2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
18 #include "block_int.h"
21 //#define DEBUG_LSI_REG
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
34 #define LSI_MAX_DEVS 7
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
176 typedef struct lsi_request
{
180 QTAILQ_ENTRY(lsi_request
) next
;
187 uint32_t script_ram_base
;
189 int carry
; /* ??? Should this be an a visible register somewhere? */
191 /* Action to take at the end of a MSG IN phase.
192 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
195 uint8_t msg
[LSI_MAX_MSGIN_LEN
];
196 /* 0 if SCRIPTS are running or stopped.
197 * 1 if a Wait Reselect instruction has been issued.
198 * 2 if processing DMA from lsi_execute_script.
199 * 3 if a DMA operation is in progress. */
202 SCSIDevice
*current_dev
;
204 /* The tag is a combination of the device ID and the SCSI tag. */
205 uint32_t current_tag
;
206 uint32_t current_dma_len
;
207 int command_complete
;
209 QTAILQ_HEAD(, lsi_request
) queue
;
270 uint32_t scratch
[18]; /* SCRATCHA-SCRATCHR */
273 /* Script ram is stored as 32-bit words in host byteorder. */
274 uint32_t script_ram
[2048];
277 static inline int lsi_irq_on_rsl(LSIState
*s
)
279 return (s
->sien0
& LSI_SIST0_RSL
) && (s
->scid
& LSI_SCID_RRE
);
282 static void lsi_soft_reset(LSIState
*s
)
292 memset(s
->scratch
, 0, sizeof(s
->scratch
));
348 static int lsi_dma_40bit(LSIState
*s
)
350 if ((s
->ccntl1
& LSI_CCNTL1_40BIT
) == LSI_CCNTL1_40BIT
)
355 static int lsi_dma_ti64bit(LSIState
*s
)
357 if ((s
->ccntl1
& LSI_CCNTL1_EN64TIBMV
) == LSI_CCNTL1_EN64TIBMV
)
362 static int lsi_dma_64bit(LSIState
*s
)
364 if ((s
->ccntl1
& LSI_CCNTL1_EN64DBMV
) == LSI_CCNTL1_EN64DBMV
)
369 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
);
370 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
);
371 static void lsi_execute_script(LSIState
*s
);
372 static void lsi_reselect(LSIState
*s
, uint32_t tag
);
374 static inline uint32_t read_dword(LSIState
*s
, uint32_t addr
)
378 /* Optimize reading from SCRIPTS RAM. */
379 if ((addr
& 0xffffe000) == s
->script_ram_base
) {
380 return s
->script_ram
[(addr
& 0x1fff) >> 2];
382 cpu_physical_memory_read(addr
, (uint8_t *)&buf
, 4);
383 return cpu_to_le32(buf
);
386 static void lsi_stop_script(LSIState
*s
)
388 s
->istat1
&= ~LSI_ISTAT1_SRUN
;
391 static void lsi_update_irq(LSIState
*s
)
394 static int last_level
;
397 /* It's unclear whether the DIP/SIP bits should be cleared when the
398 Interrupt Status Registers are cleared or when istat0 is read.
399 We currently do the formwer, which seems to work. */
402 if (s
->dstat
& s
->dien
)
404 s
->istat0
|= LSI_ISTAT0_DIP
;
406 s
->istat0
&= ~LSI_ISTAT0_DIP
;
409 if (s
->sist0
|| s
->sist1
) {
410 if ((s
->sist0
& s
->sien0
) || (s
->sist1
& s
->sien1
))
412 s
->istat0
|= LSI_ISTAT0_SIP
;
414 s
->istat0
&= ~LSI_ISTAT0_SIP
;
416 if (s
->istat0
& LSI_ISTAT0_INTF
)
419 if (level
!= last_level
) {
420 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
421 level
, s
->dstat
, s
->sist1
, s
->sist0
);
424 qemu_set_irq(s
->dev
.irq
[0], level
);
426 if (!level
&& lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
)) {
427 DPRINTF("Handled IRQs & disconnected, looking for pending "
429 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
431 lsi_reselect(s
, p
->tag
);
438 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
439 static void lsi_script_scsi_interrupt(LSIState
*s
, int stat0
, int stat1
)
444 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
445 stat1
, stat0
, s
->sist1
, s
->sist0
);
448 /* Stop processor on fatal or unmasked interrupt. As a special hack
449 we don't stop processing when raising STO. Instead continue
450 execution and stop at the next insn that accesses the SCSI bus. */
451 mask0
= s
->sien0
| ~(LSI_SIST0_CMP
| LSI_SIST0_SEL
| LSI_SIST0_RSL
);
452 mask1
= s
->sien1
| ~(LSI_SIST1_GEN
| LSI_SIST1_HTH
);
453 mask1
&= ~LSI_SIST1_STO
;
454 if (s
->sist0
& mask0
|| s
->sist1
& mask1
) {
460 /* Stop SCRIPTS execution and raise a DMA interrupt. */
461 static void lsi_script_dma_interrupt(LSIState
*s
, int stat
)
463 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat
, s
->dstat
);
469 static inline void lsi_set_phase(LSIState
*s
, int phase
)
471 s
->sstat1
= (s
->sstat1
& ~PHASE_MASK
) | phase
;
474 static void lsi_bad_phase(LSIState
*s
, int out
, int new_phase
)
476 /* Trigger a phase mismatch. */
477 if (s
->ccntl0
& LSI_CCNTL0_ENPMJ
) {
478 if ((s
->ccntl0
& LSI_CCNTL0_PMJCTL
) || out
) {
483 DPRINTF("Data phase mismatch jump to %08x\n", s
->dsp
);
485 DPRINTF("Phase mismatch interrupt\n");
486 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
489 lsi_set_phase(s
, new_phase
);
493 /* Resume SCRIPTS execution after a DMA operation. */
494 static void lsi_resume_script(LSIState
*s
)
496 if (s
->waiting
!= 2) {
498 lsi_execute_script(s
);
504 /* Initiate a SCSI layer data transfer. */
505 static void lsi_do_dma(LSIState
*s
, int out
)
508 target_phys_addr_t addr
;
510 if (!s
->current_dma_len
) {
511 /* Wait until data is available. */
512 DPRINTF("DMA no data available\n");
517 if (count
> s
->current_dma_len
)
518 count
= s
->current_dma_len
;
521 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
522 if (lsi_dma_40bit(s
) || lsi_dma_ti64bit(s
))
523 addr
|= ((uint64_t)s
->dnad64
<< 32);
525 addr
|= ((uint64_t)s
->dbms
<< 32);
527 addr
|= ((uint64_t)s
->sbms
<< 32);
529 DPRINTF("DMA addr=0x" TARGET_FMT_plx
