hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include "hw.h"
  14 #include "pci.h"
  15 #include "scsi-disk.h"
  16
  17 //#define DEBUG_LSI
  18 //#define DEBUG_LSI_REG
  19
  20 #ifdef DEBUG_LSI
  21 #define DPRINTF(fmt, args...) \
  22 do { printf("lsi_scsi: " fmt , ##args); } while (0)
  23 #define BADF(fmt, args...) \
  24 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
  25 #else
  26 #define DPRINTF(fmt, args...) do {} while(0)
  27 #define BADF(fmt, args...) \
  28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
  29 #endif
  30
  31 #define LSI_SCNTL0_TRG    0x01
  32 #define LSI_SCNTL0_AAP    0x02
  33 #define LSI_SCNTL0_EPC    0x08
  34 #define LSI_SCNTL0_WATN   0x10
  35 #define LSI_SCNTL0_START  0x20
  36
  37 #define LSI_SCNTL1_SST    0x01
  38 #define LSI_SCNTL1_IARB   0x02
  39 #define LSI_SCNTL1_AESP   0x04
  40 #define LSI_SCNTL1_RST    0x08
  41 #define LSI_SCNTL1_CON    0x10
  42 #define LSI_SCNTL1_DHP    0x20
  43 #define LSI_SCNTL1_ADB    0x40
  44 #define LSI_SCNTL1_EXC    0x80
  45
  46 #define LSI_SCNTL2_WSR    0x01
  47 #define LSI_SCNTL2_VUE0   0x02
  48 #define LSI_SCNTL2_VUE1   0x04
  49 #define LSI_SCNTL2_WSS    0x08
  50 #define LSI_SCNTL2_SLPHBEN 0x10
  51 #define LSI_SCNTL2_SLPMD  0x20
  52 #define LSI_SCNTL2_CHM    0x40
  53 #define LSI_SCNTL2_SDU    0x80
  54
  55 #define LSI_ISTAT0_DIP    0x01
  56 #define LSI_ISTAT0_SIP    0x02
  57 #define LSI_ISTAT0_INTF   0x04
  58 #define LSI_ISTAT0_CON    0x08
  59 #define LSI_ISTAT0_SEM    0x10
  60 #define LSI_ISTAT0_SIGP   0x20
  61 #define LSI_ISTAT0_SRST   0x40
  62 #define LSI_ISTAT0_ABRT   0x80
  63
  64 #define LSI_ISTAT1_SI     0x01
  65 #define LSI_ISTAT1_SRUN   0x02
  66 #define LSI_ISTAT1_FLSH   0x04
  67
  68 #define LSI_SSTAT0_SDP0   0x01
  69 #define LSI_SSTAT0_RST    0x02
  70 #define LSI_SSTAT0_WOA    0x04
  71 #define LSI_SSTAT0_LOA    0x08
  72 #define LSI_SSTAT0_AIP    0x10
  73 #define LSI_SSTAT0_OLF    0x20
  74 #define LSI_SSTAT0_ORF    0x40
  75 #define LSI_SSTAT0_ILF    0x80
  76
  77 #define LSI_SIST0_PAR     0x01
  78 #define LSI_SIST0_RST     0x02
  79 #define LSI_SIST0_UDC     0x04
  80 #define LSI_SIST0_SGE     0x08
  81 #define LSI_SIST0_RSL     0x10
  82 #define LSI_SIST0_SEL     0x20
  83 #define LSI_SIST0_CMP     0x40
  84 #define LSI_SIST0_MA      0x80
  85
  86 #define LSI_SIST1_HTH     0x01
  87 #define LSI_SIST1_GEN     0x02
  88 #define LSI_SIST1_STO     0x04
  89 #define LSI_SIST1_SBMC    0x10
  90
  91 #define LSI_SOCL_IO       0x01
  92 #define LSI_SOCL_CD       0x02
  93 #define LSI_SOCL_MSG      0x04
  94 #define LSI_SOCL_ATN      0x08
  95 #define LSI_SOCL_SEL      0x10
  96 #define LSI_SOCL_BSY      0x20
  97 #define LSI_SOCL_ACK      0x40
  98 #define LSI_SOCL_REQ      0x80
  99
 100 #define LSI_DSTAT_IID     0x01
 101 #define LSI_DSTAT_SIR     0x04
 102 #define LSI_DSTAT_SSI     0x08
 103 #define LSI_DSTAT_ABRT    0x10
 104 #define LSI_DSTAT_BF      0x20
 105 #define LSI_DSTAT_MDPE    0x40
 106 #define LSI_DSTAT_DFE     0x80
 107
 108 #define LSI_DCNTL_COM     0x01
 109 #define LSI_DCNTL_IRQD    0x02
 110 #define LSI_DCNTL_STD     0x04
 111 #define LSI_DCNTL_IRQM    0x08
 112 #define LSI_DCNTL_SSM     0x10
 113 #define LSI_DCNTL_PFEN    0x20
 114 #define LSI_DCNTL_PFF     0x40
 115 #define LSI_DCNTL_CLSE    0x80
 116
 117 #define LSI_DMODE_MAN     0x01
 118 #define LSI_DMODE_BOF     0x02
 119 #define LSI_DMODE_ERMP    0x04
 120 #define LSI_DMODE_ERL     0x08
 121 #define LSI_DMODE_DIOM    0x10
 122 #define LSI_DMODE_SIOM    0x20
 123
 124 #define LSI_CTEST2_DACK   0x01
 125 #define LSI_CTEST2_DREQ   0x02
 126 #define LSI_CTEST2_TEOP   0x04
 127 #define LSI_CTEST2_PCICIE 0x08
 128 #define LSI_CTEST2_CM     0x10
 129 #define LSI_CTEST2_CIO    0x20
 130 #define LSI_CTEST2_SIGP   0x40
 131 #define LSI_CTEST2_DDIR   0x80
 132
 133 #define LSI_CTEST5_BL2    0x04
 134 #define LSI_CTEST5_DDIR   0x08
 135 #define LSI_CTEST5_MASR   0x10
 136 #define LSI_CTEST5_DFSN   0x20
 137 #define LSI_CTEST5_BBCK   0x40
 138 #define LSI_CTEST5_ADCK   0x80
 139
 140 #define LSI_CCNTL0_DILS   0x01
 141 #define LSI_CCNTL0_DISFC  0x10
 142 #define LSI_CCNTL0_ENNDJ  0x20
 143 #define LSI_CCNTL0_PMJCTL 0x40
 144 #define LSI_CCNTL0_ENPMJ  0x80
 145
 146 #define PHASE_DO          0
 147 #define PHASE_DI          1
 148 #define PHASE_CMD         2
 149 #define PHASE_ST          3
 150 #define PHASE_MO          6
 151 #define PHASE_MI          7
 152 #define PHASE_MASK        7
 153
 154 /* The HBA is ID 7, so for simplicitly limit to 7 devices.  */
 155 #define LSI_MAX_DEVS      7
 156
 157 /* Maximum length of MSG IN data.  */
 158 #define LSI_MAX_MSGIN_LEN 8
 159
 160 /* Flag set if this is a tagged command.  */
 161 #define LSI_TAG_VALID     (1 << 16)
 162
 163 typedef struct {
 164     uint32_t tag;
 165     uint32_t pending;
 166     int out;
 167 } lsi_queue;
 168
 169 typedef struct {
 170     PCIDevice pci_dev;
 171     int mmio_io_addr;
 172     int ram_io_addr;
 173     uint32_t script_ram_base;
 174
 175     int carry; /* ??? Should this be an a visible register somewhere?  */
 176     int sense;
 177     /* Action to take at the end of a MSG IN phase.
 178        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 179     int msg_action;
 180     int msg_len;
 181     uint8_t msg[LSI_MAX_MSGIN_LEN];
 182     /* 0 if SCRIPTS are running or stopped.
 183      * 1 if a Wait Reselect instruction has been issued.
 184      * 2 if processing DMA from lsi_execute_script.
