hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include <assert.h>
  14
  15 #include "hw.h"
  16 #include "pci.h"
  17 #include "scsi.h"
  18 #include "block_int.h"
  19
  20 //#define DEBUG_LSI
  21 //#define DEBUG_LSI_REG
  22
  23 #ifdef DEBUG_LSI
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
  26 #define BADF(fmt, ...) \
  27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
  28 #else
  29 #define DPRINTF(fmt, ...) do {} while(0)
  30 #define BADF(fmt, ...) \
  31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
  32 #endif
  33
  34 #define LSI_MAX_DEVS 7
  35
  36 #define LSI_SCNTL0_TRG    0x01
  37 #define LSI_SCNTL0_AAP    0x02
  38 #define LSI_SCNTL0_EPC    0x08
  39 #define LSI_SCNTL0_WATN   0x10
  40 #define LSI_SCNTL0_START  0x20
  41
  42 #define LSI_SCNTL1_SST    0x01
  43 #define LSI_SCNTL1_IARB   0x02
  44 #define LSI_SCNTL1_AESP   0x04
  45 #define LSI_SCNTL1_RST    0x08
  46 #define LSI_SCNTL1_CON    0x10
  47 #define LSI_SCNTL1_DHP    0x20
  48 #define LSI_SCNTL1_ADB    0x40
  49 #define LSI_SCNTL1_EXC    0x80
  50
  51 #define LSI_SCNTL2_WSR    0x01
  52 #define LSI_SCNTL2_VUE0   0x02
  53 #define LSI_SCNTL2_VUE1   0x04
  54 #define LSI_SCNTL2_WSS    0x08
  55 #define LSI_SCNTL2_SLPHBEN 0x10
  56 #define LSI_SCNTL2_SLPMD  0x20
  57 #define LSI_SCNTL2_CHM    0x40
  58 #define LSI_SCNTL2_SDU    0x80
  59
  60 #define LSI_ISTAT0_DIP    0x01
  61 #define LSI_ISTAT0_SIP    0x02
  62 #define LSI_ISTAT0_INTF   0x04
  63 #define LSI_ISTAT0_CON    0x08
  64 #define LSI_ISTAT0_SEM    0x10
  65 #define LSI_ISTAT0_SIGP   0x20
  66 #define LSI_ISTAT0_SRST   0x40
  67 #define LSI_ISTAT0_ABRT   0x80
  68
  69 #define LSI_ISTAT1_SI     0x01
  70 #define LSI_ISTAT1_SRUN   0x02
  71 #define LSI_ISTAT1_FLSH   0x04
  72
  73 #define LSI_SSTAT0_SDP0   0x01
  74 #define LSI_SSTAT0_RST    0x02
  75 #define LSI_SSTAT0_WOA    0x04
  76 #define LSI_SSTAT0_LOA    0x08
  77 #define LSI_SSTAT0_AIP    0x10
  78 #define LSI_SSTAT0_OLF    0x20
  79 #define LSI_SSTAT0_ORF    0x40
  80 #define LSI_SSTAT0_ILF    0x80
  81
  82 #define LSI_SIST0_PAR     0x01
  83 #define LSI_SIST0_RST     0x02
  84 #define LSI_SIST0_UDC     0x04
  85 #define LSI_SIST0_SGE     0x08
  86 #define LSI_SIST0_RSL     0x10
  87 #define LSI_SIST0_SEL     0x20
  88 #define LSI_SIST0_CMP     0x40
  89 #define LSI_SIST0_MA      0x80
  90
  91 #define LSI_SIST1_HTH     0x01
  92 #define LSI_SIST1_GEN     0x02
  93 #define LSI_SIST1_STO     0x04
  94 #define LSI_SIST1_SBMC    0x10
  95
  96 #define LSI_SOCL_IO       0x01
  97 #define LSI_SOCL_CD       0x02
  98 #define LSI_SOCL_MSG      0x04
  99 #define LSI_SOCL_ATN      0x08
 100 #define LSI_SOCL_SEL      0x10
 101 #define LSI_SOCL_BSY      0x20
 102 #define LSI_SOCL_ACK      0x40
 103 #define LSI_SOCL_REQ      0x80
 104
 105 #define LSI_DSTAT_IID     0x01
 106 #define LSI_DSTAT_SIR     0x04
 107 #define LSI_DSTAT_SSI     0x08
 108 #define LSI_DSTAT_ABRT    0x10
 109 #define LSI_DSTAT_BF      0x20
 110 #define LSI_DSTAT_MDPE    0x40
 111 #define LSI_DSTAT_DFE     0x80
 112
 113 #define LSI_DCNTL_COM     0x01
 114 #define LSI_DCNTL_IRQD    0x02
 115 #define LSI_DCNTL_STD     0x04
 116 #define LSI_DCNTL_IRQM    0x08
 117 #define LSI_DCNTL_SSM     0x10
 118 #define LSI_DCNTL_PFEN    0x20
 119 #define LSI_DCNTL_PFF     0x40
 120 #define LSI_DCNTL_CLSE    0x80
 121
 122 #define LSI_DMODE_MAN     0x01
 123 #define LSI_DMODE_BOF     0x02
 124 #define LSI_DMODE_ERMP    0x04
 125 #define LSI_DMODE_ERL     0x08
 126 #define LSI_DMODE_DIOM    0x10
 127 #define LSI_DMODE_SIOM    0x20
 128
 129 #define LSI_CTEST2_DACK   0x01
 130 #define LSI_CTEST2_DREQ   0x02
 131 #define LSI_CTEST2_TEOP   0x04
 132 #define LSI_CTEST2_PCICIE 0x08
 133 #define LSI_CTEST2_CM     0x10
 134 #define LSI_CTEST2_CIO    0x20
 135 #define LSI_CTEST2_SIGP   0x40
 136 #define LSI_CTEST2_DDIR   0x80
 137
 138 #define LSI_CTEST5_BL2    0x04
 139 #define LSI_CTEST5_DDIR   0x08
 140 #define LSI_CTEST5_MASR   0x10
 141 #define LSI_CTEST5_DFSN   0x20
 142 #define LSI_CTEST5_BBCK   0x40
 143 #define LSI_CTEST5_ADCK   0x80
 144
 145 #define LSI_CCNTL0_DILS   0x01
 146 #define LSI_CCNTL0_DISFC  0x10
 147 #define LSI_CCNTL0_ENNDJ  0x20
 148 #define LSI_CCNTL0_PMJCTL 0x40
 149 #define LSI_CCNTL0_ENPMJ  0x80
 150
 151 #define LSI_CCNTL1_EN64DBMV  0x01
 152 #define LSI_CCNTL1_EN64TIBMV 0x02
 153 #define LSI_CCNTL1_64TIMOD   0x04
 154 #define LSI_CCNTL1_DDAC      0x08
 155 #define LSI_CCNTL1_ZMOD      0x80
 156
 157 /* Enable Response to Reselection */
 158 #define LSI_SCID_RRE      0x60
 159
 160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 161
 162 #define PHASE_DO          0
 163 #define PHASE_DI          1
 164 #define PHASE_CMD         2
 165 #define PHASE_ST          3
 166 #define PHASE_MO          6
 167 #define PHASE_MI          7
 168 #define PHASE_MASK        7
 169
 170 /* Maximum length of MSG IN data.  */
 171 #define LSI_MAX_MSGIN_LEN 8
 172
 173 /* Flag set if this is a tagged command.  */
 174 #define LSI_TAG_VALID     (1 << 16)
 175
 176 typedef struct lsi_request {
 177     uint32_t tag;
 178     SCSIDevice *dev;
 179     uint32_t dma_len;
 180     uint8_t *dma_buf;
 181     uint32_t pending;
 182     int out;
 183     QTAILQ_ENTRY(lsi_request) next;
 184 } lsi_request;
 185
 186 typedef struct {
 187     PCIDevice dev;
 188     int mmio_io_addr;
 189     int ram_io_addr;
 190     uint32_t script_ram_base;
 191
 192     int carry; /* ??? Should this be an a visible register somewhere?  */
 193     int sense;
 194     /* Action to take at the end of a MSG IN phase.
 195        0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN.  */
 196     int msg_action;
 197     int msg_len;
 198     uint8_t msg[LSI_MAX_MSGIN_LEN];
 199     /* 0 if SCRIPTS are running or stopped.
 200      * 1 if a Wait Reselect instruction has been issued.
 201      * 2 if processing DMA from lsi_execute_script.
