hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include <assert.h>                             \
  14
  15 #include "hw.h"
  16 #include "pci.h"
  17 #include "scsi.h"
  18 #include "scsi-disk.h"
  19 #include "block_int.h"
  20
  21 //#define DEBUG_LSI
  22 //#define DEBUG_LSI_REG
  23
  24 #ifdef DEBUG_LSI
  25 #define DPRINTF(fmt, ...) \
  26 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
  27 #define BADF(fmt, ...) \
  28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
  29 #else
  30 #define DPRINTF(fmt, ...) do {} while(0)
  31 #define BADF(fmt, ...) \
  32 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
  33 #endif
  34
  35 #define LSI_SCNTL0_TRG    0x01
  36 #define LSI_SCNTL0_AAP    0x02
  37 #define LSI_SCNTL0_EPC    0x08
  38 #define LSI_SCNTL0_WATN   0x10
  39 #define LSI_SCNTL0_START  0x20
  40
  41 #define LSI_SCNTL1_SST    0x01
  42 #define LSI_SCNTL1_IARB   0x02
  43 #define LSI_SCNTL1_AESP   0x04
  44 #define LSI_SCNTL1_RST    0x08
  45 #define LSI_SCNTL1_CON    0x10
  46 #define LSI_SCNTL1_DHP    0x20
  47 #define LSI_SCNTL1_ADB    0x40
  48 #define LSI_SCNTL1_EXC    0x80
  49
  50 #define LSI_SCNTL2_WSR    0x01
  51 #define LSI_SCNTL2_VUE0   0x02
  52 #define LSI_SCNTL2_VUE1   0x04
  53 #define LSI_SCNTL2_WSS    0x08
  54 #define LSI_SCNTL2_SLPHBEN 0x10
  55 #define LSI_SCNTL2_SLPMD  0x20
  56 #define LSI_SCNTL2_CHM    0x40
  57 #define LSI_SCNTL2_SDU    0x80
  58
  59 #define LSI_ISTAT0_DIP    0x01
  60 #define LSI_ISTAT0_SIP    0x02
  61 #define LSI_ISTAT0_INTF   0x04
  62 #define LSI_ISTAT0_CON    0x08
  63 #define LSI_ISTAT0_SEM    0x10
  64 #define LSI_ISTAT0_SIGP   0x20
  65 #define LSI_ISTAT0_SRST   0x40
  66 #define LSI_ISTAT0_ABRT   0x80
  67
  68 #define LSI_ISTAT1_SI     0x01
  69 #define LSI_ISTAT1_SRUN   0x02
  70 #define LSI_ISTAT1_FLSH   0x04
  71
  72 #define LSI_SSTAT0_SDP0   0x01
  73 #define LSI_SSTAT0_RST    0x02
  74 #define LSI_SSTAT0_WOA    0x04
  75 #define LSI_SSTAT0_LOA    0x08
  76 #define LSI_SSTAT0_AIP    0x10
  77 #define LSI_SSTAT0_OLF    0x20
  78 #define LSI_SSTAT0_ORF    0x40
  79 #define LSI_SSTAT0_ILF    0x80
  80
  81 #define LSI_SIST0_PAR     0x01
  82 #define LSI_SIST0_RST     0x02
  83 #define LSI_SIST0_UDC     0x04
  84 #define LSI_SIST0_SGE     0x08
  85 #define LSI_SIST0_RSL     0x10
  86 #define LSI_SIST0_SEL     0x20
  87 #define LSI_SIST0_CMP     0x40
  88 #define LSI_SIST0_MA      0x80
  89
  90 #define LSI_SIST1_HTH     0x01
  91 #define LSI_SIST1_GEN     0x02
  92 #define LSI_SIST1_STO     0x04
  93 #define LSI_SIST1_SBMC    0x10
  94
  95 #define LSI_SOCL_IO       0x01
  96 #define LSI_SOCL_CD       0x02
  97 #define LSI_SOCL_MSG      0x04
  98 #define LSI_SOCL_ATN      0x08
  99 #define LSI_SOCL_SEL      0x10
 100 #define LSI_SOCL_BSY      0x20
 101 #define LSI_SOCL_ACK      0x40
 102 #define LSI_SOCL_REQ      0x80
 103
 104 #define LSI_DSTAT_IID     0x01
 105 #define LSI_DSTAT_SIR     0x04
 106 #define LSI_DSTAT_SSI     0x08
 107 #define LSI_DSTAT_ABRT    0x10
 108 #define LSI_DSTAT_BF      0x20
 109 #define LSI_DSTAT_MDPE    0x40
 110 #define LSI_DSTAT_DFE     0x80
 111
 112 #define LSI_DCNTL_COM     0x01
 113 #define LSI_DCNTL_IRQD    0x02
 114 #define LSI_DCNTL_STD     0x04
 115 #define LSI_DCNTL_IRQM    0x08
 116 #define LSI_DCNTL_SSM     0x10
 117 #define LSI_DCNTL_PFEN    0x20
 118 #define LSI_DCNTL_PFF     0x40
 119 #define LSI_DCNTL_CLSE    0x80
 120
 121 #define LSI_DMODE_MAN     0x01
 122 #define LSI_DMODE_BOF     0x02
 123 #define LSI_DMODE_ERMP    0x04
 124 #define LSI_DMODE_ERL     0x08
 125 #define LSI_DMODE_DIOM    0x10
 126 #define LSI_DMODE_SIOM    0x20
 127
 128 #define LSI_CTEST2_DACK   0x01
 129 #define LSI_CTEST2_DREQ   0x02
 130 #define LSI_CTEST2_TEOP   0x04
 131 #define LSI_CTEST2_PCICIE 0x08
 132 #define LSI_CTEST2_CM     0x10
 133 #define LSI_CTEST2_CIO    0x20
 134 #define LSI_CTEST2_SIGP   0x40
 135 #define LSI_CTEST2_DDIR   0x80
 136
 137 #define LSI_CTEST5_BL2    0x04
 138 #define LSI_CTEST5_DDIR   0x08
 139 #define LSI_CTEST5_MASR   0x10
 140 #define LSI_CTEST5_DFSN   0x20
 141 #define LSI_CTEST5_BBCK   0x40
 142 #define LSI_CTEST5_ADCK   0x80
 143
 144 #define LSI_CCNTL0_DILS   0x01
 145 #define LSI_CCNTL0_DISFC  0x10
 146 #define LSI_CCNTL0_ENNDJ  0x20
 147 #define LSI_CCNTL0_PMJCTL 0x40
 148 #define LSI_CCNTL0_ENPMJ  0x80
 149
 150 #define LSI_CCNTL1_EN64DBMV  0x01
 151 #define LSI_CCNTL1_EN64TIBMV 0x02
 152 #define LSI_CCNTL1_64TIMOD   0x04
 153 #define LSI_CCNTL1_DDAC      0x08
 154 #define LSI_CCNTL1_ZMOD      0x80
 155
 156 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 157
 158 #define PHASE_DO          0
 159 #define PHASE_DI          1
 160 #define PHASE_CMD         2
 161 #define PHASE_ST          3
 162 #define PHASE_MO          6
 163 #define PHASE_MI          7
 164 #define PHASE_MASK        7
 165
 166 /* Maximum length of MSG IN data.  */
 167 #define LSI_MAX_MSGIN_LEN 8
 168
 169 /* Flag set if this is a tagged command.  */
 170 #define LSI_TAG_VALID     (1 << 16)
 171
 172 typedef struct {
 173     uint32_t tag;
 174     uint32_t pending;
 175     int out;
 176 } lsi_queue;
 177
 178 typedef struct {
 179     PCIDevice dev;
 180     int mmio_io_addr;
 181     int ram_io_addr;
 182     uint32_t script_ram_base;
 183
 184     int carry; /* ??? Should this be an a visible register somewhere?  */
 185     int sense;
 186     /* Action to take at the end of a MSG IN phase.
 187        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 188     int msg_action;
 189     int msg_len;
 190     uint8_t msg[LSI_MAX_MSGIN_LEN];
 191     /* 0 if SCRIPTS are running or stopped.
 192      * 1 if a Wait Reselect instruction has been issued.
 193      * 2 if processing DMA from lsi_execute_script.