 185      * 3 if a DMA operation is in progress.  */
 186     int waiting;
 187     SCSIDevice *scsi_dev[LSI_MAX_DEVS];
 188     SCSIDevice *current_dev;
 189     int current_lun;
 190     /* The tag is a combination of the device ID and the SCSI tag.  */
 191     uint32_t current_tag;
 192     uint32_t current_dma_len;
 193     uint8_t *dma_buf;
 194     lsi_queue *queue;
 195     int queue_len;
 196     int active_commands;
 197
 198     uint32_t dsa;
 199     uint32_t temp;
 200     uint32_t dnad;
 201     uint32_t dbc;
 202     uint8_t istat0;
 203     uint8_t istat1;
 204     uint8_t dcmd;
 205     uint8_t dstat;
 206     uint8_t dien;
 207     uint8_t sist0;
 208     uint8_t sist1;
 209     uint8_t sien0;
 210     uint8_t sien1;
 211     uint8_t mbox0;
 212     uint8_t mbox1;
 213     uint8_t dfifo;
 214     uint8_t ctest3;
 215     uint8_t ctest4;
 216     uint8_t ctest5;
 217     uint8_t ccntl0;
 218     uint8_t ccntl1;
 219     uint32_t dsp;
 220     uint32_t dsps;
 221     uint8_t dmode;
 222     uint8_t dcntl;
 223     uint8_t scntl0;
 224     uint8_t scntl1;
 225     uint8_t scntl2;
 226     uint8_t scntl3;
 227     uint8_t sstat0;
 228     uint8_t sstat1;
 229     uint8_t scid;
 230     uint8_t sxfer;
 231     uint8_t socl;
 232     uint8_t sdid;
 233     uint8_t ssid;
 234     uint8_t sfbr;
 235     uint8_t stest1;
 236     uint8_t stest2;
 237     uint8_t stest3;
 238     uint8_t sidl;
 239     uint8_t stime0;
 240     uint8_t respid0;
 241     uint8_t respid1;
 242     uint32_t mmrs;
 243     uint32_t mmws;
 244     uint32_t sfs;
 245     uint32_t drs;
 246     uint32_t sbms;
 247     uint32_t dmbs;
 248     uint32_t dnad64;
 249     uint32_t pmjad1;
 250     uint32_t pmjad2;
 251     uint32_t rbc;
 252     uint32_t ua;
 253     uint32_t ia;
 254     uint32_t sbc;
 255     uint32_t csbc;
 256     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 257
 258     /* Script ram is stored as 32-bit words in host byteorder.  */
 259     uint32_t script_ram[2048];
 260 } LSIState;
 261
 262 static void lsi_soft_reset(LSIState *s)
 263 {
 264     DPRINTF("Reset\n");
 265     s->carry = 0;
 266
 267     s->waiting = 0;
 268     s->dsa = 0;
 269     s->dnad = 0;
 270     s->dbc = 0;
 271     s->temp = 0;
 272     memset(s->scratch, 0, sizeof(s->scratch));
 273     s->istat0 = 0;
 274     s->istat1 = 0;
 275     s->dcmd = 0;
 276     s->dstat = 0;
 277     s->dien = 0;
 278     s->sist0 = 0;
 279     s->sist1 = 0;
 280     s->sien0 = 0;
 281     s->sien1 = 0;
 282     s->mbox0 = 0;
 283     s->mbox1 = 0;
 284     s->dfifo = 0;
 285     s->ctest3 = 0;
 286     s->ctest4 = 0;
 287     s->ctest5 = 0;
 288     s->ccntl0 = 0;
 289     s->ccntl1 = 0;
 290     s->dsp = 0;
 291     s->dsps = 0;
 292     s->dmode = 0;
 293     s->dcntl = 0;
 294     s->scntl0 = 0xc0;
 295     s->scntl1 = 0;
 296     s->scntl2 = 0;
 297     s->scntl3 = 0;
 298     s->sstat0 = 0;
 299     s->sstat1 = 0;
 300     s->scid = 7;
 301     s->sxfer = 0;
 302     s->socl = 0;
 303     s->stest1 = 0;
 304     s->stest2 = 0;
 305     s->stest3 = 0;
 306     s->sidl = 0;
 307     s->stime0 = 0;
 308     s->respid0 = 0x80;
 309     s->respid1 = 0;
 310     s->mmrs = 0;
 311     s->mmws = 0;
 312     s->sfs = 0;
 313     s->drs = 0;
 314     s->sbms = 0;
 315     s->dmbs = 0;
 316     s->dnad64 = 0;
 317     s->pmjad1 = 0;
 318     s->pmjad2 = 0;
 319     s->rbc = 0;
 320     s->ua = 0;
 321     s->ia = 0;
 322     s->sbc = 0;
 323     s->csbc = 0;
 324 }
 325
 326 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 327 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 328 static void lsi_execute_script(LSIState *s);
 329
 330 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 331 {
 332     uint32_t buf;
 333
 334     /* Optimize reading from SCRIPTS RAM.  */
 335     if ((addr & 0xffffe000) == s->script_ram_base) {
 336         return s->script_ram[(addr & 0x1fff) >> 2];
 337     }
 338     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 339     return cpu_to_le32(buf);
 340 }
 341
 342 static void lsi_stop_script(LSIState *s)
 343 {
 344     s->istat1 &= ~LSI_ISTAT1_SRUN;
 345 }
 346
 347 static void lsi_update_irq(LSIState *s)
 348 {
 349     int level;
 350     static int last_level;