" len=%d\n", addr
, count
);
534 if (s
->dma_buf
== NULL
) {
535 s
->dma_buf
= s
->current_dev
->info
->get_buf(s
->current_dev
,
539 /* ??? Set SFBR to first data byte. */
541 cpu_physical_memory_read(addr
, s
->dma_buf
, count
);
543 cpu_physical_memory_write(addr
, s
->dma_buf
, count
);
545 s
->current_dma_len
-= count
;
546 if (s
->current_dma_len
== 0) {
549 /* Write the data. */
550 s
->current_dev
->info
->write_data(s
->current_dev
, s
->current_tag
);
552 /* Request any remaining data. */
553 s
->current_dev
->info
->read_data(s
->current_dev
, s
->current_tag
);
557 lsi_resume_script(s
);
562 /* Add a command to the queue. */
563 static void lsi_queue_command(LSIState
*s
)
567 DPRINTF("Queueing tag=0x%x\n", s
->current_tag
);
568 p
= qemu_mallocz(sizeof(*p
));
569 QTAILQ_INSERT_TAIL(&s
->queue
, p
, next
);
570 p
->tag
= s
->current_tag
;
572 p
->out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
575 /* Queue a byte for a MSG IN phase. */
576 static void lsi_add_msg_byte(LSIState
*s
, uint8_t data
)
578 if (s
->msg_len
>= LSI_MAX_MSGIN_LEN
) {
579 BADF("MSG IN data too long\n");
581 DPRINTF("MSG IN 0x%02x\n", data
);
582 s
->msg
[s
->msg_len
++] = data
;
586 /* Perform reselection to continue a command. */
587 static void lsi_reselect(LSIState
*s
, uint32_t tag
)
592 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
597 BADF("Reselected non-existant command tag=0x%x\n", tag
);
600 id
= (tag
>> 8) & 0xf;
602 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
603 if (!(s
->dcntl
& LSI_DCNTL_COM
)) {
604 s
->sfbr
= 1 << (id
& 0x7);
606 DPRINTF("Reselected target %d\n", id
);
607 s
->current_dev
= s
->bus
.devs
[id
];
608 s
->current_tag
= tag
;
609 s
->scntl1
|= LSI_SCNTL1_CON
;
610 lsi_set_phase(s
, PHASE_MI
);
611 s
->msg_action
= p
->out
? 2 : 3;
612 s
->current_dma_len
= p
->pending
;
614 lsi_add_msg_byte(s
, 0x80);
615 if (s
->current_tag
& LSI_TAG_VALID
) {
616 lsi_add_msg_byte(s
, 0x20);
617 lsi_add_msg_byte(s
, tag
& 0xff);
620 QTAILQ_REMOVE(&s
->queue
, p
, next
);
623 if (lsi_irq_on_rsl(s
)) {
624 lsi_script_scsi_interrupt(s
, LSI_SIST0_RSL
, 0);
628 /* Record that data is available for a queued command. Returns zero if
629 the device was reselected, nonzero if the IO is deferred. */
630 static int lsi_queue_tag(LSIState
*s
, uint32_t tag
, uint32_t arg
)
634 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
637 BADF("Multiple IO pending for tag %d\n", tag
);
640 /* Reselect if waiting for it, or if reselection triggers an IRQ
642 Since no interrupt stacking is implemented in the emulation, it
643 is also required that there are no pending interrupts waiting
644 for service from the device driver. */
645 if (s
->waiting
== 1 ||
646 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
) &&
647 !(s
->istat0
& (LSI_ISTAT0_SIP
| LSI_ISTAT0_DIP
)))) {
648 /* Reselect device. */
649 lsi_reselect(s
, tag
);
652 DPRINTF("Queueing IO tag=0x%x\n", tag
);
658 BADF("IO with unknown tag %d\n", tag
);
662 /* Callback to indicate that the SCSI layer has completed a transfer. */
663 static void lsi_command_complete(SCSIBus
*bus
, int reason
, uint32_t tag
,
666 LSIState
*s
= DO_UPCAST(LSIState
, dev
.qdev
, bus
->qbus
.parent
);
669 out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
670 if (reason
== SCSI_REASON_DONE
) {
671 DPRINTF("Command complete sense=%d\n", (int)arg
);
673 s
->command_complete
= 2;
674 if (s
->waiting
&& s
->dbc
!= 0) {
675 /* Raise phase mismatch for short transfers. */
676 lsi_bad_phase(s
, out
, PHASE_ST
);
678 lsi_set_phase(s
, PHASE_ST
);
680 lsi_resume_script(s
);
684 if (s
->waiting
== 1 || tag
!= s
->current_tag
||
685 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
))) {
686 if (lsi_queue_tag(s
, tag
, arg
))
690 /* host adapter (re)connected */
691 DPRINTF("Data ready tag=0x%x len=%d\n", tag
, arg
);
692 s
->current_dma_len
= arg
;
693 s
->command_complete
= 1;
696 if (s
->waiting
== 1 || s
->dbc
== 0) {
697 lsi_resume_script(s
);
703 static void lsi_do_command(LSIState
*s
)
708 DPRINTF("Send command len=%d\n", s
->dbc
);
711 cpu_physical_memory_read(s
->dnad
, buf
, s
->dbc
);
713 s
->command_complete
= 0;
714 n
= s
->current_dev
->info
->send_command(s
->current_dev
, s
->current_tag
, buf
,
717 lsi_set_phase(s
, PHASE_DI
);
718 s
->current_dev
->info
->read_data(s
->current_dev
, s
->current_tag
);
720 lsi_set_phase(s
, PHASE_DO
);
721 s
->current_dev
->info
->write_data(s
->current_dev
, s
->current_tag
);
724 if (!s
->command_complete
) {
726 /* Command did not complete immediately so disconnect. */
727 lsi_add_msg_byte(s
, 2); /* SAVE DATA POINTER */
728 lsi_add_msg_byte(s
, 4); /* DISCONNECT */
730 lsi_set_phase(s
, PHASE_MI
);
732 lsi_queue_command(s
);
734 /* wait command complete */
735 lsi_set_phase(s
, PHASE_DI
);
740 static void lsi_do_status(LSIState
*s
)
743 DPRINTF("Get status len=%d sense=%d\n", s
->dbc
, s
->sense
);
745 BADF("Bad Status move\n");
749 cpu_physical_memory_write(s
->dnad
, &sense
, 1);
750 lsi_set_phase(s
, PHASE_MI
);
752 lsi_add_msg_byte(s
, 0); /* COMMAND COMPLETE */
755 static void lsi_disconnect(LSIState
*s
)
757 s
->scntl1
&= ~LSI_SCNTL1_CON
;
758 s
->sstat1
&= ~PHASE_MASK
;
761 static void lsi_do_msgin(LSIState
*s
)
764 DPRINTF("Message in len=%d/%d\n", s
->dbc
, s
->msg_len
);
769 cpu_physical_memory_write(s
->dnad
, s
->msg
, len
);
770 /* Linux drivers rely on the last byte being in the SIDL. */
771 s
->sidl
= s
->msg
[len
- 1];
