2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
18 #include "block_int.h"
21 //#define DEBUG_LSI_REG
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
34 #define LSI_MAX_DEVS 7
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
176 typedef struct lsi_request
{
182 QTAILQ_ENTRY(lsi_request
) next
;
189 uint32_t script_ram_base
;
191 int carry
; /* ??? Should this be an a visible register somewhere? */
193 /* Action to take at the end of a MSG IN phase.
194 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
197 uint8_t msg
[LSI_MAX_MSGIN_LEN
];
198 /* 0 if SCRIPTS are running or stopped.
199 * 1 if a Wait Reselect instruction has been issued.
200 * 2 if processing DMA from lsi_execute_script.
201 * 3 if a DMA operation is in progress. */
205 /* The tag is a combination of the device ID and the SCSI tag. */
207 int command_complete
;
208 QTAILQ_HEAD(, lsi_request
) queue
;
209 lsi_request
*current
;
270 uint32_t scratch
[18]; /* SCRATCHA-SCRATCHR */
273 /* Script ram is stored as 32-bit words in host byteorder. */
274 uint32_t script_ram
[2048];
277 static inline int lsi_irq_on_rsl(LSIState
*s
)
279 return (s
->sien0
& LSI_SIST0_RSL
) && (s
->scid
& LSI_SCID_RRE
);
282 static void lsi_soft_reset(LSIState
*s
)
296 memset(s
->scratch
, 0, sizeof(s
->scratch
));
300 s
->dstat
= LSI_DSTAT_DFE
;
309 s
->ctest2
= LSI_CTEST2_DACK
;
352 while (!QTAILQ_EMPTY(&s
->queue
)) {
353 p
= QTAILQ_FIRST(&s
->queue
);
354 QTAILQ_REMOVE(&s
->queue
, p
, next
);
358 qemu_free(s
->current
);
363 static int lsi_dma_40bit(LSIState
*s
)
365 if ((s
->ccntl1
& LSI_CCNTL1_40BIT
) == LSI_CCNTL1_40BIT
)
370 static int lsi_dma_ti64bit(LSIState
*s
)
372 if ((s
->ccntl1
& LSI_CCNTL1_EN64TIBMV
) == LSI_CCNTL1_EN64TIBMV
)
377 static int lsi_dma_64bit(LSIState
*s
)
379 if ((s
->ccntl1
& LSI_CCNTL1_EN64DBMV
) == LSI_CCNTL1_EN64DBMV
)
384 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
);
385 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
);
386 static void lsi_execute_script(LSIState
*s
);
387 static void lsi_reselect(LSIState
*s
, lsi_request
*p
);
389 static inline uint32_t read_dword(LSIState
*s
, uint32_t addr
)
393 /* Optimize reading from SCRIPTS RAM. */
394 if ((addr
& 0xffffe000) == s
->script_ram_base
) {
395 return s
->script_ram
[(addr
& 0x1fff) >> 2];
397 cpu_physical_memory_read(addr
, (uint8_t *)&buf
, 4);
398 return cpu_to_le32(buf
);
401 static void lsi_stop_script(LSIState
*s
)
403 s
->istat1
&= ~LSI_ISTAT1_SRUN
;
406 static void lsi_update_irq(LSIState
*s
)
409 static int last_level
;
412 /* It's unclear whether the DIP/SIP bits should be cleared when the
413 Interrupt Status Registers are cleared or when istat0 is read.
414 We currently do the formwer, which seems to work. */
417 if (s
->dstat
& s
->dien
)
419 s
->istat0
|= LSI_ISTAT0_DIP
;
421 s
->istat0
&= ~LSI_ISTAT0_DIP
;
424 if (s
->sist0
|| s
->sist1
) {
425 if ((s
->sist0
& s
->sien0
) || (s
->sist1
& s
->sien1
))
427 s
->istat0
|= LSI_ISTAT0_SIP
;
429 s
->istat0
&= ~LSI_ISTAT0_SIP
;
431 if (s
->istat0
& LSI_ISTAT0_INTF
)
434 if (level
!= last_level
) {
435 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
436 level
, s
->dstat
, s
->sist1
, s
->sist0
);
439 qemu_set_irq(s
->dev
.irq
[0], level
);
441 if (!level
&& lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
)) {
442 DPRINTF("Handled IRQs & disconnected, looking for pending "
444 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
453 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
454 static void lsi_script_scsi_interrupt(LSIState
*s
, int stat0
, int stat1
)
459 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
460 stat1
, stat0
, s
->sist1
, s
->sist0
);
463 /* Stop processor on fatal or unmasked interrupt. As a special hack
464 we don't stop processing when raising STO. Instead continue
465 execution and stop at the next insn that accesses the SCSI bus. */
466 mask0
= s
->sien0
| ~(LSI_SIST0_CMP
| LSI_SIST0_SEL
| LSI_SIST0_RSL
);
467 mask1
= s
->sien1
| ~(LSI_SIST1_GEN
| LSI_SIST1_HTH
);
468 mask1
&= ~LSI_SIST1_STO
;
469 if (s
->sist0
& mask0
|| s
->sist1
& mask1
) {
475 /* Stop SCRIPTS execution and raise a DMA interrupt. */
476 static void lsi_script_dma_interrupt(LSIState
*s
, int stat
)
478 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat
, s
->dstat
);
484 static inline void lsi_set_phase(LSIState
*s
, int phase
)
486 s
->sstat1
= (s
->sstat1
& ~PHASE_MASK
) | phase
;
489 static void lsi_bad_phase(LSIState
*s
, int out
, int new_phase
)
491 /* Trigger a phase mismatch. */
492 if (s
->ccntl0
& LSI_CCNTL0_ENPMJ
) {
493 if ((s
->ccntl0
& LSI_CCNTL0_PMJCTL
)) {
494 s
->dsp
= out
? s
->pmjad1
: s
->pmjad2
;
496 s
->dsp
= (s
->scntl2
& LSI_SCNTL2_WSR
? s
->pmjad2
: s
->pmjad1
);
498 DPRINTF("Data phase mismatch jump to %08x\n", s
->dsp
);
500 DPRINTF("Phase mismatch interrupt\n");
501 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
504 lsi_set_phase(s
, new_phase
);
508 /* Resume SCRIPTS execution after a DMA operation. */
509 static void lsi_resume_script(LSIState
*s
)
511 if (s
->waiting
!= 2) {
513 lsi_execute_script(s
);
519 static void lsi_disconnect(LSIState
*s
)
521 s
->scntl1
&= ~LSI_SCNTL1_CON
;
522 s
->sstat1
&= ~PHASE_MASK
;
525 static void lsi_bad_selection(LSIState
*s
, uint32_t id
)
527 DPRINTF("Selected absent target %d\n", id
);
528 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_STO
);
532 /* Initiate a SCSI layer data transfer. */
533 static void lsi_do_dma(LSIState
*s
, int out
)
536 target_phys_addr_t addr
;
540 if (!s
->current
->dma_len
) {
541 /* Wait until data is available. */
542 DPRINTF("DMA no data available\n");
546 id
= (s
->current
->tag
>> 8) & 0xf;
547 dev
= s
->bus
.devs
[id
];
549 lsi_bad_selection(s
, id
);
554 if (count
> s
->current
->dma_len
)
555 count
= s
->current
->dma_len
;
558 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
559 if (lsi_dma_40bit(s
) || lsi_dma_ti64bit(s
))
560 addr
|= ((uint64_t)s
->dnad64
<< 32);
562 addr
|= ((uint64_t)s
->dbms
<< 32);
564 addr
|= ((uint64_t)s
->sbms
<< 32);
566 DPRINTF("DMA addr=0x" TARGET_FMT_plx
" len=%d\n", addr
, count
);
571 if (s
->current
->dma_buf
== NULL
) {
572 s
->current
->dma_buf
= dev
->info
->get_buf(dev
, s
->current
->tag
);
575 /* ??? Set SFBR to first data byte. */
577 cpu_physical_memory_read(addr
, s
->current
->dma_buf
, count
);
579 cpu_physical_memory_write(addr
