
, 0x1c)
1643 case 0x21: /* CTEST4 */
1645 BADF("Unimplemented CTEST4-FBL 0x%x\n", val
);
1649 case 0x22: /* CTEST5 */
1650 if (val
& (LSI_CTEST5_ADCK
| LSI_CTEST5_BBCK
)) {
1651 BADF("CTEST5 DMA increment not implemented\n");
1655 CASE_SET_REG24(dbc
, 0x24)
1656 CASE_SET_REG32(dnad
, 0x28)
1657 case 0x2c: /* DSP[0:7] */
1658 s
->dsp
&= 0xffffff00;
1661 case 0x2d: /* DSP[8:15] */
1662 s
->dsp
&= 0xffff00ff;
1665 case 0x2e: /* DSP[16:23] */
1666 s
->dsp
&= 0xff00ffff;
1667 s
->dsp
|= val
<< 16;
1669 case 0x2f: /* DSP[24:31] */
1670 s
->dsp
&= 0x00ffffff;
1671 s
->dsp
|= val
<< 24;
1672 if ((s
->dmode
& LSI_DMODE_MAN
) == 0
1673 && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1674 lsi_execute_script(s
);
1676 CASE_SET_REG32(dsps
, 0x30)
1677 CASE_SET_REG32(scratch
[0], 0x34)
1678 case 0x38: /* DMODE */
1679 if (val
& (LSI_DMODE_SIOM
| LSI_DMODE_DIOM
)) {
1680 BADF("IO mappings not implemented\n");
1684 case 0x39: /* DIEN */
1688 case 0x3a: /* SBR */
1691 case 0x3b: /* DCNTL */
1692 s
->dcntl
= val
& ~(LSI_DCNTL_PFF
| LSI_DCNTL_STD
);
1693 if ((val
& LSI_DCNTL_STD
) && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1694 lsi_execute_script(s
);
1696 case 0x40: /* SIEN0 */
1700 case 0x41: /* SIEN1 */
1704 case 0x47: /* GPCNTL0 */
1706 case 0x48: /* STIME0 */
1709 case 0x49: /* STIME1 */
1711 DPRINTF("General purpose timer not implemented\n");
1712 /* ??? Raising the interrupt immediately seems to be sufficient
1713 to keep the FreeBSD driver happy. */
1714 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_GEN
);
1717 case 0x4a: /* RESPID0 */
1720 case 0x4b: /* RESPID1 */
1723 case 0x4d: /* STEST1 */
1726 case 0x4e: /* STEST2 */
1728 BADF("Low level mode not implemented\n");
1732 case 0x4f: /* STEST3 */
1734 BADF("SCSI FIFO test mode not implemented\n");
1738 case 0x56: /* CCNTL0 */
1741 case 0x57: /* CCNTL1 */
1744 CASE_SET_REG32(mmrs
, 0xa0)
1745 CASE_SET_REG32(mmws
, 0xa4)
1746 CASE_SET_REG32(sfs
, 0xa8)
1747 CASE_SET_REG32(drs
, 0xac)
1748 CASE_SET_REG32(sbms
, 0xb0)
1749 CASE_SET_REG32(dbms
, 0xb4)
1750 CASE_SET_REG32(dnad64
, 0xb8)
1751 CASE_SET_REG32(pmjad1
, 0xc0)
1752 CASE_SET_REG32(pmjad2
, 0xc4)
1753 CASE_SET_REG32(rbc
, 0xc8)
1754 CASE_SET_REG32(ua
, 0xcc)
1755 CASE_SET_REG32(ia
, 0xd4)
1756 CASE_SET_REG32(sbc
, 0xd8)
1757 CASE_SET_REG32(csbc
, 0xdc)
1759 if (offset
>= 0x5c && offset
< 0xa0) {
1762 n
= (offset
- 0x58) >> 2;
1763 shift
= (offset
& 3) * 8;
1764 s
->scratch
[n
] &= ~(0xff << shift
);
1765 s
->scratch
[n
] |= (val
& 0xff) << shift
;
1767 BADF("Unhandled writeb 0x%x = 0x%x\n", offset
, val
);
1770 #undef CASE_SET_REG24
1771 #undef CASE_SET_REG32
1774 static void lsi_mmio_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1776 LSIState
*s
= opaque
;
1778 lsi_reg_writeb(s
, addr
& 0xff, val
);
1781 static void lsi_mmio_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1783 LSIState
*s
= opaque
;
1786 lsi_reg_writeb(s
, addr
, val
& 0xff);
1787 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1790 static void lsi_mmio_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1792 LSIState
*s
= opaque
;
1795 lsi_reg_writeb(s
, addr
, val
& 0xff);
1796 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1797 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1798 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1801 static uint32_t lsi_mmio_readb(void *opaque
