hw/scsi/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include <assert.h>
  14
  15 #include "hw/hw.h"
  16 #include "hw/pci/pci.h"
  17 #include "hw/scsi/scsi.h"
  18 #include "sysemu/dma.h"
  19
  20 //#define DEBUG_LSI
  21 //#define DEBUG_LSI_REG
  22
  23 #ifdef DEBUG_LSI
  24 #define DPRINTF(fmt, ...) \
  25 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
  26 #define BADF(fmt, ...) \
  27 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
  28 #else
  29 #define DPRINTF(fmt, ...) do {} while(0)
  30 #define BADF(fmt, ...) \
  31 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
  32 #endif
  33
  34 #define LSI_MAX_DEVS 7
  35
  36 #define LSI_SCNTL0_TRG    0x01
  37 #define LSI_SCNTL0_AAP    0x02
  38 #define LSI_SCNTL0_EPC    0x08
  39 #define LSI_SCNTL0_WATN   0x10
  40 #define LSI_SCNTL0_START  0x20
  41
  42 #define LSI_SCNTL1_SST    0x01
  43 #define LSI_SCNTL1_IARB   0x02
  44 #define LSI_SCNTL1_AESP   0x04
  45 #define LSI_SCNTL1_RST    0x08
  46 #define LSI_SCNTL1_CON    0x10
  47 #define LSI_SCNTL1_DHP    0x20
  48 #define LSI_SCNTL1_ADB    0x40
  49 #define LSI_SCNTL1_EXC    0x80
  50
  51 #define LSI_SCNTL2_WSR    0x01
  52 #define LSI_SCNTL2_VUE0   0x02
  53 #define LSI_SCNTL2_VUE1   0x04
  54 #define LSI_SCNTL2_WSS    0x08
  55 #define LSI_SCNTL2_SLPHBEN 0x10
  56 #define LSI_SCNTL2_SLPMD  0x20
  57 #define LSI_SCNTL2_CHM    0x40
  58 #define LSI_SCNTL2_SDU    0x80
  59
  60 #define LSI_ISTAT0_DIP    0x01
  61 #define LSI_ISTAT0_SIP    0x02
  62 #define LSI_ISTAT0_INTF   0x04
  63 #define LSI_ISTAT0_CON    0x08
  64 #define LSI_ISTAT0_SEM    0x10
  65 #define LSI_ISTAT0_SIGP   0x20
  66 #define LSI_ISTAT0_SRST   0x40
  67 #define LSI_ISTAT0_ABRT   0x80
  68
  69 #define LSI_ISTAT1_SI     0x01
  70 #define LSI_ISTAT1_SRUN   0x02
  71 #define LSI_ISTAT1_FLSH   0x04
  72
  73 #define LSI_SSTAT0_SDP0   0x01
  74 #define LSI_SSTAT0_RST    0x02
  75 #define LSI_SSTAT0_WOA    0x04
  76 #define LSI_SSTAT0_LOA    0x08
  77 #define LSI_SSTAT0_AIP    0x10
  78 #define LSI_SSTAT0_OLF    0x20
  79 #define LSI_SSTAT0_ORF    0x40
  80 #define LSI_SSTAT0_ILF    0x80
  81
  82 #define LSI_SIST0_PAR     0x01
  83 #define LSI_SIST0_RST     0x02
  84 #define LSI_SIST0_UDC     0x04
  85 #define LSI_SIST0_SGE     0x08
  86 #define LSI_SIST0_RSL     0x10
  87 #define LSI_SIST0_SEL     0x20
  88 #define LSI_SIST0_CMP     0x40
  89 #define LSI_SIST0_MA      0x80
  90
  91 #define LSI_SIST1_HTH     0x01
  92 #define LSI_SIST1_GEN     0x02
  93 #define LSI_SIST1_STO     0x04
  94 #define LSI_SIST1_SBMC    0x10
  95
  96 #define LSI_SOCL_IO       0x01
  97 #define LSI_SOCL_CD       0x02
  98 #define LSI_SOCL_MSG      0x04
  99 #define LSI_SOCL_ATN      0x08
 100 #define LSI_SOCL_SEL      0x10
 101 #define LSI_SOCL_BSY      0x20
 102 #define LSI_SOCL_ACK      0x40
 103 #define LSI_SOCL_REQ      0x80
 104
 105 #define LSI_DSTAT_IID     0x01
 106 #define LSI_DSTAT_SIR     0x04
 107 #define LSI_DSTAT_SSI     0x08
 108 #define LSI_DSTAT_ABRT    0x10
 109 #define LSI_DSTAT_BF      0x20
 110 #define LSI_DSTAT_MDPE    0x40
 111 #define LSI_DSTAT_DFE     0x80
 112
 113 #define LSI_DCNTL_COM     0x01
 114 #define LSI_DCNTL_IRQD    0x02
 115 #define LSI_DCNTL_STD     0x04
 116 #define LSI_DCNTL_IRQM    0x08
 117 #define LSI_DCNTL_SSM     0x10
 118 #define LSI_DCNTL_PFEN    0x20
 119 #define LSI_DCNTL_PFF     0x40
 120 #define LSI_DCNTL_CLSE    0x80
 121
 122 #define LSI_DMODE_MAN     0x01
 123 #define LSI_DMODE_BOF     0x02
 124 #define LSI_DMODE_ERMP    0x04
 125 #define LSI_DMODE_ERL     0x08
 126 #define LSI_DMODE_DIOM    0x10
 127 #define LSI_DMODE_SIOM    0x20
 128
 129 #define LSI_CTEST2_DACK   0x01
 130 #define LSI_CTEST2_DREQ   0x02
 131 #define LSI_CTEST2_TEOP   0x04
 132 #define LSI_CTEST2_PCICIE 0x08
 133 #define LSI_CTEST2_CM     0x10
 134 #define LSI_CTEST2_CIO    0x20
 135 #define LSI_CTEST2_SIGP   0x40
 136 #define LSI_CTEST2_DDIR   0x80
 137
 138 #define LSI_CTEST5_BL2    0x04
 139 #define LSI_CTEST5_DDIR   0x08
 140 #define LSI_CTEST5_MASR   0x10
 141 #define LSI_CTEST5_DFSN   0x20
 142 #define LSI_CTEST5_BBCK   0x40
 143 #define LSI_CTEST5_ADCK   0x80
 144
 145 #define LSI_CCNTL0_DILS   0x01
 146 #define LSI_CCNTL0_DISFC  0x10
 147 #define LSI_CCNTL0_ENNDJ  0x20
 148 #define LSI_CCNTL0_PMJCTL 0x40
 149 #define LSI_CCNTL0_ENPMJ  0x80
 150
 151 #define LSI_CCNTL1_EN64DBMV  0x01
 152 #define LSI_CCNTL1_EN64TIBMV 0x02
 153 #define LSI_CCNTL1_64TIMOD   0x04
 154 #define LSI_CCNTL1_DDAC      0x08
 155 #define LSI_CCNTL1_ZMOD      0x80
 156
 157 /* Enable Response to Reselection */
 158 #define LSI_SCID_RRE      0x60
 159
 160 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 161
 162 #define PHASE_DO          0
 163 #define PHASE_DI          1
 164 #define PHASE_CMD         2
 165 #define PHASE_ST          3
 166 #define PHASE_MO          6
 167 #define PHASE_MI          7
 168 #define PHASE_MASK        7
 169
 170 /* Maximum length of MSG IN data.  */
 171 #define LSI_MAX_MSGIN_LEN 8
 172
 173 /* Flag set if this is a tagged command.  */
 174 #define LSI_TAG_VALID     (1 << 16)
 175
 176 typedef struct lsi_request {
 177     SCSIRequest *req;
 178     uint32_t tag;
 179     uint32_t dma_len;
 180     uint8_t *dma_buf;
 181     uint32_t pending;
 182     int out;
 183     QTAILQ_ENTRY(lsi_request) next;
 184 } lsi_request;
 185
 186 typedef struct {
 187     /*< private >*/
 188     PCIDevice parent_obj;
 189     /*< public >*/
 190
 191     MemoryRegion mmio_io;
 192     MemoryRegion ram_io;
 193     MemoryRegion io_io;
 194
 195     int carry; /* ??? Should this be an a visible register somewhere?  */
 196     int status;
 197     /* Action to take at the end of a MSG IN phase.
 198        0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN.  */
 199     int msg_action;
 200     int msg_len;
 201     uint8_t msg[LSI_MAX_MSGIN_LEN];
 202     /* 0 if SCRIPTS are running or stopped.
 203      * 1 if a Wait Reselect instruction has been issued.
 204      * 2 if processing DMA from lsi_execute_script.