, s
->current
->dma_buf
, count
);
581 s
->current
->dma_len
-= count
;
582 if (s
->current
->dma_len
== 0) {
583 s
->current
->dma_buf
= NULL
;
585 /* Write the data. */
586 dev
->info
->write_data(dev
, s
->current
->tag
);
588 /* Request any remaining data. */
589 dev
->info
->read_data(dev
, s
->current
->tag
);
592 s
->current
->dma_buf
+= count
;
593 lsi_resume_script(s
);
598 /* Add a command to the queue. */
599 static void lsi_queue_command(LSIState
*s
)
601 lsi_request
*p
= s
->current
;
603 DPRINTF("Queueing tag=0x%x\n", p
->tag
);
604 assert(s
->current
!= NULL
);
605 assert(s
->current
->dma_len
== 0);
606 QTAILQ_INSERT_TAIL(&s
->queue
, s
->current
, next
);
610 p
->out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
613 /* Queue a byte for a MSG IN phase. */
614 static void lsi_add_msg_byte(LSIState
*s
, uint8_t data
)
616 if (s
->msg_len
>= LSI_MAX_MSGIN_LEN
) {
617 BADF("MSG IN data too long\n");
619 DPRINTF("MSG IN 0x%02x\n", data
);
620 s
->msg
[s
->msg_len
++] = data
;
624 /* Perform reselection to continue a command. */
625 static void lsi_reselect(LSIState
*s
, lsi_request
*p
)
629 assert(s
->current
== NULL
);
630 QTAILQ_REMOVE(&s
->queue
, p
, next
);
633 id
= (p
->tag
>> 8) & 0xf;
635 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
636 if (!(s
->dcntl
& LSI_DCNTL_COM
)) {
637 s
->sfbr
= 1 << (id
& 0x7);
639 DPRINTF("Reselected target %d\n", id
);
640 s
->scntl1
|= LSI_SCNTL1_CON
;
641 lsi_set_phase(s
, PHASE_MI
);
642 s
->msg_action
= p
->out
? 2 : 3;
643 s
->current
->dma_len
= p
->pending
;
644 lsi_add_msg_byte(s
, 0x80);
645 if (s
->current
->tag
& LSI_TAG_VALID
) {
646 lsi_add_msg_byte(s
, 0x20);
647 lsi_add_msg_byte(s
, p
->tag
& 0xff);
650 if (lsi_irq_on_rsl(s
)) {
651 lsi_script_scsi_interrupt(s
, LSI_SIST0_RSL
, 0);
655 static lsi_request
*lsi_find_by_tag(LSIState
*s
, uint32_t tag
)
659 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
668 /* Record that data is available for a queued command. Returns zero if
669 the device was reselected, nonzero if the IO is deferred. */
670 static int lsi_queue_tag(LSIState
*s
, uint32_t tag
, uint32_t arg
)
674 p
= lsi_find_by_tag(s
, tag
);
676 BADF("IO with unknown tag %d\n", tag
);
681 BADF("Multiple IO pending for tag %d\n", tag
);
684 /* Reselect if waiting for it, or if reselection triggers an IRQ
686 Since no interrupt stacking is implemented in the emulation, it
687 is also required that there are no pending interrupts waiting
688 for service from the device driver. */
689 if (s
->waiting
== 1 ||
690 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
) &&
691 !(s
->istat0
& (LSI_ISTAT0_SIP
| LSI_ISTAT0_DIP
)))) {
692 /* Reselect device. */
696 DPRINTF("Queueing IO tag=0x%x\n", tag
);
702 /* Callback to indicate that the SCSI layer has completed a transfer. */
703 static void lsi_command_complete(SCSIBus
*bus
, int reason
, uint32_t tag
,
706 LSIState
*s
= DO_UPCAST(LSIState
, dev
.qdev
, bus
->qbus
.parent
);
709 out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
710 if (reason
== SCSI_REASON_DONE
) {
711 DPRINTF("Command complete status=%d\n", (int)arg
);
713 s
->command_complete
= 2;
714 if (s
->waiting
&& s
->dbc
!= 0) {
715 /* Raise phase mismatch for short transfers. */
716 lsi_bad_phase(s
, out
, PHASE_ST
);
718 lsi_set_phase(s
, PHASE_ST
);
721 qemu_free(s
->current
);
724 lsi_resume_script(s
);
728 if (s
->waiting
== 1 || !s
->current
|| tag
!= s
->current
->tag
||
729 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
))) {
730 if (lsi_queue_tag(s
, tag
, arg
))
734 /* host adapter (re)connected */
735 DPRINTF("Data ready tag=0x%x len=%d\n", tag
, arg
);
736 s
->current
->dma_len
= arg
;
737 s
->command_complete
= 1;
740 if (s
->waiting
== 1 || s
->dbc
== 0) {
741 lsi_resume_script(s
);
747 static void lsi_do_command(LSIState
*s
)
754 DPRINTF("Send command len=%d\n", s
->dbc
);
757 cpu_physical_memory_read(s
->dnad
, buf
, s
->dbc
);
759 s
->command_complete
= 0;
761 id
= (s
->select_tag
>> 8) & 0xf;
762 dev
= s
->bus
.devs
[id
];
764 lsi_bad_selection(s
, id
);
768 assert(s
->current
== NULL
);
769 s
->current
= qemu_mallocz(sizeof(lsi_request
));
770 s
->current
->tag
= s
->select_tag
;
772 n
= dev
->info
->send_command(dev
, s
->current
->tag
, buf
, s
->current_lun
);
774 lsi_set_phase(s
, PHASE_DI
);
775 dev
->info
->read_data(dev
, s
->current
->tag
);
777 lsi_set_phase(s
, PHASE_DO
);
778 dev
->info
->write_data(dev
, s
->current
->tag
);
781 if (!s
->command_complete
) {
783 /* Command did not complete immediately so disconnect. */
784 lsi_add_msg_byte(s
, 2); /* SAVE DATA POINTER */
785 lsi_add_msg_byte(s
, 4); /* DISCONNECT */
787 lsi_set_phase(s
, PHASE_MI
);
789 lsi_queue_command(s
);
791 /* wait command complete */
792 lsi_set_phase(s
, PHASE_DI
);
797 static void lsi_do_status(LSIState
*s
)
800 DPRINTF("Get status len=%d status=%d\n", s
->dbc
, s
->status
);
802 BADF("Bad Status move\n");
806 cpu_physical_memory_write(s
->dnad
, &status
, 1);
807 lsi_set_phase(s
, PHASE_MI
);
809 lsi_add_msg_byte(s
, 0); /* COMMAND COMPLETE */
812 static void lsi_do_msgin(LSIState
*s
)
815 DPRINTF("Message in len=%d/%d\n", s
->dbc
, s
->msg_len
);
820 cpu_physical_memory_write(s
->dnad
, s
->msg
, len
);
821 /* Linux drivers rely on the last byte being in the SIDL. */
822 s
->sidl
= s
->msg
[len
- 1];
825 memmove(s
->msg
, s
->msg
+ len
, s
->msg_len
);
827 /* ??? Check if ATN (not yet implemented) is asserted and maybe
828 switch to PHASE_MO. */
829 switch (s
->msg_action
) {
831 lsi_set_phase(s
, PHASE_CMD
);
837 lsi_set_phase(s
, PHASE_DO
);
840 lsi_set_phase(s
, PHASE_DI
);
848 /* Read the next byte during a MSGOUT phase. */
849 static uint8_t lsi_get_msgbyte(LSIState
*s
)
852 cpu_physical_memory_read(s
->dnad
, &data
, 1);
858 /* Skip the next n bytes during a MSGOUT phase. */
859 static void lsi_skip_msgbytes(LSIState
*s
, unsigned int n
)
865 static void lsi_do_msgout(LSIState
*s
)
869 uint32_t current_tag
;
870 SCSIDevice
*current_dev
;
871 lsi_request
*p
, *p_next
;
875 current_tag
= s
->current
->tag
;
877 current_tag
= s
->select_tag
;
879 id
= (current_tag
>> 8) & 0xf;
880 current_dev
= s
->bus
.devs
[id
];
882 DPRINTF("MSG out len=%d\n", s
->dbc
);
884 msg
= lsi_get_msgbyte(s
);
889 DPRINTF("MSG: Disconnect\n");
893 DPRINTF("MSG: No Operation\n");
894 lsi_set_phase(s
, PHASE_CMD
);
897 len
