2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
18 #include "block_int.h"
21 //#define DEBUG_LSI_REG
24 #define DPRINTF(fmt, ...) \
25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
26 #define BADF(fmt, ...) \
27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
29 #define DPRINTF(fmt, ...) do {} while(0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
34 #define LSI_MAX_DEVS 7
36 #define LSI_SCNTL0_TRG 0x01
37 #define LSI_SCNTL0_AAP 0x02
38 #define LSI_SCNTL0_EPC 0x08
39 #define LSI_SCNTL0_WATN 0x10
40 #define LSI_SCNTL0_START 0x20
42 #define LSI_SCNTL1_SST 0x01
43 #define LSI_SCNTL1_IARB 0x02
44 #define LSI_SCNTL1_AESP 0x04
45 #define LSI_SCNTL1_RST 0x08
46 #define LSI_SCNTL1_CON 0x10
47 #define LSI_SCNTL1_DHP 0x20
48 #define LSI_SCNTL1_ADB 0x40
49 #define LSI_SCNTL1_EXC 0x80
51 #define LSI_SCNTL2_WSR 0x01
52 #define LSI_SCNTL2_VUE0 0x02
53 #define LSI_SCNTL2_VUE1 0x04
54 #define LSI_SCNTL2_WSS 0x08
55 #define LSI_SCNTL2_SLPHBEN 0x10
56 #define LSI_SCNTL2_SLPMD 0x20
57 #define LSI_SCNTL2_CHM 0x40
58 #define LSI_SCNTL2_SDU 0x80
60 #define LSI_ISTAT0_DIP 0x01
61 #define LSI_ISTAT0_SIP 0x02
62 #define LSI_ISTAT0_INTF 0x04
63 #define LSI_ISTAT0_CON 0x08
64 #define LSI_ISTAT0_SEM 0x10
65 #define LSI_ISTAT0_SIGP 0x20
66 #define LSI_ISTAT0_SRST 0x40
67 #define LSI_ISTAT0_ABRT 0x80
69 #define LSI_ISTAT1_SI 0x01
70 #define LSI_ISTAT1_SRUN 0x02
71 #define LSI_ISTAT1_FLSH 0x04
73 #define LSI_SSTAT0_SDP0 0x01
74 #define LSI_SSTAT0_RST 0x02
75 #define LSI_SSTAT0_WOA 0x04
76 #define LSI_SSTAT0_LOA 0x08
77 #define LSI_SSTAT0_AIP 0x10
78 #define LSI_SSTAT0_OLF 0x20
79 #define LSI_SSTAT0_ORF 0x40
80 #define LSI_SSTAT0_ILF 0x80
82 #define LSI_SIST0_PAR 0x01
83 #define LSI_SIST0_RST 0x02
84 #define LSI_SIST0_UDC 0x04
85 #define LSI_SIST0_SGE 0x08
86 #define LSI_SIST0_RSL 0x10
87 #define LSI_SIST0_SEL 0x20
88 #define LSI_SIST0_CMP 0x40
89 #define LSI_SIST0_MA 0x80
91 #define LSI_SIST1_HTH 0x01
92 #define LSI_SIST1_GEN 0x02
93 #define LSI_SIST1_STO 0x04
94 #define LSI_SIST1_SBMC 0x10
96 #define LSI_SOCL_IO 0x01
97 #define LSI_SOCL_CD 0x02
98 #define LSI_SOCL_MSG 0x04
99 #define LSI_SOCL_ATN 0x08
100 #define LSI_SOCL_SEL 0x10
101 #define LSI_SOCL_BSY 0x20
102 #define LSI_SOCL_ACK 0x40
103 #define LSI_SOCL_REQ 0x80
105 #define LSI_DSTAT_IID 0x01
106 #define LSI_DSTAT_SIR 0x04
107 #define LSI_DSTAT_SSI 0x08
108 #define LSI_DSTAT_ABRT 0x10
109 #define LSI_DSTAT_BF 0x20
110 #define LSI_DSTAT_MDPE 0x40
111 #define LSI_DSTAT_DFE 0x80
113 #define LSI_DCNTL_COM 0x01
114 #define LSI_DCNTL_IRQD 0x02
115 #define LSI_DCNTL_STD 0x04
116 #define LSI_DCNTL_IRQM 0x08
117 #define LSI_DCNTL_SSM 0x10
118 #define LSI_DCNTL_PFEN 0x20
119 #define LSI_DCNTL_PFF 0x40
120 #define LSI_DCNTL_CLSE 0x80
122 #define LSI_DMODE_MAN 0x01
123 #define LSI_DMODE_BOF 0x02
124 #define LSI_DMODE_ERMP 0x04
125 #define LSI_DMODE_ERL 0x08
126 #define LSI_DMODE_DIOM 0x10
127 #define LSI_DMODE_SIOM 0x20
129 #define LSI_CTEST2_DACK 0x01
130 #define LSI_CTEST2_DREQ 0x02
131 #define LSI_CTEST2_TEOP 0x04
132 #define LSI_CTEST2_PCICIE 0x08
133 #define LSI_CTEST2_CM 0x10
134 #define LSI_CTEST2_CIO 0x20
135 #define LSI_CTEST2_SIGP 0x40
136 #define LSI_CTEST2_DDIR 0x80
138 #define LSI_CTEST5_BL2 0x04
139 #define LSI_CTEST5_DDIR 0x08
140 #define LSI_CTEST5_MASR 0x10
141 #define LSI_CTEST5_DFSN 0x20
142 #define LSI_CTEST5_BBCK 0x40
143 #define LSI_CTEST5_ADCK 0x80
145 #define LSI_CCNTL0_DILS 0x01
146 #define LSI_CCNTL0_DISFC 0x10
147 #define LSI_CCNTL0_ENNDJ 0x20
148 #define LSI_CCNTL0_PMJCTL 0x40
149 #define LSI_CCNTL0_ENPMJ 0x80
151 #define LSI_CCNTL1_EN64DBMV 0x01
152 #define LSI_CCNTL1_EN64TIBMV 0x02
153 #define LSI_CCNTL1_64TIMOD 0x04
154 #define LSI_CCNTL1_DDAC 0x08
155 #define LSI_CCNTL1_ZMOD 0x80
157 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
167 /* Maximum length of MSG IN data. */
168 #define LSI_MAX_MSGIN_LEN 8
170 /* Flag set if this is a tagged command. */
171 #define LSI_TAG_VALID (1 << 16)
183 uint32_t script_ram_base
;
185 int carry
; /* ??? Should this be an a visible register somewhere? */
187 /* Action to take at the end of a MSG IN phase.
188 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
191 uint8_t msg
[LSI_MAX_MSGIN_LEN
];
192 /* 0 if SCRIPTS are running or stopped.
193 * 1 if a Wait Reselect instruction has been issued.
194 * 2 if processing DMA from lsi_execute_script.
