2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
15 #include "scsi-disk.h"
16 #include "block_int.h"
19 //#define DEBUG_LSI_REG
22 #define DPRINTF(fmt, ...) \
23 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
24 #define BADF(fmt, ...) \
25 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
27 #define DPRINTF(fmt, ...) do {} while(0)
28 #define BADF(fmt, ...) \
29 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
32 #define LSI_SCNTL0_TRG 0x01
33 #define LSI_SCNTL0_AAP 0x02
34 #define LSI_SCNTL0_EPC 0x08
35 #define LSI_SCNTL0_WATN 0x10
36 #define LSI_SCNTL0_START 0x20
38 #define LSI_SCNTL1_SST 0x01
39 #define LSI_SCNTL1_IARB 0x02
40 #define LSI_SCNTL1_AESP 0x04
41 #define LSI_SCNTL1_RST 0x08
42 #define LSI_SCNTL1_CON 0x10
43 #define LSI_SCNTL1_DHP 0x20
44 #define LSI_SCNTL1_ADB 0x40
45 #define LSI_SCNTL1_EXC 0x80
47 #define LSI_SCNTL2_WSR 0x01
48 #define LSI_SCNTL2_VUE0 0x02
49 #define LSI_SCNTL2_VUE1 0x04
50 #define LSI_SCNTL2_WSS 0x08
51 #define LSI_SCNTL2_SLPHBEN 0x10
52 #define LSI_SCNTL2_SLPMD 0x20
53 #define LSI_SCNTL2_CHM 0x40
54 #define LSI_SCNTL2_SDU 0x80
56 #define LSI_ISTAT0_DIP 0x01
57 #define LSI_ISTAT0_SIP 0x02
58 #define LSI_ISTAT0_INTF 0x04
59 #define LSI_ISTAT0_CON 0x08
60 #define LSI_ISTAT0_SEM 0x10
61 #define LSI_ISTAT0_SIGP 0x20
62 #define LSI_ISTAT0_SRST 0x40
63 #define LSI_ISTAT0_ABRT 0x80
65 #define LSI_ISTAT1_SI 0x01
66 #define LSI_ISTAT1_SRUN 0x02
67 #define LSI_ISTAT1_FLSH 0x04
69 #define LSI_SSTAT0_SDP0 0x01
70 #define LSI_SSTAT0_RST 0x02
71 #define LSI_SSTAT0_WOA 0x04
72 #define LSI_SSTAT0_LOA 0x08
73 #define LSI_SSTAT0_AIP 0x10
74 #define LSI_SSTAT0_OLF 0x20
75 #define LSI_SSTAT0_ORF 0x40
76 #define LSI_SSTAT0_ILF 0x80
78 #define LSI_SIST0_PAR 0x01
79 #define LSI_SIST0_RST 0x02
80 #define LSI_SIST0_UDC 0x04
81 #define LSI_SIST0_SGE 0x08
82 #define LSI_SIST0_RSL 0x10
83 #define LSI_SIST0_SEL 0x20
84 #define LSI_SIST0_CMP 0x40
85 #define LSI_SIST0_MA 0x80
87 #define LSI_SIST1_HTH 0x01
88 #define LSI_SIST1_GEN 0x02
89 #define LSI_SIST1_STO 0x04
90 #define LSI_SIST1_SBMC 0x10
92 #define LSI_SOCL_IO 0x01
93 #define LSI_SOCL_CD 0x02
94 #define LSI_SOCL_MSG 0x04
95 #define LSI_SOCL_ATN 0x08
96 #define LSI_SOCL_SEL 0x10
97 #define LSI_SOCL_BSY 0x20
98 #define LSI_SOCL_ACK 0x40
99 #define LSI_SOCL_REQ 0x80
101 #define LSI_DSTAT_IID 0x01
102 #define LSI_DSTAT_SIR 0x04
103 #define LSI_DSTAT_SSI 0x08
104 #define LSI_DSTAT_ABRT 0x10
105 #define LSI_DSTAT_BF 0x20
106 #define LSI_DSTAT_MDPE 0x40
107 #define LSI_DSTAT_DFE 0x80
109 #define LSI_DCNTL_COM 0x01
110 #define LSI_DCNTL_IRQD 0x02
111 #define LSI_DCNTL_STD 0x04
112 #define LSI_DCNTL_IRQM 0x08
113 #define LSI_DCNTL_SSM 0x10
114 #define LSI_DCNTL_PFEN 0x20
115 #define LSI_DCNTL_PFF 0x40
116 #define LSI_DCNTL_CLSE 0x80
118 #define LSI_DMODE_MAN 0x01
119 #define LSI_DMODE_BOF 0x02
120 #define LSI_DMODE_ERMP 0x04
121 #define LSI_DMODE_ERL 0x08
122 #define LSI_DMODE_DIOM 0x10
123 #define LSI_DMODE_SIOM 0x20
125 #define LSI_CTEST2_DACK 0x01
126 #define LSI_CTEST2_DREQ 0x02
127 #define LSI_CTEST2_TEOP 0x04
128 #define LSI_CTEST2_PCICIE 0x08
129 #define LSI_CTEST2_CM 0x10
130 #define LSI_CTEST2_CIO 0x20
131 #define LSI_CTEST2_SIGP 0x40
132 #define LSI_CTEST2_DDIR 0x80
134 #define LSI_CTEST5_BL2 0x04
135 #define LSI_CTEST5_DDIR 0x08
136 #define LSI_CTEST5_MASR 0x10
137 #define LSI_CTEST5_DFSN 0x20
138 #define LSI_CTEST5_BBCK 0x40
139 #define LSI_CTEST5_ADCK 0x80
141 #define LSI_CCNTL0_DILS 0x01
142 #define LSI_CCNTL0_DISFC 0x10
143 #define LSI_CCNTL0_ENNDJ 0x20
144 #define LSI_CCNTL0_PMJCTL 0x40
145 #define LSI_CCNTL0_ENPMJ 0x80
147 #define LSI_CCNTL1_EN64DBMV 0x01
148 #define LSI_CCNTL1_EN64TIBMV 0x02
149 #define LSI_CCNTL1_64TIMOD 0x04
150 #define LSI_CCNTL1_DDAC 0x08
151 #define LSI_CCNTL1_ZMOD 0x80
153 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
163 /* Maximum length of MSG IN data. */
164 #define LSI_MAX_MSGIN_LEN 8
166 /* Flag set if this is a tagged command. */
167 #define LSI_TAG_VALID (1 << 16)
179 uint32_t script_ram_base;
181 int carry; /* ??? Should this be an a visible register somewhere? */
183 /* Action to take at the end of a MSG IN phase.
