hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include "hw.h"
  14 #include "pci.h"
  15 #include "scsi-disk.h"
  16 #include "block_int.h"
  17
  18 //#define DEBUG_LSI
  19 //#define DEBUG_LSI_REG
  20
  21 #ifdef DEBUG_LSI
  22 #define DPRINTF(fmt, args...) \
  23 do { printf("lsi_scsi: " fmt , ##args); } while (0)
  24 #define BADF(fmt, args...) \
  25 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
  26 #else
  27 #define DPRINTF(fmt, args...) do {} while(0)
  28 #define BADF(fmt, args...) \
  29 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
  30 #endif
  31
  32 #define LSI_SCNTL0_TRG    0x01
  33 #define LSI_SCNTL0_AAP    0x02
  34 #define LSI_SCNTL0_EPC    0x08
  35 #define LSI_SCNTL0_WATN   0x10
  36 #define LSI_SCNTL0_START  0x20
  37
  38 #define LSI_SCNTL1_SST    0x01
  39 #define LSI_SCNTL1_IARB   0x02
  40 #define LSI_SCNTL1_AESP   0x04
  41 #define LSI_SCNTL1_RST    0x08
  42 #define LSI_SCNTL1_CON    0x10
  43 #define LSI_SCNTL1_DHP    0x20
  44 #define LSI_SCNTL1_ADB    0x40
  45 #define LSI_SCNTL1_EXC    0x80
  46
  47 #define LSI_SCNTL2_WSR    0x01
  48 #define LSI_SCNTL2_VUE0   0x02
  49 #define LSI_SCNTL2_VUE1   0x04
  50 #define LSI_SCNTL2_WSS    0x08
  51 #define LSI_SCNTL2_SLPHBEN 0x10
  52 #define LSI_SCNTL2_SLPMD  0x20
  53 #define LSI_SCNTL2_CHM    0x40
  54 #define LSI_SCNTL2_SDU    0x80
  55
  56 #define LSI_ISTAT0_DIP    0x01
  57 #define LSI_ISTAT0_SIP    0x02
  58 #define LSI_ISTAT0_INTF   0x04
  59 #define LSI_ISTAT0_CON    0x08
  60 #define LSI_ISTAT0_SEM    0x10
  61 #define LSI_ISTAT0_SIGP   0x20
  62 #define LSI_ISTAT0_SRST   0x40
  63 #define LSI_ISTAT0_ABRT   0x80
  64
  65 #define LSI_ISTAT1_SI     0x01
  66 #define LSI_ISTAT1_SRUN   0x02
  67 #define LSI_ISTAT1_FLSH   0x04
  68
  69 #define LSI_SSTAT0_SDP0   0x01
  70 #define LSI_SSTAT0_RST    0x02
  71 #define LSI_SSTAT0_WOA    0x04
  72 #define LSI_SSTAT0_LOA    0x08
  73 #define LSI_SSTAT0_AIP    0x10
  74 #define LSI_SSTAT0_OLF    0x20
  75 #define LSI_SSTAT0_ORF    0x40
  76 #define LSI_SSTAT0_ILF    0x80
  77
  78 #define LSI_SIST0_PAR     0x01
  79 #define LSI_SIST0_RST     0x02
  80 #define LSI_SIST0_UDC     0x04
  81 #define LSI_SIST0_SGE     0x08
  82 #define LSI_SIST0_RSL     0x10
  83 #define LSI_SIST0_SEL     0x20
  84 #define LSI_SIST0_CMP     0x40
  85 #define LSI_SIST0_MA      0x80
  86
  87 #define LSI_SIST1_HTH     0x01
  88 #define LSI_SIST1_GEN     0x02
  89 #define LSI_SIST1_STO     0x04
  90 #define LSI_SIST1_SBMC    0x10
  91
  92 #define LSI_SOCL_IO       0x01
  93 #define LSI_SOCL_CD       0x02
  94 #define LSI_SOCL_MSG      0x04
  95 #define LSI_SOCL_ATN      0x08
  96 #define LSI_SOCL_SEL      0x10
  97 #define LSI_SOCL_BSY      0x20
  98 #define LSI_SOCL_ACK      0x40
  99 #define LSI_SOCL_REQ      0x80
 100
 101 #define LSI_DSTAT_IID     0x01
 102 #define LSI_DSTAT_SIR     0x04
 103 #define LSI_DSTAT_SSI     0x08
 104 #define LSI_DSTAT_ABRT    0x10
 105 #define LSI_DSTAT_BF      0x20
 106 #define LSI_DSTAT_MDPE    0x40
 107 #define LSI_DSTAT_DFE     0x80
 108
 109 #define LSI_DCNTL_COM     0x01
 110 #define LSI_DCNTL_IRQD    0x02
 111 #define LSI_DCNTL_STD     0x04
 112 #define LSI_DCNTL_IRQM    0x08
 113 #define LSI_DCNTL_SSM     0x10
 114 #define LSI_DCNTL_PFEN    0x20
 115 #define LSI_DCNTL_PFF     0x40
 116 #define LSI_DCNTL_CLSE    0x80
 117
 118 #define LSI_DMODE_MAN     0x01
 119 #define LSI_DMODE_BOF     0x02
 120 #define LSI_DMODE_ERMP    0x04
 121 #define LSI_DMODE_ERL     0x08
 122 #define LSI_DMODE_DIOM    0x10
 123 #define LSI_DMODE_SIOM    0x20
 124
 125 #define LSI_CTEST2_DACK   0x01
 126 #define LSI_CTEST2_DREQ   0x02
 127 #define LSI_CTEST2_TEOP   0x04
 128 #define LSI_CTEST2_PCICIE 0x08
 129 #define LSI_CTEST2_CM     0x10
 130 #define LSI_CTEST2_CIO    0x20
 131 #define LSI_CTEST2_SIGP   0x40
 132 #define LSI_CTEST2_DDIR   0x80
 133
 134 #define LSI_CTEST5_BL2    0x04
 135 #define LSI_CTEST5_DDIR   0x08
 136 #define LSI_CTEST5_MASR   0x10
 137 #define LSI_CTEST5_DFSN   0x20
 138 #define LSI_CTEST5_BBCK   0x40
 139 #define LSI_CTEST5_ADCK   0x80
 140
 141 #define LSI_CCNTL0_DILS   0x01
 142 #define LSI_CCNTL0_DISFC  0x10
 143 #define LSI_CCNTL0_ENNDJ  0x20
 144 #define LSI_CCNTL0_PMJCTL 0x40
 145 #define LSI_CCNTL0_ENPMJ  0x80
 146
 147 #define LSI_CCNTL1_EN64DBMV  0x01
 148 #define LSI_CCNTL1_EN64TIBMV 0x02
 149 #define LSI_CCNTL1_64TIMOD   0x04
 150 #define LSI_CCNTL1_DDAC      0x08
 151 #define LSI_CCNTL1_ZMOD      0x80
 152
 153 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 154
 155 #define PHASE_DO          0
 156 #define PHASE_DI          1
 157 #define PHASE_CMD         2
 158 #define PHASE_ST          3
 159 #define PHASE_MO          6
 160 #define PHASE_MI          7
 161 #define PHASE_MASK        7
 162
 163 /* Maximum length of MSG IN data.  */
 164 #define LSI_MAX_MSGIN_LEN 8
 165
 166 /* Flag set if this is a tagged command.  */
 167 #define LSI_TAG_VALID     (1 << 16)
 168
 169 typedef struct {
 170     uint32_t tag;
 171     uint32_t pending;
 172     int out;
 173 } lsi_queue;
 174
 175 typedef struct {
 176     PCIDevice pci_dev;
 177     int mmio_io_addr;
 178     int ram_io_addr;
 179     uint32_t script_ram_base;
 180
 181     int carry; /* ??? Should this be an a visible register somewhere?  */
 182     int sense;
 183     /* Action to take at the end of a MSG IN phase.
 184        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 185     int msg_action;
 186     int msg_len;
 187     uint8_t msg[LSI_MAX_MSGIN_LEN];
 188     /* 0 if SCRIPTS are running or stopped.
 189      * 1 if a Wait Reselect instruction has been issued.
 190      * 2 if processing DMA from lsi_execute_script.
