hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include <assert.h>
  14
  15 #include "hw.h"
  16 #include "pci.h"
  17 #include "scsi.h"
  18 #include "block_int.h"
  19
  20 //#define DEBUG_LSI
  21 //#define DEBUG_LSI_REG
  22
  23 #ifdef DEBUG_LSI
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
  26 #define BADF(fmt, ...) \
  27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
  28 #else
  29 #define DPRINTF(fmt, ...) do {} while(0)
  30 #define BADF(fmt, ...) \
  31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
  32 #endif
  33
  34 #define LSI_MAX_DEVS 7
  35
  36 #define LSI_SCNTL0_TRG    0x01
  37 #define LSI_SCNTL0_AAP    0x02
  38 #define LSI_SCNTL0_EPC    0x08
  39 #define LSI_SCNTL0_WATN   0x10
  40 #define LSI_SCNTL0_START  0x20
  41
  42 #define LSI_SCNTL1_SST    0x01
  43 #define LSI_SCNTL1_IARB   0x02
  44 #define LSI_SCNTL1_AESP   0x04
  45 #define LSI_SCNTL1_RST    0x08
  46 #define LSI_SCNTL1_CON    0x10
  47 #define LSI_SCNTL1_DHP    0x20
  48 #define LSI_SCNTL1_ADB    0x40
  49 #define LSI_SCNTL1_EXC    0x80
  50
  51 #define LSI_SCNTL2_WSR    0x01
  52 #define LSI_SCNTL2_VUE0   0x02
  53 #define LSI_SCNTL2_VUE1   0x04
  54 #define LSI_SCNTL2_WSS    0x08
  55 #define LSI_SCNTL2_SLPHBEN 0x10
  56 #define LSI_SCNTL2_SLPMD  0x20
  57 #define LSI_SCNTL2_CHM    0x40
  58 #define LSI_SCNTL2_SDU    0x80
  59
  60 #define LSI_ISTAT0_DIP    0x01
  61 #define LSI_ISTAT0_SIP    0x02
  62 #define LSI_ISTAT0_INTF   0x04
  63 #define LSI_ISTAT0_CON    0x08
  64 #define LSI_ISTAT0_SEM    0x10
  65 #define LSI_ISTAT0_SIGP   0x20
  66 #define LSI_ISTAT0_SRST   0x40
  67 #define LSI_ISTAT0_ABRT   0x80
  68
  69 #define LSI_ISTAT1_SI     0x01
  70 #define LSI_ISTAT1_SRUN   0x02
  71 #define LSI_ISTAT1_FLSH   0x04
  72
  73 #define LSI_SSTAT0_SDP0   0x01
  74 #define LSI_SSTAT0_RST    0x02
  75 #define LSI_SSTAT0_WOA    0x04
  76 #define LSI_SSTAT0_LOA    0x08
  77 #define LSI_SSTAT0_AIP    0x10
  78 #define LSI_SSTAT0_OLF    0x20
  79 #define LSI_SSTAT0_ORF    0x40
  80 #define LSI_SSTAT0_ILF    0x80
  81
  82 #define LSI_SIST0_PAR     0x01
  83 #define LSI_SIST0_RST     0x02
  84 #define LSI_SIST0_UDC     0x04
  85 #define LSI_SIST0_SGE     0x08
  86 #define LSI_SIST0_RSL     0x10
  87 #define LSI_SIST0_SEL     0x20
  88 #define LSI_SIST0_CMP     0x40
  89 #define LSI_SIST0_MA      0x80
  90
  91 #define LSI_SIST1_HTH     0x01
  92 #define LSI_SIST1_GEN     0x02
  93 #define LSI_SIST1_STO     0x04
  94 #define LSI_SIST1_SBMC    0x10
  95
  96 #define LSI_SOCL_IO       0x01
  97 #define LSI_SOCL_CD       0x02
  98 #define LSI_SOCL_MSG      0x04
  99 #define LSI_SOCL_ATN      0x08
 100 #define LSI_SOCL_SEL      0x10
 101 #define LSI_SOCL_BSY      0x20
 102 #define LSI_SOCL_ACK      0x40
 103 #define LSI_SOCL_REQ      0x80
 104
 105 #define LSI_DSTAT_IID     0x01
 106 #define LSI_DSTAT_SIR     0x04
 107 #define LSI_DSTAT_SSI     0x08
 108 #define LSI_DSTAT_ABRT    0x10
 109 #define LSI_DSTAT_BF      0x20
 110 #define LSI_DSTAT_MDPE    0x40
 111 #define LSI_DSTAT_DFE     0x80
 112
 113 #define LSI_DCNTL_COM     0x01
 114 #define LSI_DCNTL_IRQD    0x02
 115 #define LSI_DCNTL_STD     0x04
 116 #define LSI_DCNTL_IRQM    0x08
 117 #define LSI_DCNTL_SSM     0x10
 118 #define LSI_DCNTL_PFEN    0x20
 119 #define LSI_DCNTL_PFF     0x40
 120 #define LSI_DCNTL_CLSE    0x80
 121
 122 #define LSI_DMODE_MAN     0x01
 123 #define LSI_DMODE_BOF     0x02
 124 #define LSI_DMODE_ERMP    0x04
 125 #define LSI_DMODE_ERL     0x08
 126 #define LSI_DMODE_DIOM    0x10
 127 #define LSI_DMODE_SIOM    0x20
 128
 129 #define LSI_CTEST2_DACK   0x01
 130 #define LSI_CTEST2_DREQ   0x02
 131 #define LSI_CTEST2_TEOP   0x04
 132 #define LSI_CTEST2_PCICIE 0x08
 133 #define LSI_CTEST2_CM     0x10
 134 #define LSI_CTEST2_CIO    0x20
 135 #define LSI_CTEST2_SIGP   0x40
 136 #define LSI_CTEST2_DDIR   0x80
 137
 138 #define LSI_CTEST5_BL2    0x04
 139 #define LSI_CTEST5_DDIR   0x08
 140 #define LSI_CTEST5_MASR   0x10
 141 #define LSI_CTEST5_DFSN   0x20
 142 #define LSI_CTEST5_BBCK   0x40
 143 #define LSI_CTEST5_ADCK   0x80
 144
 145 #define LSI_CCNTL0_DILS   0x01
 146 #define LSI_CCNTL0_DISFC  0x10
 147 #define LSI_CCNTL0_ENNDJ  0x20
 148 #define LSI_CCNTL0_PMJCTL 0x40
 149 #define LSI_CCNTL0_ENPMJ  0x80
 150
 151 #define LSI_CCNTL1_EN64DBMV  0x01
 152 #define LSI_CCNTL1_EN64TIBMV 0x02
 153 #define LSI_CCNTL1_64TIMOD   0x04
 154 #define LSI_CCNTL1_DDAC      0x08
 155 #define LSI_CCNTL1_ZMOD      0x80
 156
 157 /* Enable Response to Reselection */
 158 #define LSI_SCID_RRE      0x60
 159
 160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 161
 162 #define PHASE_DO          0
 163 #define PHASE_DI          1
 164 #define PHASE_CMD         2
 165 #define PHASE_ST          3
 166 #define PHASE_MO          6
 167 #define PHASE_MI          7
 168 #define PHASE_MASK        7
 169
 170 /* Maximum length of MSG IN data.  */
 171 #define LSI_MAX_MSGIN_LEN 8
 172
 173 /* Flag set if this is a tagged command.  */
 174 #define LSI_TAG_VALID     (1 << 16)
 175
 176 typedef struct {
 177     uint32_t tag;
 178     uint32_t pending;
 179     int out;
 180 } lsi_queue;
 181
 182 typedef struct {
 183     PCIDevice dev;
 184     int mmio_io_addr;
 185     int ram_io_addr;
 186     uint32_t script_ram_base;
 187
 188     int carry; /* ??? Should this be an a visible register somewhere?  */
 189     int sense;
 190     /* Action to take at the end of a MSG IN phase.
 191        0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN.  */
 192     int msg_action;
 193     int msg_len;
 194     uint8_t msg[LSI_MAX_MSGIN_LEN];
 195     /* 0 if SCRIPTS are running or stopped.
 196      * 1 if a Wait Reselect instruction has been issued.
 197      * 2 if processing DMA from lsi_execute_script.