 205      * 3 if a DMA operation is in progress.  */
 206     int waiting;
 207     SCSIBus bus;
 208     int current_lun;
 209     /* The tag is a combination of the device ID and the SCSI tag.  */
 210     uint32_t select_tag;
 211     int command_complete;
 212     QTAILQ_HEAD(, lsi_request) queue;
 213     lsi_request *current;
 214
 215     uint32_t dsa;
 216     uint32_t temp;
 217     uint32_t dnad;
 218     uint32_t dbc;
 219     uint8_t istat0;
 220     uint8_t istat1;
 221     uint8_t dcmd;
 222     uint8_t dstat;
 223     uint8_t dien;
 224     uint8_t sist0;
 225     uint8_t sist1;
 226     uint8_t sien0;
 227     uint8_t sien1;
 228     uint8_t mbox0;
 229     uint8_t mbox1;
 230     uint8_t dfifo;
 231     uint8_t ctest2;
 232     uint8_t ctest3;
 233     uint8_t ctest4;
 234     uint8_t ctest5;
 235     uint8_t ccntl0;
 236     uint8_t ccntl1;
 237     uint32_t dsp;
 238     uint32_t dsps;
 239     uint8_t dmode;
 240     uint8_t dcntl;
 241     uint8_t scntl0;
 242     uint8_t scntl1;
 243     uint8_t scntl2;
 244     uint8_t scntl3;
 245     uint8_t sstat0;
 246     uint8_t sstat1;
 247     uint8_t scid;
 248     uint8_t sxfer;
 249     uint8_t socl;
 250     uint8_t sdid;
 251     uint8_t ssid;
 252     uint8_t sfbr;
 253     uint8_t stest1;
 254     uint8_t stest2;
 255     uint8_t stest3;
 256     uint8_t sidl;
 257     uint8_t stime0;
 258     uint8_t respid0;
 259     uint8_t respid1;
 260     uint32_t mmrs;
 261     uint32_t mmws;
 262     uint32_t sfs;
 263     uint32_t drs;
 264     uint32_t sbms;
 265     uint32_t dbms;
 266     uint32_t dnad64;
 267     uint32_t pmjad1;
 268     uint32_t pmjad2;
 269     uint32_t rbc;
 270     uint32_t ua;
 271     uint32_t ia;
 272     uint32_t sbc;
 273     uint32_t csbc;
 274     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 275     uint8_t sbr;
 276
 277     /* Script ram is stored as 32-bit words in host byteorder.  */
 278     uint32_t script_ram[2048];
 279 } LSIState;
 280
 281 #define TYPE_LSI53C895A "lsi53c895a"
 282
 283 #define LSI53C895A(obj) \
 284     OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A)
 285
 286 static inline int lsi_irq_on_rsl(LSIState *s)
 287 {
 288     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
 289 }
 290
 291 static void lsi_soft_reset(LSIState *s)
 292 {
 293     DPRINTF("Reset\n");
 294     s->carry = 0;
 295
 296     s->msg_action = 0;
 297     s->msg_len = 0;
 298     s->waiting = 0;
 299     s->dsa = 0;
 300     s->dnad = 0;
 301     s->dbc = 0;
 302     s->temp = 0;
 303     memset(s->scratch, 0, sizeof(s->scratch));
 304     s->istat0 = 0;
 305     s->istat1 = 0;
 306     s->dcmd = 0x40;
 307     s->dstat = LSI_DSTAT_DFE;
 308     s->dien = 0;
 309     s->sist0 = 0;
 310     s->sist1 = 0;
 311     s->sien0 = 0;
 312     s->sien1 = 0;
 313     s->mbox0 = 0;
 314     s->mbox1 = 0;
 315     s->dfifo = 0;
 316     s->ctest2 = LSI_CTEST2_DACK;
 317     s->ctest3 = 0;
 318     s->ctest4 = 0;
 319     s->ctest5 = 0;
 320     s->ccntl0 = 0;
 321     s->ccntl1 = 0;
 322     s->dsp = 0;
 323     s->dsps = 0;
 324     s->dmode = 0;
 325     s->dcntl = 0;
 326     s->scntl0 = 0xc0;
 327     s->scntl1 = 0;
 328     s->scntl2 = 0;
 329     s->scntl3 = 0;
 330     s->sstat0 = 0;
 331     s->sstat1 = 0;
 332     s->scid = 7;
 333     s->sxfer = 0;
 334     s->socl = 0;
 335     s->sdid = 0;
 336     s->ssid = 0;
 337     s->stest1 = 0;
 338     s->stest2 = 0;
 339     s->stest3 = 0;
 340     s->sidl = 0;
 341     s->stime0 = 0;
 342     s->respid0 = 0x80;
 343     s->respid1 = 0;
 344     s->mmrs = 0;
 345     s->mmws = 0;
 346     s->sfs = 0;
 347     s->drs = 0;
 348     s->sbms = 0;
 349     s->dbms = 0;
 350     s->dnad64 = 0;
 351     s->pmjad1 = 0;
 352     s->pmjad2 = 0;
 353     s->rbc = 0;
 354     s->ua = 0;
 355     s->ia = 0;
 356     s->sbc = 0;
 357     s->csbc = 0;
 358     s->sbr = 0;
 359     assert(QTAILQ_EMPTY(&s->queue));
 360     assert(!s->current);
 361 }
 362
 363 static int lsi_dma_40bit(LSIState *s)
 364 {
 365     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 366         return 1;
 367     return 0;
 368 }
 369
 370 static int lsi_dma_ti64bit(LSIState *s)
 371 {
 372     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 373         return 1;
 374     return 0;
 375 }
 376
 377 static int lsi_dma_64bit(LSIState *s)
 378 {
 379     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 380         return 1;
 381     return 0;
 382 }
 383
 384 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 385 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 386 static void lsi_execute_script(LSIState *s);
 387 static void lsi_reselect(LSIState *s, lsi_request *p);
 388
 389 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 390 {
 391     uint32_t buf;
 392
 393     pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
 394     return cpu_to_le32(buf);
 395 }
 396
 397 static void lsi_stop_script(LSIState *s)
 398 {
 399     s->istat1 &= ~LSI_ISTAT1_SRUN;
 400 }
 401
 402 static void lsi_update_irq(LSIState *s)
 403 {
 404     PCIDevice *d = PCI_DEVICE(s);
 405     int level;
 406     static int last_level;
 407     lsi_request *p;
 408
 409     /* It's unclear whether the DIP/SIP bits should be cleared when the
 410        Interrupt Status Registers are cleared or when istat0 is read.
 411        We currently do the formwer, which seems to work.  */
 412     level = 0;
 413     if (s->dstat) {
 414         if (s->dstat & s->dien)
 415             level = 1;
 416         s->istat0 |= LSI_ISTAT0_DIP;
 417     } else {
 418         s->istat0 &= ~LSI_ISTAT0_DIP;
 419     }
 420
 421     if (s->sist0 || s->sist1) {
 422         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 423             level = 1;
 424         s->istat0 |= LSI_ISTAT0_SIP;
 425     } else {
 426         s->istat0 &= ~LSI_ISTAT0_SIP;
 427     }
 428     if (s->istat0 & LSI_ISTAT0_INTF)
 429         level = 1;
 430
 431     if (level != last_level) {
 432         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 433                 level, s->dstat, s->sist1, s->sist0);
 434         last_level = level;
 435     }
 436     qemu_set_irq(d->irq[0], level);
 437
 438     if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
 439         DPRINTF("Handled IRQs & disconnected, looking for pending "
 440                 "processes\n");
 441         QTAILQ_FOREACH(p, &s->queue, next) {
 442             if (p->pending) {
 443                 lsi_reselect(s, p);
 444                 break;
 445             }
 446         }
 447     }
 448 }
 449
 450 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 451 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 452 {
 453     uint32_t mask0;
 454     uint32_t mask1;
 455
 456     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 457             stat1, stat0, s->sist1, s->sist0);
 458     s->sist0 |= stat0;
 459     s->sist1 |= stat1;
 460     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 461        we don't stop processing when raising STO.  Instead continue
 462        execution and stop at the next insn that accesses the SCSI bus.  */
 463     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 464     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 465     mask1 &= ~LSI_SIST1_STO;
 466     if (s->sist0 & mask0 || s->sist1 & mask1) {
 467         lsi_stop_script(s);
 468     }
 469     lsi_update_irq(s);
 470 }
 471
 472 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 473 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 474 {
 475     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 476     s->dstat |= stat;
 477     lsi_update_irq(s);
 478     lsi_stop_script(s);
 479 }
 480
 481 static inline void lsi_set_phase(LSIState *s, int phase)
 482 {
 483     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 484 }
 485
 486 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 487 {
 488     /* Trigger a phase mismatch.  */
 489     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 490         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
 491             s->dsp = out ? s->pmjad1 : s->pmjad2;
 492         } else {
 493             s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
 494         }
 495         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 496     } else {
 497         DPRINTF("Phase mismatch interrupt\n");
 498         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 499         lsi_stop_script(s);
 500     }
 501     lsi_set_phase(s, new_phase);
 502 }
 503
 504
 505 /* Resume SCRIPTS execution after a DMA operation.  */
 506 static void lsi_resume_script(LSIState *s)
 507 {
 508     if (s->waiting != 2) {
 509         s->waiting = 0;
 510         lsi_execute_script(s);
 511     } else {
 512         s->waiting = 0;
 513     }
 514 }
 515
 516 static void lsi_disconnect(LSIState *s)
 517 {
 518     s->scntl1 &= ~LSI_SCNTL1_CON;
 519     s->sstat1 &= ~PHASE_MASK;
 520 }
 521
 522 static void lsi_bad_selection(LSIState *s, uint32_t id)
 523 {
 524     DPRINTF("Selected absent target %d\n", id);
 525     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 526     lsi_disconnect(s);
 527 }
 528
 529 /* Initiate a SCSI layer data transfer.  */
 530 static void lsi_do_dma(LSIState *s, int out)
 531 {
 532     PCIDevice *pci_dev;
 533     uint32_t count;
 534     dma_addr_t addr;
 535     SCSIDevice *dev;
 536
 537     assert(s->current);
 538     if (!s->current->dma_len) {
 539         /* Wait until data is available.  */
 540         DPRINTF("DMA no data available\n");
 541         return;
 542     }
 543
 544     pci_dev = PCI_DEVICE(s);
 545     dev = s->current->req->dev;
 546     assert(dev);
 547
 548     count = s->dbc;
 549     if (count > s->current->dma_len)
 550         count = s->current->dma_len;
 551
 552     addr = s->dnad;
 553     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 554     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 555         addr |= ((uint64_t)s->dnad64 << 32);
 556     else if (s->dbms)
 557         addr |= ((uint64_t)s->dbms << 32);
 558     else if (s->sbms)
 559         addr |= ((uint64_t)s->sbms << 32);
 560
 561     DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
 562     s->csbc += count;
 563     s->dnad += count;
 564     s->dbc -= count;
 565      if (s->current->dma_buf == NULL) {
 566         s->current->dma_buf = scsi_req_get_buf(s->current->req);
 567     }
 568     /* ??? Set SFBR to first data byte.  */
 569     if (out) {
 570         pci_dma_read(pci_dev, addr, s->current->dma_buf, count);
 571     } else {
 572         pci_dma_write(pci_dev, addr, s->current->dma_buf, count);
 573     }
 574     s->current->dma_len -= count;
 575     if (s->current->dma_len == 0) {
 576         s->current->dma_buf = NULL;
 577         scsi_req_continue(s->current->req);
 578     } else {
 579         s->current->dma_buf += count;
 580         lsi_resume_script(s);
