hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include <assert.h>
  14
  15 #include "hw.h"
  16 #include "pci.h"
  17 #include "scsi.h"
  18 #include "block_int.h"
  19 #include "dma.h"
  20
  21 //#define DEBUG_LSI
  22 //#define DEBUG_LSI_REG
  23
  24 #ifdef DEBUG_LSI
  25 #define DPRINTF(fmt, ...) \
  26 do { printf("lsi_scsi: " fmt , ## __VA_ARGS__); } while (0)
  27 #define BADF(fmt, ...) \
  28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
  29 #else
  30 #define DPRINTF(fmt, ...) do {} while(0)
  31 #define BADF(fmt, ...) \
  32 do { fprintf(stderr, "lsi_scsi: error: " fmt , ## __VA_ARGS__);} while (0)
  33 #endif
  34
  35 #define LSI_MAX_DEVS 7
  36
  37 #define LSI_SCNTL0_TRG    0x01
  38 #define LSI_SCNTL0_AAP    0x02
  39 #define LSI_SCNTL0_EPC    0x08
  40 #define LSI_SCNTL0_WATN   0x10
  41 #define LSI_SCNTL0_START  0x20
  42
  43 #define LSI_SCNTL1_SST    0x01
  44 #define LSI_SCNTL1_IARB   0x02
  45 #define LSI_SCNTL1_AESP   0x04
  46 #define LSI_SCNTL1_RST    0x08
  47 #define LSI_SCNTL1_CON    0x10
  48 #define LSI_SCNTL1_DHP    0x20
  49 #define LSI_SCNTL1_ADB    0x40
  50 #define LSI_SCNTL1_EXC    0x80
  51
  52 #define LSI_SCNTL2_WSR    0x01
  53 #define LSI_SCNTL2_VUE0   0x02
  54 #define LSI_SCNTL2_VUE1   0x04
  55 #define LSI_SCNTL2_WSS    0x08
  56 #define LSI_SCNTL2_SLPHBEN 0x10
  57 #define LSI_SCNTL2_SLPMD  0x20
  58 #define LSI_SCNTL2_CHM    0x40
  59 #define LSI_SCNTL2_SDU    0x80
  60
  61 #define LSI_ISTAT0_DIP    0x01
  62 #define LSI_ISTAT0_SIP    0x02
  63 #define LSI_ISTAT0_INTF   0x04
  64 #define LSI_ISTAT0_CON    0x08
  65 #define LSI_ISTAT0_SEM    0x10
  66 #define LSI_ISTAT0_SIGP   0x20
  67 #define LSI_ISTAT0_SRST   0x40
  68 #define LSI_ISTAT0_ABRT   0x80
  69
  70 #define LSI_ISTAT1_SI     0x01
  71 #define LSI_ISTAT1_SRUN   0x02
  72 #define LSI_ISTAT1_FLSH   0x04
  73
  74 #define LSI_SSTAT0_SDP0   0x01
  75 #define LSI_SSTAT0_RST    0x02
  76 #define LSI_SSTAT0_WOA    0x04
  77 #define LSI_SSTAT0_LOA    0x08
  78 #define LSI_SSTAT0_AIP    0x10
  79 #define LSI_SSTAT0_OLF    0x20
  80 #define LSI_SSTAT0_ORF    0x40
  81 #define LSI_SSTAT0_ILF    0x80
  82
  83 #define LSI_SIST0_PAR     0x01
  84 #define LSI_SIST0_RST     0x02
  85 #define LSI_SIST0_UDC     0x04
  86 #define LSI_SIST0_SGE     0x08
  87 #define LSI_SIST0_RSL     0x10
  88 #define LSI_SIST0_SEL     0x20
  89 #define LSI_SIST0_CMP     0x40
  90 #define LSI_SIST0_MA      0x80
  91
  92 #define LSI_SIST1_HTH     0x01
  93 #define LSI_SIST1_GEN     0x02
  94 #define LSI_SIST1_STO     0x04
  95 #define LSI_SIST1_SBMC    0x10
  96
  97 #define LSI_SOCL_IO       0x01
  98 #define LSI_SOCL_CD       0x02
  99 #define LSI_SOCL_MSG      0x04
 100 #define LSI_SOCL_ATN      0x08
 101 #define LSI_SOCL_SEL      0x10
 102 #define LSI_SOCL_BSY      0x20
 103 #define LSI_SOCL_ACK      0x40
 104 #define LSI_SOCL_REQ      0x80
 105
 106 #define LSI_DSTAT_IID     0x01
 107 #define LSI_DSTAT_SIR     0x04
 108 #define LSI_DSTAT_SSI     0x08
 109 #define LSI_DSTAT_ABRT    0x10
 110 #define LSI_DSTAT_BF      0x20
 111 #define LSI_DSTAT_MDPE    0x40
 112 #define LSI_DSTAT_DFE     0x80
 113
 114 #define LSI_DCNTL_COM     0x01
 115 #define LSI_DCNTL_IRQD    0x02
 116 #define LSI_DCNTL_STD     0x04
 117 #define LSI_DCNTL_IRQM    0x08
 118 #define LSI_DCNTL_SSM     0x10
 119 #define LSI_DCNTL_PFEN    0x20
 120 #define LSI_DCNTL_PFF     0x40
 121 #define LSI_DCNTL_CLSE    0x80
 122
 123 #define LSI_DMODE_MAN     0x01
 124 #define LSI_DMODE_BOF     0x02
 125 #define LSI_DMODE_ERMP    0x04
 126 #define LSI_DMODE_ERL     0x08
 127 #define LSI_DMODE_DIOM    0x10
 128 #define LSI_DMODE_SIOM    0x20
 129
 130 #define LSI_CTEST2_DACK   0x01
 131 #define LSI_CTEST2_DREQ   0x02
 132 #define LSI_CTEST2_TEOP   0x04
 133 #define LSI_CTEST2_PCICIE 0x08
 134 #define LSI_CTEST2_CM     0x10
 135 #define LSI_CTEST2_CIO    0x20
 136 #define LSI_CTEST2_SIGP   0x40
 137 #define LSI_CTEST2_DDIR   0x80
 138
 139 #define LSI_CTEST5_BL2    0x04
 140 #define LSI_CTEST5_DDIR   0x08
 141 #define LSI_CTEST5_MASR   0x10
 142 #define LSI_CTEST5_DFSN   0x20
 143 #define LSI_CTEST5_BBCK   0x40
 144 #define LSI_CTEST5_ADCK   0x80
 145
 146 #define LSI_CCNTL0_DILS   0x01
 147 #define LSI_CCNTL0_DISFC  0x10
 148 #define LSI_CCNTL0_ENNDJ  0x20
 149 #define LSI_CCNTL0_PMJCTL 0x40
 150 #define LSI_CCNTL0_ENPMJ  0x80
 151
 152 #define LSI_CCNTL1_EN64DBMV  0x01
 153 #define LSI_CCNTL1_EN64TIBMV 0x02
 154 #define LSI_CCNTL1_64TIMOD   0x04
 155 #define LSI_CCNTL1_DDAC      0x08
 156 #define LSI_CCNTL1_ZMOD      0x80
 157
 158 /* Enable Response to Reselection */
 159 #define LSI_SCID_RRE      0x60
 160
 161 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 162
 163 #define PHASE_DO          0
 164 #define PHASE_DI          1
 165 #define PHASE_CMD         2
 166 #define PHASE_ST          3
 167 #define PHASE_MO          6
 168 #define PHASE_MI          7
 169 #define PHASE_MASK        7
 170
 171 /* Maximum length of MSG IN data.  */
 172 #define LSI_MAX_MSGIN_LEN 8
 173
 174 /* Flag set if this is a tagged command.  */
 175 #define LSI_TAG_VALID     (1 << 16)
 176
 177 typedef struct lsi_request {
 178     SCSIRequest *req;
 179     uint32_t tag;
 180     uint32_t dma_len;
 181     uint8_t *dma_buf;
 182     uint32_t pending;
 183     int out;
 184     QTAILQ_ENTRY(lsi_request) next;
 185 } lsi_request;
 186
 187 typedef struct {
 188     PCIDevice dev;
 189     MemoryRegion mmio_io;
 190     MemoryRegion ram_io;
 191     MemoryRegion io_io;
 192
 193     int carry; /* ??? Should this be an a visible register somewhere?  */
 194     int status;
 195     /* Action to take at the end of a MSG IN phase.
 196        0 = COMMAND, 1 = disconnect, 2 = DATA OUT, 3 = DATA IN.  */
 197     int msg_action;
 198     int msg_len;
 199     uint8_t msg[LSI_MAX_MSGIN_LEN];
 200     /* 0 if SCRIPTS are running or stopped.
 201      * 1 if a Wait Reselect instruction has been issued.
 202      * 2 if processing DMA from lsi_execute_script.