 198      * 3 if a DMA operation is in progress.  */
 199     int waiting;
 200     SCSIBus bus;
 201     SCSIDevice *current_dev;
 202     int current_lun;
 203     /* The tag is a combination of the device ID and the SCSI tag.  */
 204     uint32_t current_tag;
 205     uint32_t current_dma_len;
 206     int command_complete;
 207     uint8_t *dma_buf;
 208     lsi_queue *queue;
 209     int queue_len;
 210     int active_commands;
 211
 212     uint32_t dsa;
 213     uint32_t temp;
 214     uint32_t dnad;
 215     uint32_t dbc;
 216     uint8_t istat0;
 217     uint8_t istat1;
 218     uint8_t dcmd;
 219     uint8_t dstat;
 220     uint8_t dien;
 221     uint8_t sist0;
 222     uint8_t sist1;
 223     uint8_t sien0;
 224     uint8_t sien1;
 225     uint8_t mbox0;
 226     uint8_t mbox1;
 227     uint8_t dfifo;
 228     uint8_t ctest2;
 229     uint8_t ctest3;
 230     uint8_t ctest4;
 231     uint8_t ctest5;
 232     uint8_t ccntl0;
 233     uint8_t ccntl1;
 234     uint32_t dsp;
 235     uint32_t dsps;
 236     uint8_t dmode;
 237     uint8_t dcntl;
 238     uint8_t scntl0;
 239     uint8_t scntl1;
 240     uint8_t scntl2;
 241     uint8_t scntl3;
 242     uint8_t sstat0;
 243     uint8_t sstat1;
 244     uint8_t scid;
 245     uint8_t sxfer;
 246     uint8_t socl;
 247     uint8_t sdid;
 248     uint8_t ssid;
 249     uint8_t sfbr;
 250     uint8_t stest1;
 251     uint8_t stest2;
 252     uint8_t stest3;
 253     uint8_t sidl;
 254     uint8_t stime0;
 255     uint8_t respid0;
 256     uint8_t respid1;
 257     uint32_t mmrs;
 258     uint32_t mmws;
 259     uint32_t sfs;
 260     uint32_t drs;
 261     uint32_t sbms;
 262     uint32_t dbms;
 263     uint32_t dnad64;
 264     uint32_t pmjad1;
 265     uint32_t pmjad2;
 266     uint32_t rbc;
 267     uint32_t ua;
 268     uint32_t ia;
 269     uint32_t sbc;
 270     uint32_t csbc;
 271     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 272     uint8_t sbr;
 273
 274     /* Script ram is stored as 32-bit words in host byteorder.  */
 275     uint32_t script_ram[2048];
 276 } LSIState;
 277
 278 static inline int lsi_irq_on_rsl(LSIState *s)
 279 {
 280     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
 281 }
 282
 283 static void lsi_soft_reset(LSIState *s)
 284 {
 285     DPRINTF("Reset\n");
 286     s->carry = 0;
 287
 288     s->waiting = 0;
 289     s->dsa = 0;
 290     s->dnad = 0;
 291     s->dbc = 0;
 292     s->temp = 0;
 293     memset(s->scratch, 0, sizeof(s->scratch));
 294     s->istat0 = 0;
 295     s->istat1 = 0;
 296     s->dcmd = 0;
 297     s->dstat = 0;
 298     s->dien = 0;
 299     s->sist0 = 0;
 300     s->sist1 = 0;
 301     s->sien0 = 0;
 302     s->sien1 = 0;
 303     s->mbox0 = 0;
 304     s->mbox1 = 0;
 305     s->dfifo = 0;
 306     s->ctest2 = 0;
 307     s->ctest3 = 0;
 308     s->ctest4 = 0;
 309     s->ctest5 = 0;
 310     s->ccntl0 = 0;
 311     s->ccntl1 = 0;
 312     s->dsp = 0;
 313     s->dsps = 0;
 314     s->dmode = 0;
 315     s->dcntl = 0;
 316     s->scntl0 = 0xc0;
 317     s->scntl1 = 0;
 318     s->scntl2 = 0;
 319     s->scntl3 = 0;
 320     s->sstat0 = 0;
 321     s->sstat1 = 0;
 322     s->scid = 7;
 323     s->sxfer = 0;
 324     s->socl = 0;
 325     s->stest1 = 0;
 326     s->stest2 = 0;
 327     s->stest3 = 0;
 328     s->sidl = 0;
 329     s->stime0 = 0;
 330     s->respid0 = 0x80;
 331     s->respid1 = 0;
 332     s->mmrs = 0;
 333     s->mmws = 0;
 334     s->sfs = 0;
 335     s->drs = 0;
 336     s->sbms = 0;
 337     s->dbms = 0;
 338     s->dnad64 = 0;
 339     s->pmjad1 = 0;
 340     s->pmjad2 = 0;
 341     s->rbc = 0;
 342     s->ua = 0;
 343     s->ia = 0;
 344     s->sbc = 0;
 345     s->csbc = 0;
 346     s->sbr = 0;
 347 }
 348
 349 static int lsi_dma_40bit(LSIState *s)
 350 {
 351     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 352         return 1;
 353     return 0;
 354 }
 355
 356 static int lsi_dma_ti64bit(LSIState *s)
 357 {
 358     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 359         return 1;
 360     return 0;
 361 }
 362
 363 static int lsi_dma_64bit(LSIState *s)
 364 {
 365     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 366         return 1;
 367     return 0;
 368 }
 369
 370 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 371 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 372 static void lsi_execute_script(LSIState *s);
 373 static void lsi_reselect(LSIState *s, uint32_t tag);
 374
 375 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 376 {
 377     uint32_t buf;
 378
 379     /* Optimize reading from SCRIPTS RAM.  */
 380     if ((addr & 0xffffe000) == s->script_ram_base) {
 381         return s->script_ram[(addr & 0x1fff) >> 2];
 382     }
 383     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 384     return cpu_to_le32(buf);
 385 }
 386
 387 static void lsi_stop_script(LSIState *s)
 388 {
 389     s->istat1 &= ~LSI_ISTAT1_SRUN;
 390 }
 391
 392 static void lsi_update_irq(LSIState *s)
 393 {
 394     int i;
 395     int level;
 396     static int last_level;
 397
 398     /* It's unclear whether the DIP/SIP bits should be cleared when the
 399        Interrupt Status Registers are cleared or when istat0 is read.
 400        We currently do the formwer, which seems to work.  */
 401     level = 0;
 402     if (s->dstat) {
 403         if (s->dstat & s->dien)
 404             level = 1;
 405         s->istat0 |= LSI_ISTAT0_DIP;
 406     } else {
 407         s->istat0 &= ~LSI_ISTAT0_DIP;
 408     }
 409
 410     if (s->sist0 || s->sist1) {
 411         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 412             level = 1;
 413         s->istat0 |= LSI_ISTAT0_SIP;
 414     } else {
 415         s->istat0 &= ~LSI_ISTAT0_SIP;
 416     }
 417     if (s->istat0 & LSI_ISTAT0_INTF)
 418         level = 1;
 419
 420     if (level != last_level) {
 421         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 422                 level, s->dstat, s->sist1, s->sist0);
 423         last_level = level;
 424     }
 425     qemu_set_irq(s->dev.irq[0], level);
 426
 427     if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
 428         DPRINTF("Handled IRQs & disconnected, looking for pending "
 429                 "processes\n");
 430         for (i = 0; i < s->active_commands; i++) {
 431             if (s->queue[i].pending) {
 432                 lsi_reselect(s, s->queue[i].tag);
 433                 break;
 434             }
 435         }
 436     }
 437 }
 438
 439 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 440 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 441 {
 442     uint32_t mask0;
 443     uint32_t mask1;
 444
 445     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 446             stat1, stat0, s->sist1, s->sist0);
 447     s->sist0 |= stat0;
 448     s->sist1 |= stat1;
 449     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 450        we don't stop processing when raising STO.  Instead continue
 451        execution and stop at the next insn that accesses the SCSI bus.  */
 452     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 453     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 454     mask1 &= ~LSI_SIST1_STO;
 455     if (s->sist0 & mask0 || s->sist1 & mask1) {
 456         lsi_stop_script(s);
 457     }
 458     lsi_update_irq(s);
 459 }
 460
 461 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 462 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 463 {
 464     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 465     s->dstat |= stat;
 466     lsi_update_irq(s);
 467     lsi_stop_script(s);
 468 }
 469
 470 static inline void lsi_set_phase(LSIState *s, int phase)
 471 {
 472     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 473 }
 474
 475 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 476 {
 477     /* Trigger a phase mismatch.  */
 478     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 479         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 480             s->dsp = s->pmjad1;
 481         } else {
 482             s->dsp = s->pmjad2;
 483         }
 484         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 485     } else {
 486         DPRINTF("Phase mismatch interrupt\n");
 487         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 488         lsi_stop_script(s);
 489     }
 490     lsi_set_phase(s, new_phase);
 491 }
 492
 493
 494 /* Resume SCRIPTS execution after a DMA operation.  */
 495 static void lsi_resume_script(LSIState *s)
 496 {
 497     if (s->waiting != 2) {
 498         s->waiting = 0;
 499         lsi_execute_script(s);
 500     } else {
 501         s->waiting = 0;
 502     }
 503 }
 504
 505 /* Initiate a SCSI layer data transfer.  */
 506 static void lsi_do_dma(LSIState *s, int out)
 507 {
 508     uint32_t count;
 509     target_phys_addr_t addr;
 510
 511     if (!s->current_dma_len) {
 512         /* Wait until data is available.  */
 513         DPRINTF("DMA no data available\n");
 514         return;
 515     }
 516
 517     count = s->dbc;
 518     if (count > s->current_dma_len)
 519         count = s->current_dma_len;
 520
 521     addr = s->dnad;
 522     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 523     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 524         addr |= ((uint64_t)s->dnad64 << 32);
 525     else if (s->dbms)
 526         addr |= ((uint64_t)s->dbms << 32);
 527     else if (s->sbms)
 528         addr |= ((uint64_t)s->sbms << 32);
 529
 530     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 531     s->csbc += count;
 532     s->dnad += count;
 533     s->dbc -= count;
 534
 535     if (s->dma_buf == NULL) {
 536         s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