 581     }
 582 }
 583
 584
 585 /* Add a command to the queue.  */
 586 static void lsi_queue_command(LSIState *s)
 587 {
 588     lsi_request *p = s->current;
 589
 590     DPRINTF("Queueing tag=0x%x\n", p->tag);
 591     assert(s->current != NULL);
 592     assert(s->current->dma_len == 0);
 593     QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
 594     s->current = NULL;
 595
 596     p->pending = 0;
 597     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 598 }
 599
 600 /* Queue a byte for a MSG IN phase.  */
 601 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 602 {
 603     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 604         BADF("MSG IN data too long\n");
 605     } else {
 606         DPRINTF("MSG IN 0x%02x\n", data);
 607         s->msg[s->msg_len++] = data;
 608     }
 609 }
 610
 611 /* Perform reselection to continue a command.  */
 612 static void lsi_reselect(LSIState *s, lsi_request *p)
 613 {
 614     int id;
 615
 616     assert(s->current == NULL);
 617     QTAILQ_REMOVE(&s->queue, p, next);
 618     s->current = p;
 619
 620     id = (p->tag >> 8) & 0xf;
 621     s->ssid = id | 0x80;
 622     /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
 623     if (!(s->dcntl & LSI_DCNTL_COM)) {
 624         s->sfbr = 1 << (id & 0x7);
 625     }
 626     DPRINTF("Reselected target %d\n", id);
 627     s->scntl1 |= LSI_SCNTL1_CON;
 628     lsi_set_phase(s, PHASE_MI);
 629     s->msg_action = p->out ? 2 : 3;
 630     s->current->dma_len = p->pending;
 631     lsi_add_msg_byte(s, 0x80);
 632     if (s->current->tag & LSI_TAG_VALID) {
 633         lsi_add_msg_byte(s, 0x20);
 634         lsi_add_msg_byte(s, p->tag & 0xff);
 635     }
 636
 637     if (lsi_irq_on_rsl(s)) {
 638         lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
 639     }
 640 }
 641
 642 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
 643 {
 644     lsi_request *p;
 645
 646     QTAILQ_FOREACH(p, &s->queue, next) {
 647         if (p->tag == tag) {
 648             return p;
 649         }
 650     }
 651
 652     return NULL;
 653 }
 654
 655 static void lsi_request_free(LSIState *s, lsi_request *p)
 656 {
 657     if (p == s->current) {
 658         s->current = NULL;
 659     } else {
 660         QTAILQ_REMOVE(&s->queue, p, next);
 661     }
 662     g_free(p);
 663 }
 664
 665 static void lsi_request_cancelled(SCSIRequest *req)
 666 {
 667     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 668     lsi_request *p = req->hba_private;
 669
 670     req->hba_private = NULL;
 671     lsi_request_free(s, p);
 672     scsi_req_unref(req);
 673 }
 674
 675 /* Record that data is available for a queued command.  Returns zero if
 676    the device was reselected, nonzero if the IO is deferred.  */
 677 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
 678 {
 679     lsi_request *p = req->hba_private;
 680
 681     if (p->pending) {
 682         BADF("Multiple IO pending for request %p\n", p);
 683     }
 684     p->pending = len;
 685     /* Reselect if waiting for it, or if reselection triggers an IRQ
 686        and the bus is free.
 687        Since no interrupt stacking is implemented in the emulation, it
 688        is also required that there are no pending interrupts waiting
 689        for service from the device driver. */
 690     if (s->waiting == 1 ||
 691         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
 692          !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
 693         /* Reselect device.  */
 694         lsi_reselect(s, p);
 695         return 0;
 696     } else {
 697         DPRINTF("Queueing IO tag=0x%x\n", p->tag);
 698         p->pending = len;
 699         return 1;
 700     }
 701 }
 702
 703  /* Callback to indicate that the SCSI layer has completed a command.  */
 704 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 705 {
 706     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 707     int out;
 708
 709     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 710     DPRINTF("Command complete status=%d\n", (int)status);
 711     s->status = status;
 712     s->command_complete = 2;
 713     if (s->waiting && s->dbc != 0) {
 714         /* Raise phase mismatch for short transfers.  */
 715         lsi_bad_phase(s, out, PHASE_ST);
 716     } else {
 717         lsi_set_phase(s, PHASE_ST);
 718     }
 719
 720     if (req->hba_private == s->current) {
 721         req->hba_private = NULL;
 722         lsi_request_free(s, s->current);
 723         scsi_req_unref(req);
 724     }
 725     lsi_resume_script(s);
 726 }
 727
 728  /* Callback to indicate that the SCSI layer has completed a transfer.  */
 729 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
 730 {
 731     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 732     int out;
 733
 734     assert(req->hba_private);
 735     if (s->waiting == 1 || req->hba_private != s->current ||
 736         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
 737         if (lsi_queue_req(s, req, len)) {
 738             return;
 739         }
 740     }
 741
 742     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 743
 744     /* host adapter (re)connected */
 745     DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
 746     s->current->dma_len = len;
 747     s->command_complete = 1;
 748     if (s->waiting) {
 749         if (s->waiting == 1 || s->dbc == 0) {
 750             lsi_resume_script(s);
 751         } else {
 752             lsi_do_dma(s, out);
 753         }
 754     }
 755 }
 756
 757 static void lsi_do_command(LSIState *s)
 758 {
 759     SCSIDevice *dev;
 760     uint8_t buf[16];
 761     uint32_t id;
 762     int n;
 763
 764     DPRINTF("Send command len=%d\n", s->dbc);
 765     if (s->dbc > 16)
 766         s->dbc = 16;
 767     pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
 768     s->sfbr = buf[0];
 769     s->command_complete = 0;
 770
 771     id = (s->select_tag >> 8) & 0xf;
 772     dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
 773     if (!dev) {
 774         lsi_bad_selection(s, id);
 775         return;
 776     }
 777
 778     assert(s->current == NULL);
 779     s->current = g_malloc0(sizeof(lsi_request));
 780     s->current->tag = s->select_tag;
 781     s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
 782                                    s->current);
 783
 784     n = scsi_req_enqueue(s->current->req);
 785     if (n) {
 786         if (n > 0) {
 787             lsi_set_phase(s, PHASE_DI);
 788         } else if (n < 0) {
 789             lsi_set_phase(s, PHASE_DO);
 790         }
 791         scsi_req_continue(s->current->req);
 792     }
 793     if (!s->command_complete) {
 794         if (n) {
 795             /* Command did not complete immediately so disconnect.  */
 796             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 797             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 798             /* wait data */
 799             lsi_set_phase(s, PHASE_MI);
 800             s->msg_action = 1;
 801             lsi_queue_command(s);
 802         } else {
 803             /* wait command complete */
 804             lsi_set_phase(s, PHASE_DI);
 805         }
 806     }
 807 }
 808
 809 static void lsi_do_status(LSIState *s)
 810 {
 811     uint8_t status;
 812     DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
 813     if (s->dbc != 1)
 814         BADF("Bad Status move\n");
 815     s->dbc = 1;
 816     status = s->status;
 817     s->sfbr = status;
 818     pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
 819     lsi_set_phase(s, PHASE_MI);
 820     s->msg_action = 1;
 821     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 822 }
 823
 824 static void lsi_do_msgin(LSIState *s)
 825 {
 826     int len;
 827     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 828     s->sfbr = s->msg[0];
 829     len = s->msg_len;
 830     if (len > s->dbc)
 831         len = s->dbc;
 832     pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
 833     /* Linux drivers rely on the last byte being in the SIDL.  */
 834     s->sidl = s->msg[len - 1];
 835     s->msg_len -= len;
 836     if (s->msg_len) {
 837         memmove(s->msg, s->msg + len, s->msg_len);
 838     } else {
 839         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 840            switch to PHASE_MO.  */
 841         switch (s->msg_action) {
 842         case 0:
 843             lsi_set_phase(s, PHASE_CMD);
 844             break;
 845         case 1:
 846             lsi_disconnect(s);
 847             break;
 848         case 2:
 849             lsi_set_phase(s, PHASE_DO);
 850             break;
 851         case 3:
 852             lsi_set_phase(s, PHASE_DI);
 853             break;
 854         default:
 855             abort();
 856         }
 857     }
 858 }
 859
 860 /* Read the next byte during a MSGOUT phase.  */
 861 static uint8_t lsi_get_msgbyte(LSIState *s)
 862 {
 863     uint8_t data;
 864     pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
 865     s->dnad++;
 866     s->dbc--;
 867     return data;
 868 }
 869
 870 /* Skip the next n bytes during a MSGOUT phase. */
 871 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
 872 {
 873     s->dnad += n;
 874     s->dbc  -= n;
 875 }
 876
 877 static void lsi_do_msgout(LSIState *s)
 878 {
 879     uint8_t msg;
 880     int len;
 881     uint32_t current_tag;
 882     lsi_request *current_req, *p, *p_next;
 883
 884     if (s->current) {
 885         current_tag = s->current->tag;
 886         current_req = s->current;
 887     } else {
 888         current_tag = s->select_tag;
 889         current_req = lsi_find_by_tag(s, current_tag);
 890     }
 891
 892     DPRINTF("MSG out len=%d\n", s->dbc);
 893     while (s->dbc) {
 894         msg = lsi_get_msgbyte(s);
 895         s->sfbr = msg;
 896
 897         switch (msg) {
 898         case 0x04:
 899             DPRINTF("MSG: Disconnect\n");
 900             lsi_disconnect(s);
 901             break;
 902         case 0x08:
 903             DPRINTF("MSG: No Operation\n");
 904             lsi_set_phase(s, PHASE_CMD);
 905             break;
 906         case 0x01:
 907             len = lsi_get_msgbyte(s);
 908             msg = lsi_get_msgbyte(s);
 909             (void)len; /* avoid a warning about unused variable*/
 910             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 911             switch (msg) {
 912             case 1:
 913                 DPRINTF("SDTR (ignored)\n");
 914                 lsi_skip_msgbytes(s, 2);
 915                 break;
 916             case 3:
 917                 DPRINTF("WDTR (ignored)\n");
 918                 lsi_skip_msgbytes(s, 1);
 919                 break;
 920             default:
 921                 goto bad;
 922             }
 923             break;
 924         case 0x20: /* SIMPLE queue */