 203      * 3 if a DMA operation is in progress.  */
 204     int waiting;
 205     SCSIBus bus;
 206     int current_lun;
 207     /* The tag is a combination of the device ID and the SCSI tag.  */
 208     uint32_t select_tag;
 209     int command_complete;
 210     QTAILQ_HEAD(, lsi_request) queue;
 211     lsi_request *current;
 212
 213     uint32_t dsa;
 214     uint32_t temp;
 215     uint32_t dnad;
 216     uint32_t dbc;
 217     uint8_t istat0;
 218     uint8_t istat1;
 219     uint8_t dcmd;
 220     uint8_t dstat;
 221     uint8_t dien;
 222     uint8_t sist0;
 223     uint8_t sist1;
 224     uint8_t sien0;
 225     uint8_t sien1;
 226     uint8_t mbox0;
 227     uint8_t mbox1;
 228     uint8_t dfifo;
 229     uint8_t ctest2;
 230     uint8_t ctest3;
 231     uint8_t ctest4;
 232     uint8_t ctest5;
 233     uint8_t ccntl0;
 234     uint8_t ccntl1;
 235     uint32_t dsp;
 236     uint32_t dsps;
 237     uint8_t dmode;
 238     uint8_t dcntl;
 239     uint8_t scntl0;
 240     uint8_t scntl1;
 241     uint8_t scntl2;
 242     uint8_t scntl3;
 243     uint8_t sstat0;
 244     uint8_t sstat1;
 245     uint8_t scid;
 246     uint8_t sxfer;
 247     uint8_t socl;
 248     uint8_t sdid;
 249     uint8_t ssid;
 250     uint8_t sfbr;
 251     uint8_t stest1;
 252     uint8_t stest2;
 253     uint8_t stest3;
 254     uint8_t sidl;
 255     uint8_t stime0;
 256     uint8_t respid0;
 257     uint8_t respid1;
 258     uint32_t mmrs;
 259     uint32_t mmws;
 260     uint32_t sfs;
 261     uint32_t drs;
 262     uint32_t sbms;
 263     uint32_t dbms;
 264     uint32_t dnad64;
 265     uint32_t pmjad1;
 266     uint32_t pmjad2;
 267     uint32_t rbc;
 268     uint32_t ua;
 269     uint32_t ia;
 270     uint32_t sbc;
 271     uint32_t csbc;
 272     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 273     uint8_t sbr;
 274
 275     /* Script ram is stored as 32-bit words in host byteorder.  */
 276     uint32_t script_ram[2048];
 277 } LSIState;
 278
 279 static inline int lsi_irq_on_rsl(LSIState *s)
 280 {
 281     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
 282 }
 283
 284 static void lsi_soft_reset(LSIState *s)
 285 {
 286     lsi_request *p;
 287
 288     DPRINTF("Reset\n");
 289     s->carry = 0;
 290
 291     s->msg_action = 0;
 292     s->msg_len = 0;
 293     s->waiting = 0;
 294     s->dsa = 0;
 295     s->dnad = 0;
 296     s->dbc = 0;
 297     s->temp = 0;
 298     memset(s->scratch, 0, sizeof(s->scratch));
 299     s->istat0 = 0;
 300     s->istat1 = 0;
 301     s->dcmd = 0x40;
 302     s->dstat = LSI_DSTAT_DFE;
 303     s->dien = 0;
 304     s->sist0 = 0;
 305     s->sist1 = 0;
 306     s->sien0 = 0;
 307     s->sien1 = 0;
 308     s->mbox0 = 0;
 309     s->mbox1 = 0;
 310     s->dfifo = 0;
 311     s->ctest2 = LSI_CTEST2_DACK;
 312     s->ctest3 = 0;
 313     s->ctest4 = 0;
 314     s->ctest5 = 0;
 315     s->ccntl0 = 0;
 316     s->ccntl1 = 0;
 317     s->dsp = 0;
 318     s->dsps = 0;
 319     s->dmode = 0;
 320     s->dcntl = 0;
 321     s->scntl0 = 0xc0;
 322     s->scntl1 = 0;
 323     s->scntl2 = 0;
 324     s->scntl3 = 0;
 325     s->sstat0 = 0;
 326     s->sstat1 = 0;
 327     s->scid = 7;
 328     s->sxfer = 0;
 329     s->socl = 0;
 330     s->sdid = 0;
 331     s->ssid = 0;
 332     s->stest1 = 0;
 333     s->stest2 = 0;
 334     s->stest3 = 0;
 335     s->sidl = 0;
 336     s->stime0 = 0;
 337     s->respid0 = 0x80;
 338     s->respid1 = 0;
 339     s->mmrs = 0;
 340     s->mmws = 0;
 341     s->sfs = 0;
 342     s->drs = 0;
 343     s->sbms = 0;
 344     s->dbms = 0;
 345     s->dnad64 = 0;
 346     s->pmjad1 = 0;
 347     s->pmjad2 = 0;
 348     s->rbc = 0;
 349     s->ua = 0;
 350     s->ia = 0;
 351     s->sbc = 0;
 352     s->csbc = 0;
 353     s->sbr = 0;
 354     while (!QTAILQ_EMPTY(&s->queue)) {
 355         p = QTAILQ_FIRST(&s->queue);
 356         QTAILQ_REMOVE(&s->queue, p, next);
 357         g_free(p);
 358     }
 359     if (s->current) {
 360         g_free(s->current);
 361         s->current = NULL;
 362     }
 363 }
 364
 365 static int lsi_dma_40bit(LSIState *s)
 366 {
 367     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 368         return 1;
 369     return 0;
 370 }
 371
 372 static int lsi_dma_ti64bit(LSIState *s)
 373 {
 374     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 375         return 1;
 376     return 0;
 377 }
 378
 379 static int lsi_dma_64bit(LSIState *s)
 380 {
 381     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 382         return 1;
 383     return 0;
 384 }
 385
 386 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 387 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 388 static void lsi_execute_script(LSIState *s);
 389 static void lsi_reselect(LSIState *s, lsi_request *p);
 390
 391 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 392 {
 393     uint32_t buf;
 394
 395     pci_dma_read(&s->dev, addr, &buf, 4);
 396     return cpu_to_le32(buf);
 397 }
 398
 399 static void lsi_stop_script(LSIState *s)
 400 {
 401     s->istat1 &= ~LSI_ISTAT1_SRUN;
 402 }
 403
 404 static void lsi_update_irq(LSIState *s)
 405 {
 406     int level;
 407     static int last_level;
 408     lsi_request *p;
 409
 410     /* It's unclear whether the DIP/SIP bits should be cleared when the
 411        Interrupt Status Registers are cleared or when istat0 is read.
 412        We currently do the formwer, which seems to work.  */
 413     level = 0;
 414     if (s->dstat) {
 415         if (s->dstat & s->dien)
 416             level = 1;
 417         s->istat0 |= LSI_ISTAT0_DIP;
 418     } else {
 419         s->istat0 &= ~LSI_ISTAT0_DIP;
 420     }
 421
 422     if (s->sist0 || s->sist1) {
 423         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 424             level = 1;
 425         s->istat0 |= LSI_ISTAT0_SIP;
 426     } else {
 427         s->istat0 &= ~LSI_ISTAT0_SIP;
 428     }
 429     if (s->istat0 & LSI_ISTAT0_INTF)
 430         level = 1;
 431
 432     if (level != last_level) {
 433         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 434                 level, s->dstat, s->sist1, s->sist0);
 435         last_level = level;
 436     }
 437     qemu_set_irq(s->dev.irq[0], level);
 438
 439     if (!level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
 440         DPRINTF("Handled IRQs & disconnected, looking for pending "
 441                 "processes\n");
 442         QTAILQ_FOREACH(p, &s->queue, next) {
 443             if (p->pending) {
 444                 lsi_reselect(s, p);
 445                 break;
 446             }
 447         }
 448     }
 449 }
 450
 451 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 452 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 453 {
 454     uint32_t mask0;
 455     uint32_t mask1;
 456
 457     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 458             stat1, stat0, s->sist1, s->sist0);
 459     s->sist0 |= stat0;
 460     s->sist1 |= stat1;
 461     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 462        we don't stop processing when raising STO.  Instead continue
 463        execution and stop at the next insn that accesses the SCSI bus.  */
 464     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 465     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 466     mask1 &= ~LSI_SIST1_STO;
 467     if (s->sist0 & mask0 || s->sist1 & mask1) {
 468         lsi_stop_script(s);
 469     }
 470     lsi_update_irq(s);
 471 }
 472
 473 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 474 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 475 {
 476     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 477     s->dstat |= stat;
 478     lsi_update_irq(s);
 479     lsi_stop_script(s);
 480 }
 481
 482 static inline void lsi_set_phase(LSIState *s, int phase)
 483 {
 484     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 485 }
 486
 487 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 488 {
 489     /* Trigger a phase mismatch.  */
 490     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 491         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
 492             s->dsp = out ? s->pmjad1 : s->pmjad2;
 493         } else {
 494             s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
 495         }
 496         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 497     } else {
 498         DPRINTF("Phase mismatch interrupt\n");
 499         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 500         lsi_stop_script(s);
 501     }
 502     lsi_set_phase(s, new_phase);
 503 }
 504
 505
 506 /* Resume SCRIPTS execution after a DMA operation.  */
 507 static void lsi_resume_script(LSIState *s)
 508 {
 509     if (s->waiting != 2) {
 510         s->waiting = 0;
 511         lsi_execute_script(s);
 512     } else {
 513         s->waiting = 0;
 514     }
 515 }
 516
 517 static void lsi_disconnect(LSIState *s)
 518 {
 519     s->scntl1 &= ~LSI_SCNTL1_CON;
 520     s->sstat1 &= ~PHASE_MASK;
 521 }
 522
 523 static void lsi_bad_selection(LSIState *s, uint32_t id)
 524 {
 525     DPRINTF("Selected absent target %d\n", id);
 526     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 527     lsi_disconnect(s);
 528 }
 529
 530 /* Initiate a SCSI layer data transfer.  */
 531 static void lsi_do_dma(LSIState *s, int out)
 532 {
 533     uint32_t count;
 534     dma_addr_t addr;
 535     SCSIDevice *dev;
 536
 537     assert(s->current);
 538     if (!s->current->dma_len) {
 539         /* Wait until data is available.  */
 540         DPRINTF("DMA no data available\n");
 541         return;
 542     }
 543
 544     dev = s->current->req->dev;
 545     assert(dev);
 546
 547     count = s->dbc;
 548     if (count > s->current->dma_len)
 549         count = s->current->dma_len;
 550
 551     addr = s->dnad;
 552     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 553     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 554         addr |= ((uint64_t)s->dnad64 << 32);
 555     else if (s->dbms)
 556         addr |= ((uint64_t)s->dbms << 32);
 557     else if (s->sbms)
 558         addr |= ((uint64_t)s->sbms << 32);
 559
 560     DPRINTF("DMA addr=0x" DMA_ADDR_FMT " len=%d\n", addr, count);
 561     s->csbc += count;
 562     s->dnad += count;
 563     s->dbc -= count;
 564      if (s->current->dma_buf == NULL) {
 565         s->current->dma_buf = scsi_req_get_buf(s->current->req);
 566     }
 567     /* ??? Set SFBR to first data byte.  */
 568     if (out) {
 569         pci_dma_read(&s->dev, addr, s->current->dma_buf, count);
 570     } else {
 571         pci_dma_write(&s->dev, addr, s->current->dma_buf, count);
 572     }
 573     s->current->dma_len -= count;
 574     if (s->current->dma_len == 0) {
 575         s->current->dma_buf = NULL;
 576         scsi_req_continue(s->current->req);
 577     } else {
 578         s->current->dma_buf += count;
 579         lsi_resume_script(s);