= lsi_get_msgbyte(s
);
898 msg
= lsi_get_msgbyte(s
);
899 (void)len
; /* avoid a warning about unused variable*/
900 DPRINTF("Extended message 0x%x (len %d)\n", msg
, len
);
903 DPRINTF("SDTR (ignored)\n");
904 lsi_skip_msgbytes(s
, 2);
907 DPRINTF("WDTR (ignored)\n");
908 lsi_skip_msgbytes(s
, 1);
914 case 0x20: /* SIMPLE queue */
915 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
916 DPRINTF("SIMPLE queue tag=0x%x\n", s
->select_tag
& 0xff);
918 case 0x21: /* HEAD of queue */
919 BADF("HEAD queue not implemented\n");
920 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
922 case 0x22: /* ORDERED queue */
923 BADF("ORDERED queue not implemented\n");
924 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
927 /* The ABORT TAG message clears the current I/O process only. */
928 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag
);
929 current_dev
->info
->cancel_io(current_dev
, current_tag
);
935 /* The ABORT message clears all I/O processes for the selecting
936 initiator on the specified logical unit of the target. */
938 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag
);
940 /* The CLEAR QUEUE message clears all I/O processes for all
941 initiators on the specified logical unit of the target. */
943 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag
);
945 /* The BUS DEVICE RESET message clears all I/O processes for all
946 initiators on all logical units of the target. */
948 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag
);
951 /* clear the current I/O process */
952 current_dev
->info
->cancel_io(current_dev
, current_tag
);
954 /* As the current implemented devices scsi_disk and scsi_generic
955 only support one LUN, we don't need to keep track of LUNs.
956 Clearing I/O processes for other initiators could be possible
957 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
958 device, but this is currently not implemented (and seems not
959 to be really necessary). So let's simply clear all queued
960 commands for the current device: */
961 id
= current_tag
& 0x0000ff00;
962 QTAILQ_FOREACH_SAFE(p
, &s
->queue
, next
, p_next
) {
963 if ((p
->tag
& 0x0000ff00) == id
) {
964 current_dev
->info
->cancel_io(current_dev
, p
->tag
);
965 QTAILQ_REMOVE(&s
->queue
, p
, next
);
972 if ((msg
& 0x80) == 0) {
975 s
->current_lun
= msg
& 7;
976 DPRINTF("Select LUN %d\n", s
->current_lun
);
977 lsi_set_phase(s
, PHASE_CMD
);
983 BADF("Unimplemented message 0x%02x\n", msg
);
984 lsi_set_phase(s
, PHASE_MI
);
985 lsi_add_msg_byte(s
, 7); /* MESSAGE REJECT */
989 /* Sign extend a 24-bit value. */
990 static inline int32_t sxt24(int32_t n
)
992 return (n
<< 8) >> 8;
995 #define LSI_BUF_SIZE 4096
996 static void lsi_memcpy(LSIState
*s
, uint32_t dest
, uint32_t src
, int count
)
999 uint8_t buf
[LSI_BUF_SIZE
];
1001 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest
, src
, count
);
1003 n
= (count
> LSI_BUF_SIZE
) ? LSI_BUF_SIZE
: count
;
1004 cpu_physical_memory_read(src
, buf
, n
);
1005 cpu_physical_memory_write(dest
, buf
, n
);
1012 static void lsi_wait_reselect(LSIState
*s
)
1016 DPRINTF("Wait Reselect\n");
1018 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
1024 if (s
->current
== NULL
) {
1029 static void lsi_execute_script(LSIState
*s
)
1032 uint32_t addr
, addr_high
;
1034 int insn_processed
= 0;
1036 s
->istat1
|= LSI_ISTAT1_SRUN
;
1039 insn
= read_dword(s
, s
->dsp
);
1041 /* If we receive an empty opcode increment the DSP by 4 bytes
1042 instead of 8 and execute the next opcode at that location */
1046 addr
= read_dword(s
, s
->dsp
+ 4);
1048 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s
->dsp
, insn
, addr
);
1050 s
->dcmd
= insn
>> 24;
1052 switch (insn
>> 30) {
1053 case 0: /* Block move. */
1054 if (s
->sist1
& LSI_SIST1_STO
) {
1055 DPRINTF("Delayed select timeout\n");
1059 s
->dbc
= insn
& 0xffffff;
1063 if (insn
& (1 << 29)) {
1064 /* Indirect addressing. */
1065 addr
= read_dword(s
, addr
);
1066 } else if (insn
& (1 << 28)) {
1069 /* Table indirect addressing. */
1071 /* 32-bit Table indirect */
1072 offset
= sxt24(addr
);
1073 cpu_physical_memory_read(s
->dsa
+ offset
, (uint8_t *)buf
, 8);
1074 /* byte count is stored in bits 0:23 only */
1075 s
->dbc
= cpu_to_le32(buf
[0]) & 0xffffff;
1077 addr
= cpu_to_le32(buf
[1]);
1079 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1080 * table, bits [31:24] */
1081 if (lsi_dma_40bit(s
))
1082 addr_high
= cpu_to_le32(buf
[0]) >> 24;
1083 else if (lsi_dma_ti64bit(s
)) {
1084 int selector
= (cpu_to_le32(buf
[0]) >> 24) & 0x1f;
1087 /* offset index into scratch registers since
1088 * TI64 mode can use registers C to R */
1089 addr_high
= s
->scratch
[2 + selector
];
1092 addr_high
= s
->mmrs
;
1095 addr_high
= s
->mmws
;
1104 addr_high
= s
->sbms
;
1107 addr_high
= s
->dbms
;
1110 BADF("Illegal selector specified (0x%x > 0x15)"
1111 " for 64-bit DMA block move", selector
);
1115 } else if (lsi_dma_64bit(s
)) {
1116 /* fetch a 3rd dword if 64-bit direct move is enabled and
1117 only if we're not doing table indirect or indirect addressing */
1118 s
->dbms
= read_dword(s
, s
->dsp
);
1120 s
->ia
= s
->dsp
- 12;
1122 if ((s
->sstat1
& PHASE_MASK
) != ((insn
>> 24) & 7)) {
1123 DPRINTF("Wrong phase got %d expected %d\n",
1124 s
->sstat1
& PHASE_MASK
, (insn
>> 24) & 7);
1125 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
1129 s
->dnad64
= addr_high
;
1130 switch (s
->sstat1
& 0x7) {
1156 BADF("Unimplemented phase %d\n", s
->sstat1
& PHASE_MASK
);
1159 s
->dfifo
= s
->dbc
& 0xff;
1160 s
->ctest5
= (s
->ctest5
& 0xfc) | ((s
->dbc
>> 8) & 3);
1163 s
->ua
= addr
+ s
->dbc
;
1166 case 1: /* IO or Read/Write instruction. */
1167 opcode
= (insn
>> 27) & 7;
1171 if (insn
& (1 << 25)) {
1172 id
= read_dword(s
, s
->dsa
+ sxt24(insn
));
1176 id
= (id
>> 16) & 0xf;
1177 if (insn
& (1 << 26)) {
1178 addr
= s
->dsp
+ sxt24(addr
);
1182 case 0: /* Select */
1184 if (s
->scntl1
& LSI_SCNTL1_CON
) {
1185 DPRINTF("Already reselected, jumping to alternative address\n");
1189 s
->sstat0
|= LSI_SSTAT0_WOA
;
1190 s
->scntl1
&= ~LSI_SCNTL1_IARB
;
1191 if (id
>= LSI_MAX_DEVS
|| !s
->bus
.devs
[id
]) {
1192 lsi_bad_selection(s
, id
);
1195 DPRINTF("Selected target %d%s\n",
1196 id
, insn
& (1 << 3) ? " ATN" : "");
1197 /* ??? Linux drivers compain when this is set. Maybe
1198 it only applies in low-level mode (unimplemented).
