2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the LGPL.
11 * LSI53C810 emulation is incorrect, in the sense that it supports
12 * features added in later evolutions. This should not be a problem,
13 * as well-behaved operating systems will not try to use them.
19 #include "hw/pci/pci.h"
20 #include "hw/scsi/scsi.h"
21 #include "sysemu/dma.h"
22 #include "qemu/error-report.h"
25 //#define DEBUG_LSI_REG
28 #define DPRINTF(fmt, ...) \
29 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
30 #define BADF(fmt, ...) \
31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
33 #define DPRINTF(fmt, ...) do {} while(0)
34 #define BADF(fmt, ...) \
35 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
38 #define LSI_MAX_DEVS 7
40 #define LSI_SCNTL0_TRG 0x01
41 #define LSI_SCNTL0_AAP 0x02
42 #define LSI_SCNTL0_EPC 0x08
43 #define LSI_SCNTL0_WATN 0x10
44 #define LSI_SCNTL0_START 0x20
46 #define LSI_SCNTL1_SST 0x01
47 #define LSI_SCNTL1_IARB 0x02
48 #define LSI_SCNTL1_AESP 0x04
49 #define LSI_SCNTL1_RST 0x08
50 #define LSI_SCNTL1_CON 0x10
51 #define LSI_SCNTL1_DHP 0x20
52 #define LSI_SCNTL1_ADB 0x40
53 #define LSI_SCNTL1_EXC 0x80
55 #define LSI_SCNTL2_WSR 0x01
56 #define LSI_SCNTL2_VUE0 0x02
57 #define LSI_SCNTL2_VUE1 0x04
58 #define LSI_SCNTL2_WSS 0x08
59 #define LSI_SCNTL2_SLPHBEN 0x10
60 #define LSI_SCNTL2_SLPMD 0x20
61 #define LSI_SCNTL2_CHM 0x40
62 #define LSI_SCNTL2_SDU 0x80
64 #define LSI_ISTAT0_DIP 0x01
65 #define LSI_ISTAT0_SIP 0x02
66 #define LSI_ISTAT0_INTF 0x04
67 #define LSI_ISTAT0_CON 0x08
68 #define LSI_ISTAT0_SEM 0x10
69 #define LSI_ISTAT0_SIGP 0x20
70 #define LSI_ISTAT0_SRST 0x40
71 #define LSI_ISTAT0_ABRT 0x80
73 #define LSI_ISTAT1_SI 0x01
74 #define LSI_ISTAT1_SRUN 0x02
75 #define LSI_ISTAT1_FLSH 0x04
77 #define LSI_SSTAT0_SDP0 0x01
78 #define LSI_SSTAT0_RST 0x02
79 #define LSI_SSTAT0_WOA 0x04
80 #define LSI_SSTAT0_LOA 0x08
81 #define LSI_SSTAT0_AIP 0x10
82 #define LSI_SSTAT0_OLF 0x20
83 #define LSI_SSTAT0_ORF 0x40
84 #define LSI_SSTAT0_ILF 0x80
86 #define LSI_SIST0_PAR 0x01
87 #define LSI_SIST0_RST 0x02
88 #define LSI_SIST0_UDC 0x04
89 #define LSI_SIST0_SGE 0x08
90 #define LSI_SIST0_RSL 0x10
91 #define LSI_SIST0_SEL 0x20
92 #define LSI_SIST0_CMP 0x40
93 #define LSI_SIST0_MA 0x80
95 #define LSI_SIST1_HTH 0x01
96 #define LSI_SIST1_GEN 0x02
97 #define LSI_SIST1_STO 0x04
98 #define LSI_SIST1_SBMC 0x10
100 #define LSI_SOCL_IO 0x01
101 #define LSI_SOCL_CD 0x02
102 #define LSI_SOCL_MSG 0x04
103 #define LSI_SOCL_ATN 0x08
104 #define LSI_SOCL_SEL 0x10
105 #define LSI_SOCL_BSY 0x20
106 #define LSI_SOCL_ACK 0x40
107 #define LSI_SOCL_REQ 0x80
109 #define LSI_DSTAT_IID 0x01
110 #define LSI_DSTAT_SIR 0x04
111 #define LSI_DSTAT_SSI 0x08
112 #define LSI_DSTAT_ABRT 0x10
113 #define LSI_DSTAT_BF 0x20
114 #define LSI_DSTAT_MDPE 0x40
115 #define LSI_DSTAT_DFE 0x80
117 #define LSI_DCNTL_COM 0x01
118 #define LSI_DCNTL_IRQD 0x02
119 #define LSI_DCNTL_STD 0x04
120 #define LSI_DCNTL_IRQM 0x08
121 #define LSI_DCNTL_SSM 0x10
122 #define LSI_DCNTL_PFEN 0x20
123 #define LSI_DCNTL_PFF 0x40
124 #define LSI_DCNTL_CLSE 0x80
126 #define LSI_DMODE_MAN 0x01
127 #define LSI_DMODE_BOF 0x02
128 #define LSI_DMODE_ERMP 0x04
129 #define LSI_DMODE_ERL 0x08
130 #define LSI_DMODE_DIOM 0x10
131 #define LSI_DMODE_SIOM 0x20
133 #define LSI_CTEST2_DACK 0x01
134 #define LSI_CTEST2_DREQ 0x02
135 #define LSI_CTEST2_TEOP 0x04
136 #define LSI_CTEST2_PCICIE 0x08
137 #define LSI_CTEST2_CM 0x10
138 #define LSI_CTEST2_CIO 0x20
139 #define LSI_CTEST2_SIGP 0x40
140 #define LSI_CTEST2_DDIR 0x80
142 #define LSI_CTEST5_BL2 0x04
143 #define LSI_CTEST5_DDIR 0x08
144 #define LSI_CTEST5_MASR 0x10
145 #define LSI_CTEST5_DFSN 0x20
146 #define LSI_CTEST5_BBCK 0x40
147 #define LSI_CTEST5_ADCK 0x80
149 #define LSI_CCNTL0_DILS 0x01
150 #define LSI_CCNTL0_DISFC 0x10
151 #define LSI_CCNTL0_ENNDJ 0x20
152 #define LSI_CCNTL0_PMJCTL 0x40
153 #define LSI_CCNTL0_ENPMJ 0x80
155 #define LSI_CCNTL1_EN64DBMV 0x01
156 #define LSI_CCNTL1_EN64TIBMV 0x02
157 #define LSI_CCNTL1_64TIMOD 0x04
158 #define LSI_CCNTL1_DDAC 0x08
159 #define LSI_CCNTL1_ZMOD 0x80
161 /* Enable Response to Reselection */
162 #define LSI_SCID_RRE 0x60
164 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
174 /* Maximum length of MSG IN data. */
175 #define LSI_MAX_MSGIN_LEN 8
177 /* Flag set if this is a tagged command. */
178 #define LSI_TAG_VALID (1 << 16)
180 typedef struct lsi_request
{
187 QTAILQ_ENTRY(lsi_request
) next
;
192 PCIDevice parent_obj
;
195 MemoryRegion mmio_io
;
199 int carry
; /* ??? Should this be an a visible register somewhere? */
201 /* Action to take at the end of a MSG IN phase.
202 0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN. */
205 uint8_t msg
[LSI_MAX_MSGIN_LEN
];
206 /* 0 if SCRIPTS are running or stopped.
207 * 1 if a Wait Reselect instruction has been issued.
208 * 2 if processing DMA from lsi_execute_script.