 537                                                    s->current_tag);
 538     }
 539
 540     /* ??? Set SFBR to first data byte.  */
 541     if (out) {
 542         cpu_physical_memory_read(addr, s->dma_buf, count);
 543     } else {
 544         cpu_physical_memory_write(addr, s->dma_buf, count);
 545     }
 546     s->current_dma_len -= count;
 547     if (s->current_dma_len == 0) {
 548         s->dma_buf = NULL;
 549         if (out) {
 550             /* Write the data.  */
 551             s->current_dev->info->write_data(s->current_dev, s->current_tag);
 552         } else {
 553             /* Request any remaining data.  */
 554             s->current_dev->info->read_data(s->current_dev, s->current_tag);
 555         }
 556     } else {
 557         s->dma_buf += count;
 558         lsi_resume_script(s);
 559     }
 560 }
 561
 562
 563 /* Add a command to the queue.  */
 564 static void lsi_queue_command(LSIState *s)
 565 {
 566     lsi_queue *p;
 567
 568     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 569     if (s->queue_len == s->active_commands) {
 570         s->queue_len++;
 571         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 572     }
 573     p = &s->queue[s->active_commands++];
 574     p->tag = s->current_tag;
 575     p->pending = 0;
 576     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 577 }
 578
 579 /* Queue a byte for a MSG IN phase.  */
 580 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 581 {
 582     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 583         BADF("MSG IN data too long\n");
 584     } else {
 585         DPRINTF("MSG IN 0x%02x\n", data);
 586         s->msg[s->msg_len++] = data;
 587     }
 588 }
 589
 590 /* Perform reselection to continue a command.  */
 591 static void lsi_reselect(LSIState *s, uint32_t tag)
 592 {
 593     lsi_queue *p;
 594     int n;
 595     int id;
 596
 597     p = NULL;
 598     for (n = 0; n < s->active_commands; n++) {
 599         p = &s->queue[n];
 600         if (p->tag == tag)
 601             break;
 602     }
 603     if (n == s->active_commands) {
 604         BADF("Reselected non-existant command tag=0x%x\n", tag);
 605         return;
 606     }
 607     id = (tag >> 8) & 0xf;
 608     s->ssid = id | 0x80;
 609     /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
 610     if (!(s->dcntl & LSI_DCNTL_COM)) {
 611         s->sfbr = 1 << (id & 0x7);
 612     }
 613     DPRINTF("Reselected target %d\n", id);
 614     s->current_dev = s->bus.devs[id];
 615     s->current_tag = tag;
 616     s->scntl1 |= LSI_SCNTL1_CON;
 617     lsi_set_phase(s, PHASE_MI);
 618     s->msg_action = p->out ? 2 : 3;
 619     s->current_dma_len = p->pending;
 620     s->dma_buf = NULL;
 621     lsi_add_msg_byte(s, 0x80);
 622     if (s->current_tag & LSI_TAG_VALID) {
 623         lsi_add_msg_byte(s, 0x20);
 624         lsi_add_msg_byte(s, tag & 0xff);
 625     }
 626
 627     s->active_commands--;
 628     if (n != s->active_commands) {
 629         s->queue[n] = s->queue[s->active_commands];
 630     }
 631
 632     if (lsi_irq_on_rsl(s)) {
 633         lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
 634     }
 635 }
 636
 637 /* Record that data is available for a queued command.  Returns zero if
 638    the device was reselected, nonzero if the IO is deferred.  */
 639 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 640 {
 641     lsi_queue *p;
 642     int i;
 643     for (i = 0; i < s->active_commands; i++) {
 644         p = &s->queue[i];
 645         if (p->tag == tag) {
 646             if (p->pending) {
 647                 BADF("Multiple IO pending for tag %d\n", tag);
 648             }
 649             p->pending = arg;
 650             /* Reselect if waiting for it, or if reselection triggers an IRQ
 651                and the bus is free.
 652                Since no interrupt stacking is implemented in the emulation, it
 653                is also required that there are no pending interrupts waiting
 654                for service from the device driver. */
 655             if (s->waiting == 1 ||
 656                 (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
 657                  !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
 658                 /* Reselect device.  */
 659                 lsi_reselect(s, tag);
 660                 return 0;
 661             } else {
 662                DPRINTF("Queueing IO tag=0x%x\n", tag);
 663                 p->pending = arg;
 664                 return 1;
 665             }
 666         }
 667     }
 668     BADF("IO with unknown tag %d\n", tag);
 669     return 1;
 670 }
 671
 672 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 673 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 674                                  uint32_t arg)
 675 {
 676     LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
 677     int out;
 678
 679     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 680     if (reason == SCSI_REASON_DONE) {
 681         DPRINTF("Command complete sense=%d\n", (int)arg);
 682         s->sense = arg;
 683         s->command_complete = 2;
 684         if (s->waiting && s->dbc != 0) {
 685             /* Raise phase mismatch for short transfers.  */
 686             lsi_bad_phase(s, out, PHASE_ST);
 687         } else {
 688             lsi_set_phase(s, PHASE_ST);
 689         }
 690         lsi_resume_script(s);
 691         return;
 692     }
 693
 694     if (s->waiting == 1 || tag != s->current_tag ||
 695         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
 696         if (lsi_queue_tag(s, tag, arg))
 697             return;
 698     }
 699
 700     /* host adapter (re)connected */
 701     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 702     s->current_dma_len = arg;
 703     s->command_complete = 1;
 704     if (!s->waiting)
 705         return;
 706     if (s->waiting == 1 || s->dbc == 0) {
 707         lsi_resume_script(s);
 708     } else {
 709         lsi_do_dma(s, out);
 710     }
 711 }
 712
 713 static void lsi_do_command(LSIState *s)
 714 {
 715     uint8_t buf[16];
 716     int n;
 717
 718     DPRINTF("Send command len=%d\n", s->dbc);
 719     if (s->dbc > 16)
 720         s->dbc = 16;
 721     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 722     s->sfbr = buf[0];
 723     s->command_complete = 0;
 724     n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
 725                                            s->current_lun);
 726     if (n > 0) {
 727         lsi_set_phase(s, PHASE_DI);
 728         s->current_dev->info->read_data(s->current_dev, s->current_tag);
 729     } else if (n < 0) {
 730         lsi_set_phase(s, PHASE_DO);
 731         s->current_dev->info->write_data(s->current_dev, s->current_tag);
 732     }
 733
 734     if (!s->command_complete) {
 735         if (n) {
 736             /* Command did not complete immediately so disconnect.  */
 737             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 738             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 739             /* wait data */
 740             lsi_set_phase(s, PHASE_MI);
 741             s->msg_action = 1;
 742             lsi_queue_command(s);
 743         } else {
 744             /* wait command complete */
 745             lsi_set_phase(s, PHASE_DI);
 746         }
 747     }
 748 }
 749
 750 static void lsi_do_status(LSIState *s)
 751 {
 752     uint8_t sense;
 753     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 754     if (s->dbc != 1)
 755         BADF("Bad Status move\n");
 756     s->dbc = 1;
 757     sense = s->sense;
 758     s->sfbr = sense;
 759     cpu_physical_memory_write(s->dnad, &sense, 1);
 760     lsi_set_phase(s, PHASE_MI);
 761     s->msg_action = 1;
 762     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 763 }
 764
 765 static void lsi_disconnect(LSIState *s)
 766 {
 767     s->scntl1 &= ~LSI_SCNTL1_CON;
 768     s->sstat1 &= ~PHASE_MASK;
 769 }
 770
 771 static void lsi_do_msgin(LSIState *s)
 772 {
 773     int len;
 774     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 775     s->sfbr = s->msg[0];
 776     len = s->msg_len;
 777     if (len > s->dbc)
 778         len = s->dbc;
 779     cpu_physical_memory_write(s->dnad, s->msg, len);
 780     /* Linux drivers rely on the last byte being in the SIDL.  */
 781     s->sidl = s->msg[len - 1];
 782     s->msg_len -= len;
 783     if (s->msg_len) {
 784         memmove(s->msg, s->msg + len, s->msg_len);
 785     } else {
 786         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 787            switch to PHASE_MO.  */
 788         switch (s->msg_action) {
 789         case 0:
 790             lsi_set_phase(s, PHASE_CMD);
 791             break;
 792         case 1:
 793             lsi_disconnect(s);
 794             break;
 795         case 2:
 796             lsi_set_phase(s, PHASE_DO);
 797             break;
 798         case 3:
 799             lsi_set_phase(s, PHASE_DI);
 800             break;
 801         default:
 802             abort();
 803         }
 804     }
 805 }
 806
 807 /* Read the next byte during a MSGOUT phase.  */
 808 static uint8_t lsi_get_msgbyte(LSIState *s)
 809 {
 810     uint8_t data;
 811     cpu_physical_memory_read(s->dnad, &data, 1);
 812     s->dnad++;
 813     s->dbc--;
 814     return data;
 815 }
 816
 817 static void lsi_do_msgout(LSIState *s)
 818 {
 819     uint8_t msg;
 820     int len;
 821
 822     DPRINTF("MSG out len=%d\n", s->dbc);
 823     while (s->dbc) {
 824         msg = lsi_get_msgbyte(s);
 825         s->sfbr = msg;
 826
 827         switch (msg) {
 828         case 0x04:
 829             DPRINTF("MSG: Disconnect\n");
 830             lsi_disconnect(s);