 194      * 3 if a DMA operation is in progress.  */
 195     int waiting;
 196     SCSIBus bus;
 197     SCSIDevice *current_dev;
 198     int current_lun;
 199     /* The tag is a combination of the device ID and the SCSI tag.  */
 200     uint32_t current_tag;
 201     uint32_t current_dma_len;
 202     int command_complete;
 203     uint8_t *dma_buf;
 204     lsi_queue *queue;
 205     int queue_len;
 206     int active_commands;
 207
 208     uint32_t dsa;
 209     uint32_t temp;
 210     uint32_t dnad;
 211     uint32_t dbc;
 212     uint8_t istat0;
 213     uint8_t istat1;
 214     uint8_t dcmd;
 215     uint8_t dstat;
 216     uint8_t dien;
 217     uint8_t sist0;
 218     uint8_t sist1;
 219     uint8_t sien0;
 220     uint8_t sien1;
 221     uint8_t mbox0;
 222     uint8_t mbox1;
 223     uint8_t dfifo;
 224     uint8_t ctest2;
 225     uint8_t ctest3;
 226     uint8_t ctest4;
 227     uint8_t ctest5;
 228     uint8_t ccntl0;
 229     uint8_t ccntl1;
 230     uint32_t dsp;
 231     uint32_t dsps;
 232     uint8_t dmode;
 233     uint8_t dcntl;
 234     uint8_t scntl0;
 235     uint8_t scntl1;
 236     uint8_t scntl2;
 237     uint8_t scntl3;
 238     uint8_t sstat0;
 239     uint8_t sstat1;
 240     uint8_t scid;
 241     uint8_t sxfer;
 242     uint8_t socl;
 243     uint8_t sdid;
 244     uint8_t ssid;
 245     uint8_t sfbr;
 246     uint8_t stest1;
 247     uint8_t stest2;
 248     uint8_t stest3;
 249     uint8_t sidl;
 250     uint8_t stime0;
 251     uint8_t respid0;
 252     uint8_t respid1;
 253     uint32_t mmrs;
 254     uint32_t mmws;
 255     uint32_t sfs;
 256     uint32_t drs;
 257     uint32_t sbms;
 258     uint32_t dbms;
 259     uint32_t dnad64;
 260     uint32_t pmjad1;
 261     uint32_t pmjad2;
 262     uint32_t rbc;
 263     uint32_t ua;
 264     uint32_t ia;
 265     uint32_t sbc;
 266     uint32_t csbc;
 267     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 268     uint8_t sbr;
 269
 270     /* Script ram is stored as 32-bit words in host byteorder.  */
 271     uint32_t script_ram[2048];
 272 } LSIState;
 273
 274 static void lsi_soft_reset(LSIState *s)
 275 {
 276     DPRINTF("Reset\n");
 277     s->carry = 0;
 278
 279     s->waiting = 0;
 280     s->dsa = 0;
 281     s->dnad = 0;
 282     s->dbc = 0;
 283     s->temp = 0;
 284     memset(s->scratch, 0, sizeof(s->scratch));
 285     s->istat0 = 0;
 286     s->istat1 = 0;
 287     s->dcmd = 0;
 288     s->dstat = 0;
 289     s->dien = 0;
 290     s->sist0 = 0;
 291     s->sist1 = 0;
 292     s->sien0 = 0;
 293     s->sien1 = 0;
 294     s->mbox0 = 0;
 295     s->mbox1 = 0;
 296     s->dfifo = 0;
 297     s->ctest2 = 0;
 298     s->ctest3 = 0;
 299     s->ctest4 = 0;
 300     s->ctest5 = 0;
 301     s->ccntl0 = 0;
 302     s->ccntl1 = 0;
 303     s->dsp = 0;
 304     s->dsps = 0;
 305     s->dmode = 0;
 306     s->dcntl = 0;
 307     s->scntl0 = 0xc0;
 308     s->scntl1 = 0;
 309     s->scntl2 = 0;
 310     s->scntl3 = 0;
 311     s->sstat0 = 0;
 312     s->sstat1 = 0;
 313     s->scid = 7;
 314     s->sxfer = 0;
 315     s->socl = 0;
 316     s->stest1 = 0;
 317     s->stest2 = 0;
 318     s->stest3 = 0;
 319     s->sidl = 0;
 320     s->stime0 = 0;
 321     s->respid0 = 0x80;
 322     s->respid1 = 0;
 323     s->mmrs = 0;
 324     s->mmws = 0;
 325     s->sfs = 0;
 326     s->drs = 0;
 327     s->sbms = 0;
 328     s->dbms = 0;
 329     s->dnad64 = 0;
 330     s->pmjad1 = 0;
 331     s->pmjad2 = 0;
 332     s->rbc = 0;
 333     s->ua = 0;
 334     s->ia = 0;
 335     s->sbc = 0;
 336     s->csbc = 0;
 337     s->sbr = 0;
 338 }
 339
 340 static int lsi_dma_40bit(LSIState *s)
 341 {
 342     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 343         return 1;
 344     return 0;
 345 }
 346
 347 static int lsi_dma_ti64bit(LSIState *s)
 348 {
 349     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 350         return 1;
 351     return 0;
 352 }
 353
 354 static int lsi_dma_64bit(LSIState *s)
 355 {
 356     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 357         return 1;
 358     return 0;
 359 }
 360
 361 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 362 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 363 static void lsi_execute_script(LSIState *s);
 364
 365 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 366 {
 367     uint32_t buf;
 368
 369     /* Optimize reading from SCRIPTS RAM.  */
 370     if ((addr & 0xffffe000) == s->script_ram_base) {
 371         return s->script_ram[(addr & 0x1fff) >> 2];
 372     }
 373     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 374     return cpu_to_le32(buf);
 375 }
 376
 377 static void lsi_stop_script(LSIState *s)
 378 {
 379     s->istat1 &= ~LSI_ISTAT1_SRUN;
 380 }
 381
 382 static void lsi_update_irq(LSIState *s)
 383 {
 384     int level;
 385     static int last_level;
 386
 387     /* It's unclear whether the DIP/SIP bits should be cleared when the
 388        Interrupt Status Registers are cleared or when istat0 is read.
 389        We currently do the formwer, which seems to work.  */
 390     level = 0;
 391     if (s->dstat) {
 392         if (s->dstat & s->dien)
 393             level = 1;
 394         s->istat0 |= LSI_ISTAT0_DIP;
 395     } else {
 396         s->istat0 &= ~LSI_ISTAT0_DIP;
 397     }
 398
 399     if (s->sist0 || s->sist1) {
 400         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 401             level = 1;
 402         s->istat0 |= LSI_ISTAT0_SIP;
 403     } else {
 404         s->istat0 &= ~LSI_ISTAT0_SIP;
 405     }
 406     if (s->istat0 & LSI_ISTAT0_INTF)
 407         level = 1;
 408
 409     if (level != last_level) {
 410         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 411                 level, s->dstat, s->sist1, s->sist0);
 412         last_level = level;
 413     }
 414     qemu_set_irq(s->dev.irq[0], level);
 415 }
 416
 417 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 418 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 419 {
 420     uint32_t mask0;
 421     uint32_t mask1;
 422
 423     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 424             stat1, stat0, s->sist1, s->sist0);
 425     s->sist0 |= stat0;
 426     s->sist1 |= stat1;
 427     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 428        we don't stop processing when raising STO.  Instead continue
 429        execution and stop at the next insn that accesses the SCSI bus.  */
 430     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 431     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 432     mask1 &= ~LSI_SIST1_STO;
 433     if (s->sist0 & mask0 || s->sist1 & mask1) {
 434         lsi_stop_script(s);
 435     }
 436     lsi_update_irq(s);
 437 }
 438
 439 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 440 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 441 {
 442     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 443     s->dstat |= stat;
 444     lsi_update_irq(s);
 445     lsi_stop_script(s);
 446 }
 447
 448 static inline void lsi_set_phase(LSIState *s, int phase)
 449 {
 450     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 451 }
 452
 453 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 454 {
 455     /* Trigger a phase mismatch.  */
 456     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 457         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 458             s->dsp = s->pmjad1;
 459         } else {
 460             s->dsp = s->pmjad2;
 461         }
 462         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 463     } else {
 464         DPRINTF("Phase mismatch interrupt\n");
 465         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 466         lsi_stop_script(s);
 467     }
 468     lsi_set_phase(s, new_phase);
 469 }
 470
 471
 472 /* Resume SCRIPTS execution after a DMA operation.  */
 473 static void lsi_resume_script(LSIState *s)
 474 {
 475     if (s->waiting != 2) {
 476         s->waiting = 0;
 477         lsi_execute_script(s);
 478     } else {
 479         s->waiting = 0;
 480     }
 481 }
 482
 483 /* Initiate a SCSI layer data transfer.  */
 484 static void lsi_do_dma(LSIState *s, int out)
 485 {
 486     uint32_t count;
 487     target_phys_addr_t addr;
 488
 489     if (!s->current_dma_len) {
 490         /* Wait until data is available.  */
 491         DPRINTF("DMA no data available\n");
 492         return;
 493     }
 494
 495     count = s->dbc;
 496     if (count > s->current_dma_len)
 497         count = s->current_dma_len;
 498
 499     addr = s->dnad;
 500     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 501     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 502         addr |= ((uint64_t)s->dnad64 << 32);
 503     else if (s->dbms)
 504         addr |= ((uint64_t)s->dbms << 32);
 505     else if (s->sbms)
 506         addr |= ((uint64_t)s->sbms << 32);
 507
 508     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 509     s->csbc += count;
 510     s->dnad += count;
 511     s->dbc -= count;
 512
 513     if (s->dma_buf == NULL) {
 514         s->dma_buf = s->current_dev->info->get_buf(s->current_dev,
 515                                                    s->current_tag);
 516     }
 517