 351
 352     /* It's unclear whether the DIP/SIP bits should be cleared when the
 353        Interrupt Status Registers are cleared or when istat0 is read.
 354        We currently do the formwer, which seems to work.  */
 355     level = 0;
 356     if (s->dstat) {
 357         if (s->dstat & s->dien)
 358             level = 1;
 359         s->istat0 |= LSI_ISTAT0_DIP;
 360     } else {
 361         s->istat0 &= ~LSI_ISTAT0_DIP;
 362     }
 363
 364     if (s->sist0 || s->sist1) {
 365         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 366             level = 1;
 367         s->istat0 |= LSI_ISTAT0_SIP;
 368     } else {
 369         s->istat0 &= ~LSI_ISTAT0_SIP;
 370     }
 371     if (s->istat0 & LSI_ISTAT0_INTF)
 372         level = 1;
 373
 374     if (level != last_level) {
 375         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 376                 level, s->dstat, s->sist1, s->sist0);
 377         last_level = level;
 378     }
 379     qemu_set_irq(s->pci_dev.irq[0], level);
 380 }
 381
 382 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 383 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 384 {
 385     uint32_t mask0;
 386     uint32_t mask1;
 387
 388     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 389             stat1, stat0, s->sist1, s->sist0);
 390     s->sist0 |= stat0;
 391     s->sist1 |= stat1;
 392     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 393        we don't stop processing when raising STO.  Instead continue
 394        execution and stop at the next insn that accesses the SCSI bus.  */
 395     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 396     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 397     mask1 &= ~LSI_SIST1_STO;
 398     if (s->sist0 & mask0 || s->sist1 & mask1) {
 399         lsi_stop_script(s);
 400     }
 401     lsi_update_irq(s);
 402 }
 403
 404 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 405 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 406 {
 407     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 408     s->dstat |= stat;
 409     lsi_update_irq(s);
 410     lsi_stop_script(s);
 411 }
 412
 413 static inline void lsi_set_phase(LSIState *s, int phase)
 414 {
 415     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 416 }
 417
 418 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 419 {
 420     /* Trigger a phase mismatch.  */
 421     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 422         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 423             s->dsp = s->pmjad1;
 424         } else {
 425             s->dsp = s->pmjad2;
 426         }
 427         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 428     } else {
 429         DPRINTF("Phase mismatch interrupt\n");
 430         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 431         lsi_stop_script(s);
 432     }
 433     lsi_set_phase(s, new_phase);
 434 }
 435
 436
 437 /* Resume SCRIPTS execution after a DMA operation.  */
 438 static void lsi_resume_script(LSIState *s)
 439 {
 440     if (s->waiting != 2) {
 441         s->waiting = 0;
 442         lsi_execute_script(s);
 443     } else {
 444         s->waiting = 0;
 445     }
 446 }
 447
 448 /* Initiate a SCSI layer data transfer.  */
 449 static void lsi_do_dma(LSIState *s, int out)
 450 {
 451     uint32_t count;
 452     uint32_t addr;
 453
 454     if (!s->current_dma_len) {
 455         /* Wait until data is available.  */
 456         DPRINTF("DMA no data available\n");
 457         return;
 458     }
 459
 460     count = s->dbc;
 461     if (count > s->current_dma_len)
 462         count = s->current_dma_len;
 463     DPRINTF("DMA addr=0x%08x len=%d\n", s->dnad, count);
 464
 465     addr = s->dnad;
 466     s->csbc += count;
 467     s->dnad += count;
 468     s->dbc -= count;
 469
 470     if (s->dma_buf == NULL) {
 471         s->dma_buf = scsi_get_buf(s->current_dev, s->current_tag);
 472     }
 473
 474     /* ??? Set SFBR to first data byte.  */
 475     if (out) {
 476         cpu_physical_memory_read(addr, s->dma_buf, count);
 477     } else {
 478         cpu_physical_memory_write(addr, s->dma_buf, count);
 479     }
 480     s->current_dma_len -= count;
 481     if (s->current_dma_len == 0) {
 482         s->dma_buf = NULL;
 483         if (out) {
 484             /* Write the data.  */
 485             scsi_write_data(s->current_dev, s->current_tag);
 486         } else {
 487             /* Request any remaining data.  */
 488             scsi_read_data(s->current_dev, s->current_tag);
 489         }
 490     } else {
 491         s->dma_buf += count;
 492         lsi_resume_script(s);
 493     }
 494 }
 495
 496
 497 /* Add a command to the queue.  */
 498 static void lsi_queue_command(LSIState *s)
 499 {
 500     lsi_queue *p;
 501
 502     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 503     if (s->queue_len == s->active_commands) {
 504         s->queue_len++;
 505         s->queue = realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 506     }
 507     p = &s->queue[s->active_commands++];
 508     p->tag = s->current_tag;
 509     p->pending = 0;
 510     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 511 }
 512
 513 /* Queue a byte for a MSG IN phase.  */
 514 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 515 {
 516     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 517         BADF("MSG IN data too long\n");
 518     } else {
 519         DPRINTF("MSG IN 0x%02x\n", data);
 520         s->msg[s->msg_len++] = data;
 521     }
 522 }
 523
 524 /* Perform reselection to continue a command.  */
 525 static void lsi_reselect(LSIState *s, uint32_t tag)
 526 {
 527     lsi_queue *p;
 528     int n;
 529     int id;
 530
 531     p = NULL;
 532     for (n = 0; n < s->active_commands; n++) {
 533         p = &s->queue[n];
 534         if (p->tag == tag)
 535             break;
 536     }
 537     if (n == s->active_commands) {
 538         BADF("Reselected non-existant command tag=0x%x\n", tag);
 539         return;
 540     }
 541     id = (tag >> 8) & 0xf;
 542     s->ssid = id | 0x80;
 543     DPRINTF("Reselected target %d\n", id);
 544     s->current_dev = s->scsi_dev[id];
 545     s->current_tag = tag;
 546     s->scntl1 |= LSI_SCNTL1_CON;
 547     lsi_set_phase(s, PHASE_MI);
 548     s->msg_action = p->out ? 2 : 3;
 549     s->current_dma_len = p->pending;
 550     s->dma_buf = NULL;
 551     lsi_add_msg_byte(s, 0x80);
 552     if (s->current_tag & LSI_TAG_VALID) {
 553         lsi_add_msg_byte(s, 0x20);
 554         lsi_add_msg_byte(s, tag & 0xff);
 555     }
 556
 557     s->active_commands--;
 558     if (n != s->active_commands) {
 559         s->queue[n] = s->queue[s->active_commands];
 560     }
 561 }
 562
 563 /* Record that data is available for a queued command.  Returns zero if
 564    the device was reselected, nonzero if the IO is deferred.  */
 565 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 566 {
 567     lsi_queue *p;
 568     int i;
 569     for (i = 0; i < s->active_commands; i++) {
 570         p = &s->queue[i];
 571         if (p->tag == tag) {
 572             if (p->pending) {
 573                 BADF("Multiple IO pending for tag %d\n", tag);
 574             }
 575             p->pending = arg;
 576             if (s->waiting == 1) {
 577                 /* Reselect device.  */
 578                 lsi_reselect(s, tag);
 579                 return 0;
 580             } else {
 581                DPRINTF("Queueing IO tag=0x%x\n", tag);
 582                 p->pending = arg;
 583                 return 1;
 584             }
 585         }
 586     }
 587     BADF("IO with unknown tag %d\n", tag);
 588     return 1;
 589 }
 590
 591 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 592 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
 593                                  uint32_t arg)
 594 {
 595     LSIState *s = (LSIState *)opaque;
 596     int out;
 597
 598     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 599     if (reason == SCSI_REASON_DONE) {
 600         DPRINTF("Command complete sense=%d\n", (int)arg);
 601         s->sense = arg;
 602         if (s->waiting && s->dbc != 0) {
 603             /* Raise phase mismatch for short transfers.  */
 604             lsi_bad_phase(s, out, PHASE_ST);
 605         } else {
 606             lsi_set_phase(s, PHASE_ST);
 607         }
 608         lsi_resume_script(s);
 609         return;
 610     }
 611
 612     if (s->waiting == 1 || tag != s->current_tag) {
 613         if (lsi_queue_tag(s, tag, arg))
 614             return;
 615     }
 616     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 617     s->current_dma_len = arg;
 618     if (!s->waiting)
 619         return;
 620     if (s->waiting == 1 || s->dbc == 0) {
 621         lsi_resume_script(s);
 622     } else {
 623         lsi_do_dma(s, out);
 624     }
 625 }
 626
 627 static void lsi_do_command(LSIState *s)
 628 {
 629     uint8_t buf[16];
 630     int n;
 631
 632     DPRINTF("Send command len=%d\n", s->dbc);
 633     if (s->dbc > 16)
 634         s->dbc = 16;
 635     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 636     s->sfbr = buf[0];
 637     n = scsi_send_command(s->current_dev, s->current_tag, buf, s->current_lun);
 638     if (n > 0) {
 639         lsi_set_phase(s, PHASE_DI);
 640         scsi_read_data(s->current_dev, s->current_tag);
 641     } else if (n < 0) {
 642         lsi_set_phase(s, PHASE_DO);
 643         scsi_write_data(s->current_dev, s->current_tag);
 644     }
 645     if (n && s->current_dma_len == 0) {
 646         /* Command did not complete immediately so disconnect.  */
 647         lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 648         lsi_add_msg_byte(s, 4); /* DISCONNECT */