 202      * 3 if a DMA operation is in progress.  */
 203     int waiting;
 204     SCSIBus bus;
 205     SCSIDevice *select_dev;
 206     int current_lun;
 207     /* The tag is a combination of the device ID and the SCSI tag.  */
 208     uint32_t select_tag;
 209     int command_complete;
 210     QTAILQ_HEAD(, lsi_request) queue;
 211     lsi_request *current;
 212
 213     uint32_t dsa;
 214     uint32_t temp;
 215     uint32_t dnad;
 216     uint32_t dbc;
 217     uint8_t istat0;
 218     uint8_t istat1;
 219     uint8_t dcmd;
 220     uint8_t dstat;
 221     uint8_t dien;
 222     uint8_t sist0;
 223     uint8_t sist1;
 224     uint8_t sien0;
 225     uint8_t sien1;
 226     uint8_t mbox0;
 227     uint8_t mbox1;
 228     uint8_t dfifo;
 229     uint8_t ctest2;
 230     uint8_t ctest3;
 231     uint8_t ctest4;
 232     uint8_t ctest5;
 233     uint8_t ccntl0;
 234     uint8_t ccntl1;
 235     uint32_t dsp;
 236     uint32_t dsps;
 237     uint8_t dmode;
 238     uint8_t dcntl;
 239     uint8_t scntl0;
 240     uint8_t scntl1;
 241     uint8_t scntl2;
 242     uint8_t scntl3;
 243     uint8_t sstat0;
 244     uint8_t sstat1;
 245     uint8_t scid;
 246     uint8_t sxfer;
 247     uint8_t socl;
 248     uint8_t sdid;
 249     uint8_t ssid;
 250     uint8_t sfbr;
 251     uint8_t stest1;
 252     uint8_t stest2;
 253     uint8_t stest3;
 254     uint8_t sidl;
 255     uint8_t stime0;
 256     uint8_t respid0;
 257     uint8_t respid1;
 258     uint32_t mmrs;
 259     uint32_t mmws;
 260     uint32_t sfs;
 261     uint32_t drs;
 262     uint32_t sbms;
 263     uint32_t dbms;
 264     uint32_t dnad64;
 265     uint32_t pmjad1;
 266     uint32_t pmjad2;
 267     uint32_t rbc;
 268     uint32_t ua;
 269     uint32_t ia;
 270     uint32_t sbc;
 271     uint32_t csbc;
 272     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 273     uint8_t sbr;
 274
 275     /* Script ram is stored as 32-bit words in host byteorder.  */
 276     uint32_t script_ram[2048];
 277 } LSIState;
 278
 279 static inline int lsi_irq_on_rsl(LSIState *s)
 280 {
 281     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
 282 }
 283
 284 static void lsi_soft_reset(LSIState *s)
 285 {
 286     lsi_request *p;
 287
 288     DPRINTF("Reset\n");
 289     s->carry = 0;
 290
 291     s->waiting = 0;
 292     s->dsa = 0;
 293     s->dnad = 0;
 294     s->dbc = 0;
 295     s->temp = 0;
 296     memset(s->scratch, 0, sizeof(s->scratch));
 297     s->istat0 = 0;
 298     s->istat1 = 0;
 299     s->dcmd = 0;
 300     s->dstat = 0;
 301     s->dien = 0;
 302     s->sist0 = 0;
 303     s->sist1 = 0;
 304     s->sien0 = 0;
 305     s->sien1 = 0;
 306     s->mbox0 = 0;
 307     s->mbox1 = 0;
 308     s->dfifo = 0;
 309     s->ctest2 = 0;
 310     s->ctest3 = 0;
 311     s->ctest4 = 0;
 312     s->ctest5 = 0;
 313     s->ccntl0 = 0;
 314     s->ccntl1 = 0;
 315     s->dsp = 0;
 316     s->dsps = 0;
 317     s->dmode = 0;
 318     s->dcntl = 0;
 319     s->scntl0 = 0xc0;
 320     s->scntl1 = 0;
 321     s->scntl2 = 0;
 322     s->scntl3 = 0;
 323     s->sstat0 = 0;
 324     s->sstat1 = 0;
 325     s->scid = 7;
 326     s->sxfer = 0;
 327     s->socl = 0;
 328     s->stest1 = 0;
 329     s->stest2 = 0;
 330     s->stest3 = 0;
 331     s->sidl = 0;
 332     s->stime0 = 0;
 333     s->respid0 = 0x80;
 334     s->respid1 = 0;
 335     s->mmrs = 0;
 336     s->mmws = 0;
 337     s->sfs = 0;
 338     s->drs = 0;
 339     s->sbms = 0;
 340     s->dbms = 0;
 341     s->dnad64 = 0;
 342     s->pmjad1 = 0;
 343     s->pmjad2 = 0;
 344     s->rbc = 0;
 345     s->ua = 0;
 346     s->ia = 0;
 347     s->sbc = 0;
 348     s->csbc = 0;
 349     s->sbr = 0;
 350     while (!QTAILQ_EMPTY(&s->queue)) {
 351         p = QTAILQ_FIRST(&s->queue);
 352         QTAILQ_REMOVE(&s->queue, p, next);
 353         qemu_free(p);
 354     }
 355     if (s->current) {
 356         qemu_free(s->current);
 357         s->current = NULL;
 358     }
 359 }
 360
 361 static int lsi_dma_40bit(LSIState *s)
 362 {
 363     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 364         return 1;
 365     return 0;
 366 }
 367
 368 static int lsi_dma_ti64bit(LSIState *s)
 369 {
 370     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 371         return 1;
 372     return 0;
 373 }
 374
 375 static int lsi_dma_64bit(LSIState *s)
 376 {
 377     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 378         return 1;
 379     return 0;
 380 }
 381
 382 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 383 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 384 static void lsi_execute_script(LSIState *s);
 385 static void lsi_reselect(LSIState *s, lsi_request *p);
 386
 387 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 388 {
 389     uint32_t buf;
 390
 391     /* Optimize reading from SCRIPTS RAM.  */
 392     if ((addr & 0xffffe000) == s->script_ram_base) {
 393         return s->script_ram[(addr & 0x1fff) >> 2];
 394     }
 395     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 396     return cpu_to_le32(buf);
 397 }
 398
 399 static void lsi_stop_script(LSIState *s)
 400 {
 401     s->istat1 &= ~LSI_ISTAT1_SRUN;
 402 }
 403
 404 static void lsi_update_irq(LSIState *s)
 405 {
 406     int level;
 407     static int last_level;
 408     lsi_request *p;
 409
 410     /* It's unclear whether the DIP/SIP bits should be cleared when the
 411        Interrupt Status Registers are cleared or when istat0 is read.
 412        We currently do the formwer, which seems to work.  */
 413     level = 0;
 414     if (s->dstat) {
 415         if (s->dstat & s->dien)
 416             level = 1;
 417         s->istat0 |= LSI_ISTAT0_DIP;
 418     } else {
 419         s->istat0 &= ~LSI_ISTAT0_DIP;
 420     }
 421
 422     if (s->sist0 || s->sist1) {
 423         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 424             level = 1;
 425         s->istat0 |= LSI_ISTAT0_SIP;
 426     } else {
 427         s->istat0 &= ~LSI_ISTAT0_SIP;
 428     }
 429     if (s->istat0 & LSI_ISTAT0_INTF)
 430         level = 1;
 431
 432     if (level != last_level) {
 433         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 434                 level, s->dstat, s->sist1, s->sist0);
 435         last_level = level;
 436     }
 437     qemu_set_irq(s->dev.irq[0], level);
 438
 439     if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
 440         DPRINTF("Handled IRQs & disconnected, looking for pending "
 441                 "processes\n");
 442         QTAILQ_FOREACH(p, &s->queue, next) {
 443             if (p->pending) {
 444                 lsi_reselect(s, p);
 445                 break;
 446             }
 447         }
 448     }
 449 }
 450
 451 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 452 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 453 {
 454     uint32_t mask0;
 455     uint32_t mask1;
 456
 457     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 458             stat1, stat0, s->sist1, s->sist0);
 459     s->sist0 |= stat0;
 460     s->sist1 |= stat1;
 461     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 462        we don't stop processing when raising STO.  Instead continue
 463        execution and stop at the next insn that accesses the SCSI bus.  */
 464     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 465     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 466     mask1 &= ~LSI_SIST1_STO;
 467     if (s->sist0 & mask0 || s->sist1 & mask1) {
 468         lsi_stop_script(s);
 469     }
 470     lsi_update_irq(s);
 471 }
 472
 473 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 474 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 475 {
 476     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 477     s->dstat |= stat;
 478     lsi_update_irq(s);
 479     lsi_stop_script(s);
 480 }
 481
 482 static inline void lsi_set_phase(LSIState *s, int phase)
 483 {
 484     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 485 }
 486
 487 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 488 {
 489     /* Trigger a phase mismatch.  */
 490     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 491         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 492             s->dsp = s->pmjad1;
 493         } else {
 494             s->dsp = s->pmjad2;
 495         }
 496         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 497     } else {
 498         DPRINTF("Phase mismatch interrupt\n");
 499         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 500         lsi_stop_script(s);
 501     }
 502     lsi_set_phase(s, new_phase);
 503 }
 504
 505
 506 /* Resume SCRIPTS execution after a DMA operation.  */
 507 static void lsi_resume_script(LSIState *s)
 508 {
 509     if (s->waiting != 2) {
 510         s->waiting = 0;
 511         lsi_execute_script(s);
 512     } else {
 513         s->waiting = 0;
 514     }
 515 }
 516
 517 /* Initiate a SCSI layer data transfer.  */
 518 static void lsi_do_dma(LSIState *s, int out)
 519 {
 520     uint32_t count;
 521     target_phys_addr_t addr;
 522
 523     assert(s->current);
 524     if (!s->current->dma_len) {
 525         /* Wait until data is available.  */
 526         DPRINTF("DMA no data available\n");
 527         return;
 528     }
 529
 530     count = s->dbc;
 531     if (count > s->current->dma_len)
 532         count = s->current->dma_len;
 533
 534     addr = s->dnad;
 535     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 536     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 537         addr |= ((uint64_t)s->dnad64 << 32);
 538     else if (s->dbms)
 539         addr |= ((uint64_t)s->dbms << 32);
 540     else if (s->sbms)
 541         addr |= ((uint64_t)s->sbms << 32);