774 memmove(s
->msg
, s
->msg
+ len
, s
->msg_len
);
776 /* ??? Check if ATN (not yet implemented) is asserted and maybe
777 switch to PHASE_MO. */
778 switch (s
->msg_action
) {
780 lsi_set_phase(s
, PHASE_CMD
);
786 lsi_set_phase(s
, PHASE_DO
);
789 lsi_set_phase(s
, PHASE_DI
);
797 /* Read the next byte during a MSGOUT phase. */
798 static uint8_t lsi_get_msgbyte(LSIState
*s
)
801 cpu_physical_memory_read(s
->dnad
, &data
, 1);
807 static void lsi_do_msgout(LSIState
*s
)
812 DPRINTF("MSG out len=%d\n", s
->dbc
);
814 msg
= lsi_get_msgbyte(s
);
819 DPRINTF("MSG: Disconnect\n");
823 DPRINTF("MSG: No Operation\n");
824 lsi_set_phase(s
, PHASE_CMD
);
827 len
= lsi_get_msgbyte(s
);
828 msg
= lsi_get_msgbyte(s
);
829 DPRINTF("Extended message 0x%x (len %d)\n", msg
, len
);
832 DPRINTF("SDTR (ignored)\n");
836 DPRINTF("WDTR (ignored)\n");
843 case 0x20: /* SIMPLE queue */
844 s
->current_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
845 DPRINTF("SIMPLE queue tag=0x%x\n", s
->current_tag
& 0xff);
847 case 0x21: /* HEAD of queue */
848 BADF("HEAD queue not implemented\n");
849 s
->current_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
851 case 0x22: /* ORDERED queue */
852 BADF("ORDERED queue not implemented\n");
853 s
->current_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
856 if ((msg
& 0x80) == 0) {
859 s
->current_lun
= msg
& 7;
860 DPRINTF("Select LUN %d\n", s
->current_lun
);
861 lsi_set_phase(s
, PHASE_CMD
);
867 BADF("Unimplemented message 0x%02x\n", msg
);
868 lsi_set_phase(s
, PHASE_MI
);
869 lsi_add_msg_byte(s
, 7); /* MESSAGE REJECT */
873 /* Sign extend a 24-bit value. */
874 static inline int32_t sxt24(int32_t n
)
876 return (n
<< 8) >> 8;
879 #define LSI_BUF_SIZE 4096
880 static void lsi_memcpy(LSIState
*s
, uint32_t dest
, uint32_t src
, int count
)
883 uint8_t buf
[LSI_BUF_SIZE
];
885 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest
, src
, count
);
887 n
= (count
> LSI_BUF_SIZE
) ? LSI_BUF_SIZE
: count
;
888 cpu_physical_memory_read(src
, buf
, n
);
889 cpu_physical_memory_write(dest
, buf
, n
);
896 static void lsi_wait_reselect(LSIState
*s
)
900 DPRINTF("Wait Reselect\n");
901 if (s
->current_dma_len
)
902 BADF("Reselect with pending DMA\n");
904 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
906 lsi_reselect(s
, p
->tag
);
910 if (s
->current_dma_len
== 0) {
915 static void lsi_execute_script(LSIState
*s
)
918 uint32_t addr
, addr_high
;
920 int insn_processed
= 0;
922 s
->istat1
|= LSI_ISTAT1_SRUN
;
925 insn
= read_dword(s
, s
->dsp
);
927 /* If we receive an empty opcode increment the DSP by 4 bytes
928 instead of 8 and execute the next opcode at that location */
932 addr
= read_dword(s
, s
->dsp
+ 4);
934 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s
->dsp
, insn
, addr
);
936 s
->dcmd
= insn
>> 24;
938 switch (insn
>> 30) {
939 case 0: /* Block move. */
940 if (s
->sist1
& LSI_SIST1_STO
) {
941 DPRINTF("Delayed select timeout\n");
945 s
->dbc
= insn
& 0xffffff;
949 if (insn
& (1 << 29)) {
950 /* Indirect addressing. */
951 addr
= read_dword(s
, addr
);
952 } else if (insn
& (1 << 28)) {
955 /* Table indirect addressing. */
957 /* 32-bit Table indirect */
958 offset
= sxt24(addr
);
959 cpu_physical_memory_read(s
->dsa
+ offset
, (uint8_t *)buf
, 8);
960 /* byte count is stored in bits 0:23 only */
961 s
->dbc
= cpu_to_le32(buf
[0]) & 0xffffff;
963 addr
= cpu_to_le32(buf
[1]);
965 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
966 * table, bits [31:24] */
967 if (lsi_dma_40bit(s
))
968 addr_high
= cpu_to_le32(buf
[0]) >> 24;
969 else if (lsi_dma_ti64bit(s
)) {
970 int selector
= (cpu_to_le32(buf
[0]) >> 24) & 0x1f;
973 /* offset index into scratch registers since
974 * TI64 mode can use registers C to R */
975 addr_high
= s
->scratch
[2 + selector
];
996 BADF("Illegal selector specified (0x%x > 0x15)"
997 " for 64-bit DMA block move", selector
);
1001 } else if (lsi_dma_64bit(s
)) {
1002 /* fetch a 3rd dword if 64-bit direct move is enabled and
1003 only if we're not doing table indirect or indirect addressing */
1004 s
->dbms
= read_dword(s
, s
->dsp
);
1006 s
->ia
= s
->dsp
- 12;
1008 if ((s
->sstat1
& PHASE_MASK
) != ((insn
>> 24) & 7)) {
1009 DPRINTF("Wrong phase got %d expected %d\n",
1010 s
->sstat1
& PHASE_MASK
, (insn
>> 24) & 7);
1011 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
1015 s
->dnad64
= addr_high
;
1016 switch (s
->sstat1
& 0x7) {
1042 BADF("Unimplemented phase %d\n", s
->sstat1
& PHASE_MASK
);
1045 s
->dfifo
= s
->dbc
& 0xff;
1046 s
->ctest5
= (s
->ctest5
& 0xfc) | ((s
->dbc
>> 8) & 3);
1049 s
->ua
= addr
+ s
->dbc
;
1052 case 1: /* IO or Read/Write instruction. */
1053 opcode
= (insn
>> 27) & 7;
1057 if (insn
& (1 << 25)) {
1058 id
= read_dword(s
, s
->dsa
+ sxt24(insn
));
1062 id
= (id
>> 16) & 0xf;
1063 if (insn
& (1 << 26)) {
1064 addr
= s
->dsp
+ sxt24(addr
);
1068 case 0: /* Select */
1070 if (s
->scntl1
& LSI_SCNTL1_CON
) {
1071 DPRINTF("Already reselected, jumping to alternative address\n");
1075 s
->sstat0
|= LSI_SSTAT0_WOA
;
1076 s
->scntl1
&= ~LSI_SCNTL1_IARB
;
1077 if (id
>= LSI_MAX_DEVS
|| !s
->bus
.devs
[id
]) {
1078 DPRINTF("Selected absent target %d\n", id
);
1079 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_STO
);
1083 DPRINTF("Selected target %d%s\n",
1084 id
, insn
& (1 << 3) ? " ATN" : "");
1085 /* ??? Linux drivers compain when this is set. Maybe
1086 it only applies in low-level mode (unimplemented).
