2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
18 #include "block_int.h"
21 //#define DEBUG_LSI_REG
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
34 #define LSI_MAX_DEVS 7
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
157 /* Enable Response to Reselection */
158 #define LSI_SCID_RRE 0x60
160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
170 /* Maximum length of MSG IN data. */
171 #define LSI_MAX_MSGIN_LEN 8
173 /* Flag set if this is a tagged command. */
174 #define LSI_TAG_VALID (1 << 16)
176 typedef struct lsi_request
{
183 QTAILQ_ENTRY(lsi_request
) next
;
190 uint32_t script_ram_base
;
192 int carry
; /* ??? Should this be an a visible register somewhere? */
194 /* Action to take at the end of a MSG IN phase.
195 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
198 uint8_t msg
[LSI_MAX_MSGIN_LEN
];
199 /* 0 if SCRIPTS are running or stopped.
200 * 1 if a Wait Reselect instruction has been issued.
201 * 2 if processing DMA from lsi_execute_script.
202 * 3 if a DMA operation is in progress. */
206 /* The tag is a combination of the device ID and the SCSI tag. */
208 int command_complete
;
209 QTAILQ_HEAD(, lsi_request
) queue
;
210 lsi_request
*current
;
271 uint32_t scratch
[18]; /* SCRATCHA-SCRATCHR */
274 /* Script ram is stored as 32-bit words in host byteorder. */
275 uint32_t script_ram
[2048];
278 static inline int lsi_irq_on_rsl(LSIState
*s
)
280 return (s
->sien0
& LSI_SIST0_RSL
) && (s
->scid
& LSI_SCID_RRE
);
283 static void lsi_soft_reset(LSIState
*s
)
297 memset(s
->scratch
, 0, sizeof(s
->scratch
));
301 s
->dstat
= LSI_DSTAT_DFE
;
310 s
->ctest2
= LSI_CTEST2_DACK
;
353 while (!QTAILQ_EMPTY(&s
->queue
)) {
354 p
= QTAILQ_FIRST(&s
->queue
);
355 QTAILQ_REMOVE(&s
->queue
, p
, next
);
359 qemu_free(s
->current
);
364 static int lsi_dma_40bit(LSIState
*s
)
366 if ((s
->ccntl1
& LSI_CCNTL1_40BIT
) == LSI_CCNTL1_40BIT
)
371 static int lsi_dma_ti64bit(LSIState
*s
)
373 if ((s
->ccntl1
& LSI_CCNTL1_EN64TIBMV
) == LSI_CCNTL1_EN64TIBMV
)
378 static int lsi_dma_64bit(LSIState
*s
)
380 if ((s
->ccntl1
& LSI_CCNTL1_EN64DBMV
) == LSI_CCNTL1_EN64DBMV
)
385 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
);
386 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
);
387 static void lsi_execute_script(LSIState
*s
);
388 static void lsi_reselect(LSIState
*s
, lsi_request
*p
);
390 static inline uint32_t read_dword(LSIState
*s
, uint32_t addr
)
394 /* Optimize reading from SCRIPTS RAM. */
395 if ((addr
& 0xffffe000) == s
->script_ram_base
) {
396 return s
->script_ram
[(addr
& 0x1fff) >> 2];
398 cpu_physical_memory_read(addr
, (uint8_t *)&buf
, 4);
399 return cpu_to_le32(buf
);
402 static void lsi_stop_script(LSIState
*s
)
404 s
->istat1
&= ~LSI_ISTAT1_SRUN
;
407 static void lsi_update_irq(LSIState
*s
)
410 static int last_level
;
413 /* It's unclear whether the DIP/SIP bits should be cleared when the
414 Interrupt Status Registers are cleared or when istat0 is read.
415 We currently do the formwer, which seems to work. */
418 if (s
->dstat
& s
->dien
)
420 s
->istat0
|= LSI_ISTAT0_DIP
;
422 s
->istat0
&= ~LSI_ISTAT0_DIP
;
425 if (s
->sist0
|| s
->sist1
) {
426 if ((s
->sist0
& s
->sien0
) || (s
->sist1
& s
->sien1
))
428 s
->istat0
|= LSI_ISTAT0_SIP
;
430 s
->istat0
&= ~LSI_ISTAT0_SIP
;
432 if (s
->istat0
& LSI_ISTAT0_INTF
)
435 if (level
!= last_level
) {
436 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
437 level
, s
->dstat
, s
->sist1
, s
->sist0
);
440 qemu_set_irq(s
->dev
.irq
[0], level
);
442 if (!level
&& lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
)) {
443 DPRINTF("Handled IRQs & disconnected, looking for pending "
445 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
454 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
455 static void lsi_script_scsi_interrupt(LSIState
*s
, int stat0
, int stat1
)
460 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
461 stat1
, stat0
, s
->sist1
, s
->sist0
);
464 /* Stop processor on fatal or unmasked interrupt. As a special hack
465 we don't stop processing when raising STO. Instead continue
466 execution and stop at the next insn that accesses the SCSI bus. */
467 mask0
= s
->sien0
| ~(LSI_SIST0_CMP
| LSI_SIST0_SEL
| LSI_SIST0_RSL
);
468 mask1
= s
->sien1
| ~(LSI_SIST1_GEN
| LSI_SIST1_HTH
);
469 mask1
&= ~LSI_SIST1_STO
;
470 if (s
->sist0
& mask0
|| s
->sist1
& mask1
) {
476 /* Stop SCRIPTS execution and raise a DMA interrupt. */
477 static void lsi_script_dma_interrupt(LSIState
*s
, int stat
)
479 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat
, s
->dstat
);
485 static inline void lsi_set_phase(LSIState
*s
, int phase
)
487 s
->sstat1
= (s
->sstat1
& ~PHASE_MASK
) | phase
;
490 static void lsi_bad_phase(LSIState
*s
, int out
, int new_phase
)
492 /* Trigger a phase mismatch. */
493 if (s
->ccntl0
& LSI_CCNTL0_ENPMJ
) {
494 if ((s
->ccntl0
& LSI_CCNTL0_PMJCTL
)) {
495 s
->dsp
= out
? s
->pmjad1
: s
->pmjad2
;
497 s
->dsp
= (s
->scntl2
& LSI_SCNTL2_WSR
? s
->pmjad2
: s
->pmjad1
);
499 DPRINTF("Data phase mismatch jump to %08x\n", s
->dsp
);
501 DPRINTF("Phase mismatch interrupt\n");
502 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
505 lsi_set_phase(s
, new_phase
);
509 /* Resume SCRIPTS execution after a DMA operation. */
510 static void lsi_resume_script(LSIState
*s
)
512 if (s
->waiting
!= 2) {
514 lsi_execute_script(s
);
520 static void lsi_disconnect(LSIState
*s
)
522 s
->scntl1
&= ~LSI_SCNTL1_CON
;
523 s
->sstat1
&= ~PHASE_MASK
;
526 static void lsi_bad_selection(LSIState
*s
, uint32_t id
)
528 DPRINTF("Selected absent target %d\n", id
);
529 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_STO
);
533 /* Initiate a SCSI layer data transfer. */
534 static void lsi_do_dma(LSIState
*s
, int out
)
537 target_phys_addr_t addr
;
541 if (!s
->current
->dma_len
) {
542 /* Wait until data is available. */
543 DPRINTF("DMA no data available\n");
547 id
= (s
->current
->tag
>> 8) & 0xf;
548 dev
= s
->bus
.devs
[id
];
550 lsi_bad_selection(s
, id
);
555 if (count
> s
->current
->dma_len