184 0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN. */
187 uint8_t msg[LSI_MAX_MSGIN_LEN];
188 /* 0 if SCRIPTS are running or stopped.
189 * 1 if a Wait Reselect instruction has been issued.
190 * 2 if processing DMA from lsi_execute_script.
191 * 3 if a DMA operation is in progress. */
193 SCSIDevice *scsi_dev[LSI_MAX_DEVS];
194 SCSIDevice *current_dev;
196 /* The tag is a combination of the device ID and the SCSI tag. */
197 uint32_t current_tag;
198 uint32_t current_dma_len;
199 int command_complete;
264 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
266 /* Script ram is stored as 32-bit words in host byteorder. */
267 uint32_t script_ram[2048];
270 static void lsi_soft_reset(LSIState *s)
280 memset(s->scratch, 0, sizeof(s->scratch));
335 static int lsi_dma_40bit(LSIState *s)
337 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
342 static int lsi_dma_ti64bit(LSIState *s)
344 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
349 static int lsi_dma_64bit(LSIState *s)
351 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
356 static uint8_t lsi_reg_readb(LSIState *s, int offset);
357 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
358 static void lsi_execute_script(LSIState *s);
360 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
364 /* Optimize reading from SCRIPTS RAM. */
365 if ((addr & 0xffffe000) == s->script_ram_base) {
366 return s->script_ram[(addr & 0x1fff) >> 2];
368 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
369 return cpu_to_le32(buf);
372 static void lsi_stop_script(LSIState *s)
374 s->istat1 &= ~LSI_ISTAT1_SRUN;
377 static void lsi_update_irq(LSIState *s)
380 static int last_level;
382 /* It's unclear whether the DIP/SIP bits should be cleared when the
383 Interrupt Status Registers are cleared or when istat0 is read.
384 We currently do the formwer, which seems to work. */
387 if (s->dstat & s->dien)
389 s->istat0 |= LSI_ISTAT0_DIP;
391 s->istat0 &= ~LSI_ISTAT0_DIP;
394 if (s->sist0 || s->sist1) {
395 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
397 s->istat0 |= LSI_ISTAT0_SIP;
399 s->istat0 &= ~LSI_ISTAT0_SIP;
401 if (s->istat0 & LSI_ISTAT0_INTF)
404 if (level != last_level) {
405 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
406 level, s->dstat, s->sist1, s->sist0);
409 qemu_set_irq(s->pci_dev.irq[0], level);
412 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
413 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
418 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
419 stat1, stat0, s->sist1, s->sist0);
422 /* Stop processor on fatal or unmasked interrupt. As a special hack
423 we don't stop processing when raising STO. Instead continue
424 execution and stop at the next insn that accesses the SCSI bus. */
425 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
426 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
427 mask1 &= ~LSI_SIST1_STO;
428 if (s->sist0 & mask0 || s->sist1 & mask1) {
434 /* Stop SCRIPTS execution and raise a DMA interrupt. */
435 static void lsi_script_dma_interrupt(LSIState *s, int stat)
437 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
443 static inline void lsi_set_phase(LSIState *s, int phase)
445 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
448 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
450 /* Trigger a phase mismatch. */
451 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
452 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
457 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
459 DPRINTF("Phase mismatch interrupt\n");
460 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
463 lsi_set_phase(s, new_phase);
467 /* Resume SCRIPTS execution after a DMA operation. */
468 static void lsi_resume_script(LSIState *s)
470 if (s->waiting != 2) {
472 lsi_execute_script(s);
478 /* Initiate a SCSI layer data transfer. */
479 static void lsi_do_dma(LSIState *s, int out)
482 target_phys_addr_t addr;
484 if (!s->current_dma_len) {
485 /* Wait until data is available. */
486 DPRINTF("DMA no data available\n");
491 if (count > s->current_dma_len)
492 count = s->current_dma_len;
495 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
496 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
497 addr |= ((uint64_t)s->dnad64 << 32);
499 addr |= ((uint64_t)s->dbms << 32);
501 addr |= ((uint64_t)s->sbms << 32);
503 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
508 if (s->dma_buf == NULL) {
509 s->dma_buf = s->current_dev->get_buf(s->current_dev,
513 /* ??? Set SFBR to first data byte. */
515 cpu_physical_memory_read(addr, s->dma_buf, count);
517 cpu_physical_memory_write(addr, s->dma_buf, count);
519 s->current_dma_len -= count;
520 if (s->current_dma_len == 0) {
523 /* Write the data. */
