hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include "hw.h"
  14 #include "pci.h"
  15 #include "scsi-disk.h"
  16 #include "block_int.h"
  17
  18 //#define DEBUG_LSI
  19 //#define DEBUG_LSI_REG
  20
  21 #ifdef DEBUG_LSI
  22 #define DPRINTF(fmt, args...) \
  23 do { printf("lsi_scsi: " fmt , ##args); } while (0)
  24 #define BADF(fmt, args...) \
  25 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
  26 #else
  27 #define DPRINTF(fmt, args...) do {} while(0)
  28 #define BADF(fmt, args...) \
  29 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
  30 #endif
  31
  32 #define LSI_SCNTL0_TRG    0x01
  33 #define LSI_SCNTL0_AAP    0x02
  34 #define LSI_SCNTL0_EPC    0x08
  35 #define LSI_SCNTL0_WATN   0x10
  36 #define LSI_SCNTL0_START  0x20
  37
  38 #define LSI_SCNTL1_SST    0x01
  39 #define LSI_SCNTL1_IARB   0x02
  40 #define LSI_SCNTL1_AESP   0x04
  41 #define LSI_SCNTL1_RST    0x08
  42 #define LSI_SCNTL1_CON    0x10
  43 #define LSI_SCNTL1_DHP    0x20
  44 #define LSI_SCNTL1_ADB    0x40
  45 #define LSI_SCNTL1_EXC    0x80
  46
  47 #define LSI_SCNTL2_WSR    0x01
  48 #define LSI_SCNTL2_VUE0   0x02
  49 #define LSI_SCNTL2_VUE1   0x04
  50 #define LSI_SCNTL2_WSS    0x08
  51 #define LSI_SCNTL2_SLPHBEN 0x10
  52 #define LSI_SCNTL2_SLPMD  0x20
  53 #define LSI_SCNTL2_CHM    0x40
  54 #define LSI_SCNTL2_SDU    0x80
  55
  56 #define LSI_ISTAT0_DIP    0x01
  57 #define LSI_ISTAT0_SIP    0x02
  58 #define LSI_ISTAT0_INTF   0x04
  59 #define LSI_ISTAT0_CON    0x08
  60 #define LSI_ISTAT0_SEM    0x10
  61 #define LSI_ISTAT0_SIGP   0x20
  62 #define LSI_ISTAT0_SRST   0x40
  63 #define LSI_ISTAT0_ABRT   0x80
  64
  65 #define LSI_ISTAT1_SI     0x01
  66 #define LSI_ISTAT1_SRUN   0x02
  67 #define LSI_ISTAT1_FLSH   0x04
  68
  69 #define LSI_SSTAT0_SDP0   0x01
  70 #define LSI_SSTAT0_RST    0x02
  71 #define LSI_SSTAT0_WOA    0x04
  72 #define LSI_SSTAT0_LOA    0x08
  73 #define LSI_SSTAT0_AIP    0x10
  74 #define LSI_SSTAT0_OLF    0x20
  75 #define LSI_SSTAT0_ORF    0x40
  76 #define LSI_SSTAT0_ILF    0x80
  77
  78 #define LSI_SIST0_PAR     0x01
  79 #define LSI_SIST0_RST     0x02
  80 #define LSI_SIST0_UDC     0x04
  81 #define LSI_SIST0_SGE     0x08
  82 #define LSI_SIST0_RSL     0x10
  83 #define LSI_SIST0_SEL     0x20
  84 #define LSI_SIST0_CMP     0x40
  85 #define LSI_SIST0_MA      0x80
  86
  87 #define LSI_SIST1_HTH     0x01
  88 #define LSI_SIST1_GEN     0x02
  89 #define LSI_SIST1_STO     0x04
  90 #define LSI_SIST1_SBMC    0x10
  91
  92 #define LSI_SOCL_IO       0x01
  93 #define LSI_SOCL_CD       0x02
  94 #define LSI_SOCL_MSG      0x04
  95 #define LSI_SOCL_ATN      0x08
  96 #define LSI_SOCL_SEL      0x10
  97 #define LSI_SOCL_BSY      0x20
  98 #define LSI_SOCL_ACK      0x40
  99 #define LSI_SOCL_REQ      0x80
 100
 101 #define LSI_DSTAT_IID     0x01
 102 #define LSI_DSTAT_SIR     0x04
 103 #define LSI_DSTAT_SSI     0x08
 104 #define LSI_DSTAT_ABRT    0x10
 105 #define LSI_DSTAT_BF      0x20
 106 #define LSI_DSTAT_MDPE    0x40
 107 #define LSI_DSTAT_DFE     0x80
 108
 109 #define LSI_DCNTL_COM     0x01
 110 #define LSI_DCNTL_IRQD    0x02
 111 #define LSI_DCNTL_STD     0x04
 112 #define LSI_DCNTL_IRQM    0x08
 113 #define LSI_DCNTL_SSM     0x10
 114 #define LSI_DCNTL_PFEN    0x20
 115 #define LSI_DCNTL_PFF     0x40
 116 #define LSI_DCNTL_CLSE    0x80
 117
 118 #define LSI_DMODE_MAN     0x01
 119 #define LSI_DMODE_BOF     0x02
 120 #define LSI_DMODE_ERMP    0x04
 121 #define LSI_DMODE_ERL     0x08
 122 #define LSI_DMODE_DIOM    0x10
 123 #define LSI_DMODE_SIOM    0x20
 124
 125 #define LSI_CTEST2_DACK   0x01
 126 #define LSI_CTEST2_DREQ   0x02
 127 #define LSI_CTEST2_TEOP   0x04
 128 #define LSI_CTEST2_PCICIE 0x08
 129 #define LSI_CTEST2_CM     0x10
 130 #define LSI_CTEST2_CIO    0x20
 131 #define LSI_CTEST2_SIGP   0x40
 132 #define LSI_CTEST2_DDIR   0x80
 133
 134 #define LSI_CTEST5_BL2    0x04
 135 #define LSI_CTEST5_DDIR   0x08
 136 #define LSI_CTEST5_MASR   0x10
 137 #define LSI_CTEST5_DFSN   0x20
 138 #define LSI_CTEST5_BBCK   0x40
 139 #define LSI_CTEST5_ADCK   0x80
 140
 141 #define LSI_CCNTL0_DILS   0x01
 142 #define LSI_CCNTL0_DISFC  0x10
 143 #define LSI_CCNTL0_ENNDJ  0x20
 144 #define LSI_CCNTL0_PMJCTL 0x40
 145 #define LSI_CCNTL0_ENPMJ  0x80
 146
 147 #define LSI_CCNTL1_EN64DBMV  0x01
 148 #define LSI_CCNTL1_EN64TIBMV 0x02
 149 #define LSI_CCNTL1_64TIMOD   0x04
 150 #define LSI_CCNTL1_DDAC      0x08
 151 #define LSI_CCNTL1_ZMOD      0x80
 152
 153 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 154
 155 #define PHASE_DO          0
 156 #define PHASE_DI          1
 157 #define PHASE_CMD         2
 158 #define PHASE_ST          3
 159 #define PHASE_MO          6
 160 #define PHASE_MI          7
 161 #define PHASE_MASK        7
 162
 163 /* Maximum length of MSG IN data.  */
 164 #define LSI_MAX_MSGIN_LEN 8
 165
 166 /* Flag set if this is a tagged command.  */
 167 #define LSI_TAG_VALID     (1 << 16)
 168
 169 typedef struct {
 170     uint32_t tag;
 171     uint32_t pending;
 172     int out;
 173 } lsi_queue;
 174
 175 typedef struct {
 176     PCIDevice pci_dev;
 177     int mmio_io_addr;
 178     int ram_io_addr;
 179     uint32_t script_ram_base;
 180
 181     int carry; /* ??? Should this be an a visible register somewhere?  */
 182     int sense;
 183     /* Action to take at the end of a MSG IN phase.
 184        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 185     int msg_action;
 186     int msg_len;
 187     uint8_t msg[LSI_MAX_MSGIN_LEN];
 188     /* 0 if SCRIPTS are running or stopped.
 189      * 1 if a Wait Reselect instruction has been issued.
 190      * 2 if processing DMA from lsi_execute_script.