 649         lsi_set_phase(s, PHASE_MI);
 650         s->msg_action = 1;
 651         lsi_queue_command(s);
 652     }
 653 }
 654
 655 static void lsi_do_status(LSIState *s)
 656 {
 657     uint8_t sense;
 658     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 659     if (s->dbc != 1)
 660         BADF("Bad Status move\n");
 661     s->dbc = 1;
 662     sense = s->sense;
 663     s->sfbr = sense;
 664     cpu_physical_memory_write(s->dnad, &sense, 1);
 665     lsi_set_phase(s, PHASE_MI);
 666     s->msg_action = 1;
 667     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 668 }
 669
 670 static void lsi_disconnect(LSIState *s)
 671 {
 672     s->scntl1 &= ~LSI_SCNTL1_CON;
 673     s->sstat1 &= ~PHASE_MASK;
 674 }
 675
 676 static void lsi_do_msgin(LSIState *s)
 677 {
 678     int len;
 679     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 680     s->sfbr = s->msg[0];
 681     len = s->msg_len;
 682     if (len > s->dbc)
 683         len = s->dbc;
 684     cpu_physical_memory_write(s->dnad, s->msg, len);
 685     /* Linux drivers rely on the last byte being in the SIDL.  */
 686     s->sidl = s->msg[len - 1];
 687     s->msg_len -= len;
 688     if (s->msg_len) {
 689         memmove(s->msg, s->msg + len, s->msg_len);
 690     } else {
 691         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 692            switch to PHASE_MO.  */
 693         switch (s->msg_action) {
 694         case 0:
 695             lsi_set_phase(s, PHASE_CMD);
 696             break;
 697         case 1:
 698             lsi_disconnect(s);
 699             break;
 700         case 2:
 701             lsi_set_phase(s, PHASE_DO);
 702             break;
 703         case 3:
 704             lsi_set_phase(s, PHASE_DI);
 705             break;
 706         default:
 707             abort();
 708         }
 709     }
 710 }
 711
 712 /* Read the next byte during a MSGOUT phase.  */
 713 static uint8_t lsi_get_msgbyte(LSIState *s)
 714 {
 715     uint8_t data;
 716     cpu_physical_memory_read(s->dnad, &data, 1);
 717     s->dnad++;
 718     s->dbc--;
 719     return data;
 720 }
 721
 722 static void lsi_do_msgout(LSIState *s)
 723 {
 724     uint8_t msg;
 725     int len;
 726
 727     DPRINTF("MSG out len=%d\n", s->dbc);
 728     while (s->dbc) {
 729         msg = lsi_get_msgbyte(s);
 730         s->sfbr = msg;
 731
 732         switch (msg) {
 733         case 0x00:
 734             DPRINTF("MSG: Disconnect\n");
 735             lsi_disconnect(s);
 736             break;
 737         case 0x08:
 738             DPRINTF("MSG: No Operation\n");
 739             lsi_set_phase(s, PHASE_CMD);
 740             break;
 741         case 0x01:
 742             len = lsi_get_msgbyte(s);
 743             msg = lsi_get_msgbyte(s);
 744             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 745             switch (msg) {
 746             case 1:
 747                 DPRINTF("SDTR (ignored)\n");
 748                 s->dbc -= 2;
 749                 break;
 750             case 3:
 751                 DPRINTF("WDTR (ignored)\n");
 752                 s->dbc -= 1;
 753                 break;
 754             default:
 755                 goto bad;
 756             }
 757             break;
 758         case 0x20: /* SIMPLE queue */
 759             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 760             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 761             break;
 762         case 0x21: /* HEAD of queue */
 763             BADF("HEAD queue not implemented\n");
 764             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 765             break;
 766         case 0x22: /* ORDERED queue */
 767             BADF("ORDERED queue not implemented\n");
 768             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 769             break;
 770         default:
 771             if ((msg & 0x80) == 0) {
 772                 goto bad;
 773             }
 774             s->current_lun = msg & 7;
 775             DPRINTF("Select LUN %d\n", s->current_lun);
 776             lsi_set_phase(s, PHASE_CMD);
 777             break;
 778         }
 779     }
 780     return;
 781 bad:
 782     BADF("Unimplemented message 0x%02x\n", msg);
 783     lsi_set_phase(s, PHASE_MI);
 784     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 785     s->msg_action = 0;
 786 }
 787
 788 /* Sign extend a 24-bit value.  */
 789 static inline int32_t sxt24(int32_t n)
 790 {
 791     return (n << 8) >> 8;
 792 }
 793
 794 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 795 {
 796     int n;
 797     uint8_t buf[TARGET_PAGE_SIZE];
 798
 799     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 800     while (count) {
 801         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
 802         cpu_physical_memory_read(src, buf, n);
 803         cpu_physical_memory_write(dest, buf, n);
 804         src += n;
 805         dest += n;
 806         count -= n;
 807     }
 808 }
 809
 810 static void lsi_wait_reselect(LSIState *s)
 811 {
 812     int i;
 813     DPRINTF("Wait Reselect\n");
 814     if (s->current_dma_len)
 815         BADF("Reselect with pending DMA\n");
 816     for (i = 0; i < s->active_commands; i++) {
 817         if (s->queue[i].pending) {
 818             lsi_reselect(s, s->queue[i].tag);
 819             break;
 820         }
 821     }
 822     if (s->current_dma_len == 0) {
 823         s->waiting = 1;
 824     }
 825 }
 826
 827 static void lsi_execute_script(LSIState *s)
 828 {
 829     uint32_t insn;
 830     uint32_t addr;
 831     int opcode;
 832
 833     s->istat1 |= LSI_ISTAT1_SRUN;
 834 again:
 835     insn = read_dword(s, s->dsp);
 836     addr = read_dword(s, s->dsp + 4);
 837     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 838     s->dsps = addr;
 839     s->dcmd = insn >> 24;
 840     s->dsp += 8;
 841     switch (insn >> 30) {
 842     case 0: /* Block move.  */
 843         if (s->sist1 & LSI_SIST1_STO) {
 844             DPRINTF("Delayed select timeout\n");
 845             lsi_stop_script(s);
 846             break;
 847         }
 848         s->dbc = insn & 0xffffff;
 849         s->rbc = s->dbc;
 850         if (insn & (1 << 29)) {
 851             /* Indirect addressing.  */
 852             addr = read_dword(s, addr);
 853         } else if (insn & (1 << 28)) {
 854             uint32_t buf[2];
 855             int32_t offset;
 856             /* Table indirect addressing.  */
 857             offset = sxt24(addr);
 858             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 859             s->dbc = cpu_to_le32(buf[0]);
 860             s->rbc = s->dbc;
 861             addr = cpu_to_le32(buf[1]);
 862         }
 863         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 864             DPRINTF("Wrong phase got %d expected %d\n",
 865                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 866             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 867             break;
 868         }
 869         s->dnad = addr;
 870         /* ??? Set ESA.  */
 871         s->ia = s->dsp - 8;
 872         switch (s->sstat1 & 0x7) {
 873         case PHASE_DO:
 874             s->waiting = 2;
 875             lsi_do_dma(s, 1);
 876             if (s->waiting)
 877                 s->waiting = 3;
 878             break;
 879         case PHASE_DI:
 880             s->waiting = 2;
 881             lsi_do_dma(s, 0);
 882             if (s->waiting)
 883                 s->waiting = 3;
 884             break;
 885         case PHASE_CMD:
 886             lsi_do_command(s);
 887             break;
 888         case PHASE_ST:
 889             lsi_do_status(s);
 890             break;
 891         case PHASE_MO:
 892             lsi_do_msgout(s);
 893             break;
 894         case PHASE_MI:
 895             lsi_do_msgin(s);
 896             break;
 897         default:
 898             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
 899             exit(1);
 900         }
 901         s->dfifo = s->dbc & 0xff;
 902         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
 903         s->sbc = s->dbc;
 904         s->rbc -= s->dbc;
 905         s->ua = addr + s->dbc;
 906         break;
 907
 908     case 1: /* IO or Read/Write instruction.  */
 909         opcode = (insn >> 27) & 7;
 910         if (opcode < 5) {
 911             uint32_t id;
 912
 913             if (insn & (1 << 25)) {
 914                 id = read_dword(s, s->dsa + sxt24(insn));
 915             } else {
 916                 id = addr;
 917             }
 918             id = (id >> 16) & 0xf;
 919             if (insn & (1 << 26)) {
 920                 addr = s->dsp + sxt24(addr);
 921             }
 922             s->dnad = addr;
 923             switch (opcode) {
 924             case 0: /* Select */
 925                 s->sdid = id;
 926                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
 927                     DPRINTF("Already reselected by target %d\n", id);
 928                     break;
 929                 }
 930                 s->sstat0 |= LSI_SSTAT0_WOA;
 931                 s->scntl1 &= ~LSI_SCNTL1_IARB;
 932                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
 933                     DPRINTF("Selected absent target %d\n", id);
 934                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 935                     lsi_disconnect(s);
 936                     break;
 937                 }
 938                 DPRINTF("Selected target %d%s\n",
 939                         id, insn & (1 << 3) ? " ATN" : "");
 940                 /* ??? Linux drivers compain when this is set.  Maybe
 941                    it only applies in low-level mode (unimplemented).
