hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include "hw.h"
  14 #include "pci.h"
  15 #include "scsi-disk.h"
  16 #include "block_int.h"
  17
  18 //#define DEBUG_LSI
  19 //#define DEBUG_LSI_REG
  20
  21 #ifdef DEBUG_LSI
  22 #define DPRINTF(fmt, args...) \
  23 do { printf("lsi_scsi: " fmt , ##args); } while (0)
  24 #define BADF(fmt, args...) \
  25 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
  26 #else
  27 #define DPRINTF(fmt, args...) do {} while(0)
  28 #define BADF(fmt, args...) \
  29 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
  30 #endif
  31
  32 #define LSI_SCNTL0_TRG    0x01
  33 #define LSI_SCNTL0_AAP    0x02
  34 #define LSI_SCNTL0_EPC    0x08
  35 #define LSI_SCNTL0_WATN   0x10
  36 #define LSI_SCNTL0_START  0x20
  37
  38 #define LSI_SCNTL1_SST    0x01
  39 #define LSI_SCNTL1_IARB   0x02
  40 #define LSI_SCNTL1_AESP   0x04
  41 #define LSI_SCNTL1_RST    0x08
  42 #define LSI_SCNTL1_CON    0x10
  43 #define LSI_SCNTL1_DHP    0x20
  44 #define LSI_SCNTL1_ADB    0x40
  45 #define LSI_SCNTL1_EXC    0x80
  46
  47 #define LSI_SCNTL2_WSR    0x01
  48 #define LSI_SCNTL2_VUE0   0x02
  49 #define LSI_SCNTL2_VUE1   0x04
  50 #define LSI_SCNTL2_WSS    0x08
  51 #define LSI_SCNTL2_SLPHBEN 0x10
  52 #define LSI_SCNTL2_SLPMD  0x20
  53 #define LSI_SCNTL2_CHM    0x40
  54 #define LSI_SCNTL2_SDU    0x80
  55
  56 #define LSI_ISTAT0_DIP    0x01
  57 #define LSI_ISTAT0_SIP    0x02
  58 #define LSI_ISTAT0_INTF   0x04
  59 #define LSI_ISTAT0_CON    0x08
  60 #define LSI_ISTAT0_SEM    0x10
  61 #define LSI_ISTAT0_SIGP   0x20
  62 #define LSI_ISTAT0_SRST   0x40
  63 #define LSI_ISTAT0_ABRT   0x80
  64
  65 #define LSI_ISTAT1_SI     0x01
  66 #define LSI_ISTAT1_SRUN   0x02
  67 #define LSI_ISTAT1_FLSH   0x04
  68
  69 #define LSI_SSTAT0_SDP0   0x01
  70 #define LSI_SSTAT0_RST    0x02
  71 #define LSI_SSTAT0_WOA    0x04
  72 #define LSI_SSTAT0_LOA    0x08
  73 #define LSI_SSTAT0_AIP    0x10
  74 #define LSI_SSTAT0_OLF    0x20
  75 #define LSI_SSTAT0_ORF    0x40
  76 #define LSI_SSTAT0_ILF    0x80
  77
  78 #define LSI_SIST0_PAR     0x01
  79 #define LSI_SIST0_RST     0x02
  80 #define LSI_SIST0_UDC     0x04
  81 #define LSI_SIST0_SGE     0x08
  82 #define LSI_SIST0_RSL     0x10
  83 #define LSI_SIST0_SEL     0x20
  84 #define LSI_SIST0_CMP     0x40
  85 #define LSI_SIST0_MA      0x80
  86
  87 #define LSI_SIST1_HTH     0x01
  88 #define LSI_SIST1_GEN     0x02
  89 #define LSI_SIST1_STO     0x04
  90 #define LSI_SIST1_SBMC    0x10
  91
  92 #define LSI_SOCL_IO       0x01
  93 #define LSI_SOCL_CD       0x02
  94 #define LSI_SOCL_MSG      0x04
  95 #define LSI_SOCL_ATN      0x08
  96 #define LSI_SOCL_SEL      0x10
  97 #define LSI_SOCL_BSY      0x20
  98 #define LSI_SOCL_ACK      0x40
  99 #define LSI_SOCL_REQ      0x80
 100
 101 #define LSI_DSTAT_IID     0x01
 102 #define LSI_DSTAT_SIR     0x04
 103 #define LSI_DSTAT_SSI     0x08
 104 #define LSI_DSTAT_ABRT    0x10
 105 #define LSI_DSTAT_BF      0x20
 106 #define LSI_DSTAT_MDPE    0x40
 107 #define LSI_DSTAT_DFE     0x80
 108
 109 #define LSI_DCNTL_COM     0x01
 110 #define LSI_DCNTL_IRQD    0x02
 111 #define LSI_DCNTL_STD     0x04
 112 #define LSI_DCNTL_IRQM    0x08
 113 #define LSI_DCNTL_SSM     0x10
 114 #define LSI_DCNTL_PFEN    0x20
 115 #define LSI_DCNTL_PFF     0x40
 116 #define LSI_DCNTL_CLSE    0x80
 117
 118 #define LSI_DMODE_MAN     0x01
 119 #define LSI_DMODE_BOF     0x02
 120 #define LSI_DMODE_ERMP    0x04
 121 #define LSI_DMODE_ERL     0x08
 122 #define LSI_DMODE_DIOM    0x10
 123 #define LSI_DMODE_SIOM    0x20
 124
 125 #define LSI_CTEST2_DACK   0x01
 126 #define LSI_CTEST2_DREQ   0x02
 127 #define LSI_CTEST2_TEOP   0x04
 128 #define LSI_CTEST2_PCICIE 0x08
 129 #define LSI_CTEST2_CM     0x10
 130 #define LSI_CTEST2_CIO    0x20
 131 #define LSI_CTEST2_SIGP   0x40
 132 #define LSI_CTEST2_DDIR   0x80
 133
 134 #define LSI_CTEST5_BL2    0x04
 135 #define LSI_CTEST5_DDIR   0x08
 136 #define LSI_CTEST5_MASR   0x10
 137 #define LSI_CTEST5_DFSN   0x20
 138 #define LSI_CTEST5_BBCK   0x40
 139 #define LSI_CTEST5_ADCK   0x80
 140
 141 #define LSI_CCNTL0_DILS   0x01
 142 #define LSI_CCNTL0_DISFC  0x10
 143 #define LSI_CCNTL0_ENNDJ  0x20
 144 #define LSI_CCNTL0_PMJCTL 0x40
 145 #define LSI_CCNTL0_ENPMJ  0x80
 146
 147 #define PHASE_DO          0
 148 #define PHASE_DI          1
 149 #define PHASE_CMD         2
 150 #define PHASE_ST          3
 151 #define PHASE_MO          6
 152 #define PHASE_MI          7
 153 #define PHASE_MASK        7
 154
 155 /* Maximum length of MSG IN data.  */
 156 #define LSI_MAX_MSGIN_LEN 8
 157
 158 /* Flag set if this is a tagged command.  */
 159 #define LSI_TAG_VALID     (1 << 16)
 160
 161 typedef struct {
 162     uint32_t tag;
 163     uint32_t pending;
 164     int out;
 165 } lsi_queue;
 166
 167 typedef struct {
 168     PCIDevice pci_dev;
 169     int mmio_io_addr;
 170     int ram_io_addr;
 171     uint32_t script_ram_base;
 172
 173     int carry; /* ??? Should this be an a visible register somewhere?  */
 174     int sense;
 175     /* Action to take at the end of a MSG IN phase.
 176        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 177     int msg_action;
 178     int msg_len;
 179     uint8_t msg[LSI_MAX_MSGIN_LEN];
 180     /* 0 if SCRIPTS are running or stopped.
 181      * 1 if a Wait Reselect instruction has been issued.
 182      * 2 if processing DMA from lsi_execute_script.