 518     /* ??? Set SFBR to first data byte.  */
 519     if (out) {
 520         cpu_physical_memory_read(addr, s->dma_buf, count);
 521     } else {
 522         cpu_physical_memory_write(addr, s->dma_buf, count);
 523     }
 524     s->current_dma_len -= count;
 525     if (s->current_dma_len == 0) {
 526         s->dma_buf = NULL;
 527         if (out) {
 528             /* Write the data.  */
 529             s->current_dev->info->write_data(s->current_dev, s->current_tag);
 530         } else {
 531             /* Request any remaining data.  */
 532             s->current_dev->info->read_data(s->current_dev, s->current_tag);
 533         }
 534     } else {
 535         s->dma_buf += count;
 536         lsi_resume_script(s);
 537     }
 538 }
 539
 540
 541 /* Add a command to the queue.  */
 542 static void lsi_queue_command(LSIState *s)
 543 {
 544     lsi_queue *p;
 545
 546     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 547     if (s->queue_len == s->active_commands) {
 548         s->queue_len++;
 549         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 550     }
 551     p = &s->queue[s->active_commands++];
 552     p->tag = s->current_tag;
 553     p->pending = 0;
 554     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 555 }
 556
 557 /* Queue a byte for a MSG IN phase.  */
 558 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 559 {
 560     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 561         BADF("MSG IN data too long\n");
 562     } else {
 563         DPRINTF("MSG IN 0x%02x\n", data);
 564         s->msg[s->msg_len++] = data;
 565     }
 566 }
 567
 568 /* Perform reselection to continue a command.  */
 569 static void lsi_reselect(LSIState *s, uint32_t tag)
 570 {
 571     lsi_queue *p;
 572     int n;
 573     int id;
 574
 575     p = NULL;
 576     for (n = 0; n < s->active_commands; n++) {
 577         p = &s->queue[n];
 578         if (p->tag == tag)
 579             break;
 580     }
 581     if (n == s->active_commands) {
 582         BADF("Reselected non-existant command tag=0x%x\n", tag);
 583         return;
 584     }
 585     id = (tag >> 8) & 0xf;
 586     s->ssid = id | 0x80;
 587     DPRINTF("Reselected target %d\n", id);
 588     s->current_dev = s->bus.devs[id];
 589     s->current_tag = tag;
 590     s->scntl1 |= LSI_SCNTL1_CON;
 591     lsi_set_phase(s, PHASE_MI);
 592     s->msg_action = p->out ? 2 : 3;
 593     s->current_dma_len = p->pending;
 594     s->dma_buf = NULL;
 595     lsi_add_msg_byte(s, 0x80);
 596     if (s->current_tag & LSI_TAG_VALID) {
 597         lsi_add_msg_byte(s, 0x20);
 598         lsi_add_msg_byte(s, tag & 0xff);
 599     }
 600
 601     s->active_commands--;
 602     if (n != s->active_commands) {
 603         s->queue[n] = s->queue[s->active_commands];
 604     }
 605 }
 606
 607 /* Record that data is available for a queued command.  Returns zero if
 608    the device was reselected, nonzero if the IO is deferred.  */
 609 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 610 {
 611     lsi_queue *p;
 612     int i;
 613     for (i = 0; i < s->active_commands; i++) {
 614         p = &s->queue[i];
 615         if (p->tag == tag) {
 616             if (p->pending) {
 617                 BADF("Multiple IO pending for tag %d\n", tag);
 618             }
 619             p->pending = arg;
 620             if (s->waiting == 1) {
 621                 /* Reselect device.  */
 622                 lsi_reselect(s, tag);
 623                 return 0;
 624             } else {
 625                DPRINTF("Queueing IO tag=0x%x\n", tag);
 626                 p->pending = arg;
 627                 return 1;
 628             }
 629         }
 630     }
 631     BADF("IO with unknown tag %d\n", tag);
 632     return 1;
 633 }
 634
 635 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 636 static void lsi_command_complete(SCSIBus *bus, int reason, uint32_t tag,
 637                                  uint32_t arg)
 638 {
 639     LSIState *s = DO_UPCAST(LSIState, dev.qdev, bus->qbus.parent);
 640     int out;
 641
 642     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 643     if (reason == SCSI_REASON_DONE) {
 644         DPRINTF("Command complete sense=%d\n", (int)arg);
 645         s->sense = arg;
 646         s->command_complete = 2;
 647         if (s->waiting && s->dbc != 0) {
 648             /* Raise phase mismatch for short transfers.  */
 649             lsi_bad_phase(s, out, PHASE_ST);
 650         } else {
 651             lsi_set_phase(s, PHASE_ST);
 652         }
 653         lsi_resume_script(s);
 654         return;
 655     }
 656
 657     if (s->waiting == 1 || tag != s->current_tag) {
 658         if (lsi_queue_tag(s, tag, arg))
 659             return;
 660     }
 661     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 662     s->current_dma_len = arg;
 663     s->command_complete = 1;
 664     if (!s->waiting)
 665         return;
 666     if (s->waiting == 1 || s->dbc == 0) {
 667         lsi_resume_script(s);
 668     } else {
 669         lsi_do_dma(s, out);
 670     }
 671 }
 672
 673 static void lsi_do_command(LSIState *s)
 674 {
 675     uint8_t buf[16];
 676     int n;
 677
 678     DPRINTF("Send command len=%d\n", s->dbc);
 679     if (s->dbc > 16)
 680         s->dbc = 16;
 681     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 682     s->sfbr = buf[0];
 683     s->command_complete = 0;
 684     n = s->current_dev->info->send_command(s->current_dev, s->current_tag, buf,
 685                                            s->current_lun);
 686     if (n > 0) {
 687         lsi_set_phase(s, PHASE_DI);
 688         s->current_dev->info->read_data(s->current_dev, s->current_tag);
 689     } else if (n < 0) {
 690         lsi_set_phase(s, PHASE_DO);
 691         s->current_dev->info->write_data(s->current_dev, s->current_tag);
 692     }
 693
 694     if (!s->command_complete) {
 695         if (n) {
 696             /* Command did not complete immediately so disconnect.  */
 697             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 698             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 699             /* wait data */
 700             lsi_set_phase(s, PHASE_MI);
 701             s->msg_action = 1;
 702             lsi_queue_command(s);
 703         } else {
 704             /* wait command complete */
 705             lsi_set_phase(s, PHASE_DI);
 706         }
 707     }
 708 }
 709
 710 static void lsi_do_status(LSIState *s)
 711 {
 712     uint8_t sense;
 713     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 714     if (s->dbc != 1)
 715         BADF("Bad Status move\n");
 716     s->dbc = 1;
 717     sense = s->sense;
 718     s->sfbr = sense;
 719     cpu_physical_memory_write(s->dnad, &sense, 1);
 720     lsi_set_phase(s, PHASE_MI);
 721     s->msg_action = 1;
 722     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 723 }
 724
 725 static void lsi_disconnect(LSIState *s)
 726 {
 727     s->scntl1 &= ~LSI_SCNTL1_CON;
 728     s->sstat1 &= ~PHASE_MASK;
 729 }
 730
 731 static void lsi_do_msgin(LSIState *s)
 732 {
 733     int len;
 734     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 735     s->sfbr = s->msg[0];
 736     len = s->msg_len;
 737     if (len > s->dbc)
 738         len = s->dbc;
 739     cpu_physical_memory_write(s->dnad, s->msg, len);
 740     /* Linux drivers rely on the last byte being in the SIDL.  */
 741     s->sidl = s->msg[len - 1];
 742     s->msg_len -= len;
 743     if (s->msg_len) {
 744         memmove(s->msg, s->msg + len, s->msg_len);
 745     } else {
 746         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 747            switch to PHASE_MO.  */
 748         switch (s->msg_action) {
 749         case 0:
 750             lsi_set_phase(s, PHASE_CMD);
 751             break;
 752         case 1:
 753             lsi_disconnect(s);
 754             break;
 755         case 2:
 756             lsi_set_phase(s, PHASE_DO);
 757             break;
 758         case 3:
 759             lsi_set_phase(s, PHASE_DI);
 760             break;
 761         default:
 762             abort();
 763         }
 764     }
 765 }
 766
 767 /* Read the next byte during a MSGOUT phase.  */
 768 static uint8_t lsi_get_msgbyte(LSIState *s)
 769 {
 770     uint8_t data;
 771     cpu_physical_memory_read(s->dnad, &data, 1);
 772     s->dnad++;
 773     s->dbc--;
 774     return data;
 775 }
 776
 777 static void lsi_do_msgout(LSIState *s)
 778 {
 779     uint8_t msg;
 780     int len;
 781
 782     DPRINTF("MSG out len=%d\n", s->dbc);
 783     while (s->dbc) {
 784         msg = lsi_get_msgbyte(s);
 785         s->sfbr = msg;
 786
 787         switch (msg) {
 788         case 0x00:
 789             DPRINTF("MSG: Disconnect\n");
 790             lsi_disconnect(s);
 791             break;
 792         case 0x08:
 793             DPRINTF("MSG: No Operation\n");
 794             lsi_set_phase(s, PHASE_CMD);
 795             break;
 796         case 0x01:
 797             len = lsi_get_msgbyte(s);
 798             msg = lsi_get_msgbyte(s);
 799             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 800             switch (msg) {
 801             case 1:
 802                 DPRINTF("SDTR (ignored)\n");