 191      * 3 if a DMA operation is in progress.  */
 192     int waiting;
 193     SCSIDevice *scsi_dev[LSI_MAX_DEVS];
 194     SCSIDevice *current_dev;
 195     int current_lun;
 196     /* The tag is a combination of the device ID and the SCSI tag.  */
 197     uint32_t current_tag;
 198     uint32_t current_dma_len;
 199     int command_complete;
 200     uint8_t *dma_buf;
 201     lsi_queue *queue;
 202     int queue_len;
 203     int active_commands;
 204
 205     uint32_t dsa;
 206     uint32_t temp;
 207     uint32_t dnad;
 208     uint32_t dbc;
 209     uint8_t istat0;
 210     uint8_t istat1;
 211     uint8_t dcmd;
 212     uint8_t dstat;
 213     uint8_t dien;
 214     uint8_t sist0;
 215     uint8_t sist1;
 216     uint8_t sien0;
 217     uint8_t sien1;
 218     uint8_t mbox0;
 219     uint8_t mbox1;
 220     uint8_t dfifo;
 221     uint8_t ctest2;
 222     uint8_t ctest3;
 223     uint8_t ctest4;
 224     uint8_t ctest5;
 225     uint8_t ccntl0;
 226     uint8_t ccntl1;
 227     uint32_t dsp;
 228     uint32_t dsps;
 229     uint8_t dmode;
 230     uint8_t dcntl;
 231     uint8_t scntl0;
 232     uint8_t scntl1;
 233     uint8_t scntl2;
 234     uint8_t scntl3;
 235     uint8_t sstat0;
 236     uint8_t sstat1;
 237     uint8_t scid;
 238     uint8_t sxfer;
 239     uint8_t socl;
 240     uint8_t sdid;
 241     uint8_t ssid;
 242     uint8_t sfbr;
 243     uint8_t stest1;
 244     uint8_t stest2;
 245     uint8_t stest3;
 246     uint8_t sidl;
 247     uint8_t stime0;
 248     uint8_t respid0;
 249     uint8_t respid1;
 250     uint32_t mmrs;
 251     uint32_t mmws;
 252     uint32_t sfs;
 253     uint32_t drs;
 254     uint32_t sbms;
 255     uint32_t dmbs;
 256     uint32_t dnad64;
 257     uint32_t pmjad1;
 258     uint32_t pmjad2;
 259     uint32_t rbc;
 260     uint32_t ua;
 261     uint32_t ia;
 262     uint32_t sbc;
 263     uint32_t csbc;
 264     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 265
 266     /* Script ram is stored as 32-bit words in host byteorder.  */
 267     uint32_t script_ram[2048];
 268 } LSIState;
 269
 270 static void lsi_soft_reset(LSIState *s)
 271 {
 272     DPRINTF("Reset\n");
 273     s->carry = 0;
 274
 275     s->waiting = 0;
 276     s->dsa = 0;
 277     s->dnad = 0;
 278     s->dbc = 0;
 279     s->temp = 0;
 280     memset(s->scratch, 0, sizeof(s->scratch));
 281     s->istat0 = 0;
 282     s->istat1 = 0;
 283     s->dcmd = 0;
 284     s->dstat = 0;
 285     s->dien = 0;
 286     s->sist0 = 0;
 287     s->sist1 = 0;
 288     s->sien0 = 0;
 289     s->sien1 = 0;
 290     s->mbox0 = 0;
 291     s->mbox1 = 0;
 292     s->dfifo = 0;
 293     s->ctest2 = 0;
 294     s->ctest3 = 0;
 295     s->ctest4 = 0;
 296     s->ctest5 = 0;
 297     s->ccntl0 = 0;
 298     s->ccntl1 = 0;
 299     s->dsp = 0;
 300     s->dsps = 0;
 301     s->dmode = 0;
 302     s->dcntl = 0;
 303     s->scntl0 = 0xc0;
 304     s->scntl1 = 0;
 305     s->scntl2 = 0;
 306     s->scntl3 = 0;
 307     s->sstat0 = 0;
 308     s->sstat1 = 0;
 309     s->scid = 7;
 310     s->sxfer = 0;
 311     s->socl = 0;
 312     s->stest1 = 0;
 313     s->stest2 = 0;
 314     s->stest3 = 0;
 315     s->sidl = 0;
 316     s->stime0 = 0;
 317     s->respid0 = 0x80;
 318     s->respid1 = 0;
 319     s->mmrs = 0;
 320     s->mmws = 0;
 321     s->sfs = 0;
 322     s->drs = 0;
 323     s->sbms = 0;
 324     s->dmbs = 0;
 325     s->dnad64 = 0;
 326     s->pmjad1 = 0;
 327     s->pmjad2 = 0;
 328     s->rbc = 0;
 329     s->ua = 0;
 330     s->ia = 0;
 331     s->sbc = 0;
 332     s->csbc = 0;
 333 }
 334
 335 static int lsi_dma_40bit(LSIState *s)
 336 {
 337     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 338         return 1;
 339     return 0;
 340 }
 341
 342 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 343 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 344 static void lsi_execute_script(LSIState *s);
 345
 346 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 347 {
 348     uint32_t buf;
 349
 350     /* Optimize reading from SCRIPTS RAM.  */
 351     if ((addr & 0xffffe000) == s->script_ram_base) {
 352         return s->script_ram[(addr & 0x1fff) >> 2];
 353     }
 354     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 355     return cpu_to_le32(buf);
 356 }
 357
 358 static void lsi_stop_script(LSIState *s)
 359 {
 360     s->istat1 &= ~LSI_ISTAT1_SRUN;
 361 }
 362
 363 static void lsi_update_irq(LSIState *s)
 364 {
 365     int level;
 366     static int last_level;
 367
 368     /* It's unclear whether the DIP/SIP bits should be cleared when the
 369        Interrupt Status Registers are cleared or when istat0 is read.
 370        We currently do the formwer, which seems to work.  */
 371     level = 0;
 372     if (s->dstat) {
 373         if (s->dstat & s->dien)
 374             level = 1;
 375         s->istat0 |= LSI_ISTAT0_DIP;
 376     } else {
 377         s->istat0 &= ~LSI_ISTAT0_DIP;
 378     }
 379
 380     if (s->sist0 || s->sist1) {
 381         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 382             level = 1;
 383         s->istat0 |= LSI_ISTAT0_SIP;
 384     } else {
 385         s->istat0 &= ~LSI_ISTAT0_SIP;
 386     }
 387     if (s->istat0 & LSI_ISTAT0_INTF)
 388         level = 1;
 389
 390     if (level != last_level) {
 391         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 392                 level, s->dstat, s->sist1, s->sist0);
 393         last_level = level;
 394     }
 395     qemu_set_irq(s->pci_dev.irq[0], level);
 396 }
 397
 398 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 399 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 400 {
 401     uint32_t mask0;
 402     uint32_t mask1;
 403
 404     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 405             stat1, stat0, s->sist1, s->sist0);
 406     s->sist0 |= stat0;
 407     s->sist1 |= stat1;
 408     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 409        we don't stop processing when raising STO.  Instead continue
 410        execution and stop at the next insn that accesses the SCSI bus.  */
 411     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 412     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 413     mask1 &= ~LSI_SIST1_STO;
 414     if (s->sist0 & mask0 || s->sist1 & mask1) {
 415         lsi_stop_script(s);
 416     }
 417     lsi_update_irq(s);
 418 }
 419
 420 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 421 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 422 {
 423     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 424     s->dstat |= stat;
 425     lsi_update_irq(s);
 426     lsi_stop_script(s);
 427 }
 428
 429 static inline void lsi_set_phase(LSIState *s, int phase)
 430 {
 431     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 432 }
 433
 434 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 435 {
 436     /* Trigger a phase mismatch.  */
 437     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 438         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 439             s->dsp = s->pmjad1;
 440         } else {
 441             s->dsp = s->pmjad2;
 442         }
 443         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 444     } else {
 445         DPRINTF("Phase mismatch interrupt\n");
 446         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 447         lsi_stop_script(s);
 448     }
 449     lsi_set_phase(s, new_phase);
 450 }
 451
 452
 453 /* Resume SCRIPTS execution after a DMA operation.  */
 454 static void lsi_resume_script(LSIState *s)
 455 {
 456     if (s->waiting != 2) {
 457         s->waiting = 0;
 458         lsi_execute_script(s);
 459     } else {
 460         s->waiting = 0;
 461     }
 462 }
 463
 464 /* Initiate a SCSI layer data transfer.  */
 465 static void lsi_do_dma(LSIState *s, int out)
 466 {
 467     uint32_t count;
 468     target_phys_addr_t addr;
 469
 470     if (!s->current_dma_len) {
 471         /* Wait until data is available.  */
 472         DPRINTF("DMA no data available\n");
 473         return;
 474     }
 475
 476     count = s->dbc;
 477     if (count > s->current_dma_len)
 478         count = s->current_dma_len;
 479
 480     addr = s->dnad;
 481     if (lsi_dma_40bit(s))
 482         addr |= ((uint64_t)s->dnad64 << 32);
 483     else if (s->sbms)
 484         addr |= ((uint64_t)s->sbms << 32);
 485
 486     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 487     s->csbc += count;
