hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include <assert.h>                             \
  14
  15 #include "hw.h"
  16 #include "pci.h"
  17 #include "scsi.h"
  18 #include "block_int.h"
  19
  20 //#define DEBUG_LSI
  21 //#define DEBUG_LSI_REG
  22
  23 #ifdef DEBUG_LSI
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
  26 #define BADF(fmt, ...) \
  27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
  28 #else
  29 #define DPRINTF(fmt, ...) do {} while(0)
  30 #define BADF(fmt, ...) \
  31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
  32 #endif
  33
  34 #define LSI_MAX_DEVS 7
  35
  36 #define LSI_SCNTL0_TRG    0x01
  37 #define LSI_SCNTL0_AAP    0x02
  38 #define LSI_SCNTL0_EPC    0x08
  39 #define LSI_SCNTL0_WATN   0x10
  40 #define LSI_SCNTL0_START  0x20
  41
  42 #define LSI_SCNTL1_SST    0x01
  43 #define LSI_SCNTL1_IARB   0x02
  44 #define LSI_SCNTL1_AESP   0x04
  45 #define LSI_SCNTL1_RST    0x08
  46 #define LSI_SCNTL1_CON    0x10
  47 #define LSI_SCNTL1_DHP    0x20
  48 #define LSI_SCNTL1_ADB    0x40
  49 #define LSI_SCNTL1_EXC    0x80
  50
  51 #define LSI_SCNTL2_WSR    0x01
  52 #define LSI_SCNTL2_VUE0   0x02
  53 #define LSI_SCNTL2_VUE1   0x04
  54 #define LSI_SCNTL2_WSS    0x08
  55 #define LSI_SCNTL2_SLPHBEN 0x10
  56 #define LSI_SCNTL2_SLPMD  0x20
  57 #define LSI_SCNTL2_CHM    0x40
  58 #define LSI_SCNTL2_SDU    0x80
  59
  60 #define LSI_ISTAT0_DIP    0x01
  61 #define LSI_ISTAT0_SIP    0x02
  62 #define LSI_ISTAT0_INTF   0x04
  63 #define LSI_ISTAT0_CON    0x08
  64 #define LSI_ISTAT0_SEM    0x10
  65 #define LSI_ISTAT0_SIGP   0x20
  66 #define LSI_ISTAT0_SRST   0x40
  67 #define LSI_ISTAT0_ABRT   0x80
  68
  69 #define LSI_ISTAT1_SI     0x01
  70 #define LSI_ISTAT1_SRUN   0x02
  71 #define LSI_ISTAT1_FLSH   0x04
  72
  73 #define LSI_SSTAT0_SDP0   0x01
  74 #define LSI_SSTAT0_RST    0x02
  75 #define LSI_SSTAT0_WOA    0x04
  76 #define LSI_SSTAT0_LOA    0x08
  77 #define LSI_SSTAT0_AIP    0x10
  78 #define LSI_SSTAT0_OLF    0x20
  79 #define LSI_SSTAT0_ORF    0x40
  80 #define LSI_SSTAT0_ILF    0x80
  81
  82 #define LSI_SIST0_PAR     0x01
  83 #define LSI_SIST0_RST     0x02
  84 #define LSI_SIST0_UDC     0x04
  85 #define LSI_SIST0_SGE     0x08
  86 #define LSI_SIST0_RSL     0x10
  87 #define LSI_SIST0_SEL     0x20
  88 #define LSI_SIST0_CMP     0x40
  89 #define LSI_SIST0_MA      0x80
  90
  91 #define LSI_SIST1_HTH     0x01
  92 #define LSI_SIST1_GEN     0x02
  93 #define LSI_SIST1_STO     0x04
  94 #define LSI_SIST1_SBMC    0x10
  95
  96 #define LSI_SOCL_IO       0x01
  97 #define LSI_SOCL_CD       0x02
  98 #define LSI_SOCL_MSG      0x04
  99 #define LSI_SOCL_ATN      0x08
 100 #define LSI_SOCL_SEL      0x10
 101 #define LSI_SOCL_BSY      0x20
 102 #define LSI_SOCL_ACK      0x40
 103 #define LSI_SOCL_REQ      0x80
 104
 105 #define LSI_DSTAT_IID     0x01
 106 #define LSI_DSTAT_SIR     0x04
 107 #define LSI_DSTAT_SSI     0x08
 108 #define LSI_DSTAT_ABRT    0x10
 109 #define LSI_DSTAT_BF      0x20
 110 #define LSI_DSTAT_MDPE    0x40
 111 #define LSI_DSTAT_DFE     0x80
 112
 113 #define LSI_DCNTL_COM     0x01
 114 #define LSI_DCNTL_IRQD    0x02
 115 #define LSI_DCNTL_STD     0x04
 116 #define LSI_DCNTL_IRQM    0x08
 117 #define LSI_DCNTL_SSM     0x10
 118 #define LSI_DCNTL_PFEN    0x20
 119 #define LSI_DCNTL_PFF     0x40
 120 #define LSI_DCNTL_CLSE    0x80
 121
 122 #define LSI_DMODE_MAN     0x01
 123 #define LSI_DMODE_BOF     0x02
 124 #define LSI_DMODE_ERMP    0x04
 125 #define LSI_DMODE_ERL     0x08
 126 #define LSI_DMODE_DIOM    0x10
 127 #define LSI_DMODE_SIOM    0x20
 128
 129 #define LSI_CTEST2_DACK   0x01
 130 #define LSI_CTEST2_DREQ   0x02
 131 #define LSI_CTEST2_TEOP   0x04
 132 #define LSI_CTEST2_PCICIE 0x08
 133 #define LSI_CTEST2_CM     0x10
 134 #define LSI_CTEST2_CIO    0x20
 135 #define LSI_CTEST2_SIGP   0x40
 136 #define LSI_CTEST2_DDIR   0x80
 137
 138 #define LSI_CTEST5_BL2    0x04
 139 #define LSI_CTEST5_DDIR   0x08
 140 #define LSI_CTEST5_MASR   0x10
 141 #define LSI_CTEST5_DFSN   0x20
 142 #define LSI_CTEST5_BBCK   0x40
 143 #define LSI_CTEST5_ADCK   0x80
 144
 145 #define LSI_CCNTL0_DILS   0x01
 146 #define LSI_CCNTL0_DISFC  0x10
 147 #define LSI_CCNTL0_ENNDJ  0x20
 148 #define LSI_CCNTL0_PMJCTL 0x40
 149 #define LSI_CCNTL0_ENPMJ  0x80
 150
 151 #define LSI_CCNTL1_EN64DBMV  0x01
 152 #define LSI_CCNTL1_EN64TIBMV 0x02
 153 #define LSI_CCNTL1_64TIMOD   0x04
 154 #define LSI_CCNTL1_DDAC      0x08
 155 #define LSI_CCNTL1_ZMOD      0x80
 156
 157 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 158
 159 #define PHASE_DO          0
 160 #define PHASE_DI          1
 161 #define PHASE_CMD         2
 162 #define PHASE_ST          3
 163 #define PHASE_MO          6
 164 #define PHASE_MI          7
 165 #define PHASE_MASK        7
 166
 167 /* Maximum length of MSG IN data.  */
 168 #define LSI_MAX_MSGIN_LEN 8
 169
 170 /* Flag set if this is a tagged command.  */
 171 #define LSI_TAG_VALID     (1 << 16)
 172
 173 typedef struct {
 174     uint32_t tag;
 175     uint32_t pending;
 176     int out;
 177 } lsi_queue;
 178
 179 typedef struct {
 180     PCIDevice dev;
 181     int mmio_io_addr;
 182     int ram_io_addr;
 183     uint32_t script_ram_base;
 184
 185     int carry; /* ??? Should this be an a visible register somewhere?  */
 186     int sense;
 187     /* Action to take at the end of a MSG IN phase.
 188        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 189     int msg_action;
 190     int msg_len;
 191     uint8_t msg[LSI_MAX_MSGIN_LEN];
 192     /* 0 if SCRIPTS are running or stopped.
 193      * 1 if a Wait Reselect instruction has been issued.
 194      * 2 if processing DMA from lsi_execute_script.
