2 * QEMU LSI53C895A SCSI Host Bus Adapter emulation
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licenced under the LGPL.
10 /* ??? Need to check if the {read,write}[wl] routines work properly on
11 big-endian targets. */
15 #include "scsi-disk.h"
18 //#define DEBUG_LSI_REG
21 #define DPRINTF(fmt, args...) \
22 do { printf("lsi_scsi: " fmt , ##args); } while (0)
23 #define BADF(fmt, args...) \
24 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
26 #define DPRINTF(fmt, args...) do {} while(0)
27 #define BADF(fmt, args...) \
28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
31 #define LSI_SCNTL0_TRG 0x01
32 #define LSI_SCNTL0_AAP 0x02
33 #define LSI_SCNTL0_EPC 0x08
34 #define LSI_SCNTL0_WATN 0x10
35 #define LSI_SCNTL0_START 0x20
37 #define LSI_SCNTL1_SST 0x01
38 #define LSI_SCNTL1_IARB 0x02
39 #define LSI_SCNTL1_AESP 0x04
40 #define LSI_SCNTL1_RST 0x08
41 #define LSI_SCNTL1_CON 0x10
42 #define LSI_SCNTL1_DHP 0x20
43 #define LSI_SCNTL1_ADB 0x40
44 #define LSI_SCNTL1_EXC 0x80
46 #define LSI_SCNTL2_WSR 0x01
47 #define LSI_SCNTL2_VUE0 0x02
48 #define LSI_SCNTL2_VUE1 0x04
49 #define LSI_SCNTL2_WSS 0x08
50 #define LSI_SCNTL2_SLPHBEN 0x10
51 #define LSI_SCNTL2_SLPMD 0x20
52 #define LSI_SCNTL2_CHM 0x40
53 #define LSI_SCNTL2_SDU 0x80
55 #define LSI_ISTAT0_DIP 0x01
56 #define LSI_ISTAT0_SIP 0x02
57 #define LSI_ISTAT0_INTF 0x04
58 #define LSI_ISTAT0_CON 0x08
59 #define LSI_ISTAT0_SEM 0x10
60 #define LSI_ISTAT0_SIGP 0x20
61 #define LSI_ISTAT0_SRST 0x40
62 #define LSI_ISTAT0_ABRT 0x80
64 #define LSI_ISTAT1_SI 0x01
65 #define LSI_ISTAT1_SRUN 0x02
66 #define LSI_ISTAT1_FLSH 0x04
68 #define LSI_SSTAT0_SDP0 0x01
69 #define LSI_SSTAT0_RST 0x02
70 #define LSI_SSTAT0_WOA 0x04
71 #define LSI_SSTAT0_LOA 0x08
72 #define LSI_SSTAT0_AIP 0x10
73 #define LSI_SSTAT0_OLF 0x20
74 #define LSI_SSTAT0_ORF 0x40
75 #define LSI_SSTAT0_ILF 0x80
77 #define LSI_SIST0_PAR 0x01
78 #define LSI_SIST0_RST 0x02
79 #define LSI_SIST0_UDC 0x04
80 #define LSI_SIST0_SGE 0x08
81 #define LSI_SIST0_RSL 0x10
82 #define LSI_SIST0_SEL 0x20
83 #define LSI_SIST0_CMP 0x40
84 #define LSI_SIST0_MA 0x80
86 #define LSI_SIST1_HTH 0x01
87 #define LSI_SIST1_GEN 0x02
88 #define LSI_SIST1_STO 0x04
89 #define LSI_SIST1_SBMC 0x10
91 #define LSI_SOCL_IO 0x01
92 #define LSI_SOCL_CD 0x02
93 #define LSI_SOCL_MSG 0x04
94 #define LSI_SOCL_ATN 0x08
95 #define LSI_SOCL_SEL 0x10
96 #define LSI_SOCL_BSY 0x20
97 #define LSI_SOCL_ACK 0x40
98 #define LSI_SOCL_REQ 0x80
100 #define LSI_DSTAT_IID 0x01
101 #define LSI_DSTAT_SIR 0x04
102 #define LSI_DSTAT_SSI 0x08
103 #define LSI_DSTAT_ABRT 0x10
104 #define LSI_DSTAT_BF 0x20
105 #define LSI_DSTAT_MDPE 0x40
106 #define LSI_DSTAT_DFE 0x80
108 #define LSI_DCNTL_COM 0x01
109 #define LSI_DCNTL_IRQD 0x02
110 #define LSI_DCNTL_STD 0x04
111 #define LSI_DCNTL_IRQM 0x08
112 #define LSI_DCNTL_SSM 0x10
113 #define LSI_DCNTL_PFEN 0x20
114 #define LSI_DCNTL_PFF 0x40
115 #define LSI_DCNTL_CLSE 0x80
117 #define LSI_DMODE_MAN 0x01
118 #define LSI_DMODE_BOF 0x02
119 #define LSI_DMODE_ERMP 0x04
120 #define LSI_DMODE_ERL 0x08
121 #define LSI_DMODE_DIOM 0x10
122 #define LSI_DMODE_SIOM 0x20
124 #define LSI_CTEST2_DACK 0x01
125 #define LSI_CTEST2_DREQ 0x02
126 #define LSI_CTEST2_TEOP 0x04
127 #define LSI_CTEST2_PCICIE 0x08
128 #define LSI_CTEST2_CM 0x10
129 #define LSI_CTEST2_CIO 0x20
130 #define LSI_CTEST2_SIGP 0x40
131 #define LSI_CTEST2_DDIR 0x80
133 #define LSI_CTEST5_BL2 0x04
134 #define LSI_CTEST5_DDIR 0x08
135 #define LSI_CTEST5_MASR 0x10
136 #define LSI_CTEST5_DFSN 0x20
137 #define LSI_CTEST5_BBCK 0x40
138 #define LSI_CTEST5_ADCK 0x80
140 #define LSI_CCNTL0_DILS 0x01
141 #define LSI_CCNTL0_DISFC 0x10
142 #define LSI_CCNTL0_ENNDJ 0x20
143 #define LSI_CCNTL0_PMJCTL 0x40
144 #define LSI_CCNTL0_ENPMJ 0x80
146 #define LSI_CCNTL1_EN64DBMV 0x01
147 #define LSI_CCNTL1_EN64TIBMV 0x02
148 #define LSI_CCNTL1_64TIMOD 0x04
149 #define LSI_CCNTL1_DDAC 0x08
150 #define LSI_CCNTL1_ZMOD 0x80
152 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
162 /* Maximum length of MSG IN data. */
163 #define LSI_MAX_MSGIN_LEN 8
165 /* Flag set if this is a tagged command. */
166 #define LSI_TAG_VALID (1 << 16)
178 uint32_t script_ram_base;
180 int carry; /* ??? Should this be an a visible register somewhere? */
182 /* Action to take at the end of a MSG IN phase.