209 * 3 if a DMA operation is in progress. */
213 /* The tag is a combination of the device ID and the SCSI tag. */
215 int command_complete
;
216 QTAILQ_HEAD(, lsi_request
) queue
;
217 lsi_request
*current
;
278 uint32_t scratch
[18]; /* SCRATCHA-SCRATCHR */
281 /* Script ram is stored as 32-bit words in host byteorder. */
282 uint32_t script_ram
[2048];
285 #define TYPE_LSI53C810 "lsi53c810"
286 #define TYPE_LSI53C895A "lsi53c895a"
288 #define LSI53C895A(obj) \
289 OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A)
291 static inline int lsi_irq_on_rsl(LSIState
*s
)
293 return (s
->sien0
& LSI_SIST0_RSL
) && (s
->scid
& LSI_SCID_RRE
);
296 static void lsi_soft_reset(LSIState
*s
)
308 memset(s
->scratch
, 0, sizeof(s
->scratch
));
312 s
->dstat
= LSI_DSTAT_DFE
;
321 s
->ctest2
= LSI_CTEST2_DACK
;
364 assert(QTAILQ_EMPTY(&s
->queue
));
368 static int lsi_dma_40bit(LSIState
*s
)
370 if ((s
->ccntl1
& LSI_CCNTL1_40BIT
) == LSI_CCNTL1_40BIT
)
375 static int lsi_dma_ti64bit(LSIState
*s
)
377 if ((s
->ccntl1
& LSI_CCNTL1_EN64TIBMV
) == LSI_CCNTL1_EN64TIBMV
)
382 static int lsi_dma_64bit(LSIState
*s
)
384 if ((s
->ccntl1
& LSI_CCNTL1_EN64DBMV
) == LSI_CCNTL1_EN64DBMV
)
389 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
);
390 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
);
391 static void lsi_execute_script(LSIState
*s
);
392 static void lsi_reselect(LSIState
*s
, lsi_request
*p
);
394 static inline uint32_t read_dword(LSIState
*s
, uint32_t addr
)
398 pci_dma_read(PCI_DEVICE(s
), addr
, &buf
, 4);
399 return cpu_to_le32(buf
);
402 static void lsi_stop_script(LSIState
*s
)
404 s
->istat1
&= ~LSI_ISTAT1_SRUN
;
407 static void lsi_update_irq(LSIState
*s
)
409 PCIDevice
*d
= PCI_DEVICE(s
);
411 static int last_level
;
414 /* It's unclear whether the DIP/SIP bits should be cleared when the
415 Interrupt Status Registers are cleared or when istat0 is read.
416 We currently do the formwer, which seems to work. */
419 if (s
->dstat
& s
->dien
)
421 s
->istat0
|= LSI_ISTAT0_DIP
;
423 s
->istat0
&= ~LSI_ISTAT0_DIP
;
426 if (s
->sist0
|| s
->sist1
) {
427 if ((s
->sist0
& s
->sien0
) || (s
->sist1
& s
->sien1
))
429 s
->istat0
|= LSI_ISTAT0_SIP
;
431 s
->istat0
&= ~LSI_ISTAT0_SIP
;
433 if (s
->istat0
& LSI_ISTAT0_INTF
)
436 if (level
!= last_level
) {
437 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
438 level
, s
->dstat
, s
->sist1
, s
->sist0
);
441 pci_set_irq(d
, level
);
443 if (!level
&& lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
)) {
444 DPRINTF("Handled IRQs & disconnected, looking for pending "
446 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
455 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
456 static void lsi_script_scsi_interrupt(LSIState
*s
, int stat0
, int stat1
)
461 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
462 stat1
, stat0
, s
->sist1
, s
->sist0
);
465 /* Stop processor on fatal or unmasked interrupt. As a special hack
466 we don't stop processing when raising STO. Instead continue
467 execution and stop at the next insn that accesses the SCSI bus. */
468 mask0
= s
->sien0
| ~(LSI_SIST0_CMP
| LSI_SIST0_SEL
| LSI_SIST0_RSL
);
469 mask1
= s
->sien1
| ~(LSI_SIST1_GEN
| LSI_SIST1_HTH
);
470 mask1
&= ~LSI_SIST1_STO
;
471 if (s
->sist0
& mask0
|| s
->sist1
& mask1
) {
477 /* Stop SCRIPTS execution and raise a DMA interrupt. */
478 static void lsi_script_dma_interrupt(LSIState
*s
, int stat
)
480 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat
, s
->dstat
);
486 static inline void lsi_set_phase(LSIState
*s
, int phase
)
488 s
->sstat1
= (s
->sstat1
& ~PHASE_MASK
) | phase
;
491 static void lsi_bad_phase(LSIState
*s
, int out
, int new_phase
)
493 /* Trigger a phase mismatch. */
494 if (s
->ccntl0
& LSI_CCNTL0_ENPMJ
) {
495 if ((s
->ccntl0
& LSI_CCNTL0_PMJCTL
)) {
496 s
->dsp
= out
? s
->pmjad1
: s
->pmjad2
;
498 s
->dsp
= (s
->scntl2
& LSI_SCNTL2_WSR
? s
->pmjad2
: s
->pmjad1
);
500 DPRINTF("Data phase mismatch jump to %08x\n", s
->dsp
);
502 DPRINTF("Phase mismatch interrupt\n");
503 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
506 lsi_set_phase(s
, new_phase
);
510 /* Resume SCRIPTS execution after a DMA operation. */
511 static void lsi_resume_script(LSIState
*s
)
513 if (s
->waiting
!= 2) {
515 lsi_execute_script(s
);
521 static void lsi_disconnect(LSIState
*s
)
523 s
->scntl1
&= ~LSI_SCNTL1_CON
;
524 s
->sstat1
&= ~PHASE_MASK
;
527 static void lsi_bad_selection(LSIState
*s
, uint32_t id
)
529 DPRINTF("Selected absent target %d\n", id
);
530 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_STO
);
534 /* Initiate a SCSI layer data transfer. */
535 static void lsi_do_dma(LSIState
*s
, int out
)
543 if (!s
->current
->dma_len
) {
544 /* Wait until data is available. */
545 DPRINTF("DMA no data available\n");
549 pci_dev
= PCI_DEVICE(s
);
550 dev
= s
->current
->req
->dev
;
554 if (count
> s
->current
->dma_len
)
555 count
= s
->current
->dma_len
;
558 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
559 if (lsi_dma_40bit(s
) || lsi_dma_ti64bit(s
))
560 addr
|= ((uint64_t)s
->dnad64
<< 32);
562 addr
|= ((uint64_t)s
->dbms
<< 32);
564 addr
|= ((uint64_t)s
->sbms
<< 32);
566 DPRINTF("DMA addr=0x" DMA_ADDR_FMT
" len=%d\n", addr
, count
);
570 if (s
->current
->dma_buf
== NULL
) {
571 s
->current
->dma_buf
= scsi_req_get_buf(s
->current
->req
);
573 /* ??? Set SFBR to first data byte. */
575 pci_dma_read(pci_dev
, addr
, s
->current
->dma_buf
, count
);
577 pci_dma_write(pci_dev
, addr
, s
->current
->dma_buf
, count
);
579 s
->current
->dma_len
-= count
;
580 if (s
->current
->dma_len
== 0) {
581 s
->current
->dma_buf
= NULL
;
582 scsi_req_continue(s
->current
->req
);
584 s
->current
->dma_buf
+= count
;
585 lsi_resume_script(s
);
590 /* Add a command to the queue. */
591 static void lsi_queue_command(LSIState
*s
)
593 lsi_request
*p
= s
->current
;
595 DPRINTF("Queueing tag=0x%x\n", p
->tag
);
596 assert(s
->current
!= NULL
);
597 assert(s
->current
->dma_len
== 0);
598 QTAILQ_INSERT_TAIL(&s
->queue
, s
->current
, next
);
602 p
->out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
605 /* Queue a byte for a MSG IN phase. */
606 static void lsi_add_msg_byte(LSIState
*s
, uint8_t data
)
608 if (s
->msg_len
>= LSI_MAX_MSGIN_LEN
) {
609 BADF("MSG IN data too long\n");
611 DPRINTF("MSG IN 0x%02x\n", data
);
612 s
->msg
[s
->msg_len
++] = data
;
616 /* Perform reselection to continue a command. */
617 static void lsi_reselect(LSIState
*s
, lsi_request
*p
)
621 assert(s
->current
== NULL
);
622 QTAILQ_REMOVE(&s
->queue
, p
, next
);
625 id
= (p
->tag
>> 8) & 0xf;
627 /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
628 if (!(s
->dcntl
& LSI_DCNTL_COM
)) {
629 s
->sfbr
= 1 << (id
& 0x7);
631 DPRINTF("Reselected target %d\n", id
);
632 s
->scntl1
|= LSI_SCNTL1_CON
;
633 lsi_set_phase(s
, PHASE_MI
);
634 s
->msg_action
= p
->out
? 2 : 3;
635 s
->current
->dma_len
= p
->pending
;
636 lsi_add_msg_byte(s
, 0x80);
637 if (s
->current
->tag
& LSI_TAG_VALID
) {
638 lsi_add_msg_byte(s
, 0x20);