1199 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1200 s
->select_tag
= id
<< 8;
1201 s
->scntl1
|= LSI_SCNTL1_CON
;
1202 if (insn
& (1 << 3)) {
1203 s
->socl
|= LSI_SOCL_ATN
;
1205 lsi_set_phase(s
, PHASE_MO
);
1207 case 1: /* Disconnect */
1208 DPRINTF("Wait Disconnect\n");
1209 s
->scntl1
&= ~LSI_SCNTL1_CON
;
1211 case 2: /* Wait Reselect */
1212 if (!lsi_irq_on_rsl(s
)) {
1213 lsi_wait_reselect(s
);
1217 DPRINTF("Set%s%s%s%s\n",
1218 insn
& (1 << 3) ? " ATN" : "",
1219 insn
& (1 << 6) ? " ACK" : "",
1220 insn
& (1 << 9) ? " TM" : "",
1221 insn
& (1 << 10) ? " CC" : "");
1222 if (insn
& (1 << 3)) {
1223 s
->socl
|= LSI_SOCL_ATN
;
1224 lsi_set_phase(s
, PHASE_MO
);
1226 if (insn
& (1 << 9)) {
1227 BADF("Target mode not implemented\n");
1230 if (insn
& (1 << 10))
1234 DPRINTF("Clear%s%s%s%s\n",
1235 insn
& (1 << 3) ? " ATN" : "",
1236 insn
& (1 << 6) ? " ACK" : "",
1237 insn
& (1 << 9) ? " TM" : "",
1238 insn
& (1 << 10) ? " CC" : "");
1239 if (insn
& (1 << 3)) {
1240 s
->socl
&= ~LSI_SOCL_ATN
;
1242 if (insn
& (1 << 10))
1253 static const char *opcode_names
[3] =
1254 {"Write", "Read", "Read-Modify-Write"};
1255 static const char *operator_names
[8] =
1256 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1259 reg
= ((insn
>> 16) & 0x7f) | (insn
& 0x80);
1260 data8
= (insn
>> 8) & 0xff;
1261 opcode
= (insn
>> 27) & 7;
1262 operator = (insn
>> 24) & 7;
1263 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1264 opcode_names
[opcode
- 5], reg
,
1265 operator_names
[operator], data8
, s
->sfbr
,
1266 (insn
& (1 << 23)) ? " SFBR" : "");
1269 case 5: /* From SFBR */
1273 case 6: /* To SFBR */
1275 op0
= lsi_reg_readb(s
, reg
);
1278 case 7: /* Read-modify-write */
1280 op0
= lsi_reg_readb(s
, reg
);
1281 if (insn
& (1 << 23)) {
1293 case 1: /* Shift left */
1295 op0
= (op0
<< 1) | s
->carry
;
1309 op0
= (op0
>> 1) | (s
->carry
<< 7);
1314 s
->carry
= op0
< op1
;
1317 op0
+= op1
+ s
->carry
;
1319 s
->carry
= op0
<= op1
;
1321 s
->carry
= op0
< op1
;
1326 case 5: /* From SFBR */
1327 case 7: /* Read-modify-write */
1328 lsi_reg_writeb(s
, reg
, op0
);
1330 case 6: /* To SFBR */
1337 case 2: /* Transfer Control. */
1342 if ((insn
& 0x002e0000) == 0) {
1346 if (s
->sist1
& LSI_SIST1_STO
) {
1347 DPRINTF("Delayed select timeout\n");
1351 cond
= jmp
= (insn
& (1 << 19)) != 0;
1352 if (cond
== jmp
&& (insn
& (1 << 21))) {
1353 DPRINTF("Compare carry %d\n", s
->carry
== jmp
);
1354 cond
= s
->carry
!= 0;
1356 if (cond
== jmp
&& (insn
& (1 << 17))) {
1357 DPRINTF("Compare phase %d %c= %d\n",
1358 (s
->sstat1
& PHASE_MASK
),
1360 ((insn
>> 24) & 7));
1361 cond
= (s
->sstat1
& PHASE_MASK
) == ((insn
>> 24) & 7);
1363 if (cond
== jmp
&& (insn
& (1 << 18))) {
1366 mask
= (~insn
>> 8) & 0xff;
1367 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1368 s
->sfbr
, mask
, jmp
? '=' : '!', insn
& mask
);
1369 cond
= (s
->sfbr
& mask
) == (insn
& mask
);
1372 if (insn
& (1 << 23)) {
1373 /* Relative address. */
1374 addr
= s
->dsp
+ sxt24(addr
);
1376 switch ((insn
>> 27) & 7) {
1378 DPRINTF("Jump to 0x%08x\n", addr
);
1382 DPRINTF("Call 0x%08x\n", addr
);
1386 case 2: /* Return */
1387 DPRINTF("Return to 0x%08x\n", s
->temp
);
1390 case 3: /* Interrupt */
1391 DPRINTF("Interrupt 0x%08x\n", s
->dsps
);
1392 if ((insn
& (1 << 20)) != 0) {
1393 s
->istat0
|= LSI_ISTAT0_INTF
;
1396 lsi_script_dma_interrupt(s
, LSI_DSTAT_SIR
);
1400 DPRINTF("Illegal transfer control\n");
1401 lsi_script_dma_interrupt(s
, LSI_DSTAT_IID
);
1405 DPRINTF("Control condition failed\n");
1411 if ((insn
& (1 << 29)) == 0) {
1414 /* ??? The docs imply the destination address is loaded into
1415 the TEMP register. However the Linux drivers rely on
1416 the value being presrved. */
1417 dest
= read_dword(s
, s
->dsp
);
1419 lsi_memcpy(s
, dest
, addr
, insn
& 0xffffff);
1426 if (insn
& (1 << 28)) {
1427 addr
= s
->dsa
+ sxt24(addr
);
1430 reg
= (insn
>> 16) & 0xff;
1431 if (insn
& (1 << 24)) {
1432 cpu_physical_memory_read(addr
, data
, n
);
1433 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg
, n
,
1434 addr
, *(int *)data
);
1435 for (i
= 0; i
< n
; i
++) {
1436 lsi_reg_writeb(s
, reg
+ i
, data
[i
]);
1439 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg
, n
, addr
);
1440 for (i
= 0; i
< n
; i
++) {
1441 data
[i
] = lsi_reg_readb(s
, reg
+ i
);
1443 cpu_physical_memory_write(addr
, data
, n
);
1447 if (insn_processed
> 10000 && !s
->waiting
) {
1448 /* Some windows drivers make the device spin waiting for a memory
1449 location to change. If we have been executed a lot of code then
1450 assume this is the case and force an unexpected device disconnect.
