hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include <assert.h>
  14
  15 #include "hw.h"
  16 #include "pci.h"
  17 #include "scsi.h"
  18 #include "block_int.h"
  19
  20 //#define DEBUG_LSI
  21 //#define DEBUG_LSI_REG
  22
  23 #ifdef DEBUG_LSI
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
  26 #define BADF(fmt, ...) \
  27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
  28 #else
  29 #define DPRINTF(fmt, ...) do {} while(0)
  30 #define BADF(fmt, ...) \
  31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
  32 #endif
  33
  34 #define LSI_MAX_DEVS 7
  35
  36 #define LSI_SCNTL0_TRG    0x01
  37 #define LSI_SCNTL0_AAP    0x02
  38 #define LSI_SCNTL0_EPC    0x08
  39 #define LSI_SCNTL0_WATN   0x10
  40 #define LSI_SCNTL0_START  0x20
  41
  42 #define LSI_SCNTL1_SST    0x01
  43 #define LSI_SCNTL1_IARB   0x02
  44 #define LSI_SCNTL1_AESP   0x04
  45 #define LSI_SCNTL1_RST    0x08
  46 #define LSI_SCNTL1_CON    0x10
  47 #define LSI_SCNTL1_DHP    0x20
  48 #define LSI_SCNTL1_ADB    0x40
  49 #define LSI_SCNTL1_EXC    0x80
  50
  51 #define LSI_SCNTL2_WSR    0x01
  52 #define LSI_SCNTL2_VUE0   0x02
  53 #define LSI_SCNTL2_VUE1   0x04
  54 #define LSI_SCNTL2_WSS    0x08
  55 #define LSI_SCNTL2_SLPHBEN 0x10
  56 #define LSI_SCNTL2_SLPMD  0x20
  57 #define LSI_SCNTL2_CHM    0x40
  58 #define LSI_SCNTL2_SDU    0x80
  59
  60 #define LSI_ISTAT0_DIP    0x01
  61 #define LSI_ISTAT0_SIP    0x02
  62 #define LSI_ISTAT0_INTF   0x04
  63 #define LSI_ISTAT0_CON    0x08
  64 #define LSI_ISTAT0_SEM    0x10
  65 #define LSI_ISTAT0_SIGP   0x20
  66 #define LSI_ISTAT0_SRST   0x40
  67 #define LSI_ISTAT0_ABRT   0x80
  68
  69 #define LSI_ISTAT1_SI     0x01
  70 #define LSI_ISTAT1_SRUN   0x02
  71 #define LSI_ISTAT1_FLSH   0x04
  72
  73 #define LSI_SSTAT0_SDP0   0x01
  74 #define LSI_SSTAT0_RST    0x02
  75 #define LSI_SSTAT0_WOA    0x04
  76 #define LSI_SSTAT0_LOA    0x08
  77 #define LSI_SSTAT0_AIP    0x10
  78 #define LSI_SSTAT0_OLF    0x20
  79 #define LSI_SSTAT0_ORF    0x40
  80 #define LSI_SSTAT0_ILF    0x80
  81
  82 #define LSI_SIST0_PAR     0x01
  83 #define LSI_SIST0_RST     0x02
  84 #define LSI_SIST0_UDC     0x04
  85 #define LSI_SIST0_SGE     0x08
  86 #define LSI_SIST0_RSL     0x10
  87 #define LSI_SIST0_SEL     0x20
  88 #define LSI_SIST0_CMP     0x40
  89 #define LSI_SIST0_MA      0x80
  90
  91 #define LSI_SIST1_HTH     0x01
  92 #define LSI_SIST1_GEN     0x02
  93 #define LSI_SIST1_STO     0x04
  94 #define LSI_SIST1_SBMC    0x10
  95
  96 #define LSI_SOCL_IO       0x01
  97 #define LSI_SOCL_CD       0x02
  98 #define LSI_SOCL_MSG      0x04
  99 #define LSI_SOCL_ATN      0x08
 100 #define LSI_SOCL_SEL      0x10
 101 #define LSI_SOCL_BSY      0x20
 102 #define LSI_SOCL_ACK      0x40
 103 #define LSI_SOCL_REQ      0x80
 104
 105 #define LSI_DSTAT_IID     0x01
 106 #define LSI_DSTAT_SIR     0x04
 107 #define LSI_DSTAT_SSI     0x08
 108 #define LSI_DSTAT_ABRT    0x10
 109 #define LSI_DSTAT_BF      0x20
 110 #define LSI_DSTAT_MDPE    0x40
 111 #define LSI_DSTAT_DFE     0x80
 112
 113 #define LSI_DCNTL_COM     0x01
 114 #define LSI_DCNTL_IRQD    0x02
 115 #define LSI_DCNTL_STD     0x04
 116 #define LSI_DCNTL_IRQM    0x08
 117 #define LSI_DCNTL_SSM     0x10
 118 #define LSI_DCNTL_PFEN    0x20
 119 #define LSI_DCNTL_PFF     0x40
 120 #define LSI_DCNTL_CLSE    0x80
 121
 122 #define LSI_DMODE_MAN     0x01
 123 #define LSI_DMODE_BOF     0x02
 124 #define LSI_DMODE_ERMP    0x04
 125 #define LSI_DMODE_ERL     0x08
 126 #define LSI_DMODE_DIOM    0x10
 127 #define LSI_DMODE_SIOM    0x20
 128
 129 #define LSI_CTEST2_DACK   0x01
 130 #define LSI_CTEST2_DREQ   0x02
 131 #define LSI_CTEST2_TEOP   0x04
 132 #define LSI_CTEST2_PCICIE 0x08
 133 #define LSI_CTEST2_CM     0x10
 134 #define LSI_CTEST2_CIO    0x20
 135 #define LSI_CTEST2_SIGP   0x40
 136 #define LSI_CTEST2_DDIR   0x80
 137
 138 #define LSI_CTEST5_BL2    0x04
 139 #define LSI_CTEST5_DDIR   0x08
 140 #define LSI_CTEST5_MASR   0x10
 141 #define LSI_CTEST5_DFSN   0x20
 142 #define LSI_CTEST5_BBCK   0x40
 143 #define LSI_CTEST5_ADCK   0x80
 144
 145 #define LSI_CCNTL0_DILS   0x01
 146 #define LSI_CCNTL0_DISFC  0x10
 147 #define LSI_CCNTL0_ENNDJ  0x20
 148 #define LSI_CCNTL0_PMJCTL 0x40
 149 #define LSI_CCNTL0_ENPMJ  0x80
 150
 151 #define LSI_CCNTL1_EN64DBMV  0x01
 152 #define LSI_CCNTL1_EN64TIBMV 0x02
 153 #define LSI_CCNTL1_64TIMOD   0x04
 154 #define LSI_CCNTL1_DDAC      0x08
 155 #define LSI_CCNTL1_ZMOD      0x80
 156
 157 /* Enable Response to Reselection */
 158 #define LSI_SCID_RRE      0x60
 159
 160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 161
 162 #define PHASE_DO          0
 163 #define PHASE_DI          1
 164 #define PHASE_CMD         2
 165 #define PHASE_ST          3
 166 #define PHASE_MO          6
 167 #define PHASE_MI          7
 168 #define PHASE_MASK        7
 169
 170 /* Maximum length of MSG IN data.  */
 171 #define LSI_MAX_MSGIN_LEN 8
 172
 173 /* Flag set if this is a tagged command.  */
 174 #define LSI_TAG_VALID     (1 << 16)
 175
 176 typedef struct lsi_request {
 177     uint32_t tag;
 178     uint32_t dma_len;
 179     uint8_t *dma_buf;
 180     uint32_t pending;
 181     int out;
 182     QTAILQ_ENTRY(lsi_request) next;
 183 } lsi_request;
 184
 185 typedef struct {
 186     PCIDevice dev;
 187     int mmio_io_addr;
 188     int ram_io_addr;
 189     uint32_t script_ram_base;
 190
 191     int carry; /* ??? Should this be an a visible register somewhere?  */
 192     int sense;
 193     /* Action to take at the end of a MSG IN phase.
 194        0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN.  */
 195     int msg_action;
 196     int msg_len;
 197     uint8_t msg[LSI_MAX_MSGIN_LEN];
 198     /* 0 if SCRIPTS are running or stopped.
 199      * 1 if a Wait Reselect instruction has been issued.
 200      * 2 if processing DMA from lsi_execute_script.
