hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include "hw.h"
  14 #include "pci.h"
  15 #include "scsi-disk.h"
  16
  17 //#define DEBUG_LSI
  18 //#define DEBUG_LSI_REG
  19
  20 #ifdef DEBUG_LSI
  21 #define DPRINTF(fmt, args...) \
  22 do { printf("lsi_scsi: " fmt , ##args); } while (0)
  23 #define BADF(fmt, args...) \
  24 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
  25 #else
  26 #define DPRINTF(fmt, args...) do {} while(0)
  27 #define BADF(fmt, args...) \
  28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
  29 #endif
  30
  31 #define LSI_SCNTL0_TRG    0x01
  32 #define LSI_SCNTL0_AAP    0x02
  33 #define LSI_SCNTL0_EPC    0x08
  34 #define LSI_SCNTL0_WATN   0x10
  35 #define LSI_SCNTL0_START  0x20
  36
  37 #define LSI_SCNTL1_SST    0x01
  38 #define LSI_SCNTL1_IARB   0x02
  39 #define LSI_SCNTL1_AESP   0x04
  40 #define LSI_SCNTL1_RST    0x08
  41 #define LSI_SCNTL1_CON    0x10
  42 #define LSI_SCNTL1_DHP    0x20
  43 #define LSI_SCNTL1_ADB    0x40
  44 #define LSI_SCNTL1_EXC    0x80
  45
  46 #define LSI_SCNTL2_WSR    0x01
  47 #define LSI_SCNTL2_VUE0   0x02
  48 #define LSI_SCNTL2_VUE1   0x04
  49 #define LSI_SCNTL2_WSS    0x08
  50 #define LSI_SCNTL2_SLPHBEN 0x10
  51 #define LSI_SCNTL2_SLPMD  0x20
  52 #define LSI_SCNTL2_CHM    0x40
  53 #define LSI_SCNTL2_SDU    0x80
  54
  55 #define LSI_ISTAT0_DIP    0x01
  56 #define LSI_ISTAT0_SIP    0x02
  57 #define LSI_ISTAT0_INTF   0x04
  58 #define LSI_ISTAT0_CON    0x08
  59 #define LSI_ISTAT0_SEM    0x10
  60 #define LSI_ISTAT0_SIGP   0x20
  61 #define LSI_ISTAT0_SRST   0x40
  62 #define LSI_ISTAT0_ABRT   0x80
  63
  64 #define LSI_ISTAT1_SI     0x01
  65 #define LSI_ISTAT1_SRUN   0x02
  66 #define LSI_ISTAT1_FLSH   0x04
  67
  68 #define LSI_SSTAT0_SDP0   0x01
  69 #define LSI_SSTAT0_RST    0x02
  70 #define LSI_SSTAT0_WOA    0x04
  71 #define LSI_SSTAT0_LOA    0x08
  72 #define LSI_SSTAT0_AIP    0x10
  73 #define LSI_SSTAT0_OLF    0x20
  74 #define LSI_SSTAT0_ORF    0x40
  75 #define LSI_SSTAT0_ILF    0x80
  76
  77 #define LSI_SIST0_PAR     0x01
  78 #define LSI_SIST0_RST     0x02
  79 #define LSI_SIST0_UDC     0x04
  80 #define LSI_SIST0_SGE     0x08
  81 #define LSI_SIST0_RSL     0x10
  82 #define LSI_SIST0_SEL     0x20
  83 #define LSI_SIST0_CMP     0x40
  84 #define LSI_SIST0_MA      0x80
  85
  86 #define LSI_SIST1_HTH     0x01
  87 #define LSI_SIST1_GEN     0x02
  88 #define LSI_SIST1_STO     0x04
  89 #define LSI_SIST1_SBMC    0x10
  90
  91 #define LSI_SOCL_IO       0x01
  92 #define LSI_SOCL_CD       0x02
  93 #define LSI_SOCL_MSG      0x04
  94 #define LSI_SOCL_ATN      0x08
  95 #define LSI_SOCL_SEL      0x10
  96 #define LSI_SOCL_BSY      0x20
  97 #define LSI_SOCL_ACK      0x40
  98 #define LSI_SOCL_REQ      0x80
  99
 100 #define LSI_DSTAT_IID     0x01
 101 #define LSI_DSTAT_SIR     0x04
 102 #define LSI_DSTAT_SSI     0x08
 103 #define LSI_DSTAT_ABRT    0x10
 104 #define LSI_DSTAT_BF      0x20
 105 #define LSI_DSTAT_MDPE    0x40
 106 #define LSI_DSTAT_DFE     0x80
 107
 108 #define LSI_DCNTL_COM     0x01
 109 #define LSI_DCNTL_IRQD    0x02
 110 #define LSI_DCNTL_STD     0x04
 111 #define LSI_DCNTL_IRQM    0x08
 112 #define LSI_DCNTL_SSM     0x10
 113 #define LSI_DCNTL_PFEN    0x20
 114 #define LSI_DCNTL_PFF     0x40
 115 #define LSI_DCNTL_CLSE    0x80
 116
 117 #define LSI_DMODE_MAN     0x01
 118 #define LSI_DMODE_BOF     0x02
 119 #define LSI_DMODE_ERMP    0x04
 120 #define LSI_DMODE_ERL     0x08
 121 #define LSI_DMODE_DIOM    0x10
 122 #define LSI_DMODE_SIOM    0x20
 123
 124 #define LSI_CTEST2_DACK   0x01
 125 #define LSI_CTEST2_DREQ   0x02
 126 #define LSI_CTEST2_TEOP   0x04
 127 #define LSI_CTEST2_PCICIE 0x08
 128 #define LSI_CTEST2_CM     0x10
 129 #define LSI_CTEST2_CIO    0x20
 130 #define LSI_CTEST2_SIGP   0x40
 131 #define LSI_CTEST2_DDIR   0x80
 132
 133 #define LSI_CTEST5_BL2    0x04
 134 #define LSI_CTEST5_DDIR   0x08
 135 #define LSI_CTEST5_MASR   0x10
 136 #define LSI_CTEST5_DFSN   0x20
 137 #define LSI_CTEST5_BBCK   0x40
 138 #define LSI_CTEST5_ADCK   0x80
 139
 140 #define LSI_CCNTL0_DILS   0x01
 141 #define LSI_CCNTL0_DISFC  0x10
 142 #define LSI_CCNTL0_ENNDJ  0x20
 143 #define LSI_CCNTL0_PMJCTL 0x40
 144 #define LSI_CCNTL0_ENPMJ  0x80
 145
 146 #define LSI_CCNTL1_EN64DBMV  0x01
 147 #define LSI_CCNTL1_EN64TIBMV 0x02
 148 #define LSI_CCNTL1_64TIMOD   0x04
 149 #define LSI_CCNTL1_DDAC      0x08
 150 #define LSI_CCNTL1_ZMOD      0x80
 151
 152 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 153
 154 #define PHASE_DO          0
 155 #define PHASE_DI          1
 156 #define PHASE_CMD         2
 157 #define PHASE_ST          3
 158 #define PHASE_MO          6
 159 #define PHASE_MI          7
 160 #define PHASE_MASK        7
 161
 162 /* Maximum length of MSG IN data.  */
 163 #define LSI_MAX_MSGIN_LEN 8
 164
 165 /* Flag set if this is a tagged command.  */
 166 #define LSI_TAG_VALID     (1 << 16)
 167
 168 typedef struct {
 169     uint32_t tag;
 170     uint32_t pending;
 171     int out;
 172 } lsi_queue;
 173
 174 typedef struct {
 175     PCIDevice pci_dev;
 176     int mmio_io_addr;
 177     int ram_io_addr;
 178     uint32_t script_ram_base;
 179
 180     int carry; /* ??? Should this be an a visible register somewhere?  */
 181     int sense;
 182     /* Action to take at the end of a MSG IN phase.
 183        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 184     int msg_action;
 185     int msg_len;
 186     uint8_t msg[LSI_MAX_MSGIN_LEN];
 187     /* 0 if SCRIPTS are running or stopped.
 188      * 1 if a Wait Reselect instruction has been issued.
 189      * 2 if processing DMA from lsi_execute_script.