 542
 543     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 544     s->csbc += count;
 545     s->dnad += count;
 546     s->dbc -= count;
 547
 548     if (s->current->dma_buf == NULL) {
 549         s->current->dma_buf = s->current->dev->info->get_buf(s->current->dev,
 550                                                              s->current->tag);
 551     }
 552
 553     /* ??? Set SFBR to first data byte.  */
 554     if (out) {
 555         cpu_physical_memory_read(addr, s->current->dma_buf, count);
 556     } else {
 557         cpu_physical_memory_write(addr, s->current->dma_buf, count);
 558     }
 559     s->current->dma_len -= count;
 560     if (s->current->dma_len == 0) {
 561         s->current->dma_buf = NULL;
 562         if (out) {
 563             /* Write the data.  */
 564             s->current->dev->info->write_data(s->current->dev, s->current->tag);
 565         } else {
 566             /* Request any remaining data.  */
 567             s->current->dev->info->read_data(s->current->dev, s->current->tag);
 568         }
 569     } else {
 570         s->current->dma_buf += count;
 571         lsi_resume_script(s);
 572     }
 573 }
 574
 575
 576 /* Add a command to the queue.  */
 577 static void lsi_queue_command(LSIState *s)
 578 {
 579     lsi_request *p = s->current;
 580
 581     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 582     assert(s->current != NULL);
 583     assert(s->current->dma_len == 0);
 584     QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
 585     s->current = NULL;
 586
 587     p->pending = 0;
 588     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 589 }
 590
 591 /* Queue a byte for a MSG IN phase.  */
 592 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 593 {
 594     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 595         BADF("MSG IN data too long\n");
 596     } else {
 597         DPRINTF("MSG IN 0x%02x\n", data);
 598         s->msg[s->msg_len++] = data;
 599     }
 600 }
 601
 602 /* Perform reselection to continue a command.  */
 603 static void lsi_reselect(LSIState *s, lsi_request *p)
 604 {
 605     int id;
 606
 607     assert(s->current == NULL);
 608     QTAILQ_REMOVE(&s->queue, p, next);
 609     s->current = p;
 610
 611     id = (p->tag >> 8) & 0xf;
 612     s->ssid = id | 0x80;
 613     /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
 614     if (!(s->dcntl & LSI_DCNTL_COM)) {
 615         s->sfbr = 1 << (id & 0x7);
 616     }
 617     DPRINTF("Reselected target %d\n", id);
 618     s->scntl1 |= LSI_SCNTL1_CON;
 619     lsi_set_phase(s, PHASE_MI);
 620     s->msg_action = p->out ? 2 : 3;
 621     s->current->dma_len = p->pending;
 622     lsi_add_msg_byte(s, 0x80);
 623     if (s->current->tag & LSI_TAG_VALID) {
 624         lsi_add_msg_byte(s, 0x20);
 625         lsi_add_msg_byte(s, p->tag & 0xff);
 626     }
 627
 628     if (lsi_irq_on_rsl(s)) {
 629         lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
 630     }
 631 }
 632
 633 /* Record that data is available for a queued command.  Returns zero if
 634    the device was reselected, nonzero if the IO is deferred.  */
 635 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 636 {
 637     lsi_request *p;
 638
 639     QTAILQ_FOREACH(p, &s->queue, next) {
 640         if (p->tag == tag) {
 641             if (p->pending) {
 642                 BADF("Multiple IO pending for tag %d\n", tag);
 643             }
 644             p->pending = arg;
 645             /* Reselect if waiting for it, or if reselection triggers an IRQ
 646                and the bus is free.
 647                Since no interrupt stacking is implemented in the emulation, it
 648                is also required that there are no pending interrupts waiting
 649                for service from the device driver. */
 650             if (s->waiting == 1 ||
 651                 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
 652                  !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
 653                 /* Reselect device.  */
 654                 lsi_reselect(s, p);
 655                 return 0;
 656             } else {
 657                 DPRINTF("Queueing IO tag=0x%x\n", tag);
 658                 p->pending = arg;
 659                 return 1;
 660             }
 661         }
 662     }
 663     BADF("IO with unknown tag %d\n", tag);
 664     return 1;
 665 }
 666
 667 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 668 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 669                                  uint32_t arg)
 670 {
 671     LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
 672     int out;
 673
 674     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 675     if (reason == SCSI_REASON_DONE) {
 676         DPRINTF("Command complete sense=%d\n", (int)arg);
 677         s->sense = arg;
 678         s->command_complete = 2;
 679         if (s->waiting && s->dbc != 0) {
 680             /* Raise phase mismatch for short transfers.  */
 681             lsi_bad_phase(s, out, PHASE_ST);
 682         } else {
 683             lsi_set_phase(s, PHASE_ST);
 684         }
 685
 686         qemu_free(s->current);
 687         s->current = NULL;
 688
 689         lsi_resume_script(s);
 690         return;
 691     }
 692
 693     if (s->waiting == 1 || !s->current || tag != s->current->tag ||
 694         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
 695         if (lsi_queue_tag(s, tag, arg))
 696             return;
 697     }
 698
 699     /* host adapter (re)connected */
 700     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 701     s->current->dma_len = arg;
 702     s->command_complete = 1;
 703     if (!s->waiting)
 704         return;
 705     if (s->waiting == 1 || s->dbc == 0) {
 706         lsi_resume_script(s);
 707     } else {
 708         lsi_do_dma(s, out);
 709     }
 710 }
 711
 712 static void lsi_do_command(LSIState *s)
 713 {
 714     uint8_t buf[16];
 715     int n;
 716
 717     DPRINTF("Send command len=%d\n", s->dbc);
 718     if (s->dbc > 16)
 719         s->dbc = 16;
 720     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 721     s->sfbr = buf[0];
 722     s->command_complete = 0;
 723
 724     assert(s->current == NULL);
 725     s->current = qemu_mallocz(sizeof(lsi_request));
 726     s->current->tag = s->select_tag;
 727     s->current->dev = s->select_dev;
 728
 729     n = s->current->dev->info->send_command(s->current->dev, s->current->tag, buf,
 730                                             s->current_lun);
 731     if (n > 0) {
 732         lsi_set_phase(s, PHASE_DI);
 733         s->current->dev->info->read_data(s->current->dev, s->current->tag);
 734     } else if (n < 0) {
 735         lsi_set_phase(s, PHASE_DO);
 736         s->current->dev->info->write_data(s->current->dev, s->current->tag);
 737     }
 738
 739     if (!s->command_complete) {
 740         if (n) {
 741             /* Command did not complete immediately so disconnect.  */
 742             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 743             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 744             /* wait data */
 745             lsi_set_phase(s, PHASE_MI);
 746             s->msg_action = 1;
 747             lsi_queue_command(s);
 748         } else {
 749             /* wait command complete */
 750             lsi_set_phase(s, PHASE_DI);
 751         }
 752     }
 753 }
 754
 755 static void lsi_do_status(LSIState *s)
 756 {
 757     uint8_t sense;
 758     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 759     if (s->dbc != 1)
 760         BADF("Bad Status move\n");
 761     s->dbc = 1;
 762     sense = s->sense;
 763     s->sfbr = sense;
 764     cpu_physical_memory_write(s->dnad, &sense, 1);
 765     lsi_set_phase(s, PHASE_MI);
 766     s->msg_action = 1;
 767     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 768 }
 769
 770 static void lsi_disconnect(LSIState *s)
 771 {
 772     s->scntl1 &= ~LSI_SCNTL1_CON;
 773     s->sstat1 &= ~PHASE_MASK;
 774 }
 775
 776 static void lsi_do_msgin(LSIState *s)
 777 {
 778     int len;
 779     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 780     s->sfbr = s->msg[0];
 781     len = s->msg_len;
 782     if (len > s->dbc)
 783         len = s->dbc;
 784     cpu_physical_memory_write(s->dnad, s->msg, len);
 785     /* Linux drivers rely on the last byte being in the SIDL.  */
 786     s->sidl = s->msg[len - 1];
 787     s->msg_len -= len;
 788     if (s->msg_len) {
 789         memmove(s->msg, s->msg + len, s->msg_len);
 790     } else {
 791         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 792            switch to PHASE_MO.  */
 793         switch (s->msg_action) {
 794         case 0:
 795             lsi_set_phase(s, PHASE_CMD);
 796             break;
 797         case 1:
 798             lsi_disconnect(s);
 799             break;
 800         case 2:
 801             lsi_set_phase(s, PHASE_DO);
 802             break;
 803         case 3:
 804             lsi_set_phase(s, PHASE_DI);
 805             break;
 806         default:
 807             abort();
 808         }
 809     }
 810 }
 811
 812 /* Read the next byte during a MSGOUT phase.  */
 813 static uint8_t lsi_get_msgbyte(LSIState *s)
 814 {
 815     uint8_t data;
 816     cpu_physical_memory_read(s->dnad, &data, 1);
 817     s->dnad++;
 818     s->dbc--;
 819     return data;
 820 }
 821
 822 static void lsi_do_msgout(LSIState *s)
 823 {
 824     uint8_t msg;
 825     int len;
 826
 827     DPRINTF("MSG out len=%d\n", s->dbc);
 828     while (s->dbc) {
 829         msg = lsi_get_msgbyte(s);
 830         s->sfbr = msg;
 831
 832         switch (msg) {