 183      * 3 if a DMA operation is in progress.  */
 184     int waiting;
 185     SCSIDevice *scsi_dev[LSI_MAX_DEVS];
 186     SCSIDevice *current_dev;
 187     int current_lun;
 188     /* The tag is a combination of the device ID and the SCSI tag.  */
 189     uint32_t current_tag;
 190     uint32_t current_dma_len;
 191     int command_complete;
 192     uint8_t *dma_buf;
 193     lsi_queue *queue;
 194     int queue_len;
 195     int active_commands;
 196
 197     uint32_t dsa;
 198     uint32_t temp;
 199     uint32_t dnad;
 200     uint32_t dbc;
 201     uint8_t istat0;
 202     uint8_t istat1;
 203     uint8_t dcmd;
 204     uint8_t dstat;
 205     uint8_t dien;
 206     uint8_t sist0;
 207     uint8_t sist1;
 208     uint8_t sien0;
 209     uint8_t sien1;
 210     uint8_t mbox0;
 211     uint8_t mbox1;
 212     uint8_t dfifo;
 213     uint8_t ctest2;
 214     uint8_t ctest3;
 215     uint8_t ctest4;
 216     uint8_t ctest5;
 217     uint8_t ccntl0;
 218     uint8_t ccntl1;
 219     uint32_t dsp;
 220     uint32_t dsps;
 221     uint8_t dmode;
 222     uint8_t dcntl;
 223     uint8_t scntl0;
 224     uint8_t scntl1;
 225     uint8_t scntl2;
 226     uint8_t scntl3;
 227     uint8_t sstat0;
 228     uint8_t sstat1;
 229     uint8_t scid;
 230     uint8_t sxfer;
 231     uint8_t socl;
 232     uint8_t sdid;
 233     uint8_t ssid;
 234     uint8_t sfbr;
 235     uint8_t stest1;
 236     uint8_t stest2;
 237     uint8_t stest3;
 238     uint8_t sidl;
 239     uint8_t stime0;
 240     uint8_t respid0;
 241     uint8_t respid1;
 242     uint32_t mmrs;
 243     uint32_t mmws;
 244     uint32_t sfs;
 245     uint32_t drs;
 246     uint32_t sbms;
 247     uint32_t dmbs;
 248     uint32_t dnad64;
 249     uint32_t pmjad1;
 250     uint32_t pmjad2;
 251     uint32_t rbc;
 252     uint32_t ua;
 253     uint32_t ia;
 254     uint32_t sbc;
 255     uint32_t csbc;
 256     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 257
 258     /* Script ram is stored as 32-bit words in host byteorder.  */
 259     uint32_t script_ram[2048];
 260 } LSIState;
 261
 262 static void lsi_soft_reset(LSIState *s)
 263 {
 264     DPRINTF("Reset\n");
 265     s->carry = 0;
 266
 267     s->waiting = 0;
 268     s->dsa = 0;
 269     s->dnad = 0;
 270     s->dbc = 0;
 271     s->temp = 0;
 272     memset(s->scratch, 0, sizeof(s->scratch));
 273     s->istat0 = 0;
 274     s->istat1 = 0;
 275     s->dcmd = 0;
 276     s->dstat = 0;
 277     s->dien = 0;
 278     s->sist0 = 0;
 279     s->sist1 = 0;
 280     s->sien0 = 0;
 281     s->sien1 = 0;
 282     s->mbox0 = 0;
 283     s->mbox1 = 0;
 284     s->dfifo = 0;
 285     s->ctest2 = 0;
 286     s->ctest3 = 0;
 287     s->ctest4 = 0;
 288     s->ctest5 = 0;
 289     s->ccntl0 = 0;
 290     s->ccntl1 = 0;
 291     s->dsp = 0;
 292     s->dsps = 0;
 293     s->dmode = 0;
 294     s->dcntl = 0;
 295     s->scntl0 = 0xc0;
 296     s->scntl1 = 0;
 297     s->scntl2 = 0;
 298     s->scntl3 = 0;
 299     s->sstat0 = 0;
 300     s->sstat1 = 0;
 301     s->scid = 7;
 302     s->sxfer = 0;
 303     s->socl = 0;
 304     s->stest1 = 0;
 305     s->stest2 = 0;
 306     s->stest3 = 0;
 307     s->sidl = 0;
 308     s->stime0 = 0;
 309     s->respid0 = 0x80;
 310     s->respid1 = 0;
 311     s->mmrs = 0;
 312     s->mmws = 0;
 313     s->sfs = 0;
 314     s->drs = 0;
 315     s->sbms = 0;
 316     s->dmbs = 0;
 317     s->dnad64 = 0;
 318     s->pmjad1 = 0;
 319     s->pmjad2 = 0;
 320     s->rbc = 0;
 321     s->ua = 0;
 322     s->ia = 0;
 323     s->sbc = 0;
 324     s->csbc = 0;
 325 }
 326
 327 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 328 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 329 static void lsi_execute_script(LSIState *s);
 330
 331 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 332 {
 333     uint32_t buf;
 334
 335     /* Optimize reading from SCRIPTS RAM.  */
 336     if ((addr & 0xffffe000) == s->script_ram_base) {
 337         return s->script_ram[(addr & 0x1fff) >> 2];
 338     }
 339     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 340     return cpu_to_le32(buf);
 341 }
 342
 343 static void lsi_stop_script(LSIState *s)
 344 {
 345     s->istat1 &= ~LSI_ISTAT1_SRUN;
 346 }
 347
 348 static void lsi_update_irq(LSIState *s)
 349 {
 350     int level;
 351     static int last_level;
 352
 353     /* It's unclear whether the DIP/SIP bits should be cleared when the
 354        Interrupt Status Registers are cleared or when istat0 is read.
 355        We currently do the formwer, which seems to work.  */
 356     level = 0;
 357     if (s->dstat) {
 358         if (s->dstat & s->dien)
 359             level = 1;
 360         s->istat0 |= LSI_ISTAT0_DIP;
 361     } else {
 362         s->istat0 &= ~LSI_ISTAT0_DIP;
 363     }
 364
 365     if (s->sist0 || s->sist1) {
 366         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 367             level = 1;
 368         s->istat0 |= LSI_ISTAT0_SIP;
 369     } else {
 370         s->istat0 &= ~LSI_ISTAT0_SIP;
 371     }
 372     if (s->istat0 & LSI_ISTAT0_INTF)
 373         level = 1;
 374
 375     if (level != last_level) {
 376         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 377                 level, s->dstat, s->sist1, s->sist0);
 378         last_level = level;
 379     }
 380     qemu_set_irq(s->pci_dev.irq[0], level);
 381 }
 382
 383 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 384 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 385 {
 386     uint32_t mask0;
 387     uint32_t mask1;
 388
 389     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 390             stat1, stat0, s->sist1, s->sist0);
 391     s->sist0 |= stat0;
 392     s->sist1 |= stat1;
 393     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 394        we don't stop processing when raising STO.  Instead continue
 395        execution and stop at the next insn that accesses the SCSI bus.  */
 396     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 397     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 398     mask1 &= ~LSI_SIST1_STO;
 399     if (s->sist0 & mask0 || s->sist1 & mask1) {
 400         lsi_stop_script(s);
 401     }
 402     lsi_update_irq(s);
 403 }
 404
 405 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 406 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 407 {
 408     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 409     s->dstat |= stat;
 410     lsi_update_irq(s);
 411     lsi_stop_script(s);
 412 }
 413
 414 static inline void lsi_set_phase(LSIState *s, int phase)
 415 {
 416     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 417 }
 418
 419 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 420 {
 421     /* Trigger a phase mismatch.  */
 422     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 423         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 424             s->dsp = s->pmjad1;
 425         } else {
 426             s->dsp = s->pmjad2;
 427         }
 428         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 429     } else {
 430         DPRINTF("Phase mismatch interrupt\n");
 431         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 432         lsi_stop_script(s);
 433     }
 434     lsi_set_phase(s, new_phase);
 435 }
 436
 437
 438 /* Resume SCRIPTS execution after a DMA operation.  */
 439 static void lsi_resume_script(LSIState *s)
 440 {
 441     if (s->waiting != 2) {
 442         s->waiting = 0;
 443         lsi_execute_script(s);
 444     } else {
 445         s->waiting = 0;
 446     }
 447 }
 448
 449 /* Initiate a SCSI layer data transfer.  */
 450 static void lsi_do_dma(LSIState *s, int out)
 451 {
 452     uint32_t count;
 453     uint32_t addr;
 454
 455     if (!s->current_dma_len) {
 456         /* Wait until data is available.  */
 457         DPRINTF("DMA no data available\n");
 458         return;
 459     }
 460
 461     count = s->dbc;
 462     if (count > s->current_dma_len)
 463         count = s->current_dma_len;
 464     DPRINTF("DMA addr=0x%08x len=%d\n", s->dnad, count);
 465
 466     addr = s->dnad;
 467     s->csbc += count;
 468     s->dnad += count;