 201      * 3 if a DMA operation is in progress.  */
 202     int waiting;
 203     SCSIBus bus;
 204     int current_lun;
 205     /* The tag is a combination of the device ID and the SCSI tag.  */
 206     uint32_t select_tag;
 207     int command_complete;
 208     QTAILQ_HEAD(, lsi_request) queue;
 209     lsi_request *current;
 210
 211     uint32_t dsa;
 212     uint32_t temp;
 213     uint32_t dnad;
 214     uint32_t dbc;
 215     uint8_t istat0;
 216     uint8_t istat1;
 217     uint8_t dcmd;
 218     uint8_t dstat;
 219     uint8_t dien;
 220     uint8_t sist0;
 221     uint8_t sist1;
 222     uint8_t sien0;
 223     uint8_t sien1;
 224     uint8_t mbox0;
 225     uint8_t mbox1;
 226     uint8_t dfifo;
 227     uint8_t ctest2;
 228     uint8_t ctest3;
 229     uint8_t ctest4;
 230     uint8_t ctest5;
 231     uint8_t ccntl0;
 232     uint8_t ccntl1;
 233     uint32_t dsp;
 234     uint32_t dsps;
 235     uint8_t dmode;
 236     uint8_t dcntl;
 237     uint8_t scntl0;
 238     uint8_t scntl1;
 239     uint8_t scntl2;
 240     uint8_t scntl3;
 241     uint8_t sstat0;
 242     uint8_t sstat1;
 243     uint8_t scid;
 244     uint8_t sxfer;
 245     uint8_t socl;
 246     uint8_t sdid;
 247     uint8_t ssid;
 248     uint8_t sfbr;
 249     uint8_t stest1;
 250     uint8_t stest2;
 251     uint8_t stest3;
 252     uint8_t sidl;
 253     uint8_t stime0;
 254     uint8_t respid0;
 255     uint8_t respid1;
 256     uint32_t mmrs;
 257     uint32_t mmws;
 258     uint32_t sfs;
 259     uint32_t drs;
 260     uint32_t sbms;
 261     uint32_t dbms;
 262     uint32_t dnad64;
 263     uint32_t pmjad1;
 264     uint32_t pmjad2;
 265     uint32_t rbc;
 266     uint32_t ua;
 267     uint32_t ia;
 268     uint32_t sbc;
 269     uint32_t csbc;
 270     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 271     uint8_t sbr;
 272
 273     /* Script ram is stored as 32-bit words in host byteorder.  */
 274     uint32_t script_ram[2048];
 275 } LSIState;
 276
 277 static inline int lsi_irq_on_rsl(LSIState *s)
 278 {
 279     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
 280 }
 281
 282 static void lsi_soft_reset(LSIState *s)
 283 {
 284     lsi_request *p;
 285
 286     DPRINTF("Reset\n");
 287     s->carry = 0;
 288
 289     s->msg_action = 0;
 290     s->msg_len = 0;
 291     s->waiting = 0;
 292     s->dsa = 0;
 293     s->dnad = 0;
 294     s->dbc = 0;
 295     s->temp = 0;
 296     memset(s->scratch, 0, sizeof(s->scratch));
 297     s->istat0 = 0;
 298     s->istat1 = 0;
 299     s->dcmd = 0x40;
 300     s->dstat = LSI_DSTAT_DFE;
 301     s->dien = 0;
 302     s->sist0 = 0;
 303     s->sist1 = 0;
 304     s->sien0 = 0;
 305     s->sien1 = 0;
 306     s->mbox0 = 0;
 307     s->mbox1 = 0;
 308     s->dfifo = 0;
 309     s->ctest2 = LSI_CTEST2_DACK;
 310     s->ctest3 = 0;
 311     s->ctest4 = 0;
 312     s->ctest5 = 0;
 313     s->ccntl0 = 0;
 314     s->ccntl1 = 0;
 315     s->dsp = 0;
 316     s->dsps = 0;
 317     s->dmode = 0;
 318     s->dcntl = 0;
 319     s->scntl0 = 0xc0;
 320     s->scntl1 = 0;
 321     s->scntl2 = 0;
 322     s->scntl3 = 0;
 323     s->sstat0 = 0;
 324     s->sstat1 = 0;
 325     s->scid = 7;
 326     s->sxfer = 0;
 327     s->socl = 0;
 328     s->sdid = 0;
 329     s->ssid = 0;
 330     s->stest1 = 0;
 331     s->stest2 = 0;
 332     s->stest3 = 0;
 333     s->sidl = 0;
 334     s->stime0 = 0;
 335     s->respid0 = 0x80;
 336     s->respid1 = 0;
 337     s->mmrs = 0;
 338     s->mmws = 0;
 339     s->sfs = 0;
 340     s->drs = 0;
 341     s->sbms = 0;
 342     s->dbms = 0;
 343     s->dnad64 = 0;
 344     s->pmjad1 = 0;
 345     s->pmjad2 = 0;
 346     s->rbc = 0;
 347     s->ua = 0;
 348     s->ia = 0;
 349     s->sbc = 0;
 350     s->csbc = 0;
 351     s->sbr = 0;
 352     while (!QTAILQ_EMPTY(&s->queue)) {
 353         p = QTAILQ_FIRST(&s->queue);
 354         QTAILQ_REMOVE(&s->queue, p, next);
 355         qemu_free(p);
 356     }
 357     if (s->current) {
 358         qemu_free(s->current);
 359         s->current = NULL;
 360     }
 361 }
 362
 363 static int lsi_dma_40bit(LSIState *s)
 364 {
 365     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 366         return 1;
 367     return 0;
 368 }
 369
 370 static int lsi_dma_ti64bit(LSIState *s)
 371 {
 372     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 373         return 1;
 374     return 0;
 375 }
 376
 377 static int lsi_dma_64bit(LSIState *s)
 378 {
 379     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 380         return 1;
 381     return 0;
 382 }
 383
 384 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 385 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 386 static void lsi_execute_script(LSIState *s);
 387 static void lsi_reselect(LSIState *s, lsi_request *p);
 388
 389 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 390 {
 391     uint32_t buf;
 392
 393     /* Optimize reading from SCRIPTS RAM.  */
 394     if ((addr & 0xffffe000) == s->script_ram_base) {
 395         return s->script_ram[(addr & 0x1fff) >> 2];
 396     }
 397     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 398     return cpu_to_le32(buf);
 399 }
 400
 401 static void lsi_stop_script(LSIState *s)
 402 {
 403     s->istat1 &= ~LSI_ISTAT1_SRUN;
 404 }
 405
 406 static void lsi_update_irq(LSIState *s)
 407 {
 408     int level;
 409     static int last_level;
 410     lsi_request *p;
 411
 412     /* It's unclear whether the DIP/SIP bits should be cleared when the
 413        Interrupt Status Registers are cleared or when istat0 is read.
 414        We currently do the formwer, which seems to work.  */
 415     level = 0;
 416     if (s->dstat) {
 417         if (s->dstat & s->dien)
 418             level = 1;
 419         s->istat0 |= LSI_ISTAT0_DIP;
 420     } else {
 421         s->istat0 &= ~LSI_ISTAT0_DIP;
 422     }
 423
 424     if (s->sist0 || s->sist1) {
 425         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 426             level = 1;
 427         s->istat0 |= LSI_ISTAT0_SIP;
 428     } else {
 429         s->istat0 &= ~LSI_ISTAT0_SIP;
 430     }
 431     if (s->istat0 & LSI_ISTAT0_INTF)
 432         level = 1;
 433
 434     if (level != last_level) {
 435         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 436                 level, s->dstat, s->sist1, s->sist0);
 437         last_level = level;
 438     }
 439     qemu_set_irq(s->dev.irq[0], level);
 440
 441     if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
 442         DPRINTF("Handled IRQs & disconnected, looking for pending "
 443                 "processes\n");
 444         QTAILQ_FOREACH(p, &s->queue, next) {
 445             if (p->pending) {
 446                 lsi_reselect(s, p);
 447                 break;
 448             }
 449         }
 450     }
 451 }
 452
 453 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 454 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 455 {
 456     uint32_t mask0;
 457     uint32_t mask1;
 458
 459     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 460             stat1, stat0, s->sist1, s->sist0);
 461     s->sist0 |= stat0;
 462     s->sist1 |= stat1;
 463     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 464        we don't stop processing when raising STO.  Instead continue
 465        execution and stop at the next insn that accesses the SCSI bus.  */
 466     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 467     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 468     mask1 &= ~LSI_SIST1_STO;
 469     if (s->sist0 & mask0 || s->sist1 & mask1) {
 470         lsi_stop_script(s);
 471     }
 472     lsi_update_irq(s);
 473 }
 474
 475 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 476 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 477 {
 478     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 479     s->dstat |= stat;
 480     lsi_update_irq(s);
 481     lsi_stop_script(s);
 482 }
 483
 484 static inline void lsi_set_phase(LSIState *s, int phase)
 485 {
 486     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 487 }
 488
 489 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 490 {
 491     /* Trigger a phase mismatch.  */
 492     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 493         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
 494             s->dsp = out ? s->pmjad1 : s->pmjad2;
 495         } else {
 496             s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
 497         }
 498         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 499     } else {
 500         DPRINTF("Phase mismatch interrupt\n");
 501         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 502         lsi_stop_script(s);
 503     }
 504     lsi_set_phase(s, new_phase);
 505 }
 506
 507
 508 /* Resume SCRIPTS execution after a DMA operation.  */
 509 static void lsi_resume_script(LSIState *s)
 510 {
 511     if (s->waiting != 2) {
 512         s->waiting = 0;
 513         lsi_execute_script(s);
 514     } else {
 515         s->waiting = 0;
 516     }
 517 }
 518
 519 static void lsi_disconnect(LSIState *s)
 520 {
 521     s->scntl1 &= ~LSI_SCNTL1_CON;
 522     s->sstat1 &= ~PHASE_MASK;
 523 }
 524
 525 static void lsi_bad_selection(LSIState *s, uint32_t id)
 526 {
 527     DPRINTF("Selected absent target %d\n", id);
 528     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 529     lsi_disconnect(s);
 530 }
 531
 532 /* Initiate a SCSI layer data transfer.  */
 533 static void lsi_do_dma(LSIState *s, int out)
 534 {
 535     uint32_t count, id;
 536     target_phys_addr_t addr;
 537     SCSIDevice *dev;
 538
 539     assert(s->current);
 540     if (!s->current->dma_len) {
 541         /* Wait until data is available.  */
 542         DPRINTF("DMA no data available\n");
 543         return;
 544     }
 545
 546     id = (s->current->tag >> 8) & 0xf;
 547     dev = s->bus.devs[id];
 548     if (!dev) {
 549         lsi_bad_selection(s, id);