1451 This is apparently sufficient to beat the drivers into submission.
1453 if (!(s
->sien0
& LSI_SIST0_UDC
))
1454 fprintf(stderr
, "inf. loop with UDC masked\n");
1455 lsi_script_scsi_interrupt(s
, LSI_SIST0_UDC
, 0);
1457 } else if (s
->istat1
& LSI_ISTAT1_SRUN
&& !s
->waiting
) {
1458 if (s
->dcntl
& LSI_DCNTL_SSM
) {
1459 lsi_script_dma_interrupt(s
, LSI_DSTAT_SSI
);
1464 DPRINTF("SCRIPTS execution stopped\n");
1467 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
)
1470 #define CASE_GET_REG24(name, addr) \
1471 case addr: return s->name & 0xff; \
1472 case addr + 1: return (s->name >> 8) & 0xff; \
1473 case addr + 2: return (s->name >> 16) & 0xff;
1475 #define CASE_GET_REG32(name, addr) \
1476 case addr: return s->name & 0xff; \
1477 case addr + 1: return (s->name >> 8) & 0xff; \
1478 case addr + 2: return (s->name >> 16) & 0xff; \
1479 case addr + 3: return (s->name >> 24) & 0xff;
1481 #ifdef DEBUG_LSI_REG
1482 DPRINTF("Read reg %x\n", offset
);
1485 case 0x00: /* SCNTL0 */
1487 case 0x01: /* SCNTL1 */
1489 case 0x02: /* SCNTL2 */
1491 case 0x03: /* SCNTL3 */
1493 case 0x04: /* SCID */
1495 case 0x05: /* SXFER */
1497 case 0x06: /* SDID */
1499 case 0x07: /* GPREG0 */
1501 case 0x08: /* Revision ID */
1503 case 0xa: /* SSID */
1505 case 0xb: /* SBCL */
1506 /* ??? This is not correct. However it's (hopefully) only
1507 used for diagnostics, so should be ok. */
1509 case 0xc: /* DSTAT */
1510 tmp
= s
->dstat
| 0x80;
1511 if ((s
->istat0
& LSI_ISTAT0_INTF
) == 0)
1515 case 0x0d: /* SSTAT0 */
1517 case 0x0e: /* SSTAT1 */
1519 case 0x0f: /* SSTAT2 */
1520 return s
->scntl1
& LSI_SCNTL1_CON
? 0 : 2;
1521 CASE_GET_REG32(dsa
, 0x10)
1522 case 0x14: /* ISTAT0 */
1524 case 0x15: /* ISTAT1 */
1526 case 0x16: /* MBOX0 */
1528 case 0x17: /* MBOX1 */
1530 case 0x18: /* CTEST0 */
1532 case 0x19: /* CTEST1 */
1534 case 0x1a: /* CTEST2 */
1535 tmp
= s
->ctest2
| LSI_CTEST2_DACK
| LSI_CTEST2_CM
;
1536 if (s
->istat0
& LSI_ISTAT0_SIGP
) {
1537 s
->istat0
&= ~LSI_ISTAT0_SIGP
;
1538 tmp
|= LSI_CTEST2_SIGP
;
1541 case 0x1b: /* CTEST3 */
1543 CASE_GET_REG32(temp
, 0x1c)
1544 case 0x20: /* DFIFO */
1546 case 0x21: /* CTEST4 */
1548 case 0x22: /* CTEST5 */
1550 case 0x23: /* CTEST6 */
1552 CASE_GET_REG24(dbc
, 0x24)
1553 case 0x27: /* DCMD */
1555 CASE_GET_REG32(dnad
, 0x28)
1556 CASE_GET_REG32(dsp
, 0x2c)
1557 CASE_GET_REG32(dsps
, 0x30)
1558 CASE_GET_REG32(scratch
[0], 0x34)
1559 case 0x38: /* DMODE */
1561 case 0x39: /* DIEN */
1563 case 0x3a: /* SBR */
1565 case 0x3b: /* DCNTL */
1567 case 0x40: /* SIEN0 */
1569 case 0x41: /* SIEN1 */
1571 case 0x42: /* SIST0 */
1576 case 0x43: /* SIST1 */
1581 case 0x46: /* MACNTL */
1583 case 0x47: /* GPCNTL0 */
1585 case 0x48: /* STIME0 */
1587 case 0x4a: /* RESPID0 */
1589 case 0x4b: /* RESPID1 */
1591 case 0x4d: /* STEST1 */
1593 case 0x4e: /* STEST2 */
1595 case 0x4f: /* STEST3 */
1597 case 0x50: /* SIDL */
1598 /* This is needed by the linux drivers. We currently only update it
1599 during the MSG IN phase. */
1601 case 0x52: /* STEST4 */
1603 case 0x56: /* CCNTL0 */
1605 case 0x57: /* CCNTL1 */
1607 case 0x58: /* SBDL */
1608 /* Some drivers peek at the data bus during the MSG IN phase. */
1609 if ((s
->sstat1
& PHASE_MASK
) == PHASE_MI
)
1612 case 0x59: /* SBDL high */
1614 CASE_GET_REG32(mmrs
, 0xa0)
1615 CASE_GET_REG32(mmws
, 0xa4)
1616 CASE_GET_REG32(sfs
, 0xa8)
1617 CASE_GET_REG32(drs
, 0xac)
1618 CASE_GET_REG32(sbms
, 0xb0)
1619 CASE_GET_REG32(dbms
, 0xb4)
1620 CASE_GET_REG32(dnad64
, 0xb8)
1621 CASE_GET_REG32(pmjad1
, 0xc0)
1622 CASE_GET_REG32(pmjad2
, 0xc4)
1623 CASE_GET_REG32(rbc
, 0xc8)
1624 CASE_GET_REG32(ua
, 0xcc)
1625 CASE_GET_REG32(ia
, 0xd4)
1626 CASE_GET_REG32(sbc
, 0xd8)
1627 CASE_GET_REG32(csbc
, 0xdc)
1629 if (offset
>= 0x5c && offset
< 0xa0) {
1632 n
= (offset
- 0x58) >> 2;
1633 shift
= (offset
& 3) * 8;
1634 return (s
->scratch
[n
] >> shift
) & 0xff;
1636 BADF("readb 0x%x\n", offset
);
1638 #undef CASE_GET_REG24
1639 #undef CASE_GET_REG32
1642 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
)
1644 #define CASE_SET_REG24(name, addr) \
1645 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1646 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1647 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1649 #define CASE_SET_REG32(name, addr) \
1650 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1651 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1652 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1653 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1655 #ifdef DEBUG_LSI_REG
1656 DPRINTF("Write reg %x = %02x\n", offset
, val
);
1659 case 0x00: /* SCNTL0 */
1661 if (val
& LSI_SCNTL0_START
) {
1662 BADF("Start sequence not implemented\n");
1665 case 0x01: /* SCNTL1 */
1666 s
->scntl1
= val
& ~LSI_SCNTL1_SST
;
1667 if (val
& LSI_SCNTL1_IARB
) {
1668 BADF("Immediate Arbritration not implemented\n");
1670 if (val
& LSI_SCNTL1_RST
) {
1671 if (!(s