)
556 count
= s
->current
->dma_len
;
559 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
560 if (lsi_dma_40bit(s
) || lsi_dma_ti64bit(s
))
561 addr
|= ((uint64_t)s
->dnad64
<< 32);
563 addr
|= ((uint64_t)s
->dbms
<< 32);
565 addr
|= ((uint64_t)s
->sbms
<< 32);
567 DPRINTF("DMA addr=0x" TARGET_FMT_plx
" len=%d\n", addr
, count
);
571 if (s
->current
->dma_buf
== NULL
) {
572 s
->current
->dma_buf
= dev
->info
->get_buf(s
->current
->req
);
574 /* ??? Set SFBR to first data byte. */
576 cpu_physical_memory_read(addr
, s
->current
->dma_buf
, count
);
578 cpu_physical_memory_write(addr
, s
->current
->dma_buf
, count
);
580 s
->current
->dma_len
-= count
;
581 if (s
->current
->dma_len
== 0) {
582 s
->current
->dma_buf
= NULL
;
584 /* Write the data. */
585 dev
->info
->write_data(s
->current
->req
);
587 /* Request any remaining data. */
588 dev
->info
->read_data(s
->current
->req
);
591 s
->current
->dma_buf
+= count
;
592 lsi_resume_script(s
);
597 /* Add a command to the queue. */
598 static void lsi_queue_command(LSIState
*s
)
600 lsi_request
*p
= s
->current
;
602 DPRINTF("Queueing tag=0x%x\n", p
->tag
);
603 assert(s
->current
!= NULL
);
604 assert(s
->current
->dma_len
== 0);
605 QTAILQ_INSERT_TAIL(&s
->queue
, s
->current
, next
);
609 p
->out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
612 /* Queue a byte for a MSG IN phase. */
613 static void lsi_add_msg_byte(LSIState
*s
, uint8_t data
)
615 if (s
->msg_len
>= LSI_MAX_MSGIN_LEN
) {
616 BADF("MSG IN data too long\n");
618 DPRINTF("MSG IN 0x%02x\n", data
);
619 s
->msg
[s
->msg_len
++] = data
;
623 /* Perform reselection to continue a command. */
624 static void lsi_reselect(LSIState
*s
, lsi_request
*p
)
628 assert(s
->current
== NULL
);
629 QTAILQ_REMOVE(&s
->queue
, p
, next
);
632 id
= (p
->tag
>> 8) & 0xf;
634 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
635 if (!(s
->dcntl
& LSI_DCNTL_COM
)) {
636 s
->sfbr
= 1 << (id
& 0x7);
638 DPRINTF("Reselected target %d\n", id
);
639 s
->scntl1
|= LSI_SCNTL1_CON
;
640 lsi_set_phase(s
, PHASE_MI
);
641 s
->msg_action
= p
->out
? 2 : 3;
642 s
->current
->dma_len
= p
->pending
;
643 lsi_add_msg_byte(s
, 0x80);
644 if (s
->current
->tag
& LSI_TAG_VALID
) {
645 lsi_add_msg_byte(s
, 0x20);
646 lsi_add_msg_byte(s
, p
->tag
& 0xff);
649 if (lsi_irq_on_rsl(s
)) {
650 lsi_script_scsi_interrupt(s
, LSI_SIST0_RSL
, 0);
654 static lsi_request
*lsi_find_by_tag(LSIState
*s
, uint32_t tag
)
658 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
667 /* Record that data is available for a queued command. Returns zero if
668 the device was reselected, nonzero if the IO is deferred. */
669 static int lsi_queue_tag(LSIState
*s
, uint32_t tag
, uint32_t arg
)
673 p
= lsi_find_by_tag(s
, tag
);
675 BADF("IO with unknown tag %d\n", tag
);
680 BADF("Multiple IO pending for tag %d\n", tag
);
683 /* Reselect if waiting for it, or if reselection triggers an IRQ
685 Since no interrupt stacking is implemented in the emulation, it
686 is also required that there are no pending interrupts waiting
687 for service from the device driver. */
688 if (s
->waiting
== 1 ||
689 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
) &&
690 !(s
->istat0
& (LSI_ISTAT0_SIP
| LSI_ISTAT0_DIP
)))) {
691 /* Reselect device. */
695 DPRINTF("Queueing IO tag=0x%x\n", tag
);
700 /* Callback to indicate that the SCSI layer has completed a transfer. */
701 static void lsi_command_complete(SCSIRequest
*req
, int reason
, uint32_t arg
)
703 LSIState
*s
= DO_UPCAST(LSIState
, dev
.qdev
, req
->bus
->qbus
.parent
);
706 out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
707 if (reason
== SCSI_REASON_DONE
) {
708 DPRINTF("Command complete status=%d\n", (int)arg
);
710 s
->command_complete
= 2;
711 if (s
->waiting
&& s
->dbc
!= 0) {
712 /* Raise phase mismatch for short transfers. */
713 lsi_bad_phase(s
, out
, PHASE_ST
);
715 lsi_set_phase(s
, PHASE_ST
);
718 if (s
->current
&& req
== s
->current
->req
) {
719 scsi_req_unref(s
->current
->req
);
720 qemu_free(s
->current
);
723 lsi_resume_script(s
);
727 if (s
->waiting
== 1 || !s
->current
|| req
->tag
!= s
->current
->tag
||
728 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
))) {
729 if (lsi_queue_tag(s
, req
->tag
, arg
)) {
734 /* host adapter (re)connected */
735 DPRINTF("Data ready tag=0x%x len=%d\n", req
->tag
, arg
);
736 s
->current
->dma_len
= arg
;
737 s
->command_complete
= 1;
740 if (s
->waiting
== 1 || s
->dbc
== 0) {
741 lsi_resume_script(s
);
747 static void lsi_do_command(LSIState
*s
)
754 DPRINTF("Send command len=%d\n", s
->dbc
);
757 cpu_physical_memory_read(s
->dnad
, buf
, s
->dbc
);
759 s
->command_complete
= 0;
761 id
= (s
->select_tag
>> 8) & 0xf;
762 dev
= s
->bus
.devs
[id
];
764 lsi_bad_selection(s
, id
);
768 assert(s
->current
== NULL
);
769 s
->current
= qemu_mallocz(sizeof(lsi_request
));
770 s
->current
->tag
= s
->select_tag
;
771 s
->current
->req
= dev
->info
->alloc_req(dev
, s
->current
->tag
,
774 n
= dev
->info
->send_command(s
->current
->req
, buf
);
776 lsi_set_phase(s
, PHASE_DI
);
777 dev
->info
->read_data(s
->current
->req
);
779 lsi_set_phase(s
, PHASE_DO
);
780 dev
->info
->write_data(s
->current
->req
);
783 if (!s
->command_complete
) {
785 /* Command did not complete immediately so disconnect. */
786 lsi_add_msg_byte(s
, 2); /* SAVE DATA POINTER */
787 lsi_add_msg_byte(s
, 4); /* DISCONNECT */
789 lsi_set_phase(s
, PHASE_MI
);
791 lsi_queue_command(s
);
793 /* wait command complete */
794 lsi_set_phase(s
, PHASE_DI
);
799 static void lsi_do_status(LSIState
*s
)
802 DPRINTF("Get status len=%d status=%d\n", s
->dbc
, s
->status
);
804 BADF("Bad Status move\n");
808 cpu_physical_memory_write(s
->dnad
, &status
, 1);
809 lsi_set_phase(s
, PHASE_MI
);
811 lsi_add_msg_byte(s
, 0); /* COMMAND COMPLETE */
814 static void lsi_do_msgin(LSIState
*s
)
817 DPRINTF("Message in len=%d/%d\n", s
->dbc
, s
->msg_len
);
822 cpu_physical_memory_write(s
->dnad
, s
->msg
, len
);
823 /* Linux drivers rely on the last byte being in the SIDL. */
824 s
->sidl
= s