 191      * 3 if a DMA operation is in progress.  */
 192     int waiting;
 193     SCSIDevice *scsi_dev[LSI_MAX_DEVS];
 194     SCSIDevice *current_dev;
 195     int current_lun;
 196     /* The tag is a combination of the device ID and the SCSI tag.  */
 197     uint32_t current_tag;
 198     uint32_t current_dma_len;
 199     int command_complete;
 200     uint8_t *dma_buf;
 201     lsi_queue *queue;
 202     int queue_len;
 203     int active_commands;
 204
 205     uint32_t dsa;
 206     uint32_t temp;
 207     uint32_t dnad;
 208     uint32_t dbc;
 209     uint8_t istat0;
 210     uint8_t istat1;
 211     uint8_t dcmd;
 212     uint8_t dstat;
 213     uint8_t dien;
 214     uint8_t sist0;
 215     uint8_t sist1;
 216     uint8_t sien0;
 217     uint8_t sien1;
 218     uint8_t mbox0;
 219     uint8_t mbox1;
 220     uint8_t dfifo;
 221     uint8_t ctest2;
 222     uint8_t ctest3;
 223     uint8_t ctest4;
 224     uint8_t ctest5;
 225     uint8_t ccntl0;
 226     uint8_t ccntl1;
 227     uint32_t dsp;
 228     uint32_t dsps;
 229     uint8_t dmode;
 230     uint8_t dcntl;
 231     uint8_t scntl0;
 232     uint8_t scntl1;
 233     uint8_t scntl2;
 234     uint8_t scntl3;
 235     uint8_t sstat0;
 236     uint8_t sstat1;
 237     uint8_t scid;
 238     uint8_t sxfer;
 239     uint8_t socl;
 240     uint8_t sdid;
 241     uint8_t ssid;
 242     uint8_t sfbr;
 243     uint8_t stest1;
 244     uint8_t stest2;
 245     uint8_t stest3;
 246     uint8_t sidl;
 247     uint8_t stime0;
 248     uint8_t respid0;
 249     uint8_t respid1;
 250     uint32_t mmrs;
 251     uint32_t mmws;
 252     uint32_t sfs;
 253     uint32_t drs;
 254     uint32_t sbms;
 255     uint32_t dbms;
 256     uint32_t dnad64;
 257     uint32_t pmjad1;
 258     uint32_t pmjad2;
 259     uint32_t rbc;
 260     uint32_t ua;
 261     uint32_t ia;
 262     uint32_t sbc;
 263     uint32_t csbc;
 264     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 265     uint8_t sbr;
 266
 267     /* Script ram is stored as 32-bit words in host byteorder.  */
 268     uint32_t script_ram[2048];
 269 } LSIState;
 270
 271 static void lsi_soft_reset(LSIState *s)
 272 {
 273     DPRINTF("Reset\n");
 274     s->carry = 0;
 275
 276     s->waiting = 0;
 277     s->dsa = 0;
 278     s->dnad = 0;
 279     s->dbc = 0;
 280     s->temp = 0;
 281     memset(s->scratch, 0, sizeof(s->scratch));
 282     s->istat0 = 0;
 283     s->istat1 = 0;
 284     s->dcmd = 0;
 285     s->dstat = 0;
 286     s->dien = 0;
 287     s->sist0 = 0;
 288     s->sist1 = 0;
 289     s->sien0 = 0;
 290     s->sien1 = 0;
 291     s->mbox0 = 0;
 292     s->mbox1 = 0;
 293     s->dfifo = 0;
 294     s->ctest2 = 0;
 295     s->ctest3 = 0;
 296     s->ctest4 = 0;
 297     s->ctest5 = 0;
 298     s->ccntl0 = 0;
 299     s->ccntl1 = 0;
 300     s->dsp = 0;
 301     s->dsps = 0;
 302     s->dmode = 0;
 303     s->dcntl = 0;
 304     s->scntl0 = 0xc0;
 305     s->scntl1 = 0;
 306     s->scntl2 = 0;
 307     s->scntl3 = 0;
 308     s->sstat0 = 0;
 309     s->sstat1 = 0;
 310     s->scid = 7;
 311     s->sxfer = 0;
 312     s->socl = 0;
 313     s->stest1 = 0;
 314     s->stest2 = 0;
 315     s->stest3 = 0;
 316     s->sidl = 0;
 317     s->stime0 = 0;
 318     s->respid0 = 0x80;
 319     s->respid1 = 0;
 320     s->mmrs = 0;
 321     s->mmws = 0;
 322     s->sfs = 0;
 323     s->drs = 0;
 324     s->sbms = 0;
 325     s->dbms = 0;
 326     s->dnad64 = 0;
 327     s->pmjad1 = 0;
 328     s->pmjad2 = 0;
 329     s->rbc = 0;
 330     s->ua = 0;
 331     s->ia = 0;
 332     s->sbc = 0;
 333     s->csbc = 0;
 334     s->sbr = 0;
 335 }
 336
 337 static int lsi_dma_40bit(LSIState *s)
 338 {
 339     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 340         return 1;
 341     return 0;
 342 }
 343
 344 static int lsi_dma_ti64bit(LSIState *s)
 345 {
 346     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 347         return 1;
 348     return 0;
 349 }
 350
 351 static int lsi_dma_64bit(LSIState *s)
 352 {
 353     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 354         return 1;
 355     return 0;
 356 }
 357
 358 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 359 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 360 static void lsi_execute_script(LSIState *s);
 361
 362 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 363 {
 364     uint32_t buf;
 365
 366     /* Optimize reading from SCRIPTS RAM.  */
 367     if ((addr & 0xffffe000) == s->script_ram_base) {
 368         return s->script_ram[(addr & 0x1fff) >> 2];
 369     }
 370     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 371     return cpu_to_le32(buf);
 372 }
 373
 374 static void lsi_stop_script(LSIState *s)
 375 {
 376     s->istat1 &= ~LSI_ISTAT1_SRUN;
 377 }
 378
 379 static void lsi_update_irq(LSIState *s)
 380 {
 381     int level;
 382     static int last_level;
 383
 384     /* It's unclear whether the DIP/SIP bits should be cleared when the
 385        Interrupt Status Registers are cleared or when istat0 is read.
 386        We currently do the formwer, which seems to work.  */
 387     level = 0;
 388     if (s->dstat) {
 389         if (s->dstat & s->dien)
 390             level = 1;
 391         s->istat0 |= LSI_ISTAT0_DIP;
 392     } else {
 393         s->istat0 &= ~LSI_ISTAT0_DIP;
 394     }
 395
 396     if (s->sist0 || s->sist1) {
 397         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 398             level = 1;
 399         s->istat0 |= LSI_ISTAT0_SIP;
 400     } else {
 401         s->istat0 &= ~LSI_ISTAT0_SIP;
 402     }
 403     if (s->istat0 & LSI_ISTAT0_INTF)
 404         level = 1;
 405
 406     if (level != last_level) {
 407         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 408                 level, s->dstat, s->sist1, s->sist0);
 409         last_level = level;
 410     }
 411     qemu_set_irq(s->pci_dev.irq[0], level);
 412 }
 413
 414 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 415 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 416 {
 417     uint32_t mask0;
 418     uint32_t mask1;
 419
 420     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 421             stat1, stat0, s->sist1, s->sist0);
 422     s->sist0 |= stat0;
 423     s->sist1 |= stat1;
 424     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 425        we don't stop processing when raising STO.  Instead continue
 426        execution and stop at the next insn that accesses the SCSI bus.  */
 427     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 428     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 429     mask1 &= ~LSI_SIST1_STO;
 430     if (s->sist0 & mask0 || s->sist1 & mask1) {
 431         lsi_stop_script(s);
 432     }
 433     lsi_update_irq(s);
 434 }
 435
 436 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 437 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 438 {
 439     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 440     s->dstat |= stat;
 441     lsi_update_irq(s);
 442     lsi_stop_script(s);
 443 }
 444
 445 static inline void lsi_set_phase(LSIState *s, int phase)
 446 {
 447     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 448 }
 449
 450 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 451 {
 452     /* Trigger a phase mismatch.  */
 453     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 454         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 455             s->dsp = s->pmjad1;
 456         } else {
 457             s->dsp = s->pmjad2;
 458         }
 459         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 460     } else {
 461         DPRINTF("Phase mismatch interrupt\n");
 462         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 463         lsi_stop_script(s);
 464     }
 465     lsi_set_phase(s, new_phase);
 466 }
 467
 468
 469 /* Resume SCRIPTS execution after a DMA operation.  */
 470 static void lsi_resume_script(LSIState *s)
 471 {
 472     if (s->waiting != 2) {
 473         s->waiting = 0;
 474         lsi_execute_script(s);
 475     } else {
 476         s->waiting = 0;
 477     }
 478 }
 479
 480 /* Initiate a SCSI layer data transfer.  */
 481 static void lsi_do_dma(LSIState *s, int out)
 482 {
 483     uint32_t count;
 484     target_phys_addr_t addr;
 485
 486     if (!s->current_dma_len) {
 487         /* Wait until data is available.  */
 488         DPRINTF("DMA no data available\n");
 489         return;
 490     }
 491
 492     count = s->dbc;
 493     if (count > s->current_dma_len)
 494         count = s->current_dma_len;
 495
 496     addr = s->dnad;
 497     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 498     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 499         addr |= ((uint64_t)s->dnad64 << 32);
 500     else if (s->dbms)
 501         addr |= ((uint64_t)s->dbms << 32);
 502     else if (s->sbms)
 503         addr |= ((uint64_t)s->sbms << 32);
 504
 505     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 506     s->csbc += count;
 507     s->dnad += count;
 508     s->dbc -= count;
 509
 510     if (s->dma_buf == NULL) {
 511         s->dma_buf = s->current_dev->get_buf(s->current_dev,
 512                                              s->current_tag);