 580     }
 581 }
 582
 583
 584 /* Add a command to the queue.  */
 585 static void lsi_queue_command(LSIState *s)
 586 {
 587     lsi_request *p = s->current;
 588
 589     DPRINTF("Queueing tag=0x%x\n", p->tag);
 590     assert(s->current != NULL);
 591     assert(s->current->dma_len == 0);
 592     QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
 593     s->current = NULL;
 594
 595     p->pending = 0;
 596     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 597 }
 598
 599 /* Queue a byte for a MSG IN phase.  */
 600 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 601 {
 602     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 603         BADF("MSG IN data too long\n");
 604     } else {
 605         DPRINTF("MSG IN 0x%02x\n", data);
 606         s->msg[s->msg_len++] = data;
 607     }
 608 }
 609
 610 /* Perform reselection to continue a command.  */
 611 static void lsi_reselect(LSIState *s, lsi_request *p)
 612 {
 613     int id;
 614
 615     assert(s->current == NULL);
 616     QTAILQ_REMOVE(&s->queue, p, next);
 617     s->current = p;
 618
 619     id = (p->tag >> 8) & 0xf;
 620     s->ssid = id | 0x80;
 621     /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
 622     if (!(s->dcntl & LSI_DCNTL_COM)) {
 623         s->sfbr = 1 << (id & 0x7);
 624     }
 625     DPRINTF("Reselected target %d\n", id);
 626     s->scntl1 |= LSI_SCNTL1_CON;
 627     lsi_set_phase(s, PHASE_MI);
 628     s->msg_action = p->out ? 2 : 3;
 629     s->current->dma_len = p->pending;
 630     lsi_add_msg_byte(s, 0x80);
 631     if (s->current->tag & LSI_TAG_VALID) {
 632         lsi_add_msg_byte(s, 0x20);
 633         lsi_add_msg_byte(s, p->tag & 0xff);
 634     }
 635
 636     if (lsi_irq_on_rsl(s)) {
 637         lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
 638     }
 639 }
 640
 641 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
 642 {
 643     lsi_request *p;
 644
 645     QTAILQ_FOREACH(p, &s->queue, next) {
 646         if (p->tag == tag) {
 647             return p;
 648         }
 649     }
 650
 651     return NULL;
 652 }
 653
 654 static void lsi_request_cancelled(SCSIRequest *req)
 655 {
 656     LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
 657     lsi_request *p = req->hba_private;
 658
 659     if (s->current && req == s->current->req) {
 660         scsi_req_unref(req);
 661         g_free(s->current);
 662         s->current = NULL;
 663         return;
 664     }
 665
 666     if (p) {
 667         QTAILQ_REMOVE(&s->queue, p, next);
 668         scsi_req_unref(req);
 669         g_free(p);
 670     }
 671 }
 672
 673 /* Record that data is available for a queued command.  Returns zero if
 674    the device was reselected, nonzero if the IO is deferred.  */
 675 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
 676 {
 677     lsi_request *p = req->hba_private;
 678
 679     if (p->pending) {
 680         BADF("Multiple IO pending for request %p\n", p);
 681     }
 682     p->pending = len;
 683     /* Reselect if waiting for it, or if reselection triggers an IRQ
 684        and the bus is free.
 685        Since no interrupt stacking is implemented in the emulation, it
 686        is also required that there are no pending interrupts waiting
 687        for service from the device driver. */
 688     if (s->waiting == 1 ||
 689         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
 690          !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
 691         /* Reselect device.  */
 692         lsi_reselect(s, p);
 693         return 0;
 694     } else {
 695         DPRINTF("Queueing IO tag=0x%x\n", p->tag);
 696         p->pending = len;
 697         return 1;
 698     }
 699 }
 700
 701  /* Callback to indicate that the SCSI layer has completed a command.  */
 702 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 703 {
 704     LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
 705     int out;
 706
 707     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 708     DPRINTF("Command complete status=%d\n", (int)status);
 709     s->status = status;
 710     s->command_complete = 2;
 711     if (s->waiting && s->dbc != 0) {
 712         /* Raise phase mismatch for short transfers.  */
 713         lsi_bad_phase(s, out, PHASE_ST);
 714     } else {
 715         lsi_set_phase(s, PHASE_ST);
 716     }
 717
 718     if (s->current && req == s->current->req) {
 719         scsi_req_unref(s->current->req);
 720         g_free(s->current);
 721         s->current = NULL;
 722     }
 723     lsi_resume_script(s);
 724 }
 725
 726  /* Callback to indicate that the SCSI layer has completed a transfer.  */
 727 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
 728 {
 729     LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);
 730     int out;
 731
 732     if (s->waiting == 1 || !s->current || req->hba_private != s->current ||
 733         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
 734         if (lsi_queue_req(s, req, len)) {
 735             return;
 736         }
 737     }
 738
 739     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 740
 741     /* host adapter (re)connected */
 742     DPRINTF("Data ready tag=0x%x len=%d\n", req->tag, len);
 743     s->current->dma_len = len;
 744     s->command_complete = 1;
 745     if (s->waiting) {
 746         if (s->waiting == 1 || s->dbc == 0) {
 747             lsi_resume_script(s);
 748         } else {
 749             lsi_do_dma(s, out);
 750         }
 751     }
 752 }
 753
 754 static void lsi_do_command(LSIState *s)
 755 {
 756     SCSIDevice *dev;
 757     uint8_t buf[16];
 758     uint32_t id;
 759     int n;
 760
 761     DPRINTF("Send command len=%d\n", s->dbc);
 762     if (s->dbc > 16)
 763         s->dbc = 16;
 764     pci_dma_read(&s->dev, s->dnad, buf, s->dbc);
 765     s->sfbr = buf[0];
 766     s->command_complete = 0;
 767
 768     id = (s->select_tag >> 8) & 0xf;
 769     dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
 770     if (!dev) {
 771         lsi_bad_selection(s, id);
 772         return;
 773     }
 774
 775     assert(s->current == NULL);
 776     s->current = g_malloc0(sizeof(lsi_request));
 777     s->current->tag = s->select_tag;
 778     s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
 779                                    s->current);
 780
 781     n = scsi_req_enqueue(s->current->req);
 782     if (n) {
 783         if (n > 0) {
 784             lsi_set_phase(s, PHASE_DI);
 785         } else if (n < 0) {
 786             lsi_set_phase(s, PHASE_DO);
 787         }
 788         scsi_req_continue(s->current->req);
 789     }
 790     if (!s->command_complete) {
 791         if (n) {
 792             /* Command did not complete immediately so disconnect.  */
 793             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 794             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 795             /* wait data */
 796             lsi_set_phase(s, PHASE_MI);
 797             s->msg_action = 1;
 798             lsi_queue_command(s);
 799         } else {
 800             /* wait command complete */
 801             lsi_set_phase(s, PHASE_DI);
 802         }
 803     }
 804 }
 805
 806 static void lsi_do_status(LSIState *s)
 807 {
 808     uint8_t status;
 809     DPRINTF("Get status len=%d status=%d\n", s->dbc, s->status);
 810     if (s->dbc != 1)
 811         BADF("Bad Status move\n");
 812     s->dbc = 1;
 813     status = s->status;
 814     s->sfbr = status;
 815     pci_dma_write(&s->dev, s->dnad, &status, 1);
 816     lsi_set_phase(s, PHASE_MI);
 817     s->msg_action = 1;
 818     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 819 }
 820
 821 static void lsi_do_msgin(LSIState *s)
 822 {
 823     int len;
 824     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 825     s->sfbr = s->msg[0];
 826     len = s->msg_len;
 827     if (len > s->dbc)
 828         len = s->dbc;
 829     pci_dma_write(&s->dev, s->dnad, s->msg, len);
 830     /* Linux drivers rely on the last byte being in the SIDL.  */
 831     s->sidl = s->msg[len - 1];
 832     s->msg_len -= len;
 833     if (s->msg_len) {
 834         memmove(s->msg, s->msg + len, s->msg_len);
 835     } else {
 836         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 837            switch to PHASE_MO.  */
 838         switch (s->msg_action) {
 839         case 0:
 840             lsi_set_phase(s, PHASE_CMD);
 841             break;
 842         case 1:
 843             lsi_disconnect(s);
 844             break;
 845         case 2:
 846             lsi_set_phase(s, PHASE_DO);
 847             break;
 848         case 3:
 849             lsi_set_phase(s, PHASE_DI);
 850             break;
 851         default:
 852             abort();
 853         }
 854     }
 855 }
 856
 857 /* Read the next byte during a MSGOUT phase.  */
 858 static uint8_t lsi_get_msgbyte(LSIState *s)
 859 {
 860     uint8_t data;
 861     pci_dma_read(&s->dev, s->dnad, &data, 1);
 862     s->dnad++;
 863     s->dbc--;
 864     return data;
 865 }
 866
 867 /* Skip the next n bytes during a MSGOUT phase. */
 868 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
 869 {
 870     s->dnad += n;
 871     s->dbc  -= n;
 872 }
 873
 874 static void lsi_do_msgout(LSIState *s)
 875 {
 876     uint8_t msg;
 877     int len;
 878     uint32_t current_tag;
 879     lsi_request *current_req, *p, *p_next;
 880
 881     if (s->current) {
 882         current_tag = s->current->tag;
 883         current_req = s->current;
 884     } else {
 885         current_tag = s->select_tag;
 886         current_req = lsi_find_by_tag(s, current_tag);
 887     }
 888
 889     DPRINTF("MSG out len=%d\n", s->dbc);
 890     while (s->dbc) {
 891         msg = lsi_get_msgbyte(s);
 892         s->sfbr = msg;
 893
 894         switch (msg) {
 895         case 0x04:
 896             DPRINTF("MSG: Disconnect\n");
 897             lsi_disconnect(s);
 898             break;
 899         case 0x08:
 900             DPRINTF("MSG: No Operation\n");
 901             lsi_set_phase(s, PHASE_CMD);
 902             break;
 903         case 0x01:
 904             len = lsi_get_msgbyte(s);
 905             msg = lsi_get_msgbyte(s);
 906             (void)len; /* avoid a warning about unused variable*/
 907             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 908             switch (msg) {
 909             case 1:
 910                 DPRINTF("SDTR (ignored)\n");
 911                 lsi_skip_msgbytes(s, 2);
 912                 break;
 913             case 3:
 914                 DPRINTF("WDTR (ignored)\n");
 915                 lsi_skip_msgbytes(s, 1);
 916                 break;
 917             default:
 918                 goto bad;
 919             }
 920             break;
 921         case 0x20: /* SIMPLE queue */