 925             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 926             DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
 927             break;
 928         case 0x21: /* HEAD of queue */
 929             BADF("HEAD queue not implemented\n");
 930             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 931             break;
 932         case 0x22: /* ORDERED queue */
 933             BADF("ORDERED queue not implemented\n");
 934             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 935             break;
 936         case 0x0d:
 937             /* The ABORT TAG message clears the current I/O process only. */
 938             DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
 939             if (current_req) {
 940                 scsi_req_cancel(current_req->req);
 941             }
 942             lsi_disconnect(s);
 943             break;
 944         case 0x06:
 945         case 0x0e:
 946         case 0x0c:
 947             /* The ABORT message clears all I/O processes for the selecting
 948                initiator on the specified logical unit of the target. */
 949             if (msg == 0x06) {
 950                 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
 951             }
 952             /* The CLEAR QUEUE message clears all I/O processes for all
 953                initiators on the specified logical unit of the target. */
 954             if (msg == 0x0e) {
 955                 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
 956             }
 957             /* The BUS DEVICE RESET message clears all I/O processes for all
 958                initiators on all logical units of the target. */
 959             if (msg == 0x0c) {
 960                 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
 961             }
 962
 963             /* clear the current I/O process */
 964             if (s->current) {
 965                 scsi_req_cancel(s->current->req);
 966             }
 967
 968             /* As the current implemented devices scsi_disk and scsi_generic
 969                only support one LUN, we don't need to keep track of LUNs.
 970                Clearing I/O processes for other initiators could be possible
 971                for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
 972                device, but this is currently not implemented (and seems not
 973                to be really necessary). So let's simply clear all queued
 974                commands for the current device: */
 975             QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
 976                 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
 977                     scsi_req_cancel(p->req);
 978                 }
 979             }
 980
 981             lsi_disconnect(s);
 982             break;
 983         default:
 984             if ((msg & 0x80) == 0) {
 985                 goto bad;
 986             }
 987             s->current_lun = msg & 7;
 988             DPRINTF("Select LUN %d\n", s->current_lun);
 989             lsi_set_phase(s, PHASE_CMD);
 990             break;
 991         }
 992     }
 993     return;
 994 bad:
 995     BADF("Unimplemented message 0x%02x\n", msg);
 996     lsi_set_phase(s, PHASE_MI);
 997     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 998     s->msg_action = 0;
 999 }
1000
1001 #define LSI_BUF_SIZE 4096
1002 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1003 {
1004     PCIDevice *d = PCI_DEVICE(s);
1005     int n;
1006     uint8_t buf[LSI_BUF_SIZE];
1007
1008     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1009     while (count) {
1010         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1011         pci_dma_read(d, src, buf, n);
1012         pci_dma_write(d, dest, buf, n);
1013         src += n;
1014         dest += n;
1015         count -= n;
1016     }
1017 }
1018
1019 static void lsi_wait_reselect(LSIState *s)
1020 {
1021     lsi_request *p;
1022
1023     DPRINTF("Wait Reselect\n");
1024
1025     QTAILQ_FOREACH(p, &s->queue, next) {
1026         if (p->pending) {
1027             lsi_reselect(s, p);
1028             break;
1029         }
1030     }
1031     if (s->current == NULL) {
1032         s->waiting = 1;
1033     }
1034 }
1035
1036 static void lsi_execute_script(LSIState *s)
1037 {
1038     PCIDevice *pci_dev = PCI_DEVICE(s);
1039     uint32_t insn;
1040     uint32_t addr, addr_high;
1041     int opcode;
1042     int insn_processed = 0;
1043
1044     s->istat1 |= LSI_ISTAT1_SRUN;
1045 again:
1046     insn_processed++;
1047     insn = read_dword(s, s->dsp);
1048     if (!insn) {
1049         /* If we receive an empty opcode increment the DSP by 4 bytes
1050            instead of 8 and execute the next opcode at that location */
1051         s->dsp += 4;
1052         goto again;
1053     }
1054     addr = read_dword(s, s->dsp + 4);
1055     addr_high = 0;
1056     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1057     s->dsps = addr;
1058     s->dcmd = insn >> 24;
1059     s->dsp += 8;
1060     switch (insn >> 30) {
1061     case 0: /* Block move.  */
1062         if (s->sist1 & LSI_SIST1_STO) {
1063             DPRINTF("Delayed select timeout\n");
1064             lsi_stop_script(s);
1065             break;
1066         }
1067         s->dbc = insn & 0xffffff;
1068         s->rbc = s->dbc;
1069         /* ??? Set ESA.  */
1070         s->ia = s->dsp - 8;
1071         if (insn & (1 << 29)) {
1072             /* Indirect addressing.  */
1073             addr = read_dword(s, addr);
1074         } else if (insn & (1 << 28)) {
1075             uint32_t buf[2];
1076             int32_t offset;
1077             /* Table indirect addressing.  */
1078
1079             /* 32-bit Table indirect */
1080             offset = sextract32(addr, 0, 24);
1081             pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
1082             /* byte count is stored in bits 0:23 only */
1083             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1084             s->rbc = s->dbc;
1085             addr = cpu_to_le32(buf[1]);
1086
1087             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1088              * table, bits [31:24] */
1089             if (lsi_dma_40bit(s))
1090                 addr_high = cpu_to_le32(buf[0]) >> 24;
1091             else if (lsi_dma_ti64bit(s)) {
1092                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1093                 switch (selector) {
1094                 case 0 ... 0x0f:
1095                     /* offset index into scratch registers since
1096                      * TI64 mode can use registers C to R */
1097                     addr_high = s->scratch[2 + selector];
1098                     break;
1099                 case 0x10:
1100                     addr_high = s->mmrs;
1101                     break;
1102                 case 0x11:
1103                     addr_high = s->mmws;
1104                     break;
1105                 case 0x12:
1106                     addr_high = s->sfs;
1107                     break;
1108                 case 0x13:
1109                     addr_high = s->drs;
1110                     break;
1111                 case 0x14:
1112                     addr_high = s->sbms;
1113                     break;
1114                 case 0x15:
1115                     addr_high = s->dbms;
1116                     break;
1117                 default:
1118                     BADF("Illegal selector specified (0x%x > 0x15)"
1119                          " for 64-bit DMA block move", selector);
1120                     break;
1121                 }
1122             }
1123         } else if (lsi_dma_64bit(s)) {
1124             /* fetch a 3rd dword if 64-bit direct move is enabled and
1125                only if we're not doing table indirect or indirect addressing */
1126             s->dbms = read_dword(s, s->dsp);
1127             s->dsp += 4;
1128             s->ia = s->dsp - 12;
1129         }
1130         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1131             DPRINTF("Wrong phase got %d expected %d\n",
1132                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1133             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1134             break;
1135         }
1136         s->dnad = addr;
1137         s->dnad64 = addr_high;
1138         switch (s->sstat1 & 0x7) {
1139         case PHASE_DO:
1140             s->waiting = 2;
1141             lsi_do_dma(s, 1);
1142             if (s->waiting)
1143                 s->waiting = 3;
1144             break;
1145         case PHASE_DI:
1146             s->waiting = 2;
1147             lsi_do_dma(s, 0);
1148             if (s->waiting)
1149                 s->waiting = 3;
1150             break;
1151         case PHASE_CMD:
1152             lsi_do_command(s);
1153             break;
1154         case PHASE_ST:
1155             lsi_do_status(s);
1156             break;
1157         case PHASE_MO:
1158             lsi_do_msgout(s);
1159             break;
1160         case PHASE_MI:
1161             lsi_do_msgin(s);
1162             break;
1163         default:
1164             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1165             exit(1);
1166         }
1167         s->dfifo = s->dbc & 0xff;
1168         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1169         s->sbc = s->dbc;
1170         s->rbc -= s->dbc;
1171         s->ua = addr + s->dbc;
1172         break;
1173
1174     case 1: /* IO or Read/Write instruction.  */
1175         opcode = (insn >> 27) & 7;
1176         if (opcode < 5) {
1177             uint32_t id;
1178
1179             if (insn & (1 << 25)) {
1180                 id = read_dword(s, s->dsa + sextract32(insn, 0, 24));
1181             } else {
1182                 id = insn;
1183             }
1184             id = (id >> 16) & 0xf;
1185             if (insn & (1 << 26)) {
1186                 addr = s->dsp + sextract32(addr, 0, 24);
1187             }
1188             s->dnad = addr;
1189             switch (opcode) {
1190             case 0: /* Select */
1191                 s->sdid = id;
1192                 if (s->scntl1 & LSI_SCNTL1_CON) {
1193                     DPRINTF("Already reselected, jumping to alternative address\n");
1194                     s->dsp = s->dnad;
1195                     break;
1196                 }
1197                 s->sstat0 |= LSI_SSTAT0_WOA;
1198                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1199                 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1200                     lsi_bad_selection(s, id);
1201                     break;
1202                 }
1203                 DPRINTF("Selected target %d%s\n",
1204                         id, insn & (1 << 3) ? " ATN" : "");
1205                 /* ??? Linux drivers compain when this is set.  Maybe
1206                    it only applies in low-level mode (unimplemented).