 513     }
 514
 515     /* ??? Set SFBR to first data byte.  */
 516     if (out) {
 517         cpu_physical_memory_read(addr, s->dma_buf, count);
 518     } else {
 519         cpu_physical_memory_write(addr, s->dma_buf, count);
 520     }
 521     s->current_dma_len -= count;
 522     if (s->current_dma_len == 0) {
 523         s->dma_buf = NULL;
 524         if (out) {
 525             /* Write the data.  */
 526             s->current_dev->write_data(s->current_dev, s->current_tag);
 527         } else {
 528             /* Request any remaining data.  */
 529             s->current_dev->read_data(s->current_dev, s->current_tag);
 530         }
 531     } else {
 532         s->dma_buf += count;
 533         lsi_resume_script(s);
 534     }
 535 }
 536
 537
 538 /* Add a command to the queue.  */
 539 static void lsi_queue_command(LSIState *s)
 540 {
 541     lsi_queue *p;
 542
 543     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 544     if (s->queue_len == s->active_commands) {
 545         s->queue_len++;
 546         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 547     }
 548     p = &s->queue[s->active_commands++];
 549     p->tag = s->current_tag;
 550     p->pending = 0;
 551     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 552 }
 553
 554 /* Queue a byte for a MSG IN phase.  */
 555 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 556 {
 557     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 558         BADF("MSG IN data too long\n");
 559     } else {
 560         DPRINTF("MSG IN 0x%02x\n", data);
 561         s->msg[s->msg_len++] = data;
 562     }
 563 }
 564
 565 /* Perform reselection to continue a command.  */
 566 static void lsi_reselect(LSIState *s, uint32_t tag)
 567 {
 568     lsi_queue *p;
 569     int n;
 570     int id;
 571
 572     p = NULL;
 573     for (n = 0; n < s->active_commands; n++) {
 574         p = &s->queue[n];
 575         if (p->tag == tag)
 576             break;
 577     }
 578     if (n == s->active_commands) {
 579         BADF("Reselected non-existant command tag=0x%x\n", tag);
 580         return;
 581     }
 582     id = (tag >> 8) & 0xf;
 583     s->ssid = id | 0x80;
 584     DPRINTF("Reselected target %d\n", id);
 585     s->current_dev = s->scsi_dev[id];
 586     s->current_tag = tag;
 587     s->scntl1 |= LSI_SCNTL1_CON;
 588     lsi_set_phase(s, PHASE_MI);
 589     s->msg_action = p->out ? 2 : 3;
 590     s->current_dma_len = p->pending;
 591     s->dma_buf = NULL;
 592     lsi_add_msg_byte(s, 0x80);
 593     if (s->current_tag & LSI_TAG_VALID) {
 594         lsi_add_msg_byte(s, 0x20);
 595         lsi_add_msg_byte(s, tag & 0xff);
 596     }
 597
 598     s->active_commands--;
 599     if (n != s->active_commands) {
 600         s->queue[n] = s->queue[s->active_commands];
 601     }
 602 }
 603
 604 /* Record that data is available for a queued command.  Returns zero if
 605    the device was reselected, nonzero if the IO is deferred.  */
 606 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 607 {
 608     lsi_queue *p;
 609     int i;
 610     for (i = 0; i < s->active_commands; i++) {
 611         p = &s->queue[i];
 612         if (p->tag == tag) {
 613             if (p->pending) {
 614                 BADF("Multiple IO pending for tag %d\n", tag);
 615             }
 616             p->pending = arg;
 617             if (s->waiting == 1) {
 618                 /* Reselect device.  */
 619                 lsi_reselect(s, tag);
 620                 return 0;
 621             } else {
 622                DPRINTF("Queueing IO tag=0x%x\n", tag);
 623                 p->pending = arg;
 624                 return 1;
 625             }
 626         }
 627     }
 628     BADF("IO with unknown tag %d\n", tag);
 629     return 1;
 630 }
 631
 632 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 633 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
 634                                  uint32_t arg)
 635 {
 636     LSIState *s = (LSIState *)opaque;
 637     int out;
 638
 639     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 640     if (reason == SCSI_REASON_DONE) {
 641         DPRINTF("Command complete sense=%d\n", (int)arg);
 642         s->sense = arg;
 643         s->command_complete = 2;
 644         if (s->waiting && s->dbc != 0) {
 645             /* Raise phase mismatch for short transfers.  */
 646             lsi_bad_phase(s, out, PHASE_ST);
 647         } else {
 648             lsi_set_phase(s, PHASE_ST);
 649         }
 650         lsi_resume_script(s);
 651         return;
 652     }
 653
 654     if (s->waiting == 1 || tag != s->current_tag) {
 655         if (lsi_queue_tag(s, tag, arg))
 656             return;
 657     }
 658     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 659     s->current_dma_len = arg;
 660     s->command_complete = 1;
 661     if (!s->waiting)
 662         return;
 663     if (s->waiting == 1 || s->dbc == 0) {
 664         lsi_resume_script(s);
 665     } else {
 666         lsi_do_dma(s, out);
 667     }
 668 }
 669
 670 static void lsi_do_command(LSIState *s)
 671 {
 672     uint8_t buf[16];
 673     int n;
 674
 675     DPRINTF("Send command len=%d\n", s->dbc);
 676     if (s->dbc > 16)
 677         s->dbc = 16;
 678     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 679     s->sfbr = buf[0];
 680     s->command_complete = 0;
 681     n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
 682                                      s->current_lun);
 683     if (n > 0) {
 684         lsi_set_phase(s, PHASE_DI);
 685         s->current_dev->read_data(s->current_dev, s->current_tag);
 686     } else if (n < 0) {
 687         lsi_set_phase(s, PHASE_DO);
 688         s->current_dev->write_data(s->current_dev, s->current_tag);
 689     }
 690
 691     if (!s->command_complete) {
 692         if (n) {
 693             /* Command did not complete immediately so disconnect.  */
 694             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 695             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 696             /* wait data */
 697             lsi_set_phase(s, PHASE_MI);
 698             s->msg_action = 1;
 699             lsi_queue_command(s);
 700         } else {
 701             /* wait command complete */
 702             lsi_set_phase(s, PHASE_DI);
 703         }
 704     }
 705 }
 706
 707 static void lsi_do_status(LSIState *s)
 708 {
 709     uint8_t sense;
 710     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 711     if (s->dbc != 1)
 712         BADF("Bad Status move\n");
 713     s->dbc = 1;
 714     sense = s->sense;
 715     s->sfbr = sense;
 716     cpu_physical_memory_write(s->dnad, &sense, 1);
 717     lsi_set_phase(s, PHASE_MI);
 718     s->msg_action = 1;
 719     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 720 }
 721
 722 static void lsi_disconnect(LSIState *s)
 723 {
 724     s->scntl1 &= ~LSI_SCNTL1_CON;
 725     s->sstat1 &= ~PHASE_MASK;
 726 }
 727
 728 static void lsi_do_msgin(LSIState *s)
 729 {
 730     int len;
 731     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 732     s->sfbr = s->msg[0];
 733     len = s->msg_len;
 734     if (len > s->dbc)
 735         len = s->dbc;
 736     cpu_physical_memory_write(s->dnad, s->msg, len);
 737     /* Linux drivers rely on the last byte being in the SIDL.  */
 738     s->sidl = s->msg[len - 1];
 739     s->msg_len -= len;
 740     if (s->msg_len) {
 741         memmove(s->msg, s->msg + len, s->msg_len);
 742     } else {
 743         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 744            switch to PHASE_MO.  */
 745         switch (s->msg_action) {
 746         case 0:
 747             lsi_set_phase(s, PHASE_CMD);
 748             break;
 749         case 1:
 750             lsi_disconnect(s);
 751             break;
 752         case 2:
 753             lsi_set_phase(s, PHASE_DO);
 754             break;
 755         case 3:
 756             lsi_set_phase(s, PHASE_DI);
 757             break;
 758         default:
 759             abort();
 760         }
 761     }
 762 }
 763
 764 /* Read the next byte during a MSGOUT phase.  */
 765 static uint8_t lsi_get_msgbyte(LSIState *s)
 766 {
 767     uint8_t data;
 768     cpu_physical_memory_read(s->dnad, &data, 1);
 769     s->dnad++;
 770     s->dbc--;
 771     return data;
 772 }
 773
 774 static void lsi_do_msgout(LSIState *s)
 775 {
 776     uint8_t msg;
 777     int len;
 778
 779     DPRINTF("MSG out len=%d\n", s->dbc);
 780     while (s->dbc) {
 781         msg = lsi_get_msgbyte(s);
 782         s->sfbr = msg;
 783
 784         switch (msg) {
 785         case 0x00:
 786             DPRINTF("MSG: Disconnect\n");
 787             lsi_disconnect(s);
 788             break;
 789         case 0x08:
 790             DPRINTF("MSG: No Operation\n");
 791             lsi_set_phase(s, PHASE_CMD);
 792             break;
 793         case 0x01:
 794             len = lsi_get_msgbyte(s);
 795             msg = lsi_get_msgbyte(s);
 796             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 797             switch (msg) {
 798             case 1:
 799                 DPRINTF("SDTR (ignored)\n");