->msg
[len
- 1];
827 memmove(s
->msg
, s
->msg
+ len
, s
->msg_len
);
829 /* ??? Check if ATN (not yet implemented) is asserted and maybe
830 switch to PHASE_MO. */
831 switch (s
->msg_action
) {
833 lsi_set_phase(s
, PHASE_CMD
);
839 lsi_set_phase(s
, PHASE_DO
);
842 lsi_set_phase(s
, PHASE_DI
);
850 /* Read the next byte during a MSGOUT phase. */
851 static uint8_t lsi_get_msgbyte(LSIState
*s
)
854 cpu_physical_memory_read(s
->dnad
, &data
, 1);
860 /* Skip the next n bytes during a MSGOUT phase. */
861 static void lsi_skip_msgbytes(LSIState
*s
, unsigned int n
)
867 static void lsi_do_msgout(LSIState
*s
)
871 uint32_t current_tag
;
872 SCSIDevice
*current_dev
;
873 lsi_request
*current_req
, *p
, *p_next
;
877 current_tag
= s
->current
->tag
;
878 current_req
= s
->current
;
880 current_tag
= s
->select_tag
;
881 current_req
= lsi_find_by_tag(s
, current_tag
);
883 id
= (current_tag
>> 8) & 0xf;
884 current_dev
= s
->bus
.devs
[id
];
886 DPRINTF("MSG out len=%d\n", s
->dbc
);
888 msg
= lsi_get_msgbyte(s
);
893 DPRINTF("MSG: Disconnect\n");
897 DPRINTF("MSG: No Operation\n");
898 lsi_set_phase(s
, PHASE_CMD
);
901 len
= lsi_get_msgbyte(s
);
902 msg
= lsi_get_msgbyte(s
);
903 (void)len
; /* avoid a warning about unused variable*/
904 DPRINTF("Extended message 0x%x (len %d)\n", msg
, len
);
907 DPRINTF("SDTR (ignored)\n");
908 lsi_skip_msgbytes(s
, 2);
911 DPRINTF("WDTR (ignored)\n");
912 lsi_skip_msgbytes(s
, 1);
918 case 0x20: /* SIMPLE queue */
919 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
920 DPRINTF("SIMPLE queue tag=0x%x\n", s
->select_tag
& 0xff);
922 case 0x21: /* HEAD of queue */
923 BADF("HEAD queue not implemented\n");
924 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
926 case 0x22: /* ORDERED queue */
927 BADF("ORDERED queue not implemented\n");
928 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
931 /* The ABORT TAG message clears the current I/O process only. */
932 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag
);
934 current_dev
->info
->cancel_io(current_req
->req
);
941 /* The ABORT message clears all I/O processes for the selecting
942 initiator on the specified logical unit of the target. */
944 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag
);
946 /* The CLEAR QUEUE message clears all I/O processes for all
947 initiators on the specified logical unit of the target. */
949 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag
);
951 /* The BUS DEVICE RESET message clears all I/O processes for all
952 initiators on all logical units of the target. */
954 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag
);
957 /* clear the current I/O process */
959 current_dev
->info
->cancel_io(s
->current
->req
);
962 /* As the current implemented devices scsi_disk and scsi_generic
963 only support one LUN, we don't need to keep track of LUNs.
964 Clearing I/O processes for other initiators could be possible
965 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
966 device, but this is currently not implemented (and seems not
967 to be really necessary). So let's simply clear all queued
968 commands for the current device: */
969 id
= current_tag
& 0x0000ff00;
970 QTAILQ_FOREACH_SAFE(p
, &s
->queue
, next
, p_next
) {
971 if ((p
->tag
& 0x0000ff00) == id
) {
972 current_dev
->info
->cancel_io(p
->req
);
973 QTAILQ_REMOVE(&s
->queue
, p
, next
);
980 if ((msg
& 0x80) == 0) {
983 s
->current_lun
= msg
& 7;
984 DPRINTF("Select LUN %d\n", s
->current_lun
);
985 lsi_set_phase(s
, PHASE_CMD
);
991 BADF("Unimplemented message 0x%02x\n", msg
);
992 lsi_set_phase(s
, PHASE_MI
);
993 lsi_add_msg_byte(s
, 7); /* MESSAGE REJECT */
997 /* Sign extend a 24-bit value. */
998 static inline int32_t sxt24(int32_t n
)
1000 return (n
<< 8) >> 8;
1003 #define LSI_BUF_SIZE 4096
1004 static void lsi_memcpy(LSIState
*s
, uint32_t dest
, uint32_t src
, int count
)
1007 uint8_t buf
[LSI_BUF_SIZE
];
1009 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest
, src
, count
);
1011 n
= (count
> LSI_BUF_SIZE
) ? LSI_BUF_SIZE
: count
;
1012 cpu_physical_memory_read(src
, buf
, n
);
1013 cpu_physical_memory_write(dest
, buf
, n
);
1020 static void lsi_wait_reselect(LSIState
*s
)
1024 DPRINTF("Wait Reselect\n");
1026 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
1032 if (s
->current
== NULL
) {
1037 static void lsi_execute_script(LSIState
*s
)
1040 uint32_t addr
, addr_high
;
1042 int insn_processed
= 0;
1044 s
->istat1
|= LSI_ISTAT1_SRUN
;
1047 insn
= read_dword(s
, s
->dsp
);
1049 /* If we receive an empty opcode increment the DSP by 4 bytes
1050 instead of 8 and execute the next opcode at that location */
1054 addr
= read_dword(s
, s
->dsp
+ 4);
1056 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s
->dsp
, insn
, addr
);
1058 s
->dcmd
= insn
>> 24;
1060 switch (insn
>> 30) {
1061 case 0: /* Block move. */
1062 if (s
->sist1
& LSI_SIST1_STO
) {
1063 DPRINTF("Delayed select timeout\n");
1067 s
->dbc
= insn
& 0xffffff;
1071 if (insn
& (1 << 29)) {
1072 /* Indirect addressing. */
1073 addr
= read_dword(s
, addr
);
1074 } else if (insn
& (1 << 28)) {
1077 /* Table indirect addressing. */
1079 /* 32-bit Table indirect */
1080 offset
= sxt24(addr
);
1081 cpu_physical_memory_read(s
->dsa
+ offset
, (uint8_t *)buf
, 8);
1082 /* byte count is stored in bits 0:23 only */
1083 s
->dbc
= cpu_to_le32(buf
[0]) & 0xffffff;
1085 addr
= cpu_to_le32(buf
[1]);
1087 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1088 * table, bits [31:24] */
1089 if (lsi_dma_40bit(s
))
1090 addr_high
= cpu_to_le32(buf
[0]) >> 24;
1091 else if (lsi_dma_ti64bit(s
)) {
1092 int selector
= (cpu_to_le32(buf
[0]) >> 24) & 0x1f;
1095 /* offset index into scratch registers since
1096 * TI64 mode can use registers C to R */
1097 addr_high
= s
->scratch
[2 + selector
];
1100 addr_high
= s
->mmrs
;
1103 addr_high
= s
->mmws
;
1112 addr_high
= s
->sbms
;
1115 addr_high
= s
->dbms
;
1118 BADF("Illegal selector specified (0x%x > 0x15)"
1119 " for 64-bit DMA block move", selector
);
1123 } else if (lsi_dma_64bit(s
)) {