183 0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN. */
186 uint8_t msg[LSI_MAX_MSGIN_LEN];
187 /* 0 if SCRIPTS are running or stopped.
188 * 1 if a Wait Reselect instruction has been issued.
189 * 2 if processing DMA from lsi_execute_script.
190 * 3 if a DMA operation is in progress. */
192 SCSIDevice *scsi_dev[LSI_MAX_DEVS];
193 SCSIDevice *current_dev;
195 /* The tag is a combination of the device ID and the SCSI tag. */
196 uint32_t current_tag;
197 uint32_t current_dma_len;
198 int command_complete;
263 uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
265 /* Script ram is stored as 32-bit words in host byteorder. */
266 uint32_t script_ram[2048];
269 static void lsi_soft_reset(LSIState *s)
279 memset(s->scratch, 0, sizeof(s->scratch));
334 static int lsi_dma_40bit(LSIState *s)
336 if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
341 static int lsi_dma_ti64bit(LSIState *s)
343 if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
348 static int lsi_dma_64bit(LSIState *s)
350 if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
355 static uint8_t lsi_reg_readb(LSIState *s, int offset);
356 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
357 static void lsi_execute_script(LSIState *s);
359 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
363 /* Optimize reading from SCRIPTS RAM. */
364 if ((addr & 0xffffe000) == s->script_ram_base) {
365 return s->script_ram[(addr & 0x1fff) >> 2];
367 cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
368 return cpu_to_le32(buf);
371 static void lsi_stop_script(LSIState *s)
373 s->istat1 &= ~LSI_ISTAT1_SRUN;
376 static void lsi_update_irq(LSIState *s)
379 static int last_level;
381 /* It's unclear whether the DIP/SIP bits should be cleared when the
382 Interrupt Status Registers are cleared or when istat0 is read.
383 We currently do the formwer, which seems to work. */
386 if (s->dstat & s->dien)
388 s->istat0 |= LSI_ISTAT0_DIP;
390 s->istat0 &= ~LSI_ISTAT0_DIP;
393 if (s->sist0 || s->sist1) {
394 if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
396 s->istat0 |= LSI_ISTAT0_SIP;
398 s->istat0 &= ~LSI_ISTAT0_SIP;
400 if (s->istat0 & LSI_ISTAT0_INTF)
403 if (level != last_level) {
404 DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
405 level, s->dstat, s->sist1, s->sist0);
408 qemu_set_irq(s->pci_dev.irq[0], level);
411 /* Stop SCRIPTS execution and raise a SCSI interrupt. */
412 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
417 DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
418 stat1, stat0, s->sist1, s->sist0);
421 /* Stop processor on fatal or unmasked interrupt. As a special hack
422 we don't stop processing when raising STO. Instead continue
423 execution and stop at the next insn that accesses the SCSI bus. */
424 mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
425 mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
426 mask1 &= ~LSI_SIST1_STO;
427 if (s->sist0 & mask0 || s->sist1 & mask1) {
433 /* Stop SCRIPTS execution and raise a DMA interrupt. */
434 static void lsi_script_dma_interrupt(LSIState *s, int stat)
436 DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
442 static inline void lsi_set_phase(LSIState *s, int phase)
444 s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
447 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
449 /* Trigger a phase mismatch. */
450 if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
451 if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
456 DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
458 DPRINTF("Phase mismatch interrupt\n");
459 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
462 lsi_set_phase(s, new_phase);
466 /* Resume SCRIPTS execution after a DMA operation. */
467 static void lsi_resume_script(LSIState *s)
469 if (s->waiting != 2) {
471 lsi_execute_script(s);
477 /* Initiate a SCSI layer data transfer. */
478 static void lsi_do_dma(LSIState *s, int out)
481 target_phys_addr_t addr;
483 if (!s->current_dma_len) {
484 /* Wait until data is available. */
485 DPRINTF("DMA no data available\n");
490 if (count > s->current_dma_len)
491 count = s->current_dma_len;
494 /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
495 if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
496 addr |= ((uint64_t)s->dnad64 << 32);
498 addr |= ((uint64_t)s->dbms << 32);
500 addr |= ((uint64_t)s->sbms << 32);
502 DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
507 if (s->dma_buf == NULL) {
508 s->dma_buf = s->current_dev->get_buf(s->current_dev,
512 /* ??? Set SFBR to first data byte. */
514 cpu_physical_memory_read(addr, s->dma_buf, count);
516 cpu_physical_memory_write(addr, s->dma_buf, count);
518 s->current_dma_len -= count;
519 if (s->current_dma_len == 0) {