 190      * 3 if a DMA operation is in progress.  */
 191     int waiting;
 192     SCSIDevice *scsi_dev[LSI_MAX_DEVS];
 193     SCSIDevice *current_dev;
 194     int current_lun;
 195     /* The tag is a combination of the device ID and the SCSI tag.  */
 196     uint32_t current_tag;
 197     uint32_t current_dma_len;
 198     int command_complete;
 199     uint8_t *dma_buf;
 200     lsi_queue *queue;
 201     int queue_len;
 202     int active_commands;
 203
 204     uint32_t dsa;
 205     uint32_t temp;
 206     uint32_t dnad;
 207     uint32_t dbc;
 208     uint8_t istat0;
 209     uint8_t istat1;
 210     uint8_t dcmd;
 211     uint8_t dstat;
 212     uint8_t dien;
 213     uint8_t sist0;
 214     uint8_t sist1;
 215     uint8_t sien0;
 216     uint8_t sien1;
 217     uint8_t mbox0;
 218     uint8_t mbox1;
 219     uint8_t dfifo;
 220     uint8_t ctest2;
 221     uint8_t ctest3;
 222     uint8_t ctest4;
 223     uint8_t ctest5;
 224     uint8_t ccntl0;
 225     uint8_t ccntl1;
 226     uint32_t dsp;
 227     uint32_t dsps;
 228     uint8_t dmode;
 229     uint8_t dcntl;
 230     uint8_t scntl0;
 231     uint8_t scntl1;
 232     uint8_t scntl2;
 233     uint8_t scntl3;
 234     uint8_t sstat0;
 235     uint8_t sstat1;
 236     uint8_t scid;
 237     uint8_t sxfer;
 238     uint8_t socl;
 239     uint8_t sdid;
 240     uint8_t ssid;
 241     uint8_t sfbr;
 242     uint8_t stest1;
 243     uint8_t stest2;
 244     uint8_t stest3;
 245     uint8_t sidl;
 246     uint8_t stime0;
 247     uint8_t respid0;
 248     uint8_t respid1;
 249     uint32_t mmrs;
 250     uint32_t mmws;
 251     uint32_t sfs;
 252     uint32_t drs;
 253     uint32_t sbms;
 254     uint32_t dmbs;
 255     uint32_t dnad64;
 256     uint32_t pmjad1;
 257     uint32_t pmjad2;
 258     uint32_t rbc;
 259     uint32_t ua;
 260     uint32_t ia;
 261     uint32_t sbc;
 262     uint32_t csbc;
 263     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 264
 265     /* Script ram is stored as 32-bit words in host byteorder.  */
 266     uint32_t script_ram[2048];
 267 } LSIState;
 268
 269 static void lsi_soft_reset(LSIState *s)
 270 {
 271     DPRINTF("Reset\n");
 272     s->carry = 0;
 273
 274     s->waiting = 0;
 275     s->dsa = 0;
 276     s->dnad = 0;
 277     s->dbc = 0;
 278     s->temp = 0;
 279     memset(s->scratch, 0, sizeof(s->scratch));
 280     s->istat0 = 0;
 281     s->istat1 = 0;
 282     s->dcmd = 0;
 283     s->dstat = 0;
 284     s->dien = 0;
 285     s->sist0 = 0;
 286     s->sist1 = 0;
 287     s->sien0 = 0;
 288     s->sien1 = 0;
 289     s->mbox0 = 0;
 290     s->mbox1 = 0;
 291     s->dfifo = 0;
 292     s->ctest2 = 0;
 293     s->ctest3 = 0;
 294     s->ctest4 = 0;
 295     s->ctest5 = 0;
 296     s->ccntl0 = 0;
 297     s->ccntl1 = 0;
 298     s->dsp = 0;
 299     s->dsps = 0;
 300     s->dmode = 0;
 301     s->dcntl = 0;
 302     s->scntl0 = 0xc0;
 303     s->scntl1 = 0;
 304     s->scntl2 = 0;
 305     s->scntl3 = 0;
 306     s->sstat0 = 0;
 307     s->sstat1 = 0;
 308     s->scid = 7;
 309     s->sxfer = 0;
 310     s->socl = 0;
 311     s->stest1 = 0;
 312     s->stest2 = 0;
 313     s->stest3 = 0;
 314     s->sidl = 0;
 315     s->stime0 = 0;
 316     s->respid0 = 0x80;
 317     s->respid1 = 0;
 318     s->mmrs = 0;
 319     s->mmws = 0;
 320     s->sfs = 0;
 321     s->drs = 0;
 322     s->sbms = 0;
 323     s->dmbs = 0;
 324     s->dnad64 = 0;
 325     s->pmjad1 = 0;
 326     s->pmjad2 = 0;
 327     s->rbc = 0;
 328     s->ua = 0;
 329     s->ia = 0;
 330     s->sbc = 0;
 331     s->csbc = 0;
 332 }
 333
 334 static int lsi_dma_40bit(LSIState *s)
 335 {
 336     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 337         return 1;
 338     return 0;
 339 }
 340
 341 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 342 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 343 static void lsi_execute_script(LSIState *s);
 344
 345 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 346 {
 347     uint32_t buf;
 348
 349     /* Optimize reading from SCRIPTS RAM.  */
 350     if ((addr & 0xffffe000) == s->script_ram_base) {
 351         return s->script_ram[(addr & 0x1fff) >> 2];
 352     }
 353     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 354     return cpu_to_le32(buf);
 355 }
 356
 357 static void lsi_stop_script(LSIState *s)
 358 {
 359     s->istat1 &= ~LSI_ISTAT1_SRUN;
 360 }
 361
 362 static void lsi_update_irq(LSIState *s)
 363 {
 364     int level;
 365     static int last_level;
 366
 367     /* It's unclear whether the DIP/SIP bits should be cleared when the
 368        Interrupt Status Registers are cleared or when istat0 is read.
 369        We currently do the formwer, which seems to work.  */
 370     level = 0;
 371     if (s->dstat) {
 372         if (s->dstat & s->dien)
 373             level = 1;
 374         s->istat0 |= LSI_ISTAT0_DIP;
 375     } else {
 376         s->istat0 &= ~LSI_ISTAT0_DIP;
 377     }
 378
 379     if (s->sist0 || s->sist1) {
 380         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 381             level = 1;
 382         s->istat0 |= LSI_ISTAT0_SIP;
 383     } else {
 384         s->istat0 &= ~LSI_ISTAT0_SIP;
 385     }
 386     if (s->istat0 & LSI_ISTAT0_INTF)
 387         level = 1;
 388
 389     if (level != last_level) {
 390         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 391                 level, s->dstat, s->sist1, s->sist0);
 392         last_level = level;
 393     }
 394     qemu_set_irq(s->pci_dev.irq[0], level);
 395 }
 396
 397 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 398 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 399 {
 400     uint32_t mask0;
 401     uint32_t mask1;
 402
 403     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 404             stat1, stat0, s->sist1, s->sist0);
 405     s->sist0 |= stat0;
 406     s->sist1 |= stat1;
 407     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 408        we don't stop processing when raising STO.  Instead continue
 409        execution and stop at the next insn that accesses the SCSI bus.  */
 410     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 411     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 412     mask1 &= ~LSI_SIST1_STO;
 413     if (s->sist0 & mask0 || s->sist1 & mask1) {
 414         lsi_stop_script(s);
 415     }
 416     lsi_update_irq(s);
 417 }
 418
 419 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 420 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 421 {
 422     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 423     s->dstat |= stat;
 424     lsi_update_irq(s);
 425     lsi_stop_script(s);
 426 }
 427
 428 static inline void lsi_set_phase(LSIState *s, int phase)
 429 {
 430     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 431 }
 432
 433 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 434 {
 435     /* Trigger a phase mismatch.  */
 436     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 437         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 438             s->dsp = s->pmjad1;
 439         } else {
 440             s->dsp = s->pmjad2;
 441         }
 442         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 443     } else {
 444         DPRINTF("Phase mismatch interrupt\n");
 445         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 446         lsi_stop_script(s);
 447     }
 448     lsi_set_phase(s, new_phase);
 449 }
 450
 451
 452 /* Resume SCRIPTS execution after a DMA operation.  */
 453 static void lsi_resume_script(LSIState *s)
 454 {
 455     if (s->waiting != 2) {
 456         s->waiting = 0;
 457         lsi_execute_script(s);
 458     } else {
 459         s->waiting = 0;
 460     }
 461 }
 462
 463 /* Initiate a SCSI layer data transfer.  */
 464 static void lsi_do_dma(LSIState *s, int out)
 465 {
 466     uint32_t count;
 467     target_phys_addr_t addr;
 468
 469     if (!s->current_dma_len) {
 470         /* Wait until data is available.  */
 471         DPRINTF("DMA no data available\n");
 472         return;
 473     }
 474
 475     count = s->dbc;
 476     if (count > s->current_dma_len)
 477         count = s->current_dma_len;
 478
 479     addr = s->dnad;
 480     if (lsi_dma_40bit(s))
 481         addr |= ((uint64_t)s->dnad64 << 32);
 482     else if (s->sbms)
 483         addr |= ((uint64_t)s->sbms << 32);
 484
 485     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 486     s->csbc += count;