 922             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 923             DPRINTF("SIMPLE queue tag=0x%x\n", s->select_tag & 0xff);
 924             break;
 925         case 0x21: /* HEAD of queue */
 926             BADF("HEAD queue not implemented\n");
 927             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 928             break;
 929         case 0x22: /* ORDERED queue */
 930             BADF("ORDERED queue not implemented\n");
 931             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 932             break;
 933         case 0x0d:
 934             /* The ABORT TAG message clears the current I/O process only. */
 935             DPRINTF("MSG: ABORT TAG tag=0x%x\n", current_tag);
 936             if (current_req) {
 937                 scsi_req_cancel(current_req->req);
 938             }
 939             lsi_disconnect(s);
 940             break;
 941         case 0x06:
 942         case 0x0e:
 943         case 0x0c:
 944             /* The ABORT message clears all I/O processes for the selecting
 945                initiator on the specified logical unit of the target. */
 946             if (msg == 0x06) {
 947                 DPRINTF("MSG: ABORT tag=0x%x\n", current_tag);
 948             }
 949             /* The CLEAR QUEUE message clears all I/O processes for all
 950                initiators on the specified logical unit of the target. */
 951             if (msg == 0x0e) {
 952                 DPRINTF("MSG: CLEAR QUEUE tag=0x%x\n", current_tag);
 953             }
 954             /* The BUS DEVICE RESET message clears all I/O processes for all
 955                initiators on all logical units of the target. */
 956             if (msg == 0x0c) {
 957                 DPRINTF("MSG: BUS DEVICE RESET tag=0x%x\n", current_tag);
 958             }
 959
 960             /* clear the current I/O process */
 961             if (s->current) {
 962                 scsi_req_cancel(s->current->req);
 963             }
 964
 965             /* As the current implemented devices scsi_disk and scsi_generic
 966                only support one LUN, we don't need to keep track of LUNs.
 967                Clearing I/O processes for other initiators could be possible
 968                for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
 969                device, but this is currently not implemented (and seems not
 970                to be really necessary). So let's simply clear all queued
 971                commands for the current device: */
 972             QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
 973                 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
 974                     scsi_req_cancel(p->req);
 975                 }
 976             }
 977
 978             lsi_disconnect(s);
 979             break;
 980         default:
 981             if ((msg & 0x80) == 0) {
 982                 goto bad;
 983             }
 984             s->current_lun = msg & 7;
 985             DPRINTF("Select LUN %d\n", s->current_lun);
 986             lsi_set_phase(s, PHASE_CMD);
 987             break;
 988         }
 989     }
 990     return;
 991 bad:
 992     BADF("Unimplemented message 0x%02x\n", msg);
 993     lsi_set_phase(s, PHASE_MI);
 994     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 995     s->msg_action = 0;
 996 }
 997
 998 /* Sign extend a 24-bit value.  */
 999 static inline int32_t sxt24(int32_t n)
1000 {
1001     return (n << 8) >> 8;
1002 }
1003
1004 #define LSI_BUF_SIZE 4096
1005 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1006 {
1007     int n;
1008     uint8_t buf[LSI_BUF_SIZE];
1009
1010     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
1011     while (count) {
1012         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1013         pci_dma_read(&s->dev, src, buf, n);
1014         pci_dma_write(&s->dev, dest, buf, n);
1015         src += n;
1016         dest += n;
1017         count -= n;
1018     }
1019 }
1020
1021 static void lsi_wait_reselect(LSIState *s)
1022 {
1023     lsi_request *p;
1024
1025     DPRINTF("Wait Reselect\n");
1026
1027     QTAILQ_FOREACH(p, &s->queue, next) {
1028         if (p->pending) {
1029             lsi_reselect(s, p);
1030             break;
1031         }
1032     }
1033     if (s->current == NULL) {
1034         s->waiting = 1;
1035     }
1036 }
1037
1038 static void lsi_execute_script(LSIState *s)
1039 {
1040     uint32_t insn;
1041     uint32_t addr, addr_high;
1042     int opcode;
1043     int insn_processed = 0;
1044
1045     s->istat1 |= LSI_ISTAT1_SRUN;
1046 again:
1047     insn_processed++;
1048     insn = read_dword(s, s->dsp);
1049     if (!insn) {
1050         /* If we receive an empty opcode increment the DSP by 4 bytes
1051            instead of 8 and execute the next opcode at that location */
1052         s->dsp += 4;
1053         goto again;
1054     }
1055     addr = read_dword(s, s->dsp + 4);
1056     addr_high = 0;
1057     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
1058     s->dsps = addr;
1059     s->dcmd = insn >> 24;
1060     s->dsp += 8;
1061     switch (insn >> 30) {
1062     case 0: /* Block move.  */
1063         if (s->sist1 & LSI_SIST1_STO) {
1064             DPRINTF("Delayed select timeout\n");
1065             lsi_stop_script(s);
1066             break;
1067         }
1068         s->dbc = insn & 0xffffff;
1069         s->rbc = s->dbc;
1070         /* ??? Set ESA.  */
1071         s->ia = s->dsp - 8;
1072         if (insn & (1 << 29)) {
1073             /* Indirect addressing.  */
1074             addr = read_dword(s, addr);
1075         } else if (insn & (1 << 28)) {
1076             uint32_t buf[2];
1077             int32_t offset;
1078             /* Table indirect addressing.  */
1079
1080             /* 32-bit Table indirect */
1081             offset = sxt24(addr);
1082             pci_dma_read(&s->dev, s->dsa + offset, buf, 8);
1083             /* byte count is stored in bits 0:23 only */
1084             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1085             s->rbc = s->dbc;
1086             addr = cpu_to_le32(buf[1]);
1087
1088             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1089              * table, bits [31:24] */
1090             if (lsi_dma_40bit(s))
1091                 addr_high = cpu_to_le32(buf[0]) >> 24;
1092             else if (lsi_dma_ti64bit(s)) {
1093                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1094                 switch (selector) {
1095                 case 0 ... 0x0f:
1096                     /* offset index into scratch registers since
1097                      * TI64 mode can use registers C to R */
1098                     addr_high = s->scratch[2 + selector];
1099                     break;
1100                 case 0x10:
1101                     addr_high = s->mmrs;
1102                     break;
1103                 case 0x11:
1104                     addr_high = s->mmws;
1105                     break;
1106                 case 0x12:
1107                     addr_high = s->sfs;
1108                     break;
1109                 case 0x13:
1110                     addr_high = s->drs;
1111                     break;
1112                 case 0x14:
1113                     addr_high = s->sbms;
1114                     break;
1115                 case 0x15:
1116                     addr_high = s->dbms;
1117                     break;
1118                 default:
1119                     BADF("Illegal selector specified (0x%x > 0x15)"
1120                          " for 64-bit DMA block move", selector);
1121                     break;
1122                 }
1123             }
1124         } else if (lsi_dma_64bit(s)) {
1125             /* fetch a 3rd dword if 64-bit direct move is enabled and
1126                only if we're not doing table indirect or indirect addressing */
1127             s->dbms = read_dword(s, s->dsp);
1128             s->dsp += 4;
1129             s->ia = s->dsp - 12;
1130         }
1131         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1132             DPRINTF("Wrong phase got %d expected %d\n",
1133                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
1134             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1135             break;
1136         }
1137         s->dnad = addr;
1138         s->dnad64 = addr_high;
1139         switch (s->sstat1 & 0x7) {
1140         case PHASE_DO:
1141             s->waiting = 2;
1142             lsi_do_dma(s, 1);
1143             if (s->waiting)
1144                 s->waiting = 3;
1145             break;
1146         case PHASE_DI:
1147             s->waiting = 2;
1148             lsi_do_dma(s, 0);
1149             if (s->waiting)
1150                 s->waiting = 3;
1151             break;
1152         case PHASE_CMD:
1153             lsi_do_command(s);
1154             break;
1155         case PHASE_ST:
1156             lsi_do_status(s);
1157             break;
1158         case PHASE_MO:
1159             lsi_do_msgout(s);
1160             break;
1161         case PHASE_MI:
1162             lsi_do_msgin(s);
1163             break;
1164         default:
1165             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1166             exit(1);
1167         }
1168         s->dfifo = s->dbc & 0xff;
1169         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1170         s->sbc = s->dbc;
1171         s->rbc -= s->dbc;
1172         s->ua = addr + s->dbc;
1173         break;
1174
1175     case 1: /* IO or Read/Write instruction.  */
1176         opcode = (insn >> 27) & 7;
1177         if (opcode < 5) {
1178             uint32_t id;
1179
1180             if (insn & (1 << 25)) {
1181                 id = read_dword(s, s->dsa + sxt24(insn));
1182             } else {
1183                 id = insn;
1184             }
1185             id = (id >> 16) & 0xf;
1186             if (insn & (1 << 26)) {
1187                 addr = s->dsp + sxt24(addr);
1188             }
1189             s->dnad = addr;
1190             switch (opcode) {
1191             case 0: /* Select */
1192                 s->sdid = id;
1193                 if (s->scntl1 & LSI_SCNTL1_CON) {
1194                     DPRINTF("Already reselected, jumping to alternative address\n");
1195                     s->dsp = s->dnad;
1196                     break;
1197                 }
1198                 s->sstat0 |= LSI_SSTAT0_WOA;
1199                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1200                 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1201                     lsi_bad_selection(s, id);
1202                     break;
1203                 }
1204                 DPRINTF("Selected target %d%s\n",
1205                         id, insn & (1 << 3) ? " ATN" : "");
1206                 /* ??? Linux drivers compain when this is set.  Maybe
1207                    it only applies in low-level mode (unimplemented).