 800                 s->dbc -= 2;
 801                 break;
 802             case 3:
 803                 DPRINTF("WDTR (ignored)\n");
 804                 s->dbc -= 1;
 805                 break;
 806             default:
 807                 goto bad;
 808             }
 809             break;
 810         case 0x20: /* SIMPLE queue */
 811             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 812             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 813             break;
 814         case 0x21: /* HEAD of queue */
 815             BADF("HEAD queue not implemented\n");
 816             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 817             break;
 818         case 0x22: /* ORDERED queue */
 819             BADF("ORDERED queue not implemented\n");
 820             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 821             break;
 822         default:
 823             if ((msg & 0x80) == 0) {
 824                 goto bad;
 825             }
 826             s->current_lun = msg & 7;
 827             DPRINTF("Select LUN %d\n", s->current_lun);
 828             lsi_set_phase(s, PHASE_CMD);
 829             break;
 830         }
 831     }
 832     return;
 833 bad:
 834     BADF("Unimplemented message 0x%02x\n", msg);
 835     lsi_set_phase(s, PHASE_MI);
 836     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 837     s->msg_action = 0;
 838 }
 839
 840 /* Sign extend a 24-bit value.  */
 841 static inline int32_t sxt24(int32_t n)
 842 {
 843     return (n << 8) >> 8;
 844 }
 845
 846 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 847 {
 848     int n;
 849     uint8_t buf[TARGET_PAGE_SIZE];
 850
 851     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 852     while (count) {
 853         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
 854         cpu_physical_memory_read(src, buf, n);
 855         cpu_physical_memory_write(dest, buf, n);
 856         src += n;
 857         dest += n;
 858         count -= n;
 859     }
 860 }
 861
 862 static void lsi_wait_reselect(LSIState *s)
 863 {
 864     int i;
 865     DPRINTF("Wait Reselect\n");
 866     if (s->current_dma_len)
 867         BADF("Reselect with pending DMA\n");
 868     for (i = 0; i < s->active_commands; i++) {
 869         if (s->queue[i].pending) {
 870             lsi_reselect(s, s->queue[i].tag);
 871             break;
 872         }
 873     }
 874     if (s->current_dma_len == 0) {
 875         s->waiting = 1;
 876     }
 877 }
 878
 879 static void lsi_execute_script(LSIState *s)
 880 {
 881     uint32_t insn;
 882     uint32_t addr, addr_high;
 883     int opcode;
 884     int insn_processed = 0;
 885
 886     s->istat1 |= LSI_ISTAT1_SRUN;
 887 again:
 888     insn_processed++;
 889     insn = read_dword(s, s->dsp);
 890     if (!insn) {
 891         /* If we receive an empty opcode increment the DSP by 4 bytes
 892            instead of 8 and execute the next opcode at that location */
 893         s->dsp += 4;
 894         goto again;
 895     }
 896     addr = read_dword(s, s->dsp + 4);
 897     addr_high = 0;
 898     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 899     s->dsps = addr;
 900     s->dcmd = insn >> 24;
 901     s->dsp += 8;
 902     switch (insn >> 30) {
 903     case 0: /* Block move.  */
 904         if (s->sist1 & LSI_SIST1_STO) {
 905             DPRINTF("Delayed select timeout\n");
 906             lsi_stop_script(s);
 907             break;
 908         }
 909         s->dbc = insn & 0xffffff;
 910         s->rbc = s->dbc;
 911         /* ??? Set ESA.  */
 912         s->ia = s->dsp - 8;
 913         if (insn & (1 << 29)) {
 914             /* Indirect addressing.  */
 915             addr = read_dword(s, addr);
 916         } else if (insn & (1 << 28)) {
 917             uint32_t buf[2];
 918             int32_t offset;
 919             /* Table indirect addressing.  */
 920
 921             /* 32-bit Table indirect */
 922             offset = sxt24(addr);
 923             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 924             /* byte count is stored in bits 0:23 only */
 925             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 926             s->rbc = s->dbc;
 927             addr = cpu_to_le32(buf[1]);
 928
 929             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 930              * table, bits [31:24] */
 931             if (lsi_dma_40bit(s))
 932                 addr_high = cpu_to_le32(buf[0]) >> 24;
 933             else if (lsi_dma_ti64bit(s)) {
 934                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
 935                 switch (selector) {
 936                 case 0 ... 0x0f:
 937                     /* offset index into scratch registers since
 938                      * TI64 mode can use registers C to R */
 939                     addr_high = s->scratch[2 + selector];
 940                     break;
 941                 case 0x10:
 942                     addr_high = s->mmrs;
 943                     break;
 944                 case 0x11:
 945                     addr_high = s->mmws;
 946                     break;
 947                 case 0x12:
 948                     addr_high = s->sfs;
 949                     break;
 950                 case 0x13:
 951                     addr_high = s->drs;
 952                     break;
 953                 case 0x14:
 954                     addr_high = s->sbms;
 955                     break;
 956                 case 0x15:
 957                     addr_high = s->dbms;
 958                     break;
 959                 default:
 960                     BADF("Illegal selector specified (0x%x > 0x15)"
 961                          " for 64-bit DMA block move", selector);
 962                     break;
 963                 }
 964             }
 965         } else if (lsi_dma_64bit(s)) {
 966             /* fetch a 3rd dword if 64-bit direct move is enabled and
 967                only if we're not doing table indirect or indirect addressing */
 968             s->dbms = read_dword(s, s->dsp);
 969             s->dsp += 4;
 970             s->ia = s->dsp - 12;
 971         }
 972         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 973             DPRINTF("Wrong phase got %d expected %d\n",
 974                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 975             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 976             break;
 977         }
 978         s->dnad = addr;
 979         s->dnad64 = addr_high;
 980         switch (s->sstat1 & 0x7) {
 981         case PHASE_DO:
 982             s->waiting = 2;
 983             lsi_do_dma(s, 1);
 984             if (s->waiting)
 985                 s->waiting = 3;
 986             break;
 987         case PHASE_DI:
 988             s->waiting = 2;
 989             lsi_do_dma(s, 0);
 990             if (s->waiting)
 991                 s->waiting = 3;
 992             break;
 993         case PHASE_CMD:
 994             lsi_do_command(s);
 995             break;
 996         case PHASE_ST:
 997             lsi_do_status(s);
 998             break;
 999         case PHASE_MO:
1000             lsi_do_msgout(s);
1001             break;
1002         case PHASE_MI:
1003             lsi_do_msgin(s);
1004             break;
1005         default:
1006             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1007             exit(1);
1008         }
1009         s->dfifo = s->dbc & 0xff;
1010         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1011         s->sbc = s->dbc;
1012         s->rbc -= s->dbc;
1013         s->ua = addr + s->dbc;
1014         break;
1015
1016     case 1: /* IO or Read/Write instruction.  */
1017         opcode = (insn >> 27) & 7;
1018         if (opcode < 5) {
1019             uint32_t id;
1020
1021             if (insn & (1 << 25)) {
1022                 id = read_dword(s, s->dsa + sxt24(insn));
1023             } else {
1024                 id = addr;
1025             }
1026             id = (id >> 16) & 0xf;
1027             if (insn & (1 << 26)) {
1028                 addr = s->dsp + sxt24(addr);
1029             }
1030             s->dnad = addr;
1031             switch (opcode) {
1032             case 0: /* Select */
1033                 s->sdid = id;
1034                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1035                     DPRINTF("Already reselected by target %d\n", id);
1036                     break;
1037                 }
1038                 s->sstat0 |= LSI_SSTAT0_WOA;
1039                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1040                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
1041                     DPRINTF("Selected absent target %d\n", id);
1042                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1043                     lsi_disconnect(s);
1044                     break;
1045                 }
1046                 DPRINTF("Selected target %d%s\n",
1047                         id, insn & (1 << 3) ? " ATN" : "");
1048                 /* ??? Linux drivers compain when this is set.  Maybe
1049                    it only applies in low-level mode (unimplemented).