 831             break;
 832         case 0x08:
 833             DPRINTF("MSG: No Operation\n");
 834             lsi_set_phase(s, PHASE_CMD);
 835             break;
 836         case 0x01:
 837             len = lsi_get_msgbyte(s);
 838             msg = lsi_get_msgbyte(s);
 839             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 840             switch (msg) {
 841             case 1:
 842                 DPRINTF("SDTR (ignored)\n");
 843                 s->dbc -= 2;
 844                 break;
 845             case 3:
 846                 DPRINTF("WDTR (ignored)\n");
 847                 s->dbc -= 1;
 848                 break;
 849             default:
 850                 goto bad;
 851             }
 852             break;
 853         case 0x20: /* SIMPLE queue */
 854             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 855             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 856             break;
 857         case 0x21: /* HEAD of queue */
 858             BADF("HEAD queue not implemented\n");
 859             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 860             break;
 861         case 0x22: /* ORDERED queue */
 862             BADF("ORDERED queue not implemented\n");
 863             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 864             break;
 865         default:
 866             if ((msg & 0x80) == 0) {
 867                 goto bad;
 868             }
 869             s->current_lun = msg & 7;
 870             DPRINTF("Select LUN %d\n", s->current_lun);
 871             lsi_set_phase(s, PHASE_CMD);
 872             break;
 873         }
 874     }
 875     return;
 876 bad:
 877     BADF("Unimplemented message 0x%02x\n", msg);
 878     lsi_set_phase(s, PHASE_MI);
 879     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 880     s->msg_action = 0;
 881 }
 882
 883 /* Sign extend a 24-bit value.  */
 884 static inline int32_t sxt24(int32_t n)
 885 {
 886     return (n << 8) >> 8;
 887 }
 888
 889 #define LSI_BUF_SIZE 4096
 890 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 891 {
 892     int n;
 893     uint8_t buf[LSI_BUF_SIZE];
 894
 895     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 896     while (count) {
 897         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
 898         cpu_physical_memory_read(src, buf, n);
 899         cpu_physical_memory_write(dest, buf, n);
 900         src += n;
 901         dest += n;
 902         count -= n;
 903     }
 904 }
 905
 906 static void lsi_wait_reselect(LSIState *s)
 907 {
 908     int i;
 909     DPRINTF("Wait Reselect\n");
 910     if (s->current_dma_len)
 911         BADF("Reselect with pending DMA\n");
 912     for (i = 0; i < s->active_commands; i++) {
 913         if (s->queue[i].pending) {
 914             lsi_reselect(s, s->queue[i].tag);
 915             break;
 916         }
 917     }
 918     if (s->current_dma_len == 0) {
 919         s->waiting = 1;
 920     }
 921 }
 922
 923 static void lsi_execute_script(LSIState *s)
 924 {
 925     uint32_t insn;
 926     uint32_t addr, addr_high;
 927     int opcode;
 928     int insn_processed = 0;
 929
 930     s->istat1 |= LSI_ISTAT1_SRUN;
 931 again:
 932     insn_processed++;
 933     insn = read_dword(s, s->dsp);
 934     if (!insn) {
 935         /* If we receive an empty opcode increment the DSP by 4 bytes
 936            instead of 8 and execute the next opcode at that location */
 937         s->dsp += 4;
 938         goto again;
 939     }
 940     addr = read_dword(s, s->dsp + 4);
 941     addr_high = 0;
 942     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 943     s->dsps = addr;
 944     s->dcmd = insn >> 24;
 945     s->dsp += 8;
 946     switch (insn >> 30) {
 947     case 0: /* Block move.  */
 948         if (s->sist1 & LSI_SIST1_STO) {
 949             DPRINTF("Delayed select timeout\n");
 950             lsi_stop_script(s);
 951             break;
 952         }
 953         s->dbc = insn & 0xffffff;
 954         s->rbc = s->dbc;
 955         /* ??? Set ESA.  */
 956         s->ia = s->dsp - 8;
 957         if (insn & (1 << 29)) {
 958             /* Indirect addressing.  */
 959             addr = read_dword(s, addr);
 960         } else if (insn & (1 << 28)) {
 961             uint32_t buf[2];
 962             int32_t offset;
 963             /* Table indirect addressing.  */
 964
 965             /* 32-bit Table indirect */
 966             offset = sxt24(addr);
 967             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 968             /* byte count is stored in bits 0:23 only */
 969             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 970             s->rbc = s->dbc;
 971             addr = cpu_to_le32(buf[1]);
 972
 973             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 974              * table, bits [31:24] */
 975             if (lsi_dma_40bit(s))
 976                 addr_high = cpu_to_le32(buf[0]) >> 24;
 977             else if (lsi_dma_ti64bit(s)) {
 978                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
 979                 switch (selector) {
 980                 case 0 ... 0x0f:
 981                     /* offset index into scratch registers since
 982                      * TI64 mode can use registers C to R */
 983                     addr_high = s->scratch[2 + selector];
 984                     break;
 985                 case 0x10:
 986                     addr_high = s->mmrs;
 987                     break;
 988                 case 0x11:
 989                     addr_high = s->mmws;
 990                     break;
 991                 case 0x12:
 992                     addr_high = s->sfs;
 993                     break;
 994                 case 0x13:
 995                     addr_high = s->drs;
 996                     break;
 997                 case 0x14:
 998                     addr_high = s->sbms;
 999                     break;
1000                 case 0x15:
1001                     addr_high = s->dbms;
1002                     break;
1003                 default:
1004                     BADF("Illegal selector specified (0x%x > 0x15)"
1005                          " for 64-bit DMA block move", selector);
1006                     break;
1007                 }
1008             }
1009         } else if (lsi_dma_64bit(s)) {
1010             /* fetch a 3rd dword if 64-bit direct move is enabled and
1011                only if we're not doing table indirect or indirect addressing */
1012             s->dbms = read_dword(s, s->dsp);
1013             s->dsp += 4;
1014             s->ia = s->dsp - 12;
1015         }
1016         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1017             DPRINTF("Wrong phase got %d expected %d\n",
1018                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1019             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1020             break;
1021         }
1022         s->dnad = addr;
1023         s->dnad64 = addr_high;
1024         switch (s->sstat1 & 0x7) {
1025         case PHASE_DO:
1026             s->waiting = 2;
1027             lsi_do_dma(s, 1);
1028             if (s->waiting)
1029                 s->waiting = 3;
1030             break;
1031         case PHASE_DI:
1032             s->waiting = 2;
1033             lsi_do_dma(s, 0);
1034             if (s->waiting)
1035                 s->waiting = 3;
1036             break;
1037         case PHASE_CMD:
1038             lsi_do_command(s);
1039             break;
1040         case PHASE_ST:
1041             lsi_do_status(s);
1042             break;
1043         case PHASE_MO:
1044             lsi_do_msgout(s);
1045             break;
1046         case PHASE_MI:
1047             lsi_do_msgin(s);
1048             break;
1049         default:
1050             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1051             exit(1);
1052         }
1053         s->dfifo = s->dbc & 0xff;
1054         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1055         s->sbc = s->dbc;
1056         s->rbc -= s->dbc;
1057         s->ua = addr + s->dbc;
1058         break;
1059
1060     case 1: /* IO or Read/Write instruction.  */
1061         opcode = (insn >> 27) & 7;
1062         if (opcode < 5) {
1063             uint32_t id;
1064
1065             if (insn & (1 << 25)) {
1066                 id = read_dword(s, s->dsa + sxt24(insn));
1067             } else {
1068                 id = insn;
1069             }
1070             id = (id >> 16) & 0xf;
1071             if (insn & (1 << 26)) {
1072                 addr = s->dsp + sxt24(addr);
1073             }
1074             s->dnad = addr;
1075             switch (opcode) {
1076             case 0: /* Select */
1077                 s->sdid = id;
1078                 if (s->scntl1 & LSI_SCNTL1_CON) {
1079                     DPRINTF("Already reselected, jumping to alternative address\n");
1080                     s->dsp = s->dnad;
1081                     break;
1082                 }
1083                 s->sstat0 |= LSI_SSTAT0_WOA;
1084                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1085                 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1086                     DPRINTF("Selected absent target %d\n", id);
1087                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1088                     lsi_disconnect(s);
1089                     break;
1090                 }
1091                 DPRINTF("Selected target %d%s\n",
1092                         id, insn & (1 << 3) ? " ATN" : "");
1093                 /* ??? Linux drivers compain when this is set.  Maybe
1094                    it only applies in low-level mode (unimplemented).