639 lsi_add_msg_byte(s
, p
->tag
& 0xff);
642 if (lsi_irq_on_rsl(s
)) {
643 lsi_script_scsi_interrupt(s
, LSI_SIST0_RSL
, 0);
647 static lsi_request
*lsi_find_by_tag(LSIState
*s
, uint32_t tag
)
651 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
660 static void lsi_request_free(LSIState
*s
, lsi_request
*p
)
662 if (p
== s
->current
) {
665 QTAILQ_REMOVE(&s
->queue
, p
, next
);
670 static void lsi_request_cancelled(SCSIRequest
*req
)
672 LSIState
*s
= LSI53C895A(req
->bus
->qbus
.parent
);
673 lsi_request
*p
= req
->hba_private
;
675 req
->hba_private
= NULL
;
676 lsi_request_free(s
, p
);
680 /* Record that data is available for a queued command. Returns zero if
681 the device was reselected, nonzero if the IO is deferred. */
682 static int lsi_queue_req(LSIState
*s
, SCSIRequest
*req
, uint32_t len
)
684 lsi_request
*p
= req
->hba_private
;
687 BADF("Multiple IO pending for request %p\n", p
);
690 /* Reselect if waiting for it, or if reselection triggers an IRQ
692 Since no interrupt stacking is implemented in the emulation, it
693 is also required that there are no pending interrupts waiting
694 for service from the device driver. */
695 if (s
->waiting
== 1 ||
696 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
) &&
697 !(s
->istat0
& (LSI_ISTAT0_SIP
| LSI_ISTAT0_DIP
)))) {
698 /* Reselect device. */
702 DPRINTF("Queueing IO tag=0x%x\n", p
->tag
);
708 /* Callback to indicate that the SCSI layer has completed a command. */
709 static void lsi_command_complete(SCSIRequest
*req
, uint32_t status
, size_t resid
)
711 LSIState
*s
= LSI53C895A(req
->bus
->qbus
.parent
);
714 out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
715 DPRINTF("Command complete status=%d\n", (int)status
);
717 s
->command_complete
= 2;
718 if (s
->waiting
&& s
->dbc
!= 0) {
719 /* Raise phase mismatch for short transfers. */
720 lsi_bad_phase(s
, out
, PHASE_ST
);
722 lsi_set_phase(s
, PHASE_ST
);
725 if (req
->hba_private
== s
->current
) {
726 req
->hba_private
= NULL
;
727 lsi_request_free(s
, s
->current
);
730 lsi_resume_script(s
);
733 /* Callback to indicate that the SCSI layer has completed a transfer. */
734 static void lsi_transfer_data(SCSIRequest
*req
, uint32_t len
)
736 LSIState
*s
= LSI53C895A(req
->bus
->qbus
.parent
);
739 assert(req
->hba_private
);
740 if (s
->waiting
== 1 || req
->hba_private
!= s
->current
||
741 (lsi_irq_on_rsl(s
) && !(s
->scntl1
& LSI_SCNTL1_CON
))) {
742 if (lsi_queue_req(s
, req
, len
)) {
747 out
= (s
->sstat1
& PHASE_MASK
) == PHASE_DO
;
749 /* host adapter (re)connected */
750 DPRINTF("Data ready tag=0x%x len=%d\n", req
->tag
, len
);
751 s
->current
->dma_len
= len
;
752 s
->command_complete
= 1;
754 if (s
->waiting
== 1 || s
->dbc
== 0) {
755 lsi_resume_script(s
);
762 static void lsi_do_command(LSIState
*s
)
769 DPRINTF("Send command len=%d\n", s
->dbc
);
772 pci_dma_read(PCI_DEVICE(s
), s
->dnad
, buf
, s
->dbc
);
774 s
->command_complete
= 0;
776 id
= (s
->select_tag
>> 8) & 0xf;
777 dev
= scsi_device_find(&s
->bus
, 0, id
, s
->current_lun
);
779 lsi_bad_selection(s
, id
);
783 assert(s
->current
== NULL
);
784 s
->current
= g_new0(lsi_request
, 1);
785 s
->current
->tag
= s
->select_tag
;
786 s
->current
->req
= scsi_req_new(dev
, s
->current
->tag
, s
->current_lun
, buf
,
789 n
= scsi_req_enqueue(s
->current
->req
);
792 lsi_set_phase(s
, PHASE_DI
);
794 lsi_set_phase(s
, PHASE_DO
);
796 scsi_req_continue(s
->current
->req
);
798 if (!s
->command_complete
) {
800 /* Command did not complete immediately so disconnect. */
801 lsi_add_msg_byte(s
, 2); /* SAVE DATA POINTER */
802 lsi_add_msg_byte(s
, 4); /* DISCONNECT */
804 lsi_set_phase(s
, PHASE_MI
);
806 lsi_queue_command(s
);
808 /* wait command complete */
809 lsi_set_phase(s
, PHASE_DI
);
814 static void lsi_do_status(LSIState
*s
)
817 DPRINTF("Get status len=%d status=%d\n", s
->dbc
, s
->status
);
819 BADF("Bad Status move\n");
823 pci_dma_write(PCI_DEVICE(s
), s
->dnad
, &status
, 1);
824 lsi_set_phase(s
, PHASE_MI
);
826 lsi_add_msg_byte(s
, 0); /* COMMAND COMPLETE */
829 static void lsi_do_msgin(LSIState
*s
)
832 DPRINTF("Message in len=%d/%d\n", s
->dbc
, s
->msg_len
);
837 pci_dma_write(PCI_DEVICE(s
), s
->dnad
, s
->msg
, len
);
838 /* Linux drivers rely on the last byte being in the SIDL. */
839 s
->sidl
= s
->msg
[len
- 1];
842 memmove(s
->msg
, s
->msg
+ len
, s
->msg_len
);
844 /* ??? Check if ATN (not yet implemented) is asserted and maybe
845 switch to PHASE_MO. */
846 switch (s
->msg_action
) {
848 lsi_set_phase(s
, PHASE_CMD
);
854 lsi_set_phase(s
, PHASE_DO
);
857 lsi_set_phase(s
, PHASE_DI
);
865 /* Read the next byte during a MSGOUT phase. */
866 static uint8_t lsi_get_msgbyte(LSIState
*s
)
869 pci_dma_read(PCI_DEVICE(s
), s
->dnad
, &data
, 1);
875 /* Skip the next n bytes during a MSGOUT phase. */
876 static void lsi_skip_msgbytes(LSIState
*s
, unsigned int n
)
882 static void lsi_do_msgout(LSIState
*s
)
886 uint32_t current_tag
;
887 lsi_request
*current_req
, *p
, *p_next
;
890 current_tag
= s
->current
->tag
;
891 current_req
= s
->current
;
893 current_tag
= s
->select_tag
;
894 current_req
= lsi_find_by_tag(s
, current_tag
);
897 DPRINTF("MSG out len=%d\n", s
->dbc
);
899 msg
= lsi_get_msgbyte(s
);
904 DPRINTF("MSG: Disconnect\n");
908 DPRINTF("MSG: No Operation\n");
909 lsi_set_phase(s
, PHASE_CMD
);
912 len
= lsi_get_msgbyte(s
);
913 msg
= lsi_get_msgbyte(s
);
914 (void)len
; /* avoid a warning about unused variable*/
915 DPRINTF("Extended message 0x%x (len %d)\n", msg
, len
);
918 DPRINTF("SDTR (ignored)\n");
919 lsi_skip_msgbytes(s
, 2);
922 DPRINTF("WDTR (ignored)\n");
923 lsi_skip_msgbytes(s
, 1);
929 case 0x20: /* SIMPLE queue */
930 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
931 DPRINTF("SIMPLE queue tag=0x%x\n", s
->select_tag
& 0xff);
933 case 0x21: /* HEAD of queue */
934 BADF("HEAD queue not implemented\n");
935 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
937 case 0x22: /* ORDERED queue */
938 BADF("ORDERED queue not implemented\n");
939 s
->select_tag
|= lsi_get_msgbyte(s
) | LSI_TAG_VALID
;
942 /* The ABORT TAG message clears the current I/O process only. */
943 DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag
);
945 scsi_req_cancel(current_req
->req
);
952 /* The ABORT message clears all I/O processes for the selecting
953 initiator on the specified logical unit of the target. */
955 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag
);
957 /* The CLEAR QUEUE message clears all I/O processes for all
958 initiators on the specified logical unit of the target. */
960 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag
);
962 /* The BUS DEVICE RESET message clears all I/O processes for all
963 initiators on all logical units of the target. */
965 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag
);
968 /* clear the current I/O process */
970 scsi_req_cancel(s
->current
->req
);
973 /* As the current implemented devices scsi_disk and scsi_generic
974 only support one LUN, we don't need to keep track of LUNs.