, target_phys_addr_t addr
)
1803 LSIState
*s
= opaque
;
1805 return lsi_reg_readb(s
, addr
& 0xff);
1808 static uint32_t lsi_mmio_readw(void *opaque
, target_phys_addr_t addr
)
1810 LSIState
*s
= opaque
;
1814 val
= lsi_reg_readb(s
, addr
);
1815 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1819 static uint32_t lsi_mmio_readl(void *opaque
, target_phys_addr_t addr
)
1821 LSIState
*s
= opaque
;
1824 val
= lsi_reg_readb(s
, addr
);
1825 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1826 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1827 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1831 static CPUReadMemoryFunc
* const lsi_mmio_readfn
[3] = {
1837 static CPUWriteMemoryFunc
* const lsi_mmio_writefn
[3] = {
1843 static void lsi_ram_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1845 LSIState
*s
= opaque
;
1850 newval
= s
->script_ram
[addr
>> 2];
1851 shift
= (addr
& 3) * 8;
1852 newval
&= ~(0xff << shift
);
1853 newval
|= val
<< shift
;
1854 s
->script_ram
[addr
>> 2] = newval
;
1857 static void lsi_ram_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1859 LSIState
*s
= opaque
;
1863 newval
= s
->script_ram
[addr
>> 2];
1865 newval
= (newval
& 0xffff) | (val
<< 16);
1867 newval
= (newval
& 0xffff0000) | val
;
1869 s
->script_ram
[addr
>> 2] = newval
;
1873 static void lsi_ram_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1875 LSIState
*s
= opaque
;
1878 s
->script_ram
[addr
>> 2] = val
;
1881 static uint32_t lsi_ram_readb(void *opaque
, target_phys_addr_t addr
)
1883 LSIState
*s
= opaque
;
1887 val
= s
->script_ram
[addr
>> 2];
1888 val
>>= (addr
& 3) * 8;
1892 static uint32_t lsi_ram_readw(void *opaque
, target_phys_addr_t addr
)
1894 LSIState
*s
= opaque
;
1898 val
= s
->script_ram
[addr
>> 2];
1901 return le16_to_cpu(val
);
1904 static uint32_t lsi_ram_readl(void *opaque
, target_phys_addr_t addr
)
1906 LSIState
*s
= opaque
;
1909 return le32_to_cpu(s
->script_ram
[addr
>> 2]);
1912 static CPUReadMemoryFunc
* const lsi_ram_readfn
[3] = {
1918 static CPUWriteMemoryFunc
* const lsi_ram_writefn
[3] = {
1924 static uint32_t lsi_io_readb(void *opaque
, uint32_t addr
)
1926 LSIState
*s
= opaque
;
1927 return lsi_reg_readb(s
, addr
& 0xff);
1930 static uint32_t lsi_io_readw(void *opaque
, uint32_t addr
)
1932 LSIState
*s
= opaque
;
1935 val
= lsi_reg_readb(s
, addr
);
1936 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1940 static uint32_t lsi_io_readl(void *opaque
, uint32_t addr
)
1942 LSIState
*s
= opaque
;
1945 val
= lsi_reg_readb(s
, addr
);
1946 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1947 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1948 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1952 static void lsi_io_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
1954 LSIState
*s
= opaque
;
1955 lsi_reg_writeb(s
, addr
& 0xff, val
);
1958 static void lsi_io_writew(void *opaque
, uint32_t addr
, uint32_t val
)
1960 LSIState
*s
= opaque
;
1962 lsi_reg_writeb(s
, addr
, val
& 0xff);
1963 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1966 static void lsi_io_writel(void *opaque
, uint32_t addr
, uint32_t val
)
1968 LSIState
*s
= opaque
;
1970 lsi_reg_writeb(s
, addr
, val
& 0xff);