 803                 s->dbc -= 2;
 804                 break;
 805             case 3:
 806                 DPRINTF("WDTR (ignored)\n");
 807                 s->dbc -= 1;
 808                 break;
 809             default:
 810                 goto bad;
 811             }
 812             break;
 813         case 0x20: /* SIMPLE queue */
 814             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 815             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 816             break;
 817         case 0x21: /* HEAD of queue */
 818             BADF("HEAD queue not implemented\n");
 819             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 820             break;
 821         case 0x22: /* ORDERED queue */
 822             BADF("ORDERED queue not implemented\n");
 823             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 824             break;
 825         default:
 826             if ((msg & 0x80) == 0) {
 827                 goto bad;
 828             }
 829             s->current_lun = msg & 7;
 830             DPRINTF("Select LUN %d\n", s->current_lun);
 831             lsi_set_phase(s, PHASE_CMD);
 832             break;
 833         }
 834     }
 835     return;
 836 bad:
 837     BADF("Unimplemented message 0x%02x\n", msg);
 838     lsi_set_phase(s, PHASE_MI);
 839     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 840     s->msg_action = 0;
 841 }
 842
 843 /* Sign extend a 24-bit value.  */
 844 static inline int32_t sxt24(int32_t n)
 845 {
 846     return (n << 8) >> 8;
 847 }
 848
 849 #define LSI_BUF_SIZE 4096
 850 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 851 {
 852     int n;
 853     uint8_t buf[LSI_BUF_SIZE];
 854
 855     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 856     while (count) {
 857         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
 858         cpu_physical_memory_read(src, buf, n);
 859         cpu_physical_memory_write(dest, buf, n);
 860         src += n;
 861         dest += n;
 862         count -= n;
 863     }
 864 }
 865
 866 static void lsi_wait_reselect(LSIState *s)
 867 {
 868     int i;
 869     DPRINTF("Wait Reselect\n");
 870     if (s->current_dma_len)
 871         BADF("Reselect with pending DMA\n");
 872     for (i = 0; i < s->active_commands; i++) {
 873         if (s->queue[i].pending) {
 874             lsi_reselect(s, s->queue[i].tag);
 875             break;
 876         }
 877     }
 878     if (s->current_dma_len == 0) {
 879         s->waiting = 1;
 880     }
 881 }
 882
 883 static void lsi_execute_script(LSIState *s)
 884 {
 885     uint32_t insn;
 886     uint32_t addr, addr_high;
 887     int opcode;
 888     int insn_processed = 0;
 889
 890     s->istat1 |= LSI_ISTAT1_SRUN;
 891 again:
 892     insn_processed++;
 893     insn = read_dword(s, s->dsp);
 894     if (!insn) {
 895         /* If we receive an empty opcode increment the DSP by 4 bytes
 896            instead of 8 and execute the next opcode at that location */
 897         s->dsp += 4;
 898         goto again;
 899     }
 900     addr = read_dword(s, s->dsp + 4);
 901     addr_high = 0;
 902     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 903     s->dsps = addr;
 904     s->dcmd = insn >> 24;
 905     s->dsp += 8;
 906     switch (insn >> 30) {
 907     case 0: /* Block move.  */
 908         if (s->sist1 & LSI_SIST1_STO) {
 909             DPRINTF("Delayed select timeout\n");
 910             lsi_stop_script(s);
 911             break;
 912         }
 913         s->dbc = insn & 0xffffff;
 914         s->rbc = s->dbc;
 915         /* ??? Set ESA.  */
 916         s->ia = s->dsp - 8;
 917         if (insn & (1 << 29)) {
 918             /* Indirect addressing.  */
 919             addr = read_dword(s, addr);
 920         } else if (insn & (1 << 28)) {
 921             uint32_t buf[2];
 922             int32_t offset;
 923             /* Table indirect addressing.  */
 924
 925             /* 32-bit Table indirect */
 926             offset = sxt24(addr);
 927             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 928             /* byte count is stored in bits 0:23 only */
 929             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 930             s->rbc = s->dbc;
 931             addr = cpu_to_le32(buf[1]);
 932
 933             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 934              * table, bits [31:24] */
 935             if (lsi_dma_40bit(s))
 936                 addr_high = cpu_to_le32(buf[0]) >> 24;
 937             else if (lsi_dma_ti64bit(s)) {
 938                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
 939                 switch (selector) {
 940                 case 0 ... 0x0f:
 941                     /* offset index into scratch registers since
 942                      * TI64 mode can use registers C to R */
 943                     addr_high = s->scratch[2 + selector];
 944                     break;
 945                 case 0x10:
 946                     addr_high = s->mmrs;
 947                     break;
 948                 case 0x11:
 949                     addr_high = s->mmws;
 950                     break;
 951                 case 0x12:
 952                     addr_high = s->sfs;
 953                     break;
 954                 case 0x13:
 955                     addr_high = s->drs;
 956                     break;
 957                 case 0x14:
 958                     addr_high = s->sbms;
 959                     break;
 960                 case 0x15:
 961                     addr_high = s->dbms;
 962                     break;
 963                 default:
 964                     BADF("Illegal selector specified (0x%x > 0x15)"
 965                          " for 64-bit DMA block move", selector);
 966                     break;
 967                 }
 968             }
 969         } else if (lsi_dma_64bit(s)) {
 970             /* fetch a 3rd dword if 64-bit direct move is enabled and
 971                only if we're not doing table indirect or indirect addressing */
 972             s->dbms = read_dword(s, s->dsp);
 973             s->dsp += 4;
 974             s->ia = s->dsp - 12;
 975         }
 976         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 977             DPRINTF("Wrong phase got %d expected %d\n",
 978                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 979             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 980             break;
 981         }
 982         s->dnad = addr;
 983         s->dnad64 = addr_high;
 984         switch (s->sstat1 & 0x7) {
 985         case PHASE_DO:
 986             s->waiting = 2;
 987             lsi_do_dma(s, 1);
 988             if (s->waiting)
 989                 s->waiting = 3;
 990             break;
 991         case PHASE_DI:
 992             s->waiting = 2;
 993             lsi_do_dma(s, 0);
 994             if (s->waiting)
 995                 s->waiting = 3;
 996             break;
 997         case PHASE_CMD:
 998             lsi_do_command(s);
 999             break;
1000         case PHASE_ST:
1001             lsi_do_status(s);
1002             break;
1003         case PHASE_MO:
1004             lsi_do_msgout(s);
1005             break;
1006         case PHASE_MI:
1007             lsi_do_msgin(s);
1008             break;
1009         default:
1010             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1011             exit(1);
1012         }
1013         s->dfifo = s->dbc & 0xff;
1014         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1015         s->sbc = s->dbc;
1016         s->rbc -= s->dbc;
1017         s->ua = addr + s->dbc;
1018         break;
1019
1020     case 1: /* IO or Read/Write instruction.  */
1021         opcode = (insn >> 27) & 7;
1022         if (opcode < 5) {
1023             uint32_t id;
1024
1025             if (insn & (1 << 25)) {
1026                 id = read_dword(s, s->dsa + sxt24(insn));
1027             } else {
1028                 id = addr;
1029             }
1030             id = (id >> 16) & 0xf;
1031             if (insn & (1 << 26)) {
1032                 addr = s->dsp + sxt24(addr);
1033             }
1034             s->dnad = addr;
1035             switch (opcode) {
1036             case 0: /* Select */
1037                 s->sdid = id;
1038                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1039                     DPRINTF("Already reselected by target %d\n", id);
1040                     break;
1041                 }
1042                 s->sstat0 |= LSI_SSTAT0_WOA;
1043                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1044                 if (id >= LSI_MAX_DEVS || !s->bus.devs[id]) {
1045                     DPRINTF("Selected absent target %d\n", id);
1046                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1047                     lsi_disconnect(s);
1048                     break;
1049                 }
1050                 DPRINTF("Selected target %d%s\n",
1051                         id, insn & (1 << 3) ? " ATN" : "");
1052                 /* ??? Linux drivers compain when this is set.  Maybe
1053                    it only applies in low-level mode (unimplemented).