 488     s->dnad += count;
 489     s->dbc -= count;
 490
 491     if (s->dma_buf == NULL) {
 492         s->dma_buf = s->current_dev->get_buf(s->current_dev,
 493                                              s->current_tag);
 494     }
 495
 496     /* ??? Set SFBR to first data byte.  */
 497     if (out) {
 498         cpu_physical_memory_read(addr, s->dma_buf, count);
 499     } else {
 500         cpu_physical_memory_write(addr, s->dma_buf, count);
 501     }
 502     s->current_dma_len -= count;
 503     if (s->current_dma_len == 0) {
 504         s->dma_buf = NULL;
 505         if (out) {
 506             /* Write the data.  */
 507             s->current_dev->write_data(s->current_dev, s->current_tag);
 508         } else {
 509             /* Request any remaining data.  */
 510             s->current_dev->read_data(s->current_dev, s->current_tag);
 511         }
 512     } else {
 513         s->dma_buf += count;
 514         lsi_resume_script(s);
 515     }
 516 }
 517
 518
 519 /* Add a command to the queue.  */
 520 static void lsi_queue_command(LSIState *s)
 521 {
 522     lsi_queue *p;
 523
 524     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 525     if (s->queue_len == s->active_commands) {
 526         s->queue_len++;
 527         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 528     }
 529     p = &s->queue[s->active_commands++];
 530     p->tag = s->current_tag;
 531     p->pending = 0;
 532     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 533 }
 534
 535 /* Queue a byte for a MSG IN phase.  */
 536 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 537 {
 538     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 539         BADF("MSG IN data too long\n");
 540     } else {
 541         DPRINTF("MSG IN 0x%02x\n", data);
 542         s->msg[s->msg_len++] = data;
 543     }
 544 }
 545
 546 /* Perform reselection to continue a command.  */
 547 static void lsi_reselect(LSIState *s, uint32_t tag)
 548 {
 549     lsi_queue *p;
 550     int n;
 551     int id;
 552
 553     p = NULL;
 554     for (n = 0; n < s->active_commands; n++) {
 555         p = &s->queue[n];
 556         if (p->tag == tag)
 557             break;
 558     }
 559     if (n == s->active_commands) {
 560         BADF("Reselected non-existant command tag=0x%x\n", tag);
 561         return;
 562     }
 563     id = (tag >> 8) & 0xf;
 564     s->ssid = id | 0x80;
 565     DPRINTF("Reselected target %d\n", id);
 566     s->current_dev = s->scsi_dev[id];
 567     s->current_tag = tag;
 568     s->scntl1 |= LSI_SCNTL1_CON;
 569     lsi_set_phase(s, PHASE_MI);
 570     s->msg_action = p->out ? 2 : 3;
 571     s->current_dma_len = p->pending;
 572     s->dma_buf = NULL;
 573     lsi_add_msg_byte(s, 0x80);
 574     if (s->current_tag & LSI_TAG_VALID) {
 575         lsi_add_msg_byte(s, 0x20);
 576         lsi_add_msg_byte(s, tag & 0xff);
 577     }
 578
 579     s->active_commands--;
 580     if (n != s->active_commands) {
 581         s->queue[n] = s->queue[s->active_commands];
 582     }
 583 }
 584
 585 /* Record that data is available for a queued command.  Returns zero if
 586    the device was reselected, nonzero if the IO is deferred.  */
 587 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 588 {
 589     lsi_queue *p;
 590     int i;
 591     for (i = 0; i < s->active_commands; i++) {
 592         p = &s->queue[i];
 593         if (p->tag == tag) {
 594             if (p->pending) {
 595                 BADF("Multiple IO pending for tag %d\n", tag);
 596             }
 597             p->pending = arg;
 598             if (s->waiting == 1) {
 599                 /* Reselect device.  */
 600                 lsi_reselect(s, tag);
 601                 return 0;
 602             } else {
 603                DPRINTF("Queueing IO tag=0x%x\n", tag);
 604                 p->pending = arg;
 605                 return 1;
 606             }
 607         }
 608     }
 609     BADF("IO with unknown tag %d\n", tag);
 610     return 1;
 611 }
 612
 613 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 614 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
 615                                  uint32_t arg)
 616 {
 617     LSIState *s = (LSIState *)opaque;
 618     int out;
 619
 620     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 621     if (reason == SCSI_REASON_DONE) {
 622         DPRINTF("Command complete sense=%d\n", (int)arg);
 623         s->sense = arg;
 624         s->command_complete = 2;
 625         if (s->waiting && s->dbc != 0) {
 626             /* Raise phase mismatch for short transfers.  */
 627             lsi_bad_phase(s, out, PHASE_ST);
 628         } else {
 629             lsi_set_phase(s, PHASE_ST);
 630         }
 631         lsi_resume_script(s);
 632         return;
 633     }
 634
 635     if (s->waiting == 1 || tag != s->current_tag) {
 636         if (lsi_queue_tag(s, tag, arg))
 637             return;
 638     }
 639     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 640     s->current_dma_len = arg;
 641     s->command_complete = 1;
 642     if (!s->waiting)
 643         return;
 644     if (s->waiting == 1 || s->dbc == 0) {
 645         lsi_resume_script(s);
 646     } else {
 647         lsi_do_dma(s, out);
 648     }
 649 }
 650
 651 static void lsi_do_command(LSIState *s)
 652 {
 653     uint8_t buf[16];
 654     int n;
 655
 656     DPRINTF("Send command len=%d\n", s->dbc);
 657     if (s->dbc > 16)
 658         s->dbc = 16;
 659     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 660     s->sfbr = buf[0];
 661     s->command_complete = 0;
 662     n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
 663                                      s->current_lun);
 664     if (n > 0) {
 665         lsi_set_phase(s, PHASE_DI);
 666         s->current_dev->read_data(s->current_dev, s->current_tag);
 667     } else if (n < 0) {
 668         lsi_set_phase(s, PHASE_DO);
 669         s->current_dev->write_data(s->current_dev, s->current_tag);
 670     }
 671
 672     if (!s->command_complete) {
 673         if (n) {
 674             /* Command did not complete immediately so disconnect.  */
 675             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 676             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 677             /* wait data */
 678             lsi_set_phase(s, PHASE_MI);
 679             s->msg_action = 1;
 680             lsi_queue_command(s);
 681         } else {
 682             /* wait command complete */
 683             lsi_set_phase(s, PHASE_DI);
 684         }
 685     }
 686 }
 687
 688 static void lsi_do_status(LSIState *s)
 689 {
 690     uint8_t sense;
 691     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 692     if (s->dbc != 1)
 693         BADF("Bad Status move\n");
 694     s->dbc = 1;
 695     sense = s->sense;
 696     s->sfbr = sense;
 697     cpu_physical_memory_write(s->dnad, &sense, 1);
 698     lsi_set_phase(s, PHASE_MI);
 699     s->msg_action = 1;
 700     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 701 }
 702
 703 static void lsi_disconnect(LSIState *s)
 704 {
 705     s->scntl1 &= ~LSI_SCNTL1_CON;
 706     s->sstat1 &= ~PHASE_MASK;
 707 }
 708
 709 static void lsi_do_msgin(LSIState *s)
 710 {
 711     int len;
 712     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 713     s->sfbr = s->msg[0];
 714     len = s->msg_len;
 715     if (len > s->dbc)
 716         len = s->dbc;
 717     cpu_physical_memory_write(s->dnad, s->msg, len);
 718     /* Linux drivers rely on the last byte being in the SIDL.  */
 719     s->sidl = s->msg[len - 1];
 720     s->msg_len -= len;
 721     if (s->msg_len) {
 722         memmove(s->msg, s->msg + len, s->msg_len);
 723     } else {
 724         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 725            switch to PHASE_MO.  */
 726         switch (s->msg_action) {
 727         case 0:
 728             lsi_set_phase(s, PHASE_CMD);
 729             break;
 730         case 1:
 731             lsi_disconnect(s);
 732             break;
 733         case 2:
 734             lsi_set_phase(s, PHASE_DO);
 735             break;
 736         case 3:
 737             lsi_set_phase(s, PHASE_DI);
 738             break;
 739         default:
 740             abort();
 741         }
 742     }
 743 }
 744
 745 /* Read the next byte during a MSGOUT phase.  */
 746 static uint8_t lsi_get_msgbyte(LSIState *s)
 747 {
 748     uint8_t data;