 195      * 3 if a DMA operation is in progress.  */
 196     int waiting;
 197     SCSIBus bus;
 198     SCSIDevice *current_dev;
 199     int current_lun;
 200     /* The tag is a combination of the device ID and the SCSI tag.  */
 201     uint32_t current_tag;
 202     uint32_t current_dma_len;
 203     int command_complete;
 204     uint8_t *dma_buf;
 205     lsi_queue *queue;
 206     int queue_len;
 207     int active_commands;
 208
 209     uint32_t dsa;
 210     uint32_t temp;
 211     uint32_t dnad;
 212     uint32_t dbc;
 213     uint8_t istat0;
 214     uint8_t istat1;
 215     uint8_t dcmd;
 216     uint8_t dstat;
 217     uint8_t dien;
 218     uint8_t sist0;
 219     uint8_t sist1;
 220     uint8_t sien0;
 221     uint8_t sien1;
 222     uint8_t mbox0;
 223     uint8_t mbox1;
 224     uint8_t dfifo;
 225     uint8_t ctest2;
 226     uint8_t ctest3;
 227     uint8_t ctest4;
 228     uint8_t ctest5;
 229     uint8_t ccntl0;
 230     uint8_t ccntl1;
 231     uint32_t dsp;
 232     uint32_t dsps;
 233     uint8_t dmode;
 234     uint8_t dcntl;
 235     uint8_t scntl0;
 236     uint8_t scntl1;
 237     uint8_t scntl2;
 238     uint8_t scntl3;
 239     uint8_t sstat0;
 240     uint8_t sstat1;
 241     uint8_t scid;
 242     uint8_t sxfer;
 243     uint8_t socl;
 244     uint8_t sdid;
 245     uint8_t ssid;
 246     uint8_t sfbr;
 247     uint8_t stest1;
 248     uint8_t stest2;
 249     uint8_t stest3;
 250     uint8_t sidl;
 251     uint8_t stime0;
 252     uint8_t respid0;
 253     uint8_t respid1;
 254     uint32_t mmrs;
 255     uint32_t mmws;
 256     uint32_t sfs;
 257     uint32_t drs;
 258     uint32_t sbms;
 259     uint32_t dbms;
 260     uint32_t dnad64;
 261     uint32_t pmjad1;
 262     uint32_t pmjad2;
 263     uint32_t rbc;
 264     uint32_t ua;
 265     uint32_t ia;
 266     uint32_t sbc;
 267     uint32_t csbc;
 268     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 269     uint8_t sbr;
 270
 271     /* Script ram is stored as 32-bit words in host byteorder.  */
 272     uint32_t script_ram[2048];
 273 } LSIState;
 274
 275 static void lsi_soft_reset(LSIState *s)
 276 {
 277     DPRINTF("Reset\n");
 278     s->carry = 0;
 279
 280     s->waiting = 0;
 281     s->dsa = 0;
 282     s->dnad = 0;
 283     s->dbc = 0;
 284     s->temp = 0;
 285     memset(s->scratch, 0, sizeof(s->scratch));
 286     s->istat0 = 0;
 287     s->istat1 = 0;
 288     s->dcmd = 0;
 289     s->dstat = 0;
 290     s->dien = 0;
 291     s->sist0 = 0;
 292     s->sist1 = 0;
 293     s->sien0 = 0;
 294     s->sien1 = 0;
 295     s->mbox0 = 0;
 296     s->mbox1 = 0;
 297     s->dfifo = 0;
 298     s->ctest2 = 0;
 299     s->ctest3 = 0;
 300     s->ctest4 = 0;
 301     s->ctest5 = 0;
 302     s->ccntl0 = 0;
 303     s->ccntl1 = 0;
 304     s->dsp = 0;
 305     s->dsps = 0;
 306     s->dmode = 0;
 307     s->dcntl = 0;
 308     s->scntl0 = 0xc0;
 309     s->scntl1 = 0;
 310     s->scntl2 = 0;
 311     s->scntl3 = 0;
 312     s->sstat0 = 0;
 313     s->sstat1 = 0;
 314     s->scid = 7;
 315     s->sxfer = 0;
 316     s->socl = 0;
 317     s->stest1 = 0;
 318     s->stest2 = 0;
 319     s->stest3 = 0;
 320     s->sidl = 0;
 321     s->stime0 = 0;
 322     s->respid0 = 0x80;
 323     s->respid1 = 0;
 324     s->mmrs = 0;
 325     s->mmws = 0;
 326     s->sfs = 0;
 327     s->drs = 0;
 328     s->sbms = 0;
 329     s->dbms = 0;
 330     s->dnad64 = 0;
 331     s->pmjad1 = 0;
 332     s->pmjad2 = 0;
 333     s->rbc = 0;
 334     s->ua = 0;
 335     s->ia = 0;
 336     s->sbc = 0;
 337     s->csbc = 0;
 338     s->sbr = 0;
 339 }
 340
 341 static int lsi_dma_40bit(LSIState *s)
 342 {
 343     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 344         return 1;
 345     return 0;
 346 }
 347
 348 static int lsi_dma_ti64bit(LSIState *s)
 349 {
 350     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 351         return 1;
 352     return 0;
 353 }
 354
 355 static int lsi_dma_64bit(LSIState *s)
 356 {
 357     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 358         return 1;
 359     return 0;
 360 }
 361
 362 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 363 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 364 static void lsi_execute_script(LSIState *s);
 365
 366 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 367 {
 368     uint32_t buf;
 369
 370     /* Optimize reading from SCRIPTS RAM.  */
 371     if ((addr & 0xffffe000) == s->script_ram_base) {
 372         return s->script_ram[(addr & 0x1fff) >> 2];
 373     }
 374     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 375     return cpu_to_le32(buf);
 376 }
 377
 378 static void lsi_stop_script(LSIState *s)
 379 {
 380     s->istat1 &= ~LSI_ISTAT1_SRUN;
 381 }
 382
 383 static void lsi_update_irq(LSIState *s)
 384 {
 385     int level;
 386     static int last_level;
 387
 388     /* It's unclear whether the DIP/SIP bits should be cleared when the
 389        Interrupt Status Registers are cleared or when istat0 is read.
 390        We currently do the formwer, which seems to work.  */
 391     level = 0;
 392     if (s->dstat) {
 393         if (s->dstat & s->dien)
 394             level = 1;
 395         s->istat0 |= LSI_ISTAT0_DIP;
 396     } else {
 397         s->istat0 &= ~LSI_ISTAT0_DIP;
 398     }
 399
 400     if (s->sist0 || s->sist1) {
 401         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 402             level = 1;
 403         s->istat0 |= LSI_ISTAT0_SIP;
 404     } else {
 405         s->istat0 &= ~LSI_ISTAT0_SIP;
 406     }
 407     if (s->istat0 & LSI_ISTAT0_INTF)
 408         level = 1;
 409
 410     if (level != last_level) {
 411         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 412                 level, s->dstat, s->sist1, s->sist0);
 413         last_level = level;
 414     }
 415     qemu_set_irq(s->dev.irq[0], level);
 416 }
 417
 418 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 419 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 420 {
 421     uint32_t mask0;
 422     uint32_t mask1;
 423
 424     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 425             stat1, stat0, s->sist1, s->sist0);
 426     s->sist0 |= stat0;
 427     s->sist1 |= stat1;
 428     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 429        we don't stop processing when raising STO.  Instead continue
 430        execution and stop at the next insn that accesses the SCSI bus.  */
 431     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 432     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 433     mask1 &= ~LSI_SIST1_STO;
 434     if (s->sist0 & mask0 || s->sist1 & mask1) {
 435         lsi_stop_script(s);
 436     }
 437     lsi_update_irq(s);
 438 }
 439
 440 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 441 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 442 {
 443     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 444     s->dstat |= stat;
 445     lsi_update_irq(s);
 446     lsi_stop_script(s);
 447 }
 448
 449 static inline void lsi_set_phase(LSIState *s, int phase)
 450 {
 451     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 452 }
 453
 454 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 455 {
 456     /* Trigger a phase mismatch.  */
 457     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 458         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 459             s->dsp = s->pmjad1;
 460         } else {
 461             s->dsp = s->pmjad2;
 462         }
 463         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 464     } else {
 465         DPRINTF("Phase mismatch interrupt\n");
 466         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 467         lsi_stop_script(s);
 468     }
 469     lsi_set_phase(s, new_phase);
 470 }
 471
 472
 473 /* Resume SCRIPTS execution after a DMA operation.  */
 474 static void lsi_resume_script(LSIState *s)
 475 {
 476     if (s->waiting != 2) {
 477         s->waiting = 0;
 478         lsi_execute_script(s);
 479     } else {
 480         s->waiting = 0;
 481     }
 482 }
 483
 484 /* Initiate a SCSI layer data transfer.  */
 485 static void lsi_do_dma(LSIState *s, int out)
 486 {
 487     uint32_t count;
 488     target_phys_addr_t addr;
 489
 490     if (!s->current_dma_len) {
 491         /* Wait until data is available.  */
 492         DPRINTF("DMA no data available\n");
 493         return;
 494     }
 495
 496     count = s->dbc;
 497     if (count > s->current_dma_len)
 498         count = s->current_dma_len;
 499
 500     addr = s->dnad;
 501     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 502     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 503         addr |= ((uint64_t)s->dnad64 << 32);
 504     else if (s->dbms)
 505         addr |= ((uint64_t)s->dbms << 32);
 506     else if (s->sbms)
 507         addr |= ((uint64_t)s->sbms << 32);
 508
 509     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 510     s->csbc += count;
 511     s->dnad += count;
 512     s->dbc -= count;
 513
 514     if (s->dma_buf == NULL) {
 515         s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
 516                                                    s->current_tag);
 517     }
 518