975 Clearing I/O processes for other initiators could be possible
976 for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
977 device, but this is currently not implemented (and seems not
978 to be really necessary). So let's simply clear all queued
979 commands for the current device: */
980 QTAILQ_FOREACH_SAFE(p
, &s
->queue
, next
, p_next
) {
981 if ((p
->tag
& 0x0000ff00) == (current_tag
& 0x0000ff00)) {
982 scsi_req_cancel(p
->req
);
989 if ((msg
& 0x80) == 0) {
992 s
->current_lun
= msg
& 7;
993 DPRINTF("Select LUN %d\n", s
->current_lun
);
994 lsi_set_phase(s
, PHASE_CMD
);
1000 BADF("Unimplemented message 0x%02x\n", msg
);
1001 lsi_set_phase(s
, PHASE_MI
);
1002 lsi_add_msg_byte(s
, 7); /* MESSAGE REJECT */
1006 #define LSI_BUF_SIZE 4096
1007 static void lsi_memcpy(LSIState
*s
, uint32_t dest
, uint32_t src
, int count
)
1009 PCIDevice
*d
= PCI_DEVICE(s
);
1011 uint8_t buf
[LSI_BUF_SIZE
];
1013 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest
, src
, count
);
1015 n
= (count
> LSI_BUF_SIZE
) ? LSI_BUF_SIZE
: count
;
1016 pci_dma_read(d
, src
, buf
, n
);
1017 pci_dma_write(d
, dest
, buf
, n
);
1024 static void lsi_wait_reselect(LSIState
*s
)
1028 DPRINTF("Wait Reselect\n");
1030 QTAILQ_FOREACH(p
, &s
->queue
, next
) {
1036 if (s
->current
== NULL
) {
1041 static void lsi_execute_script(LSIState
*s
)
1043 PCIDevice
*pci_dev
= PCI_DEVICE(s
);
1045 uint32_t addr
, addr_high
;
1047 int insn_processed
= 0;
1049 s
->istat1
|= LSI_ISTAT1_SRUN
;
1052 insn
= read_dword(s
, s
->dsp
);
1054 /* If we receive an empty opcode increment the DSP by 4 bytes
1055 instead of 8 and execute the next opcode at that location */
1059 addr
= read_dword(s
, s
->dsp
+ 4);
1061 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s
->dsp
, insn
, addr
);
1063 s
->dcmd
= insn
>> 24;
1065 switch (insn
>> 30) {
1066 case 0: /* Block move. */
1067 if (s
->sist1
& LSI_SIST1_STO
) {
1068 DPRINTF("Delayed select timeout\n");
1072 s
->dbc
= insn
& 0xffffff;
1076 if (insn
& (1 << 29)) {
1077 /* Indirect addressing. */
1078 addr
= read_dword(s
, addr
);
1079 } else if (insn
& (1 << 28)) {
1082 /* Table indirect addressing. */
1084 /* 32-bit Table indirect */
1085 offset
= sextract32(addr
, 0, 24);
1086 pci_dma_read(pci_dev
, s
->dsa
+ offset
, buf
, 8);
1087 /* byte count is stored in bits 0:23 only */
1088 s
->dbc
= cpu_to_le32(buf
[0]) & 0xffffff;
1090 addr
= cpu_to_le32(buf
[1]);
1092 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1093 * table, bits [31:24] */
1094 if (lsi_dma_40bit(s
))
1095 addr_high
= cpu_to_le32(buf
[0]) >> 24;
1096 else if (lsi_dma_ti64bit(s
)) {
1097 int selector
= (cpu_to_le32(buf
[0]) >> 24) & 0x1f;
1100 /* offset index into scratch registers since
1101 * TI64 mode can use registers C to R */
1102 addr_high
= s
->scratch
[2 + selector
];
1105 addr_high
= s
->mmrs
;
1108 addr_high
= s
->mmws
;
1117 addr_high
= s
->sbms
;
1120 addr_high
= s
->dbms
;
1123 BADF("Illegal selector specified (0x%x > 0x15)"
1124 " for 64-bit DMA block move", selector
);
1128 } else if (lsi_dma_64bit(s
)) {
1129 /* fetch a 3rd dword if 64-bit direct move is enabled and
1130 only if we're not doing table indirect or indirect addressing */
1131 s
->dbms
= read_dword(s
, s
->dsp
);
1133 s
->ia
= s
->dsp
- 12;
1135 if ((s
->sstat1
& PHASE_MASK
) != ((insn
>> 24) & 7)) {
1136 DPRINTF("Wrong phase got %d expected %d\n",
1137 s
->sstat1
& PHASE_MASK
, (insn
>> 24) & 7);
1138 lsi_script_scsi_interrupt(s
, LSI_SIST0_MA
, 0);
1142 s
->dnad64
= addr_high
;
1143 switch (s
->sstat1
& 0x7) {
1169 BADF("Unimplemented phase %d\n", s
->sstat1
& PHASE_MASK
);
1172 s
->dfifo
= s
->dbc
& 0xff;
1173 s
->ctest5
= (s
->ctest5
& 0xfc) | ((s
->dbc
>> 8) & 3);
1176 s
->ua
= addr
+ s
->dbc
;
1179 case 1: /* IO or Read/Write instruction. */
1180 opcode
= (insn
>> 27) & 7;
1184 if (insn
& (1 << 25)) {
1185 id
= read_dword(s
, s
->dsa
+ sextract32(insn
, 0, 24));
1189 id
= (id
>> 16) & 0xf;
1190 if (insn
& (1 << 26)) {
1191 addr
= s
->dsp
+ sextract32(addr
, 0, 24);
1195 case 0: /* Select */
1197 if (s
->scntl1
& LSI_SCNTL1_CON
) {
1198 DPRINTF("Already reselected, jumping to alternative address\n");
1202 s
->sstat0
|= LSI_SSTAT0_WOA
;
1203 s
->scntl1
&= ~LSI_SCNTL1_IARB
;
1204 if (!scsi_device_find(&s
->bus
, 0, id
, 0)) {
1205 lsi_bad_selection(s
, id
);
1208 DPRINTF("Selected target %d%s\n",
1209 id
, insn
& (1 << 3) ? " ATN" : "");
1210 /* ??? Linux drivers compain when this is set. Maybe
1211 it only applies in low-level mode (unimplemented).