 749     cpu_physical_memory_read(s->dnad, &data, 1);
 750     s->dnad++;
 751     s->dbc--;
 752     return data;
 753 }
 754
 755 static void lsi_do_msgout(LSIState *s)
 756 {
 757     uint8_t msg;
 758     int len;
 759
 760     DPRINTF("MSG out len=%d\n", s->dbc);
 761     while (s->dbc) {
 762         msg = lsi_get_msgbyte(s);
 763         s->sfbr = msg;
 764
 765         switch (msg) {
 766         case 0x00:
 767             DPRINTF("MSG: Disconnect\n");
 768             lsi_disconnect(s);
 769             break;
 770         case 0x08:
 771             DPRINTF("MSG: No Operation\n");
 772             lsi_set_phase(s, PHASE_CMD);
 773             break;
 774         case 0x01:
 775             len = lsi_get_msgbyte(s);
 776             msg = lsi_get_msgbyte(s);
 777             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 778             switch (msg) {
 779             case 1:
 780                 DPRINTF("SDTR (ignored)\n");
 781                 s->dbc -= 2;
 782                 break;
 783             case 3:
 784                 DPRINTF("WDTR (ignored)\n");
 785                 s->dbc -= 1;
 786                 break;
 787             default:
 788                 goto bad;
 789             }
 790             break;
 791         case 0x20: /* SIMPLE queue */
 792             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 793             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 794             break;
 795         case 0x21: /* HEAD of queue */
 796             BADF("HEAD queue not implemented\n");
 797             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 798             break;
 799         case 0x22: /* ORDERED queue */
 800             BADF("ORDERED queue not implemented\n");
 801             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 802             break;
 803         default:
 804             if ((msg & 0x80) == 0) {
 805                 goto bad;
 806             }
 807             s->current_lun = msg & 7;
 808             DPRINTF("Select LUN %d\n", s->current_lun);
 809             lsi_set_phase(s, PHASE_CMD);
 810             break;
 811         }
 812     }
 813     return;
 814 bad:
 815     BADF("Unimplemented message 0x%02x\n", msg);
 816     lsi_set_phase(s, PHASE_MI);
 817     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 818     s->msg_action = 0;
 819 }
 820
 821 /* Sign extend a 24-bit value.  */
 822 static inline int32_t sxt24(int32_t n)
 823 {
 824     return (n << 8) >> 8;
 825 }
 826
 827 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 828 {
 829     int n;
 830     uint8_t buf[TARGET_PAGE_SIZE];
 831
 832     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 833     while (count) {
 834         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
 835         cpu_physical_memory_read(src, buf, n);
 836         cpu_physical_memory_write(dest, buf, n);
 837         src += n;
 838         dest += n;
 839         count -= n;
 840     }
 841 }
 842
 843 static void lsi_wait_reselect(LSIState *s)
 844 {
 845     int i;
 846     DPRINTF("Wait Reselect\n");
 847     if (s->current_dma_len)
 848         BADF("Reselect with pending DMA\n");
 849     for (i = 0; i < s->active_commands; i++) {
 850         if (s->queue[i].pending) {
 851             lsi_reselect(s, s->queue[i].tag);
 852             break;
 853         }
 854     }
 855     if (s->current_dma_len == 0) {
 856         s->waiting = 1;
 857     }
 858 }
 859
 860 static void lsi_execute_script(LSIState *s)
 861 {
 862     uint32_t insn;
 863     uint32_t addr, addr_high;
 864     int opcode;
 865     int insn_processed = 0;
 866
 867     s->istat1 |= LSI_ISTAT1_SRUN;
 868 again:
 869     insn_processed++;
 870     insn = read_dword(s, s->dsp);
 871     if (!insn) {
 872         /* If we receive an empty opcode increment the DSP by 4 bytes
 873            instead of 8 and execute the next opcode at that location */
 874         s->dsp += 4;
 875         goto again;
 876     }
 877     addr = read_dword(s, s->dsp + 4);
 878     addr_high = 0;
 879     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 880     s->dsps = addr;
 881     s->dcmd = insn >> 24;
 882     s->dsp += 8;
 883     switch (insn >> 30) {
 884     case 0: /* Block move.  */
 885         if (s->sist1 & LSI_SIST1_STO) {
 886             DPRINTF("Delayed select timeout\n");
 887             lsi_stop_script(s);
 888             break;
 889         }
 890         s->dbc = insn & 0xffffff;
 891         s->rbc = s->dbc;
 892         if (insn & (1 << 29)) {
 893             /* Indirect addressing.  */
 894             addr = read_dword(s, addr);
 895         } else if (insn & (1 << 28)) {
 896             uint32_t buf[2];
 897             int32_t offset;
 898             /* Table indirect addressing.  */
 899             offset = sxt24(addr);
 900             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 901             /* byte count is stored in bits 0:23 only */
 902             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 903             s->rbc = s->dbc;
 904             addr = cpu_to_le32(buf[1]);
 905
 906             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 907              * table, bits [31:24] */
 908             if (lsi_dma_40bit(s))
 909                 addr_high = cpu_to_le32(buf[0]) >> 24;
 910         }
 911         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 912             DPRINTF("Wrong phase got %d expected %d\n",
 913                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 914             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 915             break;
 916         }
 917         s->dnad = addr;
 918         s->dnad64 = addr_high;
 919         /* ??? Set ESA.  */
 920         s->ia = s->dsp - 8;
 921         switch (s->sstat1 & 0x7) {
 922         case PHASE_DO:
 923             s->waiting = 2;
 924             lsi_do_dma(s, 1);
 925             if (s->waiting)
 926                 s->waiting = 3;
 927             break;
 928         case PHASE_DI:
 929             s->waiting = 2;
 930             lsi_do_dma(s, 0);
 931             if (s->waiting)
 932                 s->waiting = 3;
 933             break;
 934         case PHASE_CMD:
 935             lsi_do_command(s);
 936             break;
 937         case PHASE_ST:
 938             lsi_do_status(s);
 939             break;
 940         case PHASE_MO:
 941             lsi_do_msgout(s);
 942             break;
 943         case PHASE_MI:
 944             lsi_do_msgin(s);
 945             break;
 946         default:
 947             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
 948             exit(1);
 949         }
 950         s->dfifo = s->dbc & 0xff;
 951         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
 952         s->sbc = s->dbc;
 953         s->rbc -= s->dbc;
 954         s->ua = addr + s->dbc;
 955         break;
 956
 957     case 1: /* IO or Read/Write instruction.  */
 958         opcode = (insn >> 27) & 7;
 959         if (opcode < 5) {
 960             uint32_t id;
 961
 962             if (insn & (1 << 25)) {
 963                 id = read_dword(s, s->dsa + sxt24(insn));
 964             } else {
 965                 id = addr;
 966             }
 967             id = (id >> 16) & 0xf;
 968             if (insn & (1 << 26)) {
 969                 addr = s->dsp + sxt24(addr);
 970             }
 971             s->dnad = addr;
 972             switch (opcode) {
 973             case 0: /* Select */
 974                 s->sdid = id;
 975                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
 976                     DPRINTF("Already reselected by target %d\n", id);
 977                     break;
 978                 }
 979                 s->sstat0 |= LSI_SSTAT0_WOA;
 980                 s->scntl1 &= ~LSI_SCNTL1_IARB;
 981                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
 982                     DPRINTF("Selected absent target %d\n", id);
 983                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 984                     lsi_disconnect(s);
 985                     break;
 986                 }
 987                 DPRINTF("Selected target %d%s\n",
 988                         id, insn & (1 << 3) ? " ATN" : "");
 989                 /* ??? Linux drivers compain when this is set.  Maybe
 990                    it only applies in low-level mode (unimplemented).