1087 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1088 s
->current_dev
= s
->bus
.devs
[id
];
1089 s
->current_tag
= id
<< 8;
1090 s
->scntl1
|= LSI_SCNTL1_CON
;
1091 if (insn
& (1 << 3)) {
1092 s
->socl
|= LSI_SOCL_ATN
;
1094 lsi_set_phase(s
, PHASE_MO
);
1096 case 1: /* Disconnect */
1097 DPRINTF("Wait Disconnect\n");
1098 s
->scntl1
&= ~LSI_SCNTL1_CON
;
1100 case 2: /* Wait Reselect */
1101 if (!lsi_irq_on_rsl(s
)) {
1102 lsi_wait_reselect(s
);
1106 DPRINTF("Set%s%s%s%s\n",
1107 insn
& (1 << 3) ? " ATN" : "",
1108 insn
& (1 << 6) ? " ACK" : "",
1109 insn
& (1 << 9) ? " TM" : "",
1110 insn
& (1 << 10) ? " CC" : "");
1111 if (insn
& (1 << 3)) {
1112 s
->socl
|= LSI_SOCL_ATN
;
1113 lsi_set_phase(s
, PHASE_MO
);
1115 if (insn
& (1 << 9)) {
1116 BADF("Target mode not implemented\n");
1119 if (insn
& (1 << 10))
1123 DPRINTF("Clear%s%s%s%s\n",
1124 insn
& (1 << 3) ? " ATN" : "",
1125 insn
& (1 << 6) ? " ACK" : "",
1126 insn
& (1 << 9) ? " TM" : "",
1127 insn
& (1 << 10) ? " CC" : "");
1128 if (insn
& (1 << 3)) {
1129 s
->socl
&= ~LSI_SOCL_ATN
;
1131 if (insn
& (1 << 10))
1142 static const char *opcode_names
[3] =
1143 {"Write", "Read", "Read-Modify-Write"};
1144 static const char *operator_names
[8] =
1145 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1148 reg
= ((insn
>> 16) & 0x7f) | (insn
& 0x80);
1149 data8
= (insn
>> 8) & 0xff;
1150 opcode
= (insn
>> 27) & 7;
1151 operator = (insn
>> 24) & 7;
1152 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1153 opcode_names
[opcode
- 5], reg
,
1154 operator_names
[operator], data8
, s
->sfbr
,
1155 (insn
& (1 << 23)) ? " SFBR" : "");
1158 case 5: /* From SFBR */
1162 case 6: /* To SFBR */
1164 op0
= lsi_reg_readb(s
, reg
);
1167 case 7: /* Read-modify-write */
1169 op0
= lsi_reg_readb(s
, reg
);
1170 if (insn
& (1 << 23)) {
1182 case 1: /* Shift left */
1184 op0
= (op0
<< 1) | s
->carry
;
1198 op0
= (op0
>> 1) | (s
->carry
<< 7);
1203 s
->carry
= op0
< op1
;
1206 op0
+= op1
+ s
->carry
;
1208 s
->carry
= op0
<= op1
;
1210 s
->carry
= op0
< op1
;
1215 case 5: /* From SFBR */
1216 case 7: /* Read-modify-write */
1217 lsi_reg_writeb(s
, reg
, op0
);
1219 case 6: /* To SFBR */
1226 case 2: /* Transfer Control. */
1231 if ((insn
& 0x002e0000) == 0) {
1235 if (s
->sist1
& LSI_SIST1_STO
) {
1236 DPRINTF("Delayed select timeout\n");
1240 cond
= jmp
= (insn
& (1 << 19)) != 0;
1241 if (cond
== jmp
&& (insn
& (1 << 21))) {
1242 DPRINTF("Compare carry %d\n", s
->carry
== jmp
);
1243 cond
= s
->carry
!= 0;
1245 if (cond
== jmp
&& (insn
& (1 << 17))) {
1246 DPRINTF("Compare phase %d %c= %d\n",
1247 (s
->sstat1
& PHASE_MASK
),
1249 ((insn
>> 24) & 7));
1250 cond
= (s
->sstat1
& PHASE_MASK
) == ((insn
>> 24) & 7);
1252 if (cond
== jmp
&& (insn
& (1 << 18))) {
1255 mask
= (~insn
>> 8) & 0xff;
1256 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1257 s
->sfbr
, mask
, jmp
? '=' : '!', insn
& mask
);
1258 cond
= (s
->sfbr
& mask
) == (insn
& mask
);
1261 if (insn
& (1 << 23)) {
1262 /* Relative address. */
1263 addr
= s
->dsp
+ sxt24(addr
);
1265 switch ((insn
>> 27) & 7) {
1267 DPRINTF("Jump to 0x%08x\n", addr
);
1271 DPRINTF("Call 0x%08x\n", addr
);
1275 case 2: /* Return */
1276 DPRINTF("Return to 0x%08x\n", s
->temp
);
1279 case 3: /* Interrupt */
1280 DPRINTF("Interrupt 0x%08x\n", s
->dsps
);
1281 if ((insn
& (1 << 20)) != 0) {
1282 s
->istat0
|= LSI_ISTAT0_INTF
;
1285 lsi_script_dma_interrupt(s
, LSI_DSTAT_SIR
);
1289 DPRINTF("Illegal transfer control\n");
1290 lsi_script_dma_interrupt(s
, LSI_DSTAT_IID
);
1294 DPRINTF("Control condition failed\n");
1300 if ((insn
& (1 << 29)) == 0) {
1303 /* ??? The docs imply the destination address is loaded into
1304 the TEMP register. However the Linux drivers rely on
1305 the value being presrved. */
1306 dest
= read_dword(s
, s
->dsp
);
1308 lsi_memcpy(s
, dest
, addr
, insn
& 0xffffff);
1315 if (insn
& (1 << 28)) {
1316 addr
= s
->dsa
+ sxt24(addr
);
1319 reg
= (insn
>> 16) & 0xff;
1320 if (insn
& (1 << 24)) {
1321 cpu_physical_memory_read(addr
, data
, n
);
1322 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg
, n
,
1323 addr
, *(int *)data
);
1324 for (i
= 0; i
< n
; i
++) {
1325 lsi_reg_writeb(s
, reg
+ i
, data
[i
]);
1328 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg
, n
, addr
);
1329 for (i
= 0; i
< n
; i
++) {
1330 data
[i
] = lsi_reg_readb(s
, reg
+ i
);
1332 cpu_physical_memory_write(addr
, data
, n
);
1336 if (insn_processed
> 10000 && !s
->waiting
) {
1337 /* Some windows drivers make the device spin waiting for a memory
1338 location to change. If we have been executed a lot of code then
1339 assume this is the case and force an unexpected device disconnect.