 487     s->dnad += count;
 488     s->dbc -= count;
 489
 490     if (s->dma_buf == NULL) {
 491         s->dma_buf = s->current_dev->get_buf(s->current_dev,
 492                                              s->current_tag);
 493     }
 494
 495     /* ??? Set SFBR to first data byte.  */
 496     if (out) {
 497         cpu_physical_memory_read(addr, s->dma_buf, count);
 498     } else {
 499         cpu_physical_memory_write(addr, s->dma_buf, count);
 500     }
 501     s->current_dma_len -= count;
 502     if (s->current_dma_len == 0) {
 503         s->dma_buf = NULL;
 504         if (out) {
 505             /* Write the data.  */
 506             s->current_dev->write_data(s->current_dev, s->current_tag);
 507         } else {
 508             /* Request any remaining data.  */
 509             s->current_dev->read_data(s->current_dev, s->current_tag);
 510         }
 511     } else {
 512         s->dma_buf += count;
 513         lsi_resume_script(s);
 514     }
 515 }
 516
 517
 518 /* Add a command to the queue.  */
 519 static void lsi_queue_command(LSIState *s)
 520 {
 521     lsi_queue *p;
 522
 523     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 524     if (s->queue_len == s->active_commands) {
 525         s->queue_len++;
 526         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 527     }
 528     p = &s->queue[s->active_commands++];
 529     p->tag = s->current_tag;
 530     p->pending = 0;
 531     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 532 }
 533
 534 /* Queue a byte for a MSG IN phase.  */
 535 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 536 {
 537     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 538         BADF("MSG IN data too long\n");
 539     } else {
 540         DPRINTF("MSG IN 0x%02x\n", data);
 541         s->msg[s->msg_len++] = data;
 542     }
 543 }
 544
 545 /* Perform reselection to continue a command.  */
 546 static void lsi_reselect(LSIState *s, uint32_t tag)
 547 {
 548     lsi_queue *p;
 549     int n;
 550     int id;
 551
 552     p = NULL;
 553     for (n = 0; n < s->active_commands; n++) {
 554         p = &s->queue[n];
 555         if (p->tag == tag)
 556             break;
 557     }
 558     if (n == s->active_commands) {
 559         BADF("Reselected non-existant command tag=0x%x\n", tag);
 560         return;
 561     }
 562     id = (tag >> 8) & 0xf;
 563     s->ssid = id | 0x80;
 564     DPRINTF("Reselected target %d\n", id);
 565     s->current_dev = s->scsi_dev[id];
 566     s->current_tag = tag;
 567     s->scntl1 |= LSI_SCNTL1_CON;
 568     lsi_set_phase(s, PHASE_MI);
 569     s->msg_action = p->out ? 2 : 3;
 570     s->current_dma_len = p->pending;
 571     s->dma_buf = NULL;
 572     lsi_add_msg_byte(s, 0x80);
 573     if (s->current_tag & LSI_TAG_VALID) {
 574         lsi_add_msg_byte(s, 0x20);
 575         lsi_add_msg_byte(s, tag & 0xff);
 576     }
 577
 578     s->active_commands--;
 579     if (n != s->active_commands) {
 580         s->queue[n] = s->queue[s->active_commands];
 581     }
 582 }
 583
 584 /* Record that data is available for a queued command.  Returns zero if
 585    the device was reselected, nonzero if the IO is deferred.  */
 586 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 587 {
 588     lsi_queue *p;
 589     int i;
 590     for (i = 0; i < s->active_commands; i++) {
 591         p = &s->queue[i];
 592         if (p->tag == tag) {
 593             if (p->pending) {
 594                 BADF("Multiple IO pending for tag %d\n", tag);
 595             }
 596             p->pending = arg;
 597             if (s->waiting == 1) {
 598                 /* Reselect device.  */
 599                 lsi_reselect(s, tag);
 600                 return 0;
 601             } else {
 602                DPRINTF("Queueing IO tag=0x%x\n", tag);
 603                 p->pending = arg;
 604                 return 1;
 605             }
 606         }
 607     }
 608     BADF("IO with unknown tag %d\n", tag);
 609     return 1;
 610 }
 611
 612 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 613 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
 614                                  uint32_t arg)
 615 {
 616     LSIState *s = (LSIState *)opaque;
 617     int out;
 618
 619     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 620     if (reason == SCSI_REASON_DONE) {
 621         DPRINTF("Command complete sense=%d\n", (int)arg);
 622         s->sense = arg;
 623         s->command_complete = 2;
 624         if (s->waiting && s->dbc != 0) {
 625             /* Raise phase mismatch for short transfers.  */
 626             lsi_bad_phase(s, out, PHASE_ST);
 627         } else {
 628             lsi_set_phase(s, PHASE_ST);
 629         }
 630         lsi_resume_script(s);
 631         return;
 632     }
 633
 634     if (s->waiting == 1 || tag != s->current_tag) {
 635         if (lsi_queue_tag(s, tag, arg))
 636             return;
 637     }
 638     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 639     s->current_dma_len = arg;
 640     s->command_complete = 1;
 641     if (!s->waiting)
 642         return;
 643     if (s->waiting == 1 || s->dbc == 0) {
 644         lsi_resume_script(s);
 645     } else {
 646         lsi_do_dma(s, out);
 647     }
 648 }
 649
 650 static void lsi_do_command(LSIState *s)
 651 {
 652     uint8_t buf[16];
 653     int n;
 654
 655     DPRINTF("Send command len=%d\n", s->dbc);
 656     if (s->dbc > 16)
 657         s->dbc = 16;
 658     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 659     s->sfbr = buf[0];
 660     s->command_complete = 0;
 661     n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
 662                                      s->current_lun);
 663     if (n > 0) {
 664         lsi_set_phase(s, PHASE_DI);
 665         s->current_dev->read_data(s->current_dev, s->current_tag);
 666     } else if (n < 0) {
 667         lsi_set_phase(s, PHASE_DO);
 668         s->current_dev->write_data(s->current_dev, s->current_tag);
 669     }
 670
 671     if (!s->command_complete) {
 672         if (n) {
 673             /* Command did not complete immediately so disconnect.  */
 674             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 675             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 676             /* wait data */
 677             lsi_set_phase(s, PHASE_MI);
 678             s->msg_action = 1;
 679             lsi_queue_command(s);
 680         } else {
 681             /* wait command complete */
 682             lsi_set_phase(s, PHASE_DI);
 683         }
 684     }
 685 }
 686
 687 static void lsi_do_status(LSIState *s)
 688 {
 689     uint8_t sense;
 690     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 691     if (s->dbc != 1)
 692         BADF("Bad Status move\n");
 693     s->dbc = 1;
 694     sense = s->sense;
 695     s->sfbr = sense;
 696     cpu_physical_memory_write(s->dnad, &sense, 1);
 697     lsi_set_phase(s, PHASE_MI);
 698     s->msg_action = 1;
 699     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 700 }
 701
 702 static void lsi_disconnect(LSIState *s)
 703 {
 704     s->scntl1 &= ~LSI_SCNTL1_CON;
 705     s->sstat1 &= ~PHASE_MASK;
 706 }
 707
 708 static void lsi_do_msgin(LSIState *s)
 709 {
 710     int len;
 711     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 712     s->sfbr = s->msg[0];
 713     len = s->msg_len;
 714     if (len > s->dbc)
 715         len = s->dbc;
 716     cpu_physical_memory_write(s->dnad, s->msg, len);
 717     /* Linux drivers rely on the last byte being in the SIDL.  */
 718     s->sidl = s->msg[len - 1];
 719     s->msg_len -= len;
 720     if (s->msg_len) {
 721         memmove(s->msg, s->msg + len, s->msg_len);
 722     } else {
 723         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 724            switch to PHASE_MO.  */
 725         switch (s->msg_action) {
 726         case 0:
 727             lsi_set_phase(s, PHASE_CMD);
 728             break;
 729         case 1:
 730             lsi_disconnect(s);
 731             break;
 732         case 2:
 733             lsi_set_phase(s, PHASE_DO);
 734             break;
 735         case 3:
 736             lsi_set_phase(s, PHASE_DI);
 737             break;
 738         default:
 739             abort();
 740         }
 741     }
 742 }
 743
 744 /* Read the next byte during a MSGOUT phase.  */
 745 static uint8_t lsi_get_msgbyte(LSIState *s)
 746 {
 747     uint8_t data;