1207                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1208                 s->select_tag = id << 8;
1209                 s->scntl1 |= LSI_SCNTL1_CON;
1210                 if (insn & (1 << 3)) {
1211                     s->socl |= LSI_SOCL_ATN;
1212                 }
1213                 lsi_set_phase(s, PHASE_MO);
1214                 break;
1215             case 1: /* Disconnect */
1216                 DPRINTF("Wait Disconnect\n");
1217                 s->scntl1 &= ~LSI_SCNTL1_CON;
1218                 break;
1219             case 2: /* Wait Reselect */
1220                 if (!lsi_irq_on_rsl(s)) {
1221                     lsi_wait_reselect(s);
1222                 }
1223                 break;
1224             case 3: /* Set */
1225                 DPRINTF("Set%s%s%s%s\n",
1226                         insn & (1 << 3) ? " ATN" : "",
1227                         insn & (1 << 6) ? " ACK" : "",
1228                         insn & (1 << 9) ? " TM" : "",
1229                         insn & (1 << 10) ? " CC" : "");
1230                 if (insn & (1 << 3)) {
1231                     s->socl |= LSI_SOCL_ATN;
1232                     lsi_set_phase(s, PHASE_MO);
1233                 }
1234                 if (insn & (1 << 9)) {
1235                     BADF("Target mode not implemented\n");
1236                     exit(1);
1237                 }
1238                 if (insn & (1 << 10))
1239                     s->carry = 1;
1240                 break;
1241             case 4: /* Clear */
1242                 DPRINTF("Clear%s%s%s%s\n",
1243                         insn & (1 << 3) ? " ATN" : "",
1244                         insn & (1 << 6) ? " ACK" : "",
1245                         insn & (1 << 9) ? " TM" : "",
1246                         insn & (1 << 10) ? " CC" : "");
1247                 if (insn & (1 << 3)) {
1248                     s->socl &= ~LSI_SOCL_ATN;
1249                 }
1250                 if (insn & (1 << 10))
1251                     s->carry = 0;
1252                 break;
1253             }
1254         } else {
1255             uint8_t op0;
1256             uint8_t op1;
1257             uint8_t data8;
1258             int reg;
1259             int operator;
1260 #ifdef DEBUG_LSI
1261             static const char *opcode_names[3] =
1262                 {"Write", "Read", "Read-Modify-Write"};
1263             static const char *operator_names[8] =
1264                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1265 #endif
1266
1267             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1268             data8 = (insn >> 8) & 0xff;
1269             opcode = (insn >> 27) & 7;
1270             operator = (insn >> 24) & 7;
1271             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1272                     opcode_names[opcode - 5], reg,
1273                     operator_names[operator], data8, s->sfbr,
1274                     (insn & (1 << 23)) ? " SFBR" : "");
1275             op0 = op1 = 0;
1276             switch (opcode) {
1277             case 5: /* From SFBR */
1278                 op0 = s->sfbr;
1279                 op1 = data8;
1280                 break;
1281             case 6: /* To SFBR */
1282                 if (operator)
1283                     op0 = lsi_reg_readb(s, reg);
1284                 op1 = data8;
1285                 break;
1286             case 7: /* Read-modify-write */
1287                 if (operator)
1288                     op0 = lsi_reg_readb(s, reg);
1289                 if (insn & (1 << 23)) {
1290                     op1 = s->sfbr;
1291                 } else {
1292                     op1 = data8;
1293                 }
1294                 break;
1295             }
1296
1297             switch (operator) {
1298             case 0: /* move */
1299                 op0 = op1;
1300                 break;
1301             case 1: /* Shift left */
1302                 op1 = op0 >> 7;
1303                 op0 = (op0 << 1) | s->carry;
1304                 s->carry = op1;
1305                 break;
1306             case 2: /* OR */
1307                 op0 |= op1;
1308                 break;
1309             case 3: /* XOR */
1310                 op0 ^= op1;
1311                 break;
1312             case 4: /* AND */
1313                 op0 &= op1;
1314                 break;
1315             case 5: /* SHR */
1316                 op1 = op0 & 1;
1317                 op0 = (op0 >> 1) | (s->carry << 7);
1318                 s->carry = op1;
1319                 break;
1320             case 6: /* ADD */
1321                 op0 += op1;
1322                 s->carry = op0 < op1;
1323                 break;
1324             case 7: /* ADC */
1325                 op0 += op1 + s->carry;
1326                 if (s->carry)
1327                     s->carry = op0 <= op1;
1328                 else
1329                     s->carry = op0 < op1;
1330                 break;
1331             }
1332
1333             switch (opcode) {
1334             case 5: /* From SFBR */
1335             case 7: /* Read-modify-write */
1336                 lsi_reg_writeb(s, reg, op0);
1337                 break;
1338             case 6: /* To SFBR */
1339                 s->sfbr = op0;
1340                 break;
1341             }
1342         }
1343         break;
1344
1345     case 2: /* Transfer Control.  */
1346         {
1347             int cond;
1348             int jmp;
1349
1350             if ((insn & 0x002e0000) == 0) {
1351                 DPRINTF("NOP\n");
1352                 break;
1353             }
1354             if (s->sist1 & LSI_SIST1_STO) {
1355                 DPRINTF("Delayed select timeout\n");
1356                 lsi_stop_script(s);
1357                 break;
1358             }
1359             cond = jmp = (insn & (1 << 19)) != 0;
1360             if (cond == jmp && (insn & (1 << 21))) {
1361                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1362                 cond = s->carry != 0;
1363             }
1364             if (cond == jmp && (insn & (1 << 17))) {
1365                 DPRINTF("Compare phase %d %c= %d\n",
1366                         (s->sstat1 & PHASE_MASK),
1367                         jmp ? '=' : '!',
1368                         ((insn >> 24) & 7));
1369                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1370             }
1371             if (cond == jmp && (insn & (1 << 18))) {
1372                 uint8_t mask;
1373
1374                 mask = (~insn >> 8) & 0xff;
1375                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1376                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1377                 cond = (s->sfbr & mask) == (insn & mask);
1378             }
1379             if (cond == jmp) {
1380                 if (insn & (1 << 23)) {
1381                     /* Relative address.  */
1382                     addr = s->dsp + sextract32(addr, 0, 24);
1383                 }
1384                 switch ((insn >> 27) & 7) {
1385                 case 0: /* Jump */
1386                     DPRINTF("Jump to 0x%08x\n", addr);
1387                     s->dsp = addr;
1388                     break;
1389                 case 1: /* Call */
1390                     DPRINTF("Call 0x%08x\n", addr);
1391                     s->temp = s->dsp;
1392                     s->dsp = addr;
1393                     break;
1394                 case 2: /* Return */
1395                     DPRINTF("Return to 0x%08x\n", s->temp);
1396                     s->dsp = s->temp;
1397                     break;
1398                 case 3: /* Interrupt */
1399                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1400                     if ((insn & (1 << 20)) != 0) {
1401                         s->istat0 |= LSI_ISTAT0_INTF;
1402                         lsi_update_irq(s);
1403                     } else {
1404                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1405                     }
1406                     break;
1407                 default:
1408                     DPRINTF("Illegal transfer control\n");
1409                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1410                     break;
1411                 }
1412             } else {
1413                 DPRINTF("Control condition failed\n");
1414             }
1415         }
1416         break;
1417
1418     case 3:
1419         if ((insn & (1 << 29)) == 0) {
1420             /* Memory move.  */
1421             uint32_t dest;
1422             /* ??? The docs imply the destination address is loaded into
1423                the TEMP register.  However the Linux drivers rely on
1424                the value being presrved.  */
1425             dest = read_dword(s, s->dsp);
1426             s->dsp += 4;
1427             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1428         } else {
1429             uint8_t data[7];
1430             int reg;
1431             int n;
1432             int i;
1433
1434             if (insn & (1 << 28)) {
1435                 addr = s->dsa + sextract32(addr, 0, 24);
1436             }
1437             n = (insn & 7);
1438             reg = (insn >> 16) & 0xff;
1439             if (insn & (1 << 24)) {
1440                 pci_dma_read(pci_dev, addr, data, n);
1441                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1442                         addr, *(int *)data);
1443                 for (i = 0; i < n; i++) {
1444                     lsi_reg_writeb(s, reg + i, data[i]);
1445                 }
1446             } else {
1447                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1448                 for (i = 0; i < n; i++) {
1449                     data[i] = lsi_reg_readb(s, reg + i);
1450                 }
1451                 pci_dma_write(pci_dev, addr, data, n);
1452             }
1453         }
1454     }
1455     if (insn_processed > 10000 && !s->waiting) {
1456         /* Some windows drivers make the device spin waiting for a memory
1457            location to change.  If we have been executed a lot of code then
1458            assume this is the case and force an unexpected device disconnect.