1212 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1213 s
->select_tag
= id
<< 8;
1214 s
->scntl1
|= LSI_SCNTL1_CON
;
1215 if (insn
& (1 << 3)) {
1216 s
->socl
|= LSI_SOCL_ATN
;
1218 lsi_set_phase(s
, PHASE_MO
);
1220 case 1: /* Disconnect */
1221 DPRINTF("Wait Disconnect\n");
1222 s
->scntl1
&= ~LSI_SCNTL1_CON
;
1224 case 2: /* Wait Reselect */
1225 if (!lsi_irq_on_rsl(s
)) {
1226 lsi_wait_reselect(s
);
1230 DPRINTF("Set%s%s%s%s\n",
1231 insn
& (1 << 3) ? " ATN" : "",
1232 insn
& (1 << 6) ? " ACK" : "",
1233 insn
& (1 << 9) ? " TM" : "",
1234 insn
& (1 << 10) ? " CC" : "");
1235 if (insn
& (1 << 3)) {
1236 s
->socl
|= LSI_SOCL_ATN
;
1237 lsi_set_phase(s
, PHASE_MO
);
1239 if (insn
& (1 << 9)) {
1240 BADF("Target mode not implemented\n");
1243 if (insn
& (1 << 10))
1247 DPRINTF("Clear%s%s%s%s\n",
1248 insn
& (1 << 3) ? " ATN" : "",
1249 insn
& (1 << 6) ? " ACK" : "",
1250 insn
& (1 << 9) ? " TM" : "",
1251 insn
& (1 << 10) ? " CC" : "");
1252 if (insn
& (1 << 3)) {
1253 s
->socl
&= ~LSI_SOCL_ATN
;
1255 if (insn
& (1 << 10))
1266 static const char *opcode_names
[3] =
1267 {"Write", "Read", "Read-Modify-Write"};
1268 static const char *operator_names
[8] =
1269 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1272 reg
= ((insn
>> 16) & 0x7f) | (insn
& 0x80);
1273 data8
= (insn
>> 8) & 0xff;
1274 opcode
= (insn
>> 27) & 7;
1275 operator = (insn
>> 24) & 7;
1276 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1277 opcode_names
[opcode
- 5], reg
,
1278 operator_names
[operator], data8
, s
->sfbr
,
1279 (insn
& (1 << 23)) ? " SFBR" : "");
1282 case 5: /* From SFBR */
1286 case 6: /* To SFBR */
1288 op0
= lsi_reg_readb(s
, reg
);
1291 case 7: /* Read-modify-write */
1293 op0
= lsi_reg_readb(s
, reg
);
1294 if (insn
& (1 << 23)) {
1306 case 1: /* Shift left */
1308 op0
= (op0
<< 1) | s
->carry
;
1322 op0
= (op0
>> 1) | (s
->carry
<< 7);
1327 s
->carry
= op0
< op1
;
1330 op0
+= op1
+ s
->carry
;
1332 s
->carry
= op0
<= op1
;
1334 s
->carry
= op0
< op1
;
1339 case 5: /* From SFBR */
1340 case 7: /* Read-modify-write */
1341 lsi_reg_writeb(s
, reg
, op0
);
1343 case 6: /* To SFBR */
1350 case 2: /* Transfer Control. */
1355 if ((insn
& 0x002e0000) == 0) {
1359 if (s
->sist1
& LSI_SIST1_STO
) {
1360 DPRINTF("Delayed select timeout\n");
1364 cond
= jmp
= (insn
& (1 << 19)) != 0;
1365 if (cond
== jmp
&& (insn
& (1 << 21))) {
1366 DPRINTF("Compare carry %d\n", s
->carry
== jmp
);
1367 cond
= s
->carry
!= 0;
1369 if (cond
== jmp
&& (insn
& (1 << 17))) {
1370 DPRINTF("Compare phase %d %c= %d\n",
1371 (s
->sstat1
& PHASE_MASK
),
1373 ((insn
>> 24) & 7));
1374 cond
= (s
->sstat1
& PHASE_MASK
) == ((insn
>> 24) & 7);
1376 if (cond
== jmp
&& (insn
& (1 << 18))) {
1379 mask
= (~insn
>> 8) & 0xff;
1380 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1381 s
->sfbr
, mask
, jmp
? '=' : '!', insn
& mask
);
1382 cond
= (s
->sfbr
& mask
) == (insn
& mask
);
1385 if (insn
& (1 << 23)) {
1386 /* Relative address. */
1387 addr
= s
->dsp
+ sextract32(addr
, 0, 24);
1389 switch ((insn
>> 27) & 7) {
1391 DPRINTF("Jump to 0x%08x\n", addr
);
1395 DPRINTF("Call 0x%08x\n", addr
);
1399 case 2: /* Return */
1400 DPRINTF("Return to 0x%08x\n", s
->temp
);
1403 case 3: /* Interrupt */
1404 DPRINTF("Interrupt 0x%08x\n", s
->dsps
);
1405 if ((insn
& (1 << 20)) != 0) {
1406 s
->istat0
|= LSI_ISTAT0_INTF
;
1409 lsi_script_dma_interrupt(s
, LSI_DSTAT_SIR
);
1413 DPRINTF("Illegal transfer control\n");
1414 lsi_script_dma_interrupt(s
, LSI_DSTAT_IID
);
1418 DPRINTF("Control condition failed\n");
1424 if ((insn
& (1 << 29)) == 0) {
1427 /* ??? The docs imply the destination address is loaded into
1428 the TEMP register. However the Linux drivers rely on
1429 the value being presrved. */
1430 dest
= read_dword(s
, s
->dsp
);
1432 lsi_memcpy(s
, dest
, addr
, insn
& 0xffffff);
1439 if (insn
& (1 << 28)) {
1440 addr
= s
->dsa
+ sextract32(addr
, 0, 24);
1443 reg
= (insn
>> 16) & 0xff;
1444 if (insn
& (1 << 24)) {
1445 pci_dma_read(pci_dev
, addr
, data
, n
);
1446 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg
, n
,
1447 addr
, *(int *)data
);
1448 for (i
= 0; i
< n
; i
++) {
1449 lsi_reg_writeb(s
, reg
+ i
, data
[i
]);
1452 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg
, n
, addr
);
1453 for (i
= 0; i
< n
; i
++) {
1454 data
[i
] = lsi_reg_readb(s
, reg
+ i
);
1456 pci_dma_write(pci_dev
, addr
, data
, n
);
1460 if (insn_processed
> 10000 && !s
->waiting
) {
1461 /* Some windows drivers make the device spin waiting for a memory
1462 location to change. If we have been executed a lot of code then
1463 assume this is the case and force an unexpected device disconnect.