 550         return;
 551     }
 552
 553     count = s->dbc;
 554     if (count > s->current->dma_len)
 555         count = s->current->dma_len;
 556
 557     addr = s->dnad;
 558     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 559     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 560         addr |= ((uint64_t)s->dnad64 << 32);
 561     else if (s->dbms)
 562         addr |= ((uint64_t)s->dbms << 32);
 563     else if (s->sbms)
 564         addr |= ((uint64_t)s->sbms << 32);
 565
 566     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 567     s->csbc += count;
 568     s->dnad += count;
 569     s->dbc -= count;
 570
 571     if (s->current->dma_buf == NULL) {
 572         s->current->dma_buf = dev->info->get_buf(dev, s->current->tag);
 573     }
 574
 575     /* ??? Set SFBR to first data byte.  */
 576     if (out) {
 577         cpu_physical_memory_read(addr, s->current->dma_buf, count);
 578     } else {
 579         cpu_physical_memory_write(addr, s->current->dma_buf, count);
 580     }
 581     s->current->dma_len -= count;
 582     if (s->current->dma_len == 0) {
 583         s->current->dma_buf = NULL;
 584         if (out) {
 585             /* Write the data.  */
 586             dev->info->write_data(dev, s->current->tag);
 587         } else {
 588             /* Request any remaining data.  */
 589             dev->info->read_data(dev, s->current->tag);
 590         }
 591     } else {
 592         s->current->dma_buf += count;
 593         lsi_resume_script(s);
 594     }
 595 }
 596
 597
 598 /* Add a command to the queue.  */
 599 static void lsi_queue_command(LSIState *s)
 600 {
 601     lsi_request *p = s->current;
 602
 603     DPRINTF("Queueing tag=0x%x\n", p->tag);
 604     assert(s->current != NULL);
 605     assert(s->current->dma_len == 0);
 606     QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
 607     s->current = NULL;
 608
 609     p->pending = 0;
 610     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 611 }
 612
 613 /* Queue a byte for a MSG IN phase.  */
 614 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 615 {
 616     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 617         BADF("MSG IN data too long\n");
 618     } else {
 619         DPRINTF("MSG IN 0x%02x\n", data);
 620         s->msg[s->msg_len++] = data;
 621     }
 622 }
 623
 624 /* Perform reselection to continue a command.  */
 625 static void lsi_reselect(LSIState *s, lsi_request *p)
 626 {
 627     int id;
 628
 629     assert(s->current == NULL);
 630     QTAILQ_REMOVE(&s->queue, p, next);
 631     s->current = p;
 632
 633     id = (p->tag >> 8) & 0xf;
 634     s->ssid = id | 0x80;
 635     /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
 636     if (!(s->dcntl & LSI_DCNTL_COM)) {
 637         s->sfbr = 1 << (id & 0x7);
 638     }
 639     DPRINTF("Reselected target %d\n", id);
 640     s->scntl1 |= LSI_SCNTL1_CON;
 641     lsi_set_phase(s, PHASE_MI);
 642     s->msg_action = p->out ? 2 : 3;
 643     s->current->dma_len = p->pending;
 644     lsi_add_msg_byte(s, 0x80);
 645     if (s->current->tag & LSI_TAG_VALID) {
 646         lsi_add_msg_byte(s, 0x20);
 647         lsi_add_msg_byte(s, p->tag & 0xff);
 648     }
 649
 650     if (lsi_irq_on_rsl(s)) {
 651         lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
 652     }
 653 }
 654
 655 /* Record that data is available for a queued command.  Returns zero if
 656    the device was reselected, nonzero if the IO is deferred.  */
 657 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 658 {
 659     lsi_request *p;
 660
 661     QTAILQ_FOREACH(p, &s->queue, next) {
 662         if (p->tag == tag) {
 663             if (p->pending) {
 664                 BADF("Multiple IO pending for tag %d\n", tag);
 665             }
 666             p->pending = arg;
 667             /* Reselect if waiting for it, or if reselection triggers an IRQ
 668                and the bus is free.
 669                Since no interrupt stacking is implemented in the emulation, it
 670                is also required that there are no pending interrupts waiting
 671                for service from the device driver. */
 672             if (s->waiting == 1 ||
 673                 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
 674                  !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
 675                 /* Reselect device.  */
 676                 lsi_reselect(s, p);
 677                 return 0;
 678             } else {
 679                 DPRINTF("Queueing IO tag=0x%x\n", tag);
 680                 p->pending = arg;
 681                 return 1;
 682             }
 683         }
 684     }
 685     BADF("IO with unknown tag %d\n", tag);
 686     return 1;
 687 }
 688
 689 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 690 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 691                                  uint32_t arg)
 692 {
 693     LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
 694     int out;
 695
 696     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 697     if (reason == SCSI_REASON_DONE) {
 698         DPRINTF("Command complete sense=%d\n", (int)arg);
 699         s->sense = arg;
 700         s->command_complete = 2;
 701         if (s->waiting && s->dbc != 0) {
 702             /* Raise phase mismatch for short transfers.  */
 703             lsi_bad_phase(s, out, PHASE_ST);
 704         } else {
 705             lsi_set_phase(s, PHASE_ST);
 706         }
 707
 708         qemu_free(s->current);
 709         s->current = NULL;
 710
 711         lsi_resume_script(s);
 712         return;
 713     }
 714
 715     if (s->waiting == 1 || !s->current || tag != s->current->tag ||
 716         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
 717         if (lsi_queue_tag(s, tag, arg))
 718             return;
 719     }
 720
 721     /* host adapter (re)connected */
 722     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 723     s->current->dma_len = arg;
 724     s->command_complete = 1;
 725     if (!s->waiting)
 726         return;
 727     if (s->waiting == 1 || s->dbc == 0) {
 728         lsi_resume_script(s);
 729     } else {
 730         lsi_do_dma(s, out);
 731     }
 732 }
 733
 734 static void lsi_do_command(LSIState *s)
 735 {
 736     SCSIDevice *dev;
 737     uint8_t buf[16];
 738     uint32_t id;
 739     int n;
 740
 741     DPRINTF("Send command len=%d\n", s->dbc);
 742     if (s->dbc > 16)
 743         s->dbc = 16;
 744     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 745     s->sfbr = buf[0];
 746     s->command_complete = 0;
 747
 748     id = (s->select_tag >> 8) & 0xf;
 749     dev = s->bus.devs[id];
 750     if (!dev) {
 751         lsi_bad_selection(s, id);
 752         return;
 753     }
 754
 755     assert(s->current == NULL);
 756     s->current = qemu_mallocz(sizeof(lsi_request));
 757     s->current->tag = s->select_tag;
 758
 759     n = dev->info->send_command(dev, s->current->tag, buf, s->current_lun);
 760     if (n > 0) {
 761         lsi_set_phase(s, PHASE_DI);
 762         dev->info->read_data(dev, s->current->tag);
 763     } else if (n < 0) {
 764         lsi_set_phase(s, PHASE_DO);
 765         dev->info->write_data(dev, s->current->tag);
 766     }
 767
 768     if (!s->command_complete) {
 769         if (n) {
 770             /* Command did not complete immediately so disconnect.  */
 771             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 772             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 773             /* wait data */
 774             lsi_set_phase(s, PHASE_MI);
 775             s->msg_action = 1;
 776             lsi_queue_command(s);
 777         } else {
 778             /* wait command complete */
 779             lsi_set_phase(s, PHASE_DI);
 780         }
 781     }
 782 }
 783
 784 static void lsi_do_status(LSIState *s)
 785 {
 786     uint8_t sense;
 787     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 788     if (s->dbc != 1)
 789         BADF("Bad Status move\n");
 790     s->dbc = 1;
 791     sense = s->sense;
 792     s->sfbr = sense;
 793     cpu_physical_memory_write(s->dnad, &sense, 1);
 794     lsi_set_phase(s, PHASE_MI);
 795     s->msg_action = 1;
 796     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 797 }
 798
 799 static void lsi_do_msgin(LSIState *s)
 800 {
 801     int len;
 802     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 803     s->sfbr = s->msg[0];
 804     len = s->msg_len;
 805     if (len > s->dbc)
 806         len = s->dbc;
 807     cpu_physical_memory_write(s->dnad, s->msg, len);
 808     /* Linux drivers rely on the last byte being in the SIDL.  */
 809     s->sidl = s->msg[len - 1];
 810     s->msg_len -= len;
 811     if (s->msg_len) {
 812         memmove(s->msg, s->msg + len, s->msg_len);
 813     } else {
 814         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 815            switch to PHASE_MO.  */
 816         switch (s->msg_action) {
 817         case 0:
 818             lsi_set_phase(s, PHASE_CMD);
 819             break;
 820         case 1:
 821             lsi_disconnect(s);
 822             break;
 823         case 2:
 824             lsi_set_phase(s, PHASE_DO);
 825             break;
 826         case 3:
 827             lsi_set_phase(s, PHASE_DI);
 828             break;
 829         default:
 830             abort();
 831         }
 832     }
 833 }
 834
 835 /* Read the next byte during a MSGOUT phase.  */
 836 static uint8_t lsi_get_msgbyte(LSIState *s)
 837 {
 838     uint8_t data;
 839     cpu_physical_memory_read(s->dnad, &data, 1);
 840     s->dnad++;
 841     s->dbc--;
 842     return data;
 843 }
 844
 845 /* Skip the next n bytes during a MSGOUT phase. */
 846 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
 847 {
 848     s->dnad += n;
 849     s->dbc  -= n;
 850 }
 851
 852 static void lsi_do_msgout(LSIState *s)