1095                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1096                 s->current_dev = s->bus.devs[id];
1097                 s->current_tag = id << 8;
1098                 s->scntl1 |= LSI_SCNTL1_CON;
1099                 if (insn & (1 << 3)) {
1100                     s->socl |= LSI_SOCL_ATN;
1101                 }
1102                 lsi_set_phase(s, PHASE_MO);
1103                 break;
1104             case 1: /* Disconnect */
1105                 DPRINTF("Wait Disconnect\n");
1106                 s->scntl1 &= ~LSI_SCNTL1_CON;
1107                 break;
1108             case 2: /* Wait Reselect */
1109                 if (!lsi_irq_on_rsl(s)) {
1110                     lsi_wait_reselect(s);
1111                 }
1112                 break;
1113             case 3: /* Set */
1114                 DPRINTF("Set%s%s%s%s\n",
1115                         insn & (1 << 3) ? " ATN" : "",
1116                         insn & (1 << 6) ? " ACK" : "",
1117                         insn & (1 << 9) ? " TM" : "",
1118                         insn & (1 << 10) ? " CC" : "");
1119                 if (insn & (1 << 3)) {
1120                     s->socl |= LSI_SOCL_ATN;
1121                     lsi_set_phase(s, PHASE_MO);
1122                 }
1123                 if (insn & (1 << 9)) {
1124                     BADF("Target mode not implemented\n");
1125                     exit(1);
1126                 }
1127                 if (insn & (1 << 10))
1128                     s->carry = 1;
1129                 break;
1130             case 4: /* Clear */
1131                 DPRINTF("Clear%s%s%s%s\n",
1132                         insn & (1 << 3) ? " ATN" : "",
1133                         insn & (1 << 6) ? " ACK" : "",
1134                         insn & (1 << 9) ? " TM" : "",
1135                         insn & (1 << 10) ? " CC" : "");
1136                 if (insn & (1 << 3)) {
1137                     s->socl &= ~LSI_SOCL_ATN;
1138                 }
1139                 if (insn & (1 << 10))
1140                     s->carry = 0;
1141                 break;
1142             }
1143         } else {
1144             uint8_t op0;
1145             uint8_t op1;
1146             uint8_t data8;
1147             int reg;
1148             int operator;
1149 #ifdef DEBUG_LSI
1150             static const char *opcode_names[3] =
1151                 {"Write", "Read", "Read-Modify-Write"};
1152             static const char *operator_names[8] =
1153                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1154 #endif
1155
1156             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1157             data8 = (insn >> 8) & 0xff;
1158             opcode = (insn >> 27) & 7;
1159             operator = (insn >> 24) & 7;
1160             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1161                     opcode_names[opcode - 5], reg,
1162                     operator_names[operator], data8, s->sfbr,
1163                     (insn & (1 << 23)) ? " SFBR" : "");
1164             op0 = op1 = 0;
1165             switch (opcode) {
1166             case 5: /* From SFBR */
1167                 op0 = s->sfbr;
1168                 op1 = data8;
1169                 break;
1170             case 6: /* To SFBR */
1171                 if (operator)
1172                     op0 = lsi_reg_readb(s, reg);
1173                 op1 = data8;
1174                 break;
1175             case 7: /* Read-modify-write */
1176                 if (operator)
1177                     op0 = lsi_reg_readb(s, reg);
1178                 if (insn & (1 << 23)) {
1179                     op1 = s->sfbr;
1180                 } else {
1181                     op1 = data8;
1182                 }
1183                 break;
1184             }
1185
1186             switch (operator) {
1187             case 0: /* move */
1188                 op0 = op1;
1189                 break;
1190             case 1: /* Shift left */
1191                 op1 = op0 >> 7;
1192                 op0 = (op0 << 1) | s->carry;
1193                 s->carry = op1;
1194                 break;
1195             case 2: /* OR */
1196                 op0 |= op1;
1197                 break;
1198             case 3: /* XOR */
1199                 op0 ^= op1;
1200                 break;
1201             case 4: /* AND */
1202                 op0 &= op1;
1203                 break;
1204             case 5: /* SHR */
1205                 op1 = op0 & 1;
1206                 op0 = (op0 >> 1) | (s->carry << 7);
1207                 s->carry = op1;
1208                 break;
1209             case 6: /* ADD */
1210                 op0 += op1;
1211                 s->carry = op0 < op1;
1212                 break;
1213             case 7: /* ADC */
1214                 op0 += op1 + s->carry;
1215                 if (s->carry)
1216                     s->carry = op0 <= op1;
1217                 else
1218                     s->carry = op0 < op1;
1219                 break;
1220             }
1221
1222             switch (opcode) {
1223             case 5: /* From SFBR */
1224             case 7: /* Read-modify-write */
1225                 lsi_reg_writeb(s, reg, op0);
1226                 break;
1227             case 6: /* To SFBR */
1228                 s->sfbr = op0;
1229                 break;
1230             }
1231         }
1232         break;
1233
1234     case 2: /* Transfer Control.  */
1235         {
1236             int cond;
1237             int jmp;
1238
1239             if ((insn & 0x002e0000) == 0) {
1240                 DPRINTF("NOP\n");
1241                 break;
1242             }
1243             if (s->sist1 & LSI_SIST1_STO) {
1244                 DPRINTF("Delayed select timeout\n");
1245                 lsi_stop_script(s);
1246                 break;
1247             }
1248             cond = jmp = (insn & (1 << 19)) != 0;
1249             if (cond == jmp && (insn & (1 << 21))) {
1250                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1251                 cond = s->carry != 0;
1252             }
1253             if (cond == jmp && (insn & (1 << 17))) {
1254                 DPRINTF("Compare phase %d %c= %d\n",
1255                         (s->sstat1 & PHASE_MASK),
1256                         jmp ? '=' : '!',
1257                         ((insn >> 24) & 7));
1258                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1259             }
1260             if (cond == jmp && (insn & (1 << 18))) {
1261                 uint8_t mask;
1262
1263                 mask = (~insn >> 8) & 0xff;
1264                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1265                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1266                 cond = (s->sfbr & mask) == (insn & mask);
1267             }
1268             if (cond == jmp) {
1269                 if (insn & (1 << 23)) {
1270                     /* Relative address.  */
1271                     addr = s->dsp + sxt24(addr);
1272                 }
1273                 switch ((insn >> 27) & 7) {
1274                 case 0: /* Jump */
1275                     DPRINTF("Jump to 0x%08x\n", addr);
1276                     s->dsp = addr;
1277                     break;
1278                 case 1: /* Call */
1279                     DPRINTF("Call 0x%08x\n", addr);
1280                     s->temp = s->dsp;
1281                     s->dsp = addr;
1282                     break;
1283                 case 2: /* Return */
1284                     DPRINTF("Return to 0x%08x\n", s->temp);
1285                     s->dsp = s->temp;
1286                     break;
1287                 case 3: /* Interrupt */
1288                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1289                     if ((insn & (1 << 20)) != 0) {
1290                         s->istat0 |= LSI_ISTAT0_INTF;
1291                         lsi_update_irq(s);
1292                     } else {
1293                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1294                     }
1295                     break;
1296                 default:
1297                     DPRINTF("Illegal transfer control\n");
1298                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1299                     break;
1300                 }
1301             } else {
1302                 DPRINTF("Control condition failed\n");
1303             }
1304         }
1305         break;
1306
1307     case 3:
1308         if ((insn & (1 << 29)) == 0) {
1309             /* Memory move.  */
1310             uint32_t dest;
1311             /* ??? The docs imply the destination address is loaded into
1312                the TEMP register.  However the Linux drivers rely on
1313                the value being presrved.  */
1314             dest = read_dword(s, s->dsp);
1315             s->dsp += 4;
1316             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1317         } else {
1318             uint8_t data[7];
1319             int reg;
1320             int n;
1321             int i;
1322
1323             if (insn & (1 << 28)) {
1324                 addr = s->dsa + sxt24(addr);
1325             }
1326             n = (insn & 7);
1327             reg = (insn >> 16) & 0xff;
1328             if (insn & (1 << 24)) {
1329                 cpu_physical_memory_read(addr, data, n);
1330                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1331                         addr, *(int *)data);
1332                 for (i = 0; i < n; i++) {
1333                     lsi_reg_writeb(s, reg + i, data[i]);
1334                 }
1335             } else {
1336                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1337                 for (i = 0; i < n; i++) {
1338                     data[i] = lsi_reg_readb(s, reg + i);
1339                 }
1340                 cpu_physical_memory_write(addr, data, n);
1341             }
1342         }
1343     }
1344     if (insn_processed > 10000 && !s->waiting) {
1345         /* Some windows drivers make the device spin waiting for a memory
1346            location to change.  If we have been executed a lot of code then
1347            assume this is the case and force an unexpected device disconnect.