 748     cpu_physical_memory_read(s->dnad, &data, 1);
 749     s->dnad++;
 750     s->dbc--;
 751     return data;
 752 }
 753
 754 static void lsi_do_msgout(LSIState *s)
 755 {
 756     uint8_t msg;
 757     int len;
 758
 759     DPRINTF("MSG out len=%d\n", s->dbc);
 760     while (s->dbc) {
 761         msg = lsi_get_msgbyte(s);
 762         s->sfbr = msg;
 763
 764         switch (msg) {
 765         case 0x00:
 766             DPRINTF("MSG: Disconnect\n");
 767             lsi_disconnect(s);
 768             break;
 769         case 0x08:
 770             DPRINTF("MSG: No Operation\n");
 771             lsi_set_phase(s, PHASE_CMD);
 772             break;
 773         case 0x01:
 774             len = lsi_get_msgbyte(s);
 775             msg = lsi_get_msgbyte(s);
 776             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 777             switch (msg) {
 778             case 1:
 779                 DPRINTF("SDTR (ignored)\n");
 780                 s->dbc -= 2;
 781                 break;
 782             case 3:
 783                 DPRINTF("WDTR (ignored)\n");
 784                 s->dbc -= 1;
 785                 break;
 786             default:
 787                 goto bad;
 788             }
 789             break;
 790         case 0x20: /* SIMPLE queue */
 791             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 792             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 793             break;
 794         case 0x21: /* HEAD of queue */
 795             BADF("HEAD queue not implemented\n");
 796             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 797             break;
 798         case 0x22: /* ORDERED queue */
 799             BADF("ORDERED queue not implemented\n");
 800             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 801             break;
 802         default:
 803             if ((msg & 0x80) == 0) {
 804                 goto bad;
 805             }
 806             s->current_lun = msg & 7;
 807             DPRINTF("Select LUN %d\n", s->current_lun);
 808             lsi_set_phase(s, PHASE_CMD);
 809             break;
 810         }
 811     }
 812     return;
 813 bad:
 814     BADF("Unimplemented message 0x%02x\n", msg);
 815     lsi_set_phase(s, PHASE_MI);
 816     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 817     s->msg_action = 0;
 818 }
 819
 820 /* Sign extend a 24-bit value.  */
 821 static inline int32_t sxt24(int32_t n)
 822 {
 823     return (n << 8) >> 8;
 824 }
 825
 826 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 827 {
 828     int n;
 829     uint8_t buf[TARGET_PAGE_SIZE];
 830
 831     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 832     while (count) {
 833         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
 834         cpu_physical_memory_read(src, buf, n);
 835         cpu_physical_memory_write(dest, buf, n);
 836         src += n;
 837         dest += n;
 838         count -= n;
 839     }
 840 }
 841
 842 static void lsi_wait_reselect(LSIState *s)
 843 {
 844     int i;
 845     DPRINTF("Wait Reselect\n");
 846     if (s->current_dma_len)
 847         BADF("Reselect with pending DMA\n");
 848     for (i = 0; i < s->active_commands; i++) {
 849         if (s->queue[i].pending) {
 850             lsi_reselect(s, s->queue[i].tag);
 851             break;
 852         }
 853     }
 854     if (s->current_dma_len == 0) {
 855         s->waiting = 1;
 856     }
 857 }
 858
 859 static void lsi_execute_script(LSIState *s)
 860 {
 861     uint32_t insn;
 862     uint32_t addr, addr_high;
 863     int opcode;
 864     int insn_processed = 0;
 865
 866     s->istat1 |= LSI_ISTAT1_SRUN;
 867 again:
 868     insn_processed++;
 869     insn = read_dword(s, s->dsp);
 870     if (!insn) {
 871         /* If we receive an empty opcode increment the DSP by 4 bytes
 872            instead of 8 and execute the next opcode at that location */
 873         s->dsp += 4;
 874         goto again;
 875     }
 876     addr = read_dword(s, s->dsp + 4);
 877     addr_high = 0;
 878     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 879     s->dsps = addr;
 880     s->dcmd = insn >> 24;
 881     s->dsp += 8;
 882     switch (insn >> 30) {
 883     case 0: /* Block move.  */
 884         if (s->sist1 & LSI_SIST1_STO) {
 885             DPRINTF("Delayed select timeout\n");
 886             lsi_stop_script(s);
 887             break;
 888         }
 889         s->dbc = insn & 0xffffff;
 890         s->rbc = s->dbc;
 891         if (insn & (1 << 29)) {
 892             /* Indirect addressing.  */
 893             addr = read_dword(s, addr);
 894         } else if (insn & (1 << 28)) {
 895             uint32_t buf[2];
 896             int32_t offset;
 897             /* Table indirect addressing.  */
 898             offset = sxt24(addr);
 899             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 900             /* byte count is stored in bits 0:23 only */
 901             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 902             s->rbc = s->dbc;
 903             addr = cpu_to_le32(buf[1]);
 904
 905             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 906              * table, bits [31:24] */
 907             if (lsi_dma_40bit(s))
 908                 addr_high = cpu_to_le32(buf[0]) >> 24;
 909         }
 910         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 911             DPRINTF("Wrong phase got %d expected %d\n",
 912                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 913             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 914             break;
 915         }
 916         s->dnad = addr;
 917         s->dnad64 = addr_high;
 918         /* ??? Set ESA.  */
 919         s->ia = s->dsp - 8;
 920         switch (s->sstat1 & 0x7) {
 921         case PHASE_DO:
 922             s->waiting = 2;
 923             lsi_do_dma(s, 1);
 924             if (s->waiting)
 925                 s->waiting = 3;
 926             break;
 927         case PHASE_DI:
 928             s->waiting = 2;
 929             lsi_do_dma(s, 0);
 930             if (s->waiting)
 931                 s->waiting = 3;
 932             break;
 933         case PHASE_CMD:
 934             lsi_do_command(s);
 935             break;
 936         case PHASE_ST:
 937             lsi_do_status(s);
 938             break;
 939         case PHASE_MO:
 940             lsi_do_msgout(s);
 941             break;
 942         case PHASE_MI:
 943             lsi_do_msgin(s);
 944             break;
 945         default:
 946             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
 947             exit(1);
 948         }
 949         s->dfifo = s->dbc & 0xff;
 950         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
 951         s->sbc = s->dbc;
 952         s->rbc -= s->dbc;
 953         s->ua = addr + s->dbc;
 954         break;
 955
 956     case 1: /* IO or Read/Write instruction.  */
 957         opcode = (insn >> 27) & 7;
 958         if (opcode < 5) {
 959             uint32_t id;
 960
 961             if (insn & (1 << 25)) {
 962                 id = read_dword(s, s->dsa + sxt24(insn));
 963             } else {
 964                 id = addr;
 965             }
 966             id = (id >> 16) & 0xf;
 967             if (insn & (1 << 26)) {
 968                 addr = s->dsp + sxt24(addr);
 969             }
 970             s->dnad = addr;
 971             switch (opcode) {
 972             case 0: /* Select */
 973                 s->sdid = id;
 974                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
 975                     DPRINTF("Already reselected by target %d\n", id);
 976                     break;
 977                 }
 978                 s->sstat0 |= LSI_SSTAT0_WOA;
 979                 s->scntl1 &= ~LSI_SCNTL1_IARB;
 980                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
 981                     DPRINTF("Selected absent target %d\n", id);
 982                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 983                     lsi_disconnect(s);
 984                     break;
 985                 }
 986                 DPRINTF("Selected target %d%s\n",
 987                         id, insn & (1 << 3) ? " ATN" : "");
 988                 /* ??? Linux drivers compain when this is set.  Maybe
 989                    it only applies in low-level mode (unimplemented).
