hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include "hw.h"
  14 #include "pci.h"
  15 #include "scsi-disk.h"
  16
  17 //#define DEBUG_LSI
  18 //#define DEBUG_LSI_REG
  19
  20 #ifdef DEBUG_LSI
  21 #define DPRINTF(fmt, args...) \
  22 do { printf("lsi_scsi: " fmt , ##args); } while (0)
  23 #define BADF(fmt, args...) \
  24 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
  25 #else
  26 #define DPRINTF(fmt, args...) do {} while(0)
  27 #define BADF(fmt, args...) \
  28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
  29 #endif
  30
  31 #define LSI_SCNTL0_TRG    0x01
  32 #define LSI_SCNTL0_AAP    0x02
  33 #define LSI_SCNTL0_EPC    0x08
  34 #define LSI_SCNTL0_WATN   0x10
  35 #define LSI_SCNTL0_START  0x20
  36
  37 #define LSI_SCNTL1_SST    0x01
  38 #define LSI_SCNTL1_IARB   0x02
  39 #define LSI_SCNTL1_AESP   0x04
  40 #define LSI_SCNTL1_RST    0x08
  41 #define LSI_SCNTL1_CON    0x10
  42 #define LSI_SCNTL1_DHP    0x20
  43 #define LSI_SCNTL1_ADB    0x40
  44 #define LSI_SCNTL1_EXC    0x80
  45
  46 #define LSI_SCNTL2_WSR    0x01
  47 #define LSI_SCNTL2_VUE0   0x02
  48 #define LSI_SCNTL2_VUE1   0x04
  49 #define LSI_SCNTL2_WSS    0x08
  50 #define LSI_SCNTL2_SLPHBEN 0x10
  51 #define LSI_SCNTL2_SLPMD  0x20
  52 #define LSI_SCNTL2_CHM    0x40
  53 #define LSI_SCNTL2_SDU    0x80
  54
  55 #define LSI_ISTAT0_DIP    0x01
  56 #define LSI_ISTAT0_SIP    0x02
  57 #define LSI_ISTAT0_INTF   0x04
  58 #define LSI_ISTAT0_CON    0x08
  59 #define LSI_ISTAT0_SEM    0x10
  60 #define LSI_ISTAT0_SIGP   0x20
  61 #define LSI_ISTAT0_SRST   0x40
  62 #define LSI_ISTAT0_ABRT   0x80
  63
  64 #define LSI_ISTAT1_SI     0x01
  65 #define LSI_ISTAT1_SRUN   0x02
  66 #define LSI_ISTAT1_FLSH   0x04
  67
  68 #define LSI_SSTAT0_SDP0   0x01
  69 #define LSI_SSTAT0_RST    0x02
  70 #define LSI_SSTAT0_WOA    0x04
  71 #define LSI_SSTAT0_LOA    0x08
  72 #define LSI_SSTAT0_AIP    0x10
  73 #define LSI_SSTAT0_OLF    0x20
  74 #define LSI_SSTAT0_ORF    0x40
  75 #define LSI_SSTAT0_ILF    0x80
  76
  77 #define LSI_SIST0_PAR     0x01
  78 #define LSI_SIST0_RST     0x02
  79 #define LSI_SIST0_UDC     0x04
  80 #define LSI_SIST0_SGE     0x08
  81 #define LSI_SIST0_RSL     0x10
  82 #define LSI_SIST0_SEL     0x20
  83 #define LSI_SIST0_CMP     0x40
  84 #define LSI_SIST0_MA      0x80
  85
  86 #define LSI_SIST1_HTH     0x01
  87 #define LSI_SIST1_GEN     0x02
  88 #define LSI_SIST1_STO     0x04
  89 #define LSI_SIST1_SBMC    0x10
  90
  91 #define LSI_SOCL_IO       0x01
  92 #define LSI_SOCL_CD       0x02
  93 #define LSI_SOCL_MSG      0x04
  94 #define LSI_SOCL_ATN      0x08
  95 #define LSI_SOCL_SEL      0x10
  96 #define LSI_SOCL_BSY      0x20
  97 #define LSI_SOCL_ACK      0x40
  98 #define LSI_SOCL_REQ      0x80
  99
 100 #define LSI_DSTAT_IID     0x01
 101 #define LSI_DSTAT_SIR     0x04
 102 #define LSI_DSTAT_SSI     0x08
 103 #define LSI_DSTAT_ABRT    0x10
 104 #define LSI_DSTAT_BF      0x20
 105 #define LSI_DSTAT_MDPE    0x40
 106 #define LSI_DSTAT_DFE     0x80
 107
 108 #define LSI_DCNTL_COM     0x01
 109 #define LSI_DCNTL_IRQD    0x02
 110 #define LSI_DCNTL_STD     0x04
 111 #define LSI_DCNTL_IRQM    0x08
 112 #define LSI_DCNTL_SSM     0x10
 113 #define LSI_DCNTL_PFEN    0x20
 114 #define LSI_DCNTL_PFF     0x40
 115 #define LSI_DCNTL_CLSE    0x80
 116
 117 #define LSI_DMODE_MAN     0x01
 118 #define LSI_DMODE_BOF     0x02
 119 #define LSI_DMODE_ERMP    0x04
 120 #define LSI_DMODE_ERL     0x08
 121 #define LSI_DMODE_DIOM    0x10
 122 #define LSI_DMODE_SIOM    0x20
 123
 124 #define LSI_CTEST2_DACK   0x01
 125 #define LSI_CTEST2_DREQ   0x02
 126 #define LSI_CTEST2_TEOP   0x04
 127 #define LSI_CTEST2_PCICIE 0x08
 128 #define LSI_CTEST2_CM     0x10
 129 #define LSI_CTEST2_CIO    0x20
 130 #define LSI_CTEST2_SIGP   0x40
 131 #define LSI_CTEST2_DDIR   0x80
 132
 133 #define LSI_CTEST5_BL2    0x04
 134 #define LSI_CTEST5_DDIR   0x08
 135 #define LSI_CTEST5_MASR   0x10
 136 #define LSI_CTEST5_DFSN   0x20
 137 #define LSI_CTEST5_BBCK   0x40
 138 #define LSI_CTEST5_ADCK   0x80
 139
 140 #define LSI_CCNTL0_DILS   0x01
 141 #define LSI_CCNTL0_DISFC  0x10
 142 #define LSI_CCNTL0_ENNDJ  0x20
 143 #define LSI_CCNTL0_PMJCTL 0x40
 144 #define LSI_CCNTL0_ENPMJ  0x80
 145
 146 #define PHASE_DO          0
 147 #define PHASE_DI          1
 148 #define PHASE_CMD         2
 149 #define PHASE_ST          3
 150 #define PHASE_MO          6
 151 #define PHASE_MI          7
 152 #define PHASE_MASK        7
 153
 154 /* Maximum length of MSG IN data.  */
 155 #define LSI_MAX_MSGIN_LEN 8
 156
 157 /* Flag set if this is a tagged command.  */
 158 #define LSI_TAG_VALID     (1 << 16)
 159
 160 typedef struct {
 161     uint32_t tag;
 162     uint32_t pending;
 163     int out;
 164 } lsi_queue;
 165
 166 typedef struct {
 167     PCIDevice pci_dev;
 168     int mmio_io_addr;
 169     int ram_io_addr;
 170     uint32_t script_ram_base;
 171
 172     int carry; /* ??? Should this be an a visible register somewhere?  */