1054                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1055                 s->current_dev = s->bus.devs[id];
1056                 s->current_tag = id << 8;
1057                 s->scntl1 |= LSI_SCNTL1_CON;
1058                 if (insn & (1 << 3)) {
1059                     s->socl |= LSI_SOCL_ATN;
1060                 }
1061                 lsi_set_phase(s, PHASE_MO);
1062                 break;
1063             case 1: /* Disconnect */
1064                 DPRINTF("Wait Disconect\n");
1065                 s->scntl1 &= ~LSI_SCNTL1_CON;
1066                 break;
1067             case 2: /* Wait Reselect */
1068                 lsi_wait_reselect(s);
1069                 break;
1070             case 3: /* Set */
1071                 DPRINTF("Set%s%s%s%s\n",
1072                         insn & (1 << 3) ? " ATN" : "",
1073                         insn & (1 << 6) ? " ACK" : "",
1074                         insn & (1 << 9) ? " TM" : "",
1075                         insn & (1 << 10) ? " CC" : "");
1076                 if (insn & (1 << 3)) {
1077                     s->socl |= LSI_SOCL_ATN;
1078                     lsi_set_phase(s, PHASE_MO);
1079                 }
1080                 if (insn & (1 << 9)) {
1081                     BADF("Target mode not implemented\n");
1082                     exit(1);
1083                 }
1084                 if (insn & (1 << 10))
1085                     s->carry = 1;
1086                 break;
1087             case 4: /* Clear */
1088                 DPRINTF("Clear%s%s%s%s\n",
1089                         insn & (1 << 3) ? " ATN" : "",
1090                         insn & (1 << 6) ? " ACK" : "",
1091                         insn & (1 << 9) ? " TM" : "",
1092                         insn & (1 << 10) ? " CC" : "");
1093                 if (insn & (1 << 3)) {
1094                     s->socl &= ~LSI_SOCL_ATN;
1095                 }
1096                 if (insn & (1 << 10))
1097                     s->carry = 0;
1098                 break;
1099             }
1100         } else {
1101             uint8_t op0;
1102             uint8_t op1;
1103             uint8_t data8;
1104             int reg;
1105             int operator;
1106 #ifdef DEBUG_LSI
1107             static const char *opcode_names[3] =
1108                 {"Write", "Read", "Read-Modify-Write"};
1109             static const char *operator_names[8] =
1110                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1111 #endif
1112
1113             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1114             data8 = (insn >> 8) & 0xff;
1115             opcode = (insn >> 27) & 7;
1116             operator = (insn >> 24) & 7;
1117             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1118                     opcode_names[opcode - 5], reg,
1119                     operator_names[operator], data8, s->sfbr,
1120                     (insn & (1 << 23)) ? " SFBR" : "");
1121             op0 = op1 = 0;
1122             switch (opcode) {
1123             case 5: /* From SFBR */
1124                 op0 = s->sfbr;
1125                 op1 = data8;
1126                 break;
1127             case 6: /* To SFBR */
1128                 if (operator)
1129                     op0 = lsi_reg_readb(s, reg);
1130                 op1 = data8;
1131                 break;
1132             case 7: /* Read-modify-write */
1133                 if (operator)
1134                     op0 = lsi_reg_readb(s, reg);
1135                 if (insn & (1 << 23)) {
1136                     op1 = s->sfbr;
1137                 } else {
1138                     op1 = data8;
1139                 }
1140                 break;
1141             }
1142
1143             switch (operator) {
1144             case 0: /* move */
1145                 op0 = op1;
1146                 break;
1147             case 1: /* Shift left */
1148                 op1 = op0 >> 7;
1149                 op0 = (op0 << 1) | s->carry;
1150                 s->carry = op1;
1151                 break;
1152             case 2: /* OR */
1153                 op0 |= op1;
1154                 break;
1155             case 3: /* XOR */
1156                 op0 ^= op1;
1157                 break;
1158             case 4: /* AND */
1159                 op0 &= op1;
1160                 break;
1161             case 5: /* SHR */
1162                 op1 = op0 & 1;
1163                 op0 = (op0 >> 1) | (s->carry << 7);
1164                 s->carry = op1;
1165                 break;
1166             case 6: /* ADD */
1167                 op0 += op1;
1168                 s->carry = op0 < op1;
1169                 break;
1170             case 7: /* ADC */
1171                 op0 += op1 + s->carry;
1172                 if (s->carry)
1173                     s->carry = op0 <= op1;
1174                 else
1175                     s->carry = op0 < op1;
1176                 break;
1177             }
1178
1179             switch (opcode) {
1180             case 5: /* From SFBR */
1181             case 7: /* Read-modify-write */
1182                 lsi_reg_writeb(s, reg, op0);
1183                 break;
1184             case 6: /* To SFBR */
1185                 s->sfbr = op0;
1186                 break;
1187             }
1188         }
1189         break;
1190
1191     case 2: /* Transfer Control.  */
1192         {
1193             int cond;
1194             int jmp;
1195
1196             if ((insn & 0x002e0000) == 0) {
1197                 DPRINTF("NOP\n");
1198                 break;
1199             }
1200             if (s->sist1 & LSI_SIST1_STO) {
1201                 DPRINTF("Delayed select timeout\n");
1202                 lsi_stop_script(s);
1203                 break;
1204             }
1205             cond = jmp = (insn & (1 << 19)) != 0;
1206             if (cond == jmp && (insn & (1 << 21))) {
1207                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1208                 cond = s->carry != 0;
1209             }
1210             if (cond == jmp && (insn & (1 << 17))) {
1211                 DPRINTF("Compare phase %d %c= %d\n",
1212                         (s->sstat1 & PHASE_MASK),
1213                         jmp ? '=' : '!',
1214                         ((insn >> 24) & 7));
1215                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1216             }
1217             if (cond == jmp && (insn & (1 << 18))) {
1218                 uint8_t mask;
1219
1220                 mask = (~insn >> 8) & 0xff;
1221                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1222                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1223                 cond = (s->sfbr & mask) == (insn & mask);
1224             }
1225             if (cond == jmp) {
1226                 if (insn & (1 << 23)) {
1227                     /* Relative address.  */
1228                     addr = s->dsp + sxt24(addr);
1229                 }
1230                 switch ((insn >> 27) & 7) {
1231                 case 0: /* Jump */
1232                     DPRINTF("Jump to 0x%08x\n", addr);
1233                     s->dsp = addr;
1234                     break;
1235                 case 1: /* Call */
1236                     DPRINTF("Call 0x%08x\n", addr);
1237                     s->temp = s->dsp;
1238                     s->dsp = addr;
1239                     break;
1240                 case 2: /* Return */
1241                     DPRINTF("Return to 0x%08x\n", s->temp);
1242                     s->dsp = s->temp;
1243                     break;
1244                 case 3: /* Interrupt */
1245                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1246                     if ((insn & (1 << 20)) != 0) {
1247                         s->istat0 |= LSI_ISTAT0_INTF;
1248                         lsi_update_irq(s);
1249                     } else {
1250                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1251                     }
1252                     break;
1253                 default:
1254                     DPRINTF("Illegal transfer control\n");
1255                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1256                     break;
1257                 }
1258             } else {
1259                 DPRINTF("Control condition failed\n");
1260             }
1261         }
1262         break;
1263
1264     case 3:
1265         if ((insn & (1 << 29)) == 0) {
1266             /* Memory move.  */
1267             uint32_t dest;
1268             /* ??? The docs imply the destination address is loaded into
1269                the TEMP register.  However the Linux drivers rely on
1270                the value being presrved.  */
1271             dest = read_dword(s, s->dsp);
1272             s->dsp += 4;
1273             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1274         } else {
1275             uint8_t data[7];
1276             int reg;
1277             int n;
1278             int i;
1279
1280             if (insn & (1 << 28)) {
1281                 addr = s->dsa + sxt24(addr);
1282             }
1283             n = (insn & 7);
1284             reg = (insn >> 16) & 0xff;
1285             if (insn & (1 << 24)) {
1286                 cpu_physical_memory_read(addr, data, n);
1287                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1288                         addr, *(int *)data);
1289                 for (i = 0; i < n; i++) {
1290                     lsi_reg_writeb(s, reg + i, data[i]);
1291                 }
1292             } else {
1293                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1294                 for (i = 0; i < n; i++) {
1295                     data[i] = lsi_reg_readb(s, reg + i);
1296                 }
1297                 cpu_physical_memory_write(addr, data, n);
1298             }
1299         }
1300     }
1301     if (insn_processed > 10000 && !s->waiting) {
1302         /* Some windows drivers make the device spin waiting for a memory
1303            location to change.  If we have been executed a lot of code then
1304            assume this is the case and force an unexpected device disconnect.