->sstat0
& LSI_SSTAT0_RST
)) {
1675 for (id
= 0; id
< s
->bus
.ndev
; id
++) {
1676 if (s
->bus
.devs
[id
]) {
1677 dev
= &s
->bus
.devs
[id
]->qdev
;
1678 dev
->info
->reset(dev
);
1681 s
->sstat0
|= LSI_SSTAT0_RST
;
1682 lsi_script_scsi_interrupt(s
, LSI_SIST0_RST
, 0);
1685 s
->sstat0
&= ~LSI_SSTAT0_RST
;
1688 case 0x02: /* SCNTL2 */
1689 val
&= ~(LSI_SCNTL2_WSR
| LSI_SCNTL2_WSS
);
1692 case 0x03: /* SCNTL3 */
1695 case 0x04: /* SCID */
1698 case 0x05: /* SXFER */
1701 case 0x06: /* SDID */
1702 if ((val
& 0xf) != (s
->ssid
& 0xf))
1703 BADF("Destination ID does not match SSID\n");
1704 s
->sdid
= val
& 0xf;
1706 case 0x07: /* GPREG0 */
1708 case 0x08: /* SFBR */
1709 /* The CPU is not allowed to write to this register. However the
1710 SCRIPTS register move instructions are. */
1713 case 0x0a: case 0x0b:
1714 /* Openserver writes to these readonly registers on startup */
1716 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1717 /* Linux writes to these readonly registers on startup. */
1719 CASE_SET_REG32(dsa
, 0x10)
1720 case 0x14: /* ISTAT0 */
1721 s
->istat0
= (s
->istat0
& 0x0f) | (val
& 0xf0);
1722 if (val
& LSI_ISTAT0_ABRT
) {
1723 lsi_script_dma_interrupt(s
, LSI_DSTAT_ABRT
);
1725 if (val
& LSI_ISTAT0_INTF
) {
1726 s
->istat0
&= ~LSI_ISTAT0_INTF
;
1729 if (s
->waiting
== 1 && val
& LSI_ISTAT0_SIGP
) {
1730 DPRINTF("Woken by SIGP\n");
1733 lsi_execute_script(s
);
1735 if (val
& LSI_ISTAT0_SRST
) {
1739 case 0x16: /* MBOX0 */
1742 case 0x17: /* MBOX1 */
1745 case 0x1a: /* CTEST2 */
1746 s
->ctest2
= val
& LSI_CTEST2_PCICIE
;
1748 case 0x1b: /* CTEST3 */
1749 s
->ctest3
= val
& 0x0f;
1751 CASE_SET_REG32(temp
, 0x1c)
1752 case 0x21: /* CTEST4 */
1754 BADF("Unimplemented CTEST4-FBL 0x%x\n", val
);
1758 case 0x22: /* CTEST5 */
1759 if (val
& (LSI_CTEST5_ADCK
| LSI_CTEST5_BBCK
)) {
1760 BADF("CTEST5 DMA increment not implemented\n");
1764 CASE_SET_REG24(dbc
, 0x24)
1765 CASE_SET_REG32(dnad
, 0x28)
1766 case 0x2c: /* DSP[0:7] */
1767 s
->dsp
&= 0xffffff00;
1770 case 0x2d: /* DSP[8:15] */
1771 s
->dsp
&= 0xffff00ff;
1774 case 0x2e: /* DSP[16:23] */
1775 s
->dsp
&= 0xff00ffff;
1776 s
->dsp
|= val
<< 16;
1778 case 0x2f: /* DSP[24:31] */
1779 s
->dsp
&= 0x00ffffff;
1780 s
->dsp
|= val
<< 24;
1781 if ((s
->dmode
& LSI_DMODE_MAN
) == 0
1782 && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1783 lsi_execute_script(s
);
1785 CASE_SET_REG32(dsps
, 0x30)
1786 CASE_SET_REG32(scratch
[0], 0x34)
1787 case 0x38: /* DMODE */
1788 if (val
& (LSI_DMODE_SIOM
| LSI_DMODE_DIOM
)) {
1789 BADF("IO mappings not implemented\n");
1793 case 0x39: /* DIEN */
1797 case 0x3a: /* SBR */
1800 case 0x3b: /* DCNTL */
1801 s
->dcntl
= val
& ~(LSI_DCNTL_PFF
| LSI_DCNTL_STD
);
1802 if ((val
& LSI_DCNTL_STD
) && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1803 lsi_execute_script(s
);
1805 case 0x40: /* SIEN0 */
1809 case 0x41: /* SIEN1 */
1813 case 0x47: /* GPCNTL0 */
1815 case 0x48: /* STIME0 */
1818 case 0x49: /* STIME1 */
1820 DPRINTF("General purpose timer not implemented\n");
1821 /* ??? Raising the interrupt immediately seems to be sufficient
1822 to keep the FreeBSD driver happy. */
1823 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_GEN
);
1826 case 0x4a: /* RESPID0 */
1829 case 0x4b: /* RESPID1 */
1832 case 0x4d: /* STEST1 */
1835 case 0x4e: /* STEST2 */
1837 BADF("Low level mode not implemented\n");
1841 case 0x4f: /* STEST3 */
1843 BADF("SCSI FIFO test mode not implemented\n");
1847 case 0x56: /* CCNTL0 */
1850 case 0x57: /* CCNTL1 */
1853 CASE_SET_REG32(mmrs
, 0xa0)
1854 CASE_SET_REG32(mmws
, 0xa4)
1855 CASE_SET_REG32(sfs
, 0xa8)
1856 CASE_SET_REG32(drs
, 0xac)
1857 CASE_SET_REG32(sbms
, 0xb0)
1858 CASE_SET_REG32(dbms
, 0xb4)
1859 CASE_SET_REG32(dnad64
, 0xb8)
1860 CASE_SET_REG32(pmjad1
, 0xc0)
1861 CASE_SET_REG32(pmjad2
, 0xc4)
1862 CASE_SET_REG32(rbc
, 0xc8)
1863 CASE_SET_REG32(ua
, 0xcc)
1864 CASE_SET_REG32(ia
, 0xd4)
1865 CASE_SET_REG32(sbc
, 0xd8)
1866 CASE_SET_REG32(csbc
, 0xdc)
1868 if (offset
>= 0x5c && offset
< 0xa0) {
1871 n
= (offset
- 0x58) >> 2;
1872 shift
= (offset
& 3) * 8;
1873 s
->scratch
[n
] &= ~(0xff << shift
);
1874 s
->scratch
[n
] |= (val
& 0xff) << shift
;
1876 BADF("Unhandled writeb 0x%x = 0x%x\n", offset
, val
);
1879 #undef CASE_SET_REG24
1880 #undef CASE_SET_REG32
1883 static void lsi_mmio_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1885 LSIState
*s
= opaque
;
1887 lsi_reg_writeb(s
, addr
& 0xff, val
);
1890 static void lsi_mmio_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1892 LSIState
*s
= opaque
;
1895 lsi_reg_writeb(s
, addr
, val
& 0xff);
1896 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1899 static void lsi_mmio_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1901 LSIState
*s
= opaque
;
1904 lsi_reg_writeb(s
, addr
, val
& 0xff);
1905 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1906 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1907 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1910 static uint32_t lsi_mmio_readb(void *opaque