1464 This is apparently sufficient to beat the drivers into submission.
1466 if (!(s
->sien0
& LSI_SIST0_UDC
))
1467 fprintf(stderr
, "inf. loop with UDC masked\n");
1468 lsi_script_scsi_interrupt(s
, LSI_SIST0_UDC
, 0);
1470 } else if (s
->istat1
& LSI_ISTAT1_SRUN
&& !s
->waiting
) {
1471 if (s
->dcntl
& LSI_DCNTL_SSM
) {
1472 lsi_script_dma_interrupt(s
, LSI_DSTAT_SSI
);
1477 DPRINTF("SCRIPTS execution stopped\n");
1480 static uint8_t lsi_reg_readb(LSIState
*s
, int offset
)
1483 #define CASE_GET_REG24(name, addr) \
1484 case addr: return s->name & 0xff; \
1485 case addr + 1: return (s->name >> 8) & 0xff; \
1486 case addr + 2: return (s->name >> 16) & 0xff;
1488 #define CASE_GET_REG32(name, addr) \
1489 case addr: return s->name & 0xff; \
1490 case addr + 1: return (s->name >> 8) & 0xff; \
1491 case addr + 2: return (s->name >> 16) & 0xff; \
1492 case addr + 3: return (s->name >> 24) & 0xff;
1494 #ifdef DEBUG_LSI_REG
1495 DPRINTF("Read reg %x\n", offset
);
1498 case 0x00: /* SCNTL0 */
1500 case 0x01: /* SCNTL1 */
1502 case 0x02: /* SCNTL2 */
1504 case 0x03: /* SCNTL3 */
1506 case 0x04: /* SCID */
1508 case 0x05: /* SXFER */
1510 case 0x06: /* SDID */
1512 case 0x07: /* GPREG0 */
1514 case 0x08: /* Revision ID */
1516 case 0xa: /* SSID */
1518 case 0xb: /* SBCL */
1519 /* ??? This is not correct. However it's (hopefully) only
1520 used for diagnostics, so should be ok. */
1522 case 0xc: /* DSTAT */
1523 tmp
= s
->dstat
| LSI_DSTAT_DFE
;
1524 if ((s
->istat0
& LSI_ISTAT0_INTF
) == 0)
1528 case 0x0d: /* SSTAT0 */
1530 case 0x0e: /* SSTAT1 */
1532 case 0x0f: /* SSTAT2 */
1533 return s
->scntl1
& LSI_SCNTL1_CON
? 0 : 2;
1534 CASE_GET_REG32(dsa
, 0x10)
1535 case 0x14: /* ISTAT0 */
1537 case 0x15: /* ISTAT1 */
1539 case 0x16: /* MBOX0 */
1541 case 0x17: /* MBOX1 */
1543 case 0x18: /* CTEST0 */
1545 case 0x19: /* CTEST1 */
1547 case 0x1a: /* CTEST2 */
1548 tmp
= s
->ctest2
| LSI_CTEST2_DACK
| LSI_CTEST2_CM
;
1549 if (s
->istat0
& LSI_ISTAT0_SIGP
) {
1550 s
->istat0
&= ~LSI_ISTAT0_SIGP
;
1551 tmp
|= LSI_CTEST2_SIGP
;
1554 case 0x1b: /* CTEST3 */
1556 CASE_GET_REG32(temp
, 0x1c)
1557 case 0x20: /* DFIFO */
1559 case 0x21: /* CTEST4 */
1561 case 0x22: /* CTEST5 */
1563 case 0x23: /* CTEST6 */
1565 CASE_GET_REG24(dbc
, 0x24)
1566 case 0x27: /* DCMD */
1568 CASE_GET_REG32(dnad
, 0x28)
1569 CASE_GET_REG32(dsp
, 0x2c)
1570 CASE_GET_REG32(dsps
, 0x30)
1571 CASE_GET_REG32(scratch
[0], 0x34)
1572 case 0x38: /* DMODE */
1574 case 0x39: /* DIEN */
1576 case 0x3a: /* SBR */
1578 case 0x3b: /* DCNTL */
1580 case 0x40: /* SIEN0 */
1582 case 0x41: /* SIEN1 */
1584 case 0x42: /* SIST0 */
1589 case 0x43: /* SIST1 */
1594 case 0x46: /* MACNTL */
1596 case 0x47: /* GPCNTL0 */
1598 case 0x48: /* STIME0 */
1600 case 0x4a: /* RESPID0 */
1602 case 0x4b: /* RESPID1 */
1604 case 0x4d: /* STEST1 */
1606 case 0x4e: /* STEST2 */
1608 case 0x4f: /* STEST3 */
1610 case 0x50: /* SIDL */
1611 /* This is needed by the linux drivers. We currently only update it
1612 during the MSG IN phase. */
1614 case 0x52: /* STEST4 */
1616 case 0x56: /* CCNTL0 */
1618 case 0x57: /* CCNTL1 */
1620 case 0x58: /* SBDL */
1621 /* Some drivers peek at the data bus during the MSG IN phase. */
1622 if ((s
->sstat1
& PHASE_MASK
) == PHASE_MI
)
1625 case 0x59: /* SBDL high */
1627 CASE_GET_REG32(mmrs
, 0xa0)
1628 CASE_GET_REG32(mmws
, 0xa4)
1629 CASE_GET_REG32(sfs
, 0xa8)
1630 CASE_GET_REG32(drs
, 0xac)
1631 CASE_GET_REG32(sbms
, 0xb0)
1632 CASE_GET_REG32(dbms
, 0xb4)
1633 CASE_GET_REG32(dnad64
, 0xb8)
1634 CASE_GET_REG32(pmjad1
, 0xc0)
1635 CASE_GET_REG32(pmjad2
, 0xc4)
1636 CASE_GET_REG32(rbc
, 0xc8)
1637 CASE_GET_REG32(ua
, 0xcc)
1638 CASE_GET_REG32(ia
, 0xd4)
1639 CASE_GET_REG32(sbc
, 0xd8)
1640 CASE_GET_REG32(csbc
, 0xdc)
1642 if (offset
>= 0x5c && offset
< 0xa0) {
1645 n
= (offset
- 0x58) >> 2;
1646 shift
= (offset
& 3) * 8;
1647 return (s
->scratch
[n
] >> shift
) & 0xff;
1649 BADF("readb 0x%x\n", offset
);
1651 #undef CASE_GET_REG24
1652 #undef CASE_GET_REG32
1655 static void lsi_reg_writeb(LSIState
*s
, int offset
, uint8_t val
)
1657 #define CASE_SET_REG24(name, addr) \
1658 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1659 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1660 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1662 #define CASE_SET_REG32(name, addr) \
1663 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1664 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1665 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1666 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1668 #ifdef DEBUG_LSI_REG
1669 DPRINTF("Write reg %x = %02x\n", offset
, val
);
1672 case 0x00: /* SCNTL0 */
1674 if (val
& LSI_SCNTL0_START
) {
1675 BADF("Start sequence not implemented\n");
1678 case 0x01: /* SCNTL1 */
1679 s
->scntl1
= val
& ~LSI_SCNTL1_SST
;
1680 if (val
& LSI_SCNTL1_IARB
) {
1681 BADF("Immediate Arbritration not implemented\n");
1683 if (val
& LSI_SCNTL1_RST
) {
1684 if (!(s
->sstat0
& LSI_SSTAT0_RST
)) {
1685 qbus_reset_all(&s
->bus
.qbus
);
1686 s
->sstat0
|= LSI_SSTAT0_RST
;
1687 lsi_script_scsi_interrupt(s
, LSI_SIST0_RST
, 0);
1690 s
->sstat0
&= ~LSI_SSTAT0_RST
;
1693 case 0x02: /* SCNTL2 */
1694 val
&= ~(LSI_SCNTL2_WSR
| LSI_SCNTL2_WSS
);
1697 case 0x03: /* SCNTL3 */
1700 case 0x04: /* SCID */
1703 case 0x05: /* SXFER */
1706 case 0x06: /* SDID */
1707 if ((s
->ssid
& 0x80) && (val
& 0xf) != (s
->ssid
& 0xf)) {
1708 BADF("Destination ID does not match SSID\n");
1710 s
->sdid
= val
& 0xf;
1712 case 0x07: /* GPREG0 */