 990                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
 991                 s->current_dev = s->scsi_dev[id];
 992                 s->current_tag = id << 8;
 993                 s->scntl1 |= LSI_SCNTL1_CON;
 994                 if (insn & (1 << 3)) {
 995                     s->socl |= LSI_SOCL_ATN;
 996                 }
 997                 lsi_set_phase(s, PHASE_MO);
 998                 break;
 999             case 1: /* Disconnect */
1000                 DPRINTF("Wait Disconect\n");
1001                 s->scntl1 &= ~LSI_SCNTL1_CON;
1002                 break;
1003             case 2: /* Wait Reselect */
1004                 lsi_wait_reselect(s);
1005                 break;
1006             case 3: /* Set */
1007                 DPRINTF("Set%s%s%s%s\n",
1008                         insn & (1 << 3) ? " ATN" : "",
1009                         insn & (1 << 6) ? " ACK" : "",
1010                         insn & (1 << 9) ? " TM" : "",
1011                         insn & (1 << 10) ? " CC" : "");
1012                 if (insn & (1 << 3)) {
1013                     s->socl |= LSI_SOCL_ATN;
1014                     lsi_set_phase(s, PHASE_MO);
1015                 }
1016                 if (insn & (1 << 9)) {
1017                     BADF("Target mode not implemented\n");
1018                     exit(1);
1019                 }
1020                 if (insn & (1 << 10))
1021                     s->carry = 1;
1022                 break;
1023             case 4: /* Clear */
1024                 DPRINTF("Clear%s%s%s%s\n",
1025                         insn & (1 << 3) ? " ATN" : "",
1026                         insn & (1 << 6) ? " ACK" : "",
1027                         insn & (1 << 9) ? " TM" : "",
1028                         insn & (1 << 10) ? " CC" : "");
1029                 if (insn & (1 << 3)) {
1030                     s->socl &= ~LSI_SOCL_ATN;
1031                 }
1032                 if (insn & (1 << 10))
1033                     s->carry = 0;
1034                 break;
1035             }
1036         } else {
1037             uint8_t op0;
1038             uint8_t op1;
1039             uint8_t data8;
1040             int reg;
1041             int operator;
1042 #ifdef DEBUG_LSI
1043             static const char *opcode_names[3] =
1044                 {"Write", "Read", "Read-Modify-Write"};
1045             static const char *operator_names[8] =
1046                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1047 #endif
1048
1049             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1050             data8 = (insn >> 8) & 0xff;
1051             opcode = (insn >> 27) & 7;
1052             operator = (insn >> 24) & 7;
1053             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1054                     opcode_names[opcode - 5], reg,
1055                     operator_names[operator], data8, s->sfbr,
1056                     (insn & (1 << 23)) ? " SFBR" : "");
1057             op0 = op1 = 0;
1058             switch (opcode) {
1059             case 5: /* From SFBR */
1060                 op0 = s->sfbr;
1061                 op1 = data8;
1062                 break;
1063             case 6: /* To SFBR */
1064                 if (operator)
1065                     op0 = lsi_reg_readb(s, reg);
1066                 op1 = data8;
1067                 break;
1068             case 7: /* Read-modify-write */
1069                 if (operator)
1070                     op0 = lsi_reg_readb(s, reg);
1071                 if (insn & (1 << 23)) {
1072                     op1 = s->sfbr;
1073                 } else {
1074                     op1 = data8;
1075                 }
1076                 break;
1077             }
1078
1079             switch (operator) {
1080             case 0: /* move */
1081                 op0 = op1;
1082                 break;
1083             case 1: /* Shift left */
1084                 op1 = op0 >> 7;
1085                 op0 = (op0 << 1) | s->carry;
1086                 s->carry = op1;
1087                 break;
1088             case 2: /* OR */
1089                 op0 |= op1;
1090                 break;
1091             case 3: /* XOR */
1092                 op0 ^= op1;
1093                 break;
1094             case 4: /* AND */
1095                 op0 &= op1;
1096                 break;
1097             case 5: /* SHR */
1098                 op1 = op0 & 1;
1099                 op0 = (op0 >> 1) | (s->carry << 7);
1100                 s->carry = op1;
1101                 break;
1102             case 6: /* ADD */
1103                 op0 += op1;
1104                 s->carry = op0 < op1;
1105                 break;
1106             case 7: /* ADC */
1107                 op0 += op1 + s->carry;
1108                 if (s->carry)
1109                     s->carry = op0 <= op1;
1110                 else
1111                     s->carry = op0 < op1;
1112                 break;
1113             }
1114
1115             switch (opcode) {
1116             case 5: /* From SFBR */
1117             case 7: /* Read-modify-write */
1118                 lsi_reg_writeb(s, reg, op0);
1119                 break;
1120             case 6: /* To SFBR */
1121                 s->sfbr = op0;
1122                 break;
1123             }
1124         }
1125         break;
1126
1127     case 2: /* Transfer Control.  */
1128         {
1129             int cond;
1130             int jmp;
1131
1132             if ((insn & 0x002e0000) == 0) {
1133                 DPRINTF("NOP\n");
1134                 break;
1135             }
1136             if (s->sist1 & LSI_SIST1_STO) {
1137                 DPRINTF("Delayed select timeout\n");
1138                 lsi_stop_script(s);
1139                 break;
1140             }
1141             cond = jmp = (insn & (1 << 19)) != 0;
1142             if (cond == jmp && (insn & (1 << 21))) {
1143                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1144                 cond = s->carry != 0;
1145             }
1146             if (cond == jmp && (insn & (1 << 17))) {
1147                 DPRINTF("Compare phase %d %c= %d\n",
1148                         (s->sstat1 & PHASE_MASK),
1149                         jmp ? '=' : '!',
1150                         ((insn >> 24) & 7));
1151                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1152             }
1153             if (cond == jmp && (insn & (1 << 18))) {
1154                 uint8_t mask;
1155
1156                 mask = (~insn >> 8) & 0xff;
1157                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1158                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1159                 cond = (s->sfbr & mask) == (insn & mask);
1160             }
1161             if (cond == jmp) {
1162                 if (insn & (1 << 23)) {
1163                     /* Relative address.  */
1164                     addr = s->dsp + sxt24(addr);
1165                 }
1166                 switch ((insn >> 27) & 7) {
1167                 case 0: /* Jump */
1168                     DPRINTF("Jump to 0x%08x\n", addr);
1169                     s->dsp = addr;
1170                     break;
1171                 case 1: /* Call */
1172                     DPRINTF("Call 0x%08x\n", addr);
1173                     s->temp = s->dsp;
1174                     s->dsp = addr;
1175                     break;
1176                 case 2: /* Return */
1177                     DPRINTF("Return to 0x%08x\n", s->temp);
1178                     s->dsp = s->temp;
1179                     break;
1180                 case 3: /* Interrupt */
1181                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1182                     if ((insn & (1 << 20)) != 0) {
1183                         s->istat0 |= LSI_ISTAT0_INTF;
1184                         lsi_update_irq(s);
1185                     } else {
1186                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1187                     }
1188                     break;
1189                 default:
1190                     DPRINTF("Illegal transfer control\n");
1191                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1192                     break;
1193                 }
1194             } else {
1195                 DPRINTF("Control condition failed\n");
1196             }
1197         }
1198         break;
1199
1200     case 3:
1201         if ((insn & (1 << 29)) == 0) {
1202             /* Memory move.  */
1203             uint32_t dest;
1204             /* ??? The docs imply the destination address is loaded into
1205                the TEMP register.  However the Linux drivers rely on
1206                the value being presrved.  */
1207             dest = read_dword(s, s->dsp);
1208             s->dsp += 4;
1209             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1210         } else {
1211             uint8_t data[7];
1212             int reg;
1213             int n;
1214             int i;
1215
1216             if (insn & (1 << 28)) {
1217                 addr = s->dsa + sxt24(addr);
1218             }
1219             n = (insn & 7);
1220             reg = (insn >> 16) & 0xff;
1221             if (insn & (1 << 24)) {
1222                 cpu_physical_memory_read(addr, data, n);
1223                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1224                         addr, *(int *)data);
1225                 for (i = 0; i < n; i++) {
1226                     lsi_reg_writeb(s, reg + i, data[i]);
1227                 }
1228             } else {
1229                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1230                 for (i = 0; i < n; i++) {
1231                     data[i] = lsi_reg_readb(s, reg + i);
1232                 }
1233                 cpu_physical_memory_write(addr, data, n);
1234             }
1235         }
1236     }
1237     if (insn_processed > 10000 && !s->waiting) {
1238         /* Some windows drivers make the device spin waiting for a memory
1239            location to change.  If we have been executed a lot of code then
1240            assume this is the case and force an unexpected device disconnect.