 833         case 0x04:
 834             DPRINTF("MSG: Disconnect\n");
 835             lsi_disconnect(s);
 836             break;
 837         case 0x08:
 838             DPRINTF("MSG: No Operation\n");
 839             lsi_set_phase(s, PHASE_CMD);
 840             break;
 841         case 0x01:
 842             len = lsi_get_msgbyte(s);
 843             msg = lsi_get_msgbyte(s);
 844             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 845             switch (msg) {
 846             case 1:
 847                 DPRINTF("SDTR (ignored)\n");
 848                 s->dbc -= 2;
 849                 break;
 850             case 3:
 851                 DPRINTF("WDTR (ignored)\n");
 852                 s->dbc -= 1;
 853                 break;
 854             default:
 855                 goto bad;
 856             }
 857             break;
 858         case 0x20: /* SIMPLE queue */
 859             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 860             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 861             break;
 862         case 0x21: /* HEAD of queue */
 863             BADF("HEAD queue not implemented\n");
 864             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 865             break;
 866         case 0x22: /* ORDERED queue */
 867             BADF("ORDERED queue not implemented\n");
 868             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 869             break;
 870         default:
 871             if ((msg & 0x80) == 0) {
 872                 goto bad;
 873             }
 874             s->current_lun = msg & 7;
 875             DPRINTF("Select LUN %d\n", s->current_lun);
 876             lsi_set_phase(s, PHASE_CMD);
 877             break;
 878         }
 879     }
 880     return;
 881 bad:
 882     BADF("Unimplemented message 0x%02x\n", msg);
 883     lsi_set_phase(s, PHASE_MI);
 884     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 885     s->msg_action = 0;
 886 }
 887
 888 /* Sign extend a 24-bit value.  */
 889 static inline int32_t sxt24(int32_t n)
 890 {
 891     return (n << 8) >> 8;
 892 }
 893
 894 #define LSI_BUF_SIZE 4096
 895 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 896 {
 897     int n;
 898     uint8_t buf[LSI_BUF_SIZE];
 899
 900     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 901     while (count) {
 902         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
 903         cpu_physical_memory_read(src, buf, n);
 904         cpu_physical_memory_write(dest, buf, n);
 905         src += n;
 906         dest += n;
 907         count -= n;
 908     }
 909 }
 910
 911 static void lsi_wait_reselect(LSIState *s)
 912 {
 913     lsi_request *p;
 914
 915     DPRINTF("Wait Reselect\n");
 916
 917     QTAILQ_FOREACH(p, &s->queue, next) {
 918         if (p->pending) {
 919             lsi_reselect(s, p);
 920             break;
 921         }
 922     }
 923     if (s->current == NULL) {
 924         s->waiting = 1;
 925     }
 926 }
 927
 928 static void lsi_execute_script(LSIState *s)
 929 {
 930     uint32_t insn;
 931     uint32_t addr, addr_high;
 932     int opcode;
 933     int insn_processed = 0;
 934
 935     s->istat1 |= LSI_ISTAT1_SRUN;
 936 again:
 937     insn_processed++;
 938     insn = read_dword(s, s->dsp);
 939     if (!insn) {
 940         /* If we receive an empty opcode increment the DSP by 4 bytes
 941            instead of 8 and execute the next opcode at that location */
 942         s->dsp += 4;
 943         goto again;
 944     }
 945     addr = read_dword(s, s->dsp + 4);
 946     addr_high = 0;
 947     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 948     s->dsps = addr;
 949     s->dcmd = insn >> 24;
 950     s->dsp += 8;
 951     switch (insn >> 30) {
 952     case 0: /* Block move.  */
 953         if (s->sist1 & LSI_SIST1_STO) {
 954             DPRINTF("Delayed select timeout\n");
 955             lsi_stop_script(s);
 956             break;
 957         }
 958         s->dbc = insn & 0xffffff;
 959         s->rbc = s->dbc;
 960         /* ??? Set ESA.  */
 961         s->ia = s->dsp - 8;
 962         if (insn & (1 << 29)) {
 963             /* Indirect addressing.  */
 964             addr = read_dword(s, addr);
 965         } else if (insn & (1 << 28)) {
 966             uint32_t buf[2];
 967             int32_t offset;
 968             /* Table indirect addressing.  */
 969
 970             /* 32-bit Table indirect */
 971             offset = sxt24(addr);
 972             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 973             /* byte count is stored in bits 0:23 only */
 974             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 975             s->rbc = s->dbc;
 976             addr = cpu_to_le32(buf[1]);
 977
 978             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 979              * table, bits [31:24] */
 980             if (lsi_dma_40bit(s))
 981                 addr_high = cpu_to_le32(buf[0]) >> 24;
 982             else if (lsi_dma_ti64bit(s)) {
 983                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
 984                 switch (selector) {
 985                 case 0 ... 0x0f:
 986                     /* offset index into scratch registers since
 987                      * TI64 mode can use registers C to R */
 988                     addr_high = s->scratch[2 + selector];
 989                     break;
 990                 case 0x10:
 991                     addr_high = s->mmrs;
 992                     break;
 993                 case 0x11:
 994                     addr_high = s->mmws;
 995                     break;
 996                 case 0x12:
 997                     addr_high = s->sfs;
 998                     break;
 999                 case 0x13:
1000                     addr_high = s->drs;
1001                     break;
1002                 case 0x14:
1003                     addr_high = s->sbms;
1004                     break;
1005                 case 0x15:
1006                     addr_high = s->dbms;
1007                     break;
1008                 default:
1009                     BADF("Illegal selector specified (0x%x > 0x15)"
1010                          " for 64-bit DMA block move", selector);
1011                     break;
1012                 }
1013             }
1014         } else if (lsi_dma_64bit(s)) {
1015             /* fetch a 3rd dword if 64-bit direct move is enabled and
1016                only if we're not doing table indirect or indirect addressing */
1017             s->dbms = read_dword(s, s->dsp);
1018             s->dsp += 4;
1019             s->ia = s->dsp - 12;
1020         }
1021         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1022             DPRINTF("Wrong phase got %d expected %d\n",
1023                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1024             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1025             break;
1026         }
1027         s->dnad = addr;
1028         s->dnad64 = addr_high;
1029         switch (s->sstat1 & 0x7) {
1030         case PHASE_DO:
1031             s->waiting = 2;
1032             lsi_do_dma(s, 1);
1033             if (s->waiting)
1034                 s->waiting = 3;
1035             break;
1036         case PHASE_DI:
1037             s->waiting = 2;
1038             lsi_do_dma(s, 0);
1039             if (s->waiting)
1040                 s->waiting = 3;
1041             break;
1042         case PHASE_CMD:
1043             lsi_do_command(s);
1044             break;
1045         case PHASE_ST:
1046             lsi_do_status(s);
1047             break;
1048         case PHASE_MO:
1049             lsi_do_msgout(s);
1050             break;
1051         case PHASE_MI:
1052             lsi_do_msgin(s);
1053             break;
1054         default:
1055             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1056             exit(1);
1057         }
1058         s->dfifo = s->dbc & 0xff;
1059         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1060         s->sbc = s->dbc;
1061         s->rbc -= s->dbc;
1062         s->ua = addr + s->dbc;
1063         break;
1064
1065     case 1: /* IO or Read/Write instruction.  */
1066         opcode = (insn >> 27) & 7;
1067         if (opcode < 5) {
1068             uint32_t id;
1069
1070             if (insn & (1 << 25)) {
1071                 id = read_dword(s, s->dsa + sxt24(insn));
1072             } else {
1073                 id = insn;
1074             }
1075             id = (id >> 16) & 0xf;
1076             if (insn & (1 << 26)) {
1077                 addr = s->dsp + sxt24(addr);
1078             }
1079             s->dnad = addr;
1080             switch (opcode) {
1081             case 0: /* Select */
1082                 s->sdid = id;
1083                 if (s->scntl1 & LSI_SCNTL1_CON) {
1084                     DPRINTF("Already reselected, jumping to alternative address\n");
1085                     s->dsp = s->dnad;
1086                     break;
1087                 }
1088                 s->sstat0 |= LSI_SSTAT0_WOA;
1089                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1090                 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1091                     DPRINTF("Selected absent target %d\n", id);
1092                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1093                     lsi_disconnect(s);
1094                     break;
1095                 }
1096                 DPRINTF("Selected target %d%s\n",
1097                         id, insn & (1 << 3) ? " ATN" : "");
1098                 /* ??? Linux drivers compain when this is set.  Maybe
1099                    it only applies in low-level mode (unimplemented).