195 * 3 if a DMA operation is in progress. */
198 SCSIDevice
*current_dev
;
200 /* The tag is a combination of the device ID and the SCSI tag. */
201 uint32_t current_tag
;
202 uint32_t current_dma_len
;
203 int command_complete
;
268 uint32_t scratch
[18]; /* SCRATCHA-SCRATCHR */
271 /* Script ram is stored as 32-bit words in host byteorder. */
272 uint32_t script_ram
[2048];
275 static void lsi_soft_reset(LSIState
*s
)
285 memset(s
->scratch
, 0, sizeof(s
->scratch
));
341 static int lsi_dma_40bit(LSIState
*s
)
343 if ((s
->ccntl1
& LSI_CCNTL1_40BIT
) == LSI_CCNTL1_40BIT
)
348 static int lsi_dma_ti64bit(LSIState
*s
)
350 if ((s
->ccntl1
& LSI_CCNTL1_EN64TIBMV
) == LSI_CCNTL1_EN64TIBMV
)
355 static int lsi_dma_64bit(LSIState
*s
)
357 if ((s
->ccntl1
& LSI_CCNTL1_EN64DBMV
) == LSI_CCNTL1_EN64DBMV
)
362 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
);
363 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
);
364 static void lsi_execute_script(LSIState
*s
);
366 static inline uint32_t read_dword(LSIState
*s
, uint32_t addr
)
370 /* Optimize reading from SCRIPTS RAM. */
371 if ((addr
& 0xffffe000) == s
->script_ram_base
) {
372 return s
->script_ram
[(addr
& 0x1fff) >> 2];
374 cpu_physical_memory_read(addr
, (uint8_t *)&buf
, 4);
375 return cpu_to_le32(buf
);
378 static void lsi_stop_script(LSIState
*s
)
380 s
->istat1
&= ~LSI_ISTAT1_SRUN
;
383 static void lsi_update_irq(LSIState
*s
)
386 static int last_level
;
388 /* It's unclear whether the DIP/SIP bits should be cleared when the
389 Interrupt Status Registers are cleared or when istat0 is read.
390 We currently do the formwer, which seems to work. */
393 if (s
->dstat
& s
->dien
)
395 s
->istat0
|= LSI_ISTAT0_DIP
;
397 s
->istat0
&= ~LSI_ISTAT0_DIP
;
400 if (s
->sist0
|| s
->sist1
) {
401 if ((s
->sist0
& s
->sien0
) || (s
->sist1
& s
->sien1
))
403 s
->istat0
|= LSI_ISTAT0_SIP
;
405 s
->istat0
&= ~LSI_ISTAT0_SIP
;
407 if (s
->istat0
& LSI_ISTAT0_INTF
)
410 if (level
!= last_level
) {
411 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
412 level
, s
->dstat
, s
->sist1
, s
->sist0
);
415 qemu_set_irq(s
->dev
.irq
[0], level
);
418 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
419 static void lsi_script_scsi_interrupt(LSIState
*s
, int stat0
, int stat1
)
424 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
425 stat1
, stat0
, s
->sist1
, s
->sist0
);
428 /* Stop processor on fatal or unmasked interrupt. As a special hack
429 we don't stop processing when raising STO. Instead continue
430 execution and stop at the next insn that accesses the SCSI bus. */
431 mask0
= s
->sien0
| ~(LSI_SIST0_CMP
| LSI_SIST0_SEL
| LSI_SIST0_RSL
);
432 mask1
= s
->sien1
| ~(LSI_SIST1_GEN
| LSI_SIST1_HTH
);
433 mask1
&= ~LSI_SIST1_STO
;
434 if (s
->sist0
& mask0
|| s
->sist1
& mask1
) {
440 /* Stop SCRIPTS execution and raise a DMA interrupt. */
441 static void lsi_script_dma_interrupt(LSIState
*s
, int stat
)
443 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat
, s
->dstat
);
449 static inline void lsi_set_phase(LSIState
*s
, int phase
)
451 s
->sstat1
= (s
->sstat1
& ~PHASE_MASK
) | phase
;
454 static void lsi_bad_phase(LSIState
*s
, int out
, int new_phase
)
456 /* Trigger a phase mismatch. */
457 if (s
->ccntl0
& LSI_CCNTL0_ENPMJ
) {
458 if ((s
->ccntl0
& LSI_CCNTL0_PMJCTL
) || out
) {
463 DPRINTF("Data phase mismatch jump to %08x\n", s
->dsp
);
465 DPRINTF("Phase mismatch interrupt\n");
466 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
469 lsi_set_phase(s
, new_phase
);
473 /* Resume SCRIPTS execution after a DMA operation. */
474 static void lsi_resume_script(LSIState
*s
)
476 if (s
->waiting
!= 2) {
478 lsi_execute_script(s
);
484 /* Initiate a SCSI layer data transfer. */
485 static void lsi_do_dma(LSIState
*s
, int out
)
488 target_phys_addr_t addr
;
490 if (!s
->current_dma_len
) {
491 /* Wait until data is available. */
492 DPRINTF("DMA no data available\n");
497 if (count
> s
->current_dma_len
)
498 count
= s
->current_dma_len
;
501 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
502 if (lsi_dma_40bit(s
) || lsi_dma_ti64bit(s
))
503 addr
|= ((uint64_t)s
->dnad64
<< 32);
505 addr
|= ((uint64_t)s
->dbms
<< 32);
507 addr
|= ((uint64_t)s
->sbms
<< 32);
509 DPRINTF("DMA addr=0x" TARGET_FMT_plx
" len=%d\n", addr
, count
);
514 if (s
->dma_buf
== NULL
) {
515 s
->dma_buf
= s
->current_dev
->info
->get_buf(s
->current_dev
,
519 /* ??? Set SFBR to first data byte. */
521 cpu_physical_memory_read(addr
, s
->dma_buf
, count
);
523 cpu_physical_memory_write(addr
, s
->dma_buf
, count
);
525 s
->current_dma_len
-= count
;
526 if (s
->current_dma_len
== 0) {
529 /* Write the data. */
530 s
->current_dev
->info
->write_data(s
->current_dev
, s
->current_tag
);
532 /* Request any remaining data. */
533 s
->current_dev
->info
->read_data(s
->current_dev
, s
->current_tag
);
537 lsi_resume_script(s
);
542 /* Add a command to the queue. */
543 static void lsi_queue_command(LSIState
*s
)
547 DPRINTF("Queueing tag=0x%x\n", s
->current_tag
);
548 if (s
->queue_len
== s
->active_commands
) {
550 s
->queue
= qemu_realloc(s
->queue
, s
->queue_len
* sizeof(lsi_queue
));
552 p
= &s
->queue
[s
->active_commands
++];
553 p
->tag
= s
->current_tag
;
555 p
->out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
558 /* Queue a byte for a MSG IN phase. */
559 static void lsi_add_msg_byte(LSIState
*s
, uint8_t data
)
561 if (s
->msg_len
>= LSI_MAX_MSGIN_LEN
) {
562 BADF("MSG IN data too long\n");
564 DPRINTF("MSG IN 0x%02x\n", data
);
565 s
->msg
[s
->msg_len
++] = data
;