1050                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1051                 s->current_dev = s->scsi_dev[id];
1052                 s->current_tag = id << 8;
1053                 s->scntl1 |= LSI_SCNTL1_CON;
1054                 if (insn & (1 << 3)) {
1055                     s->socl |= LSI_SOCL_ATN;
1056                 }
1057                 lsi_set_phase(s, PHASE_MO);
1058                 break;
1059             case 1: /* Disconnect */
1060                 DPRINTF("Wait Disconect\n");
1061                 s->scntl1 &= ~LSI_SCNTL1_CON;
1062                 break;
1063             case 2: /* Wait Reselect */
1064                 lsi_wait_reselect(s);
1065                 break;
1066             case 3: /* Set */
1067                 DPRINTF("Set%s%s%s%s\n",
1068                         insn & (1 << 3) ? " ATN" : "",
1069                         insn & (1 << 6) ? " ACK" : "",
1070                         insn & (1 << 9) ? " TM" : "",
1071                         insn & (1 << 10) ? " CC" : "");
1072                 if (insn & (1 << 3)) {
1073                     s->socl |= LSI_SOCL_ATN;
1074                     lsi_set_phase(s, PHASE_MO);
1075                 }
1076                 if (insn & (1 << 9)) {
1077                     BADF("Target mode not implemented\n");
1078                     exit(1);
1079                 }
1080                 if (insn & (1 << 10))
1081                     s->carry = 1;
1082                 break;
1083             case 4: /* Clear */
1084                 DPRINTF("Clear%s%s%s%s\n",
1085                         insn & (1 << 3) ? " ATN" : "",
1086                         insn & (1 << 6) ? " ACK" : "",
1087                         insn & (1 << 9) ? " TM" : "",
1088                         insn & (1 << 10) ? " CC" : "");
1089                 if (insn & (1 << 3)) {
1090                     s->socl &= ~LSI_SOCL_ATN;
1091                 }
1092                 if (insn & (1 << 10))
1093                     s->carry = 0;
1094                 break;
1095             }
1096         } else {
1097             uint8_t op0;
1098             uint8_t op1;
1099             uint8_t data8;
1100             int reg;
1101             int operator;
1102 #ifdef DEBUG_LSI
1103             static const char *opcode_names[3] =
1104                 {"Write", "Read", "Read-Modify-Write"};
1105             static const char *operator_names[8] =
1106                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1107 #endif
1108
1109             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1110             data8 = (insn >> 8) & 0xff;
1111             opcode = (insn >> 27) & 7;
1112             operator = (insn >> 24) & 7;
1113             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1114                     opcode_names[opcode - 5], reg,
1115                     operator_names[operator], data8, s->sfbr,
1116                     (insn & (1 << 23)) ? " SFBR" : "");
1117             op0 = op1 = 0;
1118             switch (opcode) {
1119             case 5: /* From SFBR */
1120                 op0 = s->sfbr;
1121                 op1 = data8;
1122                 break;
1123             case 6: /* To SFBR */
1124                 if (operator)
1125                     op0 = lsi_reg_readb(s, reg);
1126                 op1 = data8;
1127                 break;
1128             case 7: /* Read-modify-write */
1129                 if (operator)
1130                     op0 = lsi_reg_readb(s, reg);
1131                 if (insn & (1 << 23)) {
1132                     op1 = s->sfbr;
1133                 } else {
1134                     op1 = data8;
1135                 }
1136                 break;
1137             }
1138
1139             switch (operator) {
1140             case 0: /* move */
1141                 op0 = op1;
1142                 break;
1143             case 1: /* Shift left */
1144                 op1 = op0 >> 7;
1145                 op0 = (op0 << 1) | s->carry;
1146                 s->carry = op1;
1147                 break;
1148             case 2: /* OR */
1149                 op0 |= op1;
1150                 break;
1151             case 3: /* XOR */
1152                 op0 ^= op1;
1153                 break;
1154             case 4: /* AND */
1155                 op0 &= op1;
1156                 break;
1157             case 5: /* SHR */
1158                 op1 = op0 & 1;
1159                 op0 = (op0 >> 1) | (s->carry << 7);
1160                 s->carry = op1;
1161                 break;
1162             case 6: /* ADD */
1163                 op0 += op1;
1164                 s->carry = op0 < op1;
1165                 break;
1166             case 7: /* ADC */
1167                 op0 += op1 + s->carry;
1168                 if (s->carry)
1169                     s->carry = op0 <= op1;
1170                 else
1171                     s->carry = op0 < op1;
1172                 break;
1173             }
1174
1175             switch (opcode) {
1176             case 5: /* From SFBR */
1177             case 7: /* Read-modify-write */
1178                 lsi_reg_writeb(s, reg, op0);
1179                 break;
1180             case 6: /* To SFBR */
1181                 s->sfbr = op0;
1182                 break;
1183             }
1184         }
1185         break;
1186
1187     case 2: /* Transfer Control.  */
1188         {
1189             int cond;
1190             int jmp;
1191
1192             if ((insn & 0x002e0000) == 0) {
1193                 DPRINTF("NOP\n");
1194                 break;
1195             }
1196             if (s->sist1 & LSI_SIST1_STO) {
1197                 DPRINTF("Delayed select timeout\n");
1198                 lsi_stop_script(s);
1199                 break;
1200             }
1201             cond = jmp = (insn & (1 << 19)) != 0;
1202             if (cond == jmp && (insn & (1 << 21))) {
1203                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1204                 cond = s->carry != 0;
1205             }
1206             if (cond == jmp && (insn & (1 << 17))) {
1207                 DPRINTF("Compare phase %d %c= %d\n",
1208                         (s->sstat1 & PHASE_MASK),
1209                         jmp ? '=' : '!',
1210                         ((insn >> 24) & 7));
1211                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1212             }
1213             if (cond == jmp && (insn & (1 << 18))) {
1214                 uint8_t mask;
1215
1216                 mask = (~insn >> 8) & 0xff;
1217                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1218                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1219                 cond = (s->sfbr & mask) == (insn & mask);
1220             }
1221             if (cond == jmp) {
1222                 if (insn & (1 << 23)) {
1223                     /* Relative address.  */
1224                     addr = s->dsp + sxt24(addr);
1225                 }
1226                 switch ((insn >> 27) & 7) {
1227                 case 0: /* Jump */
1228                     DPRINTF("Jump to 0x%08x\n", addr);
1229                     s->dsp = addr;
1230                     break;
1231                 case 1: /* Call */
1232                     DPRINTF("Call 0x%08x\n", addr);
1233                     s->temp = s->dsp;
1234                     s->dsp = addr;
1235                     break;
1236                 case 2: /* Return */
1237                     DPRINTF("Return to 0x%08x\n", s->temp);
1238                     s->dsp = s->temp;
1239                     break;
1240                 case 3: /* Interrupt */
1241                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1242                     if ((insn & (1 << 20)) != 0) {
1243                         s->istat0 |= LSI_ISTAT0_INTF;
1244                         lsi_update_irq(s);
1245                     } else {
1246                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1247                     }
1248                     break;
1249                 default:
1250                     DPRINTF("Illegal transfer control\n");
1251                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1252                     break;
1253                 }
1254             } else {
1255                 DPRINTF("Control condition failed\n");
1256             }
1257         }
1258         break;
1259
1260     case 3:
1261         if ((insn & (1 << 29)) == 0) {
1262             /* Memory move.  */
1263             uint32_t dest;
1264             /* ??? The docs imply the destination address is loaded into
1265                the TEMP register.  However the Linux drivers rely on
1266                the value being presrved.  */
1267             dest = read_dword(s, s->dsp);
1268             s->dsp += 4;
1269             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1270         } else {
1271             uint8_t data[7];
1272             int reg;
1273             int n;
1274             int i;
1275
1276             if (insn & (1 << 28)) {
1277                 addr = s->dsa + sxt24(addr);
1278             }
1279             n = (insn & 7);
1280             reg = (insn >> 16) & 0xff;
1281             if (insn & (1 << 24)) {
1282                 cpu_physical_memory_read(addr, data, n);
1283                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1284                         addr, *(int *)data);
1285                 for (i = 0; i < n; i++) {
1286                     lsi_reg_writeb(s, reg + i, data[i]);
1287                 }
1288             } else {
1289                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1290                 for (i = 0; i < n; i++) {
1291                     data[i] = lsi_reg_readb(s, reg + i);
1292                 }
1293                 cpu_physical_memory_write(addr, data, n);
1294             }
1295         }
1296     }
1297     if (insn_processed > 10000 && !s->waiting) {
1298         /* Some windows drivers make the device spin waiting for a memory
1299            location to change.  If we have been executed a lot of code then
1300            assume this is the case and force an unexpected device disconnect.