 519     /* ??? Set SFBR to first data byte.  */
 520     if (out) {
 521         cpu_physical_memory_read(addr, s->dma_buf, count);
 522     } else {
 523         cpu_physical_memory_write(addr, s->dma_buf, count);
 524     }
 525     s->current_dma_len -= count;
 526     if (s->current_dma_len == 0) {
 527         s->dma_buf = NULL;
 528         if (out) {
 529             /* Write the data.  */
 530             s->current_dev->info->write_data(s->current_dev, s->current_tag);
 531         } else {
 532             /* Request any remaining data.  */
 533             s->current_dev->info->read_data(s->current_dev, s->current_tag);
 534         }
 535     } else {
 536         s->dma_buf += count;
 537         lsi_resume_script(s);
 538     }
 539 }
 540
 541
 542 /* Add a command to the queue.  */
 543 static void lsi_queue_command(LSIState *s)
 544 {
 545     lsi_queue *p;
 546
 547     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 548     if (s->queue_len == s->active_commands) {
 549         s->queue_len++;
 550         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 551     }
 552     p = &s->queue[s->active_commands++];
 553     p->tag = s->current_tag;
 554     p->pending = 0;
 555     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 556 }
 557
 558 /* Queue a byte for a MSG IN phase.  */
 559 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 560 {
 561     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 562         BADF("MSG IN data too long\n");
 563     } else {
 564         DPRINTF("MSG IN 0x%02x\n", data);
 565         s->msg[s->msg_len++] = data;
 566     }
 567 }
 568
 569 /* Perform reselection to continue a command.  */
 570 static void lsi_reselect(LSIState *s, uint32_t tag)
 571 {
 572     lsi_queue *p;
 573     int n;
 574     int id;
 575
 576     p = NULL;
 577     for (n = 0; n < s->active_commands; n++) {
 578         p = &s->queue[n];
 579         if (p->tag == tag)
 580             break;
 581     }
 582     if (n == s->active_commands) {
 583         BADF("Reselected non-existant command tag=0x%x\n", tag);
 584         return;
 585     }
 586     id = (tag >> 8) & 0xf;
 587     s->ssid = id | 0x80;
 588     DPRINTF("Reselected target %d\n", id);
 589     s->current_dev = s->bus.devs[id];
 590     s->current_tag = tag;
 591     s->scntl1 |= LSI_SCNTL1_CON;
 592     lsi_set_phase(s, PHASE_MI);
 593     s->msg_action = p->out ? 2 : 3;
 594     s->current_dma_len = p->pending;
 595     s->dma_buf = NULL;
 596     lsi_add_msg_byte(s, 0x80);
 597     if (s->current_tag & LSI_TAG_VALID) {
 598         lsi_add_msg_byte(s, 0x20);
 599         lsi_add_msg_byte(s, tag & 0xff);
 600     }
 601
 602     s->active_commands--;
 603     if (n != s->active_commands) {
 604         s->queue[n] = s->queue[s->active_commands];
 605     }
 606 }
 607
 608 /* Record that data is available for a queued command.  Returns zero if
 609    the device was reselected, nonzero if the IO is deferred.  */
 610 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 611 {
 612     lsi_queue *p;
 613     int i;
 614     for (i = 0; i < s->active_commands; i++) {
 615         p = &s->queue[i];
 616         if (p->tag == tag) {
 617             if (p->pending) {
 618                 BADF("Multiple IO pending for tag %d\n", tag);
 619             }
 620             p->pending = arg;
 621             if (s->waiting == 1) {
 622                 /* Reselect device.  */
 623                 lsi_reselect(s, tag);
 624                 return 0;
 625             } else {
 626                DPRINTF("Queueing IO tag=0x%x\n", tag);
 627                 p->pending = arg;
 628                 return 1;
 629             }
 630         }
 631     }
 632     BADF("IO with unknown tag %d\n", tag);
 633     return 1;
 634 }
 635
 636 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 637 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 638                                  uint32_t arg)
 639 {
 640     LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
 641     int out;
 642
 643     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 644     if (reason == SCSI_REASON_DONE) {
 645         DPRINTF("Command complete sense=%d\n", (int)arg);
 646         s->sense = arg;
 647         s->command_complete = 2;
 648         if (s->waiting && s->dbc != 0) {
 649             /* Raise phase mismatch for short transfers.  */
 650             lsi_bad_phase(s, out, PHASE_ST);
 651         } else {
 652             lsi_set_phase(s, PHASE_ST);
 653         }
 654         lsi_resume_script(s);
 655         return;
 656     }
 657
 658     if (s->waiting == 1 || tag != s->current_tag) {
 659         if (lsi_queue_tag(s, tag, arg))
 660             return;
 661     }
 662     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 663     s->current_dma_len = arg;
 664     s->command_complete = 1;
 665     if (!s->waiting)
 666         return;
 667     if (s->waiting == 1 || s->dbc == 0) {
 668         lsi_resume_script(s);
 669     } else {
 670         lsi_do_dma(s, out);
 671     }
 672 }
 673
 674 static void lsi_do_command(LSIState *s)
 675 {
 676     uint8_t buf[16];
 677     int n;
 678
 679     DPRINTF("Send command len=%d\n", s->dbc);
 680     if (s->dbc > 16)
 681         s->dbc = 16;
 682     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 683     s->sfbr = buf[0];
 684     s->command_complete = 0;
 685     n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
 686                                            s->current_lun);
 687     if (n > 0) {
 688         lsi_set_phase(s, PHASE_DI);
 689         s->current_dev->info->read_data(s->current_dev, s->current_tag);
 690     } else if (n < 0) {
 691         lsi_set_phase(s, PHASE_DO);
 692         s->current_dev->info->write_data(s->current_dev, s->current_tag);
 693     }
 694
 695     if (!s->command_complete) {
 696         if (n) {
 697             /* Command did not complete immediately so disconnect.  */
 698             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 699             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 700             /* wait data */
 701             lsi_set_phase(s, PHASE_MI);
 702             s->msg_action = 1;
 703             lsi_queue_command(s);
 704         } else {
 705             /* wait command complete */
 706             lsi_set_phase(s, PHASE_DI);
 707         }
 708     }
 709 }
 710
 711 static void lsi_do_status(LSIState *s)
 712 {
 713     uint8_t sense;
 714     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 715     if (s->dbc != 1)
 716         BADF("Bad Status move\n");
 717     s->dbc = 1;
 718     sense = s->sense;
 719     s->sfbr = sense;
 720     cpu_physical_memory_write(s->dnad, &sense, 1);
 721     lsi_set_phase(s, PHASE_MI);
 722     s->msg_action = 1;
 723     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 724 }
 725
 726 static void lsi_disconnect(LSIState *s)
 727 {
 728     s->scntl1 &= ~LSI_SCNTL1_CON;
 729     s->sstat1 &= ~PHASE_MASK;
 730 }
 731
 732 static void lsi_do_msgin(LSIState *s)
 733 {
 734     int len;
 735     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 736     s->sfbr = s->msg[0];
 737     len = s->msg_len;
 738     if (len > s->dbc)
 739         len = s->dbc;
 740     cpu_physical_memory_write(s->dnad, s->msg, len);
 741     /* Linux drivers rely on the last byte being in the SIDL.  */
 742     s->sidl = s->msg[len - 1];
 743     s->msg_len -= len;
 744     if (s->msg_len) {
 745         memmove(s->msg, s->msg + len, s->msg_len);
 746     } else {
 747         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 748            switch to PHASE_MO.  */
 749         switch (s->msg_action) {
 750         case 0:
 751             lsi_set_phase(s, PHASE_CMD);
 752             break;
 753         case 1:
 754             lsi_disconnect(s);
 755             break;
 756         case 2:
 757             lsi_set_phase(s, PHASE_DO);
 758             break;
 759         case 3:
 760             lsi_set_phase(s, PHASE_DI);
 761             break;
 762         default:
 763             abort();
 764         }
 765     }
 766 }
 767
 768 /* Read the next byte during a MSGOUT phase.  */
 769 static uint8_t lsi_get_msgbyte(LSIState *s)
 770 {
 771     uint8_t data;
 772     cpu_physical_memory_read(s->dnad, &data, 1);
 773     s->dnad++;
 774     s->dbc--;
 775     return data;
 776 }
 777
 778 static void lsi_do_msgout(LSIState *s)
 779 {
 780     uint8_t msg;
 781     int len;
 782
 783     DPRINTF("MSG out len=%d\n", s->dbc);
 784     while (s->dbc) {
 785         msg = lsi_get_msgbyte(s);
 786         s->sfbr = msg;
 787
 788         switch (msg) {
 789         case 0x00:
 790             DPRINTF("MSG: Disconnect\n");
 791             lsi_disconnect(s);
 792             break;
 793         case 0x08:
 794             DPRINTF("MSG: No Operation\n");
 795             lsi_set_phase(s, PHASE_CMD);
 796             break;
 797         case 0x01:
 798             len = lsi_get_msgbyte(s);
 799             msg = lsi_get_msgbyte(s);
 800             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 801             switch (msg) {
 802             case 1:
 803                 DPRINTF("SDTR (ignored)\n");