, target_phys_addr_t addr
)
1912 LSIState
*s
= opaque
;
1914 return lsi_reg_readb(s
, addr
& 0xff);
1917 static uint32_t lsi_mmio_readw(void *opaque
, target_phys_addr_t addr
)
1919 LSIState
*s
= opaque
;
1923 val
= lsi_reg_readb(s
, addr
);
1924 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1928 static uint32_t lsi_mmio_readl(void *opaque
, target_phys_addr_t addr
)
1930 LSIState
*s
= opaque
;
1933 val
= lsi_reg_readb(s
, addr
);
1934 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1935 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1936 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1940 static CPUReadMemoryFunc
* const lsi_mmio_readfn
[3] = {
1946 static CPUWriteMemoryFunc
* const lsi_mmio_writefn
[3] = {
1952 static void lsi_ram_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1954 LSIState
*s
= opaque
;
1959 newval
= s
->script_ram
[addr
>> 2];
1960 shift
= (addr
& 3) * 8;
1961 newval
&= ~(0xff << shift
);
1962 newval
|= val
<< shift
;
1963 s
->script_ram
[addr
>> 2] = newval
;
1966 static void lsi_ram_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1968 LSIState
*s
= opaque
;
1972 newval
= s
->script_ram
[addr
>> 2];
1974 newval
= (newval
& 0xffff) | (val
<< 16);
1976 newval
= (newval
& 0xffff0000) | val
;
1978 s
->script_ram
[addr
>> 2] = newval
;
1982 static void lsi_ram_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1984 LSIState
*s
= opaque
;
1987 s
->script_ram
[addr
>> 2] = val
;
1990 static uint32_t lsi_ram_readb(void *opaque
, target_phys_addr_t addr
)
1992 LSIState
*s
= opaque
;
1996 val
= s
->script_ram
[addr
>> 2];
1997 val
>>= (addr
& 3) * 8;
2001 static uint32_t lsi_ram_readw(void *opaque
, target_phys_addr_t addr
)
2003 LSIState
*s
= opaque
;
2007 val
= s
->script_ram
[addr
>> 2];
2013 static uint32_t lsi_ram_readl(void *opaque
, target_phys_addr_t addr
)
2015 LSIState
*s
= opaque
;
2018 return s
->script_ram
[addr
>> 2];
2021 static CPUReadMemoryFunc
* const lsi_ram_readfn
[3] = {
2027 static CPUWriteMemoryFunc
* const lsi_ram_writefn
[3] = {
2033 static uint32_t lsi_io_readb(void *opaque
, uint32_t addr
)
2035 LSIState
*s
= opaque
;
2036 return lsi_reg_readb(s
, addr
& 0xff);
2039 static uint32_t lsi_io_readw(void *opaque
, uint32_t addr
)
2041 LSIState
*s
= opaque
;
2044 val
= lsi_reg_readb(s
, addr
);
2045 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
2049 static uint32_t lsi_io_readl(void *opaque
, uint32_t addr
)
2051 LSIState
*s
= opaque
;
2054 val
= lsi_reg_readb(s
, addr
);
2055 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
2056 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
2057 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
2061 static void lsi_io_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
2063 LSIState
*s
= opaque
;
2064 lsi_reg_writeb(s
, addr
& 0xff, val
);
2067 static void lsi_io_writew(void *opaque
, uint32_t addr
, uint32_t val
)
2069 LSIState
*s
= opaque
;
2071 lsi_reg_writeb(s
, addr
, val
& 0xff);
2072 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
2075 static void lsi_io_writel(void *opaque
, uint32_t addr
, uint32_t val
)
2077 LSIState
*s
= opaque
;
2079 lsi_reg_writeb(s
, addr
, val
& 0xff);
2080 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
2081 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
2082 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
2085 static void lsi_io_mapfunc(PCIDevice
*pci_dev
, int region_num
,
2086 pcibus_t addr
, pcibus_t size
, int type
)
2088 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
2090 DPRINTF("Mapping IO at %08"FMT_PCIBUS
"\n", addr
);
2092 register_ioport_write(addr
, 256, 1, lsi_io_writeb
, s
);
2093 register_ioport_read(addr
, 256, 1, lsi_io_readb
, s
);
2094 register_ioport_write(addr
, 256, 2, lsi_io_writew
, s
);
2095 register_ioport_read(addr
, 256, 2, lsi_io_readw
, s
);
2096 register_ioport_write(addr
, 256, 4, lsi_io_writel
, s
);
2097 register_ioport_read(addr
, 256, 4, lsi_io_readl
, s
);
2100 static void lsi_ram_mapfunc(PCIDevice
*pci_dev
, int region_num
,
2101 pcibus_t addr
, pcibus_t size
, int type
)
2103 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
2105 DPRINTF("Mapping ram at %08"FMT_PCIBUS
"\n", addr
);
2106 s
->script_ram_base
= addr
;
2107 cpu_register_physical_memory(addr
+ 0, 0x2000, s
->ram_io_addr
);
2110 static void lsi_scsi_reset(DeviceState
*dev
)
2112 LSIState
*s
= DO_UPCAST(LSIState
, dev
.qdev
, dev
);
2117 static void lsi_pre_save(void *opaque
)
2119 LSIState
*s
= opaque
;
2122 assert(s
->current
->dma_buf
== NULL
);
2123 assert(s
->current
->dma_len
== 0);
2125 assert(QTAILQ_EMPTY(&s
->queue
));
2128 static const VMStateDescription vmstate_lsi_scsi
= {
2131 .minimum_version_id
= 0,
2132 .minimum_version_id_old
= 0,
2133 .pre_save
= lsi_pre_save
,
2134 .fields
= (VMStateField
[]) {
2135 VMSTATE_PCI_DEVICE(dev