1124 /* fetch a 3rd dword if 64-bit direct move is enabled and
1125 only if we're not doing table indirect or indirect addressing */
1126 s
->dbms
= read_dword(s
, s
->dsp
);
1128 s
->ia
= s
->dsp
- 12;
1130 if ((s
->sstat1
& PHASE_MASK
) != ((insn
>> 24) & 7)) {
1131 DPRINTF("Wrong phase got %d expected %d\n",
1132 s
->sstat1
& PHASE_MASK
, (insn
>> 24) & 7);
1133 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
1137 s
->dnad64
= addr_high
;
1138 switch (s
->sstat1
& 0x7) {
1164 BADF("Unimplemented phase %d\n", s
->sstat1
& PHASE_MASK
);
1167 s
->dfifo
= s
->dbc
& 0xff;
1168 s
->ctest5
= (s
->ctest5
& 0xfc) | ((s
->dbc
>> 8) & 3);
1171 s
->ua
= addr
+ s
->dbc
;
1174 case 1: /* IO or Read/Write instruction. */
1175 opcode
= (insn
>> 27) & 7;
1179 if (insn
& (1 << 25)) {
1180 id
= read_dword(s
, s
->dsa
+ sxt24(insn
));
1184 id
= (id
>> 16) & 0xf;
1185 if (insn
& (1 << 26)) {
1186 addr
= s
->dsp
+ sxt24(addr
);
1190 case 0: /* Select */
1192 if (s
->scntl1
& LSI_SCNTL1_CON
) {
1193 DPRINTF("Already reselected, jumping to alternative address\n");
1197 s
->sstat0
|= LSI_SSTAT0_WOA
;
1198 s
->scntl1
&= ~LSI_SCNTL1_IARB
;
1199 if (id
>= LSI_MAX_DEVS
|| !s
->bus
.devs
[id
]) {
1200 lsi_bad_selection(s
, id
);
1203 DPRINTF("Selected target %d%s\n",
1204 id
, insn
& (1 << 3) ? " ATN" : "");
1205 /* ??? Linux drivers compain when this is set. Maybe
1206 it only applies in low-level mode (unimplemented).
1207 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1208 s
->select_tag
= id
<< 8;
1209 s
->scntl1
|= LSI_SCNTL1_CON
;
1210 if (insn
& (1 << 3)) {
1211 s
->socl
|= LSI_SOCL_ATN
;
1213 lsi_set_phase(s
, PHASE_MO
);
1215 case 1: /* Disconnect */
1216 DPRINTF("Wait Disconnect\n");
1217 s
->scntl1
&= ~LSI_SCNTL1_CON
;
1219 case 2: /* Wait Reselect */
1220 if (!lsi_irq_on_rsl(s
)) {
1221 lsi_wait_reselect(s
);
1225 DPRINTF("Set%s%s%s%s\n",
1226 insn
& (1 << 3) ? " ATN" : "",
1227 insn
& (1 << 6) ? " ACK" : "",
1228 insn
& (1 << 9) ? " TM" : "",
1229 insn
& (1 << 10) ? " CC" : "");
1230 if (insn
& (1 << 3)) {
1231 s
->socl
|= LSI_SOCL_ATN
;
1232 lsi_set_phase(s
, PHASE_MO
);
1234 if (insn
& (1 << 9)) {
1235 BADF("Target mode not implemented\n");
1238 if (insn
& (1 << 10))
1242 DPRINTF("Clear%s%s%s%s\n",
1243 insn
& (1 << 3) ? " ATN" : "",
1244 insn
& (1 << 6) ? " ACK" : "",
1245 insn
& (1 << 9) ? " TM" : "",
1246 insn
& (1 << 10) ? " CC" : "");
1247 if (insn
& (1 << 3)) {
1248 s
->socl
&= ~LSI_SOCL_ATN
;
1250 if (insn
& (1 << 10))
1261 static const char *opcode_names
[3] =
1262 {"Write", "Read", "Read-Modify-Write"};
1263 static const char *operator_names
[8] =
1264 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1267 reg
= ((insn
>> 16) & 0x7f) | (insn
& 0x80);
1268 data8
= (insn
>> 8) & 0xff;
1269 opcode
= (insn
>> 27) & 7;
1270 operator = (insn
>> 24) & 7;
1271 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1272 opcode_names
[opcode
- 5], reg
,
1273 operator_names
[operator], data8
, s
->sfbr
,
1274 (insn
& (1 << 23)) ? " SFBR" : "");
1277 case 5: /* From SFBR */
1281 case 6: /* To SFBR */
1283 op0
= lsi_reg_readb(s
, reg
);
1286 case 7: /* Read-modify-write */
1288 op0
= lsi_reg_readb(s
, reg
);
1289 if (insn
& (1 << 23)) {
1301 case 1: /* Shift left */
1303 op0
= (op0
<< 1) | s
->carry
;
1317 op0
= (op0
>> 1) | (s
->carry
<< 7);
1322 s
->carry
= op0
< op1
;
1325 op0
+= op1
+ s
->carry
;
1327 s
->carry
= op0
<= op1
;
1329 s
->carry
= op0
< op1
;
1334 case 5: /* From SFBR */
1335 case 7: /* Read-modify-write */
1336 lsi_reg_writeb(s
, reg
, op0
);
1338 case 6: /* To SFBR */
1345 case 2: /* Transfer Control. */
1350 if ((insn
& 0x002e0000) == 0) {
1354 if (s
->sist1
& LSI_SIST1_STO
) {
1355 DPRINTF("Delayed select timeout\n");
1359 cond
= jmp
= (insn
& (1 << 19)) != 0;
1360 if (cond
== jmp
&& (insn
& (1 << 21))) {
1361 DPRINTF("Compare carry %d\n", s
->carry
== jmp
);
1362 cond
= s
->carry
!= 0;
1364 if (cond
== jmp
&& (insn
& (1 << 17))) {
1365 DPRINTF("Compare phase %d %c= %d\n",
1366 (s
->sstat1
& PHASE_MASK
),
1368 ((insn
>> 24) & 7));
1369 cond
= (s
->sstat1
& PHASE_MASK
) == ((insn
>> 24) & 7);
1371 if (cond
== jmp
&& (insn
& (1 << 18))) {
1374 mask
= (~insn
>> 8) & 0xff;
1375 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1376 s
->sfbr
, mask
, jmp
? '=' : '!', insn
& mask
);
1377 cond
= (s
->sfbr
& mask
) == (insn
& mask
);
1380 if (insn
& (1 << 23)) {
1381 /* Relative address. */
1382 addr
= s
->dsp
+ sxt24(addr
);
1384 switch ((insn
>> 27) & 7) {
1386 DPRINTF("Jump to 0x%08x\n", addr
);
1390 DPRINTF("Call 0x%08x\n", addr
);
1394 case 2: /* Return */
1395 DPRINTF("Return to 0x%08x\n", s
->temp
);
1398 case 3: /* Interrupt */
1399 DPRINTF("Interrupt 0x%08x\n", s
->dsps
);
1400 if ((insn
& (1 << 20)) != 0) {
1401 s
->istat0
|= LSI_ISTAT0_INTF
;
1404 lsi_script_dma_interrupt(s
, LSI_DSTAT_SIR
);
1408 DPRINTF("Illegal transfer control\n");
1409 lsi_script_dma_interrupt(s
, LSI_DSTAT_IID
);
1413 DPRINTF("Control condition failed\n");
1419 if ((insn
& (1 << 29)) == 0) {
1422 /* ??? The docs imply the destination address is loaded into
1423 the TEMP register. However the Linux drivers rely on
1424 the value being presrved. */
1425 dest
= read_dword(s
, s
->dsp
);
1427 lsi_memcpy(s
, dest
, addr
, insn
& 0xffffff);
1434 if (insn
& (1 << 28)) {
1435 addr
= s
->dsa
+ sxt24(addr
);
1438 reg
= (insn
>> 16) & 0xff;
1439 if (insn
& (1 << 24)) {
1440 cpu_physical_memory_read(addr
, data
, n
);
1441 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg
, n
,
1442 addr
, *(int *)data
);
1443 for (i
= 0; i
< n
; i
++) {
1444 lsi_reg_writeb(s
, reg
+ i
, data
[i
]);
1447 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg
, n
, addr
);
1448 for (i
= 0; i
< n
; i
++) {
1449 data
[i
] = lsi_reg_readb(s
, reg
+ i
);
1451 cpu_physical_memory_write(addr
, data
, n
);
1455 if (insn_processed
> 10000 && !s
->waiting
) {
1456 /* Some windows drivers make the device spin waiting for a memory
1457 location to change. If we have been executed a lot of code then
1458 assume this is the case and force an unexpected device disconnect.