1305            This is apparently sufficient to beat the drivers into submission.
1306          */
1307         if (!(s->sien0 & LSI_SIST0_UDC))
1308             fprintf(stderr, "inf. loop with UDC masked\n");
1309         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1310         lsi_disconnect(s);
1311     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1312         if (s->dcntl & LSI_DCNTL_SSM) {
1313             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1314         } else {
1315             goto again;
1316         }
1317     }
1318     DPRINTF("SCRIPTS execution stopped\n");
1319 }
1320
1321 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1322 {
1323     uint8_t tmp;
1324 #define CASE_GET_REG24(name, addr) \
1325     case addr: return s->name & 0xff; \
1326     case addr + 1: return (s->name >> 8) & 0xff; \
1327     case addr + 2: return (s->name >> 16) & 0xff;
1328
1329 #define CASE_GET_REG32(name, addr) \
1330     case addr: return s->name & 0xff; \
1331     case addr + 1: return (s->name >> 8) & 0xff; \
1332     case addr + 2: return (s->name >> 16) & 0xff; \
1333     case addr + 3: return (s->name >> 24) & 0xff;
1334
1335 #ifdef DEBUG_LSI_REG
1336     DPRINTF("Read reg %x\n", offset);
1337 #endif
1338     switch (offset) {
1339     case 0x00: /* SCNTL0 */
1340         return s->scntl0;
1341     case 0x01: /* SCNTL1 */
1342         return s->scntl1;
1343     case 0x02: /* SCNTL2 */
1344         return s->scntl2;
1345     case 0x03: /* SCNTL3 */
1346         return s->scntl3;
1347     case 0x04: /* SCID */
1348         return s->scid;
1349     case 0x05: /* SXFER */
1350         return s->sxfer;
1351     case 0x06: /* SDID */
1352         return s->sdid;
1353     case 0x07: /* GPREG0 */
1354         return 0x7f;
1355     case 0x08: /* Revision ID */
1356         return 0x00;
1357     case 0xa: /* SSID */
1358         return s->ssid;
1359     case 0xb: /* SBCL */
1360         /* ??? This is not correct. However it's (hopefully) only
1361            used for diagnostics, so should be ok.  */
1362         return 0;
1363     case 0xc: /* DSTAT */
1364         tmp = s->dstat | 0x80;
1365         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1366             s->dstat = 0;
1367         lsi_update_irq(s);
1368         return tmp;
1369     case 0x0d: /* SSTAT0 */
1370         return s->sstat0;
1371     case 0x0e: /* SSTAT1 */
1372         return s->sstat1;
1373     case 0x0f: /* SSTAT2 */
1374         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1375     CASE_GET_REG32(dsa, 0x10)
1376     case 0x14: /* ISTAT0 */
1377         return s->istat0;
1378     case 0x15: /* ISTAT1 */
1379         return s->istat1;
1380     case 0x16: /* MBOX0 */
1381         return s->mbox0;
1382     case 0x17: /* MBOX1 */
1383         return s->mbox1;
1384     case 0x18: /* CTEST0 */
1385         return 0xff;
1386     case 0x19: /* CTEST1 */
1387         return 0;
1388     case 0x1a: /* CTEST2 */
1389         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1390         if (s->istat0 & LSI_ISTAT0_SIGP) {
1391             s->istat0 &= ~LSI_ISTAT0_SIGP;
1392             tmp |= LSI_CTEST2_SIGP;
1393         }
1394         return tmp;
1395     case 0x1b: /* CTEST3 */
1396         return s->ctest3;
1397     CASE_GET_REG32(temp, 0x1c)
1398     case 0x20: /* DFIFO */
1399         return 0;
1400     case 0x21: /* CTEST4 */
1401         return s->ctest4;
1402     case 0x22: /* CTEST5 */
1403         return s->ctest5;
1404     case 0x23: /* CTEST6 */
1405          return 0;
1406     CASE_GET_REG24(dbc, 0x24)
1407     case 0x27: /* DCMD */
1408         return s->dcmd;
1409     CASE_GET_REG32(dnad, 0x28)
1410     CASE_GET_REG32(dsp, 0x2c)
1411     CASE_GET_REG32(dsps, 0x30)
1412     CASE_GET_REG32(scratch[0], 0x34)
1413     case 0x38: /* DMODE */
1414         return s->dmode;
1415     case 0x39: /* DIEN */
1416         return s->dien;
1417     case 0x3a: /* SBR */
1418         return s->sbr;
1419     case 0x3b: /* DCNTL */
1420         return s->dcntl;
1421     case 0x40: /* SIEN0 */
1422         return s->sien0;
1423     case 0x41: /* SIEN1 */
1424         return s->sien1;
1425     case 0x42: /* SIST0 */
1426         tmp = s->sist0;
1427         s->sist0 = 0;
1428         lsi_update_irq(s);
1429         return tmp;
1430     case 0x43: /* SIST1 */
1431         tmp = s->sist1;
1432         s->sist1 = 0;
1433         lsi_update_irq(s);
1434         return tmp;
1435     case 0x46: /* MACNTL */
1436         return 0x0f;
1437     case 0x47: /* GPCNTL0 */
1438         return 0x0f;
1439     case 0x48: /* STIME0 */
1440         return s->stime0;
1441     case 0x4a: /* RESPID0 */
1442         return s->respid0;
1443     case 0x4b: /* RESPID1 */
1444         return s->respid1;
1445     case 0x4d: /* STEST1 */
1446         return s->stest1;
1447     case 0x4e: /* STEST2 */
1448         return s->stest2;
1449     case 0x4f: /* STEST3 */
1450         return s->stest3;
1451     case 0x50: /* SIDL */
1452         /* This is needed by the linux drivers.  We currently only update it
1453            during the MSG IN phase.  */
1454         return s->sidl;
1455     case 0x52: /* STEST4 */
1456         return 0xe0;
1457     case 0x56: /* CCNTL0 */
1458         return s->ccntl0;
1459     case 0x57: /* CCNTL1 */
1460         return s->ccntl1;
1461     case 0x58: /* SBDL */
1462         /* Some drivers peek at the data bus during the MSG IN phase.  */
1463         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1464             return s->msg[0];
1465         return 0;
1466     case 0x59: /* SBDL high */
1467         return 0;
1468     CASE_GET_REG32(mmrs, 0xa0)
1469     CASE_GET_REG32(mmws, 0xa4)
1470     CASE_GET_REG32(sfs, 0xa8)
1471     CASE_GET_REG32(drs, 0xac)
1472     CASE_GET_REG32(sbms, 0xb0)
1473     CASE_GET_REG32(dbms, 0xb4)
1474     CASE_GET_REG32(dnad64, 0xb8)
1475     CASE_GET_REG32(pmjad1, 0xc0)
1476     CASE_GET_REG32(pmjad2, 0xc4)
1477     CASE_GET_REG32(rbc, 0xc8)
1478     CASE_GET_REG32(ua, 0xcc)
1479     CASE_GET_REG32(ia, 0xd4)
1480     CASE_GET_REG32(sbc, 0xd8)
1481     CASE_GET_REG32(csbc, 0xdc)
1482     }
1483     if (offset >= 0x5c && offset < 0xa0) {
1484         int n;
1485         int shift;
1486         n = (offset - 0x58) >> 2;
1487         shift = (offset & 3) * 8;
1488         return (s->scratch[n] >> shift) & 0xff;
1489     }
1490     BADF("readb 0x%x\n", offset);
1491     exit(1);
1492 #undef CASE_GET_REG24
1493 #undef CASE_GET_REG32
1494 }
1495
1496 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1497 {
1498 #define CASE_SET_REG24(name, addr) \
1499     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1500     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1501     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1502
1503 #define CASE_SET_REG32(name, addr) \
1504     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1505     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1506     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1507     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1508
1509 #ifdef DEBUG_LSI_REG
1510     DPRINTF("Write reg %x = %02x\n", offset, val);
1511 #endif
1512     switch (offset) {
1513     case 0x00: /* SCNTL0 */
1514         s->scntl0 = val;
1515         if (val & LSI_SCNTL0_START) {
1516             BADF("Start sequence not implemented\n");
1517         }
1518         break;
1519     case 0x01: /* SCNTL1 */
1520         s->scntl1 = val & ~LSI_SCNTL1_SST;
1521         if (val & LSI_SCNTL1_IARB) {
1522             BADF("Immediate Arbritration not implemented\n");
1523         }
1524         if (val & LSI_SCNTL1_RST) {
1525             s->sstat0 |= LSI_SSTAT0_RST;
1526             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1527         } else {
1528             s->sstat0 &= ~LSI_SSTAT0_RST;
1529         }
1530         break;
1531     case 0x02: /* SCNTL2 */
1532         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1533         s->scntl2 = val;
1534         break;
1535     case 0x03: /* SCNTL3 */
1536         s->scntl3 = val;
1537         break;
1538     case 0x04: /* SCID */
1539         s->scid = val;
1540         break;
1541     case 0x05: /* SXFER */
1542         s->sxfer = val;
1543         break;
1544     case 0x06: /* SDID */
1545         if ((val & 0xf) != (s->ssid & 0xf))
1546             BADF("Destination ID does not match SSID\n");
1547         s->sdid = val & 0xf;
1548         break;
1549     case 0x07: /* GPREG0 */
1550         break;
1551     case 0x08: /* SFBR */
1552         /* The CPU is not allowed to write to this register.  However the
1553            SCRIPTS register move instructions are.  */
1554         s->sfbr = val;
1555         break;
1556     case 0x0a: case 0x0b:
1557         /* Openserver writes to these readonly registers on startup */
1558         return;
1559     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1560         /* Linux writes to these readonly registers on startup.  */
1561         return;
1562     CASE_SET_REG32(dsa, 0x10)
1563     case 0x14: /* ISTAT0 */
1564         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1565         if (val & LSI_ISTAT0_ABRT) {