 804                 s->dbc -= 2;
 805                 break;
 806             case 3:
 807                 DPRINTF("WDTR (ignored)\n");
 808                 s->dbc -= 1;
 809                 break;
 810             default:
 811                 goto bad;
 812             }
 813             break;
 814         case 0x20: /* SIMPLE queue */
 815             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 816             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 817             break;
 818         case 0x21: /* HEAD of queue */
 819             BADF("HEAD queue not implemented\n");
 820             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 821             break;
 822         case 0x22: /* ORDERED queue */
 823             BADF("ORDERED queue not implemented\n");
 824             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 825             break;
 826         default:
 827             if ((msg & 0x80) == 0) {
 828                 goto bad;
 829             }
 830             s->current_lun = msg & 7;
 831             DPRINTF("Select LUN %d\n", s->current_lun);
 832             lsi_set_phase(s, PHASE_CMD);
 833             break;
 834         }
 835     }
 836     return;
 837 bad:
 838     BADF("Unimplemented message 0x%02x\n", msg);
 839     lsi_set_phase(s, PHASE_MI);
 840     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 841     s->msg_action = 0;
 842 }
 843
 844 /* Sign extend a 24-bit value.  */
 845 static inline int32_t sxt24(int32_t n)
 846 {
 847     return (n << 8) >> 8;
 848 }
 849
 850 #define LSI_BUF_SIZE 4096
 851 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 852 {
 853     int n;
 854     uint8_t buf[LSI_BUF_SIZE];
 855
 856     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 857     while (count) {
 858         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
 859         cpu_physical_memory_read(src, buf, n);
 860         cpu_physical_memory_write(dest, buf, n);
 861         src += n;
 862         dest += n;
 863         count -= n;
 864     }
 865 }
 866
 867 static void lsi_wait_reselect(LSIState *s)
 868 {
 869     int i;
 870     DPRINTF("Wait Reselect\n");
 871     if (s->current_dma_len)
 872         BADF("Reselect with pending DMA\n");
 873     for (i = 0; i < s->active_commands; i++) {
 874         if (s->queue[i].pending) {
 875             lsi_reselect(s, s->queue[i].tag);
 876             break;
 877         }
 878     }
 879     if (s->current_dma_len == 0) {
 880         s->waiting = 1;
 881     }
 882 }
 883
 884 static void lsi_execute_script(LSIState *s)
 885 {
 886     uint32_t insn;
 887     uint32_t addr, addr_high;
 888     int opcode;
 889     int insn_processed = 0;
 890
 891     s->istat1 |= LSI_ISTAT1_SRUN;
 892 again:
 893     insn_processed++;
 894     insn = read_dword(s, s->dsp);
 895     if (!insn) {
 896         /* If we receive an empty opcode increment the DSP by 4 bytes
 897            instead of 8 and execute the next opcode at that location */
 898         s->dsp += 4;
 899         goto again;
 900     }
 901     addr = read_dword(s, s->dsp + 4);
 902     addr_high = 0;
 903     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 904     s->dsps = addr;
 905     s->dcmd = insn >> 24;
 906     s->dsp += 8;
 907     switch (insn >> 30) {
 908     case 0: /* Block move.  */
 909         if (s->sist1 & LSI_SIST1_STO) {
 910             DPRINTF("Delayed select timeout\n");
 911             lsi_stop_script(s);
 912             break;
 913         }
 914         s->dbc = insn & 0xffffff;
 915         s->rbc = s->dbc;
 916         /* ??? Set ESA.  */
 917         s->ia = s->dsp - 8;
 918         if (insn & (1 << 29)) {
 919             /* Indirect addressing.  */
 920             addr = read_dword(s, addr);
 921         } else if (insn & (1 << 28)) {
 922             uint32_t buf[2];
 923             int32_t offset;
 924             /* Table indirect addressing.  */
 925
 926             /* 32-bit Table indirect */
 927             offset = sxt24(addr);
 928             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 929             /* byte count is stored in bits 0:23 only */
 930             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 931             s->rbc = s->dbc;
 932             addr = cpu_to_le32(buf[1]);
 933
 934             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 935              * table, bits [31:24] */
 936             if (lsi_dma_40bit(s))
 937                 addr_high = cpu_to_le32(buf[0]) >> 24;
 938             else if (lsi_dma_ti64bit(s)) {
 939                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
 940                 switch (selector) {
 941                 case 0 ... 0x0f:
 942                     /* offset index into scratch registers since
 943                      * TI64 mode can use registers C to R */
 944                     addr_high = s->scratch[2 + selector];
 945                     break;
 946                 case 0x10:
 947                     addr_high = s->mmrs;
 948                     break;
 949                 case 0x11:
 950                     addr_high = s->mmws;
 951                     break;
 952                 case 0x12:
 953                     addr_high = s->sfs;
 954                     break;
 955                 case 0x13:
 956                     addr_high = s->drs;
 957                     break;
 958                 case 0x14:
 959                     addr_high = s->sbms;
 960                     break;
 961                 case 0x15:
 962                     addr_high = s->dbms;
 963                     break;
 964                 default:
 965                     BADF("Illegal selector specified (0x%x > 0x15)"
 966                          " for 64-bit DMA block move", selector);
 967                     break;
 968                 }
 969             }
 970         } else if (lsi_dma_64bit(s)) {
 971             /* fetch a 3rd dword if 64-bit direct move is enabled and
 972                only if we're not doing table indirect or indirect addressing */
 973             s->dbms = read_dword(s, s->dsp);
 974             s->dsp += 4;
 975             s->ia = s->dsp - 12;
 976         }
 977         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 978             DPRINTF("Wrong phase got %d expected %d\n",
 979                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 980             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 981             break;
 982         }
 983         s->dnad = addr;
 984         s->dnad64 = addr_high;
 985         switch (s->sstat1 & 0x7) {
 986         case PHASE_DO:
 987             s->waiting = 2;
 988             lsi_do_dma(s, 1);
 989             if (s->waiting)
 990                 s->waiting = 3;
 991             break;
 992         case PHASE_DI:
 993             s->waiting = 2;
 994             lsi_do_dma(s, 0);
 995             if (s->waiting)
 996                 s->waiting = 3;
 997             break;
 998         case PHASE_CMD:
 999             lsi_do_command(s);
1000             break;
1001         case PHASE_ST:
1002             lsi_do_status(s);
1003             break;
1004         case PHASE_MO:
1005             lsi_do_msgout(s);
1006             break;
1007         case PHASE_MI:
1008             lsi_do_msgin(s);
1009             break;
1010         default:
1011             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1012             exit(1);
1013         }
1014         s->dfifo = s->dbc & 0xff;
1015         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1016         s->sbc = s->dbc;
1017         s->rbc -= s->dbc;
1018         s->ua = addr + s->dbc;
1019         break;
1020
1021     case 1: /* IO or Read/Write instruction.  */
1022         opcode = (insn >> 27) & 7;
1023         if (opcode < 5) {
1024             uint32_t id;
1025
1026             if (insn & (1 << 25)) {
1027                 id = read_dword(s, s->dsa + sxt24(insn));
1028             } else {
1029                 id = addr;
1030             }
1031             id = (id >> 16) & 0xf;
1032             if (insn & (1 << 26)) {
1033                 addr = s->dsp + sxt24(addr);
1034             }
1035             s->dnad = addr;
1036             switch (opcode) {
1037             case 0: /* Select */
1038                 s->sdid = id;
1039                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1040                     DPRINTF("Already reselected by target %d\n", id);
1041                     break;
1042                 }
1043                 s->sstat0 |= LSI_SSTAT0_WOA;
1044                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1045                 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1046                     DPRINTF("Selected absent target %d\n", id);
1047                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1048                     lsi_disconnect(s);
1049                     break;
1050                 }
1051                 DPRINTF("Selected target %d%s\n",
1052                         id, insn & (1 << 3) ? " ATN" : "");
1053                 /* ??? Linux drivers compain when this is set.  Maybe
1054                    it only applies in low-level mode (unimplemented).