569 /* Perform reselection to continue a command. */
570 static void lsi_reselect(LSIState
*s
, uint32_t tag
)
577 for (n
= 0; n
< s
->active_commands
; n
++) {
582 if (n
== s
->active_commands
) {
583 BADF("Reselected non-existant command tag=0x%x\n", tag
);
586 id
= (tag
>> 8) & 0xf;
588 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
589 if (!s
->dcntl
& LSI_DCNTL_COM
) {
590 s
->sfbr
= 1 << (id
& 0x7);
592 DPRINTF("Reselected target %d\n", id
);
593 s
->current_dev
= s
->bus
.devs
[id
];
594 s
->current_tag
= tag
;
595 s
->scntl1
|= LSI_SCNTL1_CON
;
596 lsi_set_phase(s
, PHASE_MI
);
597 s
->msg_action
= p
->out
? 2 : 3;
598 s
->current_dma_len
= p
->pending
;
600 lsi_add_msg_byte(s
, 0x80);
601 if (s
->current_tag
& LSI_TAG_VALID
) {
602 lsi_add_msg_byte(s
, 0x20);
603 lsi_add_msg_byte(s
, tag
& 0xff);
606 s
->active_commands
--;
607 if (n
!= s
->active_commands
) {
608 s
->queue
[n
] = s
->queue
[s
->active_commands
];
612 /* Record that data is available for a queued command. Returns zero if
613 the device was reselected, nonzero if the IO is deferred. */
614 static int lsi_queue_tag(LSIState
*s
, uint32_t tag
, uint32_t arg
)
618 for (i
= 0; i
< s
->active_commands
; i
++) {
622 BADF("Multiple IO pending for tag %d\n", tag
);
625 if (s
->waiting
== 1) {
626 /* Reselect device. */
627 lsi_reselect(s
, tag
);
630 DPRINTF("Queueing IO tag=0x%x\n", tag
);
636 BADF("IO with unknown tag %d\n", tag
);
640 /* Callback to indicate that the SCSI layer has completed a transfer. */
641 static void lsi_command_complete(SCSIBus
*bus
, int reason
, uint32_t tag
,
644 LSIState
*s
= DO_UPCAST(LSIState
, dev
.qdev
, bus
->qbus
.parent
);
647 out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
648 if (reason
== SCSI_REASON_DONE
) {
649 DPRINTF("Command complete sense=%d\n", (int)arg
);
651 s
->command_complete
= 2;
652 if (s
->waiting
&& s
->dbc
!= 0) {
653 /* Raise phase mismatch for short transfers. */
654 lsi_bad_phase(s
, out
, PHASE_ST
);
656 lsi_set_phase(s
, PHASE_ST
);
658 lsi_resume_script(s
);
662 if (s
->waiting
== 1 || tag
!= s
->current_tag
) {
663 if (lsi_queue_tag(s
, tag
, arg
))
666 DPRINTF("Data ready tag=0x%x len=%d\n", tag
, arg
);
667 s
->current_dma_len
= arg
;
668 s
->command_complete
= 1;
671 if (s
->waiting
== 1 || s
->dbc
== 0) {
672 lsi_resume_script(s
);
678 static void lsi_do_command(LSIState
*s
)
683 DPRINTF("Send command len=%d\n", s
->dbc
);
686 cpu_physical_memory_read(s
->dnad
, buf
, s
->dbc
);
688 s
->command_complete
= 0;
689 n
= s
->current_dev
->info
->send_command(s
->current_dev
, s
->current_tag
, buf
,
692 lsi_set_phase(s
, PHASE_DI
);
693 s
->current_dev
->info
->read_data(s
->current_dev
, s
->current_tag
);
695 lsi_set_phase(s
, PHASE_DO
);
696 s
->current_dev
->info
->write_data(s
->current_dev
, s
->current_tag
);
699 if (!s
->command_complete
) {
701 /* Command did not complete immediately so disconnect. */
702 lsi_add_msg_byte(s
, 2); /* SAVE DATA POINTER */
703 lsi_add_msg_byte(s
, 4); /* DISCONNECT */
705 lsi_set_phase(s
, PHASE_MI
);
707 lsi_queue_command(s
);
709 /* wait command complete */
710 lsi_set_phase(s
, PHASE_DI
);
715 static void lsi_do_status(LSIState
*s
)
718 DPRINTF("Get status len=%d sense=%d\n", s
->dbc
, s
->sense
);
720 BADF("Bad Status move\n");
724 cpu_physical_memory_write(s
->dnad
, &sense
, 1);
725 lsi_set_phase(s
, PHASE_MI
);
727 lsi_add_msg_byte(s
, 0); /* COMMAND COMPLETE */
730 static void lsi_disconnect(LSIState
*s
)
732 s
->scntl1
&= ~LSI_SCNTL1_CON
;
733 s
->sstat1
&= ~PHASE_MASK
;
736 static void lsi_do_msgin(LSIState
*s
)
739 DPRINTF("Message in len=%d/%d\n", s
->dbc
, s
->msg_len
);
744 cpu_physical_memory_write(s
->dnad
, s
->msg
, len
);
745 /* Linux drivers rely on the last byte being in the SIDL. */
746 s
->sidl
= s
->msg
[len
- 1];
749 memmove(s
->msg
, s
->msg
+ len
, s
->msg_len
);
751 /* ??? Check if ATN (not yet implemented) is asserted and maybe
752 switch to PHASE_MO. */
753 switch (s
->msg_action
) {
755 lsi_set_phase(s
, PHASE_CMD
);
761 lsi_set_phase(s
, PHASE_DO
);
764 lsi_set_phase(s
, PHASE_DI
);
772 /* Read the next byte during a MSGOUT phase. */
773 static uint8_t lsi_get_msgbyte(LSIState
*s
)
776 cpu_physical_memory_read(s
->dnad
, &data
, 1);
782 static void lsi_do_msgout(LSIState
*s
)
787 DPRINTF("MSG out len=%d\n", s
->dbc
);
789 msg
= lsi_get_msgbyte(s
);
794 DPRINTF("MSG: Disconnect\n");
798 DPRINTF("MSG: No Operation\n");
799 lsi_set_phase(s
, PHASE_CMD
);
802 len
= lsi_get_msgbyte(s
);
803 msg
= lsi_get_msgbyte(s
);
804 DPRINTF("Extended message 0x%x (len %d)\n", msg
, len
);
807 DPRINTF("SDTR (ignored)\n");
811 DPRINTF("WDTR (ignored)\n");
818 case 0x20: /* SIMPLE queue */
819 s
->current_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
820 DPRINTF("SIMPLE queue tag=0x%x\n", s
->current_tag
& 0xff);
822 case 0x21: /* HEAD of queue */
823 BADF("HEAD queue not implemented\n");
824 s
->current_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
826 case 0x22: /* ORDERED queue */
827 BADF("ORDERED queue not implemented\n");
828 s
->current_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
831 if ((msg
& 0x80) == 0) {
834 s
->current_lun
= msg
& 7;
835 DPRINTF("Select LUN %d\n", s
->current_lun
);
836 lsi_set_phase(s
, PHASE_CMD
);
842 BADF("Unimplemented message 0x%02x\n", msg
);
843 lsi_set_phase(s
, PHASE_MI
);
844 lsi_add_msg_byte(s
, 7); /* MESSAGE REJECT */
848 /* Sign extend a 24-bit value. */
849 static inline int32_t sxt24(int32_t n
)
851 return (n
<< 8) >> 8;
854 #define LSI_BUF_SIZE 4096
855 static void lsi_memcpy(LSIState
*s
, uint32_t dest
, uint32_t src