1971 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1972 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1973 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1976 static void lsi_io_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1977 pcibus_t addr
, pcibus_t size
, int type
)
1979 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1981 DPRINTF("Mapping IO at %08"FMT_PCIBUS
"\n", addr
);
1983 register_ioport_write(addr
, 256, 1, lsi_io_writeb
, s
);
1984 register_ioport_read(addr
, 256, 1, lsi_io_readb
, s
);
1985 register_ioport_write(addr
, 256, 2, lsi_io_writew
, s
);
1986 register_ioport_read(addr
, 256, 2, lsi_io_readw
, s
);
1987 register_ioport_write(addr
, 256, 4, lsi_io_writel
, s
);
1988 register_ioport_read(addr
, 256, 4, lsi_io_readl
, s
);
1991 static void lsi_ram_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1992 pcibus_t addr
, pcibus_t size
, int type
)
1994 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1996 DPRINTF("Mapping ram at %08"FMT_PCIBUS
"\n", addr
);
1997 s
->script_ram_base
= addr
;
1998 cpu_register_physical_memory(addr
+ 0, 0x2000, s
->ram_io_addr
);
2001 static void lsi_mmio_mapfunc(PCIDevice
*pci_dev
, int region_num
,
2002 pcibus_t addr
, pcibus_t size
, int type
)
2004 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
2006 DPRINTF("Mapping registers at %08"FMT_PCIBUS
"\n", addr
);
2007 cpu_register_physical_memory(addr
+ 0, 0x400, s
->mmio_io_addr
);
2010 static void lsi_pre_save(void *opaque
)
2012 LSIState
*s
= opaque
;
2015 assert(s
->current
->dma_buf
== NULL
);
2016 assert(s
->current
->dma_len
== 0);
2018 assert(QTAILQ_EMPTY(&s
->queue
));
2021 static const VMStateDescription vmstate_lsi_scsi
= {
2024 .minimum_version_id
= 0,
2025 .minimum_version_id_old
= 0,
2026 .pre_save
= lsi_pre_save
,
2027 .fields
= (VMStateField
[]) {
2028 VMSTATE_PCI_DEVICE(dev
, LSIState
),
2030 VMSTATE_INT32(carry
, LSIState
),
2031 VMSTATE_INT32(sense
, LSIState
),
2032 VMSTATE_INT32(msg_action
, LSIState
),
2033 VMSTATE_INT32(msg_len
, LSIState
),
2034 VMSTATE_BUFFER(msg
, LSIState
),
2035 VMSTATE_INT32(waiting
, LSIState
),
2037 VMSTATE_UINT32(dsa
, LSIState
),
2038 VMSTATE_UINT32(temp
, LSIState
),
2039 VMSTATE_UINT32(dnad
, LSIState
),
2040 VMSTATE_UINT32(dbc
, LSIState
),
2041 VMSTATE_UINT8(istat0
, LSIState
),
2042 VMSTATE_UINT8(istat1
, LSIState
),
2043 VMSTATE_UINT8(dcmd
, LSIState
),
2044 VMSTATE_UINT8(dstat
, LSIState
),
2045 VMSTATE_UINT8(dien
, LSIState
),
2046 VMSTATE_UINT8(sist0
, LSIState
),
2047 VMSTATE_UINT8(sist1
, LSIState
),
2048 VMSTATE_UINT8(sien0
, LSIState
),
2049 VMSTATE_UINT8(sien1
, LSIState
),
2050 VMSTATE_UINT8(mbox0
, LSIState
),
2051 VMSTATE_UINT8(mbox1
, LSIState
),
2052 VMSTATE_UINT8(dfifo
, LSIState
),
2053 VMSTATE_UINT8(ctest2
, LSIState
),
2054 VMSTATE_UINT8(ctest3
, LSIState
),
2055 VMSTATE_UINT8(ctest4
, LSIState
),
2056 VMSTATE_UINT8(ctest5
, LSIState
),
2057 VMSTATE_UINT8(ccntl0
, LSIState
),
2058 VMSTATE_UINT8(ccntl1
, LSIState
),
2059 VMSTATE_UINT32(dsp
, LSIState
),
2060 VMSTATE_UINT32(dsps
, LSIState
),
2061 VMSTATE_UINT8(dmode
, LSIState
),
2062 VMSTATE_UINT8(dcntl
, LSIState
),
2063 VMSTATE_UINT8(scntl0
, LSIState
),
2064 VMSTATE_UINT8(scntl1
, LSIState
),
2065 VMSTATE_UINT8(scntl2
, LSIState
),
2066 VMSTATE_UINT8(scntl3
, LSIState
),
2067 VMSTATE_UINT8(sstat0
, LSIState
),
2068 VMSTATE_UINT8(sstat1
, LSIState
),
2069 VMSTATE_UINT8(scid
, LSIState
),