 173     int sense;
 174     /* Action to take at the end of a MSG IN phase.
 175        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 176     int msg_action;
 177     int msg_len;
 178     uint8_t msg[LSI_MAX_MSGIN_LEN];
 179     /* 0 if SCRIPTS are running or stopped.
 180      * 1 if a Wait Reselect instruction has been issued.
 181      * 2 if processing DMA from lsi_execute_script.
 182      * 3 if a DMA operation is in progress.  */
 183     int waiting;
 184     SCSIDevice *scsi_dev[LSI_MAX_DEVS];
 185     SCSIDevice *current_dev;
 186     int current_lun;
 187     /* The tag is a combination of the device ID and the SCSI tag.  */
 188     uint32_t current_tag;
 189     uint32_t current_dma_len;
 190     int command_complete;
 191     uint8_t *dma_buf;
 192     lsi_queue *queue;
 193     int queue_len;
 194     int active_commands;
 195
 196     uint32_t dsa;
 197     uint32_t temp;
 198     uint32_t dnad;
 199     uint32_t dbc;
 200     uint8_t istat0;
 201     uint8_t istat1;
 202     uint8_t dcmd;
 203     uint8_t dstat;
 204     uint8_t dien;
 205     uint8_t sist0;
 206     uint8_t sist1;
 207     uint8_t sien0;
 208     uint8_t sien1;
 209     uint8_t mbox0;
 210     uint8_t mbox1;
 211     uint8_t dfifo;
 212     uint8_t ctest3;
 213     uint8_t ctest4;
 214     uint8_t ctest5;
 215     uint8_t ccntl0;
 216     uint8_t ccntl1;
 217     uint32_t dsp;
 218     uint32_t dsps;
 219     uint8_t dmode;
 220     uint8_t dcntl;
 221     uint8_t scntl0;
 222     uint8_t scntl1;
 223     uint8_t scntl2;
 224     uint8_t scntl3;
 225     uint8_t sstat0;
 226     uint8_t sstat1;
 227     uint8_t scid;
 228     uint8_t sxfer;
 229     uint8_t socl;
 230     uint8_t sdid;
 231     uint8_t ssid;
 232     uint8_t sfbr;
 233     uint8_t stest1;
 234     uint8_t stest2;
 235     uint8_t stest3;
 236     uint8_t sidl;
 237     uint8_t stime0;
 238     uint8_t respid0;
 239     uint8_t respid1;
 240     uint32_t mmrs;
 241     uint32_t mmws;
 242     uint32_t sfs;
 243     uint32_t drs;
 244     uint32_t sbms;
 245     uint32_t dmbs;
 246     uint32_t dnad64;
 247     uint32_t pmjad1;
 248     uint32_t pmjad2;
 249     uint32_t rbc;
 250     uint32_t ua;
 251     uint32_t ia;
 252     uint32_t sbc;
 253     uint32_t csbc;
 254     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 255
 256     /* Script ram is stored as 32-bit words in host byteorder.  */
 257     uint32_t script_ram[2048];
 258 } LSIState;
 259
 260 static void lsi_soft_reset(LSIState *s)
 261 {
 262     DPRINTF("Reset\n");
 263     s->carry = 0;
 264
 265     s->waiting = 0;
 266     s->dsa = 0;
 267     s->dnad = 0;
 268     s->dbc = 0;
 269     s->temp = 0;
 270     memset(s->scratch, 0, sizeof(s->scratch));
 271     s->istat0 = 0;
 272     s->istat1 = 0;
 273     s->dcmd = 0;
 274     s->dstat = 0;
 275     s->dien = 0;
 276     s->sist0 = 0;
 277     s->sist1 = 0;
 278     s->sien0 = 0;
 279     s->sien1 = 0;
 280     s->mbox0 = 0;
 281     s->mbox1 = 0;
 282     s->dfifo = 0;
 283     s->ctest3 = 0;
 284     s->ctest4 = 0;
 285     s->ctest5 = 0;
 286     s->ccntl0 = 0;
 287     s->ccntl1 = 0;
 288     s->dsp = 0;
 289     s->dsps = 0;
 290     s->dmode = 0;
 291     s->dcntl = 0;
 292     s->scntl0 = 0xc0;
 293     s->scntl1 = 0;
 294     s->scntl2 = 0;
 295     s->scntl3 = 0;
 296     s->sstat0 = 0;
 297     s->sstat1 = 0;
 298     s->scid = 7;
 299     s->sxfer = 0;
 300     s->socl = 0;
 301     s->stest1 = 0;
 302     s->stest2 = 0;
 303     s->stest3 = 0;
 304     s->sidl = 0;
 305     s->stime0 = 0;
 306     s->respid0 = 0x80;
 307     s->respid1 = 0;
 308     s->mmrs = 0;
 309     s->mmws = 0;
 310     s->sfs = 0;
 311     s->drs = 0;
 312     s->sbms = 0;
 313     s->dmbs = 0;
 314     s->dnad64 = 0;
 315     s->pmjad1 = 0;
 316     s->pmjad2 = 0;
 317     s->rbc = 0;
 318     s->ua = 0;
 319     s->ia = 0;
 320     s->sbc = 0;
 321     s->csbc = 0;
 322 }
 323
 324 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 325 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 326 static void lsi_execute_script(LSIState *s);
 327
 328 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 329 {
 330     uint32_t buf;
 331
 332     /* Optimize reading from SCRIPTS RAM.  */
 333     if ((addr & 0xffffe000) == s->script_ram_base) {
 334         return s->script_ram[(addr & 0x1fff) >> 2];
 335     }
 336     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 337     return cpu_to_le32(buf);
 338 }
 339
 340 static void lsi_stop_script(LSIState *s)
 341 {
 342     s->istat1 &= ~LSI_ISTAT1_SRUN;
 343 }
 344
 345 static void lsi_update_irq(LSIState *s)
 346 {
 347     int level;
 348     static int last_level;
 349
 350     /* It's unclear whether the DIP/SIP bits should be cleared when the
 351        Interrupt Status Registers are cleared or when istat0 is read.
 352        We currently do the formwer, which seems to work.  */
 353     level = 0;
 354     if (s->dstat) {