 942                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
 943                 s->current_dev = s->scsi_dev[id];
 944                 s->current_tag = id << 8;
 945                 s->scntl1 |= LSI_SCNTL1_CON;
 946                 if (insn & (1 << 3)) {
 947                     s->socl |= LSI_SOCL_ATN;
 948                 }
 949                 lsi_set_phase(s, PHASE_MO);
 950                 break;
 951             case 1: /* Disconnect */
 952                 DPRINTF("Wait Disconect\n");
 953                 s->scntl1 &= ~LSI_SCNTL1_CON;
 954                 break;
 955             case 2: /* Wait Reselect */
 956                 lsi_wait_reselect(s);
 957                 break;
 958             case 3: /* Set */
 959                 DPRINTF("Set%s%s%s%s\n",
 960                         insn & (1 << 3) ? " ATN" : "",
 961                         insn & (1 << 6) ? " ACK" : "",
 962                         insn & (1 << 9) ? " TM" : "",
 963                         insn & (1 << 10) ? " CC" : "");
 964                 if (insn & (1 << 3)) {
 965                     s->socl |= LSI_SOCL_ATN;
 966                     lsi_set_phase(s, PHASE_MO);
 967                 }
 968                 if (insn & (1 << 9)) {
 969                     BADF("Target mode not implemented\n");
 970                     exit(1);
 971                 }
 972                 if (insn & (1 << 10))
 973                     s->carry = 1;
 974                 break;
 975             case 4: /* Clear */
 976                 DPRINTF("Clear%s%s%s%s\n",
 977                         insn & (1 << 3) ? " ATN" : "",
 978                         insn & (1 << 6) ? " ACK" : "",
 979                         insn & (1 << 9) ? " TM" : "",
 980                         insn & (1 << 10) ? " CC" : "");
 981                 if (insn & (1 << 3)) {
 982                     s->socl &= ~LSI_SOCL_ATN;
 983                 }
 984                 if (insn & (1 << 10))
 985                     s->carry = 0;
 986                 break;
 987             }
 988         } else {
 989             uint8_t op0;
 990             uint8_t op1;
 991             uint8_t data8;
 992             int reg;
 993             int operator;
 994 #ifdef DEBUG_LSI
 995             static const char *opcode_names[3] =
 996                 {"Write", "Read", "Read-Modify-Write"};
 997             static const char *operator_names[8] =
 998                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
 999 #endif
1000
1001             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1002             data8 = (insn >> 8) & 0xff;
1003             opcode = (insn >> 27) & 7;
1004             operator = (insn >> 24) & 7;
1005             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1006                     opcode_names[opcode - 5], reg,
1007                     operator_names[operator], data8, s->sfbr,
1008                     (insn & (1 << 23)) ? " SFBR" : "");
1009             op0 = op1 = 0;
1010             switch (opcode) {
1011             case 5: /* From SFBR */
1012                 op0 = s->sfbr;
1013                 op1 = data8;
1014                 break;
1015             case 6: /* To SFBR */
1016                 if (operator)
1017                     op0 = lsi_reg_readb(s, reg);
1018                 op1 = data8;
1019                 break;
1020             case 7: /* Read-modify-write */
1021                 if (operator)
1022                     op0 = lsi_reg_readb(s, reg);
1023                 if (insn & (1 << 23)) {
1024                     op1 = s->sfbr;
1025                 } else {
1026                     op1 = data8;
1027                 }
1028                 break;
1029             }
1030
1031             switch (operator) {
1032             case 0: /* move */
1033                 op0 = op1;
1034                 break;
1035             case 1: /* Shift left */
1036                 op1 = op0 >> 7;
1037                 op0 = (op0 << 1) | s->carry;
1038                 s->carry = op1;
1039                 break;
1040             case 2: /* OR */
1041                 op0 |= op1;
1042                 break;
1043             case 3: /* XOR */
1044                 op0 ^= op1;
1045                 break;
1046             case 4: /* AND */
1047                 op0 &= op1;
1048                 break;
1049             case 5: /* SHR */
1050                 op1 = op0 & 1;
1051                 op0 = (op0 >> 1) | (s->carry << 7);
1052                 s->carry = op1;
1053                 break;
1054             case 6: /* ADD */
1055                 op0 += op1;
1056                 s->carry = op0 < op1;
1057                 break;
1058             case 7: /* ADC */
1059                 op0 += op1 + s->carry;
1060                 if (s->carry)
1061                     s->carry = op0 <= op1;
1062                 else
1063                     s->carry = op0 < op1;
1064                 break;
1065             }
1066
1067             switch (opcode) {
1068             case 5: /* From SFBR */
1069             case 7: /* Read-modify-write */
1070                 lsi_reg_writeb(s, reg, op0);
1071                 break;
1072             case 6: /* To SFBR */
1073                 s->sfbr = op0;
1074                 break;
1075             }
1076         }
1077         break;
1078
1079     case 2: /* Transfer Control.  */
1080         {
1081             int cond;
1082             int jmp;
1083
1084             if ((insn & 0x002e0000) == 0) {
1085                 DPRINTF("NOP\n");
1086                 break;
1087             }
1088             if (s->sist1 & LSI_SIST1_STO) {
1089                 DPRINTF("Delayed select timeout\n");
1090                 lsi_stop_script(s);
1091                 break;
1092             }
1093             cond = jmp = (insn & (1 << 19)) != 0;
1094             if (cond == jmp && (insn & (1 << 21))) {
1095                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1096                 cond = s->carry != 0;
1097             }
1098             if (cond == jmp && (insn & (1 << 17))) {
1099                 DPRINTF("Compare phase %d %c= %d\n",
1100                         (s->sstat1 & PHASE_MASK),
1101                         jmp ? '=' : '!',
1102                         ((insn >> 24) & 7));
1103                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1104             }
1105             if (cond == jmp && (insn & (1 << 18))) {
1106                 uint8_t mask;
1107
1108                 mask = (~insn >> 8) & 0xff;
1109                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1110                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1111                 cond = (s->sfbr & mask) == (insn & mask);
1112             }
1113             if (cond == jmp) {
1114                 if (insn & (1 << 23)) {
1115                     /* Relative address.  */
1116                     addr = s->dsp + sxt24(addr);
1117                 }
1118                 switch ((insn >> 27) & 7) {
1119                 case 0: /* Jump */
1120                     DPRINTF("Jump to 0x%08x\n", addr);
1121                     s->dsp = addr;
1122                     break;
1123                 case 1: /* Call */
1124                     DPRINTF("Call 0x%08x\n", addr);
1125                     s->temp = s->dsp;
1126                     s->dsp = addr;
1127                     break;
1128                 case 2: /* Return */
1129                     DPRINTF("Return to 0x%08x\n", s->temp);
1130                     s->dsp = s->temp;
1131                     break;
1132                 case 3: /* Interrupt */
1133                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1134                     if ((insn & (1 << 20)) != 0) {
1135                         s->istat0 |= LSI_ISTAT0_INTF;
1136                         lsi_update_irq(s);
1137                     } else {
1138                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1139                     }
1140                     break;
1141                 default:
1142                     DPRINTF("Illegal transfer control\n");
1143                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1144                     break;
1145                 }
1146             } else {
1147                 DPRINTF("Control condition failed\n");
1148             }
1149         }
1150         break;
1151
1152     case 3:
1153         if ((insn & (1 << 29)) == 0) {
1154             /* Memory move.  */
1155             uint32_t dest;
1156             /* ??? The docs imply the destination address is loaded into
1157                the TEMP register.  However the Linux drivers rely on
1158                the value being presrved.  */
1159             dest = read_dword(s, s->dsp);
1160             s->dsp += 4;
1161             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1162         } else {
1163             uint8_t data[7];
1164             int reg;
1165             int n;
1166             int i;
1167
1168             if (insn & (1 << 28)) {
1169                 addr = s->dsa + sxt24(addr);
1170             }
1171             n = (insn & 7);
1172             reg = (insn >> 16) & 0xff;
1173             if (insn & (1 << 24)) {
1174                 cpu_physical_memory_read(addr, data, n);
1175                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1176                         addr, *(int *)data);
1177                 for (i = 0; i < n; i++) {
1178                     lsi_reg_writeb(s, reg + i, data[i]);
1179                 }
1180             } else {
1181                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1182                 for (i = 0; i < n; i++) {
1183                     data[i] = lsi_reg_readb(s, reg + i);
1184                 }
1185                 cpu_physical_memory_write(addr, data, n);
1186             }
1187         }
1188     }
1189     /* ??? Need to avoid infinite loops.  */
1190     if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1191         if (s->dcntl & LSI_DCNTL_SSM) {
1192             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1193         } else {
1194             goto again;
1195         }
1196     }
1197     DPRINTF("SCRIPTS execution stopped\n");
1198 }
1199
1200 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1201 {
1202     uint8_t tmp;
1203 #define CASE_GET_REG32(name, addr) \
1204     case addr: return s->name & 0xff; \
1205     case addr + 1: return (s->name >> 8) & 0xff; \
1206     case addr + 2: return (s->name >> 16) & 0xff; \
1207     case addr + 3: return (s->name >> 24) & 0xff;
1208
1209 #ifdef DEBUG_LSI_REG
1210     DPRINTF("Read reg %x\n", offset);
1211 #endif
1212     switch (offset) {
1213     case 0x00: /* SCNTL0 */
1214         return s->scntl0;
1215     case 0x01: /* SCNTL1 */
1216         return s->scntl1;
1217     case 0x02: /* SCNTL2 */
1218         return s->scntl2;
1219     case 0x03: /* SCNTL3 */
1220         return s->scntl3;
1221     case 0x04: /* SCID */
1222         return s->scid;
1223     case 0x05: /* SXFER */
1224         return s->sxfer;
1225     case 0x06: /* SDID */
1226         return s->sdid;
1227     case 0x07: /* GPREG0 */
1228         return 0x7f;
1229     case 0xa: /* SSID */
1230         return s->ssid;
1231     case 0xb: /* SBCL */
1232         /* ??? This is not correct. However it's (hopefully) only
1233            used for diagnostics, so should be ok.  */
1234         return 0;
1235     case 0xc: /* DSTAT */
1236         tmp = s->dstat | 0x80;
1237         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1238             s->dstat = 0;
1239         lsi_update_irq(s);
1240         return tmp;
1241     case 0x0d: /* SSTAT0 */
1242         return s->sstat0;
1243     case 0x0e: /* SSTAT1 */
1244         return s->sstat1;
1245     case 0x0f: /* SSTAT2 */
1246         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1247     CASE_GET_REG32(dsa, 0x10)
1248     case 0x14: /* ISTAT0 */
1249         return s->istat0;
1250     case 0x16: /* MBOX0 */
1251         return s->mbox0;
1252     case 0x17: /* MBOX1 */
1253         return s->mbox1;
1254     case 0x18: /* CTEST0 */
1255         return 0xff;
1256     case 0x19: /* CTEST1 */
1257         return 0;
1258     case 0x1a: /* CTEST2 */
1259         tmp = LSI_CTEST2_DACK | LSI_CTEST2_CM;
1260         if (s->istat0 & LSI_ISTAT0_SIGP) {
1261             s->istat0 &= ~LSI_ISTAT0_SIGP;
1262             tmp |= LSI_CTEST2_SIGP;
1263         }
1264         return tmp;
1265     case 0x1b: /* CTEST3 */
1266         return s->ctest3;
1267     CASE_GET_REG32(temp, 0x1c)
1268     case 0x20: /* DFIFO */
1269         return 0;
1270     case 0x21: /* CTEST4 */
1271         return s->ctest4;
1272     case 0x22: /* CTEST5 */
1273         return s->ctest5;
1274     case 0x24: /* DBC[0:7] */
1275         return s->dbc & 0xff;
1276     case 0x25: /* DBC[8:15] */
1277         return (s->dbc >> 8) & 0xff;
1278     case 0x26: /* DBC[16->23] */
1279         return (s->dbc >> 16) & 0xff;
1280     case 0x27: /* DCMD */
1281         return s->dcmd;
1282     CASE_GET_REG32(dsp, 0x2c)
1283     CASE_GET_REG32(dsps, 0x30)
1284     CASE_GET_REG32(scratch[0], 0x34)
1285     case 0x38: /* DMODE */
1286         return s->dmode;
1287     case 0x39: /* DIEN */
1288         return s->dien;
1289     case 0x3b: /* DCNTL */
1290         return s->dcntl;
1291     case 0x40: /* SIEN0 */
1292         return s->sien0;
1293     case 0x41: /* SIEN1 */
1294         return s->sien1;
1295     case 0x42: /* SIST0 */
1296         tmp = s->sist0;
1297         s->sist0 = 0;
1298         lsi_update_irq(s);
1299         return tmp;
1300     case 0x43: /* SIST1 */
1301         tmp = s->sist1;
1302         s->sist1 = 0;
1303         lsi_update_irq(s);
1304         return tmp;
1305     case 0x47: /* GPCNTL0 */
1306         return 0x0f;
1307     case 0x48: /* STIME0 */
1308         return s->stime0;
1309     case 0x4a: /* RESPID0 */
1310         return s->respid0;
1311     case 0x4b: /* RESPID1 */
1312         return s->respid1;
1313     case 0x4d: /* STEST1 */
1314         return s->stest1;
1315     case 0x4e: /* STEST2 */
1316         return s->stest2;
1317     case 0x4f: /* STEST3 */
1318         return s->stest3;
1319     case 0x50: /* SIDL */
1320         /* This is needed by the linux drivers.  We currently only update it
1321            during the MSG IN phase.  */
1322         return s->sidl;
1323     case 0x52: /* STEST4 */
1324         return 0xe0;
1325     case 0x56: /* CCNTL0 */
1326         return s->ccntl0;
1327     case 0x57: /* CCNTL1 */
1328         return s->ccntl1;
1329     case 0x58: /* SBDL */
1330         /* Some drivers peek at the data bus during the MSG IN phase.  */
1331         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1332             return s->msg[0];
1333         return 0;
1334     case 0x59: /* SBDL high */
1335         return 0;
1336     CASE_GET_REG32(mmrs, 0xa0)
1337     CASE_GET_REG32(mmws, 0xa4)
1338     CASE_GET_REG32(sfs, 0xa8)
1339     CASE_GET_REG32(drs, 0xac)
1340     CASE_GET_REG32(sbms, 0xb0)
1341     CASE_GET_REG32(dmbs, 0xb4)
1342     CASE_GET_REG32(dnad64, 0xb8)
1343     CASE_GET_REG32(pmjad1, 0xc0)
1344     CASE_GET_REG32(pmjad2, 0xc4)
1345     CASE_GET_REG32(rbc, 0xc8)
1346     CASE_GET_REG32(ua, 0xcc)
1347     CASE_GET_REG32(ia, 0xd4)
1348     CASE_GET_REG32(sbc, 0xd8)
1349     CASE_GET_REG32(csbc, 0xdc)
1350     }
1351     if (offset >= 0x5c && offset < 0xa0) {
1352         int n;
1353         int shift;
1354         n = (offset - 0x58) >> 2;
1355         shift = (offset & 3) * 8;
1356         return (s->scratch[n] >> shift) & 0xff;
1357     }
1358     BADF("readb 0x%x\n", offset);
1359     exit(1);
1360 #undef CASE_GET_REG32
1361 }
1362
1363 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1364 {
1365 #define CASE_SET_REG32(name, addr) \
1366     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1367     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1368     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1369     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1370
1371 #ifdef DEBUG_LSI_REG