2070 VMSTATE_UINT8(sxfer
, LSIState
),
2071 VMSTATE_UINT8(socl
, LSIState
),
2072 VMSTATE_UINT8(sdid
, LSIState
),
2073 VMSTATE_UINT8(ssid
, LSIState
),
2074 VMSTATE_UINT8(sfbr
, LSIState
),
2075 VMSTATE_UINT8(stest1
, LSIState
),
2076 VMSTATE_UINT8(stest2
, LSIState
),
2077 VMSTATE_UINT8(stest3
, LSIState
),
2078 VMSTATE_UINT8(sidl
, LSIState
),
2079 VMSTATE_UINT8(stime0
, LSIState
),
2080 VMSTATE_UINT8(respid0
, LSIState
),
2081 VMSTATE_UINT8(respid1
, LSIState
),
2082 VMSTATE_UINT32(mmrs
, LSIState
),
2083 VMSTATE_UINT32(mmws
, LSIState
),
2084 VMSTATE_UINT32(sfs
, LSIState
),
2085 VMSTATE_UINT32(drs
, LSIState
),
2086 VMSTATE_UINT32(sbms
, LSIState
),
2087 VMSTATE_UINT32(dbms
, LSIState
),
2088 VMSTATE_UINT32(dnad64
, LSIState
),
2089 VMSTATE_UINT32(pmjad1
, LSIState
),
2090 VMSTATE_UINT32(pmjad2
, LSIState
),
2091 VMSTATE_UINT32(rbc
, LSIState
),
2092 VMSTATE_UINT32(ua
, LSIState
),
2093 VMSTATE_UINT32(ia
, LSIState
),
2094 VMSTATE_UINT32(sbc
, LSIState
),
2095 VMSTATE_UINT32(csbc
, LSIState
),
2096 VMSTATE_BUFFER_UNSAFE(scratch
, LSIState
, 0, 18 * sizeof(uint32_t)),
2097 VMSTATE_UINT8(sbr
, LSIState
),
2099 VMSTATE_BUFFER_UNSAFE(script_ram
, LSIState
, 0, 2048 * sizeof(uint32_t)),
2100 VMSTATE_END_OF_LIST()
2104 static int lsi_scsi_uninit(PCIDevice
*d
)
2106 LSIState
*s
= DO_UPCAST(LSIState
, dev
, d
);
2108 cpu_unregister_io_memory(s
->mmio_io_addr
);
2109 cpu_unregister_io_memory(s
->ram_io_addr
);
2114 static int lsi_scsi_init(PCIDevice
*dev
)
2116 LSIState
*s
= DO_UPCAST(LSIState
, dev
, dev
);
2119 pci_conf
= s
->dev
.config
;
2121 /* PCI Vendor ID (word) */
2122 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_LSI_LOGIC
);
2123 /* PCI device ID (word) */
2124 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_LSI_53C895A
);
2125 /* PCI base class code */
2126 pci_config_set_class(pci_conf
, PCI_CLASS_STORAGE_SCSI
);
2127 /* PCI subsystem ID */
2128 pci_conf
[PCI_SUBSYSTEM_ID
] = 0x00;
2129 pci_conf
[PCI_SUBSYSTEM_ID
+ 1] = 0x10;
2130 /* PCI latency timer = 255 */
2131 pci_conf
[PCI_LATENCY_TIMER
] = 0xff;
2132 /* TODO: RST# value should be 0 */
2133 /* Interrupt pin 1 */
2134 pci_conf
[PCI_INTERRUPT_PIN
] = 0x01;
2136 s
->mmio_io_addr
= cpu_register_io_memory(lsi_mmio_readfn
,
2137 lsi_mmio_writefn
, s
);
2138 s
->ram_io_addr
= cpu_register_io_memory(lsi_ram_readfn
,
2139 lsi_ram_writefn
, s
);
2141 /* TODO: use dev and get rid of cast below */
2142 pci_register_bar((struct PCIDevice
*)s
, 0, 256,
2143 PCI_BASE_ADDRESS_SPACE_IO
, lsi_io_mapfunc
);
2144 pci_register_bar((struct PCIDevice
*)s
, 1, 0x400,
2145 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_mmio_mapfunc
);
2146 pci_register_bar((struct PCIDevice
*)s
, 2, 0x2000,
2147 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_ram_mapfunc
);
2148 QTAILQ_INIT(&s
->queue
);
2152 scsi_bus_new(&s
->bus
, &dev
->qdev
, 1, LSI_MAX_DEVS
, lsi_command_complete
);
2153 if (!dev
->qdev
.hotplugged
) {
2154 scsi_bus_legacy_handle_cmdline(&s
->bus
);
2159 static PCIDeviceInfo lsi_info
= {
2160 .qdev
.name
= "lsi53c895a",
2161 .qdev
.alias
= "lsi",
2162 .qdev
.size
= sizeof(LSIState
),
2163 .qdev
.vmsd
= &vmstate_lsi_scsi
,
2164 .init
= lsi_scsi_init
,
2165 .exit
= lsi_scsi_uninit
,
2168 static void lsi53c895a_register_devices(void)
2170 pci_qdev_register(&lsi_info
);
2173 device_init(lsi53c895a_register_devices
);