522 /* Write the data. */
523 s->current_dev->write_data(s->current_dev, s->current_tag);
525 /* Request any remaining data. */
526 s->current_dev->read_data(s->current_dev, s->current_tag);
530 lsi_resume_script(s);
535 /* Add a command to the queue. */
536 static void lsi_queue_command(LSIState *s)
540 DPRINTF("Queueing tag=0x%x\n", s->current_tag);
541 if (s->queue_len == s->active_commands) {
543 s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
545 p = &s->queue[s->active_commands++];
546 p->tag = s->current_tag;
548 p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
551 /* Queue a byte for a MSG IN phase. */
552 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
554 if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
555 BADF("MSG IN data too long\n");
557 DPRINTF("MSG IN 0x%02x\n", data);
558 s->msg[s->msg_len++] = data;
562 /* Perform reselection to continue a command. */
563 static void lsi_reselect(LSIState *s, uint32_t tag)
570 for (n = 0; n < s->active_commands; n++) {
575 if (n == s->active_commands) {
576 BADF("Reselected non-existant command tag=0x%x\n", tag);
579 id = (tag >> 8) & 0xf;
581 DPRINTF("Reselected target %d\n", id);
582 s->current_dev = s->scsi_dev[id];
583 s->current_tag = tag;
584 s->scntl1 |= LSI_SCNTL1_CON;
585 lsi_set_phase(s, PHASE_MI);
586 s->msg_action = p->out ? 2 : 3;
587 s->current_dma_len = p->pending;
589 lsi_add_msg_byte(s, 0x80);
590 if (s->current_tag & LSI_TAG_VALID) {
591 lsi_add_msg_byte(s, 0x20);
592 lsi_add_msg_byte(s, tag & 0xff);
595 s->active_commands--;
596 if (n != s->active_commands) {
597 s->queue[n] = s->queue[s->active_commands];
601 /* Record that data is available for a queued command. Returns zero if
602 the device was reselected, nonzero if the IO is deferred. */
603 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
607 for (i = 0; i < s->active_commands; i++) {
611 BADF("Multiple IO pending for tag %d\n", tag);
614 if (s->waiting == 1) {
615 /* Reselect device. */
616 lsi_reselect(s, tag);
619 DPRINTF("Queueing IO tag=0x%x\n", tag);
625 BADF("IO with unknown tag %d\n", tag);
629 /* Callback to indicate that the SCSI layer has completed a transfer. */
630 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
633 LSIState *s = (LSIState *)opaque;
636 out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
637 if (reason == SCSI_REASON_DONE) {
638 DPRINTF("Command complete sense=%d\n", (int)arg);
640 s->command_complete = 2;
641 if (s->waiting && s->dbc != 0) {
642 /* Raise phase mismatch for short transfers. */
643 lsi_bad_phase(s, out, PHASE_ST);
645 lsi_set_phase(s, PHASE_ST);
647 lsi_resume_script(s);
651 if (s->waiting == 1 || tag != s->current_tag) {
652 if (lsi_queue_tag(s, tag, arg))
655 DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
656 s->current_dma_len = arg;
657 s->command_complete = 1;
660 if (s->waiting == 1 || s->dbc == 0) {
661 lsi_resume_script(s);
667 static void lsi_do_command(LSIState *s)
672 DPRINTF("Send command len=%d\n", s->dbc);
675 cpu_physical_memory_read(s->dnad, buf, s->dbc);
677 s->command_complete = 0;
678 n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
681 lsi_set_phase(s, PHASE_DI);
682 s->current_dev->read_data(s->current_dev, s->current_tag);
684 lsi_set_phase(s, PHASE_DO);
685 s->current_dev->write_data(s->current_dev, s->current_tag);
688 if (!s->command_complete) {
690 /* Command did not complete immediately so disconnect. */
691 lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
692 lsi_add_msg_byte(s, 4); /* DISCONNECT */
694 lsi_set_phase(s, PHASE_MI);
696 lsi_queue_command(s);
698 /* wait command complete */
699 lsi_set_phase(s, PHASE_DI);
704 static void lsi_do_status(LSIState *s)
707 DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
709 BADF("Bad Status move\n");
713 cpu_physical_memory_write(s->dnad, &sense, 1);
714 lsi_set_phase(s, PHASE_MI);
716 lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
719 static void lsi_disconnect(LSIState *s)
721 s->scntl1 &= ~LSI_SCNTL1_CON;
722 s->sstat1 &= ~PHASE_MASK;
725 static void lsi_do_msgin(LSIState *s)
728 DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
733 cpu_physical_memory_write(s->dnad, s->msg, len);
734 /* Linux drivers rely on the last byte being in the SIDL. */
735 s->sidl = s->msg[len - 1];
738 memmove(s->msg, s->msg + len, s->msg_len);
740 /* ??? Check if ATN (not yet implemented) is asserted and maybe
741 switch to PHASE_MO. */
742 switch (s->msg_action) {
744 lsi_set_phase(s, PHASE_CMD);
750 lsi_set_phase(s, PHASE_DO);
753 lsi_set_phase(s, PHASE_DI);
761 /* Read the next byte during a MSGOUT phase. */
762 static uint8_t lsi_get_msgbyte(LSIState *s)
765 cpu_physical_memory_read(s->dnad, &data, 1);
771 static void lsi_do_msgout(LSIState *s)