1208                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1209                 s->select_tag = id << 8;
1210                 s->scntl1 |= LSI_SCNTL1_CON;
1211                 if (insn & (1 << 3)) {
1212                     s->socl |= LSI_SOCL_ATN;
1213                 }
1214                 lsi_set_phase(s, PHASE_MO);
1215                 break;
1216             case 1: /* Disconnect */
1217                 DPRINTF("Wait Disconnect\n");
1218                 s->scntl1 &= ~LSI_SCNTL1_CON;
1219                 break;
1220             case 2: /* Wait Reselect */
1221                 if (!lsi_irq_on_rsl(s)) {
1222                     lsi_wait_reselect(s);
1223                 }
1224                 break;
1225             case 3: /* Set */
1226                 DPRINTF("Set%s%s%s%s\n",
1227                         insn & (1 << 3) ? " ATN" : "",
1228                         insn & (1 << 6) ? " ACK" : "",
1229                         insn & (1 << 9) ? " TM" : "",
1230                         insn & (1 << 10) ? " CC" : "");
1231                 if (insn & (1 << 3)) {
1232                     s->socl |= LSI_SOCL_ATN;
1233                     lsi_set_phase(s, PHASE_MO);
1234                 }
1235                 if (insn & (1 << 9)) {
1236                     BADF("Target mode not implemented\n");
1237                     exit(1);
1238                 }
1239                 if (insn & (1 << 10))
1240                     s->carry = 1;
1241                 break;
1242             case 4: /* Clear */
1243                 DPRINTF("Clear%s%s%s%s\n",
1244                         insn & (1 << 3) ? " ATN" : "",
1245                         insn & (1 << 6) ? " ACK" : "",
1246                         insn & (1 << 9) ? " TM" : "",
1247                         insn & (1 << 10) ? " CC" : "");
1248                 if (insn & (1 << 3)) {
1249                     s->socl &= ~LSI_SOCL_ATN;
1250                 }
1251                 if (insn & (1 << 10))
1252                     s->carry = 0;
1253                 break;
1254             }
1255         } else {
1256             uint8_t op0;
1257             uint8_t op1;
1258             uint8_t data8;
1259             int reg;
1260             int operator;
1261 #ifdef DEBUG_LSI
1262             static const char *opcode_names[3] =
1263                 {"Write", "Read", "Read-Modify-Write"};
1264             static const char *operator_names[8] =
1265                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1266 #endif
1267
1268             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1269             data8 = (insn >> 8) & 0xff;
1270             opcode = (insn >> 27) & 7;
1271             operator = (insn >> 24) & 7;
1272             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1273                     opcode_names[opcode - 5], reg,
1274                     operator_names[operator], data8, s->sfbr,
1275                     (insn & (1 << 23)) ? " SFBR" : "");
1276             op0 = op1 = 0;
1277             switch (opcode) {
1278             case 5: /* From SFBR */
1279                 op0 = s->sfbr;
1280                 op1 = data8;
1281                 break;
1282             case 6: /* To SFBR */
1283                 if (operator)
1284                     op0 = lsi_reg_readb(s, reg);
1285                 op1 = data8;
1286                 break;
1287             case 7: /* Read-modify-write */
1288                 if (operator)
1289                     op0 = lsi_reg_readb(s, reg);
1290                 if (insn & (1 << 23)) {
1291                     op1 = s->sfbr;
1292                 } else {
1293                     op1 = data8;
1294                 }
1295                 break;
1296             }
1297
1298             switch (operator) {
1299             case 0: /* move */
1300                 op0 = op1;
1301                 break;
1302             case 1: /* Shift left */
1303                 op1 = op0 >> 7;
1304                 op0 = (op0 << 1) | s->carry;
1305                 s->carry = op1;
1306                 break;
1307             case 2: /* OR */
1308                 op0 |= op1;
1309                 break;
1310             case 3: /* XOR */
1311                 op0 ^= op1;
1312                 break;
1313             case 4: /* AND */
1314                 op0 &= op1;
1315                 break;
1316             case 5: /* SHR */
1317                 op1 = op0 & 1;
1318                 op0 = (op0 >> 1) | (s->carry << 7);
1319                 s->carry = op1;
1320                 break;
1321             case 6: /* ADD */
1322                 op0 += op1;
1323                 s->carry = op0 < op1;
1324                 break;
1325             case 7: /* ADC */
1326                 op0 += op1 + s->carry;
1327                 if (s->carry)
1328                     s->carry = op0 <= op1;
1329                 else
1330                     s->carry = op0 < op1;
1331                 break;
1332             }
1333
1334             switch (opcode) {
1335             case 5: /* From SFBR */
1336             case 7: /* Read-modify-write */
1337                 lsi_reg_writeb(s, reg, op0);
1338                 break;
1339             case 6: /* To SFBR */
1340                 s->sfbr = op0;
1341                 break;
1342             }
1343         }
1344         break;
1345
1346     case 2: /* Transfer Control.  */
1347         {
1348             int cond;
1349             int jmp;
1350
1351             if ((insn & 0x002e0000) == 0) {
1352                 DPRINTF("NOP\n");
1353                 break;
1354             }
1355             if (s->sist1 & LSI_SIST1_STO) {
1356                 DPRINTF("Delayed select timeout\n");
1357                 lsi_stop_script(s);
1358                 break;
1359             }
1360             cond = jmp = (insn & (1 << 19)) != 0;
1361             if (cond == jmp && (insn & (1 << 21))) {
1362                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1363                 cond = s->carry != 0;
1364             }
1365             if (cond == jmp && (insn & (1 << 17))) {
1366                 DPRINTF("Compare phase %d %c= %d\n",
1367                         (s->sstat1 & PHASE_MASK),
1368                         jmp ? '=' : '!',
1369                         ((insn >> 24) & 7));
1370                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1371             }
1372             if (cond == jmp && (insn & (1 << 18))) {
1373                 uint8_t mask;
1374
1375                 mask = (~insn >> 8) & 0xff;
1376                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1377                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1378                 cond = (s->sfbr & mask) == (insn & mask);
1379             }
1380             if (cond == jmp) {
1381                 if (insn & (1 << 23)) {
1382                     /* Relative address.  */
1383                     addr = s->dsp + sxt24(addr);
1384                 }
1385                 switch ((insn >> 27) & 7) {
1386                 case 0: /* Jump */
1387                     DPRINTF("Jump to 0x%08x\n", addr);
1388                     s->dsp = addr;
1389                     break;
1390                 case 1: /* Call */
1391                     DPRINTF("Call 0x%08x\n", addr);
1392                     s->temp = s->dsp;
1393                     s->dsp = addr;
1394                     break;
1395                 case 2: /* Return */
1396                     DPRINTF("Return to 0x%08x\n", s->temp);
1397                     s->dsp = s->temp;
1398                     break;
1399                 case 3: /* Interrupt */
1400                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1401                     if ((insn & (1 << 20)) != 0) {
1402                         s->istat0 |= LSI_ISTAT0_INTF;
1403                         lsi_update_irq(s);
1404                     } else {
1405                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1406                     }
1407                     break;
1408                 default:
1409                     DPRINTF("Illegal transfer control\n");
1410                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1411                     break;
1412                 }
1413             } else {
1414                 DPRINTF("Control condition failed\n");
1415             }
1416         }
1417         break;
1418
1419     case 3:
1420         if ((insn & (1 << 29)) == 0) {
1421             /* Memory move.  */
1422             uint32_t dest;
1423             /* ??? The docs imply the destination address is loaded into
1424                the TEMP register.  However the Linux drivers rely on
1425                the value being presrved.  */
1426             dest = read_dword(s, s->dsp);
1427             s->dsp += 4;
1428             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1429         } else {
1430             uint8_t data[7];
1431             int reg;
1432             int n;
1433             int i;
1434
1435             if (insn & (1 << 28)) {
1436                 addr = s->dsa + sxt24(addr);
1437             }
1438             n = (insn & 7);
1439             reg = (insn >> 16) & 0xff;
1440             if (insn & (1 << 24)) {
1441                 pci_dma_read(&s->dev, addr, data, n);
1442                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1443                         addr, *(int *)data);
1444                 for (i = 0; i < n; i++) {
1445                     lsi_reg_writeb(s, reg + i, data[i]);
1446                 }
1447             } else {
1448                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1449                 for (i = 0; i < n; i++) {
1450                     data[i] = lsi_reg_readb(s, reg + i);
1451                 }
1452                 pci_dma_write(&s->dev, addr, data, n);
1453             }
1454         }
1455     }
1456     if (insn_processed > 10000 && !s->waiting) {
1457         /* Some windows drivers make the device spin waiting for a memory
1458            location to change.  If we have been executed a lot of code then
1459            assume this is the case and force an unexpected device disconnect.