1055                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1056                 s->current_dev = s->bus.devs[id];
1057                 s->current_tag = id << 8;
1058                 s->scntl1 |= LSI_SCNTL1_CON;
1059                 if (insn & (1 << 3)) {
1060                     s->socl |= LSI_SOCL_ATN;
1061                 }
1062                 lsi_set_phase(s, PHASE_MO);
1063                 break;
1064             case 1: /* Disconnect */
1065                 DPRINTF("Wait Disconect\n");
1066                 s->scntl1 &= ~LSI_SCNTL1_CON;
1067                 break;
1068             case 2: /* Wait Reselect */
1069                 lsi_wait_reselect(s);
1070                 break;
1071             case 3: /* Set */
1072                 DPRINTF("Set%s%s%s%s\n",
1073                         insn & (1 << 3) ? " ATN" : "",
1074                         insn & (1 << 6) ? " ACK" : "",
1075                         insn & (1 << 9) ? " TM" : "",
1076                         insn & (1 << 10) ? " CC" : "");
1077                 if (insn & (1 << 3)) {
1078                     s->socl |= LSI_SOCL_ATN;
1079                     lsi_set_phase(s, PHASE_MO);
1080                 }
1081                 if (insn & (1 << 9)) {
1082                     BADF("Target mode not implemented\n");
1083                     exit(1);
1084                 }
1085                 if (insn & (1 << 10))
1086                     s->carry = 1;
1087                 break;
1088             case 4: /* Clear */
1089                 DPRINTF("Clear%s%s%s%s\n",
1090                         insn & (1 << 3) ? " ATN" : "",
1091                         insn & (1 << 6) ? " ACK" : "",
1092                         insn & (1 << 9) ? " TM" : "",
1093                         insn & (1 << 10) ? " CC" : "");
1094                 if (insn & (1 << 3)) {
1095                     s->socl &= ~LSI_SOCL_ATN;
1096                 }
1097                 if (insn & (1 << 10))
1098                     s->carry = 0;
1099                 break;
1100             }
1101         } else {
1102             uint8_t op0;
1103             uint8_t op1;
1104             uint8_t data8;
1105             int reg;
1106             int operator;
1107 #ifdef DEBUG_LSI
1108             static const char *opcode_names[3] =
1109                 {"Write", "Read", "Read-Modify-Write"};
1110             static const char *operator_names[8] =
1111                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1112 #endif
1113
1114             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1115             data8 = (insn >> 8) & 0xff;
1116             opcode = (insn >> 27) & 7;
1117             operator = (insn >> 24) & 7;
1118             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1119                     opcode_names[opcode - 5], reg,
1120                     operator_names[operator], data8, s->sfbr,
1121                     (insn & (1 << 23)) ? " SFBR" : "");
1122             op0 = op1 = 0;
1123             switch (opcode) {
1124             case 5: /* From SFBR */
1125                 op0 = s->sfbr;
1126                 op1 = data8;
1127                 break;
1128             case 6: /* To SFBR */
1129                 if (operator)
1130                     op0 = lsi_reg_readb(s, reg);
1131                 op1 = data8;
1132                 break;
1133             case 7: /* Read-modify-write */
1134                 if (operator)
1135                     op0 = lsi_reg_readb(s, reg);
1136                 if (insn & (1 << 23)) {
1137                     op1 = s->sfbr;
1138                 } else {
1139                     op1 = data8;
1140                 }
1141                 break;
1142             }
1143
1144             switch (operator) {
1145             case 0: /* move */
1146                 op0 = op1;
1147                 break;
1148             case 1: /* Shift left */
1149                 op1 = op0 >> 7;
1150                 op0 = (op0 << 1) | s->carry;
1151                 s->carry = op1;
1152                 break;
1153             case 2: /* OR */
1154                 op0 |= op1;
1155                 break;
1156             case 3: /* XOR */
1157                 op0 ^= op1;
1158                 break;
1159             case 4: /* AND */
1160                 op0 &= op1;
1161                 break;
1162             case 5: /* SHR */
1163                 op1 = op0 & 1;
1164                 op0 = (op0 >> 1) | (s->carry << 7);
1165                 s->carry = op1;
1166                 break;
1167             case 6: /* ADD */
1168                 op0 += op1;
1169                 s->carry = op0 < op1;
1170                 break;
1171             case 7: /* ADC */
1172                 op0 += op1 + s->carry;
1173                 if (s->carry)
1174                     s->carry = op0 <= op1;
1175                 else
1176                     s->carry = op0 < op1;
1177                 break;
1178             }
1179
1180             switch (opcode) {
1181             case 5: /* From SFBR */
1182             case 7: /* Read-modify-write */
1183                 lsi_reg_writeb(s, reg, op0);
1184                 break;
1185             case 6: /* To SFBR */
1186                 s->sfbr = op0;
1187                 break;
1188             }
1189         }
1190         break;
1191
1192     case 2: /* Transfer Control.  */
1193         {
1194             int cond;
1195             int jmp;
1196
1197             if ((insn & 0x002e0000) == 0) {
1198                 DPRINTF("NOP\n");
1199                 break;
1200             }
1201             if (s->sist1 & LSI_SIST1_STO) {
1202                 DPRINTF("Delayed select timeout\n");
1203                 lsi_stop_script(s);
1204                 break;
1205             }
1206             cond = jmp = (insn & (1 << 19)) != 0;
1207             if (cond == jmp && (insn & (1 << 21))) {
1208                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1209                 cond = s->carry != 0;
1210             }
1211             if (cond == jmp && (insn & (1 << 17))) {
1212                 DPRINTF("Compare phase %d %c= %d\n",
1213                         (s->sstat1 & PHASE_MASK),
1214                         jmp ? '=' : '!',
1215                         ((insn >> 24) & 7));
1216                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1217             }
1218             if (cond == jmp && (insn & (1 << 18))) {
1219                 uint8_t mask;
1220
1221                 mask = (~insn >> 8) & 0xff;
1222                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1223                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1224                 cond = (s->sfbr & mask) == (insn & mask);
1225             }
1226             if (cond == jmp) {
1227                 if (insn & (1 << 23)) {
1228                     /* Relative address.  */
1229                     addr = s->dsp + sxt24(addr);
1230                 }
1231                 switch ((insn >> 27) & 7) {
1232                 case 0: /* Jump */
1233                     DPRINTF("Jump to 0x%08x\n", addr);
1234                     s->dsp = addr;
1235                     break;
1236                 case 1: /* Call */
1237                     DPRINTF("Call 0x%08x\n", addr);
1238                     s->temp = s->dsp;
1239                     s->dsp = addr;
1240                     break;
1241                 case 2: /* Return */
1242                     DPRINTF("Return to 0x%08x\n", s->temp);
1243                     s->dsp = s->temp;
1244                     break;
1245                 case 3: /* Interrupt */
1246                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1247                     if ((insn & (1 << 20)) != 0) {
1248                         s->istat0 |= LSI_ISTAT0_INTF;
1249                         lsi_update_irq(s);
1250                     } else {
1251                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1252                     }
1253                     break;
1254                 default:
1255                     DPRINTF("Illegal transfer control\n");
1256                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1257                     break;
1258                 }
1259             } else {
1260                 DPRINTF("Control condition failed\n");
1261             }
1262         }
1263         break;
1264
1265     case 3:
1266         if ((insn & (1 << 29)) == 0) {
1267             /* Memory move.  */
1268             uint32_t dest;
1269             /* ??? The docs imply the destination address is loaded into
1270                the TEMP register.  However the Linux drivers rely on
1271                the value being presrved.  */
1272             dest = read_dword(s, s->dsp);
1273             s->dsp += 4;
1274             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1275         } else {
1276             uint8_t data[7];
1277             int reg;
1278             int n;
1279             int i;
1280
1281             if (insn & (1 << 28)) {
1282                 addr = s->dsa + sxt24(addr);
1283             }
1284             n = (insn & 7);
1285             reg = (insn >> 16) & 0xff;
1286             if (insn & (1 << 24)) {
1287                 cpu_physical_memory_read(addr, data, n);
1288                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1289                         addr, *(int *)data);
1290                 for (i = 0; i < n; i++) {
1291                     lsi_reg_writeb(s, reg + i, data[i]);
1292                 }
1293             } else {
1294                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1295                 for (i = 0; i < n; i++) {
1296                     data[i] = lsi_reg_readb(s, reg + i);
1297                 }
1298                 cpu_physical_memory_write(addr, data, n);
1299             }
1300         }
1301     }
1302     if (insn_processed > 10000 && !s->waiting) {
1303         /* Some windows drivers make the device spin waiting for a memory
1304            location to change.  If we have been executed a lot of code then
1305            assume this is the case and force an unexpected device disconnect.