776 DPRINTF("MSG out len=%d\n", s->dbc);
778 msg = lsi_get_msgbyte(s);
783 DPRINTF("MSG: Disconnect\n");
787 DPRINTF("MSG: No Operation\n");
788 lsi_set_phase(s, PHASE_CMD);
791 len = lsi_get_msgbyte(s);
792 msg = lsi_get_msgbyte(s);
793 DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
796 DPRINTF("SDTR (ignored)\n");
800 DPRINTF("WDTR (ignored)\n");
807 case 0x20: /* SIMPLE queue */
808 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
809 DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
811 case 0x21: /* HEAD of queue */
812 BADF("HEAD queue not implemented\n");
813 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
815 case 0x22: /* ORDERED queue */
816 BADF("ORDERED queue not implemented\n");
817 s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
820 if ((msg & 0x80) == 0) {
823 s->current_lun = msg & 7;
824 DPRINTF("Select LUN %d\n", s->current_lun);
825 lsi_set_phase(s, PHASE_CMD);
831 BADF("Unimplemented message 0x%02x\n", msg);
832 lsi_set_phase(s, PHASE_MI);
833 lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
837 /* Sign extend a 24-bit value. */
838 static inline int32_t sxt24(int32_t n)
840 return (n << 8) >> 8;
843 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
846 uint8_t buf[TARGET_PAGE_SIZE];
848 DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
850 n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
851 cpu_physical_memory_read(src, buf, n);
852 cpu_physical_memory_write(dest, buf, n);
859 static void lsi_wait_reselect(LSIState *s)
862 DPRINTF("Wait Reselect\n");
863 if (s->current_dma_len)
864 BADF("Reselect with pending DMA\n");
865 for (i = 0; i < s->active_commands; i++) {
866 if (s->queue[i].pending) {
867 lsi_reselect(s, s->queue[i].tag);
871 if (s->current_dma_len == 0) {
876 static void lsi_execute_script(LSIState *s)
879 uint32_t addr, addr_high;
881 int insn_processed = 0;
883 s->istat1 |= LSI_ISTAT1_SRUN;
886 insn = read_dword(s, s->dsp);
888 /* If we receive an empty opcode increment the DSP by 4 bytes
889 instead of 8 and execute the next opcode at that location */
893 addr = read_dword(s, s->dsp + 4);
895 DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
897 s->dcmd = insn >> 24;
899 switch (insn >> 30) {
900 case 0: /* Block move. */
901 if (s->sist1 & LSI_SIST1_STO) {
902 DPRINTF("Delayed select timeout\n");
906 s->dbc = insn & 0xffffff;
910 if (insn & (1 << 29)) {
911 /* Indirect addressing. */
912 addr = read_dword(s, addr);
913 } else if (insn & (1 << 28)) {
916 /* Table indirect addressing. */
918 /* 32-bit Table indirect */
919 offset = sxt24(addr);
920 cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
921 /* byte count is stored in bits 0:23 only */
922 s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
924 addr = cpu_to_le32(buf[1]);
926 /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
927 * table, bits [31:24] */
928 if (lsi_dma_40bit(s))
929 addr_high = cpu_to_le32(buf[0]) >> 24;
930 else if (lsi_dma_ti64bit(s)) {
931 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
934 /* offset index into scratch registers since
935 * TI64 mode can use registers C to R */
936 addr_high = s->scratch[2 + selector];
957 BADF("Illegal selector specified (0x%x > 0x15)"
958 " for 64-bit DMA block move", selector);
962 } else if (lsi_dma_64bit(s)) {
963 /* fetch a 3rd dword if 64-bit direct move is enabled and
964 only if we're not doing table indirect or indirect addressing */
965 s->dbms = read_dword(s, s->dsp);
969 if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
970 DPRINTF("Wrong phase got %d expected %d\n",
971 s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
972 lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
976 s->dnad64 = addr_high;
977 switch (s->sstat1 & 0x7) {
1003 BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1006 s->dfifo = s->dbc & 0xff;
1007 s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1010 s->ua = addr + s->dbc;
1013 case 1: /* IO or Read/Write instruction. */
1014 opcode = (insn >> 27) & 7;
1018 if (insn & (1 << 25)) {
1019 id = read_dword(s, s->dsa + sxt24(insn));
1023 id = (id >> 16) & 0xf;
1024 if (insn & (1 << 26)) {
1025 addr = s->dsp + sxt24(addr);
1029 case 0: /* Select */
1031 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1032 DPRINTF("Already reselected by target %d\n", id);
1035 s->sstat0 |= LSI_SSTAT0_WOA;
1036 s->scntl1 &= ~LSI_SCNTL1_IARB;
1037 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
1038 DPRINTF("Selected absent target %d\n", id);
1039 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1043 DPRINTF("Selected target %d%s\n",
1044 id, insn & (1 << 3) ? " ATN" : "");
1045 /* ??? Linux drivers compain when this is set. Maybe
1046 it only applies in low-level mode (unimplemented).