 991                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
 992                 s->current_dev = s->scsi_dev[id];
 993                 s->current_tag = id << 8;
 994                 s->scntl1 |= LSI_SCNTL1_CON;
 995                 if (insn & (1 << 3)) {
 996                     s->socl |= LSI_SOCL_ATN;
 997                 }
 998                 lsi_set_phase(s, PHASE_MO);
 999                 break;
1000             case 1: /* Disconnect */
1001                 DPRINTF("Wait Disconect\n");
1002                 s->scntl1 &= ~LSI_SCNTL1_CON;
1003                 break;
1004             case 2: /* Wait Reselect */
1005                 lsi_wait_reselect(s);
1006                 break;
1007             case 3: /* Set */
1008                 DPRINTF("Set%s%s%s%s\n",
1009                         insn & (1 << 3) ? " ATN" : "",
1010                         insn & (1 << 6) ? " ACK" : "",
1011                         insn & (1 << 9) ? " TM" : "",
1012                         insn & (1 << 10) ? " CC" : "");
1013                 if (insn & (1 << 3)) {
1014                     s->socl |= LSI_SOCL_ATN;
1015                     lsi_set_phase(s, PHASE_MO);
1016                 }
1017                 if (insn & (1 << 9)) {
1018                     BADF("Target mode not implemented\n");
1019                     exit(1);
1020                 }
1021                 if (insn & (1 << 10))
1022                     s->carry = 1;
1023                 break;
1024             case 4: /* Clear */
1025                 DPRINTF("Clear%s%s%s%s\n",
1026                         insn & (1 << 3) ? " ATN" : "",
1027                         insn & (1 << 6) ? " ACK" : "",
1028                         insn & (1 << 9) ? " TM" : "",
1029                         insn & (1 << 10) ? " CC" : "");
1030                 if (insn & (1 << 3)) {
1031                     s->socl &= ~LSI_SOCL_ATN;
1032                 }
1033                 if (insn & (1 << 10))
1034                     s->carry = 0;
1035                 break;
1036             }
1037         } else {
1038             uint8_t op0;
1039             uint8_t op1;
1040             uint8_t data8;
1041             int reg;
1042             int operator;
1043 #ifdef DEBUG_LSI
1044             static const char *opcode_names[3] =
1045                 {"Write", "Read", "Read-Modify-Write"};
1046             static const char *operator_names[8] =
1047                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1048 #endif
1049
1050             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1051             data8 = (insn >> 8) & 0xff;
1052             opcode = (insn >> 27) & 7;
1053             operator = (insn >> 24) & 7;
1054             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1055                     opcode_names[opcode - 5], reg,
1056                     operator_names[operator], data8, s->sfbr,
1057                     (insn & (1 << 23)) ? " SFBR" : "");
1058             op0 = op1 = 0;
1059             switch (opcode) {
1060             case 5: /* From SFBR */
1061                 op0 = s->sfbr;
1062                 op1 = data8;
1063                 break;
1064             case 6: /* To SFBR */
1065                 if (operator)
1066                     op0 = lsi_reg_readb(s, reg);
1067                 op1 = data8;
1068                 break;
1069             case 7: /* Read-modify-write */
1070                 if (operator)
1071                     op0 = lsi_reg_readb(s, reg);
1072                 if (insn & (1 << 23)) {
1073                     op1 = s->sfbr;
1074                 } else {
1075                     op1 = data8;
1076                 }
1077                 break;
1078             }
1079
1080             switch (operator) {
1081             case 0: /* move */
1082                 op0 = op1;
1083                 break;
1084             case 1: /* Shift left */
1085                 op1 = op0 >> 7;
1086                 op0 = (op0 << 1) | s->carry;
1087                 s->carry = op1;
1088                 break;
1089             case 2: /* OR */
1090                 op0 |= op1;
1091                 break;
1092             case 3: /* XOR */
1093                 op0 ^= op1;
1094                 break;
1095             case 4: /* AND */
1096                 op0 &= op1;
1097                 break;
1098             case 5: /* SHR */
1099                 op1 = op0 & 1;
1100                 op0 = (op0 >> 1) | (s->carry << 7);
1101                 s->carry = op1;
1102                 break;
1103             case 6: /* ADD */
1104                 op0 += op1;
1105                 s->carry = op0 < op1;
1106                 break;
1107             case 7: /* ADC */
1108                 op0 += op1 + s->carry;
1109                 if (s->carry)
1110                     s->carry = op0 <= op1;
1111                 else
1112                     s->carry = op0 < op1;
1113                 break;
1114             }
1115
1116             switch (opcode) {
1117             case 5: /* From SFBR */
1118             case 7: /* Read-modify-write */
1119                 lsi_reg_writeb(s, reg, op0);
1120                 break;
1121             case 6: /* To SFBR */
1122                 s->sfbr = op0;
1123                 break;
1124             }
1125         }
1126         break;
1127
1128     case 2: /* Transfer Control.  */
1129         {
1130             int cond;
1131             int jmp;
1132
1133             if ((insn & 0x002e0000) == 0) {
1134                 DPRINTF("NOP\n");
1135                 break;
1136             }
1137             if (s->sist1 & LSI_SIST1_STO) {
1138                 DPRINTF("Delayed select timeout\n");
1139                 lsi_stop_script(s);
1140                 break;
1141             }
1142             cond = jmp = (insn & (1 << 19)) != 0;
1143             if (cond == jmp && (insn & (1 << 21))) {
1144                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1145                 cond = s->carry != 0;
1146             }
1147             if (cond == jmp && (insn & (1 << 17))) {
1148                 DPRINTF("Compare phase %d %c= %d\n",
1149                         (s->sstat1 & PHASE_MASK),
1150                         jmp ? '=' : '!',
1151                         ((insn >> 24) & 7));
1152                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1153             }
1154             if (cond == jmp && (insn & (1 << 18))) {
1155                 uint8_t mask;
1156
1157                 mask = (~insn >> 8) & 0xff;
1158                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1159                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1160                 cond = (s->sfbr & mask) == (insn & mask);
1161             }
1162             if (cond == jmp) {
1163                 if (insn & (1 << 23)) {
1164                     /* Relative address.  */
1165                     addr = s->dsp + sxt24(addr);
1166                 }
1167                 switch ((insn >> 27) & 7) {
1168                 case 0: /* Jump */
1169                     DPRINTF("Jump to 0x%08x\n", addr);
1170                     s->dsp = addr;
1171                     break;
1172                 case 1: /* Call */
1173                     DPRINTF("Call 0x%08x\n", addr);
1174                     s->temp = s->dsp;
1175                     s->dsp = addr;
1176                     break;
1177                 case 2: /* Return */
1178                     DPRINTF("Return to 0x%08x\n", s->temp);
1179                     s->dsp = s->temp;
1180                     break;
1181                 case 3: /* Interrupt */
1182                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1183                     if ((insn & (1 << 20)) != 0) {
1184                         s->istat0 |= LSI_ISTAT0_INTF;
1185                         lsi_update_irq(s);
1186                     } else {
1187                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1188                     }
1189                     break;
1190                 default:
1191                     DPRINTF("Illegal transfer control\n");
1192                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1193                     break;
1194                 }
1195             } else {
1196                 DPRINTF("Control condition failed\n");
1197             }
1198         }
1199         break;
1200
1201     case 3:
1202         if ((insn & (1 << 29)) == 0) {
1203             /* Memory move.  */
1204             uint32_t dest;
1205             /* ??? The docs imply the destination address is loaded into
1206                the TEMP register.  However the Linux drivers rely on
1207                the value being presrved.  */
1208             dest = read_dword(s, s->dsp);
1209             s->dsp += 4;
1210             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1211         } else {
1212             uint8_t data[7];
1213             int reg;
1214             int n;
1215             int i;
1216
1217             if (insn & (1 << 28)) {
1218                 addr = s->dsa + sxt24(addr);
1219             }
1220             n = (insn & 7);
1221             reg = (insn >> 16) & 0xff;
1222             if (insn & (1 << 24)) {
1223                 cpu_physical_memory_read(addr, data, n);
1224                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1225                         addr, *(int *)data);
1226                 for (i = 0; i < n; i++) {
1227                     lsi_reg_writeb(s, reg + i, data[i]);
1228                 }
1229             } else {
1230                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1231                 for (i = 0; i < n; i++) {
1232                     data[i] = lsi_reg_readb(s, reg + i);
1233                 }
1234                 cpu_physical_memory_write(addr, data, n);
1235             }
1236         }
1237     }
1238     if (insn_processed > 10000 && !s->waiting) {
1239         /* Some windows drivers make the device spin waiting for a memory
1240            location to change.  If we have been executed a lot of code then
1241            assume this is the case and force an unexpected device disconnect.