1100                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1101                 s->select_dev = s->bus.devs[id];
1102                 s->select_tag = id << 8;
1103                 s->scntl1 |= LSI_SCNTL1_CON;
1104                 if (insn & (1 << 3)) {
1105                     s->socl |= LSI_SOCL_ATN;
1106                 }
1107                 lsi_set_phase(s, PHASE_MO);
1108                 break;
1109             case 1: /* Disconnect */
1110                 DPRINTF("Wait Disconnect\n");
1111                 s->scntl1 &= ~LSI_SCNTL1_CON;
1112                 break;
1113             case 2: /* Wait Reselect */
1114                 if (!lsi_irq_on_rsl(s)) {
1115                     lsi_wait_reselect(s);
1116                 }
1117                 break;
1118             case 3: /* Set */
1119                 DPRINTF("Set%s%s%s%s\n",
1120                         insn & (1 << 3) ? " ATN" : "",
1121                         insn & (1 << 6) ? " ACK" : "",
1122                         insn & (1 << 9) ? " TM" : "",
1123                         insn & (1 << 10) ? " CC" : "");
1124                 if (insn & (1 << 3)) {
1125                     s->socl |= LSI_SOCL_ATN;
1126                     lsi_set_phase(s, PHASE_MO);
1127                 }
1128                 if (insn & (1 << 9)) {
1129                     BADF("Target mode not implemented\n");
1130                     exit(1);
1131                 }
1132                 if (insn & (1 << 10))
1133                     s->carry = 1;
1134                 break;
1135             case 4: /* Clear */
1136                 DPRINTF("Clear%s%s%s%s\n",
1137                         insn & (1 << 3) ? " ATN" : "",
1138                         insn & (1 << 6) ? " ACK" : "",
1139                         insn & (1 << 9) ? " TM" : "",
1140                         insn & (1 << 10) ? " CC" : "");
1141                 if (insn & (1 << 3)) {
1142                     s->socl &= ~LSI_SOCL_ATN;
1143                 }
1144                 if (insn & (1 << 10))
1145                     s->carry = 0;
1146                 break;
1147             }
1148         } else {
1149             uint8_t op0;
1150             uint8_t op1;
1151             uint8_t data8;
1152             int reg;
1153             int operator;
1154 #ifdef DEBUG_LSI
1155             static const char *opcode_names[3] =
1156                 {"Write", "Read", "Read-Modify-Write"};
1157             static const char *operator_names[8] =
1158                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1159 #endif
1160
1161             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1162             data8 = (insn >> 8) & 0xff;
1163             opcode = (insn >> 27) & 7;
1164             operator = (insn >> 24) & 7;
1165             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1166                     opcode_names[opcode - 5], reg,
1167                     operator_names[operator], data8, s->sfbr,
1168                     (insn & (1 << 23)) ? " SFBR" : "");
1169             op0 = op1 = 0;
1170             switch (opcode) {
1171             case 5: /* From SFBR */
1172                 op0 = s->sfbr;
1173                 op1 = data8;
1174                 break;
1175             case 6: /* To SFBR */
1176                 if (operator)
1177                     op0 = lsi_reg_readb(s, reg);
1178                 op1 = data8;
1179                 break;
1180             case 7: /* Read-modify-write */
1181                 if (operator)
1182                     op0 = lsi_reg_readb(s, reg);
1183                 if (insn & (1 << 23)) {
1184                     op1 = s->sfbr;
1185                 } else {
1186                     op1 = data8;
1187                 }
1188                 break;
1189             }
1190
1191             switch (operator) {
1192             case 0: /* move */
1193                 op0 = op1;
1194                 break;
1195             case 1: /* Shift left */
1196                 op1 = op0 >> 7;
1197                 op0 = (op0 << 1) | s->carry;
1198                 s->carry = op1;
1199                 break;
1200             case 2: /* OR */
1201                 op0 |= op1;
1202                 break;
1203             case 3: /* XOR */
1204                 op0 ^= op1;
1205                 break;
1206             case 4: /* AND */
1207                 op0 &= op1;
1208                 break;
1209             case 5: /* SHR */
1210                 op1 = op0 & 1;
1211                 op0 = (op0 >> 1) | (s->carry << 7);
1212                 s->carry = op1;
1213                 break;
1214             case 6: /* ADD */
1215                 op0 += op1;
1216                 s->carry = op0 < op1;
1217                 break;
1218             case 7: /* ADC */
1219                 op0 += op1 + s->carry;
1220                 if (s->carry)
1221                     s->carry = op0 <= op1;
1222                 else
1223                     s->carry = op0 < op1;
1224                 break;
1225             }
1226
1227             switch (opcode) {
1228             case 5: /* From SFBR */
1229             case 7: /* Read-modify-write */
1230                 lsi_reg_writeb(s, reg, op0);
1231                 break;
1232             case 6: /* To SFBR */
1233                 s->sfbr = op0;
1234                 break;
1235             }
1236         }
1237         break;
1238
1239     case 2: /* Transfer Control.  */
1240         {
1241             int cond;
1242             int jmp;
1243
1244             if ((insn & 0x002e0000) == 0) {
1245                 DPRINTF("NOP\n");
1246                 break;
1247             }
1248             if (s->sist1 & LSI_SIST1_STO) {
1249                 DPRINTF("Delayed select timeout\n");
1250                 lsi_stop_script(s);
1251                 break;
1252             }
1253             cond = jmp = (insn & (1 << 19)) != 0;
1254             if (cond == jmp && (insn & (1 << 21))) {
1255                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1256                 cond = s->carry != 0;
1257             }
1258             if (cond == jmp && (insn & (1 << 17))) {
1259                 DPRINTF("Compare phase %d %c= %d\n",
1260                         (s->sstat1 & PHASE_MASK),
1261                         jmp ? '=' : '!',
1262                         ((insn >> 24) & 7));
1263                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1264             }
1265             if (cond == jmp && (insn & (1 << 18))) {
1266                 uint8_t mask;
1267
1268                 mask = (~insn >> 8) & 0xff;
1269                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1270                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1271                 cond = (s->sfbr & mask) == (insn & mask);
1272             }
1273             if (cond == jmp) {
1274                 if (insn & (1 << 23)) {
1275                     /* Relative address.  */
1276                     addr = s->dsp + sxt24(addr);
1277                 }
1278                 switch ((insn >> 27) & 7) {
1279                 case 0: /* Jump */
1280                     DPRINTF("Jump to 0x%08x\n", addr);
1281                     s->dsp = addr;
1282                     break;
1283                 case 1: /* Call */
1284                     DPRINTF("Call 0x%08x\n", addr);
1285                     s->temp = s->dsp;
1286                     s->dsp = addr;
1287                     break;
1288                 case 2: /* Return */
1289                     DPRINTF("Return to 0x%08x\n", s->temp);
1290                     s->dsp = s->temp;
1291                     break;
1292                 case 3: /* Interrupt */
1293                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1294                     if ((insn & (1 << 20)) != 0) {
1295                         s->istat0 |= LSI_ISTAT0_INTF;
1296                         lsi_update_irq(s);
1297                     } else {
1298                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1299                     }
1300                     break;
1301                 default:
1302                     DPRINTF("Illegal transfer control\n");
1303                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1304                     break;
1305                 }
1306             } else {
1307                 DPRINTF("Control condition failed\n");
1308             }
1309         }
1310         break;
1311
1312     case 3:
1313         if ((insn & (1 << 29)) == 0) {
1314             /* Memory move.  */
1315             uint32_t dest;
1316             /* ??? The docs imply the destination address is loaded into
1317                the TEMP register.  However the Linux drivers rely on
1318                the value being presrved.  */
1319             dest = read_dword(s, s->dsp);
1320             s->dsp += 4;
1321             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1322         } else {
1323             uint8_t data[7];
1324             int reg;
1325             int n;
1326             int i;
1327
1328             if (insn & (1 << 28)) {
1329                 addr = s->dsa + sxt24(addr);
1330             }
1331             n = (insn & 7);
1332             reg = (insn >> 16) & 0xff;
1333             if (insn & (1 << 24)) {
1334                 cpu_physical_memory_read(addr, data, n);
1335                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1336                         addr, *(int *)data);
1337                 for (i = 0; i < n; i++) {
1338                     lsi_reg_writeb(s, reg + i, data[i]);
1339                 }
1340             } else {
1341                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1342                 for (i = 0; i < n; i++) {
1343                     data[i] = lsi_reg_readb(s, reg + i);
1344                 }
1345                 cpu_physical_memory_write(addr, data, n);
1346             }
1347         }
1348     }
1349     if (insn_processed > 10000 && !s->waiting) {
1350         /* Some windows drivers make the device spin waiting for a memory
1351            location to change.  If we have been executed a lot of code then
1352            assume this is the case and force an unexpected device disconnect.