, int count
)
858 uint8_t buf
[LSI_BUF_SIZE
];
860 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest
, src
, count
);
862 n
= (count
> LSI_BUF_SIZE
) ? LSI_BUF_SIZE
: count
;
863 cpu_physical_memory_read(src
, buf
, n
);
864 cpu_physical_memory_write(dest
, buf
, n
);
871 static void lsi_wait_reselect(LSIState
*s
)
874 DPRINTF("Wait Reselect\n");
875 if (s
->current_dma_len
)
876 BADF("Reselect with pending DMA\n");
877 for (i
= 0; i
< s
->active_commands
; i
++) {
878 if (s
->queue
[i
].pending
) {
879 lsi_reselect(s
, s
->queue
[i
].tag
);
883 if (s
->current_dma_len
== 0) {
888 static void lsi_execute_script(LSIState
*s
)
891 uint32_t addr
, addr_high
;
893 int insn_processed
= 0;
895 s
->istat1
|= LSI_ISTAT1_SRUN
;
898 insn
= read_dword(s
, s
->dsp
);
900 /* If we receive an empty opcode increment the DSP by 4 bytes
901 instead of 8 and execute the next opcode at that location */
905 addr
= read_dword(s
, s
->dsp
+ 4);
907 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s
->dsp
, insn
, addr
);
909 s
->dcmd
= insn
>> 24;
911 switch (insn
>> 30) {
912 case 0: /* Block move. */
913 if (s
->sist1
& LSI_SIST1_STO
) {
914 DPRINTF("Delayed select timeout\n");
918 s
->dbc
= insn
& 0xffffff;
922 if (insn
& (1 << 29)) {
923 /* Indirect addressing. */
924 addr
= read_dword(s
, addr
);
925 } else if (insn
& (1 << 28)) {
928 /* Table indirect addressing. */
930 /* 32-bit Table indirect */
931 offset
= sxt24(addr
);
932 cpu_physical_memory_read(s
->dsa
+ offset
, (uint8_t *)buf
, 8);
933 /* byte count is stored in bits 0:23 only */
934 s
->dbc
= cpu_to_le32(buf
[0]) & 0xffffff;
936 addr
= cpu_to_le32(buf
[1]);
938 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
939 * table, bits [31:24] */
940 if (lsi_dma_40bit(s
))
941 addr_high
= cpu_to_le32(buf
[0]) >> 24;
942 else if (lsi_dma_ti64bit(s
)) {
943 int selector
= (cpu_to_le32(buf
[0]) >> 24) & 0x1f;
946 /* offset index into scratch registers since
947 * TI64 mode can use registers C to R */
948 addr_high
= s
->scratch
[2 + selector
];
969 BADF("Illegal selector specified (0x%x > 0x15)"
970 " for 64-bit DMA block move", selector
);
974 } else if (lsi_dma_64bit(s
)) {
975 /* fetch a 3rd dword if 64-bit direct move is enabled and
976 only if we're not doing table indirect or indirect addressing */
977 s
->dbms
= read_dword(s
, s
->dsp
);
981 if ((s
->sstat1
& PHASE_MASK
) != ((insn
>> 24) & 7)) {
982 DPRINTF("Wrong phase got %d expected %d\n",
983 s
->sstat1
& PHASE_MASK
, (insn
>> 24) & 7);
984 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
988 s
->dnad64
= addr_high
;
989 switch (s
->sstat1
& 0x7) {
1015 BADF("Unimplemented phase %d\n", s
->sstat1
& PHASE_MASK
);
1018 s
->dfifo
= s
->dbc
& 0xff;
1019 s
->ctest5
= (s
->ctest5
& 0xfc) | ((s
->dbc
>> 8) & 3);
1022 s
->ua
= addr
+ s
->dbc
;
1025 case 1: /* IO or Read/Write instruction. */
1026 opcode
= (insn
>> 27) & 7;
1030 if (insn
& (1 << 25)) {
1031 id
= read_dword(s
, s
->dsa
+ sxt24(insn
));
1035 id
= (id
>> 16) & 0xf;
1036 if (insn
& (1 << 26)) {
1037 addr
= s
->dsp
+ sxt24(addr
);
1041 case 0: /* Select */
1043 if (s
->current_dma_len
&& (s
->ssid
& 0xf) == id
) {
1044 DPRINTF("Already reselected by target %d\n", id
);
1047 s
->sstat0
|= LSI_SSTAT0_WOA
;
1048 s
->scntl1
&= ~LSI_SCNTL1_IARB
;
1049 if (id
>= LSI_MAX_DEVS
|| !s
->bus
.devs
[id
]) {
1050 DPRINTF("Selected absent target %d\n", id
);
1051 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_STO
);
1055 DPRINTF("Selected target %d%s\n",
1056 id
, insn
& (1 << 3) ? " ATN" : "");
1057 /* ??? Linux drivers compain when this is set. Maybe
1058 it only applies in low-level mode (unimplemented).
1059 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1060 s
->current_dev
= s
->bus
.devs
[id
];
1061 s
->current_tag
= id
<< 8;
1062 s
->scntl1
|= LSI_SCNTL1_CON
;
1063 if (insn
& (1 << 3)) {
1064 s
->socl
|= LSI_SOCL_ATN
;
1066 lsi_set_phase(s
, PHASE_MO
);
1068 case 1: /* Disconnect */
1069 DPRINTF("Wait Disconnect\n");
1070 s
->scntl1
&= ~LSI_SCNTL1_CON
;
1072 case 2: /* Wait Reselect */
1073 lsi_wait_reselect(s
);
1076 DPRINTF("Set%s%s%s%s\n",
1077 insn
& (1 << 3) ? " ATN" : "",
1078 insn
& (1 << 6) ? " ACK" : "",
1079 insn
& (1 << 9) ? " TM" : "",
1080 insn
& (1 << 10) ? " CC" : "");
1081 if (insn
& (1 << 3)) {
1082 s
->socl
|= LSI_SOCL_ATN
;
1083 lsi_set_phase(s
, PHASE_MO
);
1085 if (insn
& (1 << 9)) {
1086 BADF("Target mode not implemented\n");
1089 if (insn
& (1 << 10))
1093 DPRINTF("Clear%s%s%s%s\n",
1094 insn
& (1 << 3) ? " ATN" : "",
1095 insn
& (1 << 6) ? " ACK" : "",
1096 insn
& (1 << 9) ? " TM" : "",
1097 insn
& (1 << 10) ? " CC" : "");
1098 if (insn
& (1 << 3)) {
1099 s
->socl
&= ~LSI_SOCL_ATN
;
1101 if (insn
& (1 << 10))
1112 static const char *opcode_names
[3] =
1113 {"Write", "Read", "Read-Modify-Write"};
1114 static const char *operator_names
[8] =
1115 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1118 reg
= ((insn
>> 16) & 0x7f) | (insn
& 0x80);
1119 data8
= (insn
>> 8) & 0xff;
1120 opcode
= (insn
>> 27) & 7;
1121 operator = (insn
>> 24) & 7;
1122 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1123 opcode_names
[opcode
- 5], reg
,
1124 operator_names
[operator], data8
, s
->sfbr
,
1125 (insn
& (1 << 23)) ? " SFBR" : "");
1128 case 5: /* From SFBR */
1132 case 6: /* To SFBR */
1134 op0
= lsi_reg_readb(s
, reg
);
1137 case 7: /* Read-modify-write */
1139 op0
= lsi_reg_readb(s
, reg
);
1140 if (insn
& (1 << 23)) {
1152 case 1: /* Shift left */
1154 op0
= (op0
<< 1) | s
->carry
;
1168 op0
= (op0
>> 1) | (s
->carry
<< 7);
1173 s
->carry
= op0
< op1
;