1460            This is apparently sufficient to beat the drivers into submission.
1461          */
1462         if (!(s->sien0 & LSI_SIST0_UDC))
1463             fprintf(stderr, "inf. loop with UDC masked\n");
1464         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1465         lsi_disconnect(s);
1466     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1467         if (s->dcntl & LSI_DCNTL_SSM) {
1468             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1469         } else {
1470             goto again;
1471         }
1472     }
1473     DPRINTF("SCRIPTS execution stopped\n");
1474 }
1475
1476 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1477 {
1478     uint8_t tmp;
1479 #define CASE_GET_REG24(name, addr) \
1480     case addr: return s->name & 0xff; \
1481     case addr + 1: return (s->name >> 8) & 0xff; \
1482     case addr + 2: return (s->name >> 16) & 0xff;
1483
1484 #define CASE_GET_REG32(name, addr) \
1485     case addr: return s->name & 0xff; \
1486     case addr + 1: return (s->name >> 8) & 0xff; \
1487     case addr + 2: return (s->name >> 16) & 0xff; \
1488     case addr + 3: return (s->name >> 24) & 0xff;
1489
1490 #ifdef DEBUG_LSI_REG
1491     DPRINTF("Read reg %x\n", offset);
1492 #endif
1493     switch (offset) {
1494     case 0x00: /* SCNTL0 */
1495         return s->scntl0;
1496     case 0x01: /* SCNTL1 */
1497         return s->scntl1;
1498     case 0x02: /* SCNTL2 */
1499         return s->scntl2;
1500     case 0x03: /* SCNTL3 */
1501         return s->scntl3;
1502     case 0x04: /* SCID */
1503         return s->scid;
1504     case 0x05: /* SXFER */
1505         return s->sxfer;
1506     case 0x06: /* SDID */
1507         return s->sdid;
1508     case 0x07: /* GPREG0 */
1509         return 0x7f;
1510     case 0x08: /* Revision ID */
1511         return 0x00;
1512     case 0xa: /* SSID */
1513         return s->ssid;
1514     case 0xb: /* SBCL */
1515         /* ??? This is not correct. However it's (hopefully) only
1516            used for diagnostics, so should be ok.  */
1517         return 0;
1518     case 0xc: /* DSTAT */
1519         tmp = s->dstat | 0x80;
1520         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1521             s->dstat = 0;
1522         lsi_update_irq(s);
1523         return tmp;
1524     case 0x0d: /* SSTAT0 */
1525         return s->sstat0;
1526     case 0x0e: /* SSTAT1 */
1527         return s->sstat1;
1528     case 0x0f: /* SSTAT2 */
1529         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1530     CASE_GET_REG32(dsa, 0x10)
1531     case 0x14: /* ISTAT0 */
1532         return s->istat0;
1533     case 0x15: /* ISTAT1 */
1534         return s->istat1;
1535     case 0x16: /* MBOX0 */
1536         return s->mbox0;
1537     case 0x17: /* MBOX1 */
1538         return s->mbox1;
1539     case 0x18: /* CTEST0 */
1540         return 0xff;
1541     case 0x19: /* CTEST1 */
1542         return 0;
1543     case 0x1a: /* CTEST2 */
1544         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1545         if (s->istat0 & LSI_ISTAT0_SIGP) {
1546             s->istat0 &= ~LSI_ISTAT0_SIGP;
1547             tmp |= LSI_CTEST2_SIGP;
1548         }
1549         return tmp;
1550     case 0x1b: /* CTEST3 */
1551         return s->ctest3;
1552     CASE_GET_REG32(temp, 0x1c)
1553     case 0x20: /* DFIFO */
1554         return 0;
1555     case 0x21: /* CTEST4 */
1556         return s->ctest4;
1557     case 0x22: /* CTEST5 */
1558         return s->ctest5;
1559     case 0x23: /* CTEST6 */
1560          return 0;
1561     CASE_GET_REG24(dbc, 0x24)
1562     case 0x27: /* DCMD */
1563         return s->dcmd;
1564     CASE_GET_REG32(dnad, 0x28)
1565     CASE_GET_REG32(dsp, 0x2c)
1566     CASE_GET_REG32(dsps, 0x30)
1567     CASE_GET_REG32(scratch[0], 0x34)
1568     case 0x38: /* DMODE */
1569         return s->dmode;
1570     case 0x39: /* DIEN */
1571         return s->dien;
1572     case 0x3a: /* SBR */
1573         return s->sbr;
1574     case 0x3b: /* DCNTL */
1575         return s->dcntl;
1576     case 0x40: /* SIEN0 */
1577         return s->sien0;
1578     case 0x41: /* SIEN1 */
1579         return s->sien1;
1580     case 0x42: /* SIST0 */
1581         tmp = s->sist0;
1582         s->sist0 = 0;
1583         lsi_update_irq(s);
1584         return tmp;
1585     case 0x43: /* SIST1 */
1586         tmp = s->sist1;
1587         s->sist1 = 0;
1588         lsi_update_irq(s);
1589         return tmp;
1590     case 0x46: /* MACNTL */
1591         return 0x0f;
1592     case 0x47: /* GPCNTL0 */
1593         return 0x0f;
1594     case 0x48: /* STIME0 */
1595         return s->stime0;
1596     case 0x4a: /* RESPID0 */
1597         return s->respid0;
1598     case 0x4b: /* RESPID1 */
1599         return s->respid1;
1600     case 0x4d: /* STEST1 */
1601         return s->stest1;
1602     case 0x4e: /* STEST2 */
1603         return s->stest2;
1604     case 0x4f: /* STEST3 */
1605         return s->stest3;
1606     case 0x50: /* SIDL */
1607         /* This is needed by the linux drivers.  We currently only update it
1608            during the MSG IN phase.  */
1609         return s->sidl;
1610     case 0x52: /* STEST4 */
1611         return 0xe0;
1612     case 0x56: /* CCNTL0 */
1613         return s->ccntl0;
1614     case 0x57: /* CCNTL1 */
1615         return s->ccntl1;
1616     case 0x58: /* SBDL */
1617         /* Some drivers peek at the data bus during the MSG IN phase.  */
1618         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1619             return s->msg[0];
1620         return 0;
1621     case 0x59: /* SBDL high */
1622         return 0;
1623     CASE_GET_REG32(mmrs, 0xa0)
1624     CASE_GET_REG32(mmws, 0xa4)
1625     CASE_GET_REG32(sfs, 0xa8)
1626     CASE_GET_REG32(drs, 0xac)
1627     CASE_GET_REG32(sbms, 0xb0)
1628     CASE_GET_REG32(dbms, 0xb4)
1629     CASE_GET_REG32(dnad64, 0xb8)
1630     CASE_GET_REG32(pmjad1, 0xc0)
1631     CASE_GET_REG32(pmjad2, 0xc4)
1632     CASE_GET_REG32(rbc, 0xc8)
1633     CASE_GET_REG32(ua, 0xcc)
1634     CASE_GET_REG32(ia, 0xd4)
1635     CASE_GET_REG32(sbc, 0xd8)
1636     CASE_GET_REG32(csbc, 0xdc)
1637     }
1638     if (offset >= 0x5c && offset < 0xa0) {
1639         int n;
1640         int shift;
1641         n = (offset - 0x58) >> 2;
1642         shift = (offset & 3) * 8;
1643         return (s->scratch[n] >> shift) & 0xff;
1644     }
1645     BADF("readb 0x%x\n", offset);
1646     exit(1);
1647 #undef CASE_GET_REG24
1648 #undef CASE_GET_REG32
1649 }
1650
1651 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1652 {
1653 #define CASE_SET_REG24(name, addr) \
1654     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1655     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1656     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1657
1658 #define CASE_SET_REG32(name, addr) \
1659     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1660     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1661     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1662     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1663
1664 #ifdef DEBUG_LSI_REG
1665     DPRINTF("Write reg %x = %02x\n", offset, val);
1666 #endif
1667     switch (offset) {
1668     case 0x00: /* SCNTL0 */
1669         s->scntl0 = val;
1670         if (val & LSI_SCNTL0_START) {
1671             BADF("Start sequence not implemented\n");
1672         }
1673         break;
1674     case 0x01: /* SCNTL1 */
1675         s->scntl1 = val & ~LSI_SCNTL1_SST;
1676         if (val & LSI_SCNTL1_IARB) {
1677             BADF("Immediate Arbritration not implemented\n");
1678         }
1679         if (val & LSI_SCNTL1_RST) {
1680             if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1681                 DeviceState *dev;
1682
1683                 QTAILQ_FOREACH(dev, &s->bus.qbus.children, sibling) {
1684                     device_reset(dev);
1685                 }
1686                 s->sstat0 |= LSI_SSTAT0_RST;