 355         if (s->dstat & s->dien)
 356             level = 1;
 357         s->istat0 |= LSI_ISTAT0_DIP;
 358     } else {
 359         s->istat0 &= ~LSI_ISTAT0_DIP;
 360     }
 361
 362     if (s->sist0 || s->sist1) {
 363         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 364             level = 1;
 365         s->istat0 |= LSI_ISTAT0_SIP;
 366     } else {
 367         s->istat0 &= ~LSI_ISTAT0_SIP;
 368     }
 369     if (s->istat0 & LSI_ISTAT0_INTF)
 370         level = 1;
 371
 372     if (level != last_level) {
 373         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 374                 level, s->dstat, s->sist1, s->sist0);
 375         last_level = level;
 376     }
 377     qemu_set_irq(s->pci_dev.irq[0], level);
 378 }
 379
 380 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 381 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 382 {
 383     uint32_t mask0;
 384     uint32_t mask1;
 385
 386     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 387             stat1, stat0, s->sist1, s->sist0);
 388     s->sist0 |= stat0;
 389     s->sist1 |= stat1;
 390     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 391        we don't stop processing when raising STO.  Instead continue
 392        execution and stop at the next insn that accesses the SCSI bus.  */
 393     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 394     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 395     mask1 &= ~LSI_SIST1_STO;
 396     if (s->sist0 & mask0 || s->sist1 & mask1) {
 397         lsi_stop_script(s);
 398     }
 399     lsi_update_irq(s);
 400 }
 401
 402 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 403 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 404 {
 405     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 406     s->dstat |= stat;
 407     lsi_update_irq(s);
 408     lsi_stop_script(s);
 409 }
 410
 411 static inline void lsi_set_phase(LSIState *s, int phase)
 412 {
 413     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 414 }
 415
 416 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 417 {
 418     /* Trigger a phase mismatch.  */
 419     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 420         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 421             s->dsp = s->pmjad1;
 422         } else {
 423             s->dsp = s->pmjad2;
 424         }
 425         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 426     } else {
 427         DPRINTF("Phase mismatch interrupt\n");
 428         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 429         lsi_stop_script(s);
 430     }
 431     lsi_set_phase(s, new_phase);
 432 }
 433
 434
 435 /* Resume SCRIPTS execution after a DMA operation.  */
 436 static void lsi_resume_script(LSIState *s)
 437 {
 438     if (s->waiting != 2) {
 439         s->waiting = 0;
 440         lsi_execute_script(s);
 441     } else {
 442         s->waiting = 0;
 443     }
 444 }
 445
 446 /* Initiate a SCSI layer data transfer.  */
 447 static void lsi_do_dma(LSIState *s, int out)
 448 {
 449     uint32_t count;
 450     uint32_t addr;
 451
 452     if (!s->current_dma_len) {
 453         /* Wait until data is available.  */
 454         DPRINTF("DMA no data available\n");
 455         return;
 456     }
 457
 458     count = s->dbc;
 459     if (count > s->current_dma_len)
 460         count = s->current_dma_len;
 461     DPRINTF("DMA addr=0x%08x len=%d\n", s->dnad, count);
 462
 463     addr = s->dnad;
 464     s->csbc += count;
 465     s->dnad += count;
 466     s->dbc -= count;
 467
 468     if (s->dma_buf == NULL) {
 469         s->dma_buf = s->current_dev->get_buf(s->current_dev,
 470                                              s->current_tag);
 471     }
 472
 473     /* ??? Set SFBR to first data byte.  */
 474     if (out) {
 475         cpu_physical_memory_read(addr, s->dma_buf, count);
 476     } else {
 477         cpu_physical_memory_write(addr, s->dma_buf, count);
 478     }
 479     s->current_dma_len -= count;
 480     if (s->current_dma_len == 0) {
 481         s->dma_buf = NULL;
 482         if (out) {
 483             /* Write the data.  */
 484             s->current_dev->write_data(s->current_dev, s->current_tag);
 485         } else {
 486             /* Request any remaining data.  */
 487             s->current_dev->read_data(s->current_dev, s->current_tag);
 488         }
 489     } else {
 490         s->dma_buf += count;
 491         lsi_resume_script(s);
 492     }
 493 }
 494
 495
 496 /* Add a command to the queue.  */
 497 static void lsi_queue_command(LSIState *s)
 498 {
 499     lsi_queue *p;
 500
 501     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 502     if (s->queue_len == s->active_commands) {
 503         s->queue_len++;
 504         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 505     }
 506     p = &s->queue[s->active_commands++];
 507     p->tag = s->current_tag;