1241            This is apparently sufficient to beat the drivers into submission.
1242          */
1243         if (!(s->sien0 & LSI_SIST0_UDC))
1244             fprintf(stderr, "inf. loop with UDC masked\n");
1245         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1246         lsi_disconnect(s);
1247     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1248         if (s->dcntl & LSI_DCNTL_SSM) {
1249             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1250         } else {
1251             goto again;
1252         }
1253     }
1254     DPRINTF("SCRIPTS execution stopped\n");
1255 }
1256
1257 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1258 {
1259     uint8_t tmp;
1260 #define CASE_GET_REG32(name, addr) \
1261     case addr: return s->name & 0xff; \
1262     case addr + 1: return (s->name >> 8) & 0xff; \
1263     case addr + 2: return (s->name >> 16) & 0xff; \
1264     case addr + 3: return (s->name >> 24) & 0xff;
1265
1266 #ifdef DEBUG_LSI_REG
1267     DPRINTF("Read reg %x\n", offset);
1268 #endif
1269     switch (offset) {
1270     case 0x00: /* SCNTL0 */
1271         return s->scntl0;
1272     case 0x01: /* SCNTL1 */
1273         return s->scntl1;
1274     case 0x02: /* SCNTL2 */
1275         return s->scntl2;
1276     case 0x03: /* SCNTL3 */
1277         return s->scntl3;
1278     case 0x04: /* SCID */
1279         return s->scid;
1280     case 0x05: /* SXFER */
1281         return s->sxfer;
1282     case 0x06: /* SDID */
1283         return s->sdid;
1284     case 0x07: /* GPREG0 */
1285         return 0x7f;
1286     case 0x08: /* Revision ID */
1287         return 0x00;
1288     case 0xa: /* SSID */
1289         return s->ssid;
1290     case 0xb: /* SBCL */
1291         /* ??? This is not correct. However it's (hopefully) only
1292            used for diagnostics, so should be ok.  */
1293         return 0;
1294     case 0xc: /* DSTAT */
1295         tmp = s->dstat | 0x80;
1296         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1297             s->dstat = 0;
1298         lsi_update_irq(s);
1299         return tmp;
1300     case 0x0d: /* SSTAT0 */
1301         return s->sstat0;
1302     case 0x0e: /* SSTAT1 */
1303         return s->sstat1;
1304     case 0x0f: /* SSTAT2 */
1305         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1306     CASE_GET_REG32(dsa, 0x10)
1307     case 0x14: /* ISTAT0 */
1308         return s->istat0;
1309     case 0x16: /* MBOX0 */
1310         return s->mbox0;
1311     case 0x17: /* MBOX1 */
1312         return s->mbox1;
1313     case 0x18: /* CTEST0 */
1314         return 0xff;
1315     case 0x19: /* CTEST1 */
1316         return 0;
1317     case 0x1a: /* CTEST2 */
1318         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1319         if (s->istat0 & LSI_ISTAT0_SIGP) {
1320             s->istat0 &= ~LSI_ISTAT0_SIGP;
1321             tmp |= LSI_CTEST2_SIGP;
1322         }
1323         return tmp;
1324     case 0x1b: /* CTEST3 */
1325         return s->ctest3;
1326     CASE_GET_REG32(temp, 0x1c)
1327     case 0x20: /* DFIFO */
1328         return 0;
1329     case 0x21: /* CTEST4 */
1330         return s->ctest4;
1331     case 0x22: /* CTEST5 */
1332         return s->ctest5;
1333     case 0x23: /* CTEST6 */
1334          return 0;
1335     case 0x24: /* DBC[0:7] */
1336         return s->dbc & 0xff;
1337     case 0x25: /* DBC[8:15] */
1338         return (s->dbc >> 8) & 0xff;
1339     case 0x26: /* DBC[16->23] */
1340         return (s->dbc >> 16) & 0xff;
1341     case 0x27: /* DCMD */
1342         return s->dcmd;
1343     CASE_GET_REG32(dsp, 0x2c)
1344     CASE_GET_REG32(dsps, 0x30)
1345     CASE_GET_REG32(scratch[0], 0x34)
1346     case 0x38: /* DMODE */
1347         return s->dmode;
1348     case 0x39: /* DIEN */
1349         return s->dien;
1350     case 0x3b: /* DCNTL */
1351         return s->dcntl;
1352     case 0x40: /* SIEN0 */
1353         return s->sien0;
1354     case 0x41: /* SIEN1 */
1355         return s->sien1;
1356     case 0x42: /* SIST0 */
1357         tmp = s->sist0;
1358         s->sist0 = 0;
1359         lsi_update_irq(s);
1360         return tmp;
1361     case 0x43: /* SIST1 */
1362         tmp = s->sist1;
1363         s->sist1 = 0;
1364         lsi_update_irq(s);
1365         return tmp;
1366     case 0x46: /* MACNTL */
1367         return 0x0f;
1368     case 0x47: /* GPCNTL0 */
1369         return 0x0f;
1370     case 0x48: /* STIME0 */
1371         return s->stime0;
1372     case 0x4a: /* RESPID0 */
1373         return s->respid0;
1374     case 0x4b: /* RESPID1 */
1375         return s->respid1;
1376     case 0x4d: /* STEST1 */
1377         return s->stest1;
1378     case 0x4e: /* STEST2 */
1379         return s->stest2;
1380     case 0x4f: /* STEST3 */
1381         return s->stest3;
1382     case 0x50: /* SIDL */
1383         /* This is needed by the linux drivers.  We currently only update it
1384            during the MSG IN phase.  */
1385         return s->sidl;
1386     case 0x52: /* STEST4 */
1387         return 0xe0;
1388     case 0x56: /* CCNTL0 */
1389         return s->ccntl0;
1390     case 0x57: /* CCNTL1 */
1391         return s->ccntl1;
1392     case 0x58: /* SBDL */
1393         /* Some drivers peek at the data bus during the MSG IN phase.  */
1394         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1395             return s->msg[0];
1396         return 0;
1397     case 0x59: /* SBDL high */
1398         return 0;
1399     CASE_GET_REG32(mmrs, 0xa0)
1400     CASE_GET_REG32(mmws, 0xa4)
1401     CASE_GET_REG32(sfs, 0xa8)
1402     CASE_GET_REG32(drs, 0xac)
1403     CASE_GET_REG32(sbms, 0xb0)
1404     CASE_GET_REG32(dmbs, 0xb4)
1405     CASE_GET_REG32(dnad64, 0xb8)
1406     CASE_GET_REG32(pmjad1, 0xc0)
1407     CASE_GET_REG32(pmjad2, 0xc4)
1408     CASE_GET_REG32(rbc, 0xc8)
1409     CASE_GET_REG32(ua, 0xcc)
1410     CASE_GET_REG32(ia, 0xd4)
1411     CASE_GET_REG32(sbc, 0xd8)
1412     CASE_GET_REG32(csbc, 0xdc)
1413     }
1414     if (offset >= 0x5c && offset < 0xa0) {
1415         int n;
1416         int shift;
1417         n = (offset - 0x58) >> 2;
1418         shift = (offset & 3) * 8;
1419         return (s->scratch[n] >> shift) & 0xff;
1420     }
1421     BADF("readb 0x%x\n", offset);
1422     exit(1);
1423 #undef CASE_GET_REG32
1424 }
1425
1426 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1427 {
1428 #define CASE_SET_REG32(name, addr) \
1429     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1430     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1431     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1432     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1433
1434 #ifdef DEBUG_LSI_REG
1435     DPRINTF("Write reg %x = %02x\n", offset, val);
1436 #endif
1437     switch (offset) {
1438     case 0x00: /* SCNTL0 */
1439         s->scntl0 = val;
1440         if (val & LSI_SCNTL0_START) {
1441             BADF("Start sequence not implemented\n");
1442         }
1443         break;
1444     case 0x01: /* SCNTL1 */
1445         s->scntl1 = val & ~LSI_SCNTL1_SST;
1446         if (val & LSI_SCNTL1_IARB) {
1447             BADF("Immediate Arbritration not implemented\n");
1448         }
1449         if (val & LSI_SCNTL1_RST) {
1450             s->sstat0 |= LSI_SSTAT0_RST;
1451             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1452         } else {
1453             s->sstat0 &= ~LSI_SSTAT0_RST;
1454         }
1455         break;
1456     case 0x02: /* SCNTL2 */
1457         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1458         s->scntl2 = val;
1459         break;
1460     case 0x03: /* SCNTL3 */
1461         s->scntl3 = val;
1462         break;
1463     case 0x04: /* SCID */
1464         s->scid = val;
1465         break;
1466     case 0x05: /* SXFER */
1467         s->sxfer = val;