1714 case 0x08: /* SFBR */
1715 /* The CPU is not allowed to write to this register. However the
1716 SCRIPTS register move instructions are. */
1719 case 0x0a: case 0x0b:
1720 /* Openserver writes to these readonly registers on startup */
1722 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1723 /* Linux writes to these readonly registers on startup. */
1725 CASE_SET_REG32(dsa
, 0x10)
1726 case 0x14: /* ISTAT0 */
1727 s
->istat0
= (s
->istat0
& 0x0f) | (val
& 0xf0);
1728 if (val
& LSI_ISTAT0_ABRT
) {
1729 lsi_script_dma_interrupt(s
, LSI_DSTAT_ABRT
);
1731 if (val
& LSI_ISTAT0_INTF
) {
1732 s
->istat0
&= ~LSI_ISTAT0_INTF
;
1735 if (s
->waiting
== 1 && val
& LSI_ISTAT0_SIGP
) {
1736 DPRINTF("Woken by SIGP\n");
1739 lsi_execute_script(s
);
1741 if (val
& LSI_ISTAT0_SRST
) {
1742 qdev_reset_all(DEVICE(s
));
1745 case 0x16: /* MBOX0 */
1748 case 0x17: /* MBOX1 */
1751 case 0x18: /* CTEST0 */
1754 case 0x1a: /* CTEST2 */
1755 s
->ctest2
= val
& LSI_CTEST2_PCICIE
;
1757 case 0x1b: /* CTEST3 */
1758 s
->ctest3
= val
& 0x0f;
1760 CASE_SET_REG32(temp
, 0x1c)
1761 case 0x21: /* CTEST4 */
1763 BADF("Unimplemented CTEST4-FBL 0x%x\n", val
);
1767 case 0x22: /* CTEST5 */
1768 if (val
& (LSI_CTEST5_ADCK
| LSI_CTEST5_BBCK
)) {
1769 BADF("CTEST5 DMA increment not implemented\n");
1773 CASE_SET_REG24(dbc
, 0x24)
1774 CASE_SET_REG32(dnad
, 0x28)
1775 case 0x2c: /* DSP[0:7] */
1776 s
->dsp
&= 0xffffff00;
1779 case 0x2d: /* DSP[8:15] */
1780 s
->dsp
&= 0xffff00ff;
1783 case 0x2e: /* DSP[16:23] */
1784 s
->dsp
&= 0xff00ffff;
1785 s
->dsp
|= val
<< 16;
1787 case 0x2f: /* DSP[24:31] */
1788 s
->dsp
&= 0x00ffffff;
1789 s
->dsp
|= val
<< 24;
1790 if ((s
->dmode
& LSI_DMODE_MAN
) == 0
1791 && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1792 lsi_execute_script(s
);
1794 CASE_SET_REG32(dsps
, 0x30)
1795 CASE_SET_REG32(scratch
[0], 0x34)
1796 case 0x38: /* DMODE */
1797 if (val
& (LSI_DMODE_SIOM
| LSI_DMODE_DIOM
)) {
1798 BADF("IO mappings not implemented\n");
1802 case 0x39: /* DIEN */
1806 case 0x3a: /* SBR */
1809 case 0x3b: /* DCNTL */
1810 s
->dcntl
= val
& ~(LSI_DCNTL_PFF
| LSI_DCNTL_STD
);
1811 if ((val
& LSI_DCNTL_STD
) && (s
->istat1
& LSI_ISTAT1_SRUN
) == 0)
1812 lsi_execute_script(s
);
1814 case 0x40: /* SIEN0 */
1818 case 0x41: /* SIEN1 */
1822 case 0x47: /* GPCNTL0 */
1824 case 0x48: /* STIME0 */
1827 case 0x49: /* STIME1 */
1829 DPRINTF("General purpose timer not implemented\n");
1830 /* ??? Raising the interrupt immediately seems to be sufficient
1831 to keep the FreeBSD driver happy. */
1832 lsi_script_scsi_interrupt(s
, 0, LSI_SIST1_GEN
);
1835 case 0x4a: /* RESPID0 */
1838 case 0x4b: /* RESPID1 */
1841 case 0x4d: /* STEST1 */
1844 case 0x4e: /* STEST2 */
1846 BADF("Low level mode not implemented\n");
1850 case 0x4f: /* STEST3 */
1852 BADF("SCSI FIFO test mode not implemented\n");
1856 case 0x56: /* CCNTL0 */
1859 case 0x57: /* CCNTL1 */
1862 CASE_SET_REG32(mmrs
, 0xa0)
1863 CASE_SET_REG32(mmws
, 0xa4)
1864 CASE_SET_REG32(sfs
, 0xa8)
1865 CASE_SET_REG32(drs
, 0xac)
1866 CASE_SET_REG32(sbms
, 0xb0)
1867 CASE_SET_REG32(dbms
, 0xb4)
1868 CASE_SET_REG32(dnad64
, 0xb8)
1869 CASE_SET_REG32(pmjad1
, 0xc0)
1870 CASE_SET_REG32(pmjad2
, 0xc4)
1871 CASE_SET_REG32(rbc
, 0xc8)
1872 CASE_SET_REG32(ua
, 0xcc)
1873 CASE_SET_REG32(ia
, 0xd4)
1874 CASE_SET_REG32(sbc
, 0xd8)
1875 CASE_SET_REG32(csbc
, 0xdc)
1877 if (offset
>= 0x5c && offset
< 0xa0) {
1880 n
= (offset
- 0x58) >> 2;
1881 shift
= (offset
& 3) * 8;
1882 s
->scratch
[n
] = deposit32(s
->scratch
[n
], shift
, 8, val
);
1884 BADF("Unhandled writeb 0x%x = 0x%x\n", offset
, val
);
1887 #undef CASE_SET_REG24
1888 #undef CASE_SET_REG32
1891 static void lsi_mmio_write(void *opaque
, hwaddr addr
,
1892 uint64_t val
, unsigned size
)
1894 LSIState
*s
= opaque
;
1896 lsi_reg_writeb(s
, addr
& 0xff, val
);
1899 static uint64_t lsi_mmio_read(void *opaque
, hwaddr addr
,
1902 LSIState
*s
= opaque
;
1904 return lsi_reg_readb(s
, addr
& 0xff);
1907 static const MemoryRegionOps lsi_mmio_ops
= {
1908 .read
= lsi_mmio_read
,
1909 .write
= lsi_mmio_write
,
1910 .endianness
= DEVICE_NATIVE_ENDIAN
,
1912 .min_access_size
= 1,
1913 .max_access_size
= 1,
1917 static void lsi_ram_write(void *opaque
, hwaddr addr
,
1918 uint64_t val
, unsigned size
)
1920 LSIState
*s
= opaque
;
1925 newval
= s
->script_ram
[addr
>> 2];
1926 shift
= (addr
& 3) * 8;
1927 mask
= ((uint64_t)1 << (size
* 8)) - 1;
1928 newval
&= ~(mask
<< shift
);
1929 newval
|= val
<< shift
;
1930 s
->script_ram
[addr
>> 2] = newval
;
1933 static uint64_t lsi_ram_read(void *opaque
, hwaddr addr
,
1936 LSIState
*s
= opaque
;
1940 val
= s
->script_ram
[addr
>> 2];
1941 mask
= ((uint64_t)1 << (size
* 8)) - 1;
1942 val
>>= (addr
& 3) * 8;
1946 static const MemoryRegionOps lsi_ram_ops
= {
1947 .read
= lsi_ram_read
,
1948 .write
= lsi_ram_write
,
1949 .endianness
= DEVICE_NATIVE_ENDIAN
,
1952 static uint64_t lsi_io_read(void *opaque
, hwaddr addr
,
1955 LSIState
*s
= opaque
;
1956 return lsi_reg_readb(s
, addr
& 0xff);
1959 static void lsi_io_write(void *opaque
, hwaddr addr
,
1960 uint64_t val
, unsigned size
)
1962 LSIState
*s
= opaque
;
1963 lsi_reg_writeb(s
, addr
& 0xff, val
);
1966 static const MemoryRegionOps lsi_io_ops
= {
1967 .read
= lsi_io_read
,
1968 .write
= lsi_io_write
,
1969 .endianness
= DEVICE_NATIVE_ENDIAN
,
1971 .min_access_size
= 1,
1972 .max_access_size
= 1,
1976 static void lsi_scsi_reset(DeviceState
*dev
)
1978 LSIState
*s
= LSI53C895A(dev
);
1983 static void lsi_pre_save(void *opaque
)