524 s->current_dev->write_data(s->current_dev, s->current_tag);
526 /* Request any remaining data. */
527 s->current_dev->read_data(s->current_dev, s->current_tag);
531 lsi_resume_script(s);
536 /* Add a command to the queue. */
537 static void lsi_queue_command(LSIState *s)
541 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
542 if (s->queue_len == s->active_commands) {
544 s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
546 p = &s->queue[s->active_commands++];
547 p->tag = s->current_tag;
549 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
552 /* Queue a byte for a MSG IN phase. */
553 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
555 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
556 BADF("MSG IN data too long\n");
558 DPRINTF("MSG IN 0x%02x\n", data);
559 s->msg[s->msg_len++] = data;
563 /* Perform reselection to continue a command. */
564 static void lsi_reselect(LSIState *s, uint32_t tag)
571 for (n = 0; n < s->active_commands; n++) {
576 if (n == s->active_commands) {
577 BADF("Reselected non-existant command tag=0x%x\n", tag);
580 id = (tag >> 8) & 0xf;
582 DPRINTF("Reselected target %d\n", id);
583 s->current_dev = s->scsi_dev[id];
584 s->current_tag = tag;
585 s->scntl1 |= LSI_SCNTL1_CON;
586 lsi_set_phase(s, PHASE_MI);
587 s->msg_action = p->out ? 2 : 3;
588 s->current_dma_len = p->pending;
590 lsi_add_msg_byte(s, 0x80);
591 if (s->current_tag & LSI_TAG_VALID) {
592 lsi_add_msg_byte(s, 0x20);
593 lsi_add_msg_byte(s, tag & 0xff);
596 s->active_commands--;
597 if (n != s->active_commands) {
598 s->queue[n] = s->queue[s->active_commands];
602 /* Record that data is available for a queued command. Returns zero if
603 the device was reselected, nonzero if the IO is deferred. */
604 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
608 for (i = 0; i < s->active_commands; i++) {
612 BADF("Multiple IO pending for tag %d\n", tag);
615 if (s->waiting == 1) {
616 /* Reselect device. */
617 lsi_reselect(s, tag);
620 DPRINTF("Queueing IO tag=0x%x\n", tag);
626 BADF("IO with unknown tag %d\n", tag);
630 /* Callback to indicate that the SCSI layer has completed a transfer. */
631 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
634 LSIState *s = (LSIState *)opaque;
637 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
638 if (reason == SCSI_REASON_DONE) {
639 DPRINTF("Command complete sense=%d\n", (int)arg);
641 s->command_complete = 2;
642 if (s->waiting && s->dbc != 0) {
643 /* Raise phase mismatch for short transfers. */
644 lsi_bad_phase(s, out, PHASE_ST);
646 lsi_set_phase(s, PHASE_ST);
648 lsi_resume_script(s);
652 if (s->waiting == 1 || tag != s->current_tag) {
653 if (lsi_queue_tag(s, tag, arg))
656 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
657 s->current_dma_len = arg;
658 s->command_complete = 1;
661 if (s->waiting == 1 || s->dbc == 0) {
662 lsi_resume_script(s);
668 static void lsi_do_command(LSIState *s)
673 DPRINTF("Send command len=%d\n", s->dbc);
676 cpu_physical_memory_read(s->dnad, buf, s->dbc);
678 s->command_complete = 0;
679 n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
682 lsi_set_phase(s, PHASE_DI);
683 s->current_dev->read_data(s->current_dev, s->current_tag);
685 lsi_set_phase(s, PHASE_DO);
686 s->current_dev->write_data(s->current_dev, s->current_tag);
689 if (!s->command_complete) {
691 /* Command did not complete immediately so disconnect. */
692 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
693 lsi_add_msg_byte(s, 4); /* DISCONNECT */
695 lsi_set_phase(s, PHASE_MI);
697 lsi_queue_command(s);
699 /* wait command complete */
700 lsi_set_phase(s, PHASE_DI);
705 static void lsi_do_status(LSIState *s)
708 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
710 BADF("Bad Status move\n");
714 cpu_physical_memory_write(s->dnad, &sense, 1);
715 lsi_set_phase(s, PHASE_MI);
717 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
720 static void lsi_disconnect(LSIState *s)
722 s->scntl1 &= ~LSI_SCNTL1_CON;
723 s->sstat1 &= ~PHASE_MASK;
726 static void lsi_do_msgin(LSIState *s)
729 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
734 cpu_physical_memory_write(s->dnad, s->msg, len);
735 /* Linux drivers rely on the last byte being in the SIDL. */
736 s->sidl = s->msg[len - 1];
739 memmove(s->msg, s->msg + len, s->msg_len);
741 /* ??? Check if ATN (not yet implemented) is asserted and maybe
742 switch to PHASE_MO. */
743 switch (s->msg_action) {
745 lsi_set_phase(s, PHASE_CMD);
751 lsi_set_phase(s, PHASE_DO);
754 lsi_set_phase(s, PHASE_DI);
762 /* Read the next byte during a MSGOUT phase. */
763 static uint8_t lsi_get_msgbyte(LSIState *s)
766 cpu_physical_memory_read(s->dnad, &data, 1);
772 static void lsi_do_msgout(LSIState *s)