1687                 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1688             }
1689         } else {
1690             s->sstat0 &= ~LSI_SSTAT0_RST;
1691         }
1692         break;
1693     case 0x02: /* SCNTL2 */
1694         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1695         s->scntl2 = val;
1696         break;
1697     case 0x03: /* SCNTL3 */
1698         s->scntl3 = val;
1699         break;
1700     case 0x04: /* SCID */
1701         s->scid = val;
1702         break;
1703     case 0x05: /* SXFER */
1704         s->sxfer = val;
1705         break;
1706     case 0x06: /* SDID */
1707         if ((val & 0xf) != (s->ssid & 0xf))
1708             BADF("Destination ID does not match SSID\n");
1709         s->sdid = val & 0xf;
1710         break;
1711     case 0x07: /* GPREG0 */
1712         break;
1713     case 0x08: /* SFBR */
1714         /* The CPU is not allowed to write to this register.  However the
1715            SCRIPTS register move instructions are.  */
1716         s->sfbr = val;
1717         break;
1718     case 0x0a: case 0x0b:
1719         /* Openserver writes to these readonly registers on startup */
1720         return;
1721     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1722         /* Linux writes to these readonly registers on startup.  */
1723         return;
1724     CASE_SET_REG32(dsa, 0x10)
1725     case 0x14: /* ISTAT0 */
1726         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1727         if (val & LSI_ISTAT0_ABRT) {
1728             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1729         }
1730         if (val & LSI_ISTAT0_INTF) {
1731             s->istat0 &= ~LSI_ISTAT0_INTF;
1732             lsi_update_irq(s);
1733         }
1734         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1735             DPRINTF("Woken by SIGP\n");
1736             s->waiting = 0;
1737             s->dsp = s->dnad;
1738             lsi_execute_script(s);
1739         }
1740         if (val & LSI_ISTAT0_SRST) {
1741             lsi_soft_reset(s);
1742         }
1743         break;
1744     case 0x16: /* MBOX0 */
1745         s->mbox0 = val;
1746         break;
1747     case 0x17: /* MBOX1 */
1748         s->mbox1 = val;
1749         break;
1750     case 0x1a: /* CTEST2 */
1751         s->ctest2 = val & LSI_CTEST2_PCICIE;
1752         break;
1753     case 0x1b: /* CTEST3 */
1754         s->ctest3 = val & 0x0f;
1755         break;
1756     CASE_SET_REG32(temp, 0x1c)
1757     case 0x21: /* CTEST4 */
1758         if (val & 7) {
1759            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1760         }
1761         s->ctest4 = val;
1762         break;
1763     case 0x22: /* CTEST5 */
1764         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1765             BADF("CTEST5 DMA increment not implemented\n");
1766         }
1767         s->ctest5 = val;
1768         break;
1769     CASE_SET_REG24(dbc, 0x24)
1770     CASE_SET_REG32(dnad, 0x28)
1771     case 0x2c: /* DSP[0:7] */
1772         s->dsp &= 0xffffff00;
1773         s->dsp |= val;
1774         break;
1775     case 0x2d: /* DSP[8:15] */
1776         s->dsp &= 0xffff00ff;
1777         s->dsp |= val << 8;
1778         break;
1779     case 0x2e: /* DSP[16:23] */
1780         s->dsp &= 0xff00ffff;
1781         s->dsp |= val << 16;
1782         break;
1783     case 0x2f: /* DSP[24:31] */
1784         s->dsp &= 0x00ffffff;
1785         s->dsp |= val << 24;
1786         if ((s->dmode & LSI_DMODE_MAN) == 0
1787             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1788             lsi_execute_script(s);
1789         break;
1790     CASE_SET_REG32(dsps, 0x30)
1791     CASE_SET_REG32(scratch[0], 0x34)
1792     case 0x38: /* DMODE */
1793         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1794             BADF("IO mappings not implemented\n");
1795         }
1796         s->dmode = val;
1797         break;
1798     case 0x39: /* DIEN */
1799         s->dien = val;
1800         lsi_update_irq(s);
1801         break;
1802     case 0x3a: /* SBR */
1803         s->sbr = val;
1804         break;
1805     case 0x3b: /* DCNTL */
1806         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1807         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1808             lsi_execute_script(s);
1809         break;
1810     case 0x40: /* SIEN0 */
1811         s->sien0 = val;
1812         lsi_update_irq(s);
1813         break;
1814     case 0x41: /* SIEN1 */
1815         s->sien1 = val;
1816         lsi_update_irq(s);
1817         break;
1818     case 0x47: /* GPCNTL0 */
1819         break;
1820     case 0x48: /* STIME0 */
1821         s->stime0 = val;
1822         break;
1823     case 0x49: /* STIME1 */
1824         if (val & 0xf) {
1825             DPRINTF("General purpose timer not implemented\n");
1826             /* ??? Raising the interrupt immediately seems to be sufficient
1827                to keep the FreeBSD driver happy.  */
1828             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1829         }
1830         break;
1831     case 0x4a: /* RESPID0 */
1832         s->respid0 = val;
1833         break;
1834     case 0x4b: /* RESPID1 */
1835         s->respid1 = val;
1836         break;
1837     case 0x4d: /* STEST1 */
1838         s->stest1 = val;
1839         break;
1840     case 0x4e: /* STEST2 */
1841         if (val & 1) {
1842             BADF("Low level mode not implemented\n");
1843         }
1844         s->stest2 = val;
1845         break;
1846     case 0x4f: /* STEST3 */
1847         if (val & 0x41) {
1848             BADF("SCSI FIFO test mode not implemented\n");
1849         }
1850         s->stest3 = val;
1851         break;
1852     case 0x56: /* CCNTL0 */
1853         s->ccntl0 = val;
1854         break;
1855     case 0x57: /* CCNTL1 */
1856         s->ccntl1 = val;
1857         break;
1858     CASE_SET_REG32(mmrs, 0xa0)
1859     CASE_SET_REG32(mmws, 0xa4)
1860     CASE_SET_REG32(sfs, 0xa8)
1861     CASE_SET_REG32(drs, 0xac)
1862     CASE_SET_REG32(sbms, 0xb0)
1863     CASE_SET_REG32(dbms, 0xb4)
1864     CASE_SET_REG32(dnad64, 0xb8)
1865     CASE_SET_REG32(pmjad1, 0xc0)
1866     CASE_SET_REG32(pmjad2, 0xc4)
1867     CASE_SET_REG32(rbc, 0xc8)
1868     CASE_SET_REG32(ua, 0xcc)
1869     CASE_SET_REG32(ia, 0xd4)
1870     CASE_SET_REG32(sbc, 0xd8)
1871     CASE_SET_REG32(csbc, 0xdc)
1872     default:
1873         if (offset >= 0x5c && offset < 0xa0) {
1874             int n;
1875             int shift;
1876             n = (offset - 0x58) >> 2;
1877             shift = (offset & 3) * 8;
1878             s->scratch[n] &= ~(0xff << shift);
1879             s->scratch[n] |= (val & 0xff) << shift;
1880         } else {
1881             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1882         }
1883     }
1884 #undef CASE_SET_REG24
1885 #undef CASE_SET_REG32
1886 }
1887
1888 static void lsi_mmio_write(void *opaque, target_phys_addr_t addr,
1889                            uint64_t val, unsigned size)
1890 {
1891     LSIState *s = opaque;
1892
1893     lsi_reg_writeb(s, addr & 0xff, val);
1894 }
1895
1896 static uint64_t lsi_mmio_read(void *opaque, target_phys_addr_t addr,
1897                               unsigned size)
1898 {
1899     LSIState *s = opaque;
1900
1901     return lsi_reg_readb(s, addr & 0xff);
1902 }
1903
1904 static const MemoryRegionOps lsi_mmio_ops = {
1905     .read = lsi_mmio_read,
1906     .write = lsi_mmio_write,
1907     .endianness = DEVICE_NATIVE_ENDIAN,
1908     .impl = {
1909         .min_access_size = 1,
1910         .max_access_size = 1,
1911     },
1912 };
1913
1914 static void lsi_ram_write(void *opaque, target_phys_addr_t addr,
1915                           uint64_t val, unsigned size)
1916 {
1917     LSIState *s = opaque;
1918     uint32_t newval;
1919     uint32_t mask;
1920     int shift;
1921
1922     newval = s->script_ram[addr >> 2];
1923     shift = (addr & 3) * 8;