 469     s->dbc -= count;
 470
 471     if (s->dma_buf == NULL) {
 472         s->dma_buf = s->current_dev->get_buf(s->current_dev,
 473                                              s->current_tag);
 474     }
 475
 476     /* ??? Set SFBR to first data byte.  */
 477     if (out) {
 478         cpu_physical_memory_read(addr, s->dma_buf, count);
 479     } else {
 480         cpu_physical_memory_write(addr, s->dma_buf, count);
 481     }
 482     s->current_dma_len -= count;
 483     if (s->current_dma_len == 0) {
 484         s->dma_buf = NULL;
 485         if (out) {
 486             /* Write the data.  */
 487             s->current_dev->write_data(s->current_dev, s->current_tag);
 488         } else {
 489             /* Request any remaining data.  */
 490             s->current_dev->read_data(s->current_dev, s->current_tag);
 491         }
 492     } else {
 493         s->dma_buf += count;
 494         lsi_resume_script(s);
 495     }
 496 }
 497
 498
 499 /* Add a command to the queue.  */
 500 static void lsi_queue_command(LSIState *s)
 501 {
 502     lsi_queue *p;
 503
 504     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 505     if (s->queue_len == s->active_commands) {
 506         s->queue_len++;
 507         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 508     }
 509     p = &s->queue[s->active_commands++];
 510     p->tag = s->current_tag;
 511     p->pending = 0;
 512     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 513 }
 514
 515 /* Queue a byte for a MSG IN phase.  */
 516 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 517 {
 518     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 519         BADF("MSG IN data too long\n");
 520     } else {
 521         DPRINTF("MSG IN 0x%02x\n", data);
 522         s->msg[s->msg_len++] = data;
 523     }
 524 }
 525
 526 /* Perform reselection to continue a command.  */
 527 static void lsi_reselect(LSIState *s, uint32_t tag)
 528 {
 529     lsi_queue *p;
 530     int n;
 531     int id;
 532
 533     p = NULL;
 534     for (n = 0; n < s->active_commands; n++) {
 535         p = &s->queue[n];
 536         if (p->tag == tag)
 537             break;
 538     }
 539     if (n == s->active_commands) {
 540         BADF("Reselected non-existant command tag=0x%x\n", tag);
 541         return;
 542     }
 543     id = (tag >> 8) & 0xf;
 544     s->ssid = id | 0x80;
 545     DPRINTF("Reselected target %d\n", id);
 546     s->current_dev = s->scsi_dev[id];
 547     s->current_tag = tag;
 548     s->scntl1 |= LSI_SCNTL1_CON;
 549     lsi_set_phase(s, PHASE_MI);
 550     s->msg_action = p->out ? 2 : 3;
 551     s->current_dma_len = p->pending;
 552     s->dma_buf = NULL;
 553     lsi_add_msg_byte(s, 0x80);
 554     if (s->current_tag & LSI_TAG_VALID) {
 555         lsi_add_msg_byte(s, 0x20);
 556         lsi_add_msg_byte(s, tag & 0xff);
 557     }
 558
 559     s->active_commands--;
 560     if (n != s->active_commands) {
 561         s->queue[n] = s->queue[s->active_commands];
 562     }
 563 }
 564
 565 /* Record that data is available for a queued command.  Returns zero if
 566    the device was reselected, nonzero if the IO is deferred.  */
 567 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 568 {
 569     lsi_queue *p;
 570     int i;
 571     for (i = 0; i < s->active_commands; i++) {
 572         p = &s->queue[i];
 573         if (p->tag == tag) {
 574             if (p->pending) {
 575                 BADF("Multiple IO pending for tag %d\n", tag);
 576             }
 577             p->pending = arg;
 578             if (s->waiting == 1) {
 579                 /* Reselect device.  */
 580                 lsi_reselect(s, tag);
 581                 return 0;
 582             } else {
 583                DPRINTF("Queueing IO tag=0x%x\n", tag);
 584                 p->pending = arg;
 585                 return 1;
 586             }
 587         }
 588     }
 589     BADF("IO with unknown tag %d\n", tag);
 590     return 1;
 591 }
 592
 593 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 594 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
 595                                  uint32_t arg)
 596 {
 597     LSIState *s = (LSIState *)opaque;
 598     int out;
 599
 600     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 601     if (reason == SCSI_REASON_DONE) {
 602         DPRINTF("Command complete sense=%d\n", (int)arg);
 603         s->sense = arg;
 604         s->command_complete = 2;
 605         if (s->waiting && s->dbc != 0) {
 606             /* Raise phase mismatch for short transfers.  */
 607             lsi_bad_phase(s, out, PHASE_ST);
 608         } else {
 609             lsi_set_phase(s, PHASE_ST);
 610         }
 611         lsi_resume_script(s);
 612         return;
 613     }
 614
 615     if (s->waiting == 1 || tag != s->current_tag) {
 616         if (lsi_queue_tag(s, tag, arg))
 617             return;
 618     }
 619     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 620     s->current_dma_len = arg;
 621     s->command_complete = 1;
 622     if (!s->waiting)
 623         return;
 624     if (s->waiting == 1 || s->dbc == 0) {
 625         lsi_resume_script(s);
 626     } else {
 627         lsi_do_dma(s, out);
 628     }
 629 }
 630
 631 static void lsi_do_command(LSIState *s)
 632 {
 633     uint8_t buf[16];
 634     int n;
 635
 636     DPRINTF("Send command len=%d\n", s->dbc);
 637     if (s->dbc > 16)
 638         s->dbc = 16;
 639     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 640     s->sfbr = buf[0];
 641     s->command_complete = 0;
 642     n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
 643                                      s->current_lun);
 644     if (n > 0) {
 645         lsi_set_phase(s, PHASE_DI);
 646         s->current_dev->read_data(s->current_dev, s->current_tag);
 647     } else if (n < 0) {
 648         lsi_set_phase(s, PHASE_DO);
 649         s->current_dev->write_data(s->current_dev, s->current_tag);
 650     }
 651
 652     if (!s->command_complete) {
 653         if (n) {
 654             /* Command did not complete immediately so disconnect.  */
 655             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 656             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 657             /* wait data */
 658             lsi_set_phase(s, PHASE_MI);
 659             s->msg_action = 1;
 660             lsi_queue_command(s);
 661         } else {
 662             /* wait command complete */
 663             lsi_set_phase(s, PHASE_DI);
 664         }
 665     }
 666 }
 667
 668 static void lsi_do_status(LSIState *s)
 669 {
 670     uint8_t sense;
 671     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 672     if (s->dbc != 1)
 673         BADF("Bad Status move\n");
 674     s->dbc = 1;
 675     sense = s->sense;
 676     s->sfbr = sense;
 677     cpu_physical_memory_write(s->dnad, &sense, 1);
 678     lsi_set_phase(s, PHASE_MI);
 679     s->msg_action = 1;
 680     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 681 }
 682
 683 static void lsi_disconnect(LSIState *s)
 684 {
 685     s->scntl1 &= ~LSI_SCNTL1_CON;
 686     s->sstat1 &= ~PHASE_MASK;
 687 }
 688
 689 static void lsi_do_msgin(LSIState *s)
 690 {
 691     int len;
 692     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 693     s->sfbr = s->msg[0];
 694     len = s->msg_len;
 695     if (len > s->dbc)
 696         len = s->dbc;
 697     cpu_physical_memory_write(s->dnad, s->msg, len);
 698     /* Linux drivers rely on the last byte being in the SIDL.  */
 699     s->sidl = s->msg[len - 1];
 700     s->msg_len -= len;
 701     if (s->msg_len) {
 702         memmove(s->msg, s->msg + len, s->msg_len);
 703     } else {
 704         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 705            switch to PHASE_MO.  */
 706         switch (s->msg_action) {
 707         case 0:
 708             lsi_set_phase(s, PHASE_CMD);
 709             break;
 710         case 1:
 711             lsi_disconnect(s);
 712             break;
 713         case 2:
 714             lsi_set_phase(s, PHASE_DO);
 715             break;
 716         case 3:
 717             lsi_set_phase(s, PHASE_DI);
 718             break;
 719         default:
 720             abort();
 721         }
 722     }
 723 }
 724
 725 /* Read the next byte during a MSGOUT phase.  */
 726 static uint8_t lsi_get_msgbyte(LSIState *s)
 727 {
 728     uint8_t data;
 729     cpu_physical_memory_read(s->dnad, &data, 1);
 730     s->dnad++;
 731     s->dbc--;
 732     return data;
 733 }
 734
 735 static void lsi_do_msgout(LSIState *s)
 736 {
 737     uint8_t msg;
 738     int len;
 739
 740     DPRINTF("MSG out len=%d\n", s->dbc);
 741     while (s->dbc) {
 742         msg = lsi_get_msgbyte(s);
 743         s->sfbr = msg;
 744
 745         switch (msg) {
 746         case 0x00:
 747             DPRINTF("MSG: Disconnect\n");
 748             lsi_disconnect(s);
 749             break;
 750         case 0x08:
 751             DPRINTF("MSG: No Operation\n");
 752             lsi_set_phase(s, PHASE_CMD);
 753             break;
 754         case 0x01:
 755             len = lsi_get_msgbyte(s);
 756             msg = lsi_get_msgbyte(s);
 757             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 758             switch (msg) {
 759             case 1:
 760                 DPRINTF("SDTR (ignored)\n");
 761                 s->dbc -= 2;
 762                 break;
 763             case 3:
 764                 DPRINTF("WDTR (ignored)\n");
 765                 s->dbc -= 1;
 766                 break;
 767             default:
 768                 goto bad;
 769             }
 770             break;
 771         case 0x20: /* SIMPLE queue */
 772             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 773             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 774             break;
 775         case 0x21: /* HEAD of queue */
 776             BADF("HEAD queue not implemented\n");
 777             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 778             break;
 779         case 0x22: /* ORDERED queue */
 780             BADF("ORDERED queue not implemented\n");
 781             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 782             break;
 783         default:
 784             if ((msg & 0x80) == 0) {
 785                 goto bad;
 786             }
 787             s->current_lun = msg & 7;
 788             DPRINTF("Select LUN %d\n", s->current_lun);
 789             lsi_set_phase(s, PHASE_CMD);
 790             break;
 791         }
 792     }
 793     return;
 794 bad:
 795     BADF("Unimplemented message 0x%02x\n", msg);
 796     lsi_set_phase(s, PHASE_MI);
 797     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 798     s->msg_action = 0;
 799 }
 800
 801 /* Sign extend a 24-bit value.  */
 802 static inline int32_t sxt24(int32_t n)
 803 {
 804     return (n << 8) >> 8;
 805 }
 806
 807 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 808 {
 809     int n;
 810     uint8_t buf[TARGET_PAGE_SIZE];
 811
 812     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 813     while (count) {
 814         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
 815         cpu_physical_memory_read(src, buf, n);
 816         cpu_physical_memory_write(dest, buf, n);
 817         src += n;
 818         dest += n;
 819         count -= n;
 820     }
 821 }
 822
 823 static void lsi_wait_reselect(LSIState *s)
 824 {
 825     int i;
 826     DPRINTF("Wait Reselect\n");
 827     if (s->current_dma_len)
 828         BADF("Reselect with pending DMA\n");
 829     for (i = 0; i < s->active_commands; i++) {
 830         if (s->queue[i].pending) {
 831             lsi_reselect(s, s->queue[i].tag);
 832             break;
 833         }
 834     }
 835     if (s->current_dma_len == 0) {
 836         s->waiting = 1;
 837     }
 838 }
 839
 840 static void lsi_execute_script(LSIState *s)
 841 {
 842     uint32_t insn;
 843     uint32_t addr;
 844     int opcode;
 845     int insn_processed = 0;
 846
 847     s->istat1 |= LSI_ISTAT1_SRUN;
 848 again:
 849     insn_processed++;
 850     insn = read_dword(s, s->dsp);
 851     addr = read_dword(s, s->dsp + 4);
 852     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 853     s->dsps = addr;
 854     s->dcmd = insn >> 24;
 855     s->dsp += 8;
 856     switch (insn >> 30) {
 857     case 0: /* Block move.  */
 858         if (s->sist1 & LSI_SIST1_STO) {
 859             DPRINTF("Delayed select timeout\n");
 860             lsi_stop_script(s);
 861             break;
 862         }
 863         s->dbc = insn & 0xffffff;
 864         s->rbc = s->dbc;
 865         if (insn & (1 << 29)) {
 866             /* Indirect addressing.  */
 867             addr = read_dword(s, addr);
 868         } else if (insn & (1 << 28)) {
 869             uint32_t buf[2];
 870             int32_t offset;
 871             /* Table indirect addressing.  */
 872             offset = sxt24(addr);
 873             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 874             s->dbc = cpu_to_le32(buf[0]);
 875             s->rbc = s->dbc;
 876             addr = cpu_to_le32(buf[1]);
 877         }
 878         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 879             DPRINTF("Wrong phase got %d expected %d\n",
 880                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 881             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 882             break;
 883         }
 884         s->dnad = addr;
 885         /* ??? Set ESA.  */
 886         s->ia = s->dsp - 8;
 887         switch (s->sstat1 & 0x7) {
 888         case PHASE_DO:
 889             s->waiting = 2;
 890             lsi_do_dma(s, 1);
 891             if (s->waiting)
 892                 s->waiting = 3;
 893             break;
 894         case PHASE_DI:
 895             s->waiting = 2;
 896             s->current_dma_len = s->dbc;
 897             lsi_do_dma(s, 0);
 898             if (s->waiting)
 899                 s->waiting = 3;
 900             break;
 901         case PHASE_CMD:
 902             lsi_do_command(s);
 903             break;
 904         case PHASE_ST:
 905             lsi_do_status(s);
 906             break;
 907         case PHASE_MO:
 908             lsi_do_msgout(s);
 909             break;
 910         case PHASE_MI:
 911             lsi_do_msgin(s);
 912             break;
 913         default:
 914             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
 915             exit(1);
 916         }
 917         s->dfifo = s->dbc & 0xff;
 918         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
 919         s->sbc = s->dbc;
 920         s->rbc -= s->dbc;
 921         s->ua = addr + s->dbc;
 922         break;
 923
 924     case 1: /* IO or Read/Write instruction.  */
 925         opcode = (insn >> 27) & 7;
 926         if (opcode < 5) {
 927             uint32_t id;
 928
 929             if (insn & (1 << 25)) {
 930                 id = read_dword(s, s->dsa + sxt24(insn));
 931             } else {
 932                 id = addr;
 933             }
 934             id = (id >> 16) & 0xf;
 935             if (insn & (1 << 26)) {
 936                 addr = s->dsp + sxt24(addr);
 937             }
 938             s->dnad = addr;
 939             switch (opcode) {
 940             case 0: /* Select */
 941                 s->sdid = id;
 942                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
 943                     DPRINTF("Already reselected by target %d\n", id);
 944                     break;
 945                 }
 946                 s->sstat0 |= LSI_SSTAT0_WOA;
 947                 s->scntl1 &= ~LSI_SCNTL1_IARB;
 948                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
 949                     DPRINTF("Selected absent target %d\n", id);
 950                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 951                     lsi_disconnect(s);
 952                     break;
 953                 }
 954                 DPRINTF("Selected target %d%s\n",
 955                         id, insn & (1 << 3) ? " ATN" : "");
 956                 /* ??? Linux drivers compain when this is set.  Maybe
 957                    it only applies in low-level mode (unimplemented).