 508     p->pending = 0;
 509     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 510 }
 511
 512 /* Queue a byte for a MSG IN phase.  */
 513 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 514 {
 515     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 516         BADF("MSG IN data too long\n");
 517     } else {
 518         DPRINTF("MSG IN 0x%02x\n", data);
 519         s->msg[s->msg_len++] = data;
 520     }
 521 }
 522
 523 /* Perform reselection to continue a command.  */
 524 static void lsi_reselect(LSIState *s, uint32_t tag)
 525 {
 526     lsi_queue *p;
 527     int n;
 528     int id;
 529
 530     p = NULL;
 531     for (n = 0; n < s->active_commands; n++) {
 532         p = &s->queue[n];
 533         if (p->tag == tag)
 534             break;
 535     }
 536     if (n == s->active_commands) {
 537         BADF("Reselected non-existant command tag=0x%x\n", tag);
 538         return;
 539     }
 540     id = (tag >> 8) & 0xf;
 541     s->ssid = id | 0x80;
 542     DPRINTF("Reselected target %d\n", id);
 543     s->current_dev = s->scsi_dev[id];
 544     s->current_tag = tag;
 545     s->scntl1 |= LSI_SCNTL1_CON;
 546     lsi_set_phase(s, PHASE_MI);
 547     s->msg_action = p->out ? 2 : 3;
 548     s->current_dma_len = p->pending;
 549     s->dma_buf = NULL;
 550     lsi_add_msg_byte(s, 0x80);
 551     if (s->current_tag & LSI_TAG_VALID) {
 552         lsi_add_msg_byte(s, 0x20);
 553         lsi_add_msg_byte(s, tag & 0xff);
 554     }
 555
 556     s->active_commands--;
 557     if (n != s->active_commands) {
 558         s->queue[n] = s->queue[s->active_commands];
 559     }
 560 }
 561
 562 /* Record that data is available for a queued command.  Returns zero if
 563    the device was reselected, nonzero if the IO is deferred.  */
 564 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 565 {
 566     lsi_queue *p;
 567     int i;
 568     for (i = 0; i < s->active_commands; i++) {
 569         p = &s->queue[i];
 570         if (p->tag == tag) {
 571             if (p->pending) {
 572                 BADF("Multiple IO pending for tag %d\n", tag);
 573             }
 574             p->pending = arg;
 575             if (s->waiting == 1) {
 576                 /* Reselect device.  */
 577                 lsi_reselect(s, tag);
 578                 return 0;
 579             } else {
 580                DPRINTF("Queueing IO tag=0x%x\n", tag);
 581                 p->pending = arg;
 582                 return 1;
 583             }
 584         }
 585     }
 586     BADF("IO with unknown tag %d\n", tag);
 587     return 1;
 588 }
 589
 590 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 591 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
 592                                  uint32_t arg)
 593 {
 594     LSIState *s = (LSIState *)opaque;
 595     int out;
 596
 597     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 598     if (reason == SCSI_REASON_DONE) {
 599         DPRINTF("Command complete sense=%d\n", (int)arg);
 600         s->sense = arg;
 601         s->command_complete = 2;
 602         if (s->waiting && s->dbc != 0) {
 603             /* Raise phase mismatch for short transfers.  */
 604             lsi_bad_phase(s, out, PHASE_ST);
 605         } else {
 606             lsi_set_phase(s, PHASE_ST);
 607         }
 608         lsi_resume_script(s);
 609         return;
 610     }
 611
 612     if (s->waiting == 1 || tag != s->current_tag) {
 613         if (lsi_queue_tag(s, tag, arg))
 614             return;
 615     }
 616     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 617     s->current_dma_len = arg;
 618     s->command_complete = 1;
 619     if (!s->waiting)
 620         return;
 621     if (s->waiting == 1 || s->dbc == 0) {
 622         lsi_resume_script(s);
 623     } else {
 624         lsi_do_dma(s, out);
 625     }
 626 }
 627
 628 static void lsi_do_command(LSIState *s)
 629 {
 630     uint8_t buf[16];
 631     int n;
 632
 633     DPRINTF("Send command len=%d\n", s->dbc);
 634     if (s->dbc > 16)
 635         s->dbc = 16;
 636     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 637     s->sfbr = buf[0];
 638     s->command_complete = 0;
 639     n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
 640                                      s->current_lun);
 641     if (n > 0) {
 642         lsi_set_phase(s, PHASE_DI);
 643         s->current_dev->read_data(s->current_dev, s->current_tag);
 644     } else if (n < 0) {
 645         lsi_set_phase(s, PHASE_DO);
 646         s->current_dev->write_data(s->current_dev, s->current_tag);
 647     }
 648
 649     if (!s->command_complete) {
 650         if (n) {
 651             /* Command did not complete immediately so disconnect.  */
 652             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 653             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 654             /* wait data */
 655             lsi_set_phase(s, PHASE_MI);