1468         break;
1469     case 0x06: /* SDID */
1470         if ((val & 0xf) != (s->ssid & 0xf))
1471             BADF("Destination ID does not match SSID\n");
1472         s->sdid = val & 0xf;
1473         break;
1474     case 0x07: /* GPREG0 */
1475         break;
1476     case 0x08: /* SFBR */
1477         /* The CPU is not allowed to write to this register.  However the
1478            SCRIPTS register move instructions are.  */
1479         s->sfbr = val;
1480         break;
1481     case 0x0a: case 0x0b:
1482         /* Openserver writes to these readonly registers on startup */
1483         return;
1484     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1485         /* Linux writes to these readonly registers on startup.  */
1486         return;
1487     CASE_SET_REG32(dsa, 0x10)
1488     case 0x14: /* ISTAT0 */
1489         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1490         if (val & LSI_ISTAT0_ABRT) {
1491             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1492         }
1493         if (val & LSI_ISTAT0_INTF) {
1494             s->istat0 &= ~LSI_ISTAT0_INTF;
1495             lsi_update_irq(s);
1496         }
1497         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1498             DPRINTF("Woken by SIGP\n");
1499             s->waiting = 0;
1500             s->dsp = s->dnad;
1501             lsi_execute_script(s);
1502         }
1503         if (val & LSI_ISTAT0_SRST) {
1504             lsi_soft_reset(s);
1505         }
1506         break;
1507     case 0x16: /* MBOX0 */
1508         s->mbox0 = val;
1509         break;
1510     case 0x17: /* MBOX1 */
1511         s->mbox1 = val;
1512         break;
1513     case 0x1a: /* CTEST2 */
1514         s->ctest2 = val & LSI_CTEST2_PCICIE;
1515         break;
1516     case 0x1b: /* CTEST3 */
1517         s->ctest3 = val & 0x0f;
1518         break;
1519     CASE_SET_REG32(temp, 0x1c)
1520     case 0x21: /* CTEST4 */
1521         if (val & 7) {
1522            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1523         }
1524         s->ctest4 = val;
1525         break;
1526     case 0x22: /* CTEST5 */
1527         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1528             BADF("CTEST5 DMA increment not implemented\n");
1529         }
1530         s->ctest5 = val;
1531         break;
1532     case 0x2c: /* DSP[0:7] */
1533         s->dsp &= 0xffffff00;
1534         s->dsp |= val;
1535         break;
1536     case 0x2d: /* DSP[8:15] */
1537         s->dsp &= 0xffff00ff;
1538         s->dsp |= val << 8;
1539         break;
1540     case 0x2e: /* DSP[16:23] */
1541         s->dsp &= 0xff00ffff;
1542         s->dsp |= val << 16;
1543         break;
1544     case 0x2f: /* DSP[24:31] */
1545         s->dsp &= 0x00ffffff;
1546         s->dsp |= val << 24;
1547         if ((s->dmode & LSI_DMODE_MAN) == 0
1548             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1549             lsi_execute_script(s);
1550         break;
1551     CASE_SET_REG32(dsps, 0x30)
1552     CASE_SET_REG32(scratch[0], 0x34)
1553     case 0x38: /* DMODE */
1554         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1555             BADF("IO mappings not implemented\n");
1556         }
1557         s->dmode = val;
1558         break;
1559     case 0x39: /* DIEN */
1560         s->dien = val;
1561         lsi_update_irq(s);
1562         break;
1563     case 0x3b: /* DCNTL */
1564         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1565         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1566             lsi_execute_script(s);
1567         break;
1568     case 0x40: /* SIEN0 */
1569         s->sien0 = val;
1570         lsi_update_irq(s);
1571         break;
1572     case 0x41: /* SIEN1 */
1573         s->sien1 = val;
1574         lsi_update_irq(s);
1575         break;
1576     case 0x47: /* GPCNTL0 */
1577         break;
1578     case 0x48: /* STIME0 */
1579         s->stime0 = val;
1580         break;
1581     case 0x49: /* STIME1 */
1582         if (val & 0xf) {
1583             DPRINTF("General purpose timer not implemented\n");
1584             /* ??? Raising the interrupt immediately seems to be sufficient
1585                to keep the FreeBSD driver happy.  */
1586             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1587         }
1588         break;
1589     case 0x4a: /* RESPID0 */
1590         s->respid0 = val;
1591         break;
1592     case 0x4b: /* RESPID1 */
1593         s->respid1 = val;
1594         break;
1595     case 0x4d: /* STEST1 */
1596         s->stest1 = val;
1597         break;
1598     case 0x4e: /* STEST2 */
1599         if (val & 1) {
1600             BADF("Low level mode not implemented\n");
1601         }
1602         s->stest2 = val;
1603         break;
1604     case 0x4f: /* STEST3 */
1605         if (val & 0x41) {
1606             BADF("SCSI FIFO test mode not implemented\n");
1607         }
1608         s->stest3 = val;
1609         break;
1610     case 0x56: /* CCNTL0 */
1611         s->ccntl0 = val;
1612         break;
1613     case 0x57: /* CCNTL1 */
1614         s->ccntl1 = val;
1615         break;
1616     CASE_SET_REG32(mmrs, 0xa0)
1617     CASE_SET_REG32(mmws, 0xa4)
1618     CASE_SET_REG32(sfs, 0xa8)
1619     CASE_SET_REG32(drs, 0xac)
1620     CASE_SET_REG32(sbms, 0xb0)
1621     CASE_SET_REG32(dmbs, 0xb4)
1622     CASE_SET_REG32(dnad64, 0xb8)
1623     CASE_SET_REG32(pmjad1, 0xc0)
1624     CASE_SET_REG32(pmjad2, 0xc4)
1625     CASE_SET_REG32(rbc, 0xc8)
1626     CASE_SET_REG32(ua, 0xcc)
1627     CASE_SET_REG32(ia, 0xd4)
1628     CASE_SET_REG32(sbc, 0xd8)
1629     CASE_SET_REG32(csbc, 0xdc)
1630     default:
1631         if (offset >= 0x5c && offset < 0xa0) {
1632             int n;
1633             int shift;
1634             n = (offset - 0x58) >> 2;
1635             shift = (offset & 3) * 8;
1636             s->scratch[n] &= ~(0xff << shift);
1637             s->scratch[n] |= (val & 0xff) << shift;
1638         } else {
1639             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1640         }
1641     }
1642 #undef CASE_SET_REG32
1643 }
1644
1645 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1646 {
1647     LSIState *s = (LSIState *)opaque;
1648
1649     lsi_reg_writeb(s, addr & 0xff, val);
1650 }
1651
1652 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1653 {
1654     LSIState *s = (LSIState *)opaque;
1655
1656     addr &= 0xff;
1657     lsi_reg_writeb(s, addr, val & 0xff);
1658     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1659 }
1660
1661 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1662 {
1663     LSIState *s = (LSIState *)opaque;
1664
1665     addr &= 0xff;
1666     lsi_reg_writeb(s, addr, val & 0xff);
1667     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1668     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1669     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1670 }
1671
1672 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1673 {
1674     LSIState *s = (LSIState *)opaque;
1675
1676     return lsi_reg_readb(s, addr & 0xff);
1677 }
1678
1679 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1680 {
1681     LSIState *s = (LSIState *)opaque;
1682     uint32_t val;
1683
1684     addr &= 0xff;
1685     val = lsi_reg_readb(s, addr);
1686     val |= lsi_reg_readb(s, addr + 1) << 8;
1687     return val;
1688 }
1689
1690 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1691 {
1692     LSIState *s = (LSIState *)opaque;
1693     uint32_t val;
1694     addr &= 0xff;
1695     val = lsi_reg_readb(s, addr);
1696     val |= lsi_reg_readb(s, addr + 1) << 8;
1697     val |= lsi_reg_readb(s, addr + 2) << 16;
1698     val |= lsi_reg_readb(s, addr + 3) << 24;
1699     return val;
1700 }
1701
1702 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1703     lsi_mmio_readb,