 958                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
 959                 s->current_dev = s->scsi_dev[id];
 960                 s->current_tag = id << 8;
 961                 s->scntl1 |= LSI_SCNTL1_CON;
 962                 if (insn & (1 << 3)) {
 963                     s->socl |= LSI_SOCL_ATN;
 964                 }
 965                 lsi_set_phase(s, PHASE_MO);
 966                 break;
 967             case 1: /* Disconnect */
 968                 DPRINTF("Wait Disconect\n");
 969                 s->scntl1 &= ~LSI_SCNTL1_CON;
 970                 break;
 971             case 2: /* Wait Reselect */
 972                 lsi_wait_reselect(s);
 973                 break;
 974             case 3: /* Set */
 975                 DPRINTF("Set%s%s%s%s\n",
 976                         insn & (1 << 3) ? " ATN" : "",
 977                         insn & (1 << 6) ? " ACK" : "",
 978                         insn & (1 << 9) ? " TM" : "",
 979                         insn & (1 << 10) ? " CC" : "");
 980                 if (insn & (1 << 3)) {
 981                     s->socl |= LSI_SOCL_ATN;
 982                     lsi_set_phase(s, PHASE_MO);
 983                 }
 984                 if (insn & (1 << 9)) {
 985                     BADF("Target mode not implemented\n");
 986                     exit(1);
 987                 }
 988                 if (insn & (1 << 10))
 989                     s->carry = 1;
 990                 break;
 991             case 4: /* Clear */
 992                 DPRINTF("Clear%s%s%s%s\n",
 993                         insn & (1 << 3) ? " ATN" : "",
 994                         insn & (1 << 6) ? " ACK" : "",
 995                         insn & (1 << 9) ? " TM" : "",
 996                         insn & (1 << 10) ? " CC" : "");
 997                 if (insn & (1 << 3)) {
 998                     s->socl &= ~LSI_SOCL_ATN;
 999                 }
1000                 if (insn & (1 << 10))
1001                     s->carry = 0;
1002                 break;
1003             }
1004         } else {
1005             uint8_t op0;
1006             uint8_t op1;
1007             uint8_t data8;
1008             int reg;
1009             int operator;
1010 #ifdef DEBUG_LSI
1011             static const char *opcode_names[3] =
1012                 {"Write", "Read", "Read-Modify-Write"};
1013             static const char *operator_names[8] =
1014                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1015 #endif
1016
1017             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1018             data8 = (insn >> 8) & 0xff;
1019             opcode = (insn >> 27) & 7;
1020             operator = (insn >> 24) & 7;
1021             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1022                     opcode_names[opcode - 5], reg,
1023                     operator_names[operator], data8, s->sfbr,
1024                     (insn & (1 << 23)) ? " SFBR" : "");
1025             op0 = op1 = 0;
1026             switch (opcode) {
1027             case 5: /* From SFBR */
1028                 op0 = s->sfbr;
1029                 op1 = data8;
1030                 break;
1031             case 6: /* To SFBR */
1032                 if (operator)
1033                     op0 = lsi_reg_readb(s, reg);
1034                 op1 = data8;
1035                 break;
1036             case 7: /* Read-modify-write */
1037                 if (operator)
1038                     op0 = lsi_reg_readb(s, reg);
1039                 if (insn & (1 << 23)) {
1040                     op1 = s->sfbr;
1041                 } else {
1042                     op1 = data8;
1043                 }
1044                 break;
1045             }
1046
1047             switch (operator) {
1048             case 0: /* move */
1049                 op0 = op1;
1050                 break;
1051             case 1: /* Shift left */
1052                 op1 = op0 >> 7;
1053                 op0 = (op0 << 1) | s->carry;
1054                 s->carry = op1;
1055                 break;
1056             case 2: /* OR */
1057                 op0 |= op1;
1058                 break;
1059             case 3: /* XOR */
1060                 op0 ^= op1;
1061                 break;
1062             case 4: /* AND */
1063                 op0 &= op1;
1064                 break;
1065             case 5: /* SHR */
1066                 op1 = op0 & 1;
1067                 op0 = (op0 >> 1) | (s->carry << 7);
1068                 s->carry = op1;
1069                 break;
1070             case 6: /* ADD */
1071                 op0 += op1;
1072                 s->carry = op0 < op1;
1073                 break;
1074             case 7: /* ADC */
1075                 op0 += op1 + s->carry;
1076                 if (s->carry)
1077                     s->carry = op0 <= op1;
1078                 else
1079                     s->carry = op0 < op1;
1080                 break;
1081             }
1082
1083             switch (opcode) {
1084             case 5: /* From SFBR */
1085             case 7: /* Read-modify-write */
1086                 lsi_reg_writeb(s, reg, op0);
1087                 break;
1088             case 6: /* To SFBR */
1089                 s->sfbr = op0;
1090                 break;
1091             }
1092         }
1093         break;
1094
1095     case 2: /* Transfer Control.  */
1096         {
1097             int cond;
1098             int jmp;
1099
1100             if ((insn & 0x002e0000) == 0) {
1101                 DPRINTF("NOP\n");
1102                 break;
1103             }
1104             if (s->sist1 & LSI_SIST1_STO) {
1105                 DPRINTF("Delayed select timeout\n");
1106                 lsi_stop_script(s);
1107                 break;
1108             }
1109             cond = jmp = (insn & (1 << 19)) != 0;
1110             if (cond == jmp && (insn & (1 << 21))) {
1111                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1112                 cond = s->carry != 0;
1113             }
1114             if (cond == jmp && (insn & (1 << 17))) {
1115                 DPRINTF("Compare phase %d %c= %d\n",
1116                         (s->sstat1 & PHASE_MASK),
1117                         jmp ? '=' : '!',
1118                         ((insn >> 24) & 7));
1119                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1120             }
1121             if (cond == jmp && (insn & (1 << 18))) {
1122                 uint8_t mask;
1123
1124                 mask = (~insn >> 8) & 0xff;
1125                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1126                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1127                 cond = (s->sfbr & mask) == (insn & mask);
1128             }
1129             if (cond == jmp) {
1130                 if (insn & (1 << 23)) {
1131                     /* Relative address.  */
1132                     addr = s->dsp + sxt24(addr);
1133                 }
1134                 switch ((insn >> 27) & 7) {
1135                 case 0: /* Jump */
1136                     DPRINTF("Jump to 0x%08x\n", addr);
1137                     s->dsp = addr;
1138                     break;
1139                 case 1: /* Call */
1140                     DPRINTF("Call 0x%08x\n", addr);
1141                     s->temp = s->dsp;
1142                     s->dsp = addr;
1143                     break;
1144                 case 2: /* Return */
1145                     DPRINTF("Return to 0x%08x\n", s->temp);
1146                     s->dsp = s->temp;
1147                     break;
1148                 case 3: /* Interrupt */
1149                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1150                     if ((insn & (1 << 20)) != 0) {
1151                         s->istat0 |= LSI_ISTAT0_INTF;
1152                         lsi_update_irq(s);
1153                     } else {
1154                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1155                     }
1156                     break;
1157                 default:
1158                     DPRINTF("Illegal transfer control\n");
1159                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1160                     break;
1161                 }
1162             } else {
1163                 DPRINTF("Control condition failed\n");
1164             }
1165         }
1166         break;
1167
1168     case 3:
1169         if ((insn & (1 << 29)) == 0) {
1170             /* Memory move.  */
1171             uint32_t dest;
1172             /* ??? The docs imply the destination address is loaded into
1173                the TEMP register.  However the Linux drivers rely on
1174                the value being presrved.  */
1175             dest = read_dword(s, s->dsp);
1176             s->dsp += 4;
1177             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1178         } else {
1179             uint8_t data[7];
1180             int reg;
1181             int n;
1182             int i;
1183
1184             if (insn & (1 << 28)) {
1185                 addr = s->dsa + sxt24(addr);
1186             }
1187             n = (insn & 7);
1188             reg = (insn >> 16) & 0xff;
1189             if (insn & (1 << 24)) {
1190                 cpu_physical_memory_read(addr, data, n);
1191                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1192                         addr, *(int *)data);
1193                 for (i = 0; i < n; i++) {
1194                     lsi_reg_writeb(s, reg + i, data[i]);
1195                 }
1196             } else {
1197                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1198                 for (i = 0; i < n; i++) {
1199                     data[i] = lsi_reg_readb(s, reg + i);
1200                 }
1201                 cpu_physical_memory_write(addr, data, n);
1202             }
1203         }
1204     }
1205     if (insn_processed > 10000 && !s->waiting) {
1206         /* Some windows drivers make the device spin waiting for a memory
1207            location to change.  If we have been executed a lot of code then
1208            assume this is the case and force an unexpected device disconnect.