1459            This is apparently sufficient to beat the drivers into submission.
1460          */
1461         if (!(s->sien0 & LSI_SIST0_UDC))
1462             fprintf(stderr, "inf. loop with UDC masked\n");
1463         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1464         lsi_disconnect(s);
1465     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1466         if (s->dcntl & LSI_DCNTL_SSM) {
1467             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1468         } else {
1469             goto again;
1470         }
1471     }
1472     DPRINTF("SCRIPTS execution stopped\n");
1473 }
1474
1475 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1476 {
1477     uint8_t tmp;
1478 #define CASE_GET_REG24(name, addr) \
1479     case addr: return s->name & 0xff; \
1480     case addr + 1: return (s->name >> 8) & 0xff; \
1481     case addr + 2: return (s->name >> 16) & 0xff;
1482
1483 #define CASE_GET_REG32(name, addr) \
1484     case addr: return s->name & 0xff; \
1485     case addr + 1: return (s->name >> 8) & 0xff; \
1486     case addr + 2: return (s->name >> 16) & 0xff; \
1487     case addr + 3: return (s->name >> 24) & 0xff;
1488
1489 #ifdef DEBUG_LSI_REG
1490     DPRINTF("Read reg %x\n", offset);
1491 #endif
1492     switch (offset) {
1493     case 0x00: /* SCNTL0 */
1494         return s->scntl0;
1495     case 0x01: /* SCNTL1 */
1496         return s->scntl1;
1497     case 0x02: /* SCNTL2 */
1498         return s->scntl2;
1499     case 0x03: /* SCNTL3 */
1500         return s->scntl3;
1501     case 0x04: /* SCID */
1502         return s->scid;
1503     case 0x05: /* SXFER */
1504         return s->sxfer;
1505     case 0x06: /* SDID */
1506         return s->sdid;
1507     case 0x07: /* GPREG0 */
1508         return 0x7f;
1509     case 0x08: /* Revision ID */
1510         return 0x00;
1511     case 0xa: /* SSID */
1512         return s->ssid;
1513     case 0xb: /* SBCL */
1514         /* ??? This is not correct. However it's (hopefully) only
1515            used for diagnostics, so should be ok.  */
1516         return 0;
1517     case 0xc: /* DSTAT */
1518         tmp = s->dstat | 0x80;
1519         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1520             s->dstat = 0;
1521         lsi_update_irq(s);
1522         return tmp;
1523     case 0x0d: /* SSTAT0 */
1524         return s->sstat0;
1525     case 0x0e: /* SSTAT1 */
1526         return s->sstat1;
1527     case 0x0f: /* SSTAT2 */
1528         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1529     CASE_GET_REG32(dsa, 0x10)
1530     case 0x14: /* ISTAT0 */
1531         return s->istat0;
1532     case 0x15: /* ISTAT1 */
1533         return s->istat1;
1534     case 0x16: /* MBOX0 */
1535         return s->mbox0;
1536     case 0x17: /* MBOX1 */
1537         return s->mbox1;
1538     case 0x18: /* CTEST0 */
1539         return 0xff;
1540     case 0x19: /* CTEST1 */
1541         return 0;
1542     case 0x1a: /* CTEST2 */
1543         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1544         if (s->istat0 & LSI_ISTAT0_SIGP) {
1545             s->istat0 &= ~LSI_ISTAT0_SIGP;
1546             tmp |= LSI_CTEST2_SIGP;
1547         }
1548         return tmp;
1549     case 0x1b: /* CTEST3 */
1550         return s->ctest3;
1551     CASE_GET_REG32(temp, 0x1c)
1552     case 0x20: /* DFIFO */
1553         return 0;
1554     case 0x21: /* CTEST4 */
1555         return s->ctest4;
1556     case 0x22: /* CTEST5 */
1557         return s->ctest5;
1558     case 0x23: /* CTEST6 */
1559          return 0;
1560     CASE_GET_REG24(dbc, 0x24)
1561     case 0x27: /* DCMD */
1562         return s->dcmd;
1563     CASE_GET_REG32(dnad, 0x28)
1564     CASE_GET_REG32(dsp, 0x2c)
1565     CASE_GET_REG32(dsps, 0x30)
1566     CASE_GET_REG32(scratch[0], 0x34)
1567     case 0x38: /* DMODE */
1568         return s->dmode;
1569     case 0x39: /* DIEN */
1570         return s->dien;
1571     case 0x3a: /* SBR */
1572         return s->sbr;
1573     case 0x3b: /* DCNTL */
1574         return s->dcntl;
1575     case 0x40: /* SIEN0 */
1576         return s->sien0;
1577     case 0x41: /* SIEN1 */
1578         return s->sien1;
1579     case 0x42: /* SIST0 */
1580         tmp = s->sist0;
1581         s->sist0 = 0;
1582         lsi_update_irq(s);
1583         return tmp;
1584     case 0x43: /* SIST1 */
1585         tmp = s->sist1;
1586         s->sist1 = 0;
1587         lsi_update_irq(s);
1588         return tmp;
1589     case 0x46: /* MACNTL */
1590         return 0x0f;
1591     case 0x47: /* GPCNTL0 */
1592         return 0x0f;
1593     case 0x48: /* STIME0 */
1594         return s->stime0;
1595     case 0x4a: /* RESPID0 */
1596         return s->respid0;
1597     case 0x4b: /* RESPID1 */
1598         return s->respid1;
1599     case 0x4d: /* STEST1 */
1600         return s->stest1;
1601     case 0x4e: /* STEST2 */
1602         return s->stest2;
1603     case 0x4f: /* STEST3 */
1604         return s->stest3;
1605     case 0x50: /* SIDL */
1606         /* This is needed by the linux drivers.  We currently only update it
1607            during the MSG IN phase.  */
1608         return s->sidl;
1609     case 0x52: /* STEST4 */
1610         return 0xe0;
1611     case 0x56: /* CCNTL0 */
1612         return s->ccntl0;
1613     case 0x57: /* CCNTL1 */
1614         return s->ccntl1;
1615     case 0x58: /* SBDL */
1616         /* Some drivers peek at the data bus during the MSG IN phase.  */
1617         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1618             return s->msg[0];
1619         return 0;
1620     case 0x59: /* SBDL high */
1621         return 0;
1622     CASE_GET_REG32(mmrs, 0xa0)
1623     CASE_GET_REG32(mmws, 0xa4)
1624     CASE_GET_REG32(sfs, 0xa8)
1625     CASE_GET_REG32(drs, 0xac)
1626     CASE_GET_REG32(sbms, 0xb0)
1627     CASE_GET_REG32(dbms, 0xb4)
1628     CASE_GET_REG32(dnad64, 0xb8)
1629     CASE_GET_REG32(pmjad1, 0xc0)
1630     CASE_GET_REG32(pmjad2, 0xc4)
1631     CASE_GET_REG32(rbc, 0xc8)
1632     CASE_GET_REG32(ua, 0xcc)
1633     CASE_GET_REG32(ia, 0xd4)
1634     CASE_GET_REG32(sbc, 0xd8)
1635     CASE_GET_REG32(csbc, 0xdc)
1636     }
1637     if (offset >= 0x5c && offset < 0xa0) {
1638         int n;
1639         int shift;
1640         n = (offset - 0x58) >> 2;
1641         shift = (offset & 3) * 8;
1642         return (s->scratch[n] >> shift) & 0xff;
1643     }
1644     BADF("readb 0x%x\n", offset);
1645     exit(1);
1646 #undef CASE_GET_REG24
1647 #undef CASE_GET_REG32
1648 }
1649
1650 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1651 {
1652 #define CASE_SET_REG24(name, addr) \
1653     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1654     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1655     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1656
1657 #define CASE_SET_REG32(name, addr) \
1658     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1659     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1660     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1661     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1662
1663 #ifdef DEBUG_LSI_REG
1664     DPRINTF("Write reg %x = %02x\n", offset, val);
1665 #endif
1666     switch (offset) {
1667     case 0x00: /* SCNTL0 */
1668         s->scntl0 = val;
1669         if (val & LSI_SCNTL0_START) {
1670             BADF("Start sequence not implemented\n");
1671         }
1672         break;
1673     case 0x01: /* SCNTL1 */
1674         s->scntl1 = val & ~LSI_SCNTL1_SST;
1675         if (val & LSI_SCNTL1_IARB) {
1676             BADF("Immediate Arbritration not implemented\n");
1677         }
1678         if (val & LSI_SCNTL1_RST) {
1679             if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1680                 qbus_reset_all(&s->bus.qbus);
1681                 s->sstat0 |= LSI_SSTAT0_RST;
1682                 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1683             }
1684         } else {