 656             s->msg_action = 1;
 657             lsi_queue_command(s);
 658         } else {
 659             /* wait command complete */
 660             lsi_set_phase(s, PHASE_DI);
 661         }
 662     }
 663 }
 664
 665 static void lsi_do_status(LSIState *s)
 666 {
 667     uint8_t sense;
 668     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 669     if (s->dbc != 1)
 670         BADF("Bad Status move\n");
 671     s->dbc = 1;
 672     sense = s->sense;
 673     s->sfbr = sense;
 674     cpu_physical_memory_write(s->dnad, &sense, 1);
 675     lsi_set_phase(s, PHASE_MI);
 676     s->msg_action = 1;
 677     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 678 }
 679
 680 static void lsi_disconnect(LSIState *s)
 681 {
 682     s->scntl1 &= ~LSI_SCNTL1_CON;
 683     s->sstat1 &= ~PHASE_MASK;
 684 }
 685
 686 static void lsi_do_msgin(LSIState *s)
 687 {
 688     int len;
 689     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 690     s->sfbr = s->msg[0];
 691     len = s->msg_len;
 692     if (len > s->dbc)
 693         len = s->dbc;
 694     cpu_physical_memory_write(s->dnad, s->msg, len);
 695     /* Linux drivers rely on the last byte being in the SIDL.  */
 696     s->sidl = s->msg[len - 1];
 697     s->msg_len -= len;
 698     if (s->msg_len) {
 699         memmove(s->msg, s->msg + len, s->msg_len);
 700     } else {
 701         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 702            switch to PHASE_MO.  */
 703         switch (s->msg_action) {
 704         case 0:
 705             lsi_set_phase(s, PHASE_CMD);
 706             break;
 707         case 1:
 708             lsi_disconnect(s);
 709             break;
 710         case 2:
 711             lsi_set_phase(s, PHASE_DO);
 712             break;
 713         case 3:
 714             lsi_set_phase(s, PHASE_DI);
 715             break;
 716         default:
 717             abort();
 718         }
 719     }
 720 }
 721
 722 /* Read the next byte during a MSGOUT phase.  */
 723 static uint8_t lsi_get_msgbyte(LSIState *s)
 724 {
 725     uint8_t data;
 726     cpu_physical_memory_read(s->dnad, &data, 1);
 727     s->dnad++;
 728     s->dbc--;
 729     return data;
 730 }
 731
 732 static void lsi_do_msgout(LSIState *s)
 733 {
 734     uint8_t msg;
 735     int len;
 736
 737     DPRINTF("MSG out len=%d\n", s->dbc);
 738     while (s->dbc) {
 739         msg = lsi_get_msgbyte(s);
 740         s->sfbr = msg;
 741
 742         switch (msg) {
 743         case 0x00:
 744             DPRINTF("MSG: Disconnect\n");
 745             lsi_disconnect(s);
 746             break;
 747         case 0x08:
 748             DPRINTF("MSG: No Operation\n");
 749             lsi_set_phase(s, PHASE_CMD);
 750             break;
 751         case 0x01:
 752             len = lsi_get_msgbyte(s);
 753             msg = lsi_get_msgbyte(s);
 754             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 755             switch (msg) {
 756             case 1:
 757                 DPRINTF("SDTR (ignored)\n");
 758                 s->dbc -= 2;
 759                 break;
 760             case 3:
 761                 DPRINTF("WDTR (ignored)\n");
 762                 s->dbc -= 1;
 763                 break;
 764             default:
 765                 goto bad;
 766             }
 767             break;
 768         case 0x20: /* SIMPLE queue */
 769             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 770             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 771             break;
 772         case 0x21: /* HEAD of queue */
 773             BADF("HEAD queue not implemented\n");
 774             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 775             break;
 776         case 0x22: /* ORDERED queue */
 777             BADF("ORDERED queue not implemented\n");
 778             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 779             break;
 780         default:
 781             if ((msg & 0x80) == 0) {
 782                 goto bad;
 783             }
 784             s->current_lun = msg & 7;
 785             DPRINTF("Select LUN %d\n", s->current_lun);
 786             lsi_set_phase(s, PHASE_CMD);
 787             break;
 788         }
 789     }
 790     return;
 791 bad:
 792     BADF("Unimplemented message 0x%02x\n", msg);
 793     lsi_set_phase(s, PHASE_MI);
 794     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 795     s->msg_action = 0;
 796 }
 797
 798 /* Sign extend a 24-bit value.  */
 799 static inline int32_t sxt24(int32_t n)
 800 {
 801     return (n << 8) >> 8;
 802 }
 803
 804 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 805 {
 806     int n;
 807     uint8_t buf[TARGET_PAGE_SIZE];
 808
 809     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 810     while (count) {
 811         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
 812         cpu_physical_memory_read(src, buf, n);
 813         cpu_physical_memory_write(dest, buf, n);