1353            This is apparently sufficient to beat the drivers into submission.
1354          */
1355         if (!(s->sien0 & LSI_SIST0_UDC))
1356             fprintf(stderr, "inf. loop with UDC masked\n");
1357         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1358         lsi_disconnect(s);
1359     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1360         if (s->dcntl & LSI_DCNTL_SSM) {
1361             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1362         } else {
1363             goto again;
1364         }
1365     }
1366     DPRINTF("SCRIPTS execution stopped\n");
1367 }
1368
1369 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1370 {
1371     uint8_t tmp;
1372 #define CASE_GET_REG24(name, addr) \
1373     case addr: return s->name & 0xff; \
1374     case addr + 1: return (s->name >> 8) & 0xff; \
1375     case addr + 2: return (s->name >> 16) & 0xff;
1376
1377 #define CASE_GET_REG32(name, addr) \
1378     case addr: return s->name & 0xff; \
1379     case addr + 1: return (s->name >> 8) & 0xff; \
1380     case addr + 2: return (s->name >> 16) & 0xff; \
1381     case addr + 3: return (s->name >> 24) & 0xff;
1382
1383 #ifdef DEBUG_LSI_REG
1384     DPRINTF("Read reg %x\n", offset);
1385 #endif
1386     switch (offset) {
1387     case 0x00: /* SCNTL0 */
1388         return s->scntl0;
1389     case 0x01: /* SCNTL1 */
1390         return s->scntl1;
1391     case 0x02: /* SCNTL2 */
1392         return s->scntl2;
1393     case 0x03: /* SCNTL3 */
1394         return s->scntl3;
1395     case 0x04: /* SCID */
1396         return s->scid;
1397     case 0x05: /* SXFER */
1398         return s->sxfer;
1399     case 0x06: /* SDID */
1400         return s->sdid;
1401     case 0x07: /* GPREG0 */
1402         return 0x7f;
1403     case 0x08: /* Revision ID */
1404         return 0x00;
1405     case 0xa: /* SSID */
1406         return s->ssid;
1407     case 0xb: /* SBCL */
1408         /* ??? This is not correct. However it's (hopefully) only
1409            used for diagnostics, so should be ok.  */
1410         return 0;
1411     case 0xc: /* DSTAT */
1412         tmp = s->dstat | 0x80;
1413         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1414             s->dstat = 0;
1415         lsi_update_irq(s);
1416         return tmp;
1417     case 0x0d: /* SSTAT0 */
1418         return s->sstat0;
1419     case 0x0e: /* SSTAT1 */
1420         return s->sstat1;
1421     case 0x0f: /* SSTAT2 */
1422         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1423     CASE_GET_REG32(dsa, 0x10)
1424     case 0x14: /* ISTAT0 */
1425         return s->istat0;
1426     case 0x15: /* ISTAT1 */
1427         return s->istat1;
1428     case 0x16: /* MBOX0 */
1429         return s->mbox0;
1430     case 0x17: /* MBOX1 */
1431         return s->mbox1;
1432     case 0x18: /* CTEST0 */
1433         return 0xff;
1434     case 0x19: /* CTEST1 */
1435         return 0;
1436     case 0x1a: /* CTEST2 */
1437         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1438         if (s->istat0 & LSI_ISTAT0_SIGP) {
1439             s->istat0 &= ~LSI_ISTAT0_SIGP;
1440             tmp |= LSI_CTEST2_SIGP;
1441         }
1442         return tmp;
1443     case 0x1b: /* CTEST3 */
1444         return s->ctest3;
1445     CASE_GET_REG32(temp, 0x1c)
1446     case 0x20: /* DFIFO */
1447         return 0;
1448     case 0x21: /* CTEST4 */
1449         return s->ctest4;
1450     case 0x22: /* CTEST5 */
1451         return s->ctest5;
1452     case 0x23: /* CTEST6 */
1453          return 0;
1454     CASE_GET_REG24(dbc, 0x24)
1455     case 0x27: /* DCMD */
1456         return s->dcmd;
1457     CASE_GET_REG32(dnad, 0x28)
1458     CASE_GET_REG32(dsp, 0x2c)
1459     CASE_GET_REG32(dsps, 0x30)
1460     CASE_GET_REG32(scratch[0], 0x34)
1461     case 0x38: /* DMODE */
1462         return s->dmode;
1463     case 0x39: /* DIEN */
1464         return s->dien;
1465     case 0x3a: /* SBR */
1466         return s->sbr;
1467     case 0x3b: /* DCNTL */
1468         return s->dcntl;
1469     case 0x40: /* SIEN0 */
1470         return s->sien0;
1471     case 0x41: /* SIEN1 */
1472         return s->sien1;
1473     case 0x42: /* SIST0 */
1474         tmp = s->sist0;
1475         s->sist0 = 0;
1476         lsi_update_irq(s);
1477         return tmp;
1478     case 0x43: /* SIST1 */
1479         tmp = s->sist1;
1480         s->sist1 = 0;
1481         lsi_update_irq(s);
1482         return tmp;
1483     case 0x46: /* MACNTL */
1484         return 0x0f;
1485     case 0x47: /* GPCNTL0 */
1486         return 0x0f;
1487     case 0x48: /* STIME0 */
1488         return s->stime0;
1489     case 0x4a: /* RESPID0 */
1490         return s->respid0;
1491     case 0x4b: /* RESPID1 */
1492         return s->respid1;
1493     case 0x4d: /* STEST1 */
1494         return s->stest1;
1495     case 0x4e: /* STEST2 */
1496         return s->stest2;
1497     case 0x4f: /* STEST3 */
1498         return s->stest3;
1499     case 0x50: /* SIDL */
1500         /* This is needed by the linux drivers.  We currently only update it
1501            during the MSG IN phase.  */
1502         return s->sidl;
1503     case 0x52: /* STEST4 */
1504         return 0xe0;
1505     case 0x56: /* CCNTL0 */
1506         return s->ccntl0;
1507     case 0x57: /* CCNTL1 */
1508         return s->ccntl1;
1509     case 0x58: /* SBDL */
1510         /* Some drivers peek at the data bus during the MSG IN phase.  */
1511         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1512             return s->msg[0];
1513         return 0;
1514     case 0x59: /* SBDL high */
1515         return 0;
1516     CASE_GET_REG32(mmrs, 0xa0)
1517     CASE_GET_REG32(mmws, 0xa4)
1518     CASE_GET_REG32(sfs, 0xa8)
1519     CASE_GET_REG32(drs, 0xac)
1520     CASE_GET_REG32(sbms, 0xb0)
1521     CASE_GET_REG32(dbms, 0xb4)
1522     CASE_GET_REG32(dnad64, 0xb8)
1523     CASE_GET_REG32(pmjad1, 0xc0)
1524     CASE_GET_REG32(pmjad2, 0xc4)
1525     CASE_GET_REG32(rbc, 0xc8)
1526     CASE_GET_REG32(ua, 0xcc)
1527     CASE_GET_REG32(ia, 0xd4)
1528     CASE_GET_REG32(sbc, 0xd8)
1529     CASE_GET_REG32(csbc, 0xdc)
1530     }
1531     if (offset >= 0x5c && offset < 0xa0) {
1532         int n;
1533         int shift;
1534         n = (offset - 0x58) >> 2;
1535         shift = (offset & 3) * 8;
1536         return (s->scratch[n] >> shift) & 0xff;
1537     }
1538     BADF("readb 0x%x\n", offset);
1539     exit(1);
1540 #undef CASE_GET_REG24
1541 #undef CASE_GET_REG32
1542 }
1543
1544 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1545 {
1546 #define CASE_SET_REG24(name, addr) \
1547     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1548     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1549     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1550
1551 #define CASE_SET_REG32(name, addr) \
1552     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1553     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1554     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1555     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1556
1557 #ifdef DEBUG_LSI_REG
1558     DPRINTF("Write reg %x = %02x\n", offset, val);
1559 #endif
1560     switch (offset) {
1561     case 0x00: /* SCNTL0 */
1562         s->scntl0 = val;
1563         if (val & LSI_SCNTL0_START) {
1564             BADF("Start sequence not implemented\n");
1565         }
1566         break;
1567     case 0x01: /* SCNTL1 */
1568         s->scntl1 = val & ~LSI_SCNTL1_SST;
1569         if (val & LSI_SCNTL1_IARB) {
1570             BADF("Immediate Arbritration not implemented\n");
1571         }
1572         if (val & LSI_SCNTL1_RST) {
1573             s->sstat0 |= LSI_SSTAT0_RST;
1574             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1575         } else {
1576             s->sstat0 &= ~LSI_SSTAT0_RST;
1577         }
1578         break;
1579     case 0x02: /* SCNTL2 */
1580         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1581         s->scntl2 = val;
1582         break;
1583     case 0x03: /* SCNTL3 */
1584         s->scntl3 = val;
1585         break;
1586     case 0x04: /* SCID */
1587         s->scid = val;
1588         break;
1589     case 0x05: /* SXFER */
1590         s->sxfer = val;
1591         break;
1592     case 0x06: /* SDID */
1593         if ((val & 0xf) != (s->ssid & 0xf))
1594             BADF("Destination ID does not match SSID\n");
1595         s->sdid = val & 0xf;
1596         break;
1597     case 0x07: /* GPREG0 */
1598         break;
1599     case 0x08: /* SFBR */
1600         /* The CPU is not allowed to write to this register.  However the
1601            SCRIPTS register move instructions are.  */
1602         s->sfbr = val;
1603         break;
1604     case 0x0a: case 0x0b:
1605         /* Openserver writes to these readonly registers on startup */
1606         return;
1607     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1608         /* Linux writes to these readonly registers on startup.  */
1609         return;
1610     CASE_SET_REG32(dsa, 0x10)
1611     case 0x14: /* ISTAT0 */
1612         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1613         if (val & LSI_ISTAT0_ABRT) {
1614             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1615         }