 853 {
 854     uint8_t msg;
 855     int len;
 856
 857     DPRINTF("MSG out len=%d\n", s->dbc);
 858     while (s->dbc) {
 859         msg = lsi_get_msgbyte(s);
 860         s->sfbr = msg;
 861
 862         switch (msg) {
 863         case 0x04:
 864             DPRINTF("MSG: Disconnect\n");
 865             lsi_disconnect(s);
 866             break;
 867         case 0x08:
 868             DPRINTF("MSG: No Operation\n");
 869             lsi_set_phase(s, PHASE_CMD);
 870             break;
 871         case 0x01:
 872             len = lsi_get_msgbyte(s);
 873             msg = lsi_get_msgbyte(s);
 874             (void)len; /* avoid a warning about unused variable*/
 875             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 876             switch (msg) {
 877             case 1:
 878                 DPRINTF("SDTR (ignored)\n");
 879                 lsi_skip_msgbytes(s, 2);
 880                 break;
 881             case 3:
 882                 DPRINTF("WDTR (ignored)\n");
 883                 lsi_skip_msgbytes(s, 1);
 884                 break;
 885             default:
 886                 goto bad;
 887             }
 888             break;
 889         case 0x20: /* SIMPLE queue */
 890             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 891             DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
 892             break;
 893         case 0x21: /* HEAD of queue */
 894             BADF("HEAD queue not implemented\n");
 895             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 896             break;
 897         case 0x22: /* ORDERED queue */
 898             BADF("ORDERED queue not implemented\n");
 899             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 900             break;
 901         default:
 902             if ((msg & 0x80) == 0) {
 903                 goto bad;
 904             }
 905             s->current_lun = msg & 7;
 906             DPRINTF("Select LUN %d\n", s->current_lun);
 907             lsi_set_phase(s, PHASE_CMD);
 908             break;
 909         }
 910     }
 911     return;
 912 bad:
 913     BADF("Unimplemented message 0x%02x\n", msg);
 914     lsi_set_phase(s, PHASE_MI);
 915     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 916     s->msg_action = 0;
 917 }
 918
 919 /* Sign extend a 24-bit value.  */
 920 static inline int32_t sxt24(int32_t n)
 921 {
 922     return (n << 8) >> 8;
 923 }
 924
 925 #define LSI_BUF_SIZE 4096
 926 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 927 {
 928     int n;
 929     uint8_t buf[LSI_BUF_SIZE];
 930
 931     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 932     while (count) {
 933         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
 934         cpu_physical_memory_read(src, buf, n);
 935         cpu_physical_memory_write(dest, buf, n);
 936         src += n;
 937         dest += n;
 938         count -= n;
 939     }
 940 }
 941
 942 static void lsi_wait_reselect(LSIState *s)
 943 {
 944     lsi_request *p;
 945
 946     DPRINTF("Wait Reselect\n");
 947
 948     QTAILQ_FOREACH(p, &s->queue, next) {
 949         if (p->pending) {
 950             lsi_reselect(s, p);
 951             break;
 952         }
 953     }
 954     if (s->current == NULL) {
 955         s->waiting = 1;
 956     }
 957 }
 958
 959 static void lsi_execute_script(LSIState *s)
 960 {
 961     uint32_t insn;
 962     uint32_t addr, addr_high;
 963     int opcode;
 964     int insn_processed = 0;
 965
 966     s->istat1 |= LSI_ISTAT1_SRUN;
 967 again:
 968     insn_processed++;
 969     insn = read_dword(s, s->dsp);
 970     if (!insn) {
 971         /* If we receive an empty opcode increment the DSP by 4 bytes
 972            instead of 8 and execute the next opcode at that location */
 973         s->dsp += 4;
 974         goto again;
 975     }
 976     addr = read_dword(s, s->dsp + 4);
 977     addr_high = 0;
 978     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 979     s->dsps = addr;
 980     s->dcmd = insn >> 24;
 981     s->dsp += 8;
 982     switch (insn >> 30) {
 983     case 0: /* Block move.  */
 984         if (s->sist1 & LSI_SIST1_STO) {
 985             DPRINTF("Delayed select timeout\n");
 986             lsi_stop_script(s);
 987             break;
 988         }
 989         s->dbc = insn & 0xffffff;
 990         s->rbc = s->dbc;
 991         /* ??? Set ESA.  */
 992         s->ia = s->dsp - 8;
 993         if (insn & (1 << 29)) {
 994             /* Indirect addressing.  */
 995             addr = read_dword(s, addr);
 996         } else if (insn & (1 << 28)) {
 997             uint32_t buf[2];
 998             int32_t offset;
 999             /* Table indirect addressing.  */
1000
1001             /* 32-bit Table indirect */
1002             offset = sxt24(addr);
1003             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
1004             /* byte count is stored in bits 0:23 only */
1005             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1006             s->rbc = s->dbc;
1007             addr = cpu_to_le32(buf[1]);
1008
1009             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1010              * table, bits [31:24] */
1011             if (lsi_dma_40bit(s))
1012                 addr_high = cpu_to_le32(buf[0]) >> 24;
1013             else if (lsi_dma_ti64bit(s)) {
1014                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1015                 switch (selector) {
1016                 case 0 ... 0x0f:
1017                     /* offset index into scratch registers since
1018                      * TI64 mode can use registers C to R */
1019                     addr_high = s->scratch[2 + selector];
1020                     break;
1021                 case 0x10:
1022                     addr_high = s->mmrs;
1023                     break;
1024                 case 0x11:
1025                     addr_high = s->mmws;
1026                     break;
1027                 case 0x12:
1028                     addr_high = s->sfs;
1029                     break;
1030                 case 0x13:
1031                     addr_high = s->drs;
1032                     break;
1033                 case 0x14:
1034                     addr_high = s->sbms;
1035                     break;
1036                 case 0x15:
1037                     addr_high = s->dbms;
1038                     break;
1039                 default:
1040                     BADF("Illegal selector specified (0x%x > 0x15)"
1041                          " for 64-bit DMA block move", selector);
1042                     break;
1043                 }
1044             }
1045         } else if (lsi_dma_64bit(s)) {
1046             /* fetch a 3rd dword if 64-bit direct move is enabled and
1047                only if we're not doing table indirect or indirect addressing */
1048             s->dbms = read_dword(s, s->dsp);
1049             s->dsp += 4;
1050             s->ia = s->dsp - 12;
1051         }
1052         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1053             DPRINTF("Wrong phase got %d expected %d\n",
1054                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1055             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1056             break;
1057         }
1058         s->dnad = addr;
1059         s->dnad64 = addr_high;
1060         switch (s->sstat1 & 0x7) {
1061         case PHASE_DO:
1062             s->waiting = 2;
1063             lsi_do_dma(s, 1);
1064             if (s->waiting)
1065                 s->waiting = 3;
1066             break;
1067         case PHASE_DI:
1068             s->waiting = 2;
1069             lsi_do_dma(s, 0);
1070             if (s->waiting)
1071                 s->waiting = 3;
1072             break;
1073         case PHASE_CMD:
1074             lsi_do_command(s);
1075             break;
1076         case PHASE_ST:
1077             lsi_do_status(s);
1078             break;
1079         case PHASE_MO:
1080             lsi_do_msgout(s);
1081             break;
1082         case PHASE_MI:
1083             lsi_do_msgin(s);
1084             break;
1085         default:
1086             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1087             exit(1);
1088         }
1089         s->dfifo = s->dbc & 0xff;
1090         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1091         s->sbc = s->dbc;
1092         s->rbc -= s->dbc;
1093         s->ua = addr + s->dbc;
1094         break;
1095
1096     case 1: /* IO or Read/Write instruction.  */
1097         opcode = (insn >> 27) & 7;
1098         if (opcode < 5) {
1099             uint32_t id;
1100
1101             if (insn & (1 << 25)) {
1102                 id = read_dword(s, s->dsa + sxt24(insn));
1103             } else {
1104                 id = insn;
1105             }
1106             id = (id >> 16) & 0xf;
1107             if (insn & (1 << 26)) {
1108                 addr = s->dsp + sxt24(addr);
1109             }
1110             s->dnad = addr;
1111             switch (opcode) {
1112             case 0: /* Select */
1113                 s->sdid = id;
1114                 if (s->scntl1 & LSI_SCNTL1_CON) {
1115                     DPRINTF("Already reselected, jumping to alternative address\n");
1116                     s->dsp = s->dnad;
1117                     break;
1118                 }
1119                 s->sstat0 |= LSI_SSTAT0_WOA;
1120                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1121                 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1122                     lsi_bad_selection(s, id);
1123                     break;
1124                 }
1125                 DPRINTF("Selected target %d%s\n",
1126                         id, insn & (1 << 3) ? " ATN" : "");
1127                 /* ??? Linux drivers compain when this is set.  Maybe
1128                    it only applies in low-level mode (unimplemented).