1209            This is apparently sufficient to beat the drivers into submission.
1210          */
1211         if (!(s->sien0 & LSI_SIST0_UDC))
1212             fprintf(stderr, "inf. loop with UDC masked\n");
1213         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1214         lsi_disconnect(s);
1215     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1216         if (s->dcntl & LSI_DCNTL_SSM) {
1217             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1218         } else {
1219             goto again;
1220         }
1221     }
1222     DPRINTF("SCRIPTS execution stopped\n");
1223 }
1224
1225 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1226 {
1227     uint8_t tmp;
1228 #define CASE_GET_REG32(name, addr) \
1229     case addr: return s->name & 0xff; \
1230     case addr + 1: return (s->name >> 8) & 0xff; \
1231     case addr + 2: return (s->name >> 16) & 0xff; \
1232     case addr + 3: return (s->name >> 24) & 0xff;
1233
1234 #ifdef DEBUG_LSI_REG
1235     DPRINTF("Read reg %x\n", offset);
1236 #endif
1237     switch (offset) {
1238     case 0x00: /* SCNTL0 */
1239         return s->scntl0;
1240     case 0x01: /* SCNTL1 */
1241         return s->scntl1;
1242     case 0x02: /* SCNTL2 */
1243         return s->scntl2;
1244     case 0x03: /* SCNTL3 */
1245         return s->scntl3;
1246     case 0x04: /* SCID */
1247         return s->scid;
1248     case 0x05: /* SXFER */
1249         return s->sxfer;
1250     case 0x06: /* SDID */
1251         return s->sdid;
1252     case 0x07: /* GPREG0 */
1253         return 0x7f;
1254     case 0x08: /* Revision ID */
1255         return 0x00;
1256     case 0xa: /* SSID */
1257         return s->ssid;
1258     case 0xb: /* SBCL */
1259         /* ??? This is not correct. However it's (hopefully) only
1260            used for diagnostics, so should be ok.  */
1261         return 0;
1262     case 0xc: /* DSTAT */
1263         tmp = s->dstat | 0x80;
1264         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1265             s->dstat = 0;
1266         lsi_update_irq(s);
1267         return tmp;
1268     case 0x0d: /* SSTAT0 */
1269         return s->sstat0;
1270     case 0x0e: /* SSTAT1 */
1271         return s->sstat1;
1272     case 0x0f: /* SSTAT2 */
1273         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1274     CASE_GET_REG32(dsa, 0x10)
1275     case 0x14: /* ISTAT0 */
1276         return s->istat0;
1277     case 0x16: /* MBOX0 */
1278         return s->mbox0;
1279     case 0x17: /* MBOX1 */
1280         return s->mbox1;
1281     case 0x18: /* CTEST0 */
1282         return 0xff;
1283     case 0x19: /* CTEST1 */
1284         return 0;
1285     case 0x1a: /* CTEST2 */
1286         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1287         if (s->istat0 & LSI_ISTAT0_SIGP) {
1288             s->istat0 &= ~LSI_ISTAT0_SIGP;
1289             tmp |= LSI_CTEST2_SIGP;
1290         }
1291         return tmp;
1292     case 0x1b: /* CTEST3 */
1293         return s->ctest3;
1294     CASE_GET_REG32(temp, 0x1c)
1295     case 0x20: /* DFIFO */
1296         return 0;
1297     case 0x21: /* CTEST4 */
1298         return s->ctest4;
1299     case 0x22: /* CTEST5 */
1300         return s->ctest5;
1301     case 0x23: /* CTEST6 */
1302          return 0;
1303     case 0x24: /* DBC[0:7] */
1304         return s->dbc & 0xff;
1305     case 0x25: /* DBC[8:15] */
1306         return (s->dbc >> 8) & 0xff;
1307     case 0x26: /* DBC[16->23] */
1308         return (s->dbc >> 16) & 0xff;
1309     case 0x27: /* DCMD */
1310         return s->dcmd;
1311     CASE_GET_REG32(dsp, 0x2c)
1312     CASE_GET_REG32(dsps, 0x30)
1313     CASE_GET_REG32(scratch[0], 0x34)
1314     case 0x38: /* DMODE */
1315         return s->dmode;
1316     case 0x39: /* DIEN */
1317         return s->dien;
1318     case 0x3b: /* DCNTL */
1319         return s->dcntl;
1320     case 0x40: /* SIEN0 */
1321         return s->sien0;
1322     case 0x41: /* SIEN1 */
1323         return s->sien1;
1324     case 0x42: /* SIST0 */
1325         tmp = s->sist0;
1326         s->sist0 = 0;
1327         lsi_update_irq(s);
1328         return tmp;
1329     case 0x43: /* SIST1 */
1330         tmp = s->sist1;
1331         s->sist1 = 0;
1332         lsi_update_irq(s);
1333         return tmp;
1334     case 0x46: /* MACNTL */
1335         return 0x0f;
1336     case 0x47: /* GPCNTL0 */
1337         return 0x0f;
1338     case 0x48: /* STIME0 */
1339         return s->stime0;
1340     case 0x4a: /* RESPID0 */
1341         return s->respid0;
1342     case 0x4b: /* RESPID1 */
1343         return s->respid1;
1344     case 0x4d: /* STEST1 */
1345         return s->stest1;
1346     case 0x4e: /* STEST2 */
1347         return s->stest2;
1348     case 0x4f: /* STEST3 */
1349         return s->stest3;
1350     case 0x50: /* SIDL */
1351         /* This is needed by the linux drivers.  We currently only update it
1352            during the MSG IN phase.  */
1353         return s->sidl;
1354     case 0x52: /* STEST4 */
1355         return 0xe0;
1356     case 0x56: /* CCNTL0 */
1357         return s->ccntl0;
1358     case 0x57: /* CCNTL1 */
1359         return s->ccntl1;
1360     case 0x58: /* SBDL */
1361         /* Some drivers peek at the data bus during the MSG IN phase.  */
1362         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1363             return s->msg[0];
1364         return 0;
1365     case 0x59: /* SBDL high */
1366         return 0;
1367     CASE_GET_REG32(mmrs, 0xa0)
1368     CASE_GET_REG32(mmws, 0xa4)
1369     CASE_GET_REG32(sfs, 0xa8)
1370     CASE_GET_REG32(drs, 0xac)
1371     CASE_GET_REG32(sbms, 0xb0)
1372     CASE_GET_REG32(dmbs, 0xb4)
1373     CASE_GET_REG32(dnad64, 0xb8)
1374     CASE_GET_REG32(pmjad1, 0xc0)
1375     CASE_GET_REG32(pmjad2, 0xc4)
1376     CASE_GET_REG32(rbc, 0xc8)
1377     CASE_GET_REG32(ua, 0xcc)
1378     CASE_GET_REG32(ia, 0xd4)
1379     CASE_GET_REG32(sbc, 0xd8)
1380     CASE_GET_REG32(csbc, 0xdc)
1381     }
1382     if (offset >= 0x5c && offset < 0xa0) {
1383         int n;
1384         int shift;
1385         n = (offset - 0x58) >> 2;
1386         shift = (offset & 3) * 8;
1387         return (s->scratch[n] >> shift) & 0xff;
1388     }
1389     BADF("readb 0x%x\n", offset);
1390     exit(1);
1391 #undef CASE_GET_REG32
1392 }
1393
1394 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1395 {
1396 #define CASE_SET_REG32(name, addr) \
1397     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1398     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1399     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1400     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1401
1402 #ifdef DEBUG_LSI_REG
1403     DPRINTF("Write reg %x = %02x\n", offset, val);
1404 #endif
1405     switch (offset) {
1406     case 0x00: /* SCNTL0 */
1407         s->scntl0 = val;
1408         if (val & LSI_SCNTL0_START) {
1409             BADF("Start sequence not implemented\n");
1410         }
1411         break;
1412     case 0x01: /* SCNTL1 */
1413         s->scntl1 = val & ~LSI_SCNTL1_SST;
1414         if (val & LSI_SCNTL1_IARB) {
1415             BADF("Immediate Arbritration not implemented\n");
1416         }
1417         if (val & LSI_SCNTL1_RST) {
1418             s->sstat0 |= LSI_SSTAT0_RST;
1419             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1420         } else {
1421             s->sstat0 &= ~LSI_SSTAT0_RST;
1422         }
1423         break;
1424     case 0x02: /* SCNTL2 */
1425         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1426         s->scntl2 = val;
1427         break;
1428     case 0x03: /* SCNTL3 */
1429         s->scntl3 = val;
1430         break;
1431     case 0x04: /* SCID */
1432         s->scid = val;
1433         break;
1434     case 0x05: /* SXFER */
1435         s->sxfer = val;
1436         break;
1437     case 0x06: /* SDID */
1438         if ((val & 0xf) != (s->ssid & 0xf))