1704     lsi_mmio_readw,
1705     lsi_mmio_readl,
1706 };
1707
1708 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1709     lsi_mmio_writeb,
1710     lsi_mmio_writew,
1711     lsi_mmio_writel,
1712 };
1713
1714 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1715 {
1716     LSIState *s = (LSIState *)opaque;
1717     uint32_t newval;
1718     int shift;
1719
1720     addr &= 0x1fff;
1721     newval = s->script_ram[addr >> 2];
1722     shift = (addr & 3) * 8;
1723     newval &= ~(0xff << shift);
1724     newval |= val << shift;
1725     s->script_ram[addr >> 2] = newval;
1726 }
1727
1728 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1729 {
1730     LSIState *s = (LSIState *)opaque;
1731     uint32_t newval;
1732
1733     addr &= 0x1fff;
1734     newval = s->script_ram[addr >> 2];
1735     if (addr & 2) {
1736         newval = (newval & 0xffff) | (val << 16);
1737     } else {
1738         newval = (newval & 0xffff0000) | val;
1739     }
1740     s->script_ram[addr >> 2] = newval;
1741 }
1742
1743
1744 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1745 {
1746     LSIState *s = (LSIState *)opaque;
1747
1748     addr &= 0x1fff;
1749     s->script_ram[addr >> 2] = val;
1750 }
1751
1752 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1753 {
1754     LSIState *s = (LSIState *)opaque;
1755     uint32_t val;
1756
1757     addr &= 0x1fff;
1758     val = s->script_ram[addr >> 2];
1759     val >>= (addr & 3) * 8;
1760     return val & 0xff;
1761 }
1762
1763 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1764 {
1765     LSIState *s = (LSIState *)opaque;
1766     uint32_t val;
1767
1768     addr &= 0x1fff;
1769     val = s->script_ram[addr >> 2];
1770     if (addr & 2)
1771         val >>= 16;
1772     return le16_to_cpu(val);
1773 }
1774
1775 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1776 {
1777     LSIState *s = (LSIState *)opaque;
1778
1779     addr &= 0x1fff;
1780     return le32_to_cpu(s->script_ram[addr >> 2]);
1781 }
1782
1783 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1784     lsi_ram_readb,
1785     lsi_ram_readw,
1786     lsi_ram_readl,
1787 };
1788
1789 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1790     lsi_ram_writeb,
1791     lsi_ram_writew,
1792     lsi_ram_writel,
1793 };
1794
1795 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1796 {
1797     LSIState *s = (LSIState *)opaque;
1798     return lsi_reg_readb(s, addr & 0xff);
1799 }
1800
1801 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1802 {
1803     LSIState *s = (LSIState *)opaque;
1804     uint32_t val;
1805     addr &= 0xff;
1806     val = lsi_reg_readb(s, addr);
1807     val |= lsi_reg_readb(s, addr + 1) << 8;
1808     return val;
1809 }
1810
1811 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1812 {
1813     LSIState *s = (LSIState *)opaque;
1814     uint32_t val;
1815     addr &= 0xff;
1816     val = lsi_reg_readb(s, addr);
1817     val |= lsi_reg_readb(s, addr + 1) << 8;
1818     val |= lsi_reg_readb(s, addr + 2) << 16;
1819     val |= lsi_reg_readb(s, addr + 3) << 24;
1820     return val;
1821 }
1822
1823 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1824 {
1825     LSIState *s = (LSIState *)opaque;
1826     lsi_reg_writeb(s, addr & 0xff, val);
1827 }
1828
1829 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1830 {
1831     LSIState *s = (LSIState *)opaque;
1832     addr &= 0xff;
1833     lsi_reg_writeb(s, addr, val & 0xff);
1834     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1835 }
1836
1837 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1838 {
1839     LSIState *s = (LSIState *)opaque;
1840     addr &= 0xff;
1841     lsi_reg_writeb(s, addr, val & 0xff);
1842     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1843     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1844     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1845 }
1846
1847 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1848                            uint32_t addr, uint32_t size, int type)
1849 {
1850     LSIState *s = (LSIState *)pci_dev;
1851
1852     DPRINTF("Mapping IO at %08x\n", addr);
1853
1854     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1855     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1856     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1857     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1858     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1859     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1860 }
1861
1862 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1863                             uint32_t addr, uint32_t size, int type)
1864 {
1865     LSIState *s = (LSIState *)pci_dev;
1866
1867     DPRINTF("Mapping ram at %08x\n", addr);
1868     s->script_ram_base = addr;
1869     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1870 }
1871
1872 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1873                              uint32_t addr, uint32_t size, int type)
1874 {
1875     LSIState *s = (LSIState *)pci_dev;
1876
1877     DPRINTF("Mapping registers at %08x\n", addr);
1878     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1879 }
1880
1881 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1882 {
1883     LSIState *s = (LSIState *)opaque;
1884
1885     if (id < 0) {
1886         for (id = 0; id < LSI_MAX_DEVS; id++) {
1887             if (s->scsi_dev[id] == NULL)
1888                 break;
1889         }
1890     }
1891     if (id >= LSI_MAX_DEVS) {
1892         BADF("Bad Device ID %d\n", id);
1893         return;
1894     }
1895     if (s->scsi_dev[id]) {
1896         DPRINTF("Destroying device %d\n", id);
1897         s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1898     }
1899     DPRINTF("Attaching block device %d\n", id);
1900     s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1901     if (s->scsi_dev[id] == NULL)
1902         s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1903 }
1904
1905 void *lsi_scsi_init(PCIBus *bus, int devfn)
1906 {
1907     LSIState *s;
1908
1909     s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1910                                         sizeof(*s), devfn, NULL, NULL);
1911     if (s == NULL) {
1912         fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1913         return NULL;
1914     }
1915
1916     /* PCI Vendor ID (word) */
1917     s->pci_dev.config[0x00] = 0x00;
1918     s->pci_dev.config[0x01] = 0x10;
1919     /* PCI device ID (word) */
1920     s->pci_dev.config[0x02] = 0x12;
1921     s->pci_dev.config[0x03] = 0x00;
1922     /* PCI base class code */
1923     s->pci_dev.config[0x0b] = 0x01;
1924     /* PCI subsystem ID */
1925     s->pci_dev.config[0x2e] = 0x00;
1926     s->pci_dev.config[0x2f] = 0x10;
1927     /* PCI latency timer = 255 */
1928     s->pci_dev.config[0x0d] = 0xff;
1929     /* Interrupt pin 1 */
1930     s->pci_dev.config[0x3d] = 0x01;
1931
1932     s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1933                                              lsi_mmio_writefn, s);
1934     s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1935                                             lsi_ram_writefn, s);
1936
1937     pci_register_io_region((struct PCIDevice *)s, 0, 256,
1938                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1939     pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1940                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
1941     pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
1942                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
1943     s->queue = qemu_malloc(sizeof(lsi_queue));
1944     s->queue_len = 1;
1945     s->active_commands = 0;
1946
1947     lsi_soft_reset(s);
1948
1949     return s;
1950 }
1951