1566             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1567         }
1568         if (val & LSI_ISTAT0_INTF) {
1569             s->istat0 &= ~LSI_ISTAT0_INTF;
1570             lsi_update_irq(s);
1571         }
1572         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1573             DPRINTF("Woken by SIGP\n");
1574             s->waiting = 0;
1575             s->dsp = s->dnad;
1576             lsi_execute_script(s);
1577         }
1578         if (val & LSI_ISTAT0_SRST) {
1579             lsi_soft_reset(s);
1580         }
1581         break;
1582     case 0x16: /* MBOX0 */
1583         s->mbox0 = val;
1584         break;
1585     case 0x17: /* MBOX1 */
1586         s->mbox1 = val;
1587         break;
1588     case 0x1a: /* CTEST2 */
1589         s->ctest2 = val & LSI_CTEST2_PCICIE;
1590         break;
1591     case 0x1b: /* CTEST3 */
1592         s->ctest3 = val & 0x0f;
1593         break;
1594     CASE_SET_REG32(temp, 0x1c)
1595     case 0x21: /* CTEST4 */
1596         if (val & 7) {
1597            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1598         }
1599         s->ctest4 = val;
1600         break;
1601     case 0x22: /* CTEST5 */
1602         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1603             BADF("CTEST5 DMA increment not implemented\n");
1604         }
1605         s->ctest5 = val;
1606         break;
1607     CASE_SET_REG24(dbc, 0x24)
1608     CASE_SET_REG32(dnad, 0x28)
1609     case 0x2c: /* DSP[0:7] */
1610         s->dsp &= 0xffffff00;
1611         s->dsp |= val;
1612         break;
1613     case 0x2d: /* DSP[8:15] */
1614         s->dsp &= 0xffff00ff;
1615         s->dsp |= val << 8;
1616         break;
1617     case 0x2e: /* DSP[16:23] */
1618         s->dsp &= 0xff00ffff;
1619         s->dsp |= val << 16;
1620         break;
1621     case 0x2f: /* DSP[24:31] */
1622         s->dsp &= 0x00ffffff;
1623         s->dsp |= val << 24;
1624         if ((s->dmode & LSI_DMODE_MAN) == 0
1625             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1626             lsi_execute_script(s);
1627         break;
1628     CASE_SET_REG32(dsps, 0x30)
1629     CASE_SET_REG32(scratch[0], 0x34)
1630     case 0x38: /* DMODE */
1631         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1632             BADF("IO mappings not implemented\n");
1633         }
1634         s->dmode = val;
1635         break;
1636     case 0x39: /* DIEN */
1637         s->dien = val;
1638         lsi_update_irq(s);
1639         break;
1640     case 0x3a: /* SBR */
1641         s->sbr = val;
1642         break;
1643     case 0x3b: /* DCNTL */
1644         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1645         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1646             lsi_execute_script(s);
1647         break;
1648     case 0x40: /* SIEN0 */
1649         s->sien0 = val;
1650         lsi_update_irq(s);
1651         break;
1652     case 0x41: /* SIEN1 */
1653         s->sien1 = val;
1654         lsi_update_irq(s);
1655         break;
1656     case 0x47: /* GPCNTL0 */
1657         break;
1658     case 0x48: /* STIME0 */
1659         s->stime0 = val;
1660         break;
1661     case 0x49: /* STIME1 */
1662         if (val & 0xf) {
1663             DPRINTF("General purpose timer not implemented\n");
1664             /* ??? Raising the interrupt immediately seems to be sufficient
1665                to keep the FreeBSD driver happy.  */
1666             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1667         }
1668         break;
1669     case 0x4a: /* RESPID0 */
1670         s->respid0 = val;
1671         break;
1672     case 0x4b: /* RESPID1 */
1673         s->respid1 = val;
1674         break;
1675     case 0x4d: /* STEST1 */
1676         s->stest1 = val;
1677         break;
1678     case 0x4e: /* STEST2 */
1679         if (val & 1) {
1680             BADF("Low level mode not implemented\n");
1681         }
1682         s->stest2 = val;
1683         break;
1684     case 0x4f: /* STEST3 */
1685         if (val & 0x41) {
1686             BADF("SCSI FIFO test mode not implemented\n");
1687         }
1688         s->stest3 = val;
1689         break;
1690     case 0x56: /* CCNTL0 */
1691         s->ccntl0 = val;
1692         break;
1693     case 0x57: /* CCNTL1 */
1694         s->ccntl1 = val;
1695         break;
1696     CASE_SET_REG32(mmrs, 0xa0)
1697     CASE_SET_REG32(mmws, 0xa4)
1698     CASE_SET_REG32(sfs, 0xa8)
1699     CASE_SET_REG32(drs, 0xac)
1700     CASE_SET_REG32(sbms, 0xb0)
1701     CASE_SET_REG32(dbms, 0xb4)
1702     CASE_SET_REG32(dnad64, 0xb8)
1703     CASE_SET_REG32(pmjad1, 0xc0)
1704     CASE_SET_REG32(pmjad2, 0xc4)
1705     CASE_SET_REG32(rbc, 0xc8)
1706     CASE_SET_REG32(ua, 0xcc)
1707     CASE_SET_REG32(ia, 0xd4)
1708     CASE_SET_REG32(sbc, 0xd8)
1709     CASE_SET_REG32(csbc, 0xdc)
1710     default:
1711         if (offset >= 0x5c && offset < 0xa0) {
1712             int n;
1713             int shift;
1714             n = (offset - 0x58) >> 2;
1715             shift = (offset & 3) * 8;
1716             s->scratch[n] &= ~(0xff << shift);
1717             s->scratch[n] |= (val & 0xff) << shift;
1718         } else {
1719             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1720         }
1721     }
1722 #undef CASE_SET_REG24
1723 #undef CASE_SET_REG32
1724 }
1725
1726 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1727 {
1728     LSIState *s = opaque;
1729
1730     lsi_reg_writeb(s, addr & 0xff, val);
1731 }
1732
1733 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1734 {
1735     LSIState *s = opaque;
1736
1737     addr &= 0xff;
1738     lsi_reg_writeb(s, addr, val & 0xff);
1739     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1740 }
1741
1742 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1743 {
1744     LSIState *s = opaque;
1745
1746     addr &= 0xff;
1747     lsi_reg_writeb(s, addr, val & 0xff);
1748     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1749     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1750     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1751 }
1752
1753 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1754 {
1755     LSIState *s = opaque;
1756
1757     return lsi_reg_readb(s, addr & 0xff);
1758 }
1759
1760 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1761 {
1762     LSIState *s = opaque;
1763     uint32_t val;
1764
1765     addr &= 0xff;
1766     val = lsi_reg_readb(s, addr);
1767     val |= lsi_reg_readb(s, addr + 1) << 8;
1768     return val;
1769 }
1770
1771 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1772 {
1773     LSIState *s = opaque;
1774     uint32_t val;
1775     addr &= 0xff;
1776     val = lsi_reg_readb(s, addr);
1777     val |= lsi_reg_readb(s, addr + 1) << 8;
1778     val |= lsi_reg_readb(s, addr + 2) << 16;
1779     val |= lsi_reg_readb(s, addr + 3) << 24;
1780     return val;
1781 }
1782
1783 static CPUReadMemoryFunc * const lsi_mmio_readfn[3] = {
1784     lsi_mmio_readb,
1785     lsi_mmio_readw,
1786     lsi_mmio_readl,
1787 };
1788
1789 static CPUWriteMemoryFunc * const lsi_mmio_writefn[3] = {
1790     lsi_mmio_writeb,
1791     lsi_mmio_writew,
1792     lsi_mmio_writel,
1793 };
1794
1795 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1796 {
1797     LSIState *s = opaque;
1798     uint32_t newval;
1799     int shift;
1800
1801     addr &= 0x1fff;
1802     newval = s->script_ram[addr >> 2];
1803     shift = (addr & 3) * 8;
1804     newval &= ~(0xff << shift);
1805     newval |= val << shift;
1806     s->script_ram[addr >> 2] = newval;
1807 }
1808
1809 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1810 {
1811     LSIState *s = opaque;
1812     uint32_t newval;
1813
1814     addr &= 0x1fff;
1815     newval = s->script_ram[addr >> 2];
1816     if (addr & 2) {
1817         newval = (newval & 0xffff) | (val << 16);
1818     } else {
1819         newval = (newval & 0xffff0000) | val;
1820     }
1821     s->script_ram[addr >> 2] = newval;
1822 }
1823
1824
1825 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1826 {
1827     LSIState *s = opaque;
1828
1829     addr &= 0x1fff;
1830     s->script_ram[addr >> 2] = val;
1831 }
1832
1833 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1834 {
1835     LSIState *s = opaque;
1836     uint32_t val;
1837
1838     addr &= 0x1fff;
1839     val = s->script_ram[addr >> 2];
1840     val >>= (addr & 3) * 8;
1841     return val & 0xff;
1842 }
1843
1844 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1845 {
1846     LSIState *s = opaque;
1847     uint32_t val;
1848
1849     addr &= 0x1fff;
1850     val = s->script_ram[addr >> 2];
1851     if (addr & 2)
1852         val >>= 16;
1853     return le16_to_cpu(val);
1854 }
1855
1856 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1857 {
1858     LSIState *s = opaque;
1859
1860     addr &= 0x1fff;
1861     return le32_to_cpu(s->script_ram[addr >> 2]);
1862 }
1863
1864 static CPUReadMemoryFunc * const lsi_ram_readfn[3] = {
1865     lsi_ram_readb,
1866     lsi_ram_readw,
1867     lsi_ram_readl,
1868 };
1869
1870 static CPUWriteMemoryFunc * const lsi_ram_writefn[3] = {