1439             BADF("Destination ID does not match SSID\n");
1440         s->sdid = val & 0xf;
1441         break;
1442     case 0x07: /* GPREG0 */
1443         break;
1444     case 0x08: /* SFBR */
1445         /* The CPU is not allowed to write to this register.  However the
1446            SCRIPTS register move instructions are.  */
1447         s->sfbr = val;
1448         break;
1449     case 0x0a: case 0x0b:
1450         /* Openserver writes to these readonly registers on startup */
1451         return;
1452     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1453         /* Linux writes to these readonly registers on startup.  */
1454         return;
1455     CASE_SET_REG32(dsa, 0x10)
1456     case 0x14: /* ISTAT0 */
1457         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1458         if (val & LSI_ISTAT0_ABRT) {
1459             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1460         }
1461         if (val & LSI_ISTAT0_INTF) {
1462             s->istat0 &= ~LSI_ISTAT0_INTF;
1463             lsi_update_irq(s);
1464         }
1465         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1466             DPRINTF("Woken by SIGP\n");
1467             s->waiting = 0;
1468             s->dsp = s->dnad;
1469             lsi_execute_script(s);
1470         }
1471         if (val & LSI_ISTAT0_SRST) {
1472             lsi_soft_reset(s);
1473         }
1474         break;
1475     case 0x16: /* MBOX0 */
1476         s->mbox0 = val;
1477         break;
1478     case 0x17: /* MBOX1 */
1479         s->mbox1 = val;
1480         break;
1481     case 0x1a: /* CTEST2 */
1482         s->ctest2 = val & LSI_CTEST2_PCICIE;
1483         break;
1484     case 0x1b: /* CTEST3 */
1485         s->ctest3 = val & 0x0f;
1486         break;
1487     CASE_SET_REG32(temp, 0x1c)
1488     case 0x21: /* CTEST4 */
1489         if (val & 7) {
1490            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1491         }
1492         s->ctest4 = val;
1493         break;
1494     case 0x22: /* CTEST5 */
1495         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1496             BADF("CTEST5 DMA increment not implemented\n");
1497         }
1498         s->ctest5 = val;
1499         break;
1500     case 0x2c: /* DSP[0:7] */
1501         s->dsp &= 0xffffff00;
1502         s->dsp |= val;
1503         break;
1504     case 0x2d: /* DSP[8:15] */
1505         s->dsp &= 0xffff00ff;
1506         s->dsp |= val << 8;
1507         break;
1508     case 0x2e: /* DSP[16:23] */
1509         s->dsp &= 0xff00ffff;
1510         s->dsp |= val << 16;
1511         break;
1512     case 0x2f: /* DSP[24:31] */
1513         s->dsp &= 0x00ffffff;
1514         s->dsp |= val << 24;
1515         if ((s->dmode & LSI_DMODE_MAN) == 0
1516             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1517             lsi_execute_script(s);
1518         break;
1519     CASE_SET_REG32(dsps, 0x30)
1520     CASE_SET_REG32(scratch[0], 0x34)
1521     case 0x38: /* DMODE */
1522         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1523             BADF("IO mappings not implemented\n");
1524         }
1525         s->dmode = val;
1526         break;
1527     case 0x39: /* DIEN */
1528         s->dien = val;
1529         lsi_update_irq(s);
1530         break;
1531     case 0x3b: /* DCNTL */
1532         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1533         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1534             lsi_execute_script(s);
1535         break;
1536     case 0x40: /* SIEN0 */
1537         s->sien0 = val;
1538         lsi_update_irq(s);
1539         break;
1540     case 0x41: /* SIEN1 */
1541         s->sien1 = val;
1542         lsi_update_irq(s);
1543         break;
1544     case 0x47: /* GPCNTL0 */
1545         break;
1546     case 0x48: /* STIME0 */
1547         s->stime0 = val;
1548         break;
1549     case 0x49: /* STIME1 */
1550         if (val & 0xf) {
1551             DPRINTF("General purpose timer not implemented\n");
1552             /* ??? Raising the interrupt immediately seems to be sufficient
1553                to keep the FreeBSD driver happy.  */
1554             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1555         }
1556         break;
1557     case 0x4a: /* RESPID0 */
1558         s->respid0 = val;
1559         break;
1560     case 0x4b: /* RESPID1 */
1561         s->respid1 = val;
1562         break;
1563     case 0x4d: /* STEST1 */
1564         s->stest1 = val;
1565         break;
1566     case 0x4e: /* STEST2 */
1567         if (val & 1) {
1568             BADF("Low level mode not implemented\n");
1569         }
1570         s->stest2 = val;
1571         break;
1572     case 0x4f: /* STEST3 */
1573         if (val & 0x41) {
1574             BADF("SCSI FIFO test mode not implemented\n");
1575         }
1576         s->stest3 = val;
1577         break;
1578     case 0x56: /* CCNTL0 */
1579         s->ccntl0 = val;
1580         break;
1581     case 0x57: /* CCNTL1 */
1582         s->ccntl1 = val;
1583         break;
1584     CASE_SET_REG32(mmrs, 0xa0)
1585     CASE_SET_REG32(mmws, 0xa4)
1586     CASE_SET_REG32(sfs, 0xa8)
1587     CASE_SET_REG32(drs, 0xac)
1588     CASE_SET_REG32(sbms, 0xb0)
1589     CASE_SET_REG32(dmbs, 0xb4)
1590     CASE_SET_REG32(dnad64, 0xb8)
1591     CASE_SET_REG32(pmjad1, 0xc0)
1592     CASE_SET_REG32(pmjad2, 0xc4)
1593     CASE_SET_REG32(rbc, 0xc8)
1594     CASE_SET_REG32(ua, 0xcc)
1595     CASE_SET_REG32(ia, 0xd4)
1596     CASE_SET_REG32(sbc, 0xd8)
1597     CASE_SET_REG32(csbc, 0xdc)
1598     default:
1599         if (offset >= 0x5c && offset < 0xa0) {
1600             int n;
1601             int shift;
1602             n = (offset - 0x58) >> 2;
1603             shift = (offset & 3) * 8;
1604             s->scratch[n] &= ~(0xff << shift);
1605             s->scratch[n] |= (val & 0xff) << shift;
1606         } else {
1607             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1608         }
1609     }
1610 #undef CASE_SET_REG32
1611 }
1612
1613 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1614 {
1615     LSIState *s = (LSIState *)opaque;
1616
1617     lsi_reg_writeb(s, addr & 0xff, val);
1618 }
1619
1620 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1621 {
1622     LSIState *s = (LSIState *)opaque;
1623
1624     addr &= 0xff;
1625     lsi_reg_writeb(s, addr, val & 0xff);
1626     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1627 }
1628
1629 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1630 {
1631     LSIState *s = (LSIState *)opaque;
1632
1633     addr &= 0xff;
1634     lsi_reg_writeb(s, addr, val & 0xff);
1635     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1636     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1637     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1638 }
1639
1640 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1641 {
1642     LSIState *s = (LSIState *)opaque;
1643
1644     return lsi_reg_readb(s, addr & 0xff);
1645 }
1646
1647 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1648 {
1649     LSIState *s = (LSIState *)opaque;
1650     uint32_t val;
1651
1652     addr &= 0xff;
1653     val = lsi_reg_readb(s, addr);
1654     val |= lsi_reg_readb(s, addr + 1) << 8;
1655     return val;
1656 }
1657
1658 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1659 {
1660     LSIState *s = (LSIState *)opaque;
1661     uint32_t val;
1662     addr &= 0xff;
1663     val = lsi_reg_readb(s, addr);
1664     val |= lsi_reg_readb(s, addr + 1) << 8;
1665     val |= lsi_reg_readb(s, addr + 2) << 16;
1666     val |= lsi_reg_readb(s, addr + 3) << 24;
1667     return val;
1668 }
1669
1670 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1671     lsi_mmio_readb,
1672     lsi_mmio_readw,
1673     lsi_mmio_readl,
1674 };
1675
1676 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1677     lsi_mmio_writeb,
1678     lsi_mmio_writew,
1679     lsi_mmio_writel,