1372     DPRINTF("Write reg %x = %02x\n", offset, val);
1373 #endif
1374     switch (offset) {
1375     case 0x00: /* SCNTL0 */
1376         s->scntl0 = val;
1377         if (val & LSI_SCNTL0_START) {
1378             BADF("Start sequence not implemented\n");
1379         }
1380         break;
1381     case 0x01: /* SCNTL1 */
1382         s->scntl1 = val & ~LSI_SCNTL1_SST;
1383         if (val & LSI_SCNTL1_IARB) {
1384             BADF("Immediate Arbritration not implemented\n");
1385         }
1386         if (val & LSI_SCNTL1_RST) {
1387             s->sstat0 |= LSI_SSTAT0_RST;
1388             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1389         } else {
1390             s->sstat0 &= ~LSI_SSTAT0_RST;
1391         }
1392         break;
1393     case 0x02: /* SCNTL2 */
1394         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1395         s->scntl2 = val;
1396         break;
1397     case 0x03: /* SCNTL3 */
1398         s->scntl3 = val;
1399         break;
1400     case 0x04: /* SCID */
1401         s->scid = val;
1402         break;
1403     case 0x05: /* SXFER */
1404         s->sxfer = val;
1405         break;
1406     case 0x06: /* SDID */
1407         if ((val & 0xf) != (s->ssid & 0xf))
1408             BADF("Destination ID does not match SSID\n");
1409         s->sdid = val & 0xf;
1410         break;
1411     case 0x07: /* GPREG0 */
1412         break;
1413     case 0x08: /* SFBR */
1414         /* The CPU is not allowed to write to this register.  However the
1415            SCRIPTS register move instructions are.  */
1416         s->sfbr = val;
1417         break;
1418     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1419         /* Linux writes to these readonly registers on startup.  */
1420         return;
1421     CASE_SET_REG32(dsa, 0x10)
1422     case 0x14: /* ISTAT0 */
1423         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1424         if (val & LSI_ISTAT0_ABRT) {
1425             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1426         }
1427         if (val & LSI_ISTAT0_INTF) {
1428             s->istat0 &= ~LSI_ISTAT0_INTF;
1429             lsi_update_irq(s);
1430         }
1431         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1432             DPRINTF("Woken by SIGP\n");
1433             s->waiting = 0;
1434             s->dsp = s->dnad;
1435             lsi_execute_script(s);
1436         }
1437         if (val & LSI_ISTAT0_SRST) {
1438             lsi_soft_reset(s);
1439         }
1440         break;
1441     case 0x16: /* MBOX0 */
1442         s->mbox0 = val;
1443         break;
1444     case 0x17: /* MBOX1 */
1445         s->mbox1 = val;
1446         break;
1447     case 0x1b: /* CTEST3 */
1448         s->ctest3 = val & 0x0f;
1449         break;
1450     CASE_SET_REG32(temp, 0x1c)
1451     case 0x21: /* CTEST4 */
1452         if (val & 7) {
1453            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1454         }
1455         s->ctest4 = val;
1456         break;
1457     case 0x22: /* CTEST5 */
1458         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1459             BADF("CTEST5 DMA increment not implemented\n");
1460         }
1461         s->ctest5 = val;
1462         break;
1463     case 0x2c: /* DSP[0:7] */
1464         s->dsp &= 0xffffff00;
1465         s->dsp |= val;
1466         break;
1467     case 0x2d: /* DSP[8:15] */
1468         s->dsp &= 0xffff00ff;
1469         s->dsp |= val << 8;
1470         break;
1471     case 0x2e: /* DSP[16:23] */
1472         s->dsp &= 0xff00ffff;
1473         s->dsp |= val << 16;
1474         break;
1475     case 0x2f: /* DSP[24:31] */
1476         s->dsp &= 0x00ffffff;
1477         s->dsp |= val << 24;
1478         if ((s->dmode & LSI_DMODE_MAN) == 0
1479             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1480             lsi_execute_script(s);
1481         break;
1482     CASE_SET_REG32(dsps, 0x30)
1483     CASE_SET_REG32(scratch[0], 0x34)
1484     case 0x38: /* DMODE */
1485         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1486             BADF("IO mappings not implemented\n");
1487         }
1488         s->dmode = val;
1489         break;
1490     case 0x39: /* DIEN */
1491         s->dien = val;
1492         lsi_update_irq(s);
1493         break;
1494     case 0x3b: /* DCNTL */
1495         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1496         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1497             lsi_execute_script(s);
1498         break;
1499     case 0x40: /* SIEN0 */
1500         s->sien0 = val;
1501         lsi_update_irq(s);
1502         break;
1503     case 0x41: /* SIEN1 */
1504         s->sien1 = val;
1505         lsi_update_irq(s);
1506         break;
1507     case 0x47: /* GPCNTL0 */
1508         break;
1509     case 0x48: /* STIME0 */
1510         s->stime0 = val;
1511         break;
1512     case 0x49: /* STIME1 */
1513         if (val & 0xf) {
1514             DPRINTF("General purpose timer not implemented\n");
1515             /* ??? Raising the interrupt immediately seems to be sufficient
1516                to keep the FreeBSD driver happy.  */
1517             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1518         }
1519         break;
1520     case 0x4a: /* RESPID0 */
1521         s->respid0 = val;
1522         break;
1523     case 0x4b: /* RESPID1 */
1524         s->respid1 = val;
1525         break;
1526     case 0x4d: /* STEST1 */
1527         s->stest1 = val;
1528         break;
1529     case 0x4e: /* STEST2 */
1530         if (val & 1) {
1531             BADF("Low level mode not implemented\n");
1532         }
1533         s->stest2 = val;
1534         break;
1535     case 0x4f: /* STEST3 */
1536         if (val & 0x41) {
1537             BADF("SCSI FIFO test mode not implemented\n");
1538         }
1539         s->stest3 = val;
1540         break;
1541     case 0x56: /* CCNTL0 */
1542         s->ccntl0 = val;
1543         break;
1544     case 0x57: /* CCNTL1 */
1545         s->ccntl1 = val;
1546         break;
1547     CASE_SET_REG32(mmrs, 0xa0)
1548     CASE_SET_REG32(mmws, 0xa4)
1549     CASE_SET_REG32(sfs, 0xa8)
1550     CASE_SET_REG32(drs, 0xac)
1551     CASE_SET_REG32(sbms, 0xb0)
1552     CASE_SET_REG32(dmbs, 0xb4)
1553     CASE_SET_REG32(dnad64, 0xb8)
1554     CASE_SET_REG32(pmjad1, 0xc0)
1555     CASE_SET_REG32(pmjad2, 0xc4)
1556     CASE_SET_REG32(rbc, 0xc8)
1557     CASE_SET_REG32(ua, 0xcc)
1558     CASE_SET_REG32(ia, 0xd4)
1559     CASE_SET_REG32(sbc, 0xd8)
1560     CASE_SET_REG32(csbc, 0xdc)
1561     default:
1562         if (offset >= 0x5c && offset < 0xa0) {
1563             int n;
1564             int shift;
1565             n = (offset - 0x58) >> 2;
1566             shift = (offset & 3) * 8;
1567             s->scratch[n] &= ~(0xff << shift);
1568             s->scratch[n] |= (val & 0xff) << shift;
1569         } else {
1570             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1571         }
1572     }
1573 #undef CASE_SET_REG32
1574 }
1575
1576 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1577 {
1578     LSIState *s = (LSIState *)opaque;
1579
1580     lsi_reg_writeb(s, addr & 0xff, val);
1581 }
1582
1583 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1584 {
1585     LSIState *s = (LSIState *)opaque;
1586
1587     addr &= 0xff;
1588     lsi_reg_writeb(s, addr, val & 0xff);
1589     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1590 }
1591
1592 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1593 {
1594     LSIState *s = (LSIState *)opaque;
1595
1596     addr &= 0xff;
1597     lsi_reg_writeb(s, addr, val & 0xff);
1598     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1599     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1600     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1601 }
1602
1603 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1604 {
1605     LSIState *s = (LSIState *)opaque;
1606
1607     return lsi_reg_readb(s, addr & 0xff);
1608 }
1609