1242            This is apparently sufficient to beat the drivers into submission.
1243          */
1244         if (!(s->sien0 & LSI_SIST0_UDC))
1245             fprintf(stderr, "inf. loop with UDC masked\n");
1246         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1247         lsi_disconnect(s);
1248     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1249         if (s->dcntl & LSI_DCNTL_SSM) {
1250             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1251         } else {
1252             goto again;
1253         }
1254     }
1255     DPRINTF("SCRIPTS execution stopped\n");
1256 }
1257
1258 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1259 {
1260     uint8_t tmp;
1261 #define CASE_GET_REG32(name, addr) \
1262     case addr: return s->name & 0xff; \
1263     case addr + 1: return (s->name >> 8) & 0xff; \
1264     case addr + 2: return (s->name >> 16) & 0xff; \
1265     case addr + 3: return (s->name >> 24) & 0xff;
1266
1267 #ifdef DEBUG_LSI_REG
1268     DPRINTF("Read reg %x\n", offset);
1269 #endif
1270     switch (offset) {
1271     case 0x00: /* SCNTL0 */
1272         return s->scntl0;
1273     case 0x01: /* SCNTL1 */
1274         return s->scntl1;
1275     case 0x02: /* SCNTL2 */
1276         return s->scntl2;
1277     case 0x03: /* SCNTL3 */
1278         return s->scntl3;
1279     case 0x04: /* SCID */
1280         return s->scid;
1281     case 0x05: /* SXFER */
1282         return s->sxfer;
1283     case 0x06: /* SDID */
1284         return s->sdid;
1285     case 0x07: /* GPREG0 */
1286         return 0x7f;
1287     case 0x08: /* Revision ID */
1288         return 0x00;
1289     case 0xa: /* SSID */
1290         return s->ssid;
1291     case 0xb: /* SBCL */
1292         /* ??? This is not correct. However it's (hopefully) only
1293            used for diagnostics, so should be ok.  */
1294         return 0;
1295     case 0xc: /* DSTAT */
1296         tmp = s->dstat | 0x80;
1297         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1298             s->dstat = 0;
1299         lsi_update_irq(s);
1300         return tmp;
1301     case 0x0d: /* SSTAT0 */
1302         return s->sstat0;
1303     case 0x0e: /* SSTAT1 */
1304         return s->sstat1;
1305     case 0x0f: /* SSTAT2 */
1306         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1307     CASE_GET_REG32(dsa, 0x10)
1308     case 0x14: /* ISTAT0 */
1309         return s->istat0;
1310     case 0x16: /* MBOX0 */
1311         return s->mbox0;
1312     case 0x17: /* MBOX1 */
1313         return s->mbox1;
1314     case 0x18: /* CTEST0 */
1315         return 0xff;
1316     case 0x19: /* CTEST1 */
1317         return 0;
1318     case 0x1a: /* CTEST2 */
1319         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1320         if (s->istat0 & LSI_ISTAT0_SIGP) {
1321             s->istat0 &= ~LSI_ISTAT0_SIGP;
1322             tmp |= LSI_CTEST2_SIGP;
1323         }
1324         return tmp;
1325     case 0x1b: /* CTEST3 */
1326         return s->ctest3;
1327     CASE_GET_REG32(temp, 0x1c)
1328     case 0x20: /* DFIFO */
1329         return 0;
1330     case 0x21: /* CTEST4 */
1331         return s->ctest4;
1332     case 0x22: /* CTEST5 */
1333         return s->ctest5;
1334     case 0x23: /* CTEST6 */
1335          return 0;
1336     case 0x24: /* DBC[0:7] */
1337         return s->dbc & 0xff;
1338     case 0x25: /* DBC[8:15] */
1339         return (s->dbc >> 8) & 0xff;
1340     case 0x26: /* DBC[16->23] */
1341         return (s->dbc >> 16) & 0xff;
1342     case 0x27: /* DCMD */
1343         return s->dcmd;
1344     CASE_GET_REG32(dsp, 0x2c)
1345     CASE_GET_REG32(dsps, 0x30)
1346     CASE_GET_REG32(scratch[0], 0x34)
1347     case 0x38: /* DMODE */
1348         return s->dmode;
1349     case 0x39: /* DIEN */
1350         return s->dien;
1351     case 0x3b: /* DCNTL */
1352         return s->dcntl;
1353     case 0x40: /* SIEN0 */
1354         return s->sien0;
1355     case 0x41: /* SIEN1 */
1356         return s->sien1;
1357     case 0x42: /* SIST0 */
1358         tmp = s->sist0;
1359         s->sist0 = 0;
1360         lsi_update_irq(s);
1361         return tmp;
1362     case 0x43: /* SIST1 */
1363         tmp = s->sist1;
1364         s->sist1 = 0;
1365         lsi_update_irq(s);
1366         return tmp;
1367     case 0x46: /* MACNTL */
1368         return 0x0f;
1369     case 0x47: /* GPCNTL0 */
1370         return 0x0f;
1371     case 0x48: /* STIME0 */
1372         return s->stime0;
1373     case 0x4a: /* RESPID0 */
1374         return s->respid0;
1375     case 0x4b: /* RESPID1 */
1376         return s->respid1;
1377     case 0x4d: /* STEST1 */
1378         return s->stest1;
1379     case 0x4e: /* STEST2 */
1380         return s->stest2;
1381     case 0x4f: /* STEST3 */
1382         return s->stest3;
1383     case 0x50: /* SIDL */
1384         /* This is needed by the linux drivers.  We currently only update it
1385            during the MSG IN phase.  */
1386         return s->sidl;
1387     case 0x52: /* STEST4 */
1388         return 0xe0;
1389     case 0x56: /* CCNTL0 */
1390         return s->ccntl0;
1391     case 0x57: /* CCNTL1 */
1392         return s->ccntl1;
1393     case 0x58: /* SBDL */
1394         /* Some drivers peek at the data bus during the MSG IN phase.  */
1395         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1396             return s->msg[0];
1397         return 0;
1398     case 0x59: /* SBDL high */
1399         return 0;
1400     CASE_GET_REG32(mmrs, 0xa0)
1401     CASE_GET_REG32(mmws, 0xa4)
1402     CASE_GET_REG32(sfs, 0xa8)
1403     CASE_GET_REG32(drs, 0xac)
1404     CASE_GET_REG32(sbms, 0xb0)
1405     CASE_GET_REG32(dmbs, 0xb4)
1406     CASE_GET_REG32(dnad64, 0xb8)
1407     CASE_GET_REG32(pmjad1, 0xc0)
1408     CASE_GET_REG32(pmjad2, 0xc4)
1409     CASE_GET_REG32(rbc, 0xc8)
1410     CASE_GET_REG32(ua, 0xcc)
1411     CASE_GET_REG32(ia, 0xd4)
1412     CASE_GET_REG32(sbc, 0xd8)
1413     CASE_GET_REG32(csbc, 0xdc)
1414     }
1415     if (offset >= 0x5c && offset < 0xa0) {
1416         int n;
1417         int shift;
1418         n = (offset - 0x58) >> 2;
1419         shift = (offset & 3) * 8;
1420         return (s->scratch[n] >> shift) & 0xff;
1421     }
1422     BADF("readb 0x%x\n", offset);
1423     exit(1);
1424 #undef CASE_GET_REG32
1425 }
1426
1427 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1428 {
1429 #define CASE_SET_REG32(name, addr) \
1430     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1431     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1432     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1433     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1434
1435 #ifdef DEBUG_LSI_REG
1436     DPRINTF("Write reg %x = %02x\n", offset, val);
1437 #endif
1438     switch (offset) {
1439     case 0x00: /* SCNTL0 */
1440         s->scntl0 = val;
1441         if (val & LSI_SCNTL0_START) {
1442             BADF("Start sequence not implemented\n");
1443         }
1444         break;
1445     case 0x01: /* SCNTL1 */
1446         s->scntl1 = val & ~LSI_SCNTL1_SST;
1447         if (val & LSI_SCNTL1_IARB) {
1448             BADF("Immediate Arbritration not implemented\n");
1449         }
1450         if (val & LSI_SCNTL1_RST) {
1451             s->sstat0 |= LSI_SSTAT0_RST;
1452             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1453         } else {
1454             s->sstat0 &= ~LSI_SSTAT0_RST;
1455         }
1456         break;
1457     case 0x02: /* SCNTL2 */
1458         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1459         s->scntl2 = val;
1460         break;
1461     case 0x03: /* SCNTL3 */
1462         s->scntl3 = val;
1463         break;
1464     case 0x04: /* SCID */
1465         s->scid = val;
1466         break;
1467     case 0x05: /* SXFER */
1468         s->sxfer = val;
1469         break;
1470     case 0x06: /* SDID */
1471         if ((val & 0xf) != (s->ssid & 0xf))