1176 op0
+= op1
+ s
->carry
;
1178 s
->carry
= op0
<= op1
;
1180 s
->carry
= op0
< op1
;
1185 case 5: /* From SFBR */
1186 case 7: /* Read-modify-write */
1187 lsi_reg_writeb(s
, reg
, op0
);
1189 case 6: /* To SFBR */
1196 case 2: /* Transfer Control. */
1201 if ((insn
& 0x002e0000) == 0) {
1205 if (s
->sist1
& LSI_SIST1_STO
) {
1206 DPRINTF("Delayed select timeout\n");
1210 cond
= jmp
= (insn
& (1 << 19)) != 0;
1211 if (cond
== jmp
&& (insn
& (1 << 21))) {
1212 DPRINTF("Compare carry %d\n", s
->carry
== jmp
);
1213 cond
= s
->carry
!= 0;
1215 if (cond
== jmp
&& (insn
& (1 << 17))) {
1216 DPRINTF("Compare phase %d %c= %d\n",
1217 (s
->sstat1
& PHASE_MASK
),
1219 ((insn
>> 24) & 7));
1220 cond
= (s
->sstat1
& PHASE_MASK
) == ((insn
>> 24) & 7);
1222 if (cond
== jmp
&& (insn
& (1 << 18))) {
1225 mask
= (~insn
>> 8) & 0xff;
1226 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1227 s
->sfbr
, mask
, jmp
? '=' : '!', insn
& mask
);
1228 cond
= (s
->sfbr
& mask
) == (insn
& mask
);
1231 if (insn
& (1 << 23)) {
1232 /* Relative address. */
1233 addr
= s
->dsp
+ sxt24(addr
);
1235 switch ((insn
>> 27) & 7) {
1237 DPRINTF("Jump to 0x%08x\n", addr
);
1241 DPRINTF("Call 0x%08x\n", addr
);
1245 case 2: /* Return */
1246 DPRINTF("Return to 0x%08x\n", s
->temp
);
1249 case 3: /* Interrupt */
1250 DPRINTF("Interrupt 0x%08x\n", s
->dsps
);
1251 if ((insn
& (1 << 20)) != 0) {
1252 s
->istat0
|= LSI_ISTAT0_INTF
;
1255 lsi_script_dma_interrupt(s
, LSI_DSTAT_SIR
);
1259 DPRINTF("Illegal transfer control\n");
1260 lsi_script_dma_interrupt(s
, LSI_DSTAT_IID
);
1264 DPRINTF("Control condition failed\n");
1270 if ((insn
& (1 << 29)) == 0) {
1273 /* ??? The docs imply the destination address is loaded into
1274 the TEMP register. However the Linux drivers rely on
1275 the value being presrved. */
1276 dest
= read_dword(s
, s
->dsp
);
1278 lsi_memcpy(s
, dest
, addr
, insn
& 0xffffff);
1285 if (insn
& (1 << 28)) {
1286 addr
= s
->dsa
+ sxt24(addr
);
1289 reg
= (insn
>> 16) & 0xff;
1290 if (insn
& (1 << 24)) {
1291 cpu_physical_memory_read(addr
, data
, n
);
1292 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg
, n
,
1293 addr
, *(int *)data
);
1294 for (i
= 0; i
< n
; i
++) {
1295 lsi_reg_writeb(s
, reg
+ i
, data
[i
]);
1298 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg
, n
, addr
);
1299 for (i
= 0; i
< n
; i
++) {
1300 data
[i
] = lsi_reg_readb(s
, reg
+ i
);
1302 cpu_physical_memory_write(addr
, data
, n
);
1306 if (insn_processed
> 10000 && !s
->waiting
) {
1307 /* Some windows drivers make the device spin waiting for a memory
1308 location to change. If we have been executed a lot of code then
1309 assume this is the case and force an unexpected device disconnect.
1310 This is apparently sufficient to beat the drivers into submission.
1312 if (!(s
->sien0
& LSI_SIST0_UDC
))
1313 fprintf(stderr
, "inf. loop with UDC masked\n");
1314 lsi_script_scsi_interrupt(s
, LSI_SIST0_UDC
, 0);
1316 } else if (s
->istat1
& LSI_ISTAT1_SRUN
&& !s
->waiting
) {
1317 if (s
->dcntl
& LSI_DCNTL_SSM
) {
1318 lsi_script_dma_interrupt(s
, LSI_DSTAT_SSI
);
1323 DPRINTF("SCRIPTS execution stopped\n");
1326 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
)
1329 #define CASE_GET_REG24(name, addr) \
1330 case addr: return s->name & 0xff; \
1331 case addr + 1: return (s->name >> 8) & 0xff; \
1332 case addr + 2: return (s->name >> 16) & 0xff;
1334 #define CASE_GET_REG32(name, addr) \
1335 case addr: return s->name & 0xff; \
1336 case addr + 1: return (s->name >> 8) & 0xff; \
1337 case addr + 2: return (s->name >> 16) & 0xff; \
1338 case addr + 3: return (s->name >> 24) & 0xff;
1340 #ifdef DEBUG_LSI_REG
1341 DPRINTF("Read reg %x\n", offset
);
1344 case 0x00: /* SCNTL0 */
1346 case 0x01: /* SCNTL1 */
1348 case 0x02: /* SCNTL2 */
1350 case 0x03: /* SCNTL3 */
1352 case 0x04: /* SCID */
1354 case 0x05: /* SXFER */
1356 case 0x06: /* SDID */
1358 case 0x07: /* GPREG0 */
1360 case 0x08: /* Revision ID */
1362 case 0xa: /* SSID */
1364 case 0xb: /* SBCL */
1365 /* ??? This is not correct. However it's (hopefully) only
1366 used for diagnostics, so should be ok. */
1368 case 0xc: /* DSTAT */
1369 tmp
= s
->dstat
| 0x80;
1370 if ((s
->istat0
& LSI_ISTAT0_INTF
) == 0)
1374 case 0x0d: /* SSTAT0 */
1376 case 0x0e: /* SSTAT1 */
1378 case 0x0f: /* SSTAT2 */
1379 return s
->scntl1
& LSI_SCNTL1_CON
? 0 : 2;
1380 CASE_GET_REG32(dsa
, 0x10)
1381 case 0x14: /* ISTAT0 */
1383 case 0x15: /* ISTAT1 */
1385 case 0x16: /* MBOX0 */
1387 case 0x17: /* MBOX1 */
1389 case 0x18: /* CTEST0 */
1391 case 0x19: /* CTEST1 */
1393 case 0x1a: /* CTEST2 */
1394 tmp
= s
->ctest2
| LSI_CTEST2_DACK
| LSI_CTEST2_CM
;
1395 if (s
->istat0
& LSI_ISTAT0_SIGP
) {
1396 s
->istat0
&= ~LSI_ISTAT0_SIGP
;
1397 tmp
|= LSI_CTEST2_SIGP
;
1400 case 0x1b: /* CTEST3 */
1402 CASE_GET_REG32(temp
, 0x1c)
1403 case 0x20: /* DFIFO */
1405 case 0x21: /* CTEST4 */
1407 case 0x22: /* CTEST5 */
1409 case 0x23: /* CTEST6 */
1411 CASE_GET_REG24(dbc
, 0x24)
1412 case 0x27: /* DCMD */
1414 CASE_GET_REG32(dnad
, 0x28)
1415 CASE_GET_REG32(dsp
, 0x2c)
1416 CASE_GET_REG32(dsps
, 0x30)
1417 CASE_GET_REG32(scratch
[0], 0x34)
1418 case 0x38: /* DMODE */
1420 case 0x39: /* DIEN */
1422 case 0x3a: /* SBR */
1424 case 0x3b: /* DCNTL */
1426 case 0x40: /* SIEN0 */
1428 case 0x41: /* SIEN1 */
1430 case 0x42: /* SIST0 */
1435 case 0x43: /* SIST1 */
1440 case 0x46: /* MACNTL */
1442 case 0x47: /* GPCNTL0 */
1444 case 0x48: /* STIME0 */
1446 case 0x4a: /* RESPID0 */
1448 case 0x4b: /* RESPID1 */
1450 case 0x4d: /* STEST1 */
1452 case 0x4e: /* STEST2 */