1459 This is apparently sufficient to beat the drivers into submission.
1461 if (!(s
->sien0
& LSI_SIST0_UDC
))
1462 fprintf(stderr
, "inf. loop with UDC masked\n");
1463 lsi_script_scsi_interrupt(s
, LSI_SIST0_UDC
, 0);
1465 } else if (s
->istat1
& LSI_ISTAT1_SRUN
&& !s
->waiting
) {
1466 if (s
->dcntl
& LSI_DCNTL_SSM
) {
1467 lsi_script_dma_interrupt(s
, LSI_DSTAT_SSI
);
1472 DPRINTF("SCRIPTS execution stopped\n");
1475 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
)
1478 #define CASE_GET_REG24(name, addr) \
1479 case addr: return s->name & 0xff; \
1480 case addr + 1: return (s->name >> 8) & 0xff; \
1481 case addr + 2: return (s->name >> 16) & 0xff;
1483 #define CASE_GET_REG32(name, addr) \
1484 case addr: return s->name & 0xff; \
1485 case addr + 1: return (s->name >> 8) & 0xff; \
1486 case addr + 2: return (s->name >> 16) & 0xff; \
1487 case addr + 3: return (s->name >> 24) & 0xff;
1489 #ifdef DEBUG_LSI_REG
1490 DPRINTF("Read reg %x\n", offset
);
1493 case 0x00: /* SCNTL0 */
1495 case 0x01: /* SCNTL1 */
1497 case 0x02: /* SCNTL2 */
1499 case 0x03: /* SCNTL3 */
1501 case 0x04: /* SCID */
1503 case 0x05: /* SXFER */
1505 case 0x06: /* SDID */
1507 case 0x07: /* GPREG0 */
1509 case 0x08: /* Revision ID */
1511 case 0xa: /* SSID */
1513 case 0xb: /* SBCL */
1514 /* ??? This is not correct. However it's (hopefully) only
1515 used for diagnostics, so should be ok. */
1517 case 0xc: /* DSTAT */
1518 tmp
= s
->dstat
| 0x80;
1519 if ((s
->istat0
& LSI_ISTAT0_INTF
) == 0)
1523 case 0x0d: /* SSTAT0 */
1525 case 0x0e: /* SSTAT1 */
1527 case 0x0f: /* SSTAT2 */
1528 return s
->scntl1
& LSI_SCNTL1_CON
? 0 : 2;
1529 CASE_GET_REG32(dsa
, 0x10)
1530 case 0x14: /* ISTAT0 */
1532 case 0x15: /* ISTAT1 */
1534 case 0x16: /* MBOX0 */
1536 case 0x17: /* MBOX1 */
1538 case 0x18: /* CTEST0 */
1540 case 0x19: /* CTEST1 */
1542 case 0x1a: /* CTEST2 */
1543 tmp
= s
->ctest2
| LSI_CTEST2_DACK
| LSI_CTEST2_CM
;
1544 if (s
->istat0
& LSI_ISTAT0_SIGP
) {
1545 s
->istat0
&= ~LSI_ISTAT0_SIGP
;
1546 tmp
|= LSI_CTEST2_SIGP
;
1549 case 0x1b: /* CTEST3 */
1551 CASE_GET_REG32(temp
, 0x1c)
1552 case 0x20: /* DFIFO */
1554 case 0x21: /* CTEST4 */
1556 case 0x22: /* CTEST5 */
1558 case 0x23: /* CTEST6 */
1560 CASE_GET_REG24(dbc
, 0x24)
1561 case 0x27: /* DCMD */
1563 CASE_GET_REG32(dnad
, 0x28)
1564 CASE_GET_REG32(dsp
, 0x2c)
1565 CASE_GET_REG32(dsps
, 0x30)
1566 CASE_GET_REG32(scratch
[0], 0x34)
1567 case 0x38: /* DMODE */
1569 case 0x39: /* DIEN */
1571 case 0x3a: /* SBR */
1573 case 0x3b: /* DCNTL */
1575 case 0x40: /* SIEN0 */
1577 case 0x41: /* SIEN1 */
1579 case 0x42: /* SIST0 */
1584 case 0x43: /* SIST1 */
1589 case 0x46: /* MACNTL */
1591 case 0x47: /* GPCNTL0 */
1593 case 0x48: /* STIME0 */
1595 case 0x4a: /* RESPID0 */
1597 case 0x4b: /* RESPID1 */
1599 case 0x4d: /* STEST1 */
1601 case 0x4e: /* STEST2 */
1603 case 0x4f: /* STEST3 */
1605 case 0x50: /* SIDL */
1606 /* This is needed by the linux drivers. We currently only update it
1607 during the MSG IN phase. */
1609 case 0x52: /* STEST4 */
1611 case 0x56: /* CCNTL0 */
1613 case 0x57: /* CCNTL1 */
1615 case 0x58: /* SBDL */
1616 /* Some drivers peek at the data bus during the MSG IN phase. */
1617 if ((s
->sstat1
& PHASE_MASK
) == PHASE_MI
)
1620 case 0x59: /* SBDL high */
1622 CASE_GET_REG32(mmrs
, 0xa0)
1623 CASE_GET_REG32(mmws
, 0xa4)
1624 CASE_GET_REG32(sfs
, 0xa8)
1625 CASE_GET_REG32(drs
, 0xac)
1626 CASE_GET_REG32(sbms
, 0xb0)
1627 CASE_GET_REG32(dbms
, 0xb4)
1628 CASE_GET_REG32(dnad64
, 0xb8)
1629 CASE_GET_REG32(pmjad1
, 0xc0)
1630 CASE_GET_REG32(pmjad2
, 0xc4)
1631 CASE_GET_REG32(rbc
, 0xc8)
1632 CASE_GET_REG32(ua
, 0xcc)
1633 CASE_GET_REG32(ia
, 0xd4)
1634 CASE_GET_REG32(sbc
, 0xd8)
1635 CASE_GET_REG32(csbc
, 0xdc)
1637 if (offset
>= 0x5c && offset
< 0xa0) {
1640 n
= (offset
- 0x58) >> 2;
1641 shift
= (offset
& 3) * 8;
1642 return (s
->scratch
[n
] >> shift
) & 0xff;
1644 BADF("readb 0x%x\n", offset
);
1646 #undef CASE_GET_REG24
1647 #undef CASE_GET_REG32
1650 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
)
1652 #define CASE_SET_REG24(name, addr) \
1653 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1654 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1655 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1657 #define CASE_SET_REG32(name, addr) \
1658 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1659 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1660 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1661 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1663 #ifdef DEBUG_LSI_REG
1664 DPRINTF("Write reg %x = %02x\n", offset
, val
);
1667 case 0x00: /* SCNTL0 */
1669 if (val
& LSI_SCNTL0_START
) {
1670 BADF("Start sequence not implemented\n");
1673 case 0x01: /* SCNTL1 */
1674 s
->scntl1
= val
& ~LSI_SCNTL1_SST
;
1675 if (val
& LSI_SCNTL1_IARB
) {
1676 BADF("Immediate Arbritration not implemented\n");
1678 if (val
& LSI_SCNTL1_RST
) {
1679 if (!(s