777 DPRINTF("MSG out len=%d\n", s->dbc);
779 msg = lsi_get_msgbyte(s);
784 DPRINTF("MSG: Disconnect\n");
788 DPRINTF("MSG: No Operation\n");
789 lsi_set_phase(s, PHASE_CMD);
792 len = lsi_get_msgbyte(s);
793 msg = lsi_get_msgbyte(s);
794 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
797 DPRINTF("SDTR (ignored)\n");
801 DPRINTF("WDTR (ignored)\n");
808 case 0x20: /* SIMPLE queue */
809 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
810 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
812 case 0x21: /* HEAD of queue */
813 BADF("HEAD queue not implemented\n");
814 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
816 case 0x22: /* ORDERED queue */
817 BADF("ORDERED queue not implemented\n");
818 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
821 if ((msg & 0x80) == 0) {
824 s->current_lun = msg & 7;
825 DPRINTF("Select LUN %d\n", s->current_lun);
826 lsi_set_phase(s, PHASE_CMD);
832 BADF("Unimplemented message 0x%02x\n", msg);
833 lsi_set_phase(s, PHASE_MI);
834 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
838 /* Sign extend a 24-bit value. */
839 static inline int32_t sxt24(int32_t n)
841 return (n << 8) >> 8;
844 #define LSI_BUF_SIZE 4096
845 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
848 uint8_t buf[LSI_BUF_SIZE];
850 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
852 n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
853 cpu_physical_memory_read(src, buf, n);
854 cpu_physical_memory_write(dest, buf, n);
861 static void lsi_wait_reselect(LSIState *s)
864 DPRINTF("Wait Reselect\n");
865 if (s->current_dma_len)
866 BADF("Reselect with pending DMA\n");
867 for (i = 0; i < s->active_commands; i++) {
868 if (s->queue[i].pending) {
869 lsi_reselect(s, s->queue[i].tag);
873 if (s->current_dma_len == 0) {
878 static void lsi_execute_script(LSIState *s)
881 uint32_t addr, addr_high;
883 int insn_processed = 0;
885 s->istat1 |= LSI_ISTAT1_SRUN;
888 insn = read_dword(s, s->dsp);
890 /* If we receive an empty opcode increment the DSP by 4 bytes
891 instead of 8 and execute the next opcode at that location */
895 addr = read_dword(s, s->dsp + 4);
897 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
899 s->dcmd = insn >> 24;
901 switch (insn >> 30) {
902 case 0: /* Block move. */
903 if (s->sist1 & LSI_SIST1_STO) {
904 DPRINTF("Delayed select timeout\n");
908 s->dbc = insn & 0xffffff;
912 if (insn & (1 << 29)) {
913 /* Indirect addressing. */
914 addr = read_dword(s, addr);
915 } else if (insn & (1 << 28)) {
918 /* Table indirect addressing. */
920 /* 32-bit Table indirect */
921 offset = sxt24(addr);
922 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
923 /* byte count is stored in bits 0:23 only */
924 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
926 addr = cpu_to_le32(buf[1]);
928 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
929 * table, bits [31:24] */
930 if (lsi_dma_40bit(s))
931 addr_high = cpu_to_le32(buf[0]) >> 24;
932 else if (lsi_dma_ti64bit(s)) {
933 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
936 /* offset index into scratch registers since
937 * TI64 mode can use registers C to R */
938 addr_high = s->scratch[2 + selector];
959 BADF("Illegal selector specified (0x%x > 0x15)"
960 " for 64-bit DMA block move", selector);
964 } else if (lsi_dma_64bit(s)) {
965 /* fetch a 3rd dword if 64-bit direct move is enabled and
966 only if we're not doing table indirect or indirect addressing */
967 s->dbms = read_dword(s, s->dsp);
971 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
972 DPRINTF("Wrong phase got %d expected %d\n",
973 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
974 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
978 s->dnad64 = addr_high;
979 switch (s->sstat1 & 0x7) {
1005 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1008 s->dfifo = s->dbc & 0xff;
1009 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1012 s->ua = addr + s->dbc;
1015 case 1: /* IO or Read/Write instruction. */
1016 opcode = (insn >> 27) & 7;
1020 if (insn & (1 << 25)) {
1021 id = read_dword(s, s->dsa + sxt24(insn));
1025 id = (id >> 16) & 0xf;
1026 if (insn & (1 << 26)) {
1027 addr = s->dsp + sxt24(addr);
1031 case 0: /* Select */
1033 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1034 DPRINTF("Already reselected by target %d\n", id);
1037 s->sstat0 |= LSI_SSTAT0_WOA;
1038 s->scntl1 &= ~LSI_SCNTL1_IARB;
1039 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
1040 DPRINTF("Selected absent target %d\n", id);
1041 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1045 DPRINTF("Selected target %d%s\n",
1046 id, insn & (1 << 3) ? " ATN" : "");
1047 /* ??? Linux drivers compain when this is set. Maybe
1048 it only applies in low-level mode (unimplemented).