1924     mask = ((uint64_t)1 << (size * 8)) - 1;
1925     newval &= ~(mask << shift);
1926     newval |= val << shift;
1927     s->script_ram[addr >> 2] = newval;
1928 }
1929
1930 static uint64_t lsi_ram_read(void *opaque, target_phys_addr_t addr,
1931                              unsigned size)
1932 {
1933     LSIState *s = opaque;
1934     uint32_t val;
1935     uint32_t mask;
1936
1937     val = s->script_ram[addr >> 2];
1938     mask = ((uint64_t)1 << (size * 8)) - 1;
1939     val >>= (addr & 3) * 8;
1940     return val & mask;
1941 }
1942
1943 static const MemoryRegionOps lsi_ram_ops = {
1944     .read = lsi_ram_read,
1945     .write = lsi_ram_write,
1946     .endianness = DEVICE_NATIVE_ENDIAN,
1947 };
1948
1949 static uint64_t lsi_io_read(void *opaque, target_phys_addr_t addr,
1950                             unsigned size)
1951 {
1952     LSIState *s = opaque;
1953     return lsi_reg_readb(s, addr & 0xff);
1954 }
1955
1956 static void lsi_io_write(void *opaque, target_phys_addr_t addr,
1957                          uint64_t val, unsigned size)
1958 {
1959     LSIState *s = opaque;
1960     lsi_reg_writeb(s, addr & 0xff, val);
1961 }
1962
1963 static const MemoryRegionOps lsi_io_ops = {
1964     .read = lsi_io_read,
1965     .write = lsi_io_write,
1966     .endianness = DEVICE_NATIVE_ENDIAN,
1967     .impl = {
1968         .min_access_size = 1,
1969         .max_access_size = 1,
1970     },
1971 };
1972
1973 static void lsi_scsi_reset(DeviceState *dev)
1974 {
1975     LSIState *s = DO_UPCAST(LSIState, dev.qdev, dev);
1976
1977     lsi_soft_reset(s);
1978 }
1979
1980 static void lsi_pre_save(void *opaque)
1981 {
1982     LSIState *s = opaque;
1983
1984     if (s->current) {
1985         assert(s->current->dma_buf == NULL);
1986         assert(s->current->dma_len == 0);
1987     }
1988     assert(QTAILQ_EMPTY(&s->queue));
1989 }
1990
1991 static const VMStateDescription vmstate_lsi_scsi = {
1992     .name = "lsiscsi",
1993     .version_id = 0,
1994     .minimum_version_id = 0,
1995     .minimum_version_id_old = 0,
1996     .pre_save = lsi_pre_save,
1997     .fields      = (VMStateField []) {
1998         VMSTATE_PCI_DEVICE(dev, LSIState),
1999
2000         VMSTATE_INT32(carry, LSIState),
2001         VMSTATE_INT32(status, LSIState),
2002         VMSTATE_INT32(msg_action, LSIState),
2003         VMSTATE_INT32(msg_len, LSIState),
2004         VMSTATE_BUFFER(msg, LSIState),
2005         VMSTATE_INT32(waiting, LSIState),
2006
2007         VMSTATE_UINT32(dsa, LSIState),
2008         VMSTATE_UINT32(temp, LSIState),
2009         VMSTATE_UINT32(dnad, LSIState),
2010         VMSTATE_UINT32(dbc, LSIState),
2011         VMSTATE_UINT8(istat0, LSIState),
2012         VMSTATE_UINT8(istat1, LSIState),
2013         VMSTATE_UINT8(dcmd, LSIState),
2014         VMSTATE_UINT8(dstat, LSIState),
2015         VMSTATE_UINT8(dien, LSIState),
2016         VMSTATE_UINT8(sist0, LSIState),
2017         VMSTATE_UINT8(sist1, LSIState),
2018         VMSTATE_UINT8(sien0, LSIState),
2019         VMSTATE_UINT8(sien1, LSIState),
2020         VMSTATE_UINT8(mbox0, LSIState),
2021         VMSTATE_UINT8(mbox1, LSIState),
2022         VMSTATE_UINT8(dfifo, LSIState),
2023         VMSTATE_UINT8(ctest2, LSIState),
2024         VMSTATE_UINT8(ctest3, LSIState),
2025         VMSTATE_UINT8(ctest4, LSIState),
2026         VMSTATE_UINT8(ctest5, LSIState),
2027         VMSTATE_UINT8(ccntl0, LSIState),
2028         VMSTATE_UINT8(ccntl1, LSIState),
2029         VMSTATE_UINT32(dsp, LSIState),
2030         VMSTATE_UINT32(dsps, LSIState),
2031         VMSTATE_UINT8(dmode, LSIState),
2032         VMSTATE_UINT8(dcntl, LSIState),
2033         VMSTATE_UINT8(scntl0, LSIState),
2034         VMSTATE_UINT8(scntl1, LSIState),
2035         VMSTATE_UINT8(scntl2, LSIState),
2036         VMSTATE_UINT8(scntl3, LSIState),
2037         VMSTATE_UINT8(sstat0, LSIState),
2038         VMSTATE_UINT8(sstat1, LSIState),
2039         VMSTATE_UINT8(scid, LSIState),
2040         VMSTATE_UINT8(sxfer, LSIState),
2041         VMSTATE_UINT8(socl, LSIState),
2042         VMSTATE_UINT8(sdid, LSIState),
2043         VMSTATE_UINT8(ssid, LSIState),
2044         VMSTATE_UINT8(sfbr, LSIState),
2045         VMSTATE_UINT8(stest1, LSIState),
2046         VMSTATE_UINT8(stest2, LSIState),
2047         VMSTATE_UINT8(stest3, LSIState),
2048         VMSTATE_UINT8(sidl, LSIState),
2049         VMSTATE_UINT8(stime0, LSIState),
2050         VMSTATE_UINT8(respid0, LSIState),
2051         VMSTATE_UINT8(respid1, LSIState),
2052         VMSTATE_UINT32(mmrs, LSIState),
2053         VMSTATE_UINT32(mmws, LSIState),
2054         VMSTATE_UINT32(sfs, LSIState),
2055         VMSTATE_UINT32(drs, LSIState),
2056         VMSTATE_UINT32(sbms, LSIState),
2057         VMSTATE_UINT32(dbms, LSIState),
2058         VMSTATE_UINT32(dnad64, LSIState),
2059         VMSTATE_UINT32(pmjad1, LSIState),
2060         VMSTATE_UINT32(pmjad2, LSIState),
2061         VMSTATE_UINT32(rbc, LSIState),
2062         VMSTATE_UINT32(ua, LSIState),
2063         VMSTATE_UINT32(ia, LSIState),
2064         VMSTATE_UINT32(sbc, LSIState),
2065         VMSTATE_UINT32(csbc, LSIState),
2066         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2067         VMSTATE_UINT8(sbr, LSIState),
2068
2069         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 2048 * sizeof(uint32_t)),
2070         VMSTATE_END_OF_LIST()
2071     }
2072 };
2073
2074 static int lsi_scsi_uninit(PCIDevice *d)
2075 {
2076     LSIState *s = DO_UPCAST(LSIState, dev, d);
2077
2078     memory_region_destroy(&s->mmio_io);
2079     memory_region_destroy(&s->ram_io);
2080     memory_region_destroy(&s->io_io);
2081
2082     return 0;
2083 }
2084
2085 static const struct SCSIBusInfo lsi_scsi_info = {
2086     .tcq = true,
2087     .max_target = LSI_MAX_DEVS,
2088     .max_lun = 0,  /* LUN support is buggy */
2089
2090     .transfer_data = lsi_transfer_data,
2091     .complete = lsi_command_complete,
2092     .cancel = lsi_request_cancelled
2093 };
2094
2095 static int lsi_scsi_init(PCIDevice *dev)
2096 {
2097     LSIState *s = DO_UPCAST(LSIState, dev, dev);
2098     uint8_t *pci_conf;
2099
2100     pci_conf = s->dev.config;
2101
2102     /* PCI latency timer = 255 */
2103     pci_conf[PCI_LATENCY_TIMER] = 0xff;
2104     /* Interrupt pin A */
2105     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2106
2107     memory_region_init_io(&s->mmio_io, &lsi_mmio_ops, s, "lsi-mmio", 0x400);
2108     memory_region_init_io(&s->ram_io, &lsi_ram_ops, s, "lsi-ram", 0x2000);
2109     memory_region_init_io(&s->io_io, &lsi_io_ops, s, "lsi-io", 256);
2110
2111     pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2112     pci_register_bar(&s->dev, 1, 0, &s->mmio_io);
2113     pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2114     QTAILQ_INIT(&s->queue);
2115
2116     scsi_bus_new(&s->bus, &dev->qdev, &lsi_scsi_info);
2117     if (!dev->qdev.hotplugged) {
2118         return scsi_bus_legacy_handle_cmdline(&s->bus);
2119     }
2120     return 0;
2121 }
2122
2123 static void lsi_class_init(ObjectClass *klass, void *data)
2124 {
2125     DeviceClass *dc = DEVICE_CLASS(klass);
2126     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2127
2128     k->init = lsi_scsi_init;
2129     k->exit = lsi_scsi_uninit;
2130     k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2131     k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2132     k->class_id = PCI_CLASS_STORAGE_SCSI;
2133     k->subsystem_id = 0x1000;
2134     dc->reset = lsi_scsi_reset;
2135     dc->vmsd = &vmstate_lsi_scsi;
2136 }
2137
2138 static TypeInfo lsi_info = {
2139     .name          = "lsi53c895a",
2140     .parent        = TYPE_PCI_DEVICE,
2141     .instance_size = sizeof(LSIState),
2142     .class_init    = lsi_class_init,
2143 };
2144
2145 static void lsi53c895a_register_types(void)
2146 {
2147     type_register_static(&lsi_info);
2148 }
2149
2150 type_init(lsi53c895a_register_types)