1454 case 0x4f: /* STEST3 */
1456 case 0x50: /* SIDL */
1457 /* This is needed by the linux drivers. We currently only update it
1458 during the MSG IN phase. */
1460 case 0x52: /* STEST4 */
1462 case 0x56: /* CCNTL0 */
1464 case 0x57: /* CCNTL1 */
1466 case 0x58: /* SBDL */
1467 /* Some drivers peek at the data bus during the MSG IN phase. */
1468 if ((s
->sstat1
& PHASE_MASK
) == PHASE_MI
)
1471 case 0x59: /* SBDL high */
1473 CASE_GET_REG32(mmrs
, 0xa0)
1474 CASE_GET_REG32(mmws
, 0xa4)
1475 CASE_GET_REG32(sfs
, 0xa8)
1476 CASE_GET_REG32(drs
, 0xac)
1477 CASE_GET_REG32(sbms
, 0xb0)
1478 CASE_GET_REG32(dbms
, 0xb4)
1479 CASE_GET_REG32(dnad64
, 0xb8)
1480 CASE_GET_REG32(pmjad1
, 0xc0)
1481 CASE_GET_REG32(pmjad2
, 0xc4)
1482 CASE_GET_REG32(rbc
, 0xc8)
1483 CASE_GET_REG32(ua
, 0xcc)
1484 CASE_GET_REG32(ia
, 0xd4)
1485 CASE_GET_REG32(sbc
, 0xd8)
1486 CASE_GET_REG32(csbc
, 0xdc)
1488 if (offset
>= 0x5c && offset
< 0xa0) {
1491 n
= (offset
- 0x58) >> 2;
1492 shift
= (offset
& 3) * 8;
1493 return (s
->scratch
[n
] >> shift
) & 0xff;
1495 BADF("readb 0x%x\n", offset
);
1497 #undef CASE_GET_REG24
1498 #undef CASE_GET_REG32
1501 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
)
1503 #define CASE_SET_REG24(name, addr) \
1504 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1505 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1506 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1508 #define CASE_SET_REG32(name, addr) \
1509 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1510 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1511 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1512 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1514 #ifdef DEBUG_LSI_REG
1515 DPRINTF("Write reg %x = %02x\n", offset
, val
);
1518 case 0x00: /* SCNTL0 */
1520 if (val
& LSI_SCNTL0_START
) {
1521 BADF("Start sequence not implemented\n");
1524 case 0x01: /* SCNTL1 */
1525 s
->scntl1
= val
& ~LSI_SCNTL1_SST
;
1526 if (val
& LSI_SCNTL1_IARB
) {
1527 BADF("Immediate Arbritration not implemented\n");
1529 if (val
& LSI_SCNTL1_RST
) {
1530 s
->sstat0
|= LSI_SSTAT0_RST
;
1531 lsi_script_scsi_interrupt(s
, LSI_SIST0_RST
, 0);
1533 s
->sstat0
&= ~LSI_SSTAT0_RST
;
1536 case 0x02: /* SCNTL2 */
1537 val
&= ~(LSI_SCNTL2_WSR
| LSI_SCNTL2_WSS
);
1540 case 0x03: /* SCNTL3 */
1543 case 0x04: /* SCID */
1546 case 0x05: /* SXFER */
1549 case 0x06: /* SDID */
1550 if ((val
& 0xf) != (s
->ssid
& 0xf))
1551 BADF("Destination ID does not match SSID\n");
1552 s
->sdid
= val
& 0xf;
1554 case 0x07: /* GPREG0 */
1556 case 0x08: /* SFBR */
1557 /* The CPU is not allowed to write to this register. However the
1558 SCRIPTS register move instructions are. */
1561 case 0x0a: case 0x0b:
1562 /* Openserver writes to these readonly registers on startup */
1564 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1565 /* Linux writes to these readonly registers on startup. */
1567 CASE_SET_REG32(dsa
, 0x10)
1568 case 0x14: /* ISTAT0 */
1569 s
->istat0
= (s
->istat0
& 0x0f) | (val
& 0xf0);
1570 if (val
& LSI_ISTAT0_ABRT
) {
1571 lsi_script_dma_interrupt(s
, LSI_DSTAT_ABRT
);
1573 if (val
& LSI_ISTAT0_INTF
) {
1574 s
->istat0
&= ~LSI_ISTAT0_INTF
;
1577 if (s
->waiting
== 1 && val
& LSI_ISTAT0_SIGP
) {
1578 DPRINTF("Woken by SIGP\n");
1581 lsi_execute_script(s
);
1583 if (val
& LSI_ISTAT0_SRST
) {
1587 case 0x16: /* MBOX0 */
1590 case 0x17: /* MBOX1 */
1593 case 0x1a: /* CTEST2 */
1594 s
->ctest2
= val
& LSI_CTEST2_PCICIE
;
1596 case 0x1b: /* CTEST3 */
1597 s
->ctest3
= val
& 0x0f;
1599 CASE_SET_REG32(temp
, 0x1c)
1600 case 0x21: /* CTEST4 */
1602 BADF("Unimplemented CTEST4-FBL 0x%x\n", val
);
1606 case 0x22: /* CTEST5 */
1607 if (val
& (LSI_CTEST5_ADCK
| LSI_CTEST5_BBCK
)) {
1608 BADF("CTEST5 DMA increment not implemented\n");
1612 CASE_SET_REG24(dbc
, 0x24)
1613 CASE_SET_REG32(dnad
, 0x28)
1614 case 0x2c: /* DSP[0:7] */
1615 s
->dsp
&= 0xffffff00;
1618 case 0x2d: /* DSP[8:15] */
1619 s
->dsp
&= 0xffff00ff;
1622 case 0x2e: /* DSP[16:23] */
1623 s
->dsp
&= 0xff00ffff;
1624 s
->dsp
|= val
<< 16;
1626 case 0x2f: /* DSP[24:31] */
1627 s
->dsp
&= 0x00ffffff;
1628 s
->dsp
|= val
<< 24;
1629 if ((s
->dmode
& LSI_DMODE_MAN
) == 0
1630 && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1631 lsi_execute_script(s
);
1633 CASE_SET_REG32(dsps
, 0x30)
1634 CASE_SET_REG32(scratch
[0], 0x34)
1635 case 0x38: /* DMODE */
1636 if (val
& (LSI_DMODE_SIOM
| LSI_DMODE_DIOM
)) {
1637 BADF("IO mappings not implemented\n");
1641 case 0x39: /* DIEN */
1645 case 0x3a: /* SBR */
1648 case 0x3b: /* DCNTL */
1649 s
->dcntl
= val
& ~(LSI_DCNTL_PFF
| LSI_DCNTL_STD
);
1650 if ((val
& LSI_DCNTL_STD
) && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1651 lsi_execute_script(s
);
1653 case 0x40: /* SIEN0 */
1657 case 0x41: /* SIEN1 */
1661 case 0x47: /* GPCNTL0 */
1663 case 0x48: /* STIME0 */
1666 case 0x49: /* STIME1 */
1668 DPRINTF("General purpose timer not implemented\n");
1669 /* ??? Raising the interrupt immediately seems to be sufficient
1670 to keep the FreeBSD driver happy. */
1671 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_GEN
);
1674 case 0x4a: /* RESPID0 */
1677 case 0x4b: /* RESPID1 */
1680 case 0x4d: /* STEST1 */
1683 case 0x4e: /* STEST2 */
1685 BADF("Low level mode not implemented\n");
1689 case 0x4f: /* STEST3 */
1691 BADF("SCSI FIFO test mode not implemented\n");
1695 case 0x56: /* CCNTL0 */
1698 case 0x57: /* CCNTL1 */
1701 CASE_SET_REG32(mmrs
, 0xa0)
1702 CASE_SET_REG32(mmws
, 0xa4)
1703 CASE_SET_REG32(sfs
, 0xa8)
1704 CASE_SET_REG32(drs
, 0xac)
1705 CASE_SET_REG32(sbms
, 0xb0)
1706 CASE_SET_REG32(dbms