1049 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1050 s->current_dev = s->scsi_dev[id];
1051 s->current_tag = id << 8;
1052 s->scntl1 |= LSI_SCNTL1_CON;
1053 if (insn & (1 << 3)) {
1054 s->socl |= LSI_SOCL_ATN;
1056 lsi_set_phase(s, PHASE_MO);
1058 case 1: /* Disconnect */
1059 DPRINTF("Wait Disconect\n");
1060 s->scntl1 &= ~LSI_SCNTL1_CON;
1062 case 2: /* Wait Reselect */
1063 lsi_wait_reselect(s);
1066 DPRINTF("Set%s%s%s%s\n",
1067 insn & (1 << 3) ? " ATN" : "",
1068 insn & (1 << 6) ? " ACK" : "",
1069 insn & (1 << 9) ? " TM" : "",
1070 insn & (1 << 10) ? " CC" : "");
1071 if (insn & (1 << 3)) {
1072 s->socl |= LSI_SOCL_ATN;
1073 lsi_set_phase(s, PHASE_MO);
1075 if (insn & (1 << 9)) {
1076 BADF("Target mode not implemented\n");
1079 if (insn & (1 << 10))
1083 DPRINTF("Clear%s%s%s%s\n",
1084 insn & (1 << 3) ? " ATN" : "",
1085 insn & (1 << 6) ? " ACK" : "",
1086 insn & (1 << 9) ? " TM" : "",
1087 insn & (1 << 10) ? " CC" : "");
1088 if (insn & (1 << 3)) {
1089 s->socl &= ~LSI_SOCL_ATN;
1091 if (insn & (1 << 10))
1102 static const char *opcode_names[3] =
1103 {"Write", "Read", "Read-Modify-Write"};
1104 static const char *operator_names[8] =
1105 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1108 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1109 data8 = (insn >> 8) & 0xff;
1110 opcode = (insn >> 27) & 7;
1111 operator = (insn >> 24) & 7;
1112 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1113 opcode_names[opcode - 5], reg,
1114 operator_names[operator], data8, s->sfbr,
1115 (insn & (1 << 23)) ? " SFBR" : "");
1118 case 5: /* From SFBR */
1122 case 6: /* To SFBR */
1124 op0 = lsi_reg_readb(s, reg);
1127 case 7: /* Read-modify-write */
1129 op0 = lsi_reg_readb(s, reg);
1130 if (insn & (1 << 23)) {
1142 case 1: /* Shift left */
1144 op0 = (op0 << 1) | s->carry;
1158 op0 = (op0 >> 1) | (s->carry << 7);
1163 s->carry = op0 < op1;
1166 op0 += op1 + s->carry;
1168 s->carry = op0 <= op1;
1170 s->carry = op0 < op1;
1175 case 5: /* From SFBR */
1176 case 7: /* Read-modify-write */
1177 lsi_reg_writeb(s, reg, op0);
1179 case 6: /* To SFBR */
1186 case 2: /* Transfer Control. */
1191 if ((insn & 0x002e0000) == 0) {
1195 if (s->sist1 & LSI_SIST1_STO) {
1196 DPRINTF("Delayed select timeout\n");
1200 cond = jmp = (insn & (1 << 19)) != 0;
1201 if (cond == jmp && (insn & (1 << 21))) {
1202 DPRINTF("Compare carry %d\n", s->carry == jmp);
1203 cond = s->carry != 0;
1205 if (cond == jmp && (insn & (1 << 17))) {
1206 DPRINTF("Compare phase %d %c= %d\n",
1207 (s->sstat1 & PHASE_MASK),
1209 ((insn >> 24) & 7));
1210 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1212 if (cond == jmp && (insn & (1 << 18))) {
1215 mask = (~insn >> 8) & 0xff;
1216 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1217 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1218 cond = (s->sfbr & mask) == (insn & mask);
1221 if (insn & (1 << 23)) {
1222 /* Relative address. */
1223 addr = s->dsp + sxt24(addr);
1225 switch ((insn >> 27) & 7) {
1227 DPRINTF("Jump to 0x%08x\n", addr);
1231 DPRINTF("Call 0x%08x\n", addr);
1235 case 2: /* Return */
1236 DPRINTF("Return to 0x%08x\n", s->temp);
1239 case 3: /* Interrupt */
1240 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1241 if ((insn & (1 << 20)) != 0) {
1242 s->istat0 |= LSI_ISTAT0_INTF;
1245 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1249 DPRINTF("Illegal transfer control\n");
1250 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1254 DPRINTF("Control condition failed\n");
1260 if ((insn & (1 << 29)) == 0) {
1263 /* ??? The docs imply the destination address is loaded into
1264 the TEMP register. However the Linux drivers rely on
1265 the value being presrved. */
1266 dest = read_dword(s, s->dsp);
1268 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1275 if (insn & (1 << 28)) {
1276 addr = s->dsa + sxt24(addr);
1279 reg = (insn >> 16) & 0xff;
1280 if (insn & (1 << 24)) {
1281 cpu_physical_memory_read(addr, data, n);
1282 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1283 addr, *(int *)data);
1284 for (i = 0; i < n; i++) {
1285 lsi_reg_writeb(s, reg + i, data[i]);
1288 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1289 for (i = 0; i < n; i++) {
1290 data[i] = lsi_reg_readb(s, reg + i);
1292 cpu_physical_memory_write(addr, data, n);
1296 if (insn_processed > 10000 && !s->waiting) {
1297 /* Some windows drivers make the device spin waiting for a memory
1298 location to change. If we have been executed a lot of code then
1299 assume this is the case and force an unexpected device disconnect.