1348            This is apparently sufficient to beat the drivers into submission.
1349          */
1350         if (!(s->sien0 & LSI_SIST0_UDC))
1351             fprintf(stderr, "inf. loop with UDC masked\n");
1352         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1353         lsi_disconnect(s);
1354     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1355         if (s->dcntl & LSI_DCNTL_SSM) {
1356             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1357         } else {
1358             goto again;
1359         }
1360     }
1361     DPRINTF("SCRIPTS execution stopped\n");
1362 }
1363
1364 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1365 {
1366     uint8_t tmp;
1367 #define CASE_GET_REG24(name, addr) \
1368     case addr: return s->name & 0xff; \
1369     case addr + 1: return (s->name >> 8) & 0xff; \
1370     case addr + 2: return (s->name >> 16) & 0xff;
1371
1372 #define CASE_GET_REG32(name, addr) \
1373     case addr: return s->name & 0xff; \
1374     case addr + 1: return (s->name >> 8) & 0xff; \
1375     case addr + 2: return (s->name >> 16) & 0xff; \
1376     case addr + 3: return (s->name >> 24) & 0xff;
1377
1378 #ifdef DEBUG_LSI_REG
1379     DPRINTF("Read reg %x\n", offset);
1380 #endif
1381     switch (offset) {
1382     case 0x00: /* SCNTL0 */
1383         return s->scntl0;
1384     case 0x01: /* SCNTL1 */
1385         return s->scntl1;
1386     case 0x02: /* SCNTL2 */
1387         return s->scntl2;
1388     case 0x03: /* SCNTL3 */
1389         return s->scntl3;
1390     case 0x04: /* SCID */
1391         return s->scid;
1392     case 0x05: /* SXFER */
1393         return s->sxfer;
1394     case 0x06: /* SDID */
1395         return s->sdid;
1396     case 0x07: /* GPREG0 */
1397         return 0x7f;
1398     case 0x08: /* Revision ID */
1399         return 0x00;
1400     case 0xa: /* SSID */
1401         return s->ssid;
1402     case 0xb: /* SBCL */
1403         /* ??? This is not correct. However it's (hopefully) only
1404            used for diagnostics, so should be ok.  */
1405         return 0;
1406     case 0xc: /* DSTAT */
1407         tmp = s->dstat | 0x80;
1408         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1409             s->dstat = 0;
1410         lsi_update_irq(s);
1411         return tmp;
1412     case 0x0d: /* SSTAT0 */
1413         return s->sstat0;
1414     case 0x0e: /* SSTAT1 */
1415         return s->sstat1;
1416     case 0x0f: /* SSTAT2 */
1417         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1418     CASE_GET_REG32(dsa, 0x10)
1419     case 0x14: /* ISTAT0 */
1420         return s->istat0;
1421     case 0x15: /* ISTAT1 */
1422         return s->istat1;
1423     case 0x16: /* MBOX0 */
1424         return s->mbox0;
1425     case 0x17: /* MBOX1 */
1426         return s->mbox1;
1427     case 0x18: /* CTEST0 */
1428         return 0xff;
1429     case 0x19: /* CTEST1 */
1430         return 0;
1431     case 0x1a: /* CTEST2 */
1432         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1433         if (s->istat0 & LSI_ISTAT0_SIGP) {
1434             s->istat0 &= ~LSI_ISTAT0_SIGP;
1435             tmp |= LSI_CTEST2_SIGP;
1436         }
1437         return tmp;
1438     case 0x1b: /* CTEST3 */
1439         return s->ctest3;
1440     CASE_GET_REG32(temp, 0x1c)
1441     case 0x20: /* DFIFO */
1442         return 0;
1443     case 0x21: /* CTEST4 */
1444         return s->ctest4;
1445     case 0x22: /* CTEST5 */
1446         return s->ctest5;
1447     case 0x23: /* CTEST6 */
1448          return 0;
1449     CASE_GET_REG24(dbc, 0x24)
1450     case 0x27: /* DCMD */
1451         return s->dcmd;
1452     CASE_GET_REG32(dnad, 0x28)
1453     CASE_GET_REG32(dsp, 0x2c)
1454     CASE_GET_REG32(dsps, 0x30)
1455     CASE_GET_REG32(scratch[0], 0x34)
1456     case 0x38: /* DMODE */
1457         return s->dmode;
1458     case 0x39: /* DIEN */
1459         return s->dien;
1460     case 0x3a: /* SBR */
1461         return s->sbr;
1462     case 0x3b: /* DCNTL */
1463         return s->dcntl;
1464     case 0x40: /* SIEN0 */
1465         return s->sien0;
1466     case 0x41: /* SIEN1 */
1467         return s->sien1;
1468     case 0x42: /* SIST0 */
1469         tmp = s->sist0;
1470         s->sist0 = 0;
1471         lsi_update_irq(s);
1472         return tmp;
1473     case 0x43: /* SIST1 */
1474         tmp = s->sist1;
1475         s->sist1 = 0;
1476         lsi_update_irq(s);
1477         return tmp;
1478     case 0x46: /* MACNTL */
1479         return 0x0f;
1480     case 0x47: /* GPCNTL0 */
1481         return 0x0f;
1482     case 0x48: /* STIME0 */
1483         return s->stime0;
1484     case 0x4a: /* RESPID0 */
1485         return s->respid0;
1486     case 0x4b: /* RESPID1 */
1487         return s->respid1;
1488     case 0x4d: /* STEST1 */
1489         return s->stest1;
1490     case 0x4e: /* STEST2 */
1491         return s->stest2;
1492     case 0x4f: /* STEST3 */
1493         return s->stest3;
1494     case 0x50: /* SIDL */
1495         /* This is needed by the linux drivers.  We currently only update it
1496            during the MSG IN phase.  */
1497         return s->sidl;
1498     case 0x52: /* STEST4 */
1499         return 0xe0;
1500     case 0x56: /* CCNTL0 */
1501         return s->ccntl0;
1502     case 0x57: /* CCNTL1 */
1503         return s->ccntl1;
1504     case 0x58: /* SBDL */
1505         /* Some drivers peek at the data bus during the MSG IN phase.  */
1506         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1507             return s->msg[0];
1508         return 0;
1509     case 0x59: /* SBDL high */
1510         return 0;
1511     CASE_GET_REG32(mmrs, 0xa0)
1512     CASE_GET_REG32(mmws, 0xa4)
1513     CASE_GET_REG32(sfs, 0xa8)
1514     CASE_GET_REG32(drs, 0xac)
1515     CASE_GET_REG32(sbms, 0xb0)
1516     CASE_GET_REG32(dbms, 0xb4)
1517     CASE_GET_REG32(dnad64, 0xb8)
1518     CASE_GET_REG32(pmjad1, 0xc0)
1519     CASE_GET_REG32(pmjad2, 0xc4)
1520     CASE_GET_REG32(rbc, 0xc8)
1521     CASE_GET_REG32(ua, 0xcc)
1522     CASE_GET_REG32(ia, 0xd4)
1523     CASE_GET_REG32(sbc, 0xd8)
1524     CASE_GET_REG32(csbc, 0xdc)
1525     }
1526     if (offset >= 0x5c && offset < 0xa0) {
1527         int n;
1528         int shift;
1529         n = (offset - 0x58) >> 2;
1530         shift = (offset & 3) * 8;
1531         return (s->scratch[n] >> shift) & 0xff;
1532     }
1533     BADF("readb 0x%x\n", offset);
1534     exit(1);
1535 #undef CASE_GET_REG24
1536 #undef CASE_GET_REG32
1537 }
1538
1539 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1540 {
1541 #define CASE_SET_REG24(name, addr) \
1542     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1543     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1544     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1545
1546 #define CASE_SET_REG32(name, addr) \
1547     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1548     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1549     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1550     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1551
1552 #ifdef DEBUG_LSI_REG
1553     DPRINTF("Write reg %x = %02x\n", offset, val);
1554 #endif
1555     switch (offset) {
1556     case 0x00: /* SCNTL0 */
1557         s->scntl0 = val;
1558         if (val & LSI_SCNTL0_START) {
1559             BADF("Start sequence not implemented\n");
1560         }
1561         break;
1562     case 0x01: /* SCNTL1 */
1563         s->scntl1 = val & ~LSI_SCNTL1_SST;
1564         if (val & LSI_SCNTL1_IARB) {
1565             BADF("Immediate Arbritration not implemented\n");
1566         }
1567         if (val & LSI_SCNTL1_RST) {
1568             s->sstat0 |= LSI_SSTAT0_RST;
1569             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1570         } else {
1571             s->sstat0 &= ~LSI_SSTAT0_RST;
1572         }
1573         break;
1574     case 0x02: /* SCNTL2 */
1575         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1576         s->scntl2 = val;
1577         break;
1578     case 0x03: /* SCNTL3 */
1579         s->scntl3 = val;
1580         break;
1581     case 0x04: /* SCID */
1582         s->scid = val;
1583         break;
1584     case 0x05: /* SXFER */
1585         s->sxfer = val;
1586         break;
1587     case 0x06: /* SDID */
1588         if ((val & 0xf) != (s->ssid & 0xf))
1589             BADF("Destination ID does not match SSID\n");
1590         s->sdid = val & 0xf;
1591         break;
1592     case 0x07: /* GPREG0 */
1593         break;
1594     case 0x08: /* SFBR */
1595         /* The CPU is not allowed to write to this register.  However the
1596            SCRIPTS register move instructions are.  */
1597         s->sfbr = val;
1598         break;
1599     case 0x0a: case 0x0b:
1600         /* Openserver writes to these readonly registers on startup */
1601         return;
1602     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1603         /* Linux writes to these readonly registers on startup.  */
1604         return;
1605     CASE_SET_REG32(dsa, 0x10)
1606     case 0x14: /* ISTAT0 */
1607         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1608         if (val & LSI_ISTAT0_ABRT) {
1609             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1610         }