 814         src += n;
 815         dest += n;
 816         count -= n;
 817     }
 818 }
 819
 820 static void lsi_wait_reselect(LSIState *s)
 821 {
 822     int i;
 823     DPRINTF("Wait Reselect\n");
 824     if (s->current_dma_len)
 825         BADF("Reselect with pending DMA\n");
 826     for (i = 0; i < s->active_commands; i++) {
 827         if (s->queue[i].pending) {
 828             lsi_reselect(s, s->queue[i].tag);
 829             break;
 830         }
 831     }
 832     if (s->current_dma_len == 0) {
 833         s->waiting = 1;
 834     }
 835 }
 836
 837 static void lsi_execute_script(LSIState *s)
 838 {
 839     uint32_t insn;
 840     uint32_t addr;
 841     int opcode;
 842     int insn_processed = 0;
 843
 844     s->istat1 |= LSI_ISTAT1_SRUN;
 845 again:
 846     insn_processed++;
 847     insn = read_dword(s, s->dsp);
 848     addr = read_dword(s, s->dsp + 4);
 849     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 850     s->dsps = addr;
 851     s->dcmd = insn >> 24;
 852     s->dsp += 8;
 853     switch (insn >> 30) {
 854     case 0: /* Block move.  */
 855         if (s->sist1 & LSI_SIST1_STO) {
 856             DPRINTF("Delayed select timeout\n");
 857             lsi_stop_script(s);
 858             break;
 859         }
 860         s->dbc = insn & 0xffffff;
 861         s->rbc = s->dbc;
 862         if (insn & (1 << 29)) {
 863             /* Indirect addressing.  */
 864             addr = read_dword(s, addr);
 865         } else if (insn & (1 << 28)) {
 866             uint32_t buf[2];
 867             int32_t offset;
 868             /* Table indirect addressing.  */
 869             offset = sxt24(addr);
 870             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 871             s->dbc = cpu_to_le32(buf[0]);
 872             s->rbc = s->dbc;
 873             addr = cpu_to_le32(buf[1]);
 874         }
 875         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 876             DPRINTF("Wrong phase got %d expected %d\n",
 877                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 878             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 879             break;
 880         }
 881         s->dnad = addr;
 882         /* ??? Set ESA.  */
 883         s->ia = s->dsp - 8;
 884         switch (s->sstat1 & 0x7) {
 885         case PHASE_DO:
 886             s->waiting = 2;
 887             lsi_do_dma(s, 1);
 888             if (s->waiting)
 889                 s->waiting = 3;
 890             break;
 891         case PHASE_DI:
 892             s->waiting = 2;
 893             lsi_do_dma(s, 0);
 894             if (s->waiting)
 895                 s->waiting = 3;
 896             break;
 897         case PHASE_CMD:
 898             lsi_do_command(s);
 899             break;
 900         case PHASE_ST:
 901             lsi_do_status(s);
 902             break;
 903         case PHASE_MO:
 904             lsi_do_msgout(s);
 905             break;
 906         case PHASE_MI:
 907             lsi_do_msgin(s);
 908             break;
 909         default:
 910             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
 911             exit(1);
 912         }
 913         s->dfifo = s->dbc & 0xff;
 914         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
 915         s->sbc = s->dbc;
 916         s->rbc -= s->dbc;
 917         s->ua = addr + s->dbc;
 918         break;
 919
 920     case 1: /* IO or Read/Write instruction.  */
 921         opcode = (insn >> 27) & 7;
 922         if (opcode < 5) {
 923             uint32_t id;
 924
 925             if (insn & (1 << 25)) {
 926                 id = read_dword(s, s->dsa + sxt24(insn));
 927             } else {
 928                 id = addr;
 929             }
 930             id = (id >> 16) & 0xf;
 931             if (insn & (1 << 26)) {
 932                 addr = s->dsp + sxt24(addr);
 933             }
 934             s->dnad = addr;
 935             switch (opcode) {
 936             case 0: /* Select */
 937                 s->sdid = id;
 938                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
 939                     DPRINTF("Already reselected by target %d\n", id);
 940                     break;
 941                 }
 942                 s->sstat0 |= LSI_SSTAT0_WOA;
 943                 s->scntl1 &= ~LSI_SCNTL1_IARB;
 944                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
 945                     DPRINTF("Selected absent target %d\n", id);
 946                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 947                     lsi_disconnect(s);
 948                     break;
 949                 }
 950                 DPRINTF("Selected target %d%s\n",
 951                         id, insn & (1 << 3) ? " ATN" : "");
 952                 /* ??? Linux drivers compain when this is set.  Maybe
 953                    it only applies in low-level mode (unimplemented).