1047 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1048 s->current_dev = s->scsi_dev[id];
1049 s->current_tag = id << 8;
1050 s->scntl1 |= LSI_SCNTL1_CON;
1051 if (insn & (1 << 3)) {
1052 s->socl |= LSI_SOCL_ATN;
1054 lsi_set_phase(s, PHASE_MO);
1056 case 1: /* Disconnect */
1057 DPRINTF("Wait Disconect\n");
1058 s->scntl1 &= ~LSI_SCNTL1_CON;
1060 case 2: /* Wait Reselect */
1061 lsi_wait_reselect(s);
1064 DPRINTF("Set%s%s%s%s\n",
1065 insn & (1 << 3) ? " ATN" : "",
1066 insn & (1 << 6) ? " ACK" : "",
1067 insn & (1 << 9) ? " TM" : "",
1068 insn & (1 << 10) ? " CC" : "");
1069 if (insn & (1 << 3)) {
1070 s->socl |= LSI_SOCL_ATN;
1071 lsi_set_phase(s, PHASE_MO);
1073 if (insn & (1 << 9)) {
1074 BADF("Target mode not implemented\n");
1077 if (insn & (1 << 10))
1081 DPRINTF("Clear%s%s%s%s\n",
1082 insn & (1 << 3) ? " ATN" : "",
1083 insn & (1 << 6) ? " ACK" : "",
1084 insn & (1 << 9) ? " TM" : "",
1085 insn & (1 << 10) ? " CC" : "");
1086 if (insn & (1 << 3)) {
1087 s->socl &= ~LSI_SOCL_ATN;
1089 if (insn & (1 << 10))
1100 static const char *opcode_names[3] =
1101 {"Write", "Read", "Read-Modify-Write"};
1102 static const char *operator_names[8] =
1103 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1106 reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1107 data8 = (insn >> 8) & 0xff;
1108 opcode = (insn >> 27) & 7;
1109 operator = (insn >> 24) & 7;
1110 DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1111 opcode_names[opcode - 5], reg,
1112 operator_names[operator], data8, s->sfbr,
1113 (insn & (1 << 23)) ? " SFBR" : "");
1116 case 5: /* From SFBR */
1120 case 6: /* To SFBR */
1122 op0 = lsi_reg_readb(s, reg);
1125 case 7: /* Read-modify-write */
1127 op0 = lsi_reg_readb(s, reg);
1128 if (insn & (1 << 23)) {
1140 case 1: /* Shift left */
1142 op0 = (op0 << 1) | s->carry;
1156 op0 = (op0 >> 1) | (s->carry << 7);
1161 s->carry = op0 < op1;
1164 op0 += op1 + s->carry;
1166 s->carry = op0 <= op1;
1168 s->carry = op0 < op1;
1173 case 5: /* From SFBR */
1174 case 7: /* Read-modify-write */
1175 lsi_reg_writeb(s, reg, op0);
1177 case 6: /* To SFBR */
1184 case 2: /* Transfer Control. */
1189 if ((insn & 0x002e0000) == 0) {
1193 if (s->sist1 & LSI_SIST1_STO) {
1194 DPRINTF("Delayed select timeout\n");
1198 cond = jmp = (insn & (1 << 19)) != 0;
1199 if (cond == jmp && (insn & (1 << 21))) {
1200 DPRINTF("Compare carry %d\n", s->carry == jmp);
1201 cond = s->carry != 0;
1203 if (cond == jmp && (insn & (1 << 17))) {
1204 DPRINTF("Compare phase %d %c= %d\n",
1205 (s->sstat1 & PHASE_MASK),
1207 ((insn >> 24) & 7));
1208 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1210 if (cond == jmp && (insn & (1 << 18))) {
1213 mask = (~insn >> 8) & 0xff;
1214 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1215 s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1216 cond = (s->sfbr & mask) == (insn & mask);
1219 if (insn & (1 << 23)) {
1220 /* Relative address. */
1221 addr = s->dsp + sxt24(addr);
1223 switch ((insn >> 27) & 7) {
1225 DPRINTF("Jump to 0x%08x\n", addr);
1229 DPRINTF("Call 0x%08x\n", addr);
1233 case 2: /* Return */
1234 DPRINTF("Return to 0x%08x\n", s->temp);
1237 case 3: /* Interrupt */
1238 DPRINTF("Interrupt 0x%08x\n", s->dsps);
1239 if ((insn & (1 << 20)) != 0) {
1240 s->istat0 |= LSI_ISTAT0_INTF;
1243 lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1247 DPRINTF("Illegal transfer control\n");
1248 lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1252 DPRINTF("Control condition failed\n");
1258 if ((insn & (1 << 29)) == 0) {
1261 /* ??? The docs imply the destination address is loaded into
1262 the TEMP register. However the Linux drivers rely on
1263 the value being presrved. */
1264 dest = read_dword(s, s->dsp);
1266 lsi_memcpy(s, dest, addr, insn & 0xffffff);
1273 if (insn & (1 << 28)) {
1274 addr = s->dsa + sxt24(addr);
1277 reg = (insn >> 16) & 0xff;
1278 if (insn & (1 << 24)) {
1279 cpu_physical_memory_read(addr, data, n);
1280 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1281 addr, *(int *)data);
1282 for (i = 0; i < n; i++) {
1283 lsi_reg_writeb(s, reg + i, data[i]);
1286 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1287 for (i = 0; i < n; i++) {
1288 data[i] = lsi_reg_readb(s, reg + i);
1290 cpu_physical_memory_write(addr, data, n);
1294 if (insn_processed > 10000 && !s->waiting) {
1295 /* Some windows drivers make the device spin waiting for a memory
1296 location to change. If we have been executed a lot of code then
1297 assume this is the case and force an unexpected device disconnect.