1611         if (val & LSI_ISTAT0_INTF) {
1612             s->istat0 &= ~LSI_ISTAT0_INTF;
1613             lsi_update_irq(s);
1614         }
1615         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1616             DPRINTF("Woken by SIGP\n");
1617             s->waiting = 0;
1618             s->dsp = s->dnad;
1619             lsi_execute_script(s);
1620         }
1621         if (val & LSI_ISTAT0_SRST) {
1622             lsi_soft_reset(s);
1623         }
1624         break;
1625     case 0x16: /* MBOX0 */
1626         s->mbox0 = val;
1627         break;
1628     case 0x17: /* MBOX1 */
1629         s->mbox1 = val;
1630         break;
1631     case 0x1a: /* CTEST2 */
1632         s->ctest2 = val & LSI_CTEST2_PCICIE;
1633         break;
1634     case 0x1b: /* CTEST3 */
1635         s->ctest3 = val & 0x0f;
1636         break;
1637     CASE_SET_REG32(temp, 0x1c)
1638     case 0x21: /* CTEST4 */
1639         if (val & 7) {
1640            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1641         }
1642         s->ctest4 = val;
1643         break;
1644     case 0x22: /* CTEST5 */
1645         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1646             BADF("CTEST5 DMA increment not implemented\n");
1647         }
1648         s->ctest5 = val;
1649         break;
1650     CASE_SET_REG24(dbc, 0x24)
1651     CASE_SET_REG32(dnad, 0x28)
1652     case 0x2c: /* DSP[0:7] */
1653         s->dsp &= 0xffffff00;
1654         s->dsp |= val;
1655         break;
1656     case 0x2d: /* DSP[8:15] */
1657         s->dsp &= 0xffff00ff;
1658         s->dsp |= val << 8;
1659         break;
1660     case 0x2e: /* DSP[16:23] */
1661         s->dsp &= 0xff00ffff;
1662         s->dsp |= val << 16;
1663         break;
1664     case 0x2f: /* DSP[24:31] */
1665         s->dsp &= 0x00ffffff;
1666         s->dsp |= val << 24;
1667         if ((s->dmode & LSI_DMODE_MAN) == 0
1668             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1669             lsi_execute_script(s);
1670         break;
1671     CASE_SET_REG32(dsps, 0x30)
1672     CASE_SET_REG32(scratch[0], 0x34)
1673     case 0x38: /* DMODE */
1674         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1675             BADF("IO mappings not implemented\n");
1676         }
1677         s->dmode = val;
1678         break;
1679     case 0x39: /* DIEN */
1680         s->dien = val;
1681         lsi_update_irq(s);
1682         break;
1683     case 0x3a: /* SBR */
1684         s->sbr = val;
1685         break;
1686     case 0x3b: /* DCNTL */
1687         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1688         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1689             lsi_execute_script(s);
1690         break;
1691     case 0x40: /* SIEN0 */
1692         s->sien0 = val;
1693         lsi_update_irq(s);
1694         break;
1695     case 0x41: /* SIEN1 */
1696         s->sien1 = val;
1697         lsi_update_irq(s);
1698         break;
1699     case 0x47: /* GPCNTL0 */
1700         break;
1701     case 0x48: /* STIME0 */
1702         s->stime0 = val;
1703         break;
1704     case 0x49: /* STIME1 */
1705         if (val & 0xf) {
1706             DPRINTF("General purpose timer not implemented\n");
1707             /* ??? Raising the interrupt immediately seems to be sufficient
1708                to keep the FreeBSD driver happy.  */
1709             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1710         }
1711         break;
1712     case 0x4a: /* RESPID0 */
1713         s->respid0 = val;
1714         break;
1715     case 0x4b: /* RESPID1 */
1716         s->respid1 = val;
1717         break;
1718     case 0x4d: /* STEST1 */
1719         s->stest1 = val;
1720         break;
1721     case 0x4e: /* STEST2 */
1722         if (val & 1) {
1723             BADF("Low level mode not implemented\n");
1724         }
1725         s->stest2 = val;
1726         break;
1727     case 0x4f: /* STEST3 */
1728         if (val & 0x41) {
1729             BADF("SCSI FIFO test mode not implemented\n");
1730         }
1731         s->stest3 = val;
1732         break;
1733     case 0x56: /* CCNTL0 */
1734         s->ccntl0 = val;
1735         break;
1736     case 0x57: /* CCNTL1 */
1737         s->ccntl1 = val;
1738         break;
1739     CASE_SET_REG32(mmrs, 0xa0)
1740     CASE_SET_REG32(mmws, 0xa4)
1741     CASE_SET_REG32(sfs, 0xa8)
1742     CASE_SET_REG32(drs, 0xac)
1743     CASE_SET_REG32(sbms, 0xb0)
1744     CASE_SET_REG32(dbms, 0xb4)
1745     CASE_SET_REG32(dnad64, 0xb8)
1746     CASE_SET_REG32(pmjad1, 0xc0)
1747     CASE_SET_REG32(pmjad2, 0xc4)
1748     CASE_SET_REG32(rbc, 0xc8)
1749     CASE_SET_REG32(ua, 0xcc)
1750     CASE_SET_REG32(ia, 0xd4)
1751     CASE_SET_REG32(sbc, 0xd8)
1752     CASE_SET_REG32(csbc, 0xdc)
1753     default:
1754         if (offset >= 0x5c && offset < 0xa0) {
1755             int n;
1756             int shift;
1757             n = (offset - 0x58) >> 2;
1758             shift = (offset & 3) * 8;
1759             s->scratch[n] &= ~(0xff << shift);
1760             s->scratch[n] |= (val & 0xff) << shift;
1761         } else {
1762             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1763         }
1764     }
1765 #undef CASE_SET_REG24
1766 #undef CASE_SET_REG32
1767 }
1768
1769 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1770 {
1771     LSIState *s = opaque;
1772
1773     lsi_reg_writeb(s, addr & 0xff, val);
1774 }
1775
1776 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1777 {
1778     LSIState *s = opaque;
1779
1780     addr &= 0xff;
1781     lsi_reg_writeb(s, addr, val & 0xff);
1782     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1783 }
1784
1785 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1786 {
1787     LSIState *s = opaque;
1788
1789     addr &= 0xff;
1790     lsi_reg_writeb(s, addr, val & 0xff);
1791     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1792     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1793     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1794 }
1795
1796 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1797 {
1798     LSIState *s = opaque;
1799
1800     return lsi_reg_readb(s, addr & 0xff);
1801 }
1802
1803 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1804 {
1805     LSIState *s = opaque;
1806     uint32_t val;
1807
1808     addr &= 0xff;
1809     val = lsi_reg_readb(s, addr);
1810     val |= lsi_reg_readb(s, addr + 1) << 8;
1811     return val;
1812 }
1813
1814 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1815 {
1816     LSIState *s = opaque;
1817     uint32_t val;
1818     addr &= 0xff;
1819     val = lsi_reg_readb(s, addr);
1820     val |= lsi_reg_readb(s, addr + 1) << 8;
1821     val |= lsi_reg_readb(s, addr + 2) << 16;
1822     val |= lsi_reg_readb(s, addr + 3) << 24;
1823     return val;
1824 }
1825
1826 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1827     lsi_mmio_readb,
1828     lsi_mmio_readw,
1829     lsi_mmio_readl,
1830 };
1831
1832 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1833     lsi_mmio_writeb,
1834     lsi_mmio_writew,
1835     lsi_mmio_writel,
1836 };
1837
1838 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1839 {
1840     LSIState *s = opaque;
1841     uint32_t newval;
1842     int shift;
1843
1844     addr &= 0x1fff;
1845     newval = s->script_ram[addr >> 2];
1846     shift = (addr & 3) * 8;
1847     newval &= ~(0xff << shift);
1848     newval |= val << shift;
1849     s->script_ram[addr >> 2] = newval;
1850 }
1851
1852 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1853 {
1854     LSIState *s = opaque;
1855     uint32_t newval;
1856
1857     addr &= 0x1fff;
1858     newval = s->script_ram[addr >> 2];
1859     if (addr & 2) {
1860         newval = (newval & 0xffff) | (val << 16);
1861     } else {
1862         newval = (newval & 0xffff0000) | val;
1863     }
1864     s->script_ram[addr >> 2] = newval;
1865 }
1866
1867
1868 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1869 {
1870     LSIState *s = opaque;
1871
1872     addr &= 0x1fff;
1873     s->script_ram[addr >> 2] = val;
1874 }
1875
1876 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1877 {
1878     LSIState *s = opaque;
1879     uint32_t val;
1880
1881     addr &= 0x1fff;
1882     val = s->script_ram[addr >> 2];
1883     val >>= (addr & 3) * 8;
1884     return val & 0xff;
1885 }
1886
1887 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1888 {
1889     LSIState *s = opaque;
1890     uint32_t val;
1891
1892     addr &= 0x1fff;
1893     val = s->script_ram[addr >> 2];
1894     if (addr & 2)
1895         val >>= 16;
1896     return le16_to_cpu(val);
1897 }
1898
1899 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1900 {
1901     LSIState *s = opaque;
1902
1903     addr &= 0x1fff;
1904     return le32_to_cpu(s->script_ram[addr >> 2]);
1905 }
1906
1907 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1908     lsi_ram_readb,
1909     lsi_ram_readw,
1910     lsi_ram_readl,
1911 };
1912
1913 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1914     lsi_ram_writeb,
1915     lsi_ram_writew,
1916     lsi_ram_writel,
1917 };
1918
1919 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1920 {