1301            This is apparently sufficient to beat the drivers into submission.
1302          */
1303         if (!(s->sien0 & LSI_SIST0_UDC))
1304             fprintf(stderr, "inf. loop with UDC masked\n");
1305         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1306         lsi_disconnect(s);
1307     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1308         if (s->dcntl & LSI_DCNTL_SSM) {
1309             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1310         } else {
1311             goto again;
1312         }
1313     }
1314     DPRINTF("SCRIPTS execution stopped\n");
1315 }
1316
1317 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1318 {
1319     uint8_t tmp;
1320 #define CASE_GET_REG24(name, addr) \
1321     case addr: return s->name & 0xff; \
1322     case addr + 1: return (s->name >> 8) & 0xff; \
1323     case addr + 2: return (s->name >> 16) & 0xff;
1324
1325 #define CASE_GET_REG32(name, addr) \
1326     case addr: return s->name & 0xff; \
1327     case addr + 1: return (s->name >> 8) & 0xff; \
1328     case addr + 2: return (s->name >> 16) & 0xff; \
1329     case addr + 3: return (s->name >> 24) & 0xff;
1330
1331 #ifdef DEBUG_LSI_REG
1332     DPRINTF("Read reg %x\n", offset);
1333 #endif
1334     switch (offset) {
1335     case 0x00: /* SCNTL0 */
1336         return s->scntl0;
1337     case 0x01: /* SCNTL1 */
1338         return s->scntl1;
1339     case 0x02: /* SCNTL2 */
1340         return s->scntl2;
1341     case 0x03: /* SCNTL3 */
1342         return s->scntl3;
1343     case 0x04: /* SCID */
1344         return s->scid;
1345     case 0x05: /* SXFER */
1346         return s->sxfer;
1347     case 0x06: /* SDID */
1348         return s->sdid;
1349     case 0x07: /* GPREG0 */
1350         return 0x7f;
1351     case 0x08: /* Revision ID */
1352         return 0x00;
1353     case 0xa: /* SSID */
1354         return s->ssid;
1355     case 0xb: /* SBCL */
1356         /* ??? This is not correct. However it's (hopefully) only
1357            used for diagnostics, so should be ok.  */
1358         return 0;
1359     case 0xc: /* DSTAT */
1360         tmp = s->dstat | 0x80;
1361         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1362             s->dstat = 0;
1363         lsi_update_irq(s);
1364         return tmp;
1365     case 0x0d: /* SSTAT0 */
1366         return s->sstat0;
1367     case 0x0e: /* SSTAT1 */
1368         return s->sstat1;
1369     case 0x0f: /* SSTAT2 */
1370         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1371     CASE_GET_REG32(dsa, 0x10)
1372     case 0x14: /* ISTAT0 */
1373         return s->istat0;
1374     case 0x15: /* ISTAT1 */
1375         return s->istat1;
1376     case 0x16: /* MBOX0 */
1377         return s->mbox0;
1378     case 0x17: /* MBOX1 */
1379         return s->mbox1;
1380     case 0x18: /* CTEST0 */
1381         return 0xff;
1382     case 0x19: /* CTEST1 */
1383         return 0;
1384     case 0x1a: /* CTEST2 */
1385         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1386         if (s->istat0 & LSI_ISTAT0_SIGP) {
1387             s->istat0 &= ~LSI_ISTAT0_SIGP;
1388             tmp |= LSI_CTEST2_SIGP;
1389         }
1390         return tmp;
1391     case 0x1b: /* CTEST3 */
1392         return s->ctest3;
1393     CASE_GET_REG32(temp, 0x1c)
1394     case 0x20: /* DFIFO */
1395         return 0;
1396     case 0x21: /* CTEST4 */
1397         return s->ctest4;
1398     case 0x22: /* CTEST5 */
1399         return s->ctest5;
1400     case 0x23: /* CTEST6 */
1401          return 0;
1402     CASE_GET_REG24(dbc, 0x24)
1403     case 0x27: /* DCMD */
1404         return s->dcmd;
1405     CASE_GET_REG32(dnad, 0x28)
1406     CASE_GET_REG32(dsp, 0x2c)
1407     CASE_GET_REG32(dsps, 0x30)
1408     CASE_GET_REG32(scratch[0], 0x34)
1409     case 0x38: /* DMODE */
1410         return s->dmode;
1411     case 0x39: /* DIEN */
1412         return s->dien;
1413     case 0x3a: /* SBR */
1414         return s->sbr;
1415     case 0x3b: /* DCNTL */
1416         return s->dcntl;
1417     case 0x40: /* SIEN0 */
1418         return s->sien0;
1419     case 0x41: /* SIEN1 */
1420         return s->sien1;
1421     case 0x42: /* SIST0 */
1422         tmp = s->sist0;
1423         s->sist0 = 0;
1424         lsi_update_irq(s);
1425         return tmp;
1426     case 0x43: /* SIST1 */
1427         tmp = s->sist1;
1428         s->sist1 = 0;
1429         lsi_update_irq(s);
1430         return tmp;
1431     case 0x46: /* MACNTL */
1432         return 0x0f;
1433     case 0x47: /* GPCNTL0 */
1434         return 0x0f;
1435     case 0x48: /* STIME0 */
1436         return s->stime0;
1437     case 0x4a: /* RESPID0 */
1438         return s->respid0;
1439     case 0x4b: /* RESPID1 */
1440         return s->respid1;
1441     case 0x4d: /* STEST1 */
1442         return s->stest1;
1443     case 0x4e: /* STEST2 */
1444         return s->stest2;
1445     case 0x4f: /* STEST3 */
1446         return s->stest3;
1447     case 0x50: /* SIDL */
1448         /* This is needed by the linux drivers.  We currently only update it
1449            during the MSG IN phase.  */
1450         return s->sidl;
1451     case 0x52: /* STEST4 */
1452         return 0xe0;
1453     case 0x56: /* CCNTL0 */
1454         return s->ccntl0;
1455     case 0x57: /* CCNTL1 */
1456         return s->ccntl1;
1457     case 0x58: /* SBDL */
1458         /* Some drivers peek at the data bus during the MSG IN phase.  */
1459         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1460             return s->msg[0];
1461         return 0;
1462     case 0x59: /* SBDL high */
1463         return 0;
1464     CASE_GET_REG32(mmrs, 0xa0)
1465     CASE_GET_REG32(mmws, 0xa4)
1466     CASE_GET_REG32(sfs, 0xa8)
1467     CASE_GET_REG32(drs, 0xac)
1468     CASE_GET_REG32(sbms, 0xb0)
1469     CASE_GET_REG32(dbms, 0xb4)
1470     CASE_GET_REG32(dnad64, 0xb8)
1471     CASE_GET_REG32(pmjad1, 0xc0)
1472     CASE_GET_REG32(pmjad2, 0xc4)
1473     CASE_GET_REG32(rbc, 0xc8)
1474     CASE_GET_REG32(ua, 0xcc)
1475     CASE_GET_REG32(ia, 0xd4)
1476     CASE_GET_REG32(sbc, 0xd8)
1477     CASE_GET_REG32(csbc, 0xdc)
1478     }
1479     if (offset >= 0x5c && offset < 0xa0) {
1480         int n;
1481         int shift;
1482         n = (offset - 0x58) >> 2;
1483         shift = (offset & 3) * 8;
1484         return (s->scratch[n] >> shift) & 0xff;
1485     }
1486     BADF("readb 0x%x\n", offset);
1487     exit(1);
1488 #undef CASE_GET_REG24
1489 #undef CASE_GET_REG32
1490 }
1491
1492 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1493 {
1494 #define CASE_SET_REG24(name, addr) \
1495     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1496     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1497     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1498
1499 #define CASE_SET_REG32(name, addr) \
1500     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1501     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1502     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1503     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1504
1505 #ifdef DEBUG_LSI_REG
1506     DPRINTF("Write reg %x = %02x\n", offset, val);
1507 #endif
1508     switch (offset) {
1509     case 0x00: /* SCNTL0 */
1510         s->scntl0 = val;
1511         if (val & LSI_SCNTL0_START) {
1512             BADF("Start sequence not implemented\n");
1513         }
1514         break;
1515     case 0x01: /* SCNTL1 */
1516         s->scntl1 = val & ~LSI_SCNTL1_SST;
1517         if (val & LSI_SCNTL1_IARB) {
1518             BADF("Immediate Arbritration not implemented\n");
1519         }
1520         if (val & LSI_SCNTL1_RST) {
1521             s->sstat0 |= LSI_SSTAT0_RST;
1522             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1523         } else {
1524             s->sstat0 &= ~LSI_SSTAT0_RST;
1525         }
1526         break;
1527     case 0x02: /* SCNTL2 */
1528         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1529         s->scntl2 = val;
1530         break;
1531     case 0x03: /* SCNTL3 */
1532         s->scntl3 = val;
1533         break;
1534     case 0x04: /* SCID */