1129                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1130                 s->select_tag = id << 8;
1131                 s->scntl1 |= LSI_SCNTL1_CON;
1132                 if (insn & (1 << 3)) {
1133                     s->socl |= LSI_SOCL_ATN;
1134                 }
1135                 lsi_set_phase(s, PHASE_MO);
1136                 break;
1137             case 1: /* Disconnect */
1138                 DPRINTF("Wait Disconnect\n");
1139                 s->scntl1 &= ~LSI_SCNTL1_CON;
1140                 break;
1141             case 2: /* Wait Reselect */
1142                 if (!lsi_irq_on_rsl(s)) {
1143                     lsi_wait_reselect(s);
1144                 }
1145                 break;
1146             case 3: /* Set */
1147                 DPRINTF("Set%s%s%s%s\n",
1148                         insn & (1 << 3) ? " ATN" : "",
1149                         insn & (1 << 6) ? " ACK" : "",
1150                         insn & (1 << 9) ? " TM" : "",
1151                         insn & (1 << 10) ? " CC" : "");
1152                 if (insn & (1 << 3)) {
1153                     s->socl |= LSI_SOCL_ATN;
1154                     lsi_set_phase(s, PHASE_MO);
1155                 }
1156                 if (insn & (1 << 9)) {
1157                     BADF("Target mode not implemented\n");
1158                     exit(1);
1159                 }
1160                 if (insn & (1 << 10))
1161                     s->carry = 1;
1162                 break;
1163             case 4: /* Clear */
1164                 DPRINTF("Clear%s%s%s%s\n",
1165                         insn & (1 << 3) ? " ATN" : "",
1166                         insn & (1 << 6) ? " ACK" : "",
1167                         insn & (1 << 9) ? " TM" : "",
1168                         insn & (1 << 10) ? " CC" : "");
1169                 if (insn & (1 << 3)) {
1170                     s->socl &= ~LSI_SOCL_ATN;
1171                 }
1172                 if (insn & (1 << 10))
1173                     s->carry = 0;
1174                 break;
1175             }
1176         } else {
1177             uint8_t op0;
1178             uint8_t op1;
1179             uint8_t data8;
1180             int reg;
1181             int operator;
1182 #ifdef DEBUG_LSI
1183             static const char *opcode_names[3] =
1184                 {"Write", "Read", "Read-Modify-Write"};
1185             static const char *operator_names[8] =
1186                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1187 #endif
1188
1189             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1190             data8 = (insn >> 8) & 0xff;
1191             opcode = (insn >> 27) & 7;
1192             operator = (insn >> 24) & 7;
1193             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1194                     opcode_names[opcode - 5], reg,
1195                     operator_names[operator], data8, s->sfbr,
1196                     (insn & (1 << 23)) ? " SFBR" : "");
1197             op0 = op1 = 0;
1198             switch (opcode) {
1199             case 5: /* From SFBR */
1200                 op0 = s->sfbr;
1201                 op1 = data8;
1202                 break;
1203             case 6: /* To SFBR */
1204                 if (operator)
1205                     op0 = lsi_reg_readb(s, reg);
1206                 op1 = data8;
1207                 break;
1208             case 7: /* Read-modify-write */
1209                 if (operator)
1210                     op0 = lsi_reg_readb(s, reg);
1211                 if (insn & (1 << 23)) {
1212                     op1 = s->sfbr;
1213                 } else {
1214                     op1 = data8;
1215                 }
1216                 break;
1217             }
1218
1219             switch (operator) {
1220             case 0: /* move */
1221                 op0 = op1;
1222                 break;
1223             case 1: /* Shift left */
1224                 op1 = op0 >> 7;
1225                 op0 = (op0 << 1) | s->carry;
1226                 s->carry = op1;
1227                 break;
1228             case 2: /* OR */
1229                 op0 |= op1;
1230                 break;
1231             case 3: /* XOR */
1232                 op0 ^= op1;
1233                 break;
1234             case 4: /* AND */
1235                 op0 &= op1;
1236                 break;
1237             case 5: /* SHR */
1238                 op1 = op0 & 1;
1239                 op0 = (op0 >> 1) | (s->carry << 7);
1240                 s->carry = op1;
1241                 break;
1242             case 6: /* ADD */
1243                 op0 += op1;
1244                 s->carry = op0 < op1;
1245                 break;
1246             case 7: /* ADC */
1247                 op0 += op1 + s->carry;
1248                 if (s->carry)
1249                     s->carry = op0 <= op1;
1250                 else
1251                     s->carry = op0 < op1;
1252                 break;
1253             }
1254
1255             switch (opcode) {
1256             case 5: /* From SFBR */
1257             case 7: /* Read-modify-write */
1258                 lsi_reg_writeb(s, reg, op0);
1259                 break;
1260             case 6: /* To SFBR */
1261                 s->sfbr = op0;
1262                 break;
1263             }
1264         }
1265         break;
1266
1267     case 2: /* Transfer Control.  */
1268         {
1269             int cond;
1270             int jmp;
1271
1272             if ((insn & 0x002e0000) == 0) {
1273                 DPRINTF("NOP\n");
1274                 break;
1275             }
1276             if (s->sist1 & LSI_SIST1_STO) {
1277                 DPRINTF("Delayed select timeout\n");
1278                 lsi_stop_script(s);
1279                 break;
1280             }
1281             cond = jmp = (insn & (1 << 19)) != 0;
1282             if (cond == jmp && (insn & (1 << 21))) {
1283                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1284                 cond = s->carry != 0;
1285             }
1286             if (cond == jmp && (insn & (1 << 17))) {
1287                 DPRINTF("Compare phase %d %c= %d\n",
1288                         (s->sstat1 & PHASE_MASK),
1289                         jmp ? '=' : '!',
1290                         ((insn >> 24) & 7));
1291                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1292             }
1293             if (cond == jmp && (insn & (1 << 18))) {
1294                 uint8_t mask;
1295
1296                 mask = (~insn >> 8) & 0xff;
1297                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1298                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1299                 cond = (s->sfbr & mask) == (insn & mask);
1300             }
1301             if (cond == jmp) {
1302                 if (insn & (1 << 23)) {
1303                     /* Relative address.  */
1304                     addr = s->dsp + sxt24(addr);
1305                 }
1306                 switch ((insn >> 27) & 7) {
1307                 case 0: /* Jump */
1308                     DPRINTF("Jump to 0x%08x\n", addr);
1309                     s->dsp = addr;
1310                     break;
1311                 case 1: /* Call */
1312                     DPRINTF("Call 0x%08x\n", addr);
1313                     s->temp = s->dsp;
1314                     s->dsp = addr;
1315                     break;
1316                 case 2: /* Return */
1317                     DPRINTF("Return to 0x%08x\n", s->temp);
1318                     s->dsp = s->temp;
1319                     break;
1320                 case 3: /* Interrupt */
1321                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1322                     if ((insn & (1 << 20)) != 0) {
1323                         s->istat0 |= LSI_ISTAT0_INTF;
1324                         lsi_update_irq(s);
1325                     } else {
1326                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1327                     }
1328                     break;
1329                 default:
1330                     DPRINTF("Illegal transfer control\n");
1331                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1332                     break;
1333                 }
1334             } else {
1335                 DPRINTF("Control condition failed\n");
1336             }
1337         }
1338         break;
1339
1340     case 3:
1341         if ((insn & (1 << 29)) == 0) {
1342             /* Memory move.  */
1343             uint32_t dest;
1344             /* ??? The docs imply the destination address is loaded into
1345                the TEMP register.  However the Linux drivers rely on
1346                the value being presrved.  */
1347             dest = read_dword(s, s->dsp);
1348             s->dsp += 4;
1349             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1350         } else {
1351             uint8_t data[7];
1352             int reg;
1353             int n;
1354             int i;
1355
1356             if (insn & (1 << 28)) {
1357                 addr = s->dsa + sxt24(addr);
1358             }
1359             n = (insn & 7);
1360             reg = (insn >> 16) & 0xff;
1361             if (insn & (1 << 24)) {
1362                 cpu_physical_memory_read(addr, data, n);
1363                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1364                         addr, *(int *)data);
1365                 for (i = 0; i < n; i++) {
1366                     lsi_reg_writeb(s, reg + i, data[i]);
1367                 }
1368             } else {
1369                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1370                 for (i = 0; i < n; i++) {
1371                     data[i] = lsi_reg_readb(s, reg + i);
1372                 }
1373                 cpu_physical_memory_write(addr, data, n);
1374             }
1375         }
1376     }
1377     if (insn_processed > 10000 && !s->waiting) {
1378         /* Some windows drivers make the device spin waiting for a memory
1379            location to change.  If we have been executed a lot of code then
1380            assume this is the case and force an unexpected device disconnect.