1921     LSIState *s = opaque;
1922     return lsi_reg_readb(s, addr & 0xff);
1923 }
1924
1925 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1926 {
1927     LSIState *s = opaque;
1928     uint32_t val;
1929     addr &= 0xff;
1930     val = lsi_reg_readb(s, addr);
1931     val |= lsi_reg_readb(s, addr + 1) << 8;
1932     return val;
1933 }
1934
1935 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1936 {
1937     LSIState *s = opaque;
1938     uint32_t val;
1939     addr &= 0xff;
1940     val = lsi_reg_readb(s, addr);
1941     val |= lsi_reg_readb(s, addr + 1) << 8;
1942     val |= lsi_reg_readb(s, addr + 2) << 16;
1943     val |= lsi_reg_readb(s, addr + 3) << 24;
1944     return val;
1945 }
1946
1947 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1948 {
1949     LSIState *s = opaque;
1950     lsi_reg_writeb(s, addr & 0xff, val);
1951 }
1952
1953 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1954 {
1955     LSIState *s = opaque;
1956     addr &= 0xff;
1957     lsi_reg_writeb(s, addr, val & 0xff);
1958     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1959 }
1960
1961 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1962 {
1963     LSIState *s = opaque;
1964     addr &= 0xff;
1965     lsi_reg_writeb(s, addr, val & 0xff);
1966     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1967     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1968     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1969 }
1970
1971 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1972                            pcibus_t addr, pcibus_t size, int type)
1973 {
1974     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1975
1976     DPRINTF("Mapping IO at %08"FMT_PCIBUS"\n", addr);
1977
1978     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1979     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1980     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1981     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1982     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1983     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1984 }
1985
1986 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1987                             pcibus_t addr, pcibus_t size, int type)
1988 {
1989     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1990
1991     DPRINTF("Mapping ram at %08"FMT_PCIBUS"\n", addr);
1992     s->script_ram_base = addr;
1993     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1994 }
1995
1996 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1997                              pcibus_t addr, pcibus_t size, int type)
1998 {
1999     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
2000
2001     DPRINTF("Mapping registers at %08"FMT_PCIBUS"\n", addr);
2002     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
2003 }
2004
2005 static void lsi_pre_save(void *opaque)
2006 {
2007     LSIState *s = opaque;
2008
2009     assert(s->dma_buf == NULL);
2010     assert(s->current_dma_len == 0);
2011     assert(s->active_commands == 0);
2012 }
2013
2014 static const VMStateDescription vmstate_lsi_scsi = {
2015     .name = "lsiscsi",
2016     .version_id = 0,
2017     .minimum_version_id = 0,
2018     .minimum_version_id_old = 0,
2019     .pre_save = lsi_pre_save,
2020     .fields      = (VMStateField []) {
2021         VMSTATE_PCI_DEVICE(dev, LSIState),
2022
2023         VMSTATE_INT32(carry, LSIState),
2024         VMSTATE_INT32(sense, LSIState),
2025         VMSTATE_INT32(msg_action, LSIState),
2026         VMSTATE_INT32(msg_len, LSIState),
2027         VMSTATE_BUFFER(msg, LSIState),
2028         VMSTATE_INT32(waiting, LSIState),
2029
2030         VMSTATE_UINT32(dsa, LSIState),
2031         VMSTATE_UINT32(temp, LSIState),
2032         VMSTATE_UINT32(dnad, LSIState),
2033         VMSTATE_UINT32(dbc, LSIState),
2034         VMSTATE_UINT8(istat0, LSIState),
2035         VMSTATE_UINT8(istat1, LSIState),
2036         VMSTATE_UINT8(dcmd, LSIState),
2037         VMSTATE_UINT8(dstat, LSIState),
2038         VMSTATE_UINT8(dien, LSIState),
2039         VMSTATE_UINT8(sist0, LSIState),
2040         VMSTATE_UINT8(sist1, LSIState),
2041         VMSTATE_UINT8(sien0, LSIState),
2042         VMSTATE_UINT8(sien1, LSIState),
2043         VMSTATE_UINT8(mbox0, LSIState),
2044         VMSTATE_UINT8(mbox1, LSIState),
2045         VMSTATE_UINT8(dfifo, LSIState),
2046         VMSTATE_UINT8(ctest2, LSIState),
2047         VMSTATE_UINT8(ctest3, LSIState),
2048         VMSTATE_UINT8(ctest4, LSIState),
2049         VMSTATE_UINT8(ctest5, LSIState),
2050         VMSTATE_UINT8(ccntl0, LSIState),
2051         VMSTATE_UINT8(ccntl1, LSIState),
2052         VMSTATE_UINT32(dsp, LSIState),
2053         VMSTATE_UINT32(dsps, LSIState),
2054         VMSTATE_UINT8(dmode, LSIState),
2055         VMSTATE_UINT8(dcntl, LSIState),
2056         VMSTATE_UINT8(scntl0, LSIState),
2057         VMSTATE_UINT8(scntl1, LSIState),
2058         VMSTATE_UINT8(scntl2, LSIState),
2059         VMSTATE_UINT8(scntl3, LSIState),
2060         VMSTATE_UINT8(sstat0, LSIState),
2061         VMSTATE_UINT8(sstat1, LSIState),
2062         VMSTATE_UINT8(scid, LSIState),
2063         VMSTATE_UINT8(sxfer, LSIState),
2064         VMSTATE_UINT8(socl, LSIState),
2065         VMSTATE_UINT8(sdid, LSIState),
2066         VMSTATE_UINT8(ssid, LSIState),
2067         VMSTATE_UINT8(sfbr, LSIState),
2068         VMSTATE_UINT8(stest1, LSIState),
2069         VMSTATE_UINT8(stest2, LSIState),
2070         VMSTATE_UINT8(stest3, LSIState),
2071         VMSTATE_UINT8(sidl, LSIState),
2072         VMSTATE_UINT8(stime0, LSIState),
2073         VMSTATE_UINT8(respid0, LSIState),
2074         VMSTATE_UINT8(respid1, LSIState),
2075         VMSTATE_UINT32(mmrs, LSIState),
2076         VMSTATE_UINT32(mmws, LSIState),
2077         VMSTATE_UINT32(sfs, LSIState),
2078         VMSTATE_UINT32(drs, LSIState),
2079         VMSTATE_UINT32(sbms, LSIState),
2080         VMSTATE_UINT32(dbms, LSIState),
2081         VMSTATE_UINT32(dnad64, LSIState),
2082         VMSTATE_UINT32(pmjad1, LSIState),
2083         VMSTATE_UINT32(pmjad2, LSIState),
2084         VMSTATE_UINT32(rbc, LSIState),
2085         VMSTATE_UINT32(ua, LSIState),
2086         VMSTATE_UINT32(ia, LSIState),
2087         VMSTATE_UINT32(sbc, LSIState),
2088         VMSTATE_UINT32(csbc, LSIState),
2089         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2090         VMSTATE_UINT8(sbr, LSIState),
2091
2092         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2093         VMSTATE_END_OF_LIST()
2094     }
2095 };
2096
2097 static int lsi_scsi_uninit(PCIDevice *d)
2098 {
2099     LSIState *s = DO_UPCAST(LSIState, dev, d);
2100
2101     cpu_unregister_io_memory(s->mmio_io_addr);
2102     cpu_unregister_io_memory(s->ram_io_addr);
2103
2104     qemu_free(s->queue);
2105
2106     return 0;
2107 }
2108
2109 static int lsi_scsi_init(PCIDevice *dev)
2110 {
2111     LSIState *s = DO_UPCAST(LSIState, dev, dev);
2112     uint8_t *pci_conf;
2113
2114     pci_conf = s->dev.config;
2115
2116     /* PCI Vendor ID (word) */
2117     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2118     /* PCI device ID (word) */
2119     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2120     /* PCI base class code */
2121     pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2122     /* PCI subsystem ID */
2123     pci_conf[PCI_SUBSYSTEM_ID] = 0x00;
2124     pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;
2125     /* PCI latency timer = 255 */
2126     pci_conf[PCI_LATENCY_TIMER] = 0xff;
2127     /* TODO: RST# value should be 0 */
2128     /* Interrupt pin 1 */
2129     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2130
2131     s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2132                                              lsi_mmio_writefn, s);
2133     s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2134                                             lsi_ram_writefn, s);
2135
2136     /* TODO: use dev and get rid of cast below */
2137     pci_register_bar((struct PCIDevice *)s, 0, 256,
2138                            PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2139     pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2140                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_mmio_mapfunc);
2141     pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2142                            PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);
2143     s->queue = qemu_malloc(sizeof(lsi_queue));
2144     s->queue_len = 1;
2145     s->active_commands = 0;
2146
2147     lsi_soft_reset(s);
2148
2149     scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2150     if (!dev->qdev.hotplugged) {
2151         scsi_bus_legacy_handle_cmdline(&s->bus);
2152     }
2153     return 0;
2154 }
2155
2156 static PCIDeviceInfo lsi_info = {
2157     .qdev.name  = "lsi53c895a",
2158     .qdev.alias = "lsi",
2159     .qdev.size  = sizeof(LSIState),
2160     .qdev.vmsd  = &vmstate_lsi_scsi,
2161     .init       = lsi_scsi_init,
2162     .exit       = lsi_scsi_uninit,
2163 };
2164
2165 static void lsi53c895a_register_devices(void)
2166 {
2167     pci_qdev_register(&lsi_info);
2168 }
2169
2170 device_init(lsi53c895a_register_devices);