1472             BADF("Destination ID does not match SSID\n");
1473         s->sdid = val & 0xf;
1474         break;
1475     case 0x07: /* GPREG0 */
1476         break;
1477     case 0x08: /* SFBR */
1478         /* The CPU is not allowed to write to this register.  However the
1479            SCRIPTS register move instructions are.  */
1480         s->sfbr = val;
1481         break;
1482     case 0x0a: case 0x0b:
1483         /* Openserver writes to these readonly registers on startup */
1484         return;
1485     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1486         /* Linux writes to these readonly registers on startup.  */
1487         return;
1488     CASE_SET_REG32(dsa, 0x10)
1489     case 0x14: /* ISTAT0 */
1490         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1491         if (val & LSI_ISTAT0_ABRT) {
1492             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1493         }
1494         if (val & LSI_ISTAT0_INTF) {
1495             s->istat0 &= ~LSI_ISTAT0_INTF;
1496             lsi_update_irq(s);
1497         }
1498         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1499             DPRINTF("Woken by SIGP\n");
1500             s->waiting = 0;
1501             s->dsp = s->dnad;
1502             lsi_execute_script(s);
1503         }
1504         if (val & LSI_ISTAT0_SRST) {
1505             lsi_soft_reset(s);
1506         }
1507         break;
1508     case 0x16: /* MBOX0 */
1509         s->mbox0 = val;
1510         break;
1511     case 0x17: /* MBOX1 */
1512         s->mbox1 = val;
1513         break;
1514     case 0x1a: /* CTEST2 */
1515         s->ctest2 = val & LSI_CTEST2_PCICIE;
1516         break;
1517     case 0x1b: /* CTEST3 */
1518         s->ctest3 = val & 0x0f;
1519         break;
1520     CASE_SET_REG32(temp, 0x1c)
1521     case 0x21: /* CTEST4 */
1522         if (val & 7) {
1523            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1524         }
1525         s->ctest4 = val;
1526         break;
1527     case 0x22: /* CTEST5 */
1528         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1529             BADF("CTEST5 DMA increment not implemented\n");
1530         }
1531         s->ctest5 = val;
1532         break;
1533     case 0x2c: /* DSP[0:7] */
1534         s->dsp &= 0xffffff00;
1535         s->dsp |= val;
1536         break;
1537     case 0x2d: /* DSP[8:15] */
1538         s->dsp &= 0xffff00ff;
1539         s->dsp |= val << 8;
1540         break;
1541     case 0x2e: /* DSP[16:23] */
1542         s->dsp &= 0xff00ffff;
1543         s->dsp |= val << 16;
1544         break;
1545     case 0x2f: /* DSP[24:31] */
1546         s->dsp &= 0x00ffffff;
1547         s->dsp |= val << 24;
1548         if ((s->dmode & LSI_DMODE_MAN) == 0
1549             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1550             lsi_execute_script(s);
1551         break;
1552     CASE_SET_REG32(dsps, 0x30)
1553     CASE_SET_REG32(scratch[0], 0x34)
1554     case 0x38: /* DMODE */
1555         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1556             BADF("IO mappings not implemented\n");
1557         }
1558         s->dmode = val;
1559         break;
1560     case 0x39: /* DIEN */
1561         s->dien = val;
1562         lsi_update_irq(s);
1563         break;
1564     case 0x3b: /* DCNTL */
1565         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1566         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1567             lsi_execute_script(s);
1568         break;
1569     case 0x40: /* SIEN0 */
1570         s->sien0 = val;
1571         lsi_update_irq(s);
1572         break;
1573     case 0x41: /* SIEN1 */
1574         s->sien1 = val;
1575         lsi_update_irq(s);
1576         break;
1577     case 0x47: /* GPCNTL0 */
1578         break;
1579     case 0x48: /* STIME0 */
1580         s->stime0 = val;
1581         break;
1582     case 0x49: /* STIME1 */
1583         if (val & 0xf) {
1584             DPRINTF("General purpose timer not implemented\n");
1585             /* ??? Raising the interrupt immediately seems to be sufficient
1586                to keep the FreeBSD driver happy.  */
1587             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1588         }
1589         break;
1590     case 0x4a: /* RESPID0 */
1591         s->respid0 = val;
1592         break;
1593     case 0x4b: /* RESPID1 */
1594         s->respid1 = val;
1595         break;
1596     case 0x4d: /* STEST1 */
1597         s->stest1 = val;
1598         break;
1599     case 0x4e: /* STEST2 */
1600         if (val & 1) {
1601             BADF("Low level mode not implemented\n");
1602         }
1603         s->stest2 = val;
1604         break;
1605     case 0x4f: /* STEST3 */
1606         if (val & 0x41) {
1607             BADF("SCSI FIFO test mode not implemented\n");
1608         }
1609         s->stest3 = val;
1610         break;
1611     case 0x56: /* CCNTL0 */
1612         s->ccntl0 = val;
1613         break;
1614     case 0x57: /* CCNTL1 */
1615         s->ccntl1 = val;
1616         break;
1617     CASE_SET_REG32(mmrs, 0xa0)
1618     CASE_SET_REG32(mmws, 0xa4)
1619     CASE_SET_REG32(sfs, 0xa8)
1620     CASE_SET_REG32(drs, 0xac)
1621     CASE_SET_REG32(sbms, 0xb0)
1622     CASE_SET_REG32(dmbs, 0xb4)
1623     CASE_SET_REG32(dnad64, 0xb8)
1624     CASE_SET_REG32(pmjad1, 0xc0)
1625     CASE_SET_REG32(pmjad2, 0xc4)
1626     CASE_SET_REG32(rbc, 0xc8)
1627     CASE_SET_REG32(ua, 0xcc)
1628     CASE_SET_REG32(ia, 0xd4)
1629     CASE_SET_REG32(sbc, 0xd8)
1630     CASE_SET_REG32(csbc, 0xdc)
1631     default:
1632         if (offset >= 0x5c && offset < 0xa0) {
1633             int n;
1634             int shift;
1635             n = (offset - 0x58) >> 2;
1636             shift = (offset & 3) * 8;
1637             s->scratch[n] &= ~(0xff << shift);
1638             s->scratch[n] |= (val & 0xff) << shift;
1639         } else {
1640             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1641         }
1642     }
1643 #undef CASE_SET_REG32
1644 }
1645
1646 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1647 {
1648     LSIState *s = (LSIState *)opaque;
1649
1650     lsi_reg_writeb(s, addr & 0xff, val);
1651 }
1652
1653 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1654 {
1655     LSIState *s = (LSIState *)opaque;
1656
1657     addr &= 0xff;
1658     lsi_reg_writeb(s, addr, val & 0xff);
1659     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1660 }
1661
1662 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1663 {
1664     LSIState *s = (LSIState *)opaque;
1665
1666     addr &= 0xff;
1667     lsi_reg_writeb(s, addr, val & 0xff);
1668     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1669     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1670     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1671 }
1672
1673 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1674 {
1675     LSIState *s = (LSIState *)opaque;
1676
1677     return lsi_reg_readb(s, addr & 0xff);
1678 }
1679
1680 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1681 {
1682     LSIState *s = (LSIState *)opaque;
1683     uint32_t val;
1684
1685     addr &= 0xff;
1686     val = lsi_reg_readb(s, addr);
1687     val |= lsi_reg_readb(s, addr + 1) << 8;
1688     return val;
1689 }
1690
1691 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1692 {
1693     LSIState *s = (LSIState *)opaque;
1694     uint32_t val;
1695     addr &= 0xff;
1696     val = lsi_reg_readb(s, addr);
1697     val |= lsi_reg_readb(s, addr + 1) << 8;
1698     val |= lsi_reg_readb(s, addr + 2) << 16;
1699     val |= lsi_reg_readb(s, addr + 3) << 24;
1700     return val;
1701 }
1702
1703 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1704     lsi_mmio_readb,
1705     lsi_mmio_readw,
1706     lsi_mmio_readl,
1707 };
1708
1709 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1710     lsi_mmio_writeb,
1711     lsi_mmio_writew,
1712     lsi_mmio_writel,