1685             s->sstat0 &= ~LSI_SSTAT0_RST;
1686         }
1687         break;
1688     case 0x02: /* SCNTL2 */
1689         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1690         s->scntl2 = val;
1691         break;
1692     case 0x03: /* SCNTL3 */
1693         s->scntl3 = val;
1694         break;
1695     case 0x04: /* SCID */
1696         s->scid = val;
1697         break;
1698     case 0x05: /* SXFER */
1699         s->sxfer = val;
1700         break;
1701     case 0x06: /* SDID */
1702         if ((val & 0xf) != (s->ssid & 0xf))
1703             BADF("Destination ID does not match SSID\n");
1704         s->sdid = val & 0xf;
1705         break;
1706     case 0x07: /* GPREG0 */
1707         break;
1708     case 0x08: /* SFBR */
1709         /* The CPU is not allowed to write to this register.  However the
1710            SCRIPTS register move instructions are.  */
1711         s->sfbr = val;
1712         break;
1713     case 0x0a: case 0x0b:
1714         /* Openserver writes to these readonly registers on startup */
1715         return;
1716     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1717         /* Linux writes to these readonly registers on startup.  */
1718         return;
1719     CASE_SET_REG32(dsa, 0x10)
1720     case 0x14: /* ISTAT0 */
1721         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1722         if (val & LSI_ISTAT0_ABRT) {
1723             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1724         }
1725         if (val & LSI_ISTAT0_INTF) {
1726             s->istat0 &= ~LSI_ISTAT0_INTF;
1727             lsi_update_irq(s);
1728         }
1729         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1730             DPRINTF("Woken by SIGP\n");
1731             s->waiting = 0;
1732             s->dsp = s->dnad;
1733             lsi_execute_script(s);
1734         }
1735         if (val & LSI_ISTAT0_SRST) {
1736             qdev_reset_all(DEVICE(s));
1737         }
1738         break;
1739     case 0x16: /* MBOX0 */
1740         s->mbox0 = val;
1741         break;
1742     case 0x17: /* MBOX1 */
1743         s->mbox1 = val;
1744         break;
1745     case 0x1a: /* CTEST2 */
1746         s->ctest2 = val & LSI_CTEST2_PCICIE;
1747         break;
1748     case 0x1b: /* CTEST3 */
1749         s->ctest3 = val & 0x0f;
1750         break;
1751     CASE_SET_REG32(temp, 0x1c)
1752     case 0x21: /* CTEST4 */
1753         if (val & 7) {
1754            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1755         }
1756         s->ctest4 = val;
1757         break;
1758     case 0x22: /* CTEST5 */
1759         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1760             BADF("CTEST5 DMA increment not implemented\n");
1761         }
1762         s->ctest5 = val;
1763         break;
1764     CASE_SET_REG24(dbc, 0x24)
1765     CASE_SET_REG32(dnad, 0x28)
1766     case 0x2c: /* DSP[0:7] */
1767         s->dsp &= 0xffffff00;
1768         s->dsp |= val;
1769         break;
1770     case 0x2d: /* DSP[8:15] */
1771         s->dsp &= 0xffff00ff;
1772         s->dsp |= val << 8;
1773         break;
1774     case 0x2e: /* DSP[16:23] */
1775         s->dsp &= 0xff00ffff;
1776         s->dsp |= val << 16;
1777         break;
1778     case 0x2f: /* DSP[24:31] */
1779         s->dsp &= 0x00ffffff;
1780         s->dsp |= val << 24;
1781         if ((s->dmode & LSI_DMODE_MAN) == 0
1782             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1783             lsi_execute_script(s);
1784         break;
1785     CASE_SET_REG32(dsps, 0x30)
1786     CASE_SET_REG32(scratch[0], 0x34)
1787     case 0x38: /* DMODE */
1788         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1789             BADF("IO mappings not implemented\n");
1790         }
1791         s->dmode = val;
1792         break;
1793     case 0x39: /* DIEN */
1794         s->dien = val;
1795         lsi_update_irq(s);
1796         break;
1797     case 0x3a: /* SBR */
1798         s->sbr = val;
1799         break;
1800     case 0x3b: /* DCNTL */
1801         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1802         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1803             lsi_execute_script(s);
1804         break;
1805     case 0x40: /* SIEN0 */
1806         s->sien0 = val;
1807         lsi_update_irq(s);
1808         break;
1809     case 0x41: /* SIEN1 */
1810         s->sien1 = val;
1811         lsi_update_irq(s);
1812         break;
1813     case 0x47: /* GPCNTL0 */
1814         break;
1815     case 0x48: /* STIME0 */
1816         s->stime0 = val;
1817         break;
1818     case 0x49: /* STIME1 */
1819         if (val & 0xf) {
1820             DPRINTF("General purpose timer not implemented\n");
1821             /* ??? Raising the interrupt immediately seems to be sufficient
1822                to keep the FreeBSD driver happy.  */
1823             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1824         }
1825         break;
1826     case 0x4a: /* RESPID0 */
1827         s->respid0 = val;
1828         break;
1829     case 0x4b: /* RESPID1 */
1830         s->respid1 = val;
1831         break;
1832     case 0x4d: /* STEST1 */
1833         s->stest1 = val;
1834         break;
1835     case 0x4e: /* STEST2 */
1836         if (val & 1) {
1837             BADF("Low level mode not implemented\n");
1838         }
1839         s->stest2 = val;
1840         break;
1841     case 0x4f: /* STEST3 */
1842         if (val & 0x41) {
1843             BADF("SCSI FIFO test mode not implemented\n");
1844         }
1845         s->stest3 = val;
1846         break;
1847     case 0x56: /* CCNTL0 */
1848         s->ccntl0 = val;
1849         break;
1850     case 0x57: /* CCNTL1 */
1851         s->ccntl1 = val;
1852         break;
1853     CASE_SET_REG32(mmrs, 0xa0)
1854     CASE_SET_REG32(mmws, 0xa4)
1855     CASE_SET_REG32(sfs, 0xa8)
1856     CASE_SET_REG32(drs, 0xac)
1857     CASE_SET_REG32(sbms, 0xb0)
1858     CASE_SET_REG32(dbms, 0xb4)
1859     CASE_SET_REG32(dnad64, 0xb8)
1860     CASE_SET_REG32(pmjad1, 0xc0)
1861     CASE_SET_REG32(pmjad2, 0xc4)
1862     CASE_SET_REG32(rbc, 0xc8)
1863     CASE_SET_REG32(ua, 0xcc)
1864     CASE_SET_REG32(ia, 0xd4)
1865     CASE_SET_REG32(sbc, 0xd8)
1866     CASE_SET_REG32(csbc, 0xdc)
1867     default:
1868         if (offset >= 0x5c && offset < 0xa0) {
1869             int n;
1870             int shift;
1871             n = (offset - 0x58) >> 2;
1872             shift = (offset & 3) * 8;
1873             s->scratch[n] &= ~(0xff << shift);
1874             s->scratch[n] |= (val & 0xff) << shift;
1875         } else {
1876             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1877         }
1878     }
1879 #undef CASE_SET_REG24
1880 #undef CASE_SET_REG32
1881 }
1882
1883 static void lsi_mmio_write(void *opaque, hwaddr addr,
1884                            uint64_t val, unsigned size)
1885 {
1886     LSIState *s = opaque;
1887
1888     lsi_reg_writeb(s, addr & 0xff, val);
1889 }
1890
1891 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr,
1892                               unsigned size)
1893 {
1894     LSIState *s = opaque;
1895
1896     return lsi_reg_readb(s, addr & 0xff);
1897 }
1898
1899 static const MemoryRegionOps lsi_mmio_ops = {
1900     .read = lsi_mmio_read,
1901     .write = lsi_mmio_write,
1902     .endianness = DEVICE_NATIVE_ENDIAN,
1903     .impl = {
1904         .min_access_size = 1,
1905         .max_access_size = 1,
1906     },
1907 };
1908
1909 static void lsi_ram_write(void *opaque, hwaddr addr,
1910                           uint64_t val, unsigned size)
1911 {
1912     LSIState *s = opaque;
1913     uint32_t newval;
1914     uint32_t mask;
1915     int shift;
1916
1917     newval = s->script_ram[addr >> 2];
1918     shift = (addr & 3) * 8;
1919     mask = ((uint64_t)1 << (size * 8)) - 1;
1920     newval &= ~(mask << shift);
1921     newval |= val << shift;
1922     s->script_ram[addr >> 2] = newval;
1923 }
1924