1680 };
1681
1682 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1683 {
1684     LSIState *s = (LSIState *)opaque;
1685     uint32_t newval;
1686     int shift;
1687
1688     addr &= 0x1fff;
1689     newval = s->script_ram[addr >> 2];
1690     shift = (addr & 3) * 8;
1691     newval &= ~(0xff << shift);
1692     newval |= val << shift;
1693     s->script_ram[addr >> 2] = newval;
1694 }
1695
1696 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1697 {
1698     LSIState *s = (LSIState *)opaque;
1699     uint32_t newval;
1700
1701     addr &= 0x1fff;
1702     newval = s->script_ram[addr >> 2];
1703     if (addr & 2) {
1704         newval = (newval & 0xffff) | (val << 16);
1705     } else {
1706         newval = (newval & 0xffff0000) | val;
1707     }
1708     s->script_ram[addr >> 2] = newval;
1709 }
1710
1711
1712 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1713 {
1714     LSIState *s = (LSIState *)opaque;
1715
1716     addr &= 0x1fff;
1717     s->script_ram[addr >> 2] = val;
1718 }
1719
1720 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1721 {
1722     LSIState *s = (LSIState *)opaque;
1723     uint32_t val;
1724
1725     addr &= 0x1fff;
1726     val = s->script_ram[addr >> 2];
1727     val >>= (addr & 3) * 8;
1728     return val & 0xff;
1729 }
1730
1731 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1732 {
1733     LSIState *s = (LSIState *)opaque;
1734     uint32_t val;
1735
1736     addr &= 0x1fff;
1737     val = s->script_ram[addr >> 2];
1738     if (addr & 2)
1739         val >>= 16;
1740     return le16_to_cpu(val);
1741 }
1742
1743 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1744 {
1745     LSIState *s = (LSIState *)opaque;
1746
1747     addr &= 0x1fff;
1748     return le32_to_cpu(s->script_ram[addr >> 2]);
1749 }
1750
1751 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1752     lsi_ram_readb,
1753     lsi_ram_readw,
1754     lsi_ram_readl,
1755 };
1756
1757 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1758     lsi_ram_writeb,
1759     lsi_ram_writew,
1760     lsi_ram_writel,
1761 };
1762
1763 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1764 {
1765     LSIState *s = (LSIState *)opaque;
1766     return lsi_reg_readb(s, addr & 0xff);
1767 }
1768
1769 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1770 {
1771     LSIState *s = (LSIState *)opaque;
1772     uint32_t val;
1773     addr &= 0xff;
1774     val = lsi_reg_readb(s, addr);
1775     val |= lsi_reg_readb(s, addr + 1) << 8;
1776     return val;
1777 }
1778
1779 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1780 {
1781     LSIState *s = (LSIState *)opaque;
1782     uint32_t val;
1783     addr &= 0xff;
1784     val = lsi_reg_readb(s, addr);
1785     val |= lsi_reg_readb(s, addr + 1) << 8;
1786     val |= lsi_reg_readb(s, addr + 2) << 16;
1787     val |= lsi_reg_readb(s, addr + 3) << 24;
1788     return val;
1789 }
1790
1791 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1792 {
1793     LSIState *s = (LSIState *)opaque;
1794     lsi_reg_writeb(s, addr & 0xff, val);
1795 }
1796
1797 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1798 {
1799     LSIState *s = (LSIState *)opaque;
1800     addr &= 0xff;
1801     lsi_reg_writeb(s, addr, val & 0xff);
1802     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1803 }
1804
1805 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1806 {
1807     LSIState *s = (LSIState *)opaque;
1808     addr &= 0xff;
1809     lsi_reg_writeb(s, addr, val & 0xff);
1810     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1811     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1812     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1813 }
1814
1815 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1816                            uint32_t addr, uint32_t size, int type)
1817 {
1818     LSIState *s = (LSIState *)pci_dev;
1819
1820     DPRINTF("Mapping IO at %08x\n", addr);
1821
1822     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1823     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1824     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1825     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1826     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1827     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1828 }
1829
1830 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1831                             uint32_t addr, uint32_t size, int type)
1832 {
1833     LSIState *s = (LSIState *)pci_dev;
1834
1835     DPRINTF("Mapping ram at %08x\n", addr);
1836     s->script_ram_base = addr;
1837     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1838 }
1839
1840 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1841                              uint32_t addr, uint32_t size, int type)
1842 {
1843     LSIState *s = (LSIState *)pci_dev;
1844
1845     DPRINTF("Mapping registers at %08x\n", addr);
1846     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1847 }
1848
1849 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1850 {
1851     LSIState *s = (LSIState *)opaque;
1852
1853     if (id < 0) {
1854         for (id = 0; id < LSI_MAX_DEVS; id++) {
1855             if (s->scsi_dev[id] == NULL)
1856                 break;
1857         }
1858     }
1859     if (id >= LSI_MAX_DEVS) {
1860         BADF("Bad Device ID %d\n", id);
1861         return;
1862     }
1863     if (s->scsi_dev[id]) {
1864         DPRINTF("Destroying device %d\n", id);
1865         s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1866     }
1867     DPRINTF("Attaching block device %d\n", id);
1868     s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1869     if (s->scsi_dev[id] == NULL)
1870         s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1871     bd->devfn = s->pci_dev.devfn;
1872 }
1873
1874 int lsi_scsi_uninit(PCIDevice *d)
1875 {
1876     LSIState *s = (LSIState *) d;
1877
1878     cpu_unregister_io_memory(s->mmio_io_addr);
1879     cpu_unregister_io_memory(s->ram_io_addr);
1880
1881     qemu_free(s->queue);
1882
1883     return 0;
1884 }
1885
1886 void *lsi_scsi_init(PCIBus *bus, int devfn)
1887 {
1888     LSIState *s;
1889
1890     s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1891                                         sizeof(*s), devfn, NULL, NULL);
1892     if (s == NULL) {
1893         fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1894         return NULL;
1895     }
1896
1897     /* PCI Vendor ID (word) */
1898     s->pci_dev.config[0x00] = 0x00;
1899     s->pci_dev.config[0x01] = 0x10;
1900     /* PCI device ID (word) */
1901     s->pci_dev.config[0x02] = 0x12;
1902     s->pci_dev.config[0x03] = 0x00;
1903     /* PCI base class code */
1904     s->pci_dev.config[0x0b] = 0x01;
1905     /* PCI subsystem ID */
1906     s->pci_dev.config[0x2e] = 0x00;
1907     s->pci_dev.config[0x2f] = 0x10;
1908     /* PCI latency timer = 255 */
1909     s->pci_dev.config[0x0d] = 0xff;
1910     /* Interrupt pin 1 */
1911     s->pci_dev.config[0x3d] = 0x01;
1912
1913     s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1914                                              lsi_mmio_writefn, s);
1915     s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1916                                             lsi_ram_writefn, s);
1917
1918     pci_register_io_region((struct PCIDevice *)s, 0, 256,
1919                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1920     pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1921                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
1922     pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
1923                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
1924     s->queue = qemu_malloc(sizeof(lsi_queue));
1925     s->queue_len = 1;
1926     s->active_commands = 0;
1927     s->pci_dev.unregister = lsi_scsi_uninit;
1928
1929     lsi_soft_reset(s);
1930
1931     return s;
1932 }
1933