1381            This is apparently sufficient to beat the drivers into submission.
1382          */
1383         if (!(s->sien0 & LSI_SIST0_UDC))
1384             fprintf(stderr, "inf. loop with UDC masked\n");
1385         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1386         lsi_disconnect(s);
1387     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1388         if (s->dcntl & LSI_DCNTL_SSM) {
1389             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1390         } else {
1391             goto again;
1392         }
1393     }
1394     DPRINTF("SCRIPTS execution stopped\n");
1395 }
1396
1397 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1398 {
1399     uint8_t tmp;
1400 #define CASE_GET_REG24(name, addr) \
1401     case addr: return s->name & 0xff; \
1402     case addr + 1: return (s->name >> 8) & 0xff; \
1403     case addr + 2: return (s->name >> 16) & 0xff;
1404
1405 #define CASE_GET_REG32(name, addr) \
1406     case addr: return s->name & 0xff; \
1407     case addr + 1: return (s->name >> 8) & 0xff; \
1408     case addr + 2: return (s->name >> 16) & 0xff; \
1409     case addr + 3: return (s->name >> 24) & 0xff;
1410
1411 #ifdef DEBUG_LSI_REG
1412     DPRINTF("Read reg %x\n", offset);
1413 #endif
1414     switch (offset) {
1415     case 0x00: /* SCNTL0 */
1416         return s->scntl0;
1417     case 0x01: /* SCNTL1 */
1418         return s->scntl1;
1419     case 0x02: /* SCNTL2 */
1420         return s->scntl2;
1421     case 0x03: /* SCNTL3 */
1422         return s->scntl3;
1423     case 0x04: /* SCID */
1424         return s->scid;
1425     case 0x05: /* SXFER */
1426         return s->sxfer;
1427     case 0x06: /* SDID */
1428         return s->sdid;
1429     case 0x07: /* GPREG0 */
1430         return 0x7f;
1431     case 0x08: /* Revision ID */
1432         return 0x00;
1433     case 0xa: /* SSID */
1434         return s->ssid;
1435     case 0xb: /* SBCL */
1436         /* ??? This is not correct. However it's (hopefully) only
1437            used for diagnostics, so should be ok.  */
1438         return 0;
1439     case 0xc: /* DSTAT */
1440         tmp = s->dstat | 0x80;
1441         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1442             s->dstat = 0;
1443         lsi_update_irq(s);
1444         return tmp;
1445     case 0x0d: /* SSTAT0 */
1446         return s->sstat0;
1447     case 0x0e: /* SSTAT1 */
1448         return s->sstat1;
1449     case 0x0f: /* SSTAT2 */
1450         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1451     CASE_GET_REG32(dsa, 0x10)
1452     case 0x14: /* ISTAT0 */
1453         return s->istat0;
1454     case 0x15: /* ISTAT1 */
1455         return s->istat1;
1456     case 0x16: /* MBOX0 */
1457         return s->mbox0;
1458     case 0x17: /* MBOX1 */
1459         return s->mbox1;
1460     case 0x18: /* CTEST0 */
1461         return 0xff;
1462     case 0x19: /* CTEST1 */
1463         return 0;
1464     case 0x1a: /* CTEST2 */
1465         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1466         if (s->istat0 & LSI_ISTAT0_SIGP) {
1467             s->istat0 &= ~LSI_ISTAT0_SIGP;
1468             tmp |= LSI_CTEST2_SIGP;
1469         }
1470         return tmp;
1471     case 0x1b: /* CTEST3 */
1472         return s->ctest3;
1473     CASE_GET_REG32(temp, 0x1c)
1474     case 0x20: /* DFIFO */
1475         return 0;
1476     case 0x21: /* CTEST4 */
1477         return s->ctest4;
1478     case 0x22: /* CTEST5 */
1479         return s->ctest5;
1480     case 0x23: /* CTEST6 */
1481          return 0;
1482     CASE_GET_REG24(dbc, 0x24)
1483     case 0x27: /* DCMD */
1484         return s->dcmd;
1485     CASE_GET_REG32(dnad, 0x28)
1486     CASE_GET_REG32(dsp, 0x2c)
1487     CASE_GET_REG32(dsps, 0x30)
1488     CASE_GET_REG32(scratch[0], 0x34)
1489     case 0x38: /* DMODE */
1490         return s->dmode;
1491     case 0x39: /* DIEN */
1492         return s->dien;
1493     case 0x3a: /* SBR */
1494         return s->sbr;
1495     case 0x3b: /* DCNTL */
1496         return s->dcntl;
1497     case 0x40: /* SIEN0 */
1498         return s->sien0;
1499     case 0x41: /* SIEN1 */
1500         return s->sien1;
1501     case 0x42: /* SIST0 */
1502         tmp = s->sist0;
1503         s->sist0 = 0;
1504         lsi_update_irq(s);
1505         return tmp;
1506     case 0x43: /* SIST1 */
1507         tmp = s->sist1;
1508         s->sist1 = 0;
1509         lsi_update_irq(s);
1510         return tmp;
1511     case 0x46: /* MACNTL */
1512         return 0x0f;
1513     case 0x47: /* GPCNTL0 */
1514         return 0x0f;
1515     case 0x48: /* STIME0 */
1516         return s->stime0;
1517     case 0x4a: /* RESPID0 */
1518         return s->respid0;
1519     case 0x4b: /* RESPID1 */
1520         return s->respid1;
1521     case 0x4d: /* STEST1 */
1522         return s->stest1;
1523     case 0x4e: /* STEST2 */
1524         return s->stest2;
1525     case 0x4f: /* STEST3 */
1526         return s->stest3;
1527     case 0x50: /* SIDL */
1528         /* This is needed by the linux drivers.  We currently only update it
1529            during the MSG IN phase.  */
1530         return s->sidl;
1531     case 0x52: /* STEST4 */
1532         return 0xe0;
1533     case 0x56: /* CCNTL0 */
1534         return s->ccntl0;
1535     case 0x57: /* CCNTL1 */
1536         return s->ccntl1;
1537     case 0x58: /* SBDL */
1538         /* Some drivers peek at the data bus during the MSG IN phase.  */
1539         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1540             return s->msg[0];
1541         return 0;
1542     case 0x59: /* SBDL high */
1543         return 0;
1544     CASE_GET_REG32(mmrs, 0xa0)
1545     CASE_GET_REG32(mmws, 0xa4)
1546     CASE_GET_REG32(sfs, 0xa8)
1547     CASE_GET_REG32(drs, 0xac)
1548     CASE_GET_REG32(sbms, 0xb0)
1549     CASE_GET_REG32(dbms, 0xb4)
1550     CASE_GET_REG32(dnad64, 0xb8)
1551     CASE_GET_REG32(pmjad1, 0xc0)
1552     CASE_GET_REG32(pmjad2, 0xc4)
1553     CASE_GET_REG32(rbc, 0xc8)
1554     CASE_GET_REG32(ua, 0xcc)
1555     CASE_GET_REG32(ia, 0xd4)
1556     CASE_GET_REG32(sbc, 0xd8)
1557     CASE_GET_REG32(csbc, 0xdc)
1558     }
1559     if (offset >= 0x5c && offset < 0xa0) {
1560         int n;
1561         int shift;
1562         n = (offset - 0x58) >> 2;
1563         shift = (offset & 3) * 8;
1564         return (s->scratch[n] >> shift) & 0xff;
1565     }
1566     BADF("readb 0x%x\n", offset);
1567     exit(1);
1568 #undef CASE_GET_REG24
1569 #undef CASE_GET_REG32
1570 }
1571
1572 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1573 {
1574 #define CASE_SET_REG24(name, addr) \
1575     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1576     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1577     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1578
1579 #define CASE_SET_REG32(name, addr) \
1580     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1581     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1582     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1583     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1584
1585 #ifdef DEBUG_LSI_REG
1586     DPRINTF("Write reg %x = %02x\n", offset, val);
1587 #endif
1588     switch (offset) {
1589     case 0x00: /* SCNTL0 */
1590         s->scntl0 = val;
1591         if (val & LSI_SCNTL0_START) {
1592             BADF("Start sequence not implemented\n");
1593         }
1594         break;
1595     case 0x01: /* SCNTL1 */
1596         s->scntl1 = val & ~LSI_SCNTL1_SST;
1597         if (val & LSI_SCNTL1_IARB) {
1598             BADF("Immediate Arbritration not implemented\n");
1599         }
1600         if (val & LSI_SCNTL1_RST) {
1601             if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1602                 DeviceState *dev;
1603                 int id;
1604
1605                 for (id = 0; id < s->bus.ndev; id++) {
1606                     if (s->bus.devs[id]) {
1607                         dev = &s->bus.devs[id]->qdev;
1608                         dev->info->reset(dev);
1609                     }
1610                 }
1611                 s->sstat0 |= LSI_SSTAT0_RST;
1612                 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1613             }
1614         } else {
1615             s->sstat0 &= ~LSI_SSTAT0_RST;
1616         }
1617         break;
1618     case 0x02: /* SCNTL2 */
1619         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1620         s->scntl2 = val;
1621         break;
1622     case 0x03: /* SCNTL3 */
1623         s->scntl3 = val;
1624         break;
1625     case 0x04: /* SCID */
1626         s->scid = val;
1627         break;
1628     case 0x05: /* SXFER */
1629         s->sxfer = val;
1630         break;
1631     case 0x06: /* SDID */
1632         if ((val & 0xf) != (s->ssid & 0xf))
1633             BADF("Destination ID does not match SSID\n");
1634         s->sdid = val & 0xf;
1635         break;
1636     case 0x07: /* GPREG0 */
1637         break;
1638     case 0x08: /* SFBR */
1639         /* The CPU is not allowed to write to this register.  However the
1640            SCRIPTS register move instructions are.  */
1641         s->sfbr = val;
1642         break;
1643     case 0x0a: case 0x0b:
1644         /* Openserver writes to these readonly registers on startup */
1645         return;
1646     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1647         /* Linux writes to these readonly registers on startup.  */