1298 This is apparently sufficient to beat the drivers into submission.
1300 if (!(s->sien0 & LSI_SIST0_UDC))
1301 fprintf(stderr, "inf. loop with UDC masked\n");
1302 lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1304 } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1305 if (s->dcntl & LSI_DCNTL_SSM) {
1306 lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1311 DPRINTF("SCRIPTS execution stopped\n");
1314 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1317 #define CASE_GET_REG32(name, addr) \
1318 case addr: return s->name & 0xff; \
1319 case addr + 1: return (s->name >> 8) & 0xff; \
1320 case addr + 2: return (s->name >> 16) & 0xff; \
1321 case addr + 3: return (s->name >> 24) & 0xff;
1323 #ifdef DEBUG_LSI_REG
1324 DPRINTF("Read reg %x\n", offset);
1327 case 0x00: /* SCNTL0 */
1329 case 0x01: /* SCNTL1 */
1331 case 0x02: /* SCNTL2 */
1333 case 0x03: /* SCNTL3 */
1335 case 0x04: /* SCID */
1337 case 0x05: /* SXFER */
1339 case 0x06: /* SDID */
1341 case 0x07: /* GPREG0 */
1343 case 0x08: /* Revision ID */
1345 case 0xa: /* SSID */
1347 case 0xb: /* SBCL */
1348 /* ??? This is not correct. However it's (hopefully) only
1349 used for diagnostics, so should be ok. */
1351 case 0xc: /* DSTAT */
1352 tmp = s->dstat | 0x80;
1353 if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1357 case 0x0d: /* SSTAT0 */
1359 case 0x0e: /* SSTAT1 */
1361 case 0x0f: /* SSTAT2 */
1362 return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1363 CASE_GET_REG32(dsa, 0x10)
1364 case 0x14: /* ISTAT0 */
1366 case 0x16: /* MBOX0 */
1368 case 0x17: /* MBOX1 */
1370 case 0x18: /* CTEST0 */
1372 case 0x19: /* CTEST1 */
1374 case 0x1a: /* CTEST2 */
1375 tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1376 if (s->istat0 & LSI_ISTAT0_SIGP) {
1377 s->istat0 &= ~LSI_ISTAT0_SIGP;
1378 tmp |= LSI_CTEST2_SIGP;
1381 case 0x1b: /* CTEST3 */
1383 CASE_GET_REG32(temp, 0x1c)
1384 case 0x20: /* DFIFO */
1386 case 0x21: /* CTEST4 */
1388 case 0x22: /* CTEST5 */
1390 case 0x23: /* CTEST6 */
1392 case 0x24: /* DBC[0:7] */
1393 return s->dbc & 0xff;
1394 case 0x25: /* DBC[8:15] */
1395 return (s->dbc >> 8) & 0xff;
1396 case 0x26: /* DBC[16->23] */
1397 return (s->dbc >> 16) & 0xff;
1398 case 0x27: /* DCMD */
1400 CASE_GET_REG32(dsp, 0x2c)
1401 CASE_GET_REG32(dsps, 0x30)
1402 CASE_GET_REG32(scratch[0], 0x34)
1403 case 0x38: /* DMODE */
1405 case 0x39: /* DIEN */
1407 case 0x3b: /* DCNTL */
1409 case 0x40: /* SIEN0 */
1411 case 0x41: /* SIEN1 */
1413 case 0x42: /* SIST0 */
1418 case 0x43: /* SIST1 */
1423 case 0x46: /* MACNTL */
1425 case 0x47: /* GPCNTL0 */
1427 case 0x48: /* STIME0 */
1429 case 0x4a: /* RESPID0 */
1431 case 0x4b: /* RESPID1 */
1433 case 0x4d: /* STEST1 */
1435 case 0x4e: /* STEST2 */
1437 case 0x4f: /* STEST3 */
1439 case 0x50: /* SIDL */
1440 /* This is needed by the linux drivers. We currently only update it
1441 during the MSG IN phase. */
1443 case 0x52: /* STEST4 */
1445 case 0x56: /* CCNTL0 */
1447 case 0x57: /* CCNTL1 */
1449 case 0x58: /* SBDL */
1450 /* Some drivers peek at the data bus during the MSG IN phase. */
1451 if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1454 case 0x59: /* SBDL high */
1456 CASE_GET_REG32(mmrs, 0xa0)
1457 CASE_GET_REG32(mmws, 0xa4)
1458 CASE_GET_REG32(sfs, 0xa8)
1459 CASE_GET_REG32(drs, 0xac)
1460 CASE_GET_REG32(sbms, 0xb0)
1461 CASE_GET_REG32(dbms, 0xb4)
1462 CASE_GET_REG32(dnad64, 0xb8)
1463 CASE_GET_REG32(pmjad1, 0xc0)
1464 CASE_GET_REG32(pmjad2, 0xc4)
1465 CASE_GET_REG32(rbc, 0xc8)
1466 CASE_GET_REG32(ua, 0xcc)
1467 CASE_GET_REG32(ia, 0xd4)
1468 CASE_GET_REG32(sbc, 0xd8)
1469 CASE_GET_REG32(csbc, 0xdc)
1471 if (offset >= 0x5c && offset < 0xa0) {
1474 n = (offset - 0x58) >> 2;
1475 shift = (offset & 3) * 8;
1476 return (s->scratch[n] >> shift) & 0xff;
1478 BADF("readb 0x%x\n", offset);
1480 #undef CASE_GET_REG32
1483 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1485 #define CASE_SET_REG32(name, addr) \
1486 case addr : s->name &= 0xffffff00; s->name |= val; break; \
1487 case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8; break; \
1488 case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1489 case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1491 #ifdef DEBUG_LSI_REG
1492 DPRINTF("Write reg %x = %02x\n", offset, val);
1495 case 0x00: /* SCNTL0 */
1497 if (val & LSI_SCNTL0_START) {
1498 BADF("Start sequence not implemented\n");
1501 case 0x01: /* SCNTL1 */
1502 s->scntl1 = val & ~LSI_SCNTL1_SST;
1503 if (val & LSI_SCNTL1_IARB) {
1504 BADF("Immediate Arbritration not implemented\n");
1506 if (val & LSI_SCNTL1_RST) {
1507 s->sstat0 |= LSI_SSTAT0_RST;
1508 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1510 s->sstat0 &= ~LSI_SSTAT0_RST;
1513 case 0x02: /* SCNTL2 */
1514 val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1517 case 0x03: /* SCNTL3 */
1520 case 0x04: /* SCID */
1523 case 0x05: /* SXFER */
1526 case 0x06: /* SDID */
1527 if ((val & 0xf) != (s->ssid & 0xf))
1528 BADF("Destination ID does not match SSID\n");
1529 s->sdid = val & 0xf;
1531 case 0x07: /* GPREG0 */
1533 case 0x08: /* SFBR */
1534 /* The CPU is not allowed to write to this register. However the