1535         s->scid = val;
1536         break;
1537     case 0x05: /* SXFER */
1538         s->sxfer = val;
1539         break;
1540     case 0x06: /* SDID */
1541         if ((val & 0xf) != (s->ssid & 0xf))
1542             BADF("Destination ID does not match SSID\n");
1543         s->sdid = val & 0xf;
1544         break;
1545     case 0x07: /* GPREG0 */
1546         break;
1547     case 0x08: /* SFBR */
1548         /* The CPU is not allowed to write to this register.  However the
1549            SCRIPTS register move instructions are.  */
1550         s->sfbr = val;
1551         break;
1552     case 0x0a: case 0x0b:
1553         /* Openserver writes to these readonly registers on startup */
1554         return;
1555     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1556         /* Linux writes to these readonly registers on startup.  */
1557         return;
1558     CASE_SET_REG32(dsa, 0x10)
1559     case 0x14: /* ISTAT0 */
1560         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1561         if (val & LSI_ISTAT0_ABRT) {
1562             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1563         }
1564         if (val & LSI_ISTAT0_INTF) {
1565             s->istat0 &= ~LSI_ISTAT0_INTF;
1566             lsi_update_irq(s);
1567         }
1568         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1569             DPRINTF("Woken by SIGP\n");
1570             s->waiting = 0;
1571             s->dsp = s->dnad;
1572             lsi_execute_script(s);
1573         }
1574         if (val & LSI_ISTAT0_SRST) {
1575             lsi_soft_reset(s);
1576         }
1577         break;
1578     case 0x16: /* MBOX0 */
1579         s->mbox0 = val;
1580         break;
1581     case 0x17: /* MBOX1 */
1582         s->mbox1 = val;
1583         break;
1584     case 0x1a: /* CTEST2 */
1585         s->ctest2 = val & LSI_CTEST2_PCICIE;
1586         break;
1587     case 0x1b: /* CTEST3 */
1588         s->ctest3 = val & 0x0f;
1589         break;
1590     CASE_SET_REG32(temp, 0x1c)
1591     case 0x21: /* CTEST4 */
1592         if (val & 7) {
1593            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1594         }
1595         s->ctest4 = val;
1596         break;
1597     case 0x22: /* CTEST5 */
1598         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1599             BADF("CTEST5 DMA increment not implemented\n");
1600         }
1601         s->ctest5 = val;
1602         break;
1603     CASE_SET_REG24(dbc, 0x24)
1604     CASE_SET_REG32(dnad, 0x28)
1605     case 0x2c: /* DSP[0:7] */
1606         s->dsp &= 0xffffff00;
1607         s->dsp |= val;
1608         break;
1609     case 0x2d: /* DSP[8:15] */
1610         s->dsp &= 0xffff00ff;
1611         s->dsp |= val << 8;
1612         break;
1613     case 0x2e: /* DSP[16:23] */
1614         s->dsp &= 0xff00ffff;
1615         s->dsp |= val << 16;
1616         break;
1617     case 0x2f: /* DSP[24:31] */
1618         s->dsp &= 0x00ffffff;
1619         s->dsp |= val << 24;
1620         if ((s->dmode & LSI_DMODE_MAN) == 0
1621             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1622             lsi_execute_script(s);
1623         break;
1624     CASE_SET_REG32(dsps, 0x30)
1625     CASE_SET_REG32(scratch[0], 0x34)
1626     case 0x38: /* DMODE */
1627         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1628             BADF("IO mappings not implemented\n");
1629         }
1630         s->dmode = val;
1631         break;
1632     case 0x39: /* DIEN */
1633         s->dien = val;
1634         lsi_update_irq(s);
1635         break;
1636     case 0x3a: /* SBR */
1637         s->sbr = val;
1638         break;
1639     case 0x3b: /* DCNTL */
1640         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1641         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1642             lsi_execute_script(s);
1643         break;
1644     case 0x40: /* SIEN0 */
1645         s->sien0 = val;
1646         lsi_update_irq(s);
1647         break;
1648     case 0x41: /* SIEN1 */
1649         s->sien1 = val;
1650         lsi_update_irq(s);
1651         break;
1652     case 0x47: /* GPCNTL0 */
1653         break;
1654     case 0x48: /* STIME0 */
1655         s->stime0 = val;
1656         break;
1657     case 0x49: /* STIME1 */
1658         if (val & 0xf) {
1659             DPRINTF("General purpose timer not implemented\n");
1660             /* ??? Raising the interrupt immediately seems to be sufficient
1661                to keep the FreeBSD driver happy.  */
1662             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1663         }
1664         break;
1665     case 0x4a: /* RESPID0 */
1666         s->respid0 = val;
1667         break;
1668     case 0x4b: /* RESPID1 */
1669         s->respid1 = val;
1670         break;
1671     case 0x4d: /* STEST1 */
1672         s->stest1 = val;
1673         break;
1674     case 0x4e: /* STEST2 */
1675         if (val & 1) {
1676             BADF("Low level mode not implemented\n");
1677         }
1678         s->stest2 = val;
1679         break;
1680     case 0x4f: /* STEST3 */
1681         if (val & 0x41) {
1682             BADF("SCSI FIFO test mode not implemented\n");
1683         }
1684         s->stest3 = val;
1685         break;
1686     case 0x56: /* CCNTL0 */
1687         s->ccntl0 = val;
1688         break;
1689     case 0x57: /* CCNTL1 */
1690         s->ccntl1 = val;
1691         break;
1692     CASE_SET_REG32(mmrs, 0xa0)
1693     CASE_SET_REG32(mmws, 0xa4)
1694     CASE_SET_REG32(sfs, 0xa8)
1695     CASE_SET_REG32(drs, 0xac)
1696     CASE_SET_REG32(sbms, 0xb0)
1697     CASE_SET_REG32(dbms, 0xb4)
1698     CASE_SET_REG32(dnad64, 0xb8)
1699     CASE_SET_REG32(pmjad1, 0xc0)
1700     CASE_SET_REG32(pmjad2, 0xc4)
1701     CASE_SET_REG32(rbc, 0xc8)
1702     CASE_SET_REG32(ua, 0xcc)
1703     CASE_SET_REG32(ia, 0xd4)
1704     CASE_SET_REG32(sbc, 0xd8)
1705     CASE_SET_REG32(csbc, 0xdc)
1706     default:
1707         if (offset >= 0x5c && offset < 0xa0) {
1708             int n;
1709             int shift;
1710             n = (offset - 0x58) >> 2;
1711             shift = (offset & 3) * 8;
1712             s->scratch[n] &= ~(0xff << shift);
1713             s->scratch[n] |= (val & 0xff) << shift;
1714         } else {
1715             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1716         }
1717     }
1718 #undef CASE_SET_REG24
1719 #undef CASE_SET_REG32
1720 }
1721
1722 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1723 {
1724     LSIState *s = (LSIState *)opaque;
1725
1726     lsi_reg_writeb(s, addr & 0xff, val);
1727 }
1728
1729 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1730 {
1731     LSIState *s = (LSIState *)opaque;
1732
1733     addr &= 0xff;
1734     lsi_reg_writeb(s, addr, val & 0xff);
1735     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1736 }
1737
1738 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1739 {
1740     LSIState *s = (LSIState *)opaque;
1741
1742     addr &= 0xff;
1743     lsi_reg_writeb(s, addr, val & 0xff);
1744     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1745     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1746     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1747 }
1748
1749 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1750 {
1751     LSIState *s = (LSIState *)opaque;
1752
1753     return lsi_reg_readb(s, addr & 0xff);
1754 }
1755
1756 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1757 {
1758     LSIState *s = (LSIState *)opaque;
1759     uint32_t val;
1760
1761     addr &= 0xff;
1762     val = lsi_reg_readb(s, addr);
1763     val |= lsi_reg_readb(s, addr + 1) << 8;
1764     return val;
1765 }
1766
1767 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1768 {
1769     LSIState *s = (LSIState *)opaque;
1770     uint32_t val;
1771     addr &= 0xff;
1772     val = lsi_reg_readb(s, addr);
1773     val |= lsi_reg_readb(s, addr + 1) << 8;
1774     val |= lsi_reg_readb(s, addr + 2) << 16;
1775     val |= lsi_reg_readb(s, addr + 3) << 24;
1776     return val;
1777 }
1778
1779 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1780     lsi_mmio_readb,
1781     lsi_mmio_readw,