1648         return;
1649     CASE_SET_REG32(dsa, 0x10)
1650     case 0x14: /* ISTAT0 */
1651         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1652         if (val & LSI_ISTAT0_ABRT) {
1653             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1654         }
1655         if (val & LSI_ISTAT0_INTF) {
1656             s->istat0 &= ~LSI_ISTAT0_INTF;
1657             lsi_update_irq(s);
1658         }
1659         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1660             DPRINTF("Woken by SIGP\n");
1661             s->waiting = 0;
1662             s->dsp = s->dnad;
1663             lsi_execute_script(s);
1664         }
1665         if (val & LSI_ISTAT0_SRST) {
1666             lsi_soft_reset(s);
1667         }
1668         break;
1669     case 0x16: /* MBOX0 */
1670         s->mbox0 = val;
1671         break;
1672     case 0x17: /* MBOX1 */
1673         s->mbox1 = val;
1674         break;
1675     case 0x1a: /* CTEST2 */
1676         s->ctest2 = val & LSI_CTEST2_PCICIE;
1677         break;
1678     case 0x1b: /* CTEST3 */
1679         s->ctest3 = val & 0x0f;
1680         break;
1681     CASE_SET_REG32(temp, 0x1c)
1682     case 0x21: /* CTEST4 */
1683         if (val & 7) {
1684            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1685         }
1686         s->ctest4 = val;
1687         break;
1688     case 0x22: /* CTEST5 */
1689         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1690             BADF("CTEST5 DMA increment not implemented\n");
1691         }
1692         s->ctest5 = val;
1693         break;
1694     CASE_SET_REG24(dbc, 0x24)
1695     CASE_SET_REG32(dnad, 0x28)
1696     case 0x2c: /* DSP[0:7] */
1697         s->dsp &= 0xffffff00;
1698         s->dsp |= val;
1699         break;
1700     case 0x2d: /* DSP[8:15] */
1701         s->dsp &= 0xffff00ff;
1702         s->dsp |= val << 8;
1703         break;
1704     case 0x2e: /* DSP[16:23] */
1705         s->dsp &= 0xff00ffff;
1706         s->dsp |= val << 16;
1707         break;
1708     case 0x2f: /* DSP[24:31] */
1709         s->dsp &= 0x00ffffff;
1710         s->dsp |= val << 24;
1711         if ((s->dmode & LSI_DMODE_MAN) == 0
1712             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1713             lsi_execute_script(s);
1714         break;
1715     CASE_SET_REG32(dsps, 0x30)
1716     CASE_SET_REG32(scratch[0], 0x34)
1717     case 0x38: /* DMODE */
1718         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1719             BADF("IO mappings not implemented\n");
1720         }
1721         s->dmode = val;
1722         break;
1723     case 0x39: /* DIEN */
1724         s->dien = val;
1725         lsi_update_irq(s);
1726         break;
1727     case 0x3a: /* SBR */
1728         s->sbr = val;
1729         break;
1730     case 0x3b: /* DCNTL */
1731         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1732         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1733             lsi_execute_script(s);
1734         break;
1735     case 0x40: /* SIEN0 */
1736         s->sien0 = val;
1737         lsi_update_irq(s);
1738         break;
1739     case 0x41: /* SIEN1 */
1740         s->sien1 = val;
1741         lsi_update_irq(s);
1742         break;
1743     case 0x47: /* GPCNTL0 */
1744         break;
1745     case 0x48: /* STIME0 */
1746         s->stime0 = val;
1747         break;
1748     case 0x49: /* STIME1 */
1749         if (val & 0xf) {
1750             DPRINTF("General purpose timer not implemented\n");
1751             /* ??? Raising the interrupt immediately seems to be sufficient
1752                to keep the FreeBSD driver happy.  */
1753             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1754         }
1755         break;
1756     case 0x4a: /* RESPID0 */
1757         s->respid0 = val;
1758         break;
1759     case 0x4b: /* RESPID1 */
1760         s->respid1 = val;
1761         break;
1762     case 0x4d: /* STEST1 */
1763         s->stest1 = val;
1764         break;
1765     case 0x4e: /* STEST2 */
1766         if (val & 1) {
1767             BADF("Low level mode not implemented\n");
1768         }
1769         s->stest2 = val;
1770         break;
1771     case 0x4f: /* STEST3 */
1772         if (val & 0x41) {
1773             BADF("SCSI FIFO test mode not implemented\n");
1774         }
1775         s->stest3 = val;
1776         break;
1777     case 0x56: /* CCNTL0 */
1778         s->ccntl0 = val;
1779         break;
1780     case 0x57: /* CCNTL1 */
1781         s->ccntl1 = val;
1782         break;
1783     CASE_SET_REG32(mmrs, 0xa0)
1784     CASE_SET_REG32(mmws, 0xa4)
1785     CASE_SET_REG32(sfs, 0xa8)
1786     CASE_SET_REG32(drs, 0xac)
1787     CASE_SET_REG32(sbms, 0xb0)
1788     CASE_SET_REG32(dbms, 0xb4)
1789     CASE_SET_REG32(dnad64, 0xb8)
1790     CASE_SET_REG32(pmjad1, 0xc0)
1791     CASE_SET_REG32(pmjad2, 0xc4)
1792     CASE_SET_REG32(rbc, 0xc8)
1793     CASE_SET_REG32(ua, 0xcc)
1794     CASE_SET_REG32(ia, 0xd4)
1795     CASE_SET_REG32(sbc, 0xd8)
1796     CASE_SET_REG32(csbc, 0xdc)
1797     default:
1798         if (offset >= 0x5c && offset < 0xa0) {
1799             int n;
1800             int shift;
1801             n = (offset - 0x58) >> 2;
1802             shift = (offset & 3) * 8;
1803             s->scratch[n] &= ~(0xff << shift);
1804             s->scratch[n] |= (val & 0xff) << shift;
1805         } else {
1806             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1807         }
1808     }
1809 #undef CASE_SET_REG24
1810 #undef CASE_SET_REG32
1811 }
1812
1813 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1814 {
1815     LSIState *s = opaque;
1816
1817     lsi_reg_writeb(s, addr & 0xff, val);
1818 }
1819
1820 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1821 {
1822     LSIState *s = opaque;
1823
1824     addr &= 0xff;
1825     lsi_reg_writeb(s, addr, val & 0xff);
1826     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1827 }
1828
1829 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1830 {
1831     LSIState *s = opaque;
1832
1833     addr &= 0xff;
1834     lsi_reg_writeb(s, addr, val & 0xff);
1835     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1836     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1837     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1838 }
1839
1840 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1841 {
1842     LSIState *s = opaque;
1843
1844     return lsi_reg_readb(s, addr & 0xff);
1845 }
1846
1847 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1848 {
1849     LSIState *s = opaque;
1850     uint32_t val;
1851
1852     addr &= 0xff;
1853     val = lsi_reg_readb(s, addr);
1854     val |= lsi_reg_readb(s, addr + 1) << 8;
1855     return val;
1856 }
1857
1858 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1859 {
1860     LSIState *s = opaque;
1861     uint32_t val;
1862     addr &= 0xff;
1863     val = lsi_reg_readb(s, addr);
1864     val |= lsi_reg_readb(s, addr + 1) << 8;
1865     val |= lsi_reg_readb(s, addr + 2) << 16;
1866     val |= lsi_reg_readb(s, addr + 3) << 24;
1867     return val;
1868 }
1869
1870 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1871     lsi_mmio_readb,
1872     lsi_mmio_readw,
1873     lsi_mmio_readl,
1874 };
1875
1876 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1877     lsi_mmio_writeb,
1878     lsi_mmio_writew,
1879     lsi_mmio_writel,
1880 };
1881
1882 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1883 {
1884     LSIState *s = opaque;
1885     uint32_t newval;
1886     int shift;
1887
1888     addr &= 0x1fff;
1889     newval = s->script_ram[addr >> 2];
1890     shift = (addr & 3) * 8;
1891     newval &= ~(0xff << shift);
1892     newval |= val << shift;
1893     s->script_ram[addr >> 2] = newval;
1894 }
1895
1896 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1897 {
1898     LSIState *s = opaque;
1899     uint32_t newval;
1900
1901     addr &= 0x1fff;
1902     newval = s->script_ram[addr >> 2];
1903     if (addr & 2) {
1904         newval = (newval & 0xffff) | (val << 16);
1905     } else {
1906         newval = (newval & 0xffff0000) | val;
1907     }
1908     s->script_ram[addr >> 2] = newval;
1909 }
1910
1911
1912 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1913 {
1914     LSIState *s = opaque;
1915
1916     addr &= 0x1fff;
1917     s->script_ram[addr >> 2] = val;
1918 }
1919
1920 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1921 {
1922     LSIState *s = opaque;
1923     uint32_t val;
1924
1925     addr &= 0x1fff;
1926     val = s->script_ram[addr >> 2];
1927     val >>= (addr & 3) * 8;
1928     return val & 0xff;
1929 }
1930
1931 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1932 {
1933     LSIState *s = opaque;
1934     uint32_t val;
1935
1936     addr &= 0x1fff;
1937     val = s->script_ram[addr >> 2];
1938     if (addr & 2)
1939         val >>= 16;
1940     return val;
1941 }
1942
1943 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1944 {
1945     LSIState *s = opaque;
1946
1947     addr &= 0x1fff;
1948     return s->script_ram[addr >> 2];
1949 }
1950
1951 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1952     lsi_ram_readb,
1953     lsi_ram_readw,
1954     lsi_ram_readl,
1955 };
1956
1957 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1958     lsi_ram_writeb,
1959     lsi_ram_writew,
1960     lsi_ram_writel,
1961 };
1962
1963 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1964 {