1713 };
1714
1715 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1716 {
1717     LSIState *s = (LSIState *)opaque;
1718     uint32_t newval;
1719     int shift;
1720
1721     addr &= 0x1fff;
1722     newval = s->script_ram[addr >> 2];
1723     shift = (addr & 3) * 8;
1724     newval &= ~(0xff << shift);
1725     newval |= val << shift;
1726     s->script_ram[addr >> 2] = newval;
1727 }
1728
1729 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1730 {
1731     LSIState *s = (LSIState *)opaque;
1732     uint32_t newval;
1733
1734     addr &= 0x1fff;
1735     newval = s->script_ram[addr >> 2];
1736     if (addr & 2) {
1737         newval = (newval & 0xffff) | (val << 16);
1738     } else {
1739         newval = (newval & 0xffff0000) | val;
1740     }
1741     s->script_ram[addr >> 2] = newval;
1742 }
1743
1744
1745 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1746 {
1747     LSIState *s = (LSIState *)opaque;
1748
1749     addr &= 0x1fff;
1750     s->script_ram[addr >> 2] = val;
1751 }
1752
1753 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1754 {
1755     LSIState *s = (LSIState *)opaque;
1756     uint32_t val;
1757
1758     addr &= 0x1fff;
1759     val = s->script_ram[addr >> 2];
1760     val >>= (addr & 3) * 8;
1761     return val & 0xff;
1762 }
1763
1764 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1765 {
1766     LSIState *s = (LSIState *)opaque;
1767     uint32_t val;
1768
1769     addr &= 0x1fff;
1770     val = s->script_ram[addr >> 2];
1771     if (addr & 2)
1772         val >>= 16;
1773     return le16_to_cpu(val);
1774 }
1775
1776 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1777 {
1778     LSIState *s = (LSIState *)opaque;
1779
1780     addr &= 0x1fff;
1781     return le32_to_cpu(s->script_ram[addr >> 2]);
1782 }
1783
1784 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1785     lsi_ram_readb,
1786     lsi_ram_readw,
1787     lsi_ram_readl,
1788 };
1789
1790 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1791     lsi_ram_writeb,
1792     lsi_ram_writew,
1793     lsi_ram_writel,
1794 };
1795
1796 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1797 {
1798     LSIState *s = (LSIState *)opaque;
1799     return lsi_reg_readb(s, addr & 0xff);
1800 }
1801
1802 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1803 {
1804     LSIState *s = (LSIState *)opaque;
1805     uint32_t val;
1806     addr &= 0xff;
1807     val = lsi_reg_readb(s, addr);
1808     val |= lsi_reg_readb(s, addr + 1) << 8;
1809     return val;
1810 }
1811
1812 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1813 {
1814     LSIState *s = (LSIState *)opaque;
1815     uint32_t val;
1816     addr &= 0xff;
1817     val = lsi_reg_readb(s, addr);
1818     val |= lsi_reg_readb(s, addr + 1) << 8;
1819     val |= lsi_reg_readb(s, addr + 2) << 16;
1820     val |= lsi_reg_readb(s, addr + 3) << 24;
1821     return val;
1822 }
1823
1824 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1825 {
1826     LSIState *s = (LSIState *)opaque;
1827     lsi_reg_writeb(s, addr & 0xff, val);
1828 }
1829
1830 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1831 {
1832     LSIState *s = (LSIState *)opaque;
1833     addr &= 0xff;
1834     lsi_reg_writeb(s, addr, val & 0xff);
1835     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1836 }
1837
1838 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1839 {
1840     LSIState *s = (LSIState *)opaque;
1841     addr &= 0xff;
1842     lsi_reg_writeb(s, addr, val & 0xff);
1843     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1844     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1845     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1846 }
1847
1848 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1849                            uint32_t addr, uint32_t size, int type)
1850 {
1851     LSIState *s = (LSIState *)pci_dev;
1852
1853     DPRINTF("Mapping IO at %08x\n", addr);
1854
1855     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1856     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1857     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1858     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1859     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1860     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1861 }
1862
1863 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1864                             uint32_t addr, uint32_t size, int type)
1865 {
1866     LSIState *s = (LSIState *)pci_dev;
1867
1868     DPRINTF("Mapping ram at %08x\n", addr);
1869     s->script_ram_base = addr;
1870     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1871 }
1872
1873 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1874                              uint32_t addr, uint32_t size, int type)
1875 {
1876     LSIState *s = (LSIState *)pci_dev;
1877
1878     DPRINTF("Mapping registers at %08x\n", addr);
1879     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1880 }
1881
1882 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1883 {
1884     LSIState *s = (LSIState *)opaque;
1885
1886     if (id < 0) {
1887         for (id = 0; id < LSI_MAX_DEVS; id++) {
1888             if (s->scsi_dev[id] == NULL)
1889                 break;
1890         }
1891     }
1892     if (id >= LSI_MAX_DEVS) {
1893         BADF("Bad Device ID %d\n", id);
1894         return;
1895     }
1896     if (s->scsi_dev[id]) {
1897         DPRINTF("Destroying device %d\n", id);
1898         s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1899     }
1900     DPRINTF("Attaching block device %d\n", id);
1901     s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1902     if (s->scsi_dev[id] == NULL)
1903         s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1904     bd->devfn = s->pci_dev.devfn;
1905 }
1906
1907 int lsi_scsi_uninit(PCIDevice *d)
1908 {
1909     LSIState *s = (LSIState *) d;
1910
1911     cpu_unregister_io_memory(s->mmio_io_addr);
1912     cpu_unregister_io_memory(s->ram_io_addr);
1913
1914     qemu_free(s->queue);
1915
1916     return 0;
1917 }
1918
1919 void *lsi_scsi_init(PCIBus *bus, int devfn)
1920 {
1921     LSIState *s;
1922
1923     s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1924                                         sizeof(*s), devfn, NULL, NULL);
1925     if (s == NULL) {
1926         fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1927         return NULL;
1928     }
1929
1930     /* PCI Vendor ID (word) */
1931     s->pci_dev.config[0x00] = 0x00;
1932     s->pci_dev.config[0x01] = 0x10;
1933     /* PCI device ID (word) */
1934     s->pci_dev.config[0x02] = 0x12;
1935     s->pci_dev.config[0x03] = 0x00;
1936     /* PCI base class code */
1937     s->pci_dev.config[0x0b] = 0x01;
1938     /* PCI subsystem ID */
1939     s->pci_dev.config[0x2e] = 0x00;
1940     s->pci_dev.config[0x2f] = 0x10;
1941     /* PCI latency timer = 255 */
1942     s->pci_dev.config[0x0d] = 0xff;
1943     /* Interrupt pin 1 */
1944     s->pci_dev.config[0x3d] = 0x01;
1945
1946     s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1947                                              lsi_mmio_writefn, s);
1948     s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1949                                             lsi_ram_writefn, s);
1950
1951     pci_register_io_region((struct PCIDevice *)s, 0, 256,
1952                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1953     pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1954                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
1955     pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
1956                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
1957     s->queue = qemu_malloc(sizeof(lsi_queue));
1958     s->queue_len = 1;
1959     s->active_commands = 0;
1960     s->pci_dev.unregister = lsi_scsi_uninit;
1961
1962     lsi_soft_reset(s);
1963
1964     return s;
1965 }
1966