1616         if (val & LSI_ISTAT0_INTF) {
1617             s->istat0 &= ~LSI_ISTAT0_INTF;
1618             lsi_update_irq(s);
1619         }
1620         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1621             DPRINTF("Woken by SIGP\n");
1622             s->waiting = 0;
1623             s->dsp = s->dnad;
1624             lsi_execute_script(s);
1625         }
1626         if (val & LSI_ISTAT0_SRST) {
1627             lsi_soft_reset(s);
1628         }
1629         break;
1630     case 0x16: /* MBOX0 */
1631         s->mbox0 = val;
1632         break;
1633     case 0x17: /* MBOX1 */
1634         s->mbox1 = val;
1635         break;
1636     case 0x1a: /* CTEST2 */
1637         s->ctest2 = val & LSI_CTEST2_PCICIE;
1638         break;
1639     case 0x1b: /* CTEST3 */
1640         s->ctest3 = val & 0x0f;
1641         break;
1642     CASE_SET_REG32(temp, 0x1c)
1643     case 0x21: /* CTEST4 */
1644         if (val & 7) {
1645            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1646         }
1647         s->ctest4 = val;
1648         break;
1649     case 0x22: /* CTEST5 */
1650         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1651             BADF("CTEST5 DMA increment not implemented\n");
1652         }
1653         s->ctest5 = val;
1654         break;
1655     CASE_SET_REG24(dbc, 0x24)
1656     CASE_SET_REG32(dnad, 0x28)
1657     case 0x2c: /* DSP[0:7] */
1658         s->dsp &= 0xffffff00;
1659         s->dsp |= val;
1660         break;
1661     case 0x2d: /* DSP[8:15] */
1662         s->dsp &= 0xffff00ff;
1663         s->dsp |= val << 8;
1664         break;
1665     case 0x2e: /* DSP[16:23] */
1666         s->dsp &= 0xff00ffff;
1667         s->dsp |= val << 16;
1668         break;
1669     case 0x2f: /* DSP[24:31] */
1670         s->dsp &= 0x00ffffff;
1671         s->dsp |= val << 24;
1672         if ((s->dmode & LSI_DMODE_MAN) == 0
1673             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1674             lsi_execute_script(s);
1675         break;
1676     CASE_SET_REG32(dsps, 0x30)
1677     CASE_SET_REG32(scratch[0], 0x34)
1678     case 0x38: /* DMODE */
1679         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1680             BADF("IO mappings not implemented\n");
1681         }
1682         s->dmode = val;
1683         break;
1684     case 0x39: /* DIEN */
1685         s->dien = val;
1686         lsi_update_irq(s);
1687         break;
1688     case 0x3a: /* SBR */
1689         s->sbr = val;
1690         break;
1691     case 0x3b: /* DCNTL */
1692         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1693         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1694             lsi_execute_script(s);
1695         break;
1696     case 0x40: /* SIEN0 */
1697         s->sien0 = val;
1698         lsi_update_irq(s);
1699         break;
1700     case 0x41: /* SIEN1 */
1701         s->sien1 = val;
1702         lsi_update_irq(s);
1703         break;
1704     case 0x47: /* GPCNTL0 */
1705         break;
1706     case 0x48: /* STIME0 */
1707         s->stime0 = val;
1708         break;
1709     case 0x49: /* STIME1 */
1710         if (val & 0xf) {
1711             DPRINTF("General purpose timer not implemented\n");
1712             /* ??? Raising the interrupt immediately seems to be sufficient
1713                to keep the FreeBSD driver happy.  */
1714             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1715         }
1716         break;
1717     case 0x4a: /* RESPID0 */
1718         s->respid0 = val;
1719         break;
1720     case 0x4b: /* RESPID1 */
1721         s->respid1 = val;
1722         break;
1723     case 0x4d: /* STEST1 */
1724         s->stest1 = val;
1725         break;
1726     case 0x4e: /* STEST2 */
1727         if (val & 1) {
1728             BADF("Low level mode not implemented\n");
1729         }
1730         s->stest2 = val;
1731         break;
1732     case 0x4f: /* STEST3 */
1733         if (val & 0x41) {
1734             BADF("SCSI FIFO test mode not implemented\n");
1735         }
1736         s->stest3 = val;
1737         break;
1738     case 0x56: /* CCNTL0 */
1739         s->ccntl0 = val;
1740         break;
1741     case 0x57: /* CCNTL1 */
1742         s->ccntl1 = val;
1743         break;
1744     CASE_SET_REG32(mmrs, 0xa0)
1745     CASE_SET_REG32(mmws, 0xa4)
1746     CASE_SET_REG32(sfs, 0xa8)
1747     CASE_SET_REG32(drs, 0xac)
1748     CASE_SET_REG32(sbms, 0xb0)
1749     CASE_SET_REG32(dbms, 0xb4)
1750     CASE_SET_REG32(dnad64, 0xb8)
1751     CASE_SET_REG32(pmjad1, 0xc0)
1752     CASE_SET_REG32(pmjad2, 0xc4)
1753     CASE_SET_REG32(rbc, 0xc8)
1754     CASE_SET_REG32(ua, 0xcc)
1755     CASE_SET_REG32(ia, 0xd4)
1756     CASE_SET_REG32(sbc, 0xd8)
1757     CASE_SET_REG32(csbc, 0xdc)
1758     default:
1759         if (offset >= 0x5c && offset < 0xa0) {
1760             int n;
1761             int shift;
1762             n = (offset - 0x58) >> 2;
1763             shift = (offset & 3) * 8;
1764             s->scratch[n] &= ~(0xff << shift);
1765             s->scratch[n] |= (val & 0xff) << shift;
1766         } else {
1767             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1768         }
1769     }
1770 #undef CASE_SET_REG24
1771 #undef CASE_SET_REG32
1772 }
1773
1774 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1775 {
1776     LSIState *s = opaque;
1777
1778     lsi_reg_writeb(s, addr & 0xff, val);
1779 }
1780
1781 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1782 {
1783     LSIState *s = opaque;
1784
1785     addr &= 0xff;
1786     lsi_reg_writeb(s, addr, val & 0xff);
1787     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1788 }
1789
1790 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1791 {
1792     LSIState *s = opaque;
1793
1794     addr &= 0xff;
1795     lsi_reg_writeb(s, addr, val & 0xff);
1796     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1797     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1798     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1799 }
1800
1801 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1802 {
1803     LSIState *s = opaque;
1804
1805     return lsi_reg_readb(s, addr & 0xff);
1806 }
1807
1808 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1809 {
1810     LSIState *s = opaque;
1811     uint32_t val;
1812
1813     addr &= 0xff;
1814     val = lsi_reg_readb(s, addr);
1815     val |= lsi_reg_readb(s, addr + 1) << 8;
1816     return val;
1817 }
1818
1819 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1820 {
1821     LSIState *s = opaque;
1822     uint32_t val;
1823     addr &= 0xff;
1824     val = lsi_reg_readb(s, addr);
1825     val |= lsi_reg_readb(s, addr + 1) << 8;
1826     val |= lsi_reg_readb(s, addr + 2) << 16;
1827     val |= lsi_reg_readb(s, addr + 3) << 24;
1828     return val;
1829 }
1830
1831 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1832     lsi_mmio_readb,
1833     lsi_mmio_readw,
1834     lsi_mmio_readl,
1835 };
1836
1837 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1838     lsi_mmio_writeb,
1839     lsi_mmio_writew,
1840     lsi_mmio_writel,
1841 };
1842
1843 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1844 {
1845     LSIState *s = opaque;
1846     uint32_t newval;
1847     int shift;
1848
1849     addr &= 0x1fff;
1850     newval = s->script_ram[addr >> 2];
1851     shift = (addr & 3) * 8;
1852     newval &= ~(0xff << shift);
1853     newval |= val << shift;
1854     s->script_ram[addr >> 2] = newval;
1855 }
1856
1857 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1858 {
1859     LSIState *s = opaque;
1860     uint32_t newval;
1861
1862     addr &= 0x1fff;
1863     newval = s->script_ram[addr >> 2];
1864     if (addr & 2) {
1865         newval = (newval & 0xffff) | (val << 16);
1866     } else {
1867         newval = (newval & 0xffff0000) | val;
1868     }
1869     s->script_ram[addr >> 2] = newval;
1870 }
1871
1872
1873 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1874 {
1875     LSIState *s = opaque;
1876
1877     addr &= 0x1fff;
1878     s->script_ram[addr >> 2] = val;
1879 }
1880
1881 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1882 {
1883     LSIState *s = opaque;
1884     uint32_t val;
1885
1886     addr &= 0x1fff;
1887     val = s->script_ram[addr >> 2];
1888     val >>= (addr & 3) * 8;
1889     return val & 0xff;
1890 }
1891
1892 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1893 {
1894     LSIState *s = opaque;
1895     uint32_t val;
1896
1897     addr &= 0x1fff;
1898     val = s->script_ram[addr >> 2];
1899     if (addr & 2)
1900         val >>= 16;
1901     return le16_to_cpu(val);
1902 }
1903
1904 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1905 {
1906     LSIState *s = opaque;
1907
1908     addr &= 0x1fff;
1909     return le32_to_cpu(s->script_ram[addr >> 2]);
1910 }
1911
1912 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1913     lsi_ram_readb,
1914     lsi_ram_readw,
1915     lsi_ram_readl,
1916 };
1917
1918 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1919     lsi_ram_writeb,
1920     lsi_ram_writew,
1921     lsi_ram_writel,
1922 };
1923
1924 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1925 {
1926     LSIState *s = opaque;
1927     return lsi_reg_readb(s, addr & 0xff);