1340 This is apparently sufficient to beat the drivers into submission.
1342 if (!(s
->sien0
& LSI_SIST0_UDC
))
1343 fprintf(stderr
, "inf. loop with UDC masked\n");
1344 lsi_script_scsi_interrupt(s
, LSI_SIST0_UDC
, 0);
1346 } else if (s
->istat1
& LSI_ISTAT1_SRUN
&& !s
->waiting
) {
1347 if (s
->dcntl
& LSI_DCNTL_SSM
) {
1348 lsi_script_dma_interrupt(s
, LSI_DSTAT_SSI
);
1353 DPRINTF("SCRIPTS execution stopped\n");
1356 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
)
1359 #define CASE_GET_REG24(name, addr) \
1360 case addr: return s->name & 0xff; \
1361 case addr + 1: return (s->name >> 8) & 0xff; \
1362 case addr + 2: return (s->name >> 16) & 0xff;
1364 #define CASE_GET_REG32(name, addr) \
1365 case addr: return s->name & 0xff; \
1366 case addr + 1: return (s->name >> 8) & 0xff; \
1367 case addr + 2: return (s->name >> 16) & 0xff; \
1368 case addr + 3: return (s->name >> 24) & 0xff;
1370 #ifdef DEBUG_LSI_REG
1371 DPRINTF("Read reg %x\n", offset
);
1374 case 0x00: /* SCNTL0 */
1376 case 0x01: /* SCNTL1 */
1378 case 0x02: /* SCNTL2 */
1380 case 0x03: /* SCNTL3 */
1382 case 0x04: /* SCID */
1384 case 0x05: /* SXFER */
1386 case 0x06: /* SDID */
1388 case 0x07: /* GPREG0 */
1390 case 0x08: /* Revision ID */
1392 case 0xa: /* SSID */
1394 case 0xb: /* SBCL */
1395 /* ??? This is not correct. However it's (hopefully) only
1396 used for diagnostics, so should be ok. */
1398 case 0xc: /* DSTAT */
1399 tmp
= s
->dstat
| 0x80;
1400 if ((s
->istat0
& LSI_ISTAT0_INTF
) == 0)
1404 case 0x0d: /* SSTAT0 */
1406 case 0x0e: /* SSTAT1 */
1408 case 0x0f: /* SSTAT2 */
1409 return s
->scntl1
& LSI_SCNTL1_CON
? 0 : 2;
1410 CASE_GET_REG32(dsa
, 0x10)
1411 case 0x14: /* ISTAT0 */
1413 case 0x15: /* ISTAT1 */
1415 case 0x16: /* MBOX0 */
1417 case 0x17: /* MBOX1 */
1419 case 0x18: /* CTEST0 */
1421 case 0x19: /* CTEST1 */
1423 case 0x1a: /* CTEST2 */
1424 tmp
= s
->ctest2
| LSI_CTEST2_DACK
| LSI_CTEST2_CM
;
1425 if (s
->istat0
& LSI_ISTAT0_SIGP
) {
1426 s
->istat0
&= ~LSI_ISTAT0_SIGP
;
1427 tmp
|= LSI_CTEST2_SIGP
;
1430 case 0x1b: /* CTEST3 */
1432 CASE_GET_REG32(temp
, 0x1c)
1433 case 0x20: /* DFIFO */
1435 case 0x21: /* CTEST4 */
1437 case 0x22: /* CTEST5 */
1439 case 0x23: /* CTEST6 */
1441 CASE_GET_REG24(dbc
, 0x24)
1442 case 0x27: /* DCMD */
1444 CASE_GET_REG32(dnad
, 0x28)
1445 CASE_GET_REG32(dsp
, 0x2c)
1446 CASE_GET_REG32(dsps
, 0x30)
1447 CASE_GET_REG32(scratch
[0], 0x34)
1448 case 0x38: /* DMODE */
1450 case 0x39: /* DIEN */
1452 case 0x3a: /* SBR */
1454 case 0x3b: /* DCNTL */
1456 case 0x40: /* SIEN0 */
1458 case 0x41: /* SIEN1 */
1460 case 0x42: /* SIST0 */
1465 case 0x43: /* SIST1 */
1470 case 0x46: /* MACNTL */
1472 case 0x47: /* GPCNTL0 */
1474 case 0x48: /* STIME0 */
1476 case 0x4a: /* RESPID0 */
1478 case 0x4b: /* RESPID1 */
1480 case 0x4d: /* STEST1 */
1482 case 0x4e: /* STEST2 */
1484 case 0x4f: /* STEST3 */
1486 case 0x50: /* SIDL */
1487 /* This is needed by the linux drivers. We currently only update it
1488 during the MSG IN phase. */
1490 case 0x52: /* STEST4 */
1492 case 0x56: /* CCNTL0 */
1494 case 0x57: /* CCNTL1 */
1496 case 0x58: /* SBDL */
1497 /* Some drivers peek at the data bus during the MSG IN phase. */
1498 if ((s
->sstat1
& PHASE_MASK
) == PHASE_MI
)
1501 case 0x59: /* SBDL high */
1503 CASE_GET_REG32(mmrs
, 0xa0)
1504 CASE_GET_REG32(mmws
, 0xa4)
1505 CASE_GET_REG32(sfs
, 0xa8)
1506 CASE_GET_REG32(drs
, 0xac)
1507 CASE_GET_REG32(sbms
, 0xb0)
1508 CASE_GET_REG32(dbms
, 0xb4)
1509 CASE_GET_REG32(dnad64
, 0xb8)
1510 CASE_GET_REG32(pmjad1
, 0xc0)
1511 CASE_GET_REG32(pmjad2
, 0xc4)
1512 CASE_GET_REG32(rbc
, 0xc8)
1513 CASE_GET_REG32(ua
, 0xcc)
1514 CASE_GET_REG32(ia
, 0xd4)
1515 CASE_GET_REG32(sbc
, 0xd8)
1516 CASE_GET_REG32(csbc
, 0xdc)
1518 if (offset
>= 0x5c && offset
< 0xa0) {
1521 n
= (offset
- 0x58) >> 2;
1522 shift
= (offset
& 3) * 8;
1523 return (s
->scratch
[n
] >> shift
) & 0xff;
1525 BADF("readb 0x%x\n", offset
);
1527 #undef CASE_GET_REG24
1528 #undef CASE_GET_REG32
1531 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
)
1533 #define CASE_SET_REG24(name, addr) \
1534 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1535 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1536 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1538 #define CASE_SET_REG32(name, addr) \
1539 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1540 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1541 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1542 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1544 #ifdef DEBUG_LSI_REG
1545 DPRINTF("Write reg %x = %02x\n", offset
, val
);
1548 case 0x00: /* SCNTL0 */
1550 if (val
& LSI_SCNTL0_START
) {
1551 BADF("Start sequence not implemented\n");
1554 case 0x01: /* SCNTL1 */
1555 s
->scntl1
= val
& ~LSI_SCNTL1_SST
;
1556 if (val
& LSI_SCNTL1_IARB
) {
1557 BADF("Immediate Arbritration not implemented\n");
1559 if (val
& LSI_SCNTL1_RST
) {
1560 s
->sstat0