1300 This is apparently sufficient to beat the drivers into submission.
1302 if (!(s->sien0 & LSI_SIST0_UDC))
1303 fprintf(stderr, "inf. loop with UDC masked\n");
1304 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1306 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1307 if (s->dcntl & LSI_DCNTL_SSM) {
1308 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1313 DPRINTF("SCRIPTS execution stopped\n");
1316 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1319 #define CASE_GET_REG24(name, addr) \
1320 case addr: return s->name & 0xff; \
1321 case addr + 1: return (s->name >> 8) & 0xff; \
1322 case addr + 2: return (s->name >> 16) & 0xff;
1324 #define CASE_GET_REG32(name, addr) \
1325 case addr: return s->name & 0xff; \
1326 case addr + 1: return (s->name >> 8) & 0xff; \
1327 case addr + 2: return (s->name >> 16) & 0xff; \
1328 case addr + 3: return (s->name >> 24) & 0xff;
1330 #ifdef DEBUG_LSI_REG
1331 DPRINTF("Read reg %x\n", offset);
1334 case 0x00: /* SCNTL0 */
1336 case 0x01: /* SCNTL1 */
1338 case 0x02: /* SCNTL2 */
1340 case 0x03: /* SCNTL3 */
1342 case 0x04: /* SCID */
1344 case 0x05: /* SXFER */
1346 case 0x06: /* SDID */
1348 case 0x07: /* GPREG0 */
1350 case 0x08: /* Revision ID */
1352 case 0xa: /* SSID */
1354 case 0xb: /* SBCL */
1355 /* ??? This is not correct. However it's (hopefully) only
1356 used for diagnostics, so should be ok. */
1358 case 0xc: /* DSTAT */
1359 tmp = s->dstat | 0x80;
1360 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1364 case 0x0d: /* SSTAT0 */
1366 case 0x0e: /* SSTAT1 */
1368 case 0x0f: /* SSTAT2 */
1369 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1370 CASE_GET_REG32(dsa, 0x10)
1371 case 0x14: /* ISTAT0 */
1373 case 0x15: /* ISTAT1 */
1375 case 0x16: /* MBOX0 */
1377 case 0x17: /* MBOX1 */
1379 case 0x18: /* CTEST0 */
1381 case 0x19: /* CTEST1 */
1383 case 0x1a: /* CTEST2 */
1384 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1385 if (s->istat0 & LSI_ISTAT0_SIGP) {
1386 s->istat0 &= ~LSI_ISTAT0_SIGP;
1387 tmp |= LSI_CTEST2_SIGP;
1390 case 0x1b: /* CTEST3 */
1392 CASE_GET_REG32(temp, 0x1c)
1393 case 0x20: /* DFIFO */
1395 case 0x21: /* CTEST4 */
1397 case 0x22: /* CTEST5 */
1399 case 0x23: /* CTEST6 */
1401 CASE_GET_REG24(dbc, 0x24)
1402 case 0x27: /* DCMD */
1404 CASE_GET_REG32(dsp, 0x2c)
1405 CASE_GET_REG32(dsps, 0x30)
1406 CASE_GET_REG32(scratch[0], 0x34)
1407 case 0x38: /* DMODE */
1409 case 0x39: /* DIEN */
1411 case 0x3b: /* DCNTL */
1413 case 0x40: /* SIEN0 */
1415 case 0x41: /* SIEN1 */
1417 case 0x42: /* SIST0 */
1422 case 0x43: /* SIST1 */
1427 case 0x46: /* MACNTL */
1429 case 0x47: /* GPCNTL0 */
1431 case 0x48: /* STIME0 */
1433 case 0x4a: /* RESPID0 */
1435 case 0x4b: /* RESPID1 */
1437 case 0x4d: /* STEST1 */
1439 case 0x4e: /* STEST2 */
1441 case 0x4f: /* STEST3 */
1443 case 0x50: /* SIDL */
1444 /* This is needed by the linux drivers. We currently only update it
1445 during the MSG IN phase. */
1447 case 0x52: /* STEST4 */
1449 case 0x56: /* CCNTL0 */
1451 case 0x57: /* CCNTL1 */
1453 case 0x58: /* SBDL */
1454 /* Some drivers peek at the data bus during the MSG IN phase. */
1455 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1458 case 0x59: /* SBDL high */
1460 CASE_GET_REG32(mmrs, 0xa0)
1461 CASE_GET_REG32(mmws, 0xa4)
1462 CASE_GET_REG32(sfs, 0xa8)
1463 CASE_GET_REG32(drs, 0xac)
1464 CASE_GET_REG32(sbms, 0xb0)
1465 CASE_GET_REG32(dbms, 0xb4)
1466 CASE_GET_REG32(dnad64, 0xb8)
1467 CASE_GET_REG32(pmjad1, 0xc0)
1468 CASE_GET_REG32(pmjad2, 0xc4)
1469 CASE_GET_REG32(rbc, 0xc8)
1470 CASE_GET_REG32(ua, 0xcc)
1471 CASE_GET_REG32(ia, 0xd4)
1472 CASE_GET_REG32(sbc, 0xd8)
1473 CASE_GET_REG32(csbc, 0xdc)
1475 if (offset >= 0x5c && offset < 0xa0) {
1478 n = (offset - 0x58) >> 2;
1479 shift = (offset & 3) * 8;
1480 return (s->scratch[n] >> shift) & 0xff;
1482 BADF("readb 0x%x\n", offset);
1484 #undef CASE_GET_REG24
1485 #undef CASE_GET_REG32
1488 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1490 #define CASE_SET_REG32(name, addr) \
1491 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1492 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1493 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1494 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1496 #ifdef DEBUG_LSI_REG
1497 DPRINTF("Write reg %x = %02x\n", offset, val);
1500 case 0x00: /* SCNTL0 */
1502 if (val & LSI_SCNTL0_START) {
1503 BADF("Start sequence not implemented\n");
1506 case 0x01: /* SCNTL1 */
1507 s->scntl1 = val & ~LSI_SCNTL1_SST;
1508 if (val & LSI_SCNTL1_IARB) {
1509 BADF("Immediate Arbritration not implemented\n");
1511 if (val & LSI_SCNTL1_RST) {
1512 s->sstat0 |= LSI_SSTAT0_RST;
1513 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1515 s->sstat0 &= ~LSI_SSTAT0_RST;
1518 case 0x02: /* SCNTL2 */
1519 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1522 case 0x03: /* SCNTL3 */
1525 case 0x04: /* SCID */
1528 case 0x05: /* SXFER */
1531 case 0x06: /* SDID */
1532 if ((val & 0xf) != (s->ssid & 0xf))
1533 BADF("Destination ID does not match SSID\n");
1534 s->sdid = val & 0xf;
1536 case 0x07: /* GPREG0 */
1538 case 0x08: /* SFBR */
1539 /* The CPU is not allowed to write to this register. However the
1540 SCRIPTS register move instructions are. */
1543 case 0x0a: case 0x0b:
1544 /* Openserver writes to these readonly registers on startup */
1546 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1547 /* Linux writes to these readonly registers on startup. */
1549 CASE_SET_REG32(dsa, 0x10)
1550 case 0x14: /* ISTAT0 */
1551 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1552 if (val & LSI_ISTAT0_ABRT) {
1553 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1555 if (val & LSI_ISTAT0_INTF) {
1556 s->istat0 &= ~LSI_ISTAT0_INTF;
1559 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1560 DPRINTF("Woken by SIGP\n");
1563 lsi_execute_script(s);
1565 if (val & LSI_ISTAT0_SRST) {
1569 case 0x16: /* MBOX0 */
1572 case 0x17: /* MBOX1 */
1575 case 0x1a: /* CTEST2 */
1576 s->ctest2 = val & LSI_CTEST2_PCICIE;
1578 case 0x1b: /* CTEST3 */
1579 s->ctest3 = val & 0x0f;
1581 CASE_SET_REG32(temp, 0x1c)
1582 case 0x21: /* CTEST4 */
1584 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1588 case 0x22: /* CTEST5 */
1589 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1590 BADF("CTEST5 DMA increment not implemented\n");
1594 case 0x2c: /* DSP[0:7] */
1595 s->dsp &= 0xffffff00;
1598 case 0x2d: /* DSP[8:15] */
1599 s->dsp &= 0xffff00ff;
1602 case 0x2e: /* DSP[16:23] */
1603 s->dsp &= 0xff00ffff;
1604 s->dsp |= val << 16;
1606 case 0x2f: /* DSP[24:31] */
1607 s->dsp &= 0x00ffffff;
1608 s->dsp |= val << 24;
1609 if ((s->dmode & LSI_DMODE_MAN) == 0
1610 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1611 lsi_execute_script(s);
1613 CASE_SET_REG32(dsps, 0x30)
1614 CASE_SET_REG32(scratch[0], 0x34)
1615 case 0x38: /* DMODE */
1616 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1617 BADF("IO mappings not implemented\n");
1621 case 0x39: /* DIEN */
1625 case 0x3b: /* DCNTL */
1626 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1627 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1628 lsi_execute_script(s);
1630 case 0x40: /* SIEN0 */
1634 case 0x41: /* SIEN1 */
1638 case 0x47: /* GPCNTL0 */
1640 case 0x48: /* STIME0 */
1643 case 0x49: /* STIME1 */
1645 DPRINTF("General purpose timer not implemented\n");
1646 /* ??? Raising the interrupt immediately seems to be sufficient
1647 to keep the FreeBSD driver happy. */
1648 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1651 case 0x4a: /* RESPID0 */
1654 case 0x4b: /* RESPID1 */
1657 case 0x4d: /* STEST1 */
1660 case 0x4e: /* STEST2 */
1662 BADF("Low level mode not implemented\n");
1666 case 0x4f: /* STEST3 */
1668 BADF("SCSI FIFO test mode not implemented\n");
1672 case 0x56: /* CCNTL0 */
1675 case 0x57: /* CCNTL1 */
1678 CASE_SET_REG32(mmrs, 0xa0)
1679 CASE_SET_REG32(mmws, 0xa4)
1680 CASE_SET_REG32(sfs, 0xa8)
1681 CASE_SET_REG32(drs, 0xac)
1682 CASE_SET_REG32(sbms, 0xb0)
1683 CASE_SET_REG32(dbms, 0xb4)
1684 CASE_SET_REG32(dnad64, 0xb8)
1685 CASE_SET_REG32(pmjad1, 0xc0)
1686 CASE_SET_REG32(pmjad2, 0xc4)
1687 CASE_SET_REG32(rbc, 0xc8)
1688 CASE_SET_REG32(ua, 0xcc)
1689 CASE_SET_REG32(ia, 0xd4)
1690 CASE_SET_REG32(sbc, 0xd8)
1691 CASE_SET_REG32(csbc, 0xdc)
1693 if (offset >= 0x5c && offset < 0xa0) {
1696 n = (offset - 0x58) >> 2;
1697 shift = (offset & 3) * 8;
1698 s->scratch[n] &= ~(0xff << shift);
1699 s->scratch[n] |= (val & 0xff) << shift;
1701 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1704 #undef CASE_SET_REG32
1707 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1709 LSIState *s = (LSIState *)opaque;
1711 lsi_reg_writeb(s, addr & 0xff, val);
1714 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1716 LSIState *s = (LSIState *)opaque;
1719 lsi_reg_writeb(s, addr, val & 0xff);
1720 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1723 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1725 LSIState *s = (LSIState *)opaque;
1728 lsi_reg_writeb(s, addr, val & 0xff);
1729 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1730 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1731 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1734 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1736 LSIState *s = (LSIState *)opaque;
1738 return lsi_reg_readb(s, addr & 0xff);
1741 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1743 LSIState *s = (LSIState *)opaque;
1747 val = lsi_reg_readb(s, addr);
1748 val |= lsi_reg_readb(s, addr + 1) << 8;
1752 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1754 LSIState *s = (LSIState *)opaque;
1757 val = lsi_reg_readb(s, addr);
1758 val |= lsi_reg_readb(s, addr + 1) << 8;
1759 val |= lsi_reg_readb(s, addr + 2) << 16;
1760 val |= lsi_reg_readb(s, addr + 3) << 24;
1764 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1770 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1776 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1778 LSIState *s = (LSIState *)opaque;
1783 newval = s->script_ram[addr >> 2];
1784 shift = (addr & 3) * 8;
1785 newval &= ~(0xff << shift);
1786 newval |= val << shift;
1787 s->script_ram[addr >> 2] = newval;
1790 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1792 LSIState *s = (LSIState *)opaque;
1796 newval = s->script_ram[addr >> 2];
1798 newval = (newval & 0xffff) | (val << 16);
1800 newval = (newval & 0xffff0000) | val;
1802 s->script_ram[addr >> 2] = newval;
1806 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1808 LSIState *s = (LSIState *)opaque;