1610 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1611 {
1612     LSIState *s = (LSIState *)opaque;
1613     uint32_t val;
1614
1615     addr &= 0xff;
1616     val = lsi_reg_readb(s, addr);
1617     val |= lsi_reg_readb(s, addr + 1) << 8;
1618     return val;
1619 }
1620
1621 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1622 {
1623     LSIState *s = (LSIState *)opaque;
1624     uint32_t val;
1625     addr &= 0xff;
1626     val = lsi_reg_readb(s, addr);
1627     val |= lsi_reg_readb(s, addr + 1) << 8;
1628     val |= lsi_reg_readb(s, addr + 2) << 16;
1629     val |= lsi_reg_readb(s, addr + 3) << 24;
1630     return val;
1631 }
1632
1633 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1634     lsi_mmio_readb,
1635     lsi_mmio_readw,
1636     lsi_mmio_readl,
1637 };
1638
1639 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1640     lsi_mmio_writeb,
1641     lsi_mmio_writew,
1642     lsi_mmio_writel,
1643 };
1644
1645 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1646 {
1647     LSIState *s = (LSIState *)opaque;
1648     uint32_t newval;
1649     int shift;
1650
1651     addr &= 0x1fff;
1652     newval = s->script_ram[addr >> 2];
1653     shift = (addr & 3) * 8;
1654     newval &= ~(0xff << shift);
1655     newval |= val << shift;
1656     s->script_ram[addr >> 2] = newval;
1657 }
1658
1659 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1660 {
1661     LSIState *s = (LSIState *)opaque;
1662     uint32_t newval;
1663
1664     addr &= 0x1fff;
1665     newval = s->script_ram[addr >> 2];
1666     if (addr & 2) {
1667         newval = (newval & 0xffff) | (val << 16);
1668     } else {
1669         newval = (newval & 0xffff0000) | val;
1670     }
1671     s->script_ram[addr >> 2] = newval;
1672 }
1673
1674
1675 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1676 {
1677     LSIState *s = (LSIState *)opaque;
1678
1679     addr &= 0x1fff;
1680     s->script_ram[addr >> 2] = val;
1681 }
1682
1683 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1684 {
1685     LSIState *s = (LSIState *)opaque;
1686     uint32_t val;
1687
1688     addr &= 0x1fff;
1689     val = s->script_ram[addr >> 2];
1690     val >>= (addr & 3) * 8;
1691     return val & 0xff;
1692 }
1693
1694 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1695 {
1696     LSIState *s = (LSIState *)opaque;
1697     uint32_t val;
1698
1699     addr &= 0x1fff;
1700     val = s->script_ram[addr >> 2];
1701     if (addr & 2)
1702         val >>= 16;
1703     return le16_to_cpu(val);
1704 }
1705
1706 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1707 {
1708     LSIState *s = (LSIState *)opaque;
1709
1710     addr &= 0x1fff;
1711     return le32_to_cpu(s->script_ram[addr >> 2]);
1712 }
1713
1714 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1715     lsi_ram_readb,
1716     lsi_ram_readw,
1717     lsi_ram_readl,
1718 };
1719
1720 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1721     lsi_ram_writeb,
1722     lsi_ram_writew,
1723     lsi_ram_writel,
1724 };
1725
1726 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1727 {
1728     LSIState *s = (LSIState *)opaque;
1729     return lsi_reg_readb(s, addr & 0xff);
1730 }
1731
1732 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1733 {
1734     LSIState *s = (LSIState *)opaque;
1735     uint32_t val;
1736     addr &= 0xff;
1737     val = lsi_reg_readb(s, addr);
1738     val |= lsi_reg_readb(s, addr + 1) << 8;
1739     return val;
1740 }
1741
1742 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1743 {
1744     LSIState *s = (LSIState *)opaque;
1745     uint32_t val;
1746     addr &= 0xff;
1747     val = lsi_reg_readb(s, addr);
1748     val |= lsi_reg_readb(s, addr + 1) << 8;
1749     val |= lsi_reg_readb(s, addr + 2) << 16;
1750     val |= lsi_reg_readb(s, addr + 3) << 24;
1751     return val;
1752 }
1753
1754 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1755 {
1756     LSIState *s = (LSIState *)opaque;
1757     lsi_reg_writeb(s, addr & 0xff, val);
1758 }
1759
1760 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1761 {
1762     LSIState *s = (LSIState *)opaque;
1763     addr &= 0xff;
1764     lsi_reg_writeb(s, addr, val & 0xff);
1765     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1766 }
1767
1768 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1769 {
1770     LSIState *s = (LSIState *)opaque;
1771     addr &= 0xff;
1772     lsi_reg_writeb(s, addr, val & 0xff);
1773     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1774     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1775     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1776 }
1777
1778 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1779                            uint32_t addr, uint32_t size, int type)
1780 {
1781     LSIState *s = (LSIState *)pci_dev;
1782
1783     DPRINTF("Mapping IO at %08x\n", addr);
1784
1785     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1786     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1787     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1788     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1789     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1790     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1791 }
1792
1793 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1794                             uint32_t addr, uint32_t size, int type)
1795 {
1796     LSIState *s = (LSIState *)pci_dev;
1797
1798     DPRINTF("Mapping ram at %08x\n", addr);
1799     s->script_ram_base = addr;
1800     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1801 }
1802
1803 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1804                              uint32_t addr, uint32_t size, int type)
1805 {
1806     LSIState *s = (LSIState *)pci_dev;
1807
1808     DPRINTF("Mapping registers at %08x\n", addr);
1809     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1810 }
1811
1812 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1813 {
1814     LSIState *s = (LSIState *)opaque;
1815
1816     if (id < 0) {
1817         for (id = 0; id < LSI_MAX_DEVS; id++) {
1818             if (s->scsi_dev[id] == NULL)
1819                 break;
1820         }
1821     }
1822     if (id >= LSI_MAX_DEVS) {
1823         BADF("Bad Device ID %d\n", id);
1824         return;
1825     }
1826     if (s->scsi_dev[id]) {
1827         DPRINTF("Destroying device %d\n", id);
1828         scsi_disk_destroy(s->scsi_dev[id]);
1829     }
1830     DPRINTF("Attaching block device %d\n", id);
1831     s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1832 }
1833
1834 void *lsi_scsi_init(PCIBus *bus, int devfn)
1835 {
1836     LSIState *s;
1837
1838     s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1839                                         sizeof(*s), devfn, NULL, NULL);
1840     if (s == NULL) {
1841         fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1842         return NULL;
1843     }
1844
1845     s->pci_dev.config[0x00] = 0x00;
1846     s->pci_dev.config[0x01] = 0x10;
1847     s->pci_dev.config[0x02] = 0x12;
1848     s->pci_dev.config[0x03] = 0x00;
1849     s->pci_dev.config[0x0b] = 0x01;
1850     s->pci_dev.config[0x3d] = 0x01; /* interrupt pin 1 */
1851
1852     s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1853                                              lsi_mmio_writefn, s);
1854     s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1855                                             lsi_ram_writefn, s);
1856
1857     pci_register_io_region((struct PCIDevice *)s, 0, 256,
1858                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1859     pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1860                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
1861     pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
1862                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
1863     s->queue = qemu_malloc(sizeof(lsi_queue));
1864     s->queue_len = 1;
1865     s->active_commands = 0;
1866
1867     lsi_soft_reset(s);
1868
1869     return s;
1870 }
1871