|= LSI_SSTAT0_RST
;
1561 lsi_script_scsi_interrupt(s
, LSI_SIST0_RST
, 0);
1563 s
->sstat0
&= ~LSI_SSTAT0_RST
;
1566 case 0x02: /* SCNTL2 */
1567 val
&= ~(LSI_SCNTL2_WSR
| LSI_SCNTL2_WSS
);
1570 case 0x03: /* SCNTL3 */
1573 case 0x04: /* SCID */
1576 case 0x05: /* SXFER */
1579 case 0x06: /* SDID */
1580 if ((val
& 0xf) != (s
->ssid
& 0xf))
1581 BADF("Destination ID does not match SSID\n");
1582 s
->sdid
= val
& 0xf;
1584 case 0x07: /* GPREG0 */
1586 case 0x08: /* SFBR */
1587 /* The CPU is not allowed to write to this register. However the
1588 SCRIPTS register move instructions are. */
1591 case 0x0a: case 0x0b:
1592 /* Openserver writes to these readonly registers on startup */
1594 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1595 /* Linux writes to these readonly registers on startup. */
1597 CASE_SET_REG32(dsa
, 0x10)
1598 case 0x14: /* ISTAT0 */
1599 s
->istat0
= (s
->istat0
& 0x0f) | (val
& 0xf0);
1600 if (val
& LSI_ISTAT0_ABRT
) {
1601 lsi_script_dma_interrupt(s
, LSI_DSTAT_ABRT
);
1603 if (val
& LSI_ISTAT0_INTF
) {
1604 s
->istat0
&= ~LSI_ISTAT0_INTF
;
1607 if (s
->waiting
== 1 && val
& LSI_ISTAT0_SIGP
) {
1608 DPRINTF("Woken by SIGP\n");
1611 lsi_execute_script(s
);
1613 if (val
& LSI_ISTAT0_SRST
) {
1617 case 0x16: /* MBOX0 */
1620 case 0x17: /* MBOX1 */
1623 case 0x1a: /* CTEST2 */
1624 s
->ctest2
= val
& LSI_CTEST2_PCICIE
;
1626 case 0x1b: /* CTEST3 */
1627 s
->ctest3
= val
& 0x0f;
1629 CASE_SET_REG32(temp
, 0x1c)
1630 case 0x21: /* CTEST4 */
1632 BADF("Unimplemented CTEST4-FBL 0x%x\n", val
);
1636 case 0x22: /* CTEST5 */
1637 if (val
& (LSI_CTEST5_ADCK
| LSI_CTEST5_BBCK
)) {
1638 BADF("CTEST5 DMA increment not implemented\n");
1642 CASE_SET_REG24(dbc
, 0x24)
1643 CASE_SET_REG32(dnad
, 0x28)
1644 case 0x2c: /* DSP[0:7] */
1645 s
->dsp
&= 0xffffff00;
1648 case 0x2d: /* DSP[8:15] */
1649 s
->dsp
&= 0xffff00ff;
1652 case 0x2e: /* DSP[16:23] */
1653 s
->dsp
&= 0xff00ffff;
1654 s
->dsp
|= val
<< 16;
1656 case 0x2f: /* DSP[24:31] */
1657 s
->dsp
&= 0x00ffffff;
1658 s
->dsp
|= val
<< 24;
1659 if ((s
->dmode
& LSI_DMODE_MAN
) == 0
1660 && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1661 lsi_execute_script(s
);
1663 CASE_SET_REG32(dsps
, 0x30)
1664 CASE_SET_REG32(scratch
[0], 0x34)
1665 case 0x38: /* DMODE */
1666 if (val
& (LSI_DMODE_SIOM
| LSI_DMODE_DIOM
)) {
1667 BADF("IO mappings not implemented\n");
1671 case 0x39: /* DIEN */
1675 case 0x3a: /* SBR */
1678 case 0x3b: /* DCNTL */
1679 s
->dcntl
= val
& ~(LSI_DCNTL_PFF
| LSI_DCNTL_STD
);
1680 if ((val
& LSI_DCNTL_STD
) && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1681 lsi_execute_script(s
);
1683 case 0x40: /* SIEN0 */
1687 case 0x41: /* SIEN1 */
1691 case 0x47: /* GPCNTL0 */
1693 case 0x48: /* STIME0 */
1696 case 0x49: /* STIME1 */
1698 DPRINTF("General purpose timer not implemented\n");
1699 /* ??? Raising the interrupt immediately seems to be sufficient
1700 to keep the FreeBSD driver happy. */
1701 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_GEN
);
1704 case 0x4a: /* RESPID0 */
1707 case 0x4b: /* RESPID1 */
1710 case 0x4d: /* STEST1 */
1713 case 0x4e: /* STEST2 */
1715 BADF("Low level mode not implemented\n");
1719 case 0x4f: /* STEST3 */
1721 BADF("SCSI FIFO test mode not implemented\n");
1725 case 0x56: /* CCNTL0 */
1728 case 0x57: /* CCNTL1 */
1731 CASE_SET_REG32(mmrs
, 0xa0)
1732 CASE_SET_REG32(mmws
, 0xa4)
1733 CASE_SET_REG32(sfs
, 0xa8)
1734 CASE_SET_REG32(drs
, 0xac)
1735 CASE_SET_REG32(sbms
, 0xb0)
1736 CASE_SET_REG32(dbms
, 0xb4)
1737 CASE_SET_REG32(dnad64
, 0xb8)
1738 CASE_SET_REG32(pmjad1
, 0xc0)
1739 CASE_SET_REG32(pmjad2
, 0xc4)
1740 CASE_SET_REG32(rbc
, 0xc8)
1741 CASE_SET_REG32(ua
, 0xcc)
1742 CASE_SET_REG32(ia
, 0xd4)
1743 CASE_SET_REG32(sbc
, 0xd8)
1744 CASE_SET_REG32(csbc
, 0xdc)
1746 if (offset
>= 0x5c && offset
< 0xa0) {
1749 n
= (offset
- 0x58) >> 2;
1750 shift
= (offset
& 3) * 8;
1751 s
->scratch
[n
] &= ~(0xff << shift
);
1752 s
->scratch
[n
] |= (val
& 0xff) << shift
;
1754 BADF("Unhandled writeb 0x%x = 0x%x\n", offset
, val
);
1757 #undef CASE_SET_REG24
1758 #undef CASE_SET_REG32
1761 static void lsi_mmio_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1763 LSIState
*s
= opaque
;
1765 lsi_reg_writeb(s
, addr
& 0xff, val
);
1768 static void lsi_mmio_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1770 LSIState
*s
= opaque
;
1773 lsi_reg_writeb(s
, addr
, val
& 0xff);
1774 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1777 static void lsi_mmio_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1779 LSIState
*s
= opaque
;
1782 lsi_reg_writeb(s
, addr
, val
& 0xff);
1783 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1784 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1785 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1788 static uint32_t lsi_mmio_readb(void *opaque
, target_phys_addr_t addr
)
1790 LSIState
*s
= opaque
;
1792 return lsi_reg_readb(s
, addr
& 0xff);