1535 SCRIPTS register move instructions are. */
1538 case 0x0a: case 0x0b:
1539 /* Openserver writes to these readonly registers on startup */
1541 case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1542 /* Linux writes to these readonly registers on startup. */
1544 CASE_SET_REG32(dsa, 0x10)
1545 case 0x14: /* ISTAT0 */
1546 s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1547 if (val & LSI_ISTAT0_ABRT) {
1548 lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1550 if (val & LSI_ISTAT0_INTF) {
1551 s->istat0 &= ~LSI_ISTAT0_INTF;
1554 if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1555 DPRINTF("Woken by SIGP\n");
1558 lsi_execute_script(s);
1560 if (val & LSI_ISTAT0_SRST) {
1564 case 0x16: /* MBOX0 */
1567 case 0x17: /* MBOX1 */
1570 case 0x1a: /* CTEST2 */
1571 s->ctest2 = val & LSI_CTEST2_PCICIE;
1573 case 0x1b: /* CTEST3 */
1574 s->ctest3 = val & 0x0f;
1576 CASE_SET_REG32(temp, 0x1c)
1577 case 0x21: /* CTEST4 */
1579 BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1583 case 0x22: /* CTEST5 */
1584 if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1585 BADF("CTEST5 DMA increment not implemented\n");
1589 case 0x2c: /* DSP[0:7] */
1590 s->dsp &= 0xffffff00;
1593 case 0x2d: /* DSP[8:15] */
1594 s->dsp &= 0xffff00ff;
1597 case 0x2e: /* DSP[16:23] */
1598 s->dsp &= 0xff00ffff;
1599 s->dsp |= val << 16;
1601 case 0x2f: /* DSP[24:31] */
1602 s->dsp &= 0x00ffffff;
1603 s->dsp |= val << 24;
1604 if ((s->dmode & LSI_DMODE_MAN) == 0
1605 && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1606 lsi_execute_script(s);
1608 CASE_SET_REG32(dsps, 0x30)
1609 CASE_SET_REG32(scratch[0], 0x34)
1610 case 0x38: /* DMODE */
1611 if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1612 BADF("IO mappings not implemented\n");
1616 case 0x39: /* DIEN */
1620 case 0x3b: /* DCNTL */
1621 s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1622 if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1623 lsi_execute_script(s);
1625 case 0x40: /* SIEN0 */
1629 case 0x41: /* SIEN1 */
1633 case 0x47: /* GPCNTL0 */
1635 case 0x48: /* STIME0 */
1638 case 0x49: /* STIME1 */
1640 DPRINTF("General purpose timer not implemented\n");
1641 /* ??? Raising the interrupt immediately seems to be sufficient
1642 to keep the FreeBSD driver happy. */
1643 lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1646 case 0x4a: /* RESPID0 */
1649 case 0x4b: /* RESPID1 */
1652 case 0x4d: /* STEST1 */
1655 case 0x4e: /* STEST2 */
1657 BADF("Low level mode not implemented\n");
1661 case 0x4f: /* STEST3 */
1663 BADF("SCSI FIFO test mode not implemented\n");
1667 case 0x56: /* CCNTL0 */
1670 case 0x57: /* CCNTL1 */
1673 CASE_SET_REG32(mmrs, 0xa0)
1674 CASE_SET_REG32(mmws, 0xa4)
1675 CASE_SET_REG32(sfs, 0xa8)
1676 CASE_SET_REG32(drs, 0xac)
1677 CASE_SET_REG32(sbms, 0xb0)
1678 CASE_SET_REG32(dbms, 0xb4)
1679 CASE_SET_REG32(dnad64, 0xb8)
1680 CASE_SET_REG32(pmjad1, 0xc0)
1681 CASE_SET_REG32(pmjad2, 0xc4)
1682 CASE_SET_REG32(rbc, 0xc8)
1683 CASE_SET_REG32(ua, 0xcc)
1684 CASE_SET_REG32(ia, 0xd4)
1685 CASE_SET_REG32(sbc, 0xd8)
1686 CASE_SET_REG32(csbc, 0xdc)
1688 if (offset >= 0x5c && offset < 0xa0) {
1691 n = (offset - 0x58) >> 2;
1692 shift = (offset & 3) * 8;
1693 s->scratch[n] &= ~(0xff << shift);
1694 s->scratch[n] |= (val & 0xff) << shift;
1696 BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1699 #undef CASE_SET_REG32
1702 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1704 LSIState *s = (LSIState *)opaque;
1706 lsi_reg_writeb(s, addr & 0xff, val);
1709 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1711 LSIState *s = (LSIState *)opaque;
1714 lsi_reg_writeb(s, addr, val & 0xff);
1715 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1718 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1720 LSIState *s = (LSIState *)opaque;
1723 lsi_reg_writeb(s, addr, val & 0xff);
1724 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1725 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1726 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1729 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1731 LSIState *s = (LSIState *)opaque;
1733 return lsi_reg_readb(s, addr & 0xff);
1736 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1738 LSIState *s = (LSIState *)opaque;
1742 val = lsi_reg_readb(s, addr);
1743 val |= lsi_reg_readb(s, addr + 1) << 8;
1747 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1749 LSIState *s = (LSIState *)opaque;
1752 val = lsi_reg_readb(s, addr);
1753 val |= lsi_reg_readb(s, addr + 1) << 8;
1754 val |= lsi_reg_readb(s, addr + 2) << 16;
1755 val |= lsi_reg_readb(s, addr + 3) << 24;
1759 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1765 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1771 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1773 LSIState *s = (LSIState *)opaque;
1778 newval = s->script_ram[addr >> 2];
1779 shift = (addr & 3) * 8;
1780 newval &= ~(0xff << shift);
1781 newval |= val << shift;
1782 s->script_ram[addr >> 2] = newval;
1785 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1787 LSIState *s = (LSIState *)opaque;
1791 newval = s->script_ram[addr >> 2];