, 0xb4)
1707 CASE_SET_REG32(dnad64
, 0xb8)
1708 CASE_SET_REG32(pmjad1
, 0xc0)
1709 CASE_SET_REG32(pmjad2
, 0xc4)
1710 CASE_SET_REG32(rbc
, 0xc8)
1711 CASE_SET_REG32(ua
, 0xcc)
1712 CASE_SET_REG32(ia
, 0xd4)
1713 CASE_SET_REG32(sbc
, 0xd8)
1714 CASE_SET_REG32(csbc
, 0xdc)
1716 if (offset
>= 0x5c && offset
< 0xa0) {
1719 n
= (offset
- 0x58) >> 2;
1720 shift
= (offset
& 3) * 8;
1721 s
->scratch
[n
] &= ~(0xff << shift
);
1722 s
->scratch
[n
] |= (val
& 0xff) << shift
;
1724 BADF("Unhandled writeb 0x%x = 0x%x\n", offset
, val
);
1727 #undef CASE_SET_REG24
1728 #undef CASE_SET_REG32
1731 static void lsi_mmio_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1733 LSIState
*s
= opaque
;
1735 lsi_reg_writeb(s
, addr
& 0xff, val
);
1738 static void lsi_mmio_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1740 LSIState
*s
= opaque
;
1743 lsi_reg_writeb(s
, addr
, val
& 0xff);
1744 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1747 static void lsi_mmio_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1749 LSIState
*s
= opaque
;
1752 lsi_reg_writeb(s
, addr
, val
& 0xff);
1753 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1754 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1755 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1758 static uint32_t lsi_mmio_readb(void *opaque
, target_phys_addr_t addr
)
1760 LSIState
*s
= opaque
;
1762 return lsi_reg_readb(s
, addr
& 0xff);
1765 static uint32_t lsi_mmio_readw(void *opaque
, target_phys_addr_t addr
)
1767 LSIState
*s
= opaque
;
1771 val
= lsi_reg_readb(s
, addr
);
1772 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1776 static uint32_t lsi_mmio_readl(void *opaque
, target_phys_addr_t addr
)
1778 LSIState
*s
= opaque
;
1781 val
= lsi_reg_readb(s
, addr
);
1782 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1783 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1784 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1788 static CPUReadMemoryFunc
* const lsi_mmio_readfn
[3] = {
1794 static CPUWriteMemoryFunc
* const lsi_mmio_writefn
[3] = {
1800 static void lsi_ram_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1802 LSIState
*s
= opaque
;
1807 newval
= s
->script_ram
[addr
>> 2];
1808 shift
= (addr
& 3) * 8;
1809 newval
&= ~(0xff << shift
);
1810 newval
|= val
<< shift
;
1811 s
->script_ram
[addr
>> 2] = newval
;
1814 static void lsi_ram_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1816 LSIState
*s
= opaque
;
1820 newval
= s
->script_ram
[addr
>> 2];
1822 newval
= (newval
& 0xffff) | (val
<< 16);
1824 newval
= (newval
& 0xffff0000) | val
;
1826 s
->script_ram
[addr
>> 2] = newval
;
1830 static void lsi_ram_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
1832 LSIState
*s
= opaque
;
1835 s
->script_ram
[addr
>> 2] = val
;
1838 static uint32_t lsi_ram_readb(void *opaque
, target_phys_addr_t addr
)
1840 LSIState
*s
= opaque
;
1844 val
= s
->script_ram
[addr
>> 2];
1845 val
>>= (addr
& 3) * 8;
1849 static uint32_t lsi_ram_readw(void *opaque
, target_phys_addr_t addr
)
1851 LSIState
*s
= opaque
;
1855 val
= s
->script_ram
[addr
>> 2];
1858 return le16_to_cpu(val
);
1861 static uint32_t lsi_ram_readl(void *opaque
, target_phys_addr_t addr
)
1863 LSIState
*s
= opaque
;
1866 return le32_to_cpu(s
->script_ram
[addr
>> 2]);
1869 static CPUReadMemoryFunc
* const lsi_ram_readfn
[3] = {
1875 static CPUWriteMemoryFunc
* const lsi_ram_writefn
[3] = {
1881 static uint32_t lsi_io_readb(void *opaque
, uint32_t addr
)
1883 LSIState
*s
= opaque
;
1884 return lsi_reg_readb(s
, addr
& 0xff);
1887 static uint32_t lsi_io_readw(void *opaque
, uint32_t addr
)
1889 LSIState
*s
= opaque
;
1892 val
= lsi_reg_readb(s
, addr
);
1893 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1897 static uint32_t lsi_io_readl(void *opaque
, uint32_t addr
)
1899 LSIState
*s
= opaque
;
1902 val
= lsi_reg_readb(s
, addr
);
1903 val
|= lsi_reg_readb(s
, addr
+ 1) << 8;
1904 val
|= lsi_reg_readb(s
, addr
+ 2) << 16;
1905 val
|= lsi_reg_readb(s
, addr
+ 3) << 24;
1909 static void lsi_io_writeb(void *opaque
, uint32_t addr
, uint32_t val
)
1911 LSIState
*s
= opaque
;
1912 lsi_reg_writeb(s
, addr
& 0xff, val
);
1915 static void lsi_io_writew(void *opaque
, uint32_t addr
, uint32_t val
)
1917 LSIState
*s
= opaque
;
1919 lsi_reg_writeb(s
, addr
, val
& 0xff);
1920 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1923 static void lsi_io_writel(void *opaque
, uint32_t addr
, uint32_t val
)
1925 LSIState
*s
= opaque
;
1927 lsi_reg_writeb(s
, addr
, val
& 0xff);
1928 lsi_reg_writeb(s
, addr
+ 1, (val
>> 8) & 0xff);
1929 lsi_reg_writeb(s
, addr
+ 2, (val
>> 16) & 0xff);
1930 lsi_reg_writeb(s
, addr
+ 3, (val
>> 24) & 0xff);
1933 static void lsi_io_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1934 pcibus_t addr
, pcibus_t size
, int type
)
1936 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1938 DPRINTF("Mapping IO at %08x\n", addr
);
1940 register_ioport_write(addr
, 256, 1, lsi_io_writeb
, s
);
1941 register_ioport_read(addr
, 256, 1, lsi_io_readb
, s
);
1942 register_ioport_write(addr
, 256, 2, lsi_io_writew
, s
);
1943 register_ioport_read(addr
, 256, 2, lsi_io_readw
, s
);
1944 register_ioport_write(addr
, 256, 4, lsi_io_writel
, s
);
1945 register_ioport_read(addr
, 256, 4, lsi_io_readl
, s
);
1948 static void lsi_ram_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1949 pcibus_t addr
, pcibus_t size
, int type
)
1951 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1953 DPRINTF("Mapping ram at %08x\n", addr
);
1954 s
->script_ram_base
= addr
;
1955 cpu_register_physical_memory(addr