 954                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
 955                 s->current_dev = s->scsi_dev[id];
 956                 s->current_tag = id << 8;
 957                 s->scntl1 |= LSI_SCNTL1_CON;
 958                 if (insn & (1 << 3)) {
 959                     s->socl |= LSI_SOCL_ATN;
 960                 }
 961                 lsi_set_phase(s, PHASE_MO);
 962                 break;
 963             case 1: /* Disconnect */
 964                 DPRINTF("Wait Disconect\n");
 965                 s->scntl1 &= ~LSI_SCNTL1_CON;
 966                 break;
 967             case 2: /* Wait Reselect */
 968                 lsi_wait_reselect(s);
 969                 break;
 970             case 3: /* Set */
 971                 DPRINTF("Set%s%s%s%s\n",
 972                         insn & (1 << 3) ? " ATN" : "",
 973                         insn & (1 << 6) ? " ACK" : "",
 974                         insn & (1 << 9) ? " TM" : "",
 975                         insn & (1 << 10) ? " CC" : "");
 976                 if (insn & (1 << 3)) {
 977                     s->socl |= LSI_SOCL_ATN;
 978                     lsi_set_phase(s, PHASE_MO);
 979                 }
 980                 if (insn & (1 << 9)) {
 981                     BADF("Target mode not implemented\n");
 982                     exit(1);
 983                 }
 984                 if (insn & (1 << 10))
 985                     s->carry = 1;
 986                 break;
 987             case 4: /* Clear */
 988                 DPRINTF("Clear%s%s%s%s\n",
 989                         insn & (1 << 3) ? " ATN" : "",
 990                         insn & (1 << 6) ? " ACK" : "",
 991                         insn & (1 << 9) ? " TM" : "",
 992                         insn & (1 << 10) ? " CC" : "");
 993                 if (insn & (1 << 3)) {
 994                     s->socl &= ~LSI_SOCL_ATN;
 995                 }
 996                 if (insn & (1 << 10))
 997                     s->carry = 0;
 998                 break;
 999             }
1000         } else {
1001             uint8_t op0;
1002             uint8_t op1;
1003             uint8_t data8;
1004             int reg;
1005             int operator;
1006 #ifdef DEBUG_LSI
1007             static const char *opcode_names[3] =
1008                 {"Write", "Read", "Read-Modify-Write"};
1009             static const char *operator_names[8] =
1010                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1011 #endif
1012
1013             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1014             data8 = (insn >> 8) & 0xff;
1015             opcode = (insn >> 27) & 7;
1016             operator = (insn >> 24) & 7;
1017             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1018                     opcode_names[opcode - 5], reg,
1019                     operator_names[operator], data8, s->sfbr,
1020                     (insn & (1 << 23)) ? " SFBR" : "");
1021             op0 = op1 = 0;
1022             switch (opcode) {
1023             case 5: /* From SFBR */
1024                 op0 = s->sfbr;
1025                 op1 = data8;
1026                 break;
1027             case 6: /* To SFBR */
1028                 if (operator)
1029                     op0 = lsi_reg_readb(s, reg);
1030                 op1 = data8;
1031                 break;
1032             case 7: /* Read-modify-write */
1033                 if (operator)
1034                     op0 = lsi_reg_readb(s, reg);
1035                 if (insn & (1 << 23)) {
1036                     op1 = s->sfbr;
1037                 } else {
1038                     op1 = data8;
1039                 }
1040                 break;
1041             }
1042
1043             switch (operator) {
1044             case 0: /* move */
1045                 op0 = op1;
1046                 break;
1047             case 1: /* Shift left */
1048                 op1 = op0 >> 7;
1049                 op0 = (op0 << 1) | s->carry;
1050                 s->carry = op1;
1051                 break;
1052             case 2: /* OR */
1053                 op0 |= op1;
1054                 break;
1055             case 3: /* XOR */
1056                 op0 ^= op1;
1057                 break;
1058             case 4: /* AND */
1059                 op0 &= op1;
1060                 break;
1061             case 5: /* SHR */
1062                 op1 = op0 & 1;
1063                 op0 = (op0 >> 1) | (s->carry << 7);
1064                 s->carry = op1;
1065                 break;
1066             case 6: /* ADD */
1067                 op0 += op1;
1068                 s->carry = op0 < op1;
1069                 break;
1070             case 7: /* ADC */
1071                 op0 += op1 + s->carry;
1072                 if (s->carry)
1073                     s->carry = op0 <= op1;
1074                 else
1075                     s->carry = op0 < op1;
1076                 break;
1077             }
1078