1306            This is apparently sufficient to beat the drivers into submission.
1307          */
1308         if (!(s->sien0 & LSI_SIST0_UDC))
1309             fprintf(stderr, "inf. loop with UDC masked\n");
1310         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1311         lsi_disconnect(s);
1312     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1313         if (s->dcntl & LSI_DCNTL_SSM) {
1314             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1315         } else {
1316             goto again;
1317         }
1318     }
1319     DPRINTF("SCRIPTS execution stopped\n");
1320 }
1321
1322 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1323 {
1324     uint8_t tmp;
1325 #define CASE_GET_REG24(name, addr) \
1326     case addr: return s->name & 0xff; \
1327     case addr + 1: return (s->name >> 8) & 0xff; \
1328     case addr + 2: return (s->name >> 16) & 0xff;
1329
1330 #define CASE_GET_REG32(name, addr) \
1331     case addr: return s->name & 0xff; \
1332     case addr + 1: return (s->name >> 8) & 0xff; \
1333     case addr + 2: return (s->name >> 16) & 0xff; \
1334     case addr + 3: return (s->name >> 24) & 0xff;
1335
1336 #ifdef DEBUG_LSI_REG
1337     DPRINTF("Read reg %x\n", offset);
1338 #endif
1339     switch (offset) {
1340     case 0x00: /* SCNTL0 */
1341         return s->scntl0;
1342     case 0x01: /* SCNTL1 */
1343         return s->scntl1;
1344     case 0x02: /* SCNTL2 */
1345         return s->scntl2;
1346     case 0x03: /* SCNTL3 */
1347         return s->scntl3;
1348     case 0x04: /* SCID */
1349         return s->scid;
1350     case 0x05: /* SXFER */
1351         return s->sxfer;
1352     case 0x06: /* SDID */
1353         return s->sdid;
1354     case 0x07: /* GPREG0 */
1355         return 0x7f;
1356     case 0x08: /* Revision ID */
1357         return 0x00;
1358     case 0xa: /* SSID */
1359         return s->ssid;
1360     case 0xb: /* SBCL */
1361         /* ??? This is not correct. However it's (hopefully) only
1362            used for diagnostics, so should be ok.  */
1363         return 0;
1364     case 0xc: /* DSTAT */
1365         tmp = s->dstat | 0x80;
1366         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1367             s->dstat = 0;
1368         lsi_update_irq(s);
1369         return tmp;
1370     case 0x0d: /* SSTAT0 */
1371         return s->sstat0;
1372     case 0x0e: /* SSTAT1 */
1373         return s->sstat1;
1374     case 0x0f: /* SSTAT2 */
1375         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1376     CASE_GET_REG32(dsa, 0x10)
1377     case 0x14: /* ISTAT0 */
1378         return s->istat0;
1379     case 0x15: /* ISTAT1 */
1380         return s->istat1;
1381     case 0x16: /* MBOX0 */
1382         return s->mbox0;
1383     case 0x17: /* MBOX1 */
1384         return s->mbox1;
1385     case 0x18: /* CTEST0 */
1386         return 0xff;
1387     case 0x19: /* CTEST1 */
1388         return 0;
1389     case 0x1a: /* CTEST2 */
1390         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1391         if (s->istat0 & LSI_ISTAT0_SIGP) {
1392             s->istat0 &= ~LSI_ISTAT0_SIGP;
1393             tmp |= LSI_CTEST2_SIGP;
1394         }
1395         return tmp;
1396     case 0x1b: /* CTEST3 */
1397         return s->ctest3;
1398     CASE_GET_REG32(temp, 0x1c)
1399     case 0x20: /* DFIFO */
1400         return 0;
1401     case 0x21: /* CTEST4 */
1402         return s->ctest4;
1403     case 0x22: /* CTEST5 */
1404         return s->ctest5;
1405     case 0x23: /* CTEST6 */
1406          return 0;
1407     CASE_GET_REG24(dbc, 0x24)
1408     case 0x27: /* DCMD */
1409         return s->dcmd;
1410     CASE_GET_REG32(dnad, 0x28)
1411     CASE_GET_REG32(dsp, 0x2c)
1412     CASE_GET_REG32(dsps, 0x30)
1413     CASE_GET_REG32(scratch[0], 0x34)
1414     case 0x38: /* DMODE */
1415         return s->dmode;
1416     case 0x39: /* DIEN */
1417         return s->dien;
1418     case 0x3a: /* SBR */
1419         return s->sbr;
1420     case 0x3b: /* DCNTL */
1421         return s->dcntl;
1422     case 0x40: /* SIEN0 */
1423         return s->sien0;
1424     case 0x41: /* SIEN1 */
1425         return s->sien1;
1426     case 0x42: /* SIST0 */
1427         tmp = s->sist0;
1428         s->sist0 = 0;
1429         lsi_update_irq(s);
1430         return tmp;
1431     case 0x43: /* SIST1 */
1432         tmp = s->sist1;
1433         s->sist1 = 0;
1434         lsi_update_irq(s);
1435         return tmp;
1436     case 0x46: /* MACNTL */
1437         return 0x0f;
1438     case 0x47: /* GPCNTL0 */
1439         return 0x0f;
1440     case 0x48: /* STIME0 */
1441         return s->stime0;
1442     case 0x4a: /* RESPID0 */
1443         return s->respid0;
1444     case 0x4b: /* RESPID1 */
1445         return s->respid1;
1446     case 0x4d: /* STEST1 */
1447         return s->stest1;
1448     case 0x4e: /* STEST2 */
1449         return s->stest2;
1450     case 0x4f: /* STEST3 */
1451         return s->stest3;
1452     case 0x50: /* SIDL */
1453         /* This is needed by the linux drivers.  We currently only update it
1454            during the MSG IN phase.  */
1455         return s->sidl;
1456     case 0x52: /* STEST4 */
1457         return 0xe0;
1458     case 0x56: /* CCNTL0 */
1459         return s->ccntl0;
1460     case 0x57: /* CCNTL1 */
1461         return s->ccntl1;
1462     case 0x58: /* SBDL */
1463         /* Some drivers peek at the data bus during the MSG IN phase.  */
1464         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1465             return s->msg[0];
1466         return 0;
1467     case 0x59: /* SBDL high */
1468         return 0;
1469     CASE_GET_REG32(mmrs, 0xa0)
1470     CASE_GET_REG32(mmws, 0xa4)
1471     CASE_GET_REG32(sfs, 0xa8)
1472     CASE_GET_REG32(drs, 0xac)
1473     CASE_GET_REG32(sbms, 0xb0)
1474     CASE_GET_REG32(dbms, 0xb4)
1475     CASE_GET_REG32(dnad64, 0xb8)
1476     CASE_GET_REG32(pmjad1, 0xc0)
1477     CASE_GET_REG32(pmjad2, 0xc4)
1478     CASE_GET_REG32(rbc, 0xc8)
1479     CASE_GET_REG32(ua, 0xcc)
1480     CASE_GET_REG32(ia, 0xd4)
1481     CASE_GET_REG32(sbc, 0xd8)
1482     CASE_GET_REG32(csbc, 0xdc)
1483     }
1484     if (offset >= 0x5c && offset < 0xa0) {
1485         int n;
1486         int shift;
1487         n = (offset - 0x58) >> 2;
1488         shift = (offset & 3) * 8;
1489         return (s->scratch[n] >> shift) & 0xff;
1490     }
1491     BADF("readb 0x%x\n", offset);
1492     exit(1);
1493 #undef CASE_GET_REG24
1494 #undef CASE_GET_REG32
1495 }
1496
1497 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1498 {
1499 #define CASE_SET_REG24(name, addr) \
1500     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1501     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1502     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1503
1504 #define CASE_SET_REG32(name, addr) \
1505     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1506     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1507     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1508     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1509
1510 #ifdef DEBUG_LSI_REG
1511     DPRINTF("Write reg %x = %02x\n", offset, val);
1512 #endif
1513     switch (offset) {
1514     case 0x00: /* SCNTL0 */
1515         s->scntl0 = val;
1516         if (val & LSI_SCNTL0_START) {
1517             BADF("Start sequence not implemented\n");
1518         }
1519         break;
1520     case 0x01: /* SCNTL1 */
1521         s->scntl1 = val & ~LSI_SCNTL1_SST;
1522         if (val & LSI_SCNTL1_IARB) {
1523             BADF("Immediate Arbritration not implemented\n");
1524         }
1525         if (val & LSI_SCNTL1_RST) {
1526             s->sstat0 |= LSI_SSTAT0_RST;
1527             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1528         } else {
1529             s->sstat0 &= ~LSI_SSTAT0_RST;
1530         }
1531         break;
1532     case 0x02: /* SCNTL2 */
1533         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1534         s->scntl2 = val;
1535         break;
1536     case 0x03: /* SCNTL3 */
1537         s->scntl3 = val;
1538         break;
1539     case 0x04: /* SCID */
1540         s->scid = val;
1541         break;
1542     case 0x05: /* SXFER */
1543         s->sxfer = val;
1544         break;
1545     case 0x06: /* SDID */
1546         if ((val & 0xf) != (s->ssid & 0xf))
1547             BADF("Destination ID does not match SSID\n");
1548         s->sdid = val & 0xf;
1549         break;
1550     case 0x07: /* GPREG0 */
1551         break;
1552     case 0x08: /* SFBR */
1553         /* The CPU is not allowed to write to this register.  However the
1554            SCRIPTS register move instructions are.  */
1555         s->sfbr = val;
1556         break;
1557     case 0x0a: case 0x0b:
1558         /* Openserver writes to these readonly registers on startup */
1559         return;
1560     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1561         /* Linux writes to these readonly registers on startup.  */
1562         return;
1563     CASE_SET_REG32(dsa, 0x10)
1564     case 0x14: /* ISTAT0 */
1565         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1566         if (val & LSI_ISTAT0_ABRT) {