1811 s->script_ram[addr >> 2] = val;
1814 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1816 LSIState *s = (LSIState *)opaque;
1820 val = s->script_ram[addr >> 2];
1821 val >>= (addr & 3) * 8;
1825 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1827 LSIState *s = (LSIState *)opaque;
1831 val = s->script_ram[addr >> 2];
1834 return le16_to_cpu(val);
1837 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1839 LSIState *s = (LSIState *)opaque;
1842 return le32_to_cpu(s->script_ram[addr >> 2]);
1845 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1851 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1857 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1859 LSIState *s = (LSIState *)opaque;
1860 return lsi_reg_readb(s, addr & 0xff);
1863 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1865 LSIState *s = (LSIState *)opaque;
1868 val = lsi_reg_readb(s, addr);
1869 val |= lsi_reg_readb(s, addr + 1) << 8;
1873 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1875 LSIState *s = (LSIState *)opaque;
1878 val = lsi_reg_readb(s, addr);
1879 val |= lsi_reg_readb(s, addr + 1) << 8;
1880 val |= lsi_reg_readb(s, addr + 2) << 16;
1881 val |= lsi_reg_readb(s, addr + 3) << 24;
1885 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1887 LSIState *s = (LSIState *)opaque;
1888 lsi_reg_writeb(s, addr & 0xff, val);
1891 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1893 LSIState *s = (LSIState *)opaque;
1895 lsi_reg_writeb(s, addr, val & 0xff);
1896 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1899 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1901 LSIState *s = (LSIState *)opaque;
1903 lsi_reg_writeb(s, addr, val & 0xff);
1904 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1905 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1906 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1909 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1910 uint32_t addr, uint32_t size, int type)
1912 LSIState *s = (LSIState *)pci_dev;
1914 DPRINTF("Mapping IO at %08x\n", addr);
1916 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1917 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1918 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1919 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1920 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1921 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1924 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1925 uint32_t addr, uint32_t size, int type)
1927 LSIState *s = (LSIState *)pci_dev;
1929 DPRINTF("Mapping ram at %08x\n", addr);
1930 s->script_ram_base = addr;
1931 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1934 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1935 uint32_t addr, uint32_t size, int type)
1937 LSIState *s = (LSIState *)pci_dev;
1939 DPRINTF("Mapping registers at %08x\n", addr);
1940 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1943 void lsi_scsi_attach(DeviceState *host, BlockDriverState *bd, int id)
1945 LSIState *s = (LSIState *)host;
1948 for (id = 0; id < LSI_MAX_DEVS; id++) {
1949 if (s->scsi_dev[id] == NULL)
1953 if (id >= LSI_MAX_DEVS) {
1954 BADF("Bad Device ID %d\n", id);
1957 if (s->scsi_dev[id]) {
1958 DPRINTF("Destroying device %d\n", id);
1959 s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1961 DPRINTF("Attaching block device %d\n", id);
1962 s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1963 if (s->scsi_dev[id] == NULL)
1964 s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1965 bd->private = &s->pci_dev;
1968 static int lsi_scsi_uninit(PCIDevice *d)
1970 LSIState *s = (LSIState *) d;
1972 cpu_unregister_io_memory(s->mmio_io_addr);
1973 cpu_unregister_io_memory(s->ram_io_addr);
1975 qemu_free(s->queue);
1980 static void lsi_scsi_init(PCIDevice *dev)
1982 LSIState *s = (LSIState *)dev;
1985 pci_conf = s->pci_dev.config;
1987 /* PCI Vendor ID (word) */
1988 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
1989 /* PCI device ID (word) */
1990 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
1991 /* PCI base class code */
1992 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
1993 /* PCI subsystem ID */
1994 pci_conf[0x2e] = 0x00;
1995 pci_conf[0x2f] = 0x10;
1996 /* PCI latency timer = 255 */
1997 pci_conf[0x0d] = 0xff;
1998 /* Interrupt pin 1 */
1999 pci_conf[0x3d] = 0x01;
2001 s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
2002 lsi_mmio_writefn, s);
2003 s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
2004 lsi_ram_writefn, s);
2006 pci_register_io_region((struct PCIDevice *)s, 0, 256,
2007 PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2008 pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
2009 PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
2010 pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
2011 PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
2012 s->queue = qemu_malloc(sizeof(lsi_queue));
2014 s->active_commands = 0;
2015 s->pci_dev.unregister = lsi_scsi_uninit;
2019 scsi_bus_new(&dev->qdev, lsi_scsi_attach);
2022 static void lsi53c895a_register_devices(void)
2024 pci_qdev_register("lsi53c895a", sizeof(LSIState), lsi_scsi_init);
2027 device_init(lsi53c895a_register_devices);