->sstat0
& LSI_SSTAT0_RST
)) {
1683 for (id
= 0; id
< s
->bus
.ndev
; id
++) {
1684 if (s
->bus
.devs
[id
]) {
1685 dev
= &s
->bus
.devs
[id
]->qdev
;
1686 dev
->info
->reset(dev
);
1689 s
->sstat0
|= LSI_SSTAT0_RST
;
1690 lsi_script_scsi_interrupt(s
, LSI_SIST0_RST
, 0);
1693 s
->sstat0
&= ~LSI_SSTAT0_RST
;
1696 case 0x02: /* SCNTL2 */
1697 val
&= ~(LSI_SCNTL2_WSR
| LSI_SCNTL2_WSS
);
1700 case 0x03: /* SCNTL3 */
1703 case 0x04: /* SCID */
1706 case 0x05: /* SXFER */
1709 case 0x06: /* SDID */
1710 if ((val
& 0xf) != (s
->ssid
& 0xf))
1711 BADF("Destination ID does not match SSID\n");
1712 s
->sdid
= val
& 0xf;
1714 case 0x07: /* GPREG0 */
1716 case 0x08: /* SFBR */
1717 /* The CPU is not allowed to write to this register. However the
1718 SCRIPTS register move instructions are. */
1721 case 0x0a: case 0x0b:
1722 /* Openserver writes to these readonly registers on startup */
1724 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1725 /* Linux writes to these readonly registers on startup. */
1727 CASE_SET_REG32(dsa
, 0x10)
1728 case 0x14: /* ISTAT0 */
1729 s
->istat0
= (s
->istat0
& 0x0f) | (val
& 0xf0);
1730 if (val
& LSI_ISTAT0_ABRT
) {
1731 lsi_script_dma_interrupt(s
, LSI_DSTAT_ABRT
);
1733 if (val
& LSI_ISTAT0_INTF
) {
1734 s
->istat0
&= ~LSI_ISTAT0_INTF
;
1737 if (s
->waiting
== 1 && val
& LSI_ISTAT0_SIGP
) {
1738 DPRINTF("Woken by SIGP\n");
1741 lsi_execute_script(s
);
1743 if (val
& LSI_ISTAT0_SRST
) {
1747 case 0x16: /* MBOX0 */
1750 case 0x17: /* MBOX1 */
1753 case 0x1a: /* CTEST2 */
1754 s
->ctest2
= val
& LSI_CTEST2_PCICIE
;
1756 case 0x1b: /* CTEST3 */
1757 s
->ctest3
= val
& 0x0f;
1759 CASE_SET_REG32(temp
, 0x1c)
1760 case 0x21: /* CTEST4 */
1762 BADF("Unimplemented CTEST4-FBL 0x%x\n", val
);
1766 case 0x22: /* CTEST5 */
1767 if (val
& (LSI_CTEST5_ADCK
| LSI_CTEST5_BBCK
)) {
1768 BADF("CTEST5 DMA increment not implemented\n");
1772 CASE_SET_REG24(dbc
, 0x24)
1773 CASE_SET_REG32(dnad
, 0x28)
1774 case 0x2c: /* DSP[0:7] */
1775 s
->dsp
&= 0xffffff00;
1778 case 0x2d: /* DSP[8:15] */
1779 s
->dsp
&= 0xffff00ff;
1782 case 0x2e: /* DSP[16:23] */
1783 s
->dsp
&= 0xff00ffff;
1784 s
->dsp
|= val
<< 16;
1786 case 0x2f: /* DSP[24:31] */
1787 s
->dsp
&= 0x00ffffff;
1788 s
->dsp
|= val
<< 24;
1789 if ((s
->dmode
& LSI_DMODE_MAN
) == 0
1790 && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1791 lsi_execute_script(s
);
1793 CASE_SET_REG32(dsps
, 0x30)
1794 CASE_SET_REG32(scratch
[0], 0x34)
1795 case 0x38: /* DMODE */
1796 if (val
& (LSI_DMODE_SIOM
| LSI_DMODE_DIOM
)) {
1797 BADF("IO mappings not implemented\n");
1801 case 0x39: /* DIEN */
1805 case 0x3a: /* SBR */
1808 case 0x3b: /* DCNTL */
1809 s
->dcntl
= val
& ~(LSI_DCNTL_PFF
| LSI_DCNTL_STD
);
1810 if ((val
& LSI_DCNTL_STD
) && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1811 lsi_execute_script(s
);
1813 case 0x40: /* SIEN0 */
1817 case 0x41: /* SIEN1 */
1821 case 0x47: /* GPCNTL0 */
1823 case 0x48: /* STIME0 */
1826 case 0x49: /* STIME1 */
1828 DPRINTF("General purpose timer not implemented\n");
1829 /* ??? Raising the interrupt immediately seems to be sufficient
1830 to keep the FreeBSD driver happy. */
1831 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_GEN
);
1834 case 0x4a: /* RESPID0 */
1837 case 0x4b: /* RESPID1 */
1840 case 0x4d: /* STEST1 */
1843 case 0x4e: /* STEST2 */
1845 BADF("Low level mode not implemented\n");
1849 case 0x4f: /* STEST3 */
1851 BADF("SCSI FIFO test mode not implemented\n");
1855 case 0x56: /* CCNTL0 */
1858 case 0x57: /* CCNTL1 */
1861 CASE_SET_REG32(mmrs
, 0xa0)
1862 CASE_SET_REG32(mmws
, 0xa4)
1863 CASE_SET_REG32(sfs
, 0xa8)
1864 CASE_SET_REG32(drs
, 0xac)
1865 CASE_SET_REG32(sbms
, 0xb0)
1866 CASE_SET_REG32(dbms
, 0xb4)
1867 CASE_SET_REG32(dnad64
, 0xb8)
1868 CASE_SET_REG32(pmjad1
, 0xc0)
1869 CASE_SET_REG32(pmjad2
, 0xc4)
1870 CASE_SET_REG32(rbc
, 0xc8)
1871 CASE_SET_REG32(ua
, 0xcc)
1872 CASE_SET_REG32(ia
, 0xd4)
1873 CASE_SET_REG32(sbc
, 0xd8)
1874 CASE_SET_REG32(csbc
, 0xdc)
1876 if (offset
>= 0x5c && offset
< 0xa0) {
1879 n
= (offset
- 0x58) >> 2;
1880 shift
= (offset
& 3) * 8;
1881 s
->scratch
[n
] &= ~(0xff << shift
);
1882 s
->scratch
[n
] |= (val
& 0xff) << shift
;
1884 BADF("Unhandled writeb 0x%x = 0x%x\n", offset
, val
);
1887 #undef CASE_SET_REG24
1888 #undef CASE_SET_REG32
1891 static void lsi_mmio_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1893 LSIState
*s
= opaque
;
1895 lsi_reg_writeb(s
, addr
& 0xff, val
);
1898 static void lsi_mmio_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1900 LSIState
*s
= opaque
;
1903 lsi_reg_writeb(s
, addr
, val
& 0xff);
1904 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1907 static void lsi_mmio_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1909 LSIState
*s
= opaque
;
1912 lsi_reg_writeb(s
, addr
, val
& 0xff);
1913 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1914 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1915 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1918 static uint32_t lsi_mmio_readb(void *opaque