1965     LSIState *s = opaque;
1966     return lsi_reg_readb(s, addr & 0xff);
1967 }
1968
1969 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1970 {
1971     LSIState *s = opaque;
1972     uint32_t val;
1973     addr &= 0xff;
1974     val = lsi_reg_readb(s, addr);
1975     val |= lsi_reg_readb(s, addr + 1) << 8;
1976     return val;
1977 }
1978
1979 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1980 {
1981     LSIState *s = opaque;
1982     uint32_t val;
1983     addr &= 0xff;
1984     val = lsi_reg_readb(s, addr);
1985     val |= lsi_reg_readb(s, addr + 1) << 8;
1986     val |= lsi_reg_readb(s, addr + 2) << 16;
1987     val |= lsi_reg_readb(s, addr + 3) << 24;
1988     return val;
1989 }
1990
1991 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1992 {
1993     LSIState *s = opaque;
1994     lsi_reg_writeb(s, addr & 0xff, val);
1995 }
1996
1997 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1998 {
1999     LSIState *s = opaque;
2000     addr &= 0xff;
2001     lsi_reg_writeb(s, addr, val & 0xff);
2002     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2003 }
2004
2005 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
2006 {
2007     LSIState *s = opaque;
2008     addr &= 0xff;
2009     lsi_reg_writeb(s, addr, val & 0xff);
2010     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
2011     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
2012     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
2013 }
2014
2015 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
2016                            pcibus_t addr, pcibus_t size, int type)
2017 {
2018     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2019
2020     DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
2021
2022     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
2023     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
2024     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
2025     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
2026     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
2027     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
2028 }
2029
2030 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
2031                             pcibus_t addr, pcibus_t size, int type)
2032 {
2033     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2034
2035     DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
2036     s->script_ram_base = addr;
2037     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
2038 }
2039
2040 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
2041                              pcibus_t addr, pcibus_t size, int type)
2042 {
2043     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2044
2045     DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
2046     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
2047 }
2048
2049 static void lsi_scsi_reset(DeviceState *dev)
2050 {
2051     LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
2052
2053     lsi_soft_reset(s);
2054 }
2055
2056 static void lsi_pre_save(void *opaque)
2057 {
2058     LSIState *s = opaque;
2059
2060     if (s->current) {
2061         assert(s->current->dma_buf == NULL);
2062         assert(s->current->dma_len == 0);
2063     }
2064     assert(QTAILQ_EMPTY(&s->queue));
2065 }
2066
2067 static const VMStateDescription vmstate_lsi_scsi = {
2068     .name = "lsiscsi",
2069     .version_id = 0,
2070     .minimum_version_id = 0,
2071     .minimum_version_id_old = 0,
2072     .pre_save = lsi_pre_save,
2073     .fields      = (VMStateField []) {
2074         VMSTATE_PCI_DEVICE(dev, LSIState),
2075
2076         VMSTATE_INT32(carry, LSIState),
2077         VMSTATE_INT32(sense, LSIState),
2078         VMSTATE_INT32(msg_action, LSIState),
2079         VMSTATE_INT32(msg_len, LSIState),
2080         VMSTATE_BUFFER(msg, LSIState),
2081         VMSTATE_INT32(waiting, LSIState),
2082
2083         VMSTATE_UINT32(dsa, LSIState),
2084         VMSTATE_UINT32(temp, LSIState),
2085         VMSTATE_UINT32(dnad, LSIState),
2086         VMSTATE_UINT32(dbc, LSIState),
2087         VMSTATE_UINT8(istat0, LSIState),
2088         VMSTATE_UINT8(istat1, LSIState),
2089         VMSTATE_UINT8(dcmd, LSIState),
2090         VMSTATE_UINT8(dstat, LSIState),
2091         VMSTATE_UINT8(dien, LSIState),
2092         VMSTATE_UINT8(sist0, LSIState),
2093         VMSTATE_UINT8(sist1, LSIState),
2094         VMSTATE_UINT8(sien0, LSIState),
2095         VMSTATE_UINT8(sien1, LSIState),
2096         VMSTATE_UINT8(mbox0, LSIState),
2097         VMSTATE_UINT8(mbox1, LSIState),
2098         VMSTATE_UINT8(dfifo, LSIState),
2099         VMSTATE_UINT8(ctest2, LSIState),
2100         VMSTATE_UINT8(ctest3, LSIState),
2101         VMSTATE_UINT8(ctest4, LSIState),
2102         VMSTATE_UINT8(ctest5, LSIState),
2103         VMSTATE_UINT8(ccntl0, LSIState),
2104         VMSTATE_UINT8(ccntl1, LSIState),
2105         VMSTATE_UINT32(dsp, LSIState),
2106         VMSTATE_UINT32(dsps, LSIState),
2107         VMSTATE_UINT8(dmode, LSIState),
2108         VMSTATE_UINT8(dcntl, LSIState),
2109         VMSTATE_UINT8(scntl0, LSIState),
2110         VMSTATE_UINT8(scntl1, LSIState),
2111         VMSTATE_UINT8(scntl2, LSIState),
2112         VMSTATE_UINT8(scntl3, LSIState),
2113         VMSTATE_UINT8(sstat0, LSIState),
2114         VMSTATE_UINT8(sstat1, LSIState),
2115         VMSTATE_UINT8(scid, LSIState),
2116         VMSTATE_UINT8(sxfer, LSIState),
2117         VMSTATE_UINT8(socl, LSIState),
2118         VMSTATE_UINT8(sdid, LSIState),
2119         VMSTATE_UINT8(ssid, LSIState),
2120         VMSTATE_UINT8(sfbr, LSIState),
2121         VMSTATE_UINT8(stest1, LSIState),
2122         VMSTATE_UINT8(stest2, LSIState),
2123         VMSTATE_UINT8(stest3, LSIState),
2124         VMSTATE_UINT8(sidl, LSIState),
2125         VMSTATE_UINT8(stime0, LSIState),
2126         VMSTATE_UINT8(respid0, LSIState),
2127         VMSTATE_UINT8(respid1, LSIState),
2128         VMSTATE_UINT32(mmrs, LSIState),
2129         VMSTATE_UINT32(mmws, LSIState),
2130         VMSTATE_UINT32(sfs, LSIState),
2131         VMSTATE_UINT32(drs, LSIState),
2132         VMSTATE_UINT32(sbms, LSIState),
2133         VMSTATE_UINT32(dbms, LSIState),
2134         VMSTATE_UINT32(dnad64, LSIState),
2135         VMSTATE_UINT32(pmjad1, LSIState),
2136         VMSTATE_UINT32(pmjad2, LSIState),
2137         VMSTATE_UINT32(rbc, LSIState),
2138         VMSTATE_UINT32(ua, LSIState),
2139         VMSTATE_UINT32(ia, LSIState),
2140         VMSTATE_UINT32(sbc, LSIState),
2141         VMSTATE_UINT32(csbc, LSIState),
2142         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2143         VMSTATE_UINT8(sbr, LSIState),
2144
2145         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2146         VMSTATE_END_OF_LIST()
2147     }
2148 };
2149
2150 static int lsi_scsi_uninit(PCIDevice *d)
2151 {
2152     LSIState *s = DO_UPCAST(LSIState, dev, d);
2153
2154     cpu_unregister_io_memory(s->mmio_io_addr);
2155     cpu_unregister_io_memory(s->ram_io_addr);
2156
2157     return 0;
2158 }
2159
2160 static int lsi_scsi_init(PCIDevice *dev)
2161 {
2162     LSIState *s = DO_UPCAST(LSIState, dev, dev);
2163     uint8_t *pci_conf;
2164
2165     pci_conf = s->dev.config;
2166
2167     /* PCI Vendor ID (word) */
2168     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2169     /* PCI device ID (word) */
2170     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2171     /* PCI base class code */
2172     pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2173     /* PCI subsystem ID */
2174     pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2175     pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
2176     /* PCI latency timer = 255 */
2177     pci_conf[PCI_LATENCY_TIMER] = 0xff;
2178     /* TODO: RST# value should be 0 */
2179     /* Interrupt pin 1 */
2180     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2181
2182     s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2183                                              lsi_mmio_writefn, s,
2184                                              DEVICE_NATIVE_ENDIAN);
2185     s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2186                                             lsi_ram_writefn, s,
2187                                             DEVICE_NATIVE_ENDIAN);
2188
2189     pci_register_bar(&s->dev, 0, 256,
2190                            PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2191     pci_register_bar(&s->dev, 1, 0x400,
2192                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2193     pci_register_bar(&s->dev, 2, 0x2000,
2194                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2195     QTAILQ_INIT(&s->queue);
2196
2197     scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2198     if (!dev->qdev.hotplugged) {
2199         return scsi_bus_legacy_handle_cmdline(&s->bus);
2200     }
2201     return 0;
2202 }
2203
2204 static PCIDeviceInfo lsi_info = {
2205     .qdev.name  = "lsi53c895a",
2206     .qdev.alias = "lsi",
2207     .qdev.size  = sizeof(LSIState),
2208     .qdev.reset = lsi_scsi_reset,
2209     .qdev.vmsd  = &vmstate_lsi_scsi,
2210     .init       = lsi_scsi_init,
2211     .exit       = lsi_scsi_uninit,
2212 };
2213
2214 static void lsi53c895a_register_devices(void)
2215 {
2216     pci_qdev_register(&lsi_info);
2217 }
2218
2219 device_init(lsi53c895a_register_devices);