+ 0, 0x2000, s
->ram_io_addr
);
1958 static void lsi_mmio_mapfunc(PCIDevice
*pci_dev
, int region_num
,
1959 pcibus_t addr
, pcibus_t size
, int type
)
1961 LSIState
*s
= DO_UPCAST(LSIState
, dev
, pci_dev
);
1963 DPRINTF("Mapping registers at %08x\n", addr
);
1964 cpu_register_physical_memory(addr
+ 0, 0x400, s
->mmio_io_addr
);
1967 static void lsi_pre_save(void *opaque
)
1969 LSIState
*s
= opaque
;
1971 assert(s
->dma_buf
== NULL
);
1972 assert(s
->current_dma_len
== 0);
1973 assert(s
->active_commands
== 0);
1976 static const VMStateDescription vmstate_lsi_scsi
= {
1979 .minimum_version_id
= 0,
1980 .minimum_version_id_old
= 0,
1981 .pre_save
= lsi_pre_save
,
1982 .fields
= (VMStateField
[]) {
1983 VMSTATE_PCI_DEVICE(dev
, LSIState
),
1985 VMSTATE_INT32(carry
, LSIState
),
1986 VMSTATE_INT32(sense
, LSIState
),
1987 VMSTATE_INT32(msg_action
, LSIState
),
1988 VMSTATE_INT32(msg_len
, LSIState
),
1989 VMSTATE_BUFFER(msg
, LSIState
),
1990 VMSTATE_INT32(waiting
, LSIState
),
1992 VMSTATE_UINT32(dsa
, LSIState
),
1993 VMSTATE_UINT32(temp
, LSIState
),
1994 VMSTATE_UINT32(dnad
, LSIState
),
1995 VMSTATE_UINT32(dbc
, LSIState
),
1996 VMSTATE_UINT8(istat0
, LSIState
),
1997 VMSTATE_UINT8(istat1
, LSIState
),
1998 VMSTATE_UINT8(dcmd
, LSIState
),
1999 VMSTATE_UINT8(dstat
, LSIState
),
2000 VMSTATE_UINT8(dien
, LSIState
),
2001 VMSTATE_UINT8(sist0
, LSIState
),
2002 VMSTATE_UINT8(sist1
, LSIState
),
2003 VMSTATE_UINT8(sien0
, LSIState
),
2004 VMSTATE_UINT8(sien1
, LSIState
),
2005 VMSTATE_UINT8(mbox0
, LSIState
),
2006 VMSTATE_UINT8(mbox1
, LSIState
),
2007 VMSTATE_UINT8(dfifo
, LSIState
),
2008 VMSTATE_UINT8(ctest2
, LSIState
),
2009 VMSTATE_UINT8(ctest3
, LSIState
),
2010 VMSTATE_UINT8(ctest4
, LSIState
),
2011 VMSTATE_UINT8(ctest5
, LSIState
),
2012 VMSTATE_UINT8(ccntl0
, LSIState
),
2013 VMSTATE_UINT8(ccntl1
, LSIState
),
2014 VMSTATE_UINT32(dsp
, LSIState
),
2015 VMSTATE_UINT32(dsps
, LSIState
),
2016 VMSTATE_UINT8(dmode
, LSIState
),
2017 VMSTATE_UINT8(dcntl
, LSIState
),
2018 VMSTATE_UINT8(scntl0
, LSIState
),
2019 VMSTATE_UINT8(scntl1
, LSIState
),
2020 VMSTATE_UINT8(scntl2
, LSIState
),
2021 VMSTATE_UINT8(scntl3
, LSIState
),
2022 VMSTATE_UINT8(sstat0
, LSIState
),
2023 VMSTATE_UINT8(sstat1
, LSIState
),
2024 VMSTATE_UINT8(scid
, LSIState
),
2025 VMSTATE_UINT8(sxfer
, LSIState
),
2026 VMSTATE_UINT8(socl
, LSIState
),
2027 VMSTATE_UINT8(sdid
, LSIState
),
2028 VMSTATE_UINT8(ssid
, LSIState
),
2029 VMSTATE_UINT8(sfbr
, LSIState
),
2030 VMSTATE_UINT8(stest1
, LSIState
),
2031 VMSTATE_UINT8(stest2
, LSIState
),
2032 VMSTATE_UINT8(stest3
, LSIState
),
2033 VMSTATE_UINT8(sidl
, LSIState
),
2034 VMSTATE_UINT8(stime0
, LSIState
),
2035 VMSTATE_UINT8(respid0
, LSIState
),
2036 VMSTATE_UINT8(respid1
, LSIState
),
2037 VMSTATE_UINT32(mmrs
, LSIState
),
2038 VMSTATE_UINT32(mmws
, LSIState
),
2039 VMSTATE_UINT32(sfs
, LSIState
),
2040 VMSTATE_UINT32(drs
, LSIState
),
2041 VMSTATE_UINT32(sbms
, LSIState
),
2042 VMSTATE_UINT32(dbms
, LSIState
),
2043 VMSTATE_UINT32(dnad64
, LSIState
),
2044 VMSTATE_UINT32(pmjad1
, LSIState
),
2045 VMSTATE_UINT32(pmjad2
, LSIState
),
2046 VMSTATE_UINT32(rbc
, LSIState
),
2047 VMSTATE_UINT32(ua
, LSIState
),
2048 VMSTATE_UINT32(ia
, LSIState
),
2049 VMSTATE_UINT32(sbc
, LSIState
),
2050 VMSTATE_UINT32(csbc
, LSIState
),
2051 VMSTATE_BUFFER_UNSAFE(scratch
, LSIState
, 0, 18 * sizeof(uint32_t)),
2052 VMSTATE_UINT8(sbr
, LSIState
),
2054 VMSTATE_BUFFER_UNSAFE(script_ram
, LSIState
, 0, 2048 * sizeof(uint32_t)),
2055 VMSTATE_END_OF_LIST()
2059 static int lsi_scsi_uninit(PCIDevice
*d
)
2061 LSIState
*s
= DO_UPCAST(LSIState
, dev
, d
);
2063 cpu_unregister_io_memory(s
->mmio_io_addr
);
2064 cpu_unregister_io_memory(s
->ram_io_addr
);
2066 qemu_free(s
->queue
);
2071 static int lsi_scsi_init(PCIDevice
*dev
)
2073 LSIState
*s
= DO_UPCAST(LSIState
, dev
, dev
);
2076 pci_conf
= s
->dev
.config
;
2078 /* PCI Vendor ID (word) */
2079 pci_config_set_vendor_id(pci_conf
, PCI_VENDOR_ID_LSI_LOGIC
);
2080 /* PCI device ID (word) */
2081 pci_config_set_device_id(pci_conf
, PCI_DEVICE_ID_LSI_53C895A
);
2082 /* PCI base class code */
2083 pci_config_set_class(pci_conf
, PCI_CLASS_STORAGE_SCSI
);
2084 /* PCI subsystem ID */
2085 pci_conf
[0x2e] = 0x00;
2086 pci_conf
[0x2f] = 0x10;
2087 /* PCI latency timer = 255 */
2088 pci_conf
[0x0d] = 0xff;
2089 /* Interrupt pin 1 */
2090 pci_conf
[0x3d] = 0x01;
2092 s
->mmio_io_addr
= cpu_register_io_memory(lsi_mmio_readfn
,
2093 lsi_mmio_writefn
, s
);
2094 s
->ram_io_addr
= cpu_register_io_memory(lsi_ram_readfn
,
2095 lsi_ram_writefn
, s
);
2097 pci_register_bar((struct PCIDevice
*)s
, 0, 256,
2098 PCI_BASE_ADDRESS_SPACE_IO
, lsi_io_mapfunc
);
2099 pci_register_bar((struct PCIDevice
*)s
, 1, 0x400,
2100 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_mmio_mapfunc
);
2101 pci_register_bar((struct PCIDevice
*)s
, 2, 0x2000,
2102 PCI_BASE_ADDRESS_SPACE_MEMORY
, lsi_ram_mapfunc
);
2103 s
->queue
= qemu_malloc(sizeof(lsi_queue
));
2105 s
->active_commands
= 0;
2109 scsi_bus_new(&s
->bus
, &dev
->qdev
, 1, LSI_MAX_DEVS
, lsi_command_complete
);
2110 if (!dev
->qdev
.hotplugged
) {
2111 scsi_bus_legacy_handle_cmdline(&s
->bus
);
2113 vmstate_register(-1, &vmstate_lsi_scsi
, s
);
2117 static PCIDeviceInfo lsi_info
= {
2118 .qdev
.name
= "lsi53c895a",
2119 .qdev
.alias
= "lsi",
2120 .qdev
.size
= sizeof(LSIState
),
2121 .init
= lsi_scsi_init
,
2122 .exit
= lsi_scsi_uninit
,
2125 static void lsi53c895a_register_devices(void)
2127 pci_qdev_register(&lsi_info
);
2130 device_init(lsi53c895a_register_devices
);