1793 newval = (newval & 0xffff) | (val << 16);
1795 newval = (newval & 0xffff0000) | val;
1797 s->script_ram[addr >> 2] = newval;
1801 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1803 LSIState *s = (LSIState *)opaque;
1806 s->script_ram[addr >> 2] = val;
1809 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1811 LSIState *s = (LSIState *)opaque;
1815 val = s->script_ram[addr >> 2];
1816 val >>= (addr & 3) * 8;
1820 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1822 LSIState *s = (LSIState *)opaque;
1826 val = s->script_ram[addr >> 2];
1829 return le16_to_cpu(val);
1832 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1834 LSIState *s = (LSIState *)opaque;
1837 return le32_to_cpu(s->script_ram[addr >> 2]);
1840 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1846 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1852 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1854 LSIState *s = (LSIState *)opaque;
1855 return lsi_reg_readb(s, addr & 0xff);
1858 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1860 LSIState *s = (LSIState *)opaque;
1863 val = lsi_reg_readb(s, addr);
1864 val |= lsi_reg_readb(s, addr + 1) << 8;
1868 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1870 LSIState *s = (LSIState *)opaque;
1873 val = lsi_reg_readb(s, addr);
1874 val |= lsi_reg_readb(s, addr + 1) << 8;
1875 val |= lsi_reg_readb(s, addr + 2) << 16;
1876 val |= lsi_reg_readb(s, addr + 3) << 24;
1880 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1882 LSIState *s = (LSIState *)opaque;
1883 lsi_reg_writeb(s, addr & 0xff, val);
1886 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1888 LSIState *s = (LSIState *)opaque;
1890 lsi_reg_writeb(s, addr, val & 0xff);
1891 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1894 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1896 LSIState *s = (LSIState *)opaque;
1898 lsi_reg_writeb(s, addr, val & 0xff);
1899 lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1900 lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1901 lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1904 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1905 uint32_t addr, uint32_t size, int type)
1907 LSIState *s = (LSIState *)pci_dev;
1909 DPRINTF("Mapping IO at %08x\n", addr);
1911 register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1912 register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1913 register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1914 register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1915 register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1916 register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1919 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1920 uint32_t addr, uint32_t size, int type)
1922 LSIState *s = (LSIState *)pci_dev;
1924 DPRINTF("Mapping ram at %08x\n", addr);
1925 s->script_ram_base = addr;
1926 cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1929 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1930 uint32_t addr, uint32_t size, int type)
1932 LSIState *s = (LSIState *)pci_dev;
1934 DPRINTF("Mapping registers at %08x\n", addr);
1935 cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1938 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1940 LSIState *s = (LSIState *)opaque;
1943 for (id = 0; id < LSI_MAX_DEVS; id++) {
1944 if (s->scsi_dev[id] == NULL)
1948 if (id >= LSI_MAX_DEVS) {
1949 BADF("Bad Device ID %d\n", id);
1952 if (s->scsi_dev[id]) {
1953 DPRINTF("Destroying device %d\n", id);
1954 s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1956 DPRINTF("Attaching block device %d\n", id);
1957 s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1958 if (s->scsi_dev[id] == NULL)
1959 s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1962 void *lsi_scsi_init(PCIBus *bus, int devfn)
1966 s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1967 sizeof(*s), devfn, NULL, NULL);
1969 fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1973 /* PCI Vendor ID (word) */
1974 s->pci_dev.config[0x00] = 0x00;
1975 s->pci_dev.config[0x01] = 0x10;
1976 /* PCI device ID (word) */
1977 s->pci_dev.config[0x02] = 0x12;
1978 s->pci_dev.config[0x03] = 0x00;
1979 /* PCI base class code */
1980 s->pci_dev.config[0x0b] = 0x01;
1981 /* PCI subsystem ID */
1982 s->pci_dev.config[0x2e] = 0x00;
1983 s->pci_dev.config[0x2f] = 0x10;
1984 /* PCI latency timer = 255 */
1985 s->pci_dev.config[0x0d] = 0xff;
1986 /* Interrupt pin 1 */
1987 s->pci_dev.config[0x3d] = 0x01;
1989 s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1990 lsi_mmio_writefn, s);
1991 s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1992 lsi_ram_writefn, s);
1994 pci_register_io_region((struct PCIDevice *)s, 0, 256,
1995 PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1996 pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1997 PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
1998 pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
1999 PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
2000 s->queue = qemu_malloc(sizeof(lsi_queue));
2002 s->active_commands = 0;