1795 static uint32_t lsi_mmio_readw(void *opaque
, target_phys_addr_t addr
)
1797 LSIState
*s
= opaque
;
1801 val
= lsi_reg_readb(s
, addr
);
1802 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1806 static uint32_t lsi_mmio_readl(void *opaque
, target_phys_addr_t addr
)
1808 LSIState
*s
= opaque
;
1811 val
= lsi_reg_readb(s
, addr
);
1812 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1813 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1814 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1818 static CPUReadMemoryFunc
* const lsi_mmio_readfn
[3] = {
1824 static CPUWriteMemoryFunc
* const lsi_mmio_writefn
[3] = {
1830 static void lsi_ram_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1832 LSIState
*s
= opaque
;
1837 newval
= s
->script_ram
[addr
>> 2];
1838 shift
= (addr
& 3) * 8;
1839 newval
&= ~(0xff << shift
);
1840 newval
|= val
<< shift
;
1841 s
->script_ram
[addr
>> 2] = newval
;
1844 static void lsi_ram_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1846 LSIState
*s
= opaque
;
1850 newval
= s
->script_ram
[addr
>> 2];
1852 newval
= (newval
& 0xffff) | (val
<< 16);
1854 newval
= (newval
& 0xffff0000) | val
;
1856 s
->script_ram
[addr
>> 2] = newval
;
1860 static void lsi_ram_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1862 LSIState
*s
= opaque
;
1865 s
->script_ram
[addr
>> 2] = val
;
1868 static uint32_t lsi_ram_readb(void *opaque
, target_phys_addr_t addr
)
1870 LSIState
*s
= opaque
;
1874 val
= s
->script_ram
[addr
>> 2];
1875 val
>>= (addr
& 3) * 8;
1879 static uint32_t lsi_ram_readw(void *opaque
, target_phys_addr_t addr
)
1881 LSIState
*s
= opaque
;
1885 val
= s
->script_ram
[addr
>> 2];
1888 return le16_to_cpu(val
);
1891 static uint32_t lsi_ram_readl(void *opaque
, target_phys_addr_t addr
)
1893 LSIState
*s
= opaque
;
1896 return le32_to_cpu(s
->script_ram
[addr
>> 2]);
1899 static CPUReadMemoryFunc
* const lsi_ram_readfn
[3] = {
1905 static CPUWriteMemoryFunc
* const lsi_ram_writefn
[3] = {
1911 static uint32_t lsi_io_readb(void *opaque
, uint32_t addr
)
1913 LSIState
*s
= opaque
;
1914 return lsi_reg_readb(s
, addr
& 0xff);
1917 static uint32_t lsi_io_readw(void *opaque
, uint32_t addr
)
1919 LSIState
*s
= opaque
;
1922 val
= lsi_reg_readb(s
, addr
);
1923 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1927 static uint32_t lsi_io_readl(void *opaque
, uint32_t addr
)
1929 LSIState
*s
= opaque
;
1932 val
= lsi_reg_readb(s
, addr
);
1933 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1934 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1935 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1939 static void lsi_io_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
1941 LSIState
*s
= opaque
;
1942 lsi_reg_writeb(s
, addr
& 0xff, val
);
1945 static void lsi_io_writew(void *opaque
, uint32_t addr
, uint32_t val
)
1947 LSIState
*s
= opaque
;
1949 lsi_reg_writeb(s
, addr
, val
& 0xff);
1950 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1953 static void lsi_io_writel(void *opaque
, uint32_t addr
, uint32_t val
)
1955 LSIState
*s
= opaque
;
1957 lsi_reg_writeb(s
, addr
, val
& 0xff);
1958 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1959 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1960 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1963 static void lsi_io_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1964 pcibus_t addr
, pcibus_t size
, int type
)
1966 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1968 DPRINTF("Mapping IO at %08"FMT_PCIBUS
"\n", addr
);
1970 register_ioport_write(addr
, 256, 1, lsi_io_writeb
, s
);
1971 register_ioport_read(addr
, 256, 1, lsi_io_readb
, s
);
1972 register_ioport_write(addr
, 256, 2, lsi_io_writew
, s
);
1973 register_ioport_read(addr
, 256, 2, lsi_io_readw
, s
);
1974 register_ioport_write(addr
, 256, 4, lsi_io_writel
, s
);
1975 register_ioport_read(addr
, 256, 4, lsi_io_readl
, s
);
1978 static void lsi_ram_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1979 pcibus_t addr
, pcibus_t size
, int type
)
1981 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1983 DPRINTF("Mapping ram at %08"FMT_PCIBUS
"\n", addr
);
1984 s
->script_ram_base
= addr
;
1985 cpu_register_physical_memory(addr
+ 0, 0x2000, s
->ram_io_addr
);
1988 static void lsi_mmio_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1989 pcibus_t addr
, pcibus_t size
, int type
)
1991 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1993 DPRINTF("Mapping registers at %08"FMT_PCIBUS
"\n", addr
);
1994 cpu_register_physical_memory(addr
+ 0, 0x400, s
->mmio_io_addr
);
1997 static void lsi_pre_save(void *opaque
)
1999 LSIState
*s
= opaque
;
2001 assert(s
->dma_buf
== NULL
);
2002 assert(s
->current_dma_len
== 0);
2003 assert(QTAILQ_EMPTY(&s
->queue
));
2006 static const VMStateDescription vmstate_lsi_scsi
= {
2009 .minimum_version_id
= 0,
2010 .minimum_version_id_old
= 0,
2011 .pre_save
= lsi_pre_save
,
2012 .fields
= (VMStateField
[]) {