, LSIState
),
2137 VMSTATE_INT32(carry
, LSIState
),
2138 VMSTATE_INT32(status
, LSIState
),
2139 VMSTATE_INT32(msg_action
, LSIState
),
2140 VMSTATE_INT32(msg_len
, LSIState
),
2141 VMSTATE_BUFFER(msg
, LSIState
),
2142 VMSTATE_INT32(waiting
, LSIState
),
2144 VMSTATE_UINT32(dsa
, LSIState
),
2145 VMSTATE_UINT32(temp
, LSIState
),
2146 VMSTATE_UINT32(dnad
, LSIState
),
2147 VMSTATE_UINT32(dbc
, LSIState
),
2148 VMSTATE_UINT8(istat0
, LSIState
),
2149 VMSTATE_UINT8(istat1
, LSIState
),
2150 VMSTATE_UINT8(dcmd
, LSIState
),
2151 VMSTATE_UINT8(dstat
, LSIState
),
2152 VMSTATE_UINT8(dien
, LSIState
),
2153 VMSTATE_UINT8(sist0
, LSIState
),
2154 VMSTATE_UINT8(sist1
, LSIState
),
2155 VMSTATE_UINT8(sien0
, LSIState
),
2156 VMSTATE_UINT8(sien1
, LSIState
),
2157 VMSTATE_UINT8(mbox0
, LSIState
),
2158 VMSTATE_UINT8(mbox1
, LSIState
),
2159 VMSTATE_UINT8(dfifo
, LSIState
),
2160 VMSTATE_UINT8(ctest2
, LSIState
),
2161 VMSTATE_UINT8(ctest3
, LSIState
),
2162 VMSTATE_UINT8(ctest4
, LSIState
),
2163 VMSTATE_UINT8(ctest5
, LSIState
),
2164 VMSTATE_UINT8(ccntl0
, LSIState
),
2165 VMSTATE_UINT8(ccntl1
, LSIState
),
2166 VMSTATE_UINT32(dsp
, LSIState
),
2167 VMSTATE_UINT32(dsps
, LSIState
),
2168 VMSTATE_UINT8(dmode
, LSIState
),
2169 VMSTATE_UINT8(dcntl
, LSIState
),
2170 VMSTATE_UINT8(scntl0
, LSIState
),
2171 VMSTATE_UINT8(scntl1
, LSIState
),
2172 VMSTATE_UINT8(scntl2
, LSIState
),
2173 VMSTATE_UINT8(scntl3
, LSIState
),
2174 VMSTATE_UINT8(sstat0
, LSIState
),
2175 VMSTATE_UINT8(sstat1
, LSIState
),
2176 VMSTATE_UINT8(scid
, LSIState
),
2177 VMSTATE_UINT8(sxfer
, LSIState
),
2178 VMSTATE_UINT8(socl
, LSIState
),
2179 VMSTATE_UINT8(sdid
, LSIState
),
2180 VMSTATE_UINT8(ssid
, LSIState
),
2181 VMSTATE_UINT8(sfbr
, LSIState
),
2182 VMSTATE_UINT8(stest1
, LSIState
),
2183 VMSTATE_UINT8(stest2
, LSIState
),
2184 VMSTATE_UINT8(stest3
, LSIState
),
2185 VMSTATE_UINT8(sidl
, LSIState
),
2186 VMSTATE_UINT8(stime0
, LSIState
),
2187 VMSTATE_UINT8(respid0
, LSIState
),
2188 VMSTATE_UINT8(respid1
, LSIState
),
2189 VMSTATE_UINT32(mmrs
, LSIState
),
2190 VMSTATE_UINT32(mmws
, LSIState
),
2191 VMSTATE_UINT32(sfs
, LSIState
),
2192 VMSTATE_UINT32(drs
, LSIState
),
2193 VMSTATE_UINT32(sbms
, LSIState
),
2194 VMSTATE_UINT32(dbms
, LSIState
),
2195 VMSTATE_UINT32(dnad64
, LSIState
),
2196 VMSTATE_UINT32(pmjad1
, LSIState
),
2197 VMSTATE_UINT32(pmjad2
, LSIState
),
2198 VMSTATE_UINT32(rbc
, LSIState
),
2199 VMSTATE_UINT32(ua
, LSIState
),
2200 VMSTATE_UINT32(ia
, LSIState
),
2201 VMSTATE_UINT32(sbc
, LSIState
),
2202 VMSTATE_UINT32(csbc
, LSIState
),
2203 VMSTATE_BUFFER_UNSAFE(scratch
, LSIState
, 0, 18 * sizeof(uint32_t)),
2204 VMSTATE_UINT8(sbr
, LSIState
),
2206 VMSTATE_BUFFER_UNSAFE(script_ram
, LSIState
, 0, 2048 * sizeof(uint32_t)),
2207 VMSTATE_END_OF_LIST()
2211 static int lsi_scsi_uninit(PCIDevice
*d
)
2213 LSIState
*s
= DO_UPCAST(LSIState
, dev
, d
);
2215 cpu_unregister_io_memory(s
->mmio_io_addr
);
2216 cpu_unregister_io_memory(s
->ram_io_addr
);
2221 static const struct SCSIBusOps lsi_scsi_ops
= {
2222 .complete
= lsi_command_complete
2225 static int lsi_scsi_init(PCIDevice
*dev
)
2227 LSIState
*s
= DO_UPCAST(LSIState
, dev
, dev
);
2230 pci_conf
= s
->dev
.config
;
2232 /* PCI Vendor ID (word) */
2233 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_LSI_LOGIC
);
2234 /* PCI device ID (word) */
2235 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_LSI_53C895A
);
2236 /* PCI base class code */
2237 pci_config_set_class(pci_conf
, PCI_CLASS_STORAGE_SCSI
);
2238 /* PCI subsystem ID */
2239 pci_conf
[PCI_SUBSYSTEM_ID
] = 0x00;
2240 pci_conf
[PCI_SUBSYSTEM_ID
+ 1] = 0x10;
2241 /* PCI latency timer = 255 */
2242 pci_conf
[PCI_LATENCY_TIMER
] = 0xff;
2243 /* TODO: RST# value should be 0 */
2244 /* Interrupt pin 1 */
2245 pci_conf
[PCI_INTERRUPT_PIN
] = 0x01;
2247 s
->mmio_io_addr
= cpu_register_io_memory(lsi_mmio_readfn
,
2248 lsi_mmio_writefn
, s
,
2249 DEVICE_NATIVE_ENDIAN
);
2250 s
->ram_io_addr
= cpu_register_io_memory(lsi_ram_readfn
,
2252 DEVICE_NATIVE_ENDIAN
);
2254 pci_register_bar(&s
->dev
, 0, 256,
2255 PCI_BASE_ADDRESS_SPACE_IO
, lsi_io_mapfunc
);
2256 pci_register_bar_simple(&s
->dev
, 1, 0x400, 0, s
->mmio_io_addr
);
2257 pci_register_bar(&s
->dev
, 2, 0x2000,
2258 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_ram_mapfunc
);
2259 QTAILQ_INIT(&s
->queue
);
2261 scsi_bus_new(&s
->bus
, &dev
->qdev
, 1, LSI_MAX_DEVS
, &lsi_scsi_ops
);
2262 if (!dev
->qdev
.hotplugged
) {
2263 return scsi_bus_legacy_handle_cmdline(&s
->bus
);
2268 static PCIDeviceInfo lsi_info
= {
2269 .qdev
.name
= "lsi53c895a",
2270 .qdev
.alias
= "lsi",
2271 .qdev
.size
= sizeof(LSIState
),
2272 .qdev
.reset
= lsi_scsi_reset
,
2273 .qdev
.vmsd
= &vmstate_lsi_scsi
,
2274 .init
= lsi_scsi_init
,
2275 .exit
= lsi_scsi_uninit
,
2278 static void lsi53c895a_register_devices(void)
2280 pci_qdev_register(&lsi_info
);
2283 device_init(lsi53c895a_register_devices
);