1871     lsi_ram_writeb,
1872     lsi_ram_writew,
1873     lsi_ram_writel,
1874 };
1875
1876 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1877 {
1878     LSIState *s = opaque;
1879     return lsi_reg_readb(s, addr & 0xff);
1880 }
1881
1882 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1883 {
1884     LSIState *s = opaque;
1885     uint32_t val;
1886     addr &= 0xff;
1887     val = lsi_reg_readb(s, addr);
1888     val |= lsi_reg_readb(s, addr + 1) << 8;
1889     return val;
1890 }
1891
1892 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1893 {
1894     LSIState *s = opaque;
1895     uint32_t val;
1896     addr &= 0xff;
1897     val = lsi_reg_readb(s, addr);
1898     val |= lsi_reg_readb(s, addr + 1) << 8;
1899     val |= lsi_reg_readb(s, addr + 2) << 16;
1900     val |= lsi_reg_readb(s, addr + 3) << 24;
1901     return val;
1902 }
1903
1904 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1905 {
1906     LSIState *s = opaque;
1907     lsi_reg_writeb(s, addr & 0xff, val);
1908 }
1909
1910 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1911 {
1912     LSIState *s = opaque;
1913     addr &= 0xff;
1914     lsi_reg_writeb(s, addr, val & 0xff);
1915     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1916 }
1917
1918 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1919 {
1920     LSIState *s = opaque;
1921     addr &= 0xff;
1922     lsi_reg_writeb(s, addr, val & 0xff);
1923     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1924     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1925     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1926 }
1927
1928 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1929                            uint32_t addr, uint32_t size, int type)
1930 {
1931     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1932
1933     DPRINTF("Mapping IO at %08x\n", addr);
1934
1935     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1936     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1937     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1938     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1939     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1940     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1941 }
1942
1943 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1944                             uint32_t addr, uint32_t size, int type)
1945 {
1946     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1947
1948     DPRINTF("Mapping ram at %08x\n", addr);
1949     s->script_ram_base = addr;
1950     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1951 }
1952
1953 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1954                              uint32_t addr, uint32_t size, int type)
1955 {
1956     LSIState *s = DO_UPCAST(LSIState, dev, pci_dev);
1957
1958     DPRINTF("Mapping registers at %08x\n", addr);
1959     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1960 }
1961
1962 static void lsi_pre_save(void *opaque)
1963 {
1964     LSIState *s = opaque;
1965
1966     assert(s->dma_buf == NULL);
1967     assert(s->current_dma_len == 0);
1968     assert(s->active_commands == 0);
1969 }
1970
1971 static const VMStateDescription vmstate_lsi_scsi = {
1972     .name = "lsiscsi",
1973     .version_id = 0,
1974     .minimum_version_id = 0,
1975     .minimum_version_id_old = 0,
1976     .pre_save = lsi_pre_save,
1977     .fields      = (VMStateField []) {
1978         VMSTATE_PCI_DEVICE(dev, LSIState),
1979
1980         VMSTATE_INT32(carry, LSIState),
1981         VMSTATE_INT32(sense, LSIState),
1982         VMSTATE_INT32(msg_action, LSIState),
1983         VMSTATE_INT32(msg_len, LSIState),
1984         VMSTATE_BUFFER(msg, LSIState),
1985         VMSTATE_INT32(waiting, LSIState),
1986
1987         VMSTATE_UINT32(dsa, LSIState),
1988         VMSTATE_UINT32(temp, LSIState),
1989         VMSTATE_UINT32(dnad, LSIState),
1990         VMSTATE_UINT32(dbc, LSIState),
1991         VMSTATE_UINT8(istat0, LSIState),
1992         VMSTATE_UINT8(istat1, LSIState),
1993         VMSTATE_UINT8(dcmd, LSIState),
1994         VMSTATE_UINT8(dstat, LSIState),
1995         VMSTATE_UINT8(dien, LSIState),
1996         VMSTATE_UINT8(sist0, LSIState),
1997         VMSTATE_UINT8(sist1, LSIState),
1998         VMSTATE_UINT8(sien0, LSIState),
1999         VMSTATE_UINT8(sien1, LSIState),
2000         VMSTATE_UINT8(mbox0, LSIState),
2001         VMSTATE_UINT8(mbox1, LSIState),
2002         VMSTATE_UINT8(dfifo, LSIState),
2003         VMSTATE_UINT8(ctest2, LSIState),
2004         VMSTATE_UINT8(ctest3, LSIState),
2005         VMSTATE_UINT8(ctest4, LSIState),
2006         VMSTATE_UINT8(ctest5, LSIState),
2007         VMSTATE_UINT8(ccntl0, LSIState),
2008         VMSTATE_UINT8(ccntl1, LSIState),
2009         VMSTATE_UINT32(dsp, LSIState),
2010         VMSTATE_UINT32(dsps, LSIState),
2011         VMSTATE_UINT8(dmode, LSIState),
2012         VMSTATE_UINT8(dcntl, LSIState),
2013         VMSTATE_UINT8(scntl0, LSIState),
2014         VMSTATE_UINT8(scntl1, LSIState),
2015         VMSTATE_UINT8(scntl2, LSIState),
2016         VMSTATE_UINT8(scntl3, LSIState),
2017         VMSTATE_UINT8(sstat0, LSIState),
2018         VMSTATE_UINT8(sstat1, LSIState),
2019         VMSTATE_UINT8(scid, LSIState),
2020         VMSTATE_UINT8(sxfer, LSIState),
2021         VMSTATE_UINT8(socl, LSIState),
2022         VMSTATE_UINT8(sdid, LSIState),
2023         VMSTATE_UINT8(ssid, LSIState),
2024         VMSTATE_UINT8(sfbr, LSIState),
2025         VMSTATE_UINT8(stest1, LSIState),
2026         VMSTATE_UINT8(stest2, LSIState),
2027         VMSTATE_UINT8(stest3, LSIState),
2028         VMSTATE_UINT8(sidl, LSIState),
2029         VMSTATE_UINT8(stime0, LSIState),
2030         VMSTATE_UINT8(respid0, LSIState),
2031         VMSTATE_UINT8(respid1, LSIState),
2032         VMSTATE_UINT32(mmrs, LSIState),
2033         VMSTATE_UINT32(mmws, LSIState),
2034         VMSTATE_UINT32(sfs, LSIState),
2035         VMSTATE_UINT32(drs, LSIState),
2036         VMSTATE_UINT32(sbms, LSIState),
2037         VMSTATE_UINT32(dbms, LSIState),
2038         VMSTATE_UINT32(dnad64, LSIState),
2039         VMSTATE_UINT32(pmjad1, LSIState),
2040         VMSTATE_UINT32(pmjad2, LSIState),
2041         VMSTATE_UINT32(rbc, LSIState),
2042         VMSTATE_UINT32(ua, LSIState),
2043         VMSTATE_UINT32(ia, LSIState),
2044         VMSTATE_UINT32(sbc, LSIState),
2045         VMSTATE_UINT32(csbc, LSIState),
2046         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2047         VMSTATE_UINT8(sbr, LSIState),
2048
2049         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2050         VMSTATE_END_OF_LIST()
2051     }
2052 };
2053
2054 static int lsi_scsi_uninit(PCIDevice *d)
2055 {
2056     LSIState *s = DO_UPCAST(LSIState, dev, d);
2057
2058     cpu_unregister_io_memory(s->mmio_io_addr);
2059     cpu_unregister_io_memory(s->ram_io_addr);
2060
2061     qemu_free(s->queue);
2062
2063     return 0;
2064 }
2065
2066 static int lsi_scsi_init(PCIDevice *dev)
2067 {
2068     LSIState *s = DO_UPCAST(LSIState, dev, dev);
2069     uint8_t *pci_conf;
2070
2071     pci_conf = s->dev.config;
2072
2073     /* PCI Vendor ID (word) */
2074     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
2075     /* PCI device ID (word) */
2076     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
2077     /* PCI base class code */
2078     pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);
2079     /* PCI subsystem ID */
2080     pci_conf[0x2e] = 0x00;
2081     pci_conf[0x2f] = 0x10;
2082     /* PCI latency timer = 255 */
2083     pci_conf[0x0d] = 0xff;
2084     /* Interrupt pin 1 */
2085     pci_conf[0x3d] = 0x01;
2086
2087     s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,
2088                                              lsi_mmio_writefn, s);
2089     s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,
2090                                             lsi_ram_writefn, s);
2091
2092     pci_register_bar((struct PCIDevice *)s, 0, 256,
2093                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
2094     pci_register_bar((struct PCIDevice *)s, 1, 0x400,
2095                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
2096     pci_register_bar((struct PCIDevice *)s, 2, 0x2000,
2097                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
2098     s->queue = qemu_malloc(sizeof(lsi_queue));
2099     s->queue_len = 1;
2100     s->active_commands = 0;
2101
2102     lsi_soft_reset(s);
2103
2104     scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);
2105     if (!dev->qdev.hotplugged) {
2106         scsi_bus_legacy_handle_cmdline(&s->bus);
2107     }
2108     vmstate_register(-1, &vmstate_lsi_scsi, s);
2109     return 0;
2110 }
2111
2112 static PCIDeviceInfo lsi_info = {
2113     .qdev.name  = "lsi53c895a",
2114     .qdev.alias = "lsi",
2115     .qdev.size  = sizeof(LSIState),
2116     .init       = lsi_scsi_init,
2117     .exit       = lsi_scsi_uninit,
2118 };
2119
2120 static void lsi53c895a_register_devices(void)
2121 {
2122     pci_qdev_register(&lsi_info);
2123 }
2124
2125 device_init(lsi53c895a_register_devices);