1925 static uint64_t lsi_ram_read(void *opaque, hwaddr addr,
1926                              unsigned size)
1927 {
1928     LSIState *s = opaque;
1929     uint32_t val;
1930     uint32_t mask;
1931
1932     val = s->script_ram[addr >> 2];
1933     mask = ((uint64_t)1 << (size * 8)) - 1;
1934     val >>= (addr & 3) * 8;
1935     return val & mask;
1936 }
1937
1938 static const MemoryRegionOps lsi_ram_ops = {
1939     .read = lsi_ram_read,
1940     .write = lsi_ram_write,
1941     .endianness = DEVICE_NATIVE_ENDIAN,
1942 };
1943
1944 static uint64_t lsi_io_read(void *opaque, hwaddr addr,
1945                             unsigned size)
1946 {
1947     LSIState *s = opaque;
1948     return lsi_reg_readb(s, addr & 0xff);
1949 }
1950
1951 static void lsi_io_write(void *opaque, hwaddr addr,
1952                          uint64_t val, unsigned size)
1953 {
1954     LSIState *s = opaque;
1955     lsi_reg_writeb(s, addr & 0xff, val);
1956 }
1957
1958 static const MemoryRegionOps lsi_io_ops = {
1959     .read = lsi_io_read,
1960     .write = lsi_io_write,
1961     .endianness = DEVICE_NATIVE_ENDIAN,
1962     .impl = {
1963         .min_access_size = 1,
1964         .max_access_size = 1,
1965     },
1966 };
1967
1968 static void lsi_scsi_reset(DeviceState *dev)
1969 {
1970     LSIState *s = LSI53C895A(dev);
1971
1972     lsi_soft_reset(s);
1973 }
1974
1975 static void lsi_pre_save(void *opaque)
1976 {
1977     LSIState *s = opaque;
1978
1979     if (s->current) {
1980         assert(s->current->dma_buf == NULL);
1981         assert(s->current->dma_len == 0);
1982     }
1983     assert(QTAILQ_EMPTY(&s->queue));
1984 }
1985
1986 static const VMStateDescription vmstate_lsi_scsi = {
1987     .name = "lsiscsi",
1988     .version_id = 0,
1989     .minimum_version_id = 0,
1990     .minimum_version_id_old = 0,
1991     .pre_save = lsi_pre_save,
1992     .fields      = (VMStateField []) {
1993         VMSTATE_PCI_DEVICE(parent_obj, LSIState),
1994
1995         VMSTATE_INT32(carry, LSIState),
1996         VMSTATE_INT32(status, LSIState),
1997         VMSTATE_INT32(msg_action, LSIState),
1998         VMSTATE_INT32(msg_len, LSIState),
1999         VMSTATE_BUFFER(msg, LSIState),
2000         VMSTATE_INT32(waiting, LSIState),
2001
2002         VMSTATE_UINT32(dsa, LSIState),
2003         VMSTATE_UINT32(temp, LSIState),
2004         VMSTATE_UINT32(dnad, LSIState),
2005         VMSTATE_UINT32(dbc, LSIState),
2006         VMSTATE_UINT8(istat0, LSIState),
2007         VMSTATE_UINT8(istat1, LSIState),
2008         VMSTATE_UINT8(dcmd, LSIState),
2009         VMSTATE_UINT8(dstat, LSIState),
2010         VMSTATE_UINT8(dien, LSIState),
2011         VMSTATE_UINT8(sist0, LSIState),
2012         VMSTATE_UINT8(sist1, LSIState),
2013         VMSTATE_UINT8(sien0, LSIState),
2014         VMSTATE_UINT8(sien1, LSIState),
2015         VMSTATE_UINT8(mbox0, LSIState),
2016         VMSTATE_UINT8(mbox1, LSIState),
2017         VMSTATE_UINT8(dfifo, LSIState),
2018         VMSTATE_UINT8(ctest2, LSIState),
2019         VMSTATE_UINT8(ctest3, LSIState),
2020         VMSTATE_UINT8(ctest4, LSIState),
2021         VMSTATE_UINT8(ctest5, LSIState),
2022         VMSTATE_UINT8(ccntl0, LSIState),
2023         VMSTATE_UINT8(ccntl1, LSIState),
2024         VMSTATE_UINT32(dsp, LSIState),
2025         VMSTATE_UINT32(dsps, LSIState),
2026         VMSTATE_UINT8(dmode, LSIState),
2027         VMSTATE_UINT8(dcntl, LSIState),
2028         VMSTATE_UINT8(scntl0, LSIState),
2029         VMSTATE_UINT8(scntl1, LSIState),
2030         VMSTATE_UINT8(scntl2, LSIState),
2031         VMSTATE_UINT8(scntl3, LSIState),
2032         VMSTATE_UINT8(sstat0, LSIState),
2033         VMSTATE_UINT8(sstat1, LSIState),
2034         VMSTATE_UINT8(scid, LSIState),
2035         VMSTATE_UINT8(sxfer, LSIState),
2036         VMSTATE_UINT8(socl, LSIState),
2037         VMSTATE_UINT8(sdid, LSIState),
2038         VMSTATE_UINT8(ssid, LSIState),
2039         VMSTATE_UINT8(sfbr, LSIState),
2040         VMSTATE_UINT8(stest1, LSIState),
2041         VMSTATE_UINT8(stest2, LSIState),
2042         VMSTATE_UINT8(stest3, LSIState),
2043         VMSTATE_UINT8(sidl, LSIState),
2044         VMSTATE_UINT8(stime0, LSIState),
2045         VMSTATE_UINT8(respid0, LSIState),
2046         VMSTATE_UINT8(respid1, LSIState),
2047         VMSTATE_UINT32(mmrs, LSIState),
2048         VMSTATE_UINT32(mmws, LSIState),
2049         VMSTATE_UINT32(sfs, LSIState),
2050         VMSTATE_UINT32(drs, LSIState),
2051         VMSTATE_UINT32(sbms, LSIState),
2052         VMSTATE_UINT32(dbms, LSIState),
2053         VMSTATE_UINT32(dnad64, LSIState),
2054         VMSTATE_UINT32(pmjad1, LSIState),
2055         VMSTATE_UINT32(pmjad2, LSIState),
2056         VMSTATE_UINT32(rbc, LSIState),
2057         VMSTATE_UINT32(ua, LSIState),
2058         VMSTATE_UINT32(ia, LSIState),
2059         VMSTATE_UINT32(sbc, LSIState),
2060         VMSTATE_UINT32(csbc, LSIState),
2061         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2062         VMSTATE_UINT8(sbr, LSIState),
2063
2064         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2065         VMSTATE_END_OF_LIST()
2066     }
2067 };
2068
2069 static void lsi_scsi_uninit(PCIDevice *d)
2070 {
2071     LSIState *s = LSI53C895A(d);
2072
2073     memory_region_destroy(&s->mmio_io);
2074     memory_region_destroy(&s->ram_io);
2075     memory_region_destroy(&s->io_io);
2076 }
2077
2078 static const struct SCSIBusInfo lsi_scsi_info = {
2079     .tcq = true,
2080     .max_target = LSI_MAX_DEVS,
2081     .max_lun = 0,  /* LUN support is buggy */
2082
2083     .transfer_data = lsi_transfer_data,
2084     .complete = lsi_command_complete,
2085     .cancel = lsi_request_cancelled
2086 };
2087
2088 static int lsi_scsi_init(PCIDevice *dev)
2089 {
2090     LSIState *s = LSI53C895A(dev);
2091     DeviceState *d = DEVICE(dev);
2092     uint8_t *pci_conf;
2093     Error *err = NULL;
2094
2095     pci_conf = dev->config;
2096
2097     /* PCI latency timer = 255 */
2098     pci_conf[PCI_LATENCY_TIMER] = 0xff;
2099     /* Interrupt pin A */
2100     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2101
2102     memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
2103                           "lsi-mmio", 0x400);
2104     memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
2105                           "lsi-ram", 0x2000);
2106     memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
2107                           "lsi-io", 256);
2108
2109     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2110     pci_register_bar(dev, 1, 0, &s->mmio_io);
2111     pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2112     QTAILQ_INIT(&s->queue);
2113
2114     scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL);
2115     if (!d->hotplugged) {
2116         scsi_bus_legacy_handle_cmdline(&s->bus, &err);
2117         if (err != NULL) {
2118             error_free(err);
2119             return -1;
2120         }
2121     }
2122     return 0;
2123 }
2124
2125 static void lsi_class_init(ObjectClass *klass, void *data)
2126 {
2127     DeviceClass *dc = DEVICE_CLASS(klass);
2128     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2129
2130     k->init = lsi_scsi_init;
2131     k->exit = lsi_scsi_uninit;
2132     k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2133     k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2134     k->class_id = PCI_CLASS_STORAGE_SCSI;
2135     k->subsystem_id = 0x1000;
2136     dc->reset = lsi_scsi_reset;
2137     dc->vmsd = &vmstate_lsi_scsi;
2138     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2139 }
2140
2141 static const TypeInfo lsi_info = {
2142     .name          = TYPE_LSI53C895A,
2143     .parent        = TYPE_PCI_DEVICE,
2144     .instance_size = sizeof(LSIState),
2145     .class_init    = lsi_class_init,
2146 };
2147
2148 static void lsi53c895a_register_types(void)
2149 {
2150     type_register_static(&lsi_info);
2151 }
2152
2153 type_init(lsi53c895a_register_types)