2013 VMSTATE_PCI_DEVICE(dev
, LSIState
),
2015 VMSTATE_INT32(carry
, LSIState
),
2016 VMSTATE_INT32(sense
, LSIState
),
2017 VMSTATE_INT32(msg_action
, LSIState
),
2018 VMSTATE_INT32(msg_len
, LSIState
),
2019 VMSTATE_BUFFER(msg
, LSIState
),
2020 VMSTATE_INT32(waiting
, LSIState
),
2022 VMSTATE_UINT32(dsa
, LSIState
),
2023 VMSTATE_UINT32(temp
, LSIState
),
2024 VMSTATE_UINT32(dnad
, LSIState
),
2025 VMSTATE_UINT32(dbc
, LSIState
),
2026 VMSTATE_UINT8(istat0
, LSIState
),
2027 VMSTATE_UINT8(istat1
, LSIState
),
2028 VMSTATE_UINT8(dcmd
, LSIState
),
2029 VMSTATE_UINT8(dstat
, LSIState
),
2030 VMSTATE_UINT8(dien
, LSIState
),
2031 VMSTATE_UINT8(sist0
, LSIState
),
2032 VMSTATE_UINT8(sist1
, LSIState
),
2033 VMSTATE_UINT8(sien0
, LSIState
),
2034 VMSTATE_UINT8(sien1
, LSIState
),
2035 VMSTATE_UINT8(mbox0
, LSIState
),
2036 VMSTATE_UINT8(mbox1
, LSIState
),
2037 VMSTATE_UINT8(dfifo
, LSIState
),
2038 VMSTATE_UINT8(ctest2
, LSIState
),
2039 VMSTATE_UINT8(ctest3
, LSIState
),
2040 VMSTATE_UINT8(ctest4
, LSIState
),
2041 VMSTATE_UINT8(ctest5
, LSIState
),
2042 VMSTATE_UINT8(ccntl0
, LSIState
),
2043 VMSTATE_UINT8(ccntl1
, LSIState
),
2044 VMSTATE_UINT32(dsp
, LSIState
),
2045 VMSTATE_UINT32(dsps
, LSIState
),
2046 VMSTATE_UINT8(dmode
, LSIState
),
2047 VMSTATE_UINT8(dcntl
, LSIState
),
2048 VMSTATE_UINT8(scntl0
, LSIState
),
2049 VMSTATE_UINT8(scntl1
, LSIState
),
2050 VMSTATE_UINT8(scntl2
, LSIState
),
2051 VMSTATE_UINT8(scntl3
, LSIState
),
2052 VMSTATE_UINT8(sstat0
, LSIState
),
2053 VMSTATE_UINT8(sstat1
, LSIState
),
2054 VMSTATE_UINT8(scid
, LSIState
),
2055 VMSTATE_UINT8(sxfer
, LSIState
),
2056 VMSTATE_UINT8(socl
, LSIState
),
2057 VMSTATE_UINT8(sdid
, LSIState
),
2058 VMSTATE_UINT8(ssid
, LSIState
),
2059 VMSTATE_UINT8(sfbr
, LSIState
),
2060 VMSTATE_UINT8(stest1
, LSIState
),
2061 VMSTATE_UINT8(stest2
, LSIState
),
2062 VMSTATE_UINT8(stest3
, LSIState
),
2063 VMSTATE_UINT8(sidl
, LSIState
),
2064 VMSTATE_UINT8(stime0
, LSIState
),
2065 VMSTATE_UINT8(respid0
, LSIState
),
2066 VMSTATE_UINT8(respid1
, LSIState
),
2067 VMSTATE_UINT32(mmrs
, LSIState
),
2068 VMSTATE_UINT32(mmws
, LSIState
),
2069 VMSTATE_UINT32(sfs
, LSIState
),
2070 VMSTATE_UINT32(drs
, LSIState
),
2071 VMSTATE_UINT32(sbms
, LSIState
),
2072 VMSTATE_UINT32(dbms
, LSIState
),
2073 VMSTATE_UINT32(dnad64
, LSIState
),
2074 VMSTATE_UINT32(pmjad1
, LSIState
),
2075 VMSTATE_UINT32(pmjad2
, LSIState
),
2076 VMSTATE_UINT32(rbc
, LSIState
),
2077 VMSTATE_UINT32(ua
, LSIState
),
2078 VMSTATE_UINT32(ia
, LSIState
),
2079 VMSTATE_UINT32(sbc
, LSIState
),
2080 VMSTATE_UINT32(csbc
, LSIState
),
2081 VMSTATE_BUFFER_UNSAFE(scratch
, LSIState
, 0, 18 * sizeof(uint32_t)),
2082 VMSTATE_UINT8(sbr
, LSIState
),
2084 VMSTATE_BUFFER_UNSAFE(script_ram
, LSIState
, 0, 2048 * sizeof(uint32_t)),
2085 VMSTATE_END_OF_LIST()
2089 static int lsi_scsi_uninit(PCIDevice
*d
)
2091 LSIState
*s
= DO_UPCAST(LSIState
, dev
, d
);
2093 cpu_unregister_io_memory(s
->mmio_io_addr
);
2094 cpu_unregister_io_memory(s
->ram_io_addr
);
2099 static int lsi_scsi_init(PCIDevice
*dev
)
2101 LSIState
*s
= DO_UPCAST(LSIState
, dev
, dev
);
2104 pci_conf
= s
->dev
.config
;
2106 /* PCI Vendor ID (word) */
2107 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_LSI_LOGIC
);
2108 /* PCI device ID (word) */
2109 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_LSI_53C895A
);
2110 /* PCI base class code */
2111 pci_config_set_class(pci_conf
, PCI_CLASS_STORAGE_SCSI
);
2112 /* PCI subsystem ID */
2113 pci_conf
[PCI_SUBSYSTEM_ID
] = 0x00;
2114 pci_conf
[PCI_SUBSYSTEM_ID
+ 1] = 0x10;
2115 /* PCI latency timer = 255 */
2116 pci_conf
[PCI_LATENCY_TIMER
] = 0xff;
2117 /* TODO: RST# value should be 0 */
2118 /* Interrupt pin 1 */
2119 pci_conf
[PCI_INTERRUPT_PIN
] = 0x01;
2121 s
->mmio_io_addr
= cpu_register_io_memory(lsi_mmio_readfn
,
2122 lsi_mmio_writefn
, s
);
2123 s
->ram_io_addr
= cpu_register_io_memory(lsi_ram_readfn
,
2124 lsi_ram_writefn
, s
);
2126 /* TODO: use dev and get rid of cast below */
2127 pci_register_bar((struct PCIDevice
*)s
, 0, 256,
2128 PCI_BASE_ADDRESS_SPACE_IO
, lsi_io_mapfunc
);
2129 pci_register_bar((struct PCIDevice
*)s
, 1, 0x400,
2130 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_mmio_mapfunc
);
2131 pci_register_bar((struct PCIDevice
*)s
, 2, 0x2000,
2132 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_ram_mapfunc
);
2133 QTAILQ_INIT(&s
->queue
);
2137 scsi_bus_new(&s
->bus
, &dev
->qdev
, 1, LSI_MAX_DEVS
, lsi_command_complete
);
2138 if (!dev
->qdev
.hotplugged
) {
2139 scsi_bus_legacy_handle_cmdline(&s
->bus
);
2144 static PCIDeviceInfo lsi_info
= {
2145 .qdev
.name
= "lsi53c895a",
2146 .qdev
.alias
= "lsi",
2147 .qdev
.size
= sizeof(LSIState
),
2148 .qdev
.vmsd
= &vmstate_lsi_scsi
,
2149 .init
= lsi_scsi_init
,
2150 .exit
= lsi_scsi_uninit
,
2153 static void lsi53c895a_register_devices(void)
2155 pci_qdev_register(&lsi_info
);
2158 device_init(lsi53c895a_register_devices
);