, target_phys_addr_t addr
)
1920 LSIState
*s
= opaque
;
1922 return lsi_reg_readb(s
, addr
& 0xff);
1925 static uint32_t lsi_mmio_readw(void *opaque
, target_phys_addr_t addr
)
1927 LSIState
*s
= opaque
;
1931 val
= lsi_reg_readb(s
, addr
);
1932 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1936 static uint32_t lsi_mmio_readl(void *opaque
, target_phys_addr_t addr
)
1938 LSIState
*s
= opaque
;
1941 val
= lsi_reg_readb(s
, addr
);
1942 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1943 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1944 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1948 static CPUReadMemoryFunc
* const lsi_mmio_readfn
[3] = {
1954 static CPUWriteMemoryFunc
* const lsi_mmio_writefn
[3] = {
1960 static void lsi_ram_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1962 LSIState
*s
= opaque
;
1967 newval
= s
->script_ram
[addr
>> 2];
1968 shift
= (addr
& 3) * 8;
1969 newval
&= ~(0xff << shift
);
1970 newval
|= val
<< shift
;
1971 s
->script_ram
[addr
>> 2] = newval
;
1974 static void lsi_ram_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1976 LSIState
*s
= opaque
;
1980 newval
= s
->script_ram
[addr
>> 2];
1982 newval
= (newval
& 0xffff) | (val
<< 16);
1984 newval
= (newval
& 0xffff0000) | val
;
1986 s
->script_ram
[addr
>> 2] = newval
;
1990 static void lsi_ram_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1992 LSIState
*s
= opaque
;
1995 s
->script_ram
[addr
>> 2] = val
;
1998 static uint32_t lsi_ram_readb(void *opaque
, target_phys_addr_t addr
)
2000 LSIState
*s
= opaque
;
2004 val
= s
->script_ram
[addr
>> 2];
2005 val
>>= (addr
& 3) * 8;
2009 static uint32_t lsi_ram_readw(void *opaque
, target_phys_addr_t addr
)
2011 LSIState
*s
= opaque
;
2015 val
= s
->script_ram
[addr
>> 2];
2021 static uint32_t lsi_ram_readl(void *opaque
, target_phys_addr_t addr
)
2023 LSIState
*s
= opaque
;
2026 return s
->script_ram
[addr
>> 2];
2029 static CPUReadMemoryFunc
* const lsi_ram_readfn
[3] = {
2035 static CPUWriteMemoryFunc
* const lsi_ram_writefn
[3] = {
2041 static uint32_t lsi_io_readb(void *opaque
, uint32_t addr
)
2043 LSIState
*s
= opaque
;
2044 return lsi_reg_readb(s
, addr
& 0xff);
2047 static uint32_t lsi_io_readw(void *opaque
, uint32_t addr
)
2049 LSIState
*s
= opaque
;
2052 val
= lsi_reg_readb(s
, addr
);
2053 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
2057 static uint32_t lsi_io_readl(void *opaque
, uint32_t addr
)
2059 LSIState
*s
= opaque
;
2062 val
= lsi_reg_readb(s
, addr
);
2063 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
2064 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
2065 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
2069 static void lsi_io_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
2071 LSIState
*s
= opaque
;
2072 lsi_reg_writeb(s
, addr
& 0xff, val
);
2075 static void lsi_io_writew(void *opaque
, uint32_t addr
, uint32_t val
)
2077 LSIState
*s
= opaque
;
2079 lsi_reg_writeb(s
, addr
, val
& 0xff);
2080 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
2083 static void lsi_io_writel(void *opaque
, uint32_t addr
, uint32_t val
)
2085 LSIState
*s
= opaque
;
2087 lsi_reg_writeb(s
, addr
, val
& 0xff);
2088 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
2089 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
2090 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
2093 static void lsi_io_mapfunc(PCIDevice
*pci_dev
, int region_num
,
2094 pcibus_t addr
, pcibus_t size
, int type
)
2096 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
2098 DPRINTF("Mapping IO at %08"FMT_PCIBUS
"\n", addr
);
2100 register_ioport_write(addr
, 256, 1, lsi_io_writeb
, s
);
2101 register_ioport_read(addr
, 256, 1, lsi_io_readb
, s
);
2102 register_ioport_write(addr
, 256, 2, lsi_io_writew
, s
);
2103 register_ioport_read(addr
, 256, 2, lsi_io_readw
, s
);
2104 register_ioport_write(addr
, 256, 4, lsi_io_writel
, s
);
2105 register_ioport_read(addr
, 256, 4, lsi_io_readl
, s
);
2108 static void lsi_ram_mapfunc(PCIDevice
*pci_dev
, int region_num
,
2109 pcibus_t addr
, pcibus_t size
, int type
)
2111 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
2113 DPRINTF("Mapping ram at %08"FMT_PCIBUS
"\n", addr
);
2114 s
->script_ram_base
= addr
;
2115 cpu_register_physical_memory(addr
+ 0, 0x2000, s
->ram_io_addr
);
2118 static void lsi_scsi_reset(DeviceState
*dev
)
2120 LSIState
*s
= DO_UPCAST(LSIState
, dev
.qdev
, dev
);
2125 static void lsi_pre_save(void *opaque
)
2127 LSIState
*s
= opaque
;
2130 assert(s
->current
->dma_buf
== NULL
);
2131 assert(s
->current
->dma_len
== 0);
2133 assert(QTAILQ_EMPTY(&s
->queue
));
2136 static const VMStateDescription vmstate_lsi_scsi
= {
2139 .minimum_version_id
= 0,
2140 .minimum_version_id_old
= 0,
2141 .pre_save
= lsi_pre_save
,
2142 .fields
= (VMStateField
[]) {
2143 VMSTATE_PCI_DEVICE(dev