1567             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1568         }
1569         if (val & LSI_ISTAT0_INTF) {
1570             s->istat0 &= ~LSI_ISTAT0_INTF;
1571             lsi_update_irq(s);
1572         }
1573         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1574             DPRINTF("Woken by SIGP\n");
1575             s->waiting = 0;
1576             s->dsp = s->dnad;
1577             lsi_execute_script(s);
1578         }
1579         if (val & LSI_ISTAT0_SRST) {
1580             lsi_soft_reset(s);
1581         }
1582         break;
1583     case 0x16: /* MBOX0 */
1584         s->mbox0 = val;
1585         break;
1586     case 0x17: /* MBOX1 */
1587         s->mbox1 = val;
1588         break;
1589     case 0x1a: /* CTEST2 */
1590         s->ctest2 = val & LSI_CTEST2_PCICIE;
1591         break;
1592     case 0x1b: /* CTEST3 */
1593         s->ctest3 = val & 0x0f;
1594         break;
1595     CASE_SET_REG32(temp, 0x1c)
1596     case 0x21: /* CTEST4 */
1597         if (val & 7) {
1598            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1599         }
1600         s->ctest4 = val;
1601         break;
1602     case 0x22: /* CTEST5 */
1603         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1604             BADF("CTEST5 DMA increment not implemented\n");
1605         }
1606         s->ctest5 = val;
1607         break;
1608     CASE_SET_REG24(dbc, 0x24)
1609     CASE_SET_REG32(dnad, 0x28)
1610     case 0x2c: /* DSP[0:7] */
1611         s->dsp &= 0xffffff00;
1612         s->dsp |= val;
1613         break;
1614     case 0x2d: /* DSP[8:15] */
1615         s->dsp &= 0xffff00ff;
1616         s->dsp |= val << 8;
1617         break;
1618     case 0x2e: /* DSP[16:23] */
1619         s->dsp &= 0xff00ffff;
1620         s->dsp |= val << 16;
1621         break;
1622     case 0x2f: /* DSP[24:31] */
1623         s->dsp &= 0x00ffffff;
1624         s->dsp |= val << 24;
1625         if ((s->dmode & LSI_DMODE_MAN) == 0
1626             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1627             lsi_execute_script(s);
1628         break;
1629     CASE_SET_REG32(dsps, 0x30)
1630     CASE_SET_REG32(scratch[0], 0x34)
1631     case 0x38: /* DMODE */
1632         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1633             BADF("IO mappings not implemented\n");
1634         }
1635         s->dmode = val;
1636         break;
1637     case 0x39: /* DIEN */
1638         s->dien = val;
1639         lsi_update_irq(s);
1640         break;
1641     case 0x3a: /* SBR */
1642         s->sbr = val;
1643         break;
1644     case 0x3b: /* DCNTL */
1645         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1646         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1647             lsi_execute_script(s);
1648         break;
1649     case 0x40: /* SIEN0 */
1650         s->sien0 = val;
1651         lsi_update_irq(s);
1652         break;
1653     case 0x41: /* SIEN1 */
1654         s->sien1 = val;
1655         lsi_update_irq(s);
1656         break;
1657     case 0x47: /* GPCNTL0 */
1658         break;
1659     case 0x48: /* STIME0 */
1660         s->stime0 = val;
1661         break;
1662     case 0x49: /* STIME1 */
1663         if (val & 0xf) {
1664             DPRINTF("General purpose timer not implemented\n");
1665             /* ??? Raising the interrupt immediately seems to be sufficient
1666                to keep the FreeBSD driver happy.  */
1667             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1668         }
1669         break;
1670     case 0x4a: /* RESPID0 */
1671         s->respid0 = val;
1672         break;
1673     case 0x4b: /* RESPID1 */
1674         s->respid1 = val;
1675         break;
1676     case 0x4d: /* STEST1 */
1677         s->stest1 = val;
1678         break;
1679     case 0x4e: /* STEST2 */
1680         if (val & 1) {
1681             BADF("Low level mode not implemented\n");
1682         }
1683         s->stest2 = val;
1684         break;
1685     case 0x4f: /* STEST3 */
1686         if (val & 0x41) {
1687             BADF("SCSI FIFO test mode not implemented\n");
1688         }
1689         s->stest3 = val;
1690         break;
1691     case 0x56: /* CCNTL0 */
1692         s->ccntl0 = val;
1693         break;
1694     case 0x57: /* CCNTL1 */
1695         s->ccntl1 = val;
1696         break;
1697     CASE_SET_REG32(mmrs, 0xa0)
1698     CASE_SET_REG32(mmws, 0xa4)
1699     CASE_SET_REG32(sfs, 0xa8)
1700     CASE_SET_REG32(drs, 0xac)
1701     CASE_SET_REG32(sbms, 0xb0)
1702     CASE_SET_REG32(dbms, 0xb4)
1703     CASE_SET_REG32(dnad64, 0xb8)
1704     CASE_SET_REG32(pmjad1, 0xc0)
1705     CASE_SET_REG32(pmjad2, 0xc4)
1706     CASE_SET_REG32(rbc, 0xc8)
1707     CASE_SET_REG32(ua, 0xcc)
1708     CASE_SET_REG32(ia, 0xd4)
1709     CASE_SET_REG32(sbc, 0xd8)
1710     CASE_SET_REG32(csbc, 0xdc)
1711     default:
1712         if (offset >= 0x5c && offset < 0xa0) {
1713             int n;
1714             int shift;
1715             n = (offset - 0x58) >> 2;
1716             shift = (offset & 3) * 8;
1717             s->scratch[n] &= ~(0xff << shift);
1718             s->scratch[n] |= (val & 0xff) << shift;
1719         } else {
1720             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1721         }
1722     }
1723 #undef CASE_SET_REG24
1724 #undef CASE_SET_REG32
1725 }
1726
1727 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1728 {
1729     LSIState *s = opaque;
1730
1731     lsi_reg_writeb(s, addr & 0xff, val);
1732 }
1733
1734 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1735 {
1736     LSIState *s = opaque;
1737
1738     addr &= 0xff;
1739     lsi_reg_writeb(s, addr, val & 0xff);
1740     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1741 }
1742
1743 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1744 {
1745     LSIState *s = opaque;
1746
1747     addr &= 0xff;
1748     lsi_reg_writeb(s, addr, val & 0xff);
1749     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1750     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1751     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1752 }
1753
1754 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1755 {
1756     LSIState *s = opaque;
1757
1758     return lsi_reg_readb(s, addr & 0xff);
1759 }
1760
1761 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1762 {
1763     LSIState *s = opaque;
1764     uint32_t val;
1765
1766     addr &= 0xff;
1767     val = lsi_reg_readb(s, addr);
1768     val |= lsi_reg_readb(s, addr + 1) << 8;
1769     return val;
1770 }
1771
1772 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1773 {
1774     LSIState *s = opaque;
1775     uint32_t val;
1776     addr &= 0xff;
1777     val = lsi_reg_readb(s, addr);
1778     val |= lsi_reg_readb(s, addr + 1) << 8;
1779     val |= lsi_reg_readb(s, addr + 2) << 16;
1780     val |= lsi_reg_readb(s, addr + 3) << 24;
1781     return val;
1782 }
1783
1784 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1785     lsi_mmio_readb,
1786     lsi_mmio_readw,
1787     lsi_mmio_readl,
1788 };
1789
1790 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1791     lsi_mmio_writeb,
1792     lsi_mmio_writew,
1793     lsi_mmio_writel,
1794 };
1795
1796 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1797 {
1798     LSIState *s = opaque;
1799     uint32_t newval;
1800     int shift;
1801
1802     addr &= 0x1fff;
1803     newval = s->script_ram[addr >> 2];
1804     shift = (addr & 3) * 8;
1805     newval &= ~(0xff << shift);
1806     newval |= val << shift;
1807     s->script_ram[addr >> 2] = newval;
1808 }
1809
1810 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1811 {
1812     LSIState *s = opaque;
1813     uint32_t newval;
1814
1815     addr &= 0x1fff;
1816     newval = s->script_ram[addr >> 2];
1817     if (addr & 2) {
1818         newval = (newval & 0xffff) | (val << 16);
1819     } else {
1820         newval = (newval & 0xffff0000) | val;
1821     }
1822     s->script_ram[addr >> 2] = newval;
1823 }
1824
1825
1826 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1827 {
1828     LSIState *s = opaque;
1829
1830     addr &= 0x1fff;
1831     s->script_ram[addr >> 2] = val;
1832 }
1833
1834 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1835 {
1836     LSIState *s = opaque;
1837     uint32_t val;
1838
1839     addr &= 0x1fff;
1840     val = s->script_ram[addr >> 2];
1841     val >>= (addr & 3) * 8;
1842     return val & 0xff;
1843 }
1844
1845 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1846 {
1847     LSIState *s = opaque;
1848     uint32_t val;
1849
1850     addr &= 0x1fff;
1851     val = s->script_ram[addr >> 2];
1852     if (addr & 2)
1853         val >>= 16;
1854     return le16_to_cpu(val);
1855 }
1856
1857 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1858 {
1859     LSIState *s = opaque;
1860
1861     addr &= 0x1fff;
1862     return le32_to_cpu(s->script_ram[addr >> 2]);
1863 }
1864
1865 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1866     lsi_ram_readb,
1867     lsi_ram_readw,
1868     lsi_ram_readl,
1869 };
1870
1871 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1872     lsi_ram_writeb,