1928 }
1929
1930 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1931 {
1932     LSIState *s = opaque;
1933     uint32_t val;
1934     addr &= 0xff;
1935     val = lsi_reg_readb(s, addr);
1936     val |= lsi_reg_readb(s, addr + 1) << 8;
1937     return val;
1938 }
1939
1940 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1941 {
1942     LSIState *s = opaque;
1943     uint32_t val;
1944     addr &= 0xff;
1945     val = lsi_reg_readb(s, addr);
1946     val |= lsi_reg_readb(s, addr + 1) << 8;
1947     val |= lsi_reg_readb(s, addr + 2) << 16;
1948     val |= lsi_reg_readb(s, addr + 3) << 24;
1949     return val;
1950 }
1951
1952 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1953 {
1954     LSIState *s = opaque;
1955     lsi_reg_writeb(s, addr & 0xff, val);
1956 }
1957
1958 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1959 {
1960     LSIState *s = opaque;
1961     addr &= 0xff;
1962     lsi_reg_writeb(s, addr, val & 0xff);
1963     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1964 }
1965
1966 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1967 {
1968     LSIState *s = opaque;
1969     addr &= 0xff;
1970     lsi_reg_writeb(s, addr, val & 0xff);
1971     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1972     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1973     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1974 }
1975
1976 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1977                            pcibus_t addr, pcibus_t size, int type)
1978 {
1979     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1980
1981     DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
1982
1983     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1984     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1985     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1986     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1987     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1988     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1989 }
1990
1991 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1992                             pcibus_t addr, pcibus_t size, int type)
1993 {
1994     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1995
1996     DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
1997     s->script_ram_base = addr;
1998     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1999 }
2000
2001 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
2002                              pcibus_t addr, pcibus_t size, int type)
2003 {
2004     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2005
2006     DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
2007     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
2008 }
2009
2010 static void lsi_scsi_reset(DeviceState *dev)
2011 {
2012     LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
2013
2014     lsi_soft_reset(s);
2015 }
2016
2017 static void lsi_pre_save(void *opaque)
2018 {
2019     LSIState *s = opaque;
2020
2021     if (s->current) {
2022         assert(s->current->dma_buf == NULL);
2023         assert(s->current->dma_len == 0);
2024     }
2025     assert(QTAILQ_EMPTY(&s->queue));
2026 }
2027
2028 static const VMStateDescription vmstate_lsi_scsi = {
2029     .name = "lsiscsi",
2030     .version_id = 0,
2031     .minimum_version_id = 0,
2032     .minimum_version_id_old = 0,
2033     .pre_save = lsi_pre_save,
2034     .fields      = (VMStateField []) {
2035         VMSTATE_PCI_DEVICE(dev, LSIState),
2036
2037         VMSTATE_INT32(carry, LSIState),
2038         VMSTATE_INT32(sense, LSIState),
2039         VMSTATE_INT32(msg_action, LSIState),
2040         VMSTATE_INT32(msg_len, LSIState),
2041         VMSTATE_BUFFER(msg, LSIState),
2042         VMSTATE_INT32(waiting, LSIState),
2043
2044         VMSTATE_UINT32(dsa, LSIState),
2045         VMSTATE_UINT32(temp, LSIState),
2046         VMSTATE_UINT32(dnad, LSIState),
2047         VMSTATE_UINT32(dbc, LSIState),
2048         VMSTATE_UINT8(istat0, LSIState),
2049         VMSTATE_UINT8(istat1, LSIState),
2050         VMSTATE_UINT8(dcmd, LSIState),
2051         VMSTATE_UINT8(dstat, LSIState),
2052         VMSTATE_UINT8(dien, LSIState),
2053         VMSTATE_UINT8(sist0, LSIState),
2054         VMSTATE_UINT8(sist1, LSIState),
2055         VMSTATE_UINT8(sien0, LSIState),
2056         VMSTATE_UINT8(sien1, LSIState),
2057         VMSTATE_UINT8(mbox0, LSIState),
2058         VMSTATE_UINT8(mbox1, LSIState),
2059         VMSTATE_UINT8(dfifo, LSIState),
2060         VMSTATE_UINT8(ctest2, LSIState),
2061         VMSTATE_UINT8(ctest3, LSIState),
2062         VMSTATE_UINT8(ctest4, LSIState),
2063         VMSTATE_UINT8(ctest5, LSIState),
2064         VMSTATE_UINT8(ccntl0, LSIState),
2065         VMSTATE_UINT8(ccntl1, LSIState),
2066         VMSTATE_UINT32(dsp, LSIState),
2067         VMSTATE_UINT32(dsps, LSIState),
2068         VMSTATE_UINT8(dmode, LSIState),
2069         VMSTATE_UINT8(dcntl, LSIState),
2070         VMSTATE_UINT8(scntl0, LSIState),
2071         VMSTATE_UINT8(scntl1, LSIState),
2072         VMSTATE_UINT8(scntl2, LSIState),
2073         VMSTATE_UINT8(scntl3, LSIState),
2074         VMSTATE_UINT8(sstat0, LSIState),
2075         VMSTATE_UINT8(sstat1, LSIState),
2076         VMSTATE_UINT8(scid, LSIState),
2077         VMSTATE_UINT8(sxfer, LSIState),
2078         VMSTATE_UINT8(socl, LSIState),
2079         VMSTATE_UINT8(sdid, LSIState),
2080         VMSTATE_UINT8(ssid, LSIState),
2081         VMSTATE_UINT8(sfbr, LSIState),
2082         VMSTATE_UINT8(stest1, LSIState),
2083         VMSTATE_UINT8(stest2, LSIState),
2084         VMSTATE_UINT8(stest3, LSIState),
2085         VMSTATE_UINT8(sidl, LSIState),
2086         VMSTATE_UINT8(stime0, LSIState),
2087         VMSTATE_UINT8(respid0, LSIState),
2088         VMSTATE_UINT8(respid1, LSIState),
2089         VMSTATE_UINT32(mmrs, LSIState),
2090         VMSTATE_UINT32(mmws, LSIState),
2091         VMSTATE_UINT32(sfs, LSIState),
2092         VMSTATE_UINT32(drs, LSIState),
2093         VMSTATE_UINT32(sbms, LSIState),
2094         VMSTATE_UINT32(dbms, LSIState),
2095         VMSTATE_UINT32(dnad64, LSIState),
2096         VMSTATE_UINT32(pmjad1, LSIState),
2097         VMSTATE_UINT32(pmjad2, LSIState),
2098         VMSTATE_UINT32(rbc, LSIState),
2099         VMSTATE_UINT32(ua, LSIState),
2100         VMSTATE_UINT32(ia, LSIState),
2101         VMSTATE_UINT32(sbc, LSIState),
2102         VMSTATE_UINT32(csbc, LSIState),
2103         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2104         VMSTATE_UINT8(sbr, LSIState),
2105
2106         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2107         VMSTATE_END_OF_LIST()
2108     }
2109 };
2110
2111 static int lsi_scsi_uninit(PCIDevice *d)
2112 {
2113     LSIState *s = DO_UPCAST(LSIState, dev, d);
2114
2115     cpu_unregister_io_memory(s->mmio_io_addr);
2116     cpu_unregister_io_memory(s->ram_io_addr);
2117
2118     return 0;
2119 }
2120
2121 static int lsi_scsi_init(PCIDevice *dev)
2122 {
2123     LSIState *s = DO_UPCAST(LSIState, dev, dev);
2124     uint8_t *pci_conf;
2125
2126     pci_conf = s->dev.config;
2127
2128     /* PCI Vendor ID (word) */
2129     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2130     /* PCI device ID (word) */
2131     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2132     /* PCI base class code */
2133     pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2134     /* PCI subsystem ID */
2135     pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2136     pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
2137     /* PCI latency timer = 255 */
2138     pci_conf[PCI_LATENCY_TIMER] = 0xff;
2139     /* TODO: RST# value should be 0 */
2140     /* Interrupt pin 1 */
2141     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2142
2143     s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2144                                              lsi_mmio_writefn, s);
2145     s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2146                                             lsi_ram_writefn, s);
2147
2148     /* TODO: use dev and get rid of cast below */
2149     pci_register_bar((struct PCIDevice *)s, 0, 256,
2150                            PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2151     pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2152                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2153     pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2154                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2155     QTAILQ_INIT(&s->queue);
2156
2157     scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2158     if (!dev->qdev.hotplugged) {
2159         scsi_bus_legacy_handle_cmdline(&s->bus);
2160     }
2161     return 0;
2162 }
2163
2164 static PCIDeviceInfo lsi_info = {
2165     .qdev.name  = "lsi53c895a",
2166     .qdev.alias = "lsi",
2167     .qdev.size  = sizeof(LSIState),
2168     .qdev.reset = lsi_scsi_reset,
2169     .qdev.vmsd  = &vmstate_lsi_scsi,
2170     .init       = lsi_scsi_init,
2171     .exit       = lsi_scsi_uninit,
2172 };
2173
2174 static void lsi53c895a_register_devices(void)
2175 {
2176     pci_qdev_register(&lsi_info);
2177 }
2178
2179 device_init(lsi53c895a_register_devices);