, LSIState
),
2145 VMSTATE_INT32(carry
, LSIState
),
2146 VMSTATE_INT32(status
, LSIState
),
2147 VMSTATE_INT32(msg_action
, LSIState
),
2148 VMSTATE_INT32(msg_len
, LSIState
),
2149 VMSTATE_BUFFER(msg
, LSIState
),
2150 VMSTATE_INT32(waiting
, LSIState
),
2152 VMSTATE_UINT32(dsa
, LSIState
),
2153 VMSTATE_UINT32(temp
, LSIState
),
2154 VMSTATE_UINT32(dnad
, LSIState
),
2155 VMSTATE_UINT32(dbc
, LSIState
),
2156 VMSTATE_UINT8(istat0
, LSIState
),
2157 VMSTATE_UINT8(istat1
, LSIState
),
2158 VMSTATE_UINT8(dcmd
, LSIState
),
2159 VMSTATE_UINT8(dstat
, LSIState
),
2160 VMSTATE_UINT8(dien
, LSIState
),
2161 VMSTATE_UINT8(sist0
, LSIState
),
2162 VMSTATE_UINT8(sist1
, LSIState
),
2163 VMSTATE_UINT8(sien0
, LSIState
),
2164 VMSTATE_UINT8(sien1
, LSIState
),
2165 VMSTATE_UINT8(mbox0
, LSIState
),
2166 VMSTATE_UINT8(mbox1
, LSIState
),
2167 VMSTATE_UINT8(dfifo
, LSIState
),
2168 VMSTATE_UINT8(ctest2
, LSIState
),
2169 VMSTATE_UINT8(ctest3
, LSIState
),
2170 VMSTATE_UINT8(ctest4
, LSIState
),
2171 VMSTATE_UINT8(ctest5
, LSIState
),
2172 VMSTATE_UINT8(ccntl0
, LSIState
),
2173 VMSTATE_UINT8(ccntl1
, LSIState
),
2174 VMSTATE_UINT32(dsp
, LSIState
),
2175 VMSTATE_UINT32(dsps
, LSIState
),
2176 VMSTATE_UINT8(dmode
, LSIState
),
2177 VMSTATE_UINT8(dcntl
, LSIState
),
2178 VMSTATE_UINT8(scntl0
, LSIState
),
2179 VMSTATE_UINT8(scntl1
, LSIState
),
2180 VMSTATE_UINT8(scntl2
, LSIState
),
2181 VMSTATE_UINT8(scntl3
, LSIState
),
2182 VMSTATE_UINT8(sstat0
, LSIState
),
2183 VMSTATE_UINT8(sstat1
, LSIState
),
2184 VMSTATE_UINT8(scid
, LSIState
),
2185 VMSTATE_UINT8(sxfer
, LSIState
),
2186 VMSTATE_UINT8(socl
, LSIState
),
2187 VMSTATE_UINT8(sdid
, LSIState
),
2188 VMSTATE_UINT8(ssid
, LSIState
),
2189 VMSTATE_UINT8(sfbr
, LSIState
),
2190 VMSTATE_UINT8(stest1
, LSIState
),
2191 VMSTATE_UINT8(stest2
, LSIState
),
2192 VMSTATE_UINT8(stest3
, LSIState
),
2193 VMSTATE_UINT8(sidl
, LSIState
),
2194 VMSTATE_UINT8(stime0
, LSIState
),
2195 VMSTATE_UINT8(respid0
, LSIState
),
2196 VMSTATE_UINT8(respid1
, LSIState
),
2197 VMSTATE_UINT32(mmrs
, LSIState
),
2198 VMSTATE_UINT32(mmws
, LSIState
),
2199 VMSTATE_UINT32(sfs
, LSIState
),
2200 VMSTATE_UINT32(drs
, LSIState
),
2201 VMSTATE_UINT32(sbms
, LSIState
),
2202 VMSTATE_UINT32(dbms
, LSIState
),
2203 VMSTATE_UINT32(dnad64
, LSIState
),
2204 VMSTATE_UINT32(pmjad1
, LSIState
),
2205 VMSTATE_UINT32(pmjad2
, LSIState
),
2206 VMSTATE_UINT32(rbc
, LSIState
),
2207 VMSTATE_UINT32(ua
, LSIState
),
2208 VMSTATE_UINT32(ia
, LSIState
),
2209 VMSTATE_UINT32(sbc
, LSIState
),
2210 VMSTATE_UINT32(csbc
, LSIState
),
2211 VMSTATE_BUFFER_UNSAFE(scratch
, LSIState
, 0, 18 * sizeof(uint32_t)),
2212 VMSTATE_UINT8(sbr
, LSIState
),
2214 VMSTATE_BUFFER_UNSAFE(script_ram
, LSIState
, 0, 2048 * sizeof(uint32_t)),
2215 VMSTATE_END_OF_LIST()
2219 static int lsi_scsi_uninit(PCIDevice
*d
)
2221 LSIState
*s
= DO_UPCAST(LSIState
, dev
, d
);
2223 cpu_unregister_io_memory(s
->mmio_io_addr
);
2224 cpu_unregister_io_memory(s
->ram_io_addr
);
2229 static const struct SCSIBusOps lsi_scsi_ops
= {
2230 .complete
= lsi_command_complete
2233 static int lsi_scsi_init(PCIDevice
*dev
)
2235 LSIState
*s
= DO_UPCAST(LSIState
, dev
, dev
);
2238 pci_conf
= s
->dev
.config
;
2240 /* PCI Vendor ID (word) */
2241 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_LSI_LOGIC
);
2242 /* PCI device ID (word) */
2243 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_LSI_53C895A
);
2244 /* PCI base class code */
2245 pci_config_set_class(pci_conf
, PCI_CLASS_STORAGE_SCSI
);
2246 /* PCI subsystem ID */
2247 pci_conf
[PCI_SUBSYSTEM_ID
] = 0x00;
2248 pci_conf
[PCI_SUBSYSTEM_ID
+ 1] = 0x10;
2249 /* PCI latency timer = 255 */
2250 pci_conf
[PCI_LATENCY_TIMER
] = 0xff;
2251 /* TODO: RST# value should be 0 */
2252 /* Interrupt pin 1 */
2253 pci_conf
[PCI_INTERRUPT_PIN
] = 0x01;
2255 s
->mmio_io_addr
= cpu_register_io_memory(lsi_mmio_readfn
,
2256 lsi_mmio_writefn
, s
,
2257 DEVICE_NATIVE_ENDIAN
);
2258 s
->ram_io_addr
= cpu_register_io_memory(lsi_ram_readfn
,
2260 DEVICE_NATIVE_ENDIAN
);
2262 pci_register_bar(&s
->dev
, 0, 256,
2263 PCI_BASE_ADDRESS_SPACE_IO
, lsi_io_mapfunc
);
2264 pci_register_bar_simple(&s
->dev
, 1, 0x400, 0, s
->mmio_io_addr
);
2265 pci_register_bar(&s
->dev
, 2, 0x2000,
2266 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_ram_mapfunc
);
2267 QTAILQ_INIT(&s
->queue
);
2269 scsi_bus_new(&s
->bus
, &dev
->qdev
, 1, LSI_MAX_DEVS
, &lsi_scsi_ops
);
2270 if (!dev
->qdev
.hotplugged
) {
2271 return scsi_bus_legacy_handle_cmdline(&s
->bus
);
2276 static PCIDeviceInfo lsi_info
= {
2277 .qdev
.name
= "lsi53c895a",
2278 .qdev
.alias
= "lsi",
2279 .qdev
.size
= sizeof(LSIState
),
2280 .qdev
.reset
= lsi_scsi_reset
,
2281 .qdev
.vmsd
= &vmstate_lsi_scsi
,
2282 .init
= lsi_scsi_init
,
2283 .exit
= lsi_scsi_uninit
,
2286 static void lsi53c895a_register_devices(void)
2288 pci_qdev_register(&lsi_info
);
2291 device_init(lsi53c895a_register_devices
);