1873     lsi_ram_writew,
1874     lsi_ram_writel,
1875 };
1876
1877 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1878 {
1879     LSIState *s = opaque;
1880     return lsi_reg_readb(s, addr & 0xff);
1881 }
1882
1883 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1884 {
1885     LSIState *s = opaque;
1886     uint32_t val;
1887     addr &= 0xff;
1888     val = lsi_reg_readb(s, addr);
1889     val |= lsi_reg_readb(s, addr + 1) << 8;
1890     return val;
1891 }
1892
1893 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1894 {
1895     LSIState *s = opaque;
1896     uint32_t val;
1897     addr &= 0xff;
1898     val = lsi_reg_readb(s, addr);
1899     val |= lsi_reg_readb(s, addr + 1) << 8;
1900     val |= lsi_reg_readb(s, addr + 2) << 16;
1901     val |= lsi_reg_readb(s, addr + 3) << 24;
1902     return val;
1903 }
1904
1905 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1906 {
1907     LSIState *s = opaque;
1908     lsi_reg_writeb(s, addr & 0xff, val);
1909 }
1910
1911 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1912 {
1913     LSIState *s = opaque;
1914     addr &= 0xff;
1915     lsi_reg_writeb(s, addr, val & 0xff);
1916     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1917 }
1918
1919 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1920 {
1921     LSIState *s = opaque;
1922     addr &= 0xff;
1923     lsi_reg_writeb(s, addr, val & 0xff);
1924     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1925     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1926     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1927 }
1928
1929 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1930                            pcibus_t addr, pcibus_t size, int type)
1931 {
1932     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1933
1934     DPRINTF("Mapping IO at %08x\n", addr);
1935
1936     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1937     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1938     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1939     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1940     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1941     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1942 }
1943
1944 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1945                             pcibus_t addr, pcibus_t size, int type)
1946 {
1947     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1948
1949     DPRINTF("Mapping ram at %08x\n", addr);
1950     s->script_ram_base = addr;
1951     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1952 }
1953
1954 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1955                              pcibus_t addr, pcibus_t size, int type)
1956 {
1957     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1958
1959     DPRINTF("Mapping registers at %08x\n", addr);
1960     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1961 }
1962
1963 static void lsi_pre_save(void *opaque)
1964 {
1965     LSIState *s = opaque;
1966
1967     assert(s->dma_buf == NULL);
1968     assert(s->current_dma_len == 0);
1969     assert(s->active_commands == 0);
1970 }
1971
1972 static const VMStateDescription vmstate_lsi_scsi = {
1973     .name = "lsiscsi",
1974     .version_id = 0,
1975     .minimum_version_id = 0,
1976     .minimum_version_id_old = 0,
1977     .pre_save = lsi_pre_save,
1978     .fields      = (VMStateField []) {
1979         VMSTATE_PCI_DEVICE(dev, LSIState),
1980
1981         VMSTATE_INT32(carry, LSIState),
1982         VMSTATE_INT32(sense, LSIState),
1983         VMSTATE_INT32(msg_action, LSIState),
1984         VMSTATE_INT32(msg_len, LSIState),
1985         VMSTATE_BUFFER(msg, LSIState),
1986         VMSTATE_INT32(waiting, LSIState),
1987
1988         VMSTATE_UINT32(dsa, LSIState),
1989         VMSTATE_UINT32(temp, LSIState),
1990         VMSTATE_UINT32(dnad, LSIState),
1991         VMSTATE_UINT32(dbc, LSIState),
1992         VMSTATE_UINT8(istat0, LSIState),
1993         VMSTATE_UINT8(istat1, LSIState),
1994         VMSTATE_UINT8(dcmd, LSIState),
1995         VMSTATE_UINT8(dstat, LSIState),
1996         VMSTATE_UINT8(dien, LSIState),
1997         VMSTATE_UINT8(sist0, LSIState),
1998         VMSTATE_UINT8(sist1, LSIState),
1999         VMSTATE_UINT8(sien0, LSIState),
2000         VMSTATE_UINT8(sien1, LSIState),
2001         VMSTATE_UINT8(mbox0, LSIState),
2002         VMSTATE_UINT8(mbox1, LSIState),
2003         VMSTATE_UINT8(dfifo, LSIState),
2004         VMSTATE_UINT8(ctest2, LSIState),
2005         VMSTATE_UINT8(ctest3, LSIState),
2006         VMSTATE_UINT8(ctest4, LSIState),
2007         VMSTATE_UINT8(ctest5, LSIState),
2008         VMSTATE_UINT8(ccntl0, LSIState),
2009         VMSTATE_UINT8(ccntl1, LSIState),
2010         VMSTATE_UINT32(dsp, LSIState),
2011         VMSTATE_UINT32(dsps, LSIState),
2012         VMSTATE_UINT8(dmode, LSIState),
2013         VMSTATE_UINT8(dcntl, LSIState),
2014         VMSTATE_UINT8(scntl0, LSIState),
2015         VMSTATE_UINT8(scntl1, LSIState),
2016         VMSTATE_UINT8(scntl2, LSIState),
2017         VMSTATE_UINT8(scntl3, LSIState),
2018         VMSTATE_UINT8(sstat0, LSIState),
2019         VMSTATE_UINT8(sstat1, LSIState),
2020         VMSTATE_UINT8(scid, LSIState),
2021         VMSTATE_UINT8(sxfer, LSIState),
2022         VMSTATE_UINT8(socl, LSIState),
2023         VMSTATE_UINT8(sdid, LSIState),
2024         VMSTATE_UINT8(ssid, LSIState),
2025         VMSTATE_UINT8(sfbr, LSIState),
2026         VMSTATE_UINT8(stest1, LSIState),
2027         VMSTATE_UINT8(stest2, LSIState),
2028         VMSTATE_UINT8(stest3, LSIState),
2029         VMSTATE_UINT8(sidl, LSIState),
2030         VMSTATE_UINT8(stime0, LSIState),
2031         VMSTATE_UINT8(respid0, LSIState),
2032         VMSTATE_UINT8(respid1, LSIState),
2033         VMSTATE_UINT32(mmrs, LSIState),
2034         VMSTATE_UINT32(mmws, LSIState),
2035         VMSTATE_UINT32(sfs, LSIState),
2036         VMSTATE_UINT32(drs, LSIState),
2037         VMSTATE_UINT32(sbms, LSIState),
2038         VMSTATE_UINT32(dbms, LSIState),
2039         VMSTATE_UINT32(dnad64, LSIState),
2040         VMSTATE_UINT32(pmjad1, LSIState),
2041         VMSTATE_UINT32(pmjad2, LSIState),
2042         VMSTATE_UINT32(rbc, LSIState),
2043         VMSTATE_UINT32(ua, LSIState),
2044         VMSTATE_UINT32(ia, LSIState),
2045         VMSTATE_UINT32(sbc, LSIState),
2046         VMSTATE_UINT32(csbc, LSIState),
2047         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2048         VMSTATE_UINT8(sbr, LSIState),
2049
2050         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2051         VMSTATE_END_OF_LIST()
2052     }
2053 };
2054
2055 static int lsi_scsi_uninit(PCIDevice *d)
2056 {
2057     LSIState *s = DO_UPCAST(LSIState, dev, d);
2058
2059     cpu_unregister_io_memory(s->mmio_io_addr);
2060     cpu_unregister_io_memory(s->ram_io_addr);
2061
2062     qemu_free(s->queue);
2063
2064     return 0;
2065 }
2066
2067 static int lsi_scsi_init(PCIDevice *dev)
2068 {
2069     LSIState *s = DO_UPCAST(LSIState, dev, dev);
2070     uint8_t *pci_conf;
2071
2072     pci_conf = s->dev.config;
2073
2074     /* PCI Vendor ID (word) */
2075     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2076     /* PCI device ID (word) */
2077     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2078     /* PCI base class code */
2079     pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2080     /* PCI subsystem ID */
2081     pci_conf[0x2e] = 0x00;
2082     pci_conf[0x2f] = 0x10;
2083     /* PCI latency timer = 255 */
2084     pci_conf[0x0d] = 0xff;
2085     /* Interrupt pin 1 */
2086     pci_conf[0x3d] = 0x01;
2087
2088     s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2089                                              lsi_mmio_writefn, s);
2090     s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2091                                             lsi_ram_writefn, s);
2092
2093     pci_register_bar((struct PCIDevice *)s, 0, 256,
2094                            PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2095     pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2096                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2097     pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2098                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2099     s->queue = qemu_malloc(sizeof(lsi_queue));
2100     s->queue_len = 1;
2101     s->active_commands = 0;
2102
2103     lsi_soft_reset(s);
2104
2105     scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2106     if (!dev->qdev.hotplugged) {
2107         scsi_bus_legacy_handle_cmdline(&s->bus);
2108     }
2109     vmstate_register(-1, &vmstate_lsi_scsi, s);
2110     return 0;
2111 }
2112
2113 static PCIDeviceInfo lsi_info = {
2114     .qdev.name  = "lsi53c895a",
2115     .qdev.alias = "lsi",
2116     .qdev.size  = sizeof(LSIState),
2117     .init       = lsi_scsi_init,
2118     .exit       = lsi_scsi_uninit,
2119 };
2120
2121 static void lsi53c895a_register_devices(void)
2122 {
2123     pci_qdev_register(&lsi_info);
2124 }
2125
2126 device_init(lsi53c895a_register_devices);