1985 LSIState
*s
= opaque
;
1988 assert(s
->current
->dma_buf
== NULL
);
1989 assert(s
->current
->dma_len
== 0);
1991 assert(QTAILQ_EMPTY(&s
->queue
));
1994 static const VMStateDescription vmstate_lsi_scsi
= {
1997 .minimum_version_id
= 0,
1998 .pre_save
= lsi_pre_save
,
1999 .fields
= (VMStateField
[]) {
2000 VMSTATE_PCI_DEVICE(parent_obj
, LSIState
),
2002 VMSTATE_INT32(carry
, LSIState
),
2003 VMSTATE_INT32(status
, LSIState
),
2004 VMSTATE_INT32(msg_action
, LSIState
),
2005 VMSTATE_INT32(msg_len
, LSIState
),
2006 VMSTATE_BUFFER(msg
, LSIState
),
2007 VMSTATE_INT32(waiting
, LSIState
),
2009 VMSTATE_UINT32(dsa
, LSIState
),
2010 VMSTATE_UINT32(temp
, LSIState
),
2011 VMSTATE_UINT32(dnad
, LSIState
),
2012 VMSTATE_UINT32(dbc
, LSIState
),
2013 VMSTATE_UINT8(istat0
, LSIState
),
2014 VMSTATE_UINT8(istat1
, LSIState
),
2015 VMSTATE_UINT8(dcmd
, LSIState
),
2016 VMSTATE_UINT8(dstat
, LSIState
),
2017 VMSTATE_UINT8(dien
, LSIState
),
2018 VMSTATE_UINT8(sist0
, LSIState
),
2019 VMSTATE_UINT8(sist1
, LSIState
),
2020 VMSTATE_UINT8(sien0
, LSIState
),
2021 VMSTATE_UINT8(sien1
, LSIState
),
2022 VMSTATE_UINT8(mbox0
, LSIState
),
2023 VMSTATE_UINT8(mbox1
, LSIState
),
2024 VMSTATE_UINT8(dfifo
, LSIState
),
2025 VMSTATE_UINT8(ctest2
, LSIState
),
2026 VMSTATE_UINT8(ctest3
, LSIState
),
2027 VMSTATE_UINT8(ctest4
, LSIState
),
2028 VMSTATE_UINT8(ctest5
, LSIState
),
2029 VMSTATE_UINT8(ccntl0
, LSIState
),
2030 VMSTATE_UINT8(ccntl1
, LSIState
),
2031 VMSTATE_UINT32(dsp
, LSIState
),
2032 VMSTATE_UINT32(dsps
, LSIState
),
2033 VMSTATE_UINT8(dmode
, LSIState
),
2034 VMSTATE_UINT8(dcntl
, LSIState
),
2035 VMSTATE_UINT8(scntl0
, LSIState
),
2036 VMSTATE_UINT8(scntl1
, LSIState
),
2037 VMSTATE_UINT8(scntl2
, LSIState
),
2038 VMSTATE_UINT8(scntl3
, LSIState
),
2039 VMSTATE_UINT8(sstat0
, LSIState
),
2040 VMSTATE_UINT8(sstat1
, LSIState
),
2041 VMSTATE_UINT8(scid
, LSIState
),
2042 VMSTATE_UINT8(sxfer
, LSIState
),
2043 VMSTATE_UINT8(socl
, LSIState
),
2044 VMSTATE_UINT8(sdid
, LSIState
),
2045 VMSTATE_UINT8(ssid
, LSIState
),
2046 VMSTATE_UINT8(sfbr
, LSIState
),
2047 VMSTATE_UINT8(stest1
, LSIState
),
2048 VMSTATE_UINT8(stest2
, LSIState
),
2049 VMSTATE_UINT8(stest3
, LSIState
),
2050 VMSTATE_UINT8(sidl
, LSIState
),
2051 VMSTATE_UINT8(stime0
, LSIState
),
2052 VMSTATE_UINT8(respid0
, LSIState
),
2053 VMSTATE_UINT8(respid1
, LSIState
),
2054 VMSTATE_UINT32(mmrs
, LSIState
),
2055 VMSTATE_UINT32(mmws
, LSIState
),
2056 VMSTATE_UINT32(sfs
, LSIState
),
2057 VMSTATE_UINT32(drs
, LSIState
),
2058 VMSTATE_UINT32(sbms
, LSIState
),
2059 VMSTATE_UINT32(dbms
, LSIState
),
2060 VMSTATE_UINT32(dnad64
, LSIState
),
2061 VMSTATE_UINT32(pmjad1
, LSIState
),
2062 VMSTATE_UINT32(pmjad2
, LSIState
),
2063 VMSTATE_UINT32(rbc
, LSIState
),
2064 VMSTATE_UINT32(ua
, LSIState
),
2065 VMSTATE_UINT32(ia
, LSIState
),
2066 VMSTATE_UINT32(sbc
, LSIState
),
2067 VMSTATE_UINT32(csbc
, LSIState
),
2068 VMSTATE_BUFFER_UNSAFE(scratch
, LSIState
, 0, 18 * sizeof(uint32_t)),
2069 VMSTATE_UINT8(sbr
, LSIState
),
2071 VMSTATE_BUFFER_UNSAFE(script_ram
, LSIState
, 0, 2048 * sizeof(uint32_t)),
2072 VMSTATE_END_OF_LIST()
2076 static const struct SCSIBusInfo lsi_scsi_info
= {
2078 .max_target
= LSI_MAX_DEVS
,
2079 .max_lun
= 0, /* LUN support is buggy */
2081 .transfer_data
= lsi_transfer_data
,
2082 .complete
= lsi_command_complete
,
2083 .cancel
= lsi_request_cancelled
2086 static int lsi_scsi_init(PCIDevice
*dev
)
2088 LSIState
*s
= LSI53C895A(dev
);
2089 DeviceState
*d
= DEVICE(dev
);
2093 pci_conf
= dev
->config
;
2095 /* PCI latency timer = 255 */
2096 pci_conf
[PCI_LATENCY_TIMER
] = 0xff;
2097 /* Interrupt pin A */
2098 pci_conf
[PCI_INTERRUPT_PIN
] = 0x01;
2100 memory_region_init_io(&s
->mmio_io
, OBJECT(s
), &lsi_mmio_ops
, s
,
2102 memory_region_init_io(&s
->ram_io
, OBJECT(s
), &lsi_ram_ops
, s
,
2104 memory_region_init_io(&s
->io_io
, OBJECT(s
), &lsi_io_ops
, s
,
2107 pci_register_bar(dev
, 0, PCI_BASE_ADDRESS_SPACE_IO
, &s
->io_io
);
2108 pci_register_bar(dev
, 1, PCI_BASE_ADDRESS_SPACE_MEMORY
, &s
->mmio_io
);
2109 pci_register_bar(dev
, 2, PCI_BASE_ADDRESS_SPACE_MEMORY
, &s
->ram_io
);
2110 QTAILQ_INIT(&s
->queue
);
2112 scsi_bus_new(&s
->bus
, sizeof(s
->bus
), d
, &lsi_scsi_info
, NULL
);
2113 if (!d
->hotplugged
) {
2114 scsi_bus_legacy_handle_cmdline(&s
->bus
, &err
);
2123 static void lsi_class_init(ObjectClass
*klass
, void *data
)
2125 DeviceClass
*dc
= DEVICE_CLASS(klass
);
2126 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
2128 k
->init
= lsi_scsi_init
;
2129 k
->vendor_id
= PCI_VENDOR_ID_LSI_LOGIC
;
2130 k
->device_id
= PCI_DEVICE_ID_LSI_53C895A
;
2131 k
->class_id
= PCI_CLASS_STORAGE_SCSI
;
2132 k
->subsystem_id
= 0x1000;
2133 dc
->reset
= lsi_scsi_reset
;
2134 dc
->vmsd
= &vmstate_lsi_scsi
;
2135 set_bit(DEVICE_CATEGORY_STORAGE
, dc
->categories
);
2138 static const TypeInfo lsi_info
= {
2139 .name
= TYPE_LSI53C895A
,
2140 .parent
= TYPE_PCI_DEVICE
,
2141 .instance_size
= sizeof(LSIState
),
2142 .class_init
= lsi_class_init
,
2145 static void lsi53c810_class_init(ObjectClass
*klass
, void *data
)
2147 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
2149 k
->device_id
= PCI_DEVICE_ID_LSI_53C810
;
2152 static TypeInfo lsi53c810_info
= {
2153 .name
= TYPE_LSI53C810
,
2154 .parent
= TYPE_LSI53C895A
,
2155 .class_init
= lsi53c810_class_init
,
2158 static void lsi53c895a_register_types(void)
2160 type_register_static(&lsi_info
);
2161 type_register_static(&lsi53c810_info
);
2164 type_init(lsi53c895a_register_types
)