1782     lsi_mmio_readl,
1783 };
1784
1785 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1786     lsi_mmio_writeb,
1787     lsi_mmio_writew,
1788     lsi_mmio_writel,
1789 };
1790
1791 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1792 {
1793     LSIState *s = (LSIState *)opaque;
1794     uint32_t newval;
1795     int shift;
1796
1797     addr &= 0x1fff;
1798     newval = s->script_ram[addr >> 2];
1799     shift = (addr & 3) * 8;
1800     newval &= ~(0xff << shift);
1801     newval |= val << shift;
1802     s->script_ram[addr >> 2] = newval;
1803 }
1804
1805 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1806 {
1807     LSIState *s = (LSIState *)opaque;
1808     uint32_t newval;
1809
1810     addr &= 0x1fff;
1811     newval = s->script_ram[addr >> 2];
1812     if (addr & 2) {
1813         newval = (newval & 0xffff) | (val << 16);
1814     } else {
1815         newval = (newval & 0xffff0000) | val;
1816     }
1817     s->script_ram[addr >> 2] = newval;
1818 }
1819
1820
1821 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1822 {
1823     LSIState *s = (LSIState *)opaque;
1824
1825     addr &= 0x1fff;
1826     s->script_ram[addr >> 2] = val;
1827 }
1828
1829 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1830 {
1831     LSIState *s = (LSIState *)opaque;
1832     uint32_t val;
1833
1834     addr &= 0x1fff;
1835     val = s->script_ram[addr >> 2];
1836     val >>= (addr & 3) * 8;
1837     return val & 0xff;
1838 }
1839
1840 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1841 {
1842     LSIState *s = (LSIState *)opaque;
1843     uint32_t val;
1844
1845     addr &= 0x1fff;
1846     val = s->script_ram[addr >> 2];
1847     if (addr & 2)
1848         val >>= 16;
1849     return le16_to_cpu(val);
1850 }
1851
1852 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1853 {
1854     LSIState *s = (LSIState *)opaque;
1855
1856     addr &= 0x1fff;
1857     return le32_to_cpu(s->script_ram[addr >> 2]);
1858 }
1859
1860 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1861     lsi_ram_readb,
1862     lsi_ram_readw,
1863     lsi_ram_readl,
1864 };
1865
1866 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1867     lsi_ram_writeb,
1868     lsi_ram_writew,
1869     lsi_ram_writel,
1870 };
1871
1872 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1873 {
1874     LSIState *s = (LSIState *)opaque;
1875     return lsi_reg_readb(s, addr & 0xff);
1876 }
1877
1878 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1879 {
1880     LSIState *s = (LSIState *)opaque;
1881     uint32_t val;
1882     addr &= 0xff;
1883     val = lsi_reg_readb(s, addr);
1884     val |= lsi_reg_readb(s, addr + 1) << 8;
1885     return val;
1886 }
1887
1888 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1889 {
1890     LSIState *s = (LSIState *)opaque;
1891     uint32_t val;
1892     addr &= 0xff;
1893     val = lsi_reg_readb(s, addr);
1894     val |= lsi_reg_readb(s, addr + 1) << 8;
1895     val |= lsi_reg_readb(s, addr + 2) << 16;
1896     val |= lsi_reg_readb(s, addr + 3) << 24;
1897     return val;
1898 }
1899
1900 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1901 {
1902     LSIState *s = (LSIState *)opaque;
1903     lsi_reg_writeb(s, addr & 0xff, val);
1904 }
1905
1906 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1907 {
1908     LSIState *s = (LSIState *)opaque;
1909     addr &= 0xff;
1910     lsi_reg_writeb(s, addr, val & 0xff);
1911     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1912 }
1913
1914 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1915 {
1916     LSIState *s = (LSIState *)opaque;
1917     addr &= 0xff;
1918     lsi_reg_writeb(s, addr, val & 0xff);
1919     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1920     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1921     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1922 }
1923
1924 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1925                            uint32_t addr, uint32_t size, int type)
1926 {
1927     LSIState *s = (LSIState *)pci_dev;
1928
1929     DPRINTF("Mapping IO at %08x\n", addr);
1930
1931     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1932     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1933     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1934     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1935     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1936     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1937 }
1938
1939 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1940                             uint32_t addr, uint32_t size, int type)
1941 {
1942     LSIState *s = (LSIState *)pci_dev;
1943
1944     DPRINTF("Mapping ram at %08x\n", addr);
1945     s->script_ram_base = addr;
1946     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1947 }
1948
1949 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1950                              uint32_t addr, uint32_t size, int type)
1951 {
1952     LSIState *s = (LSIState *)pci_dev;
1953
1954     DPRINTF("Mapping registers at %08x\n", addr);
1955     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1956 }
1957
1958 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1959 {
1960     LSIState *s = (LSIState *)opaque;
1961
1962     if (id < 0) {
1963         for (id = 0; id < LSI_MAX_DEVS; id++) {
1964             if (s->scsi_dev[id] == NULL)
1965                 break;
1966         }
1967     }
1968     if (id >= LSI_MAX_DEVS) {
1969         BADF("Bad Device ID %d\n", id);
1970         return;
1971     }
1972     if (s->scsi_dev[id]) {
1973         DPRINTF("Destroying device %d\n", id);
1974         s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1975     }
1976     DPRINTF("Attaching block device %d\n", id);
1977     s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1978     if (s->scsi_dev[id] == NULL)
1979         s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1980     bd->private = &s->pci_dev;
1981 }
1982
1983 static int lsi_scsi_uninit(PCIDevice *d)
1984 {
1985     LSIState *s = (LSIState *) d;
1986
1987     cpu_unregister_io_memory(s->mmio_io_addr);
1988     cpu_unregister_io_memory(s->ram_io_addr);
1989
1990     qemu_free(s->queue);
1991
1992     return 0;
1993 }
1994
1995 void *lsi_scsi_init(PCIBus *bus, int devfn)
1996 {
1997     LSIState *s;
1998     uint8_t *pci_conf;
1999
2000     s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
2001                                         sizeof(*s), devfn, NULL, NULL);
2002     if (s == NULL) {
2003         fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
2004         return NULL;
2005     }
2006
2007     pci_conf = s->pci_dev.config;
2008
2009     /* PCI Vendor ID (word) */
2010     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2011     /* PCI device ID (word) */
2012     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2013     /* PCI base class code */
2014     pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2015     /* PCI subsystem ID */
2016     pci_conf[0x2e] = 0x00;
2017     pci_conf[0x2f] = 0x10;
2018     /* PCI latency timer = 255 */
2019     pci_conf[0x0d] = 0xff;
2020     /* Interrupt pin 1 */
2021     pci_conf[0x3d] = 0x01;
2022
2023     s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
2024                                              lsi_mmio_writefn, s);
2025     s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
2026                                             lsi_ram_writefn, s);
2027
2028     pci_register_io_region((struct PCIDevice *)s, 0, 256,
2029                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2030     pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
2031                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
2032     pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
2033                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
2034     s->queue = qemu_malloc(sizeof(lsi_queue));
2035     s->queue_len = 1;
2036     s->active_commands = 0;
2037     s->pci_dev.unregister = lsi_scsi_uninit;
2038
2039     lsi_soft_reset(s);
2040
2041     return s;
2042 }