1079             switch (opcode) {
1080             case 5: /* From SFBR */
1081             case 7: /* Read-modify-write */
1082                 lsi_reg_writeb(s, reg, op0);
1083                 break;
1084             case 6: /* To SFBR */
1085                 s->sfbr = op0;
1086                 break;
1087             }
1088         }
1089         break;
1090
1091     case 2: /* Transfer Control.  */
1092         {
1093             int cond;
1094             int jmp;
1095
1096             if ((insn & 0x002e0000) == 0) {
1097                 DPRINTF("NOP\n");
1098                 break;
1099             }
1100             if (s->sist1 & LSI_SIST1_STO) {
1101                 DPRINTF("Delayed select timeout\n");
1102                 lsi_stop_script(s);
1103                 break;
1104             }
1105             cond = jmp = (insn & (1 << 19)) != 0;
1106             if (cond == jmp && (insn & (1 << 21))) {
1107                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1108                 cond = s->carry != 0;
1109             }
1110             if (cond == jmp && (insn & (1 << 17))) {
1111                 DPRINTF("Compare phase %d %c= %d\n",
1112                         (s->sstat1 & PHASE_MASK),
1113                         jmp ? '=' : '!',
1114                         ((insn >> 24) & 7));
1115                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1116             }
1117             if (cond == jmp && (insn & (1 << 18))) {
1118                 uint8_t mask;
1119
1120                 mask = (~insn >> 8) & 0xff;
1121                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1122                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1123                 cond = (s->sfbr & mask) == (insn & mask);
1124             }
1125             if (cond == jmp) {
1126                 if (insn & (1 << 23)) {
1127                     /* Relative address.  */
1128                     addr = s->dsp + sxt24(addr);
1129                 }
1130                 switch ((insn >> 27) & 7) {
1131                 case 0: /* Jump */
1132                     DPRINTF("Jump to 0x%08x\n", addr);
1133                     s->dsp = addr;
1134                     break;
1135                 case 1: /* Call */
1136                     DPRINTF("Call 0x%08x\n", addr);
1137                     s->temp = s->dsp;
1138                     s->dsp = addr;
1139                     break;
1140                 case 2: /* Return */
1141                     DPRINTF("Return to 0x%08x\n", s->temp);
1142                     s->dsp = s->temp;
1143                     break;
1144                 case 3: /* Interrupt */
1145                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1146                     if ((insn & (1 << 20)) != 0) {
1147                         s->istat0 |= LSI_ISTAT0_INTF;
1148                         lsi_update_irq(s);
1149                     } else {
1150                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1151                     }
1152                     break;
1153                 default:
1154                     DPRINTF("Illegal transfer control\n");
1155                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1156                     break;
1157                 }
1158             } else {
1159                 DPRINTF("Control condition failed\n");
1160             }
1161         }
1162         break;
1163
1164     case 3:
1165         if ((insn & (1 << 29)) == 0) {
1166             /* Memory move.  */
1167             uint32_t dest;
1168             /* ??? The docs imply the destination address is loaded into
1169                the TEMP register.  However the Linux drivers rely on
1170                the value being presrved.  */
1171             dest = read_dword(s, s->dsp);
1172             s->dsp += 4;
1173             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1174         } else {
1175             uint8_t data[7];
1176             int reg;
1177             int n;
1178             int i;
1179
1180             if (insn & (1 << 28)) {
1181                 addr = s->dsa + sxt24(addr);
1182             }
1183             n = (insn & 7);
1184             reg = (insn >> 16) & 0xff;
1185             if (insn & (1 << 24)) {
1186                 cpu_physical_memory_read(addr, data, n);
1187                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1188                         addr, *(int *)data);
1189                 for (i = 0; i < n; i++) {
1190                     lsi_reg_writeb(s, reg + i, data[i]);
1191                 }
1192             } else {
1193                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1194                 for (i = 0; i < n; i++) {
1195                     data[i] = lsi_reg_readb(s, reg + i);
1196                 }
1197                 cpu_physical_memory_write(addr, data, n);
1198             }
1199         }
1200     }
1201     if (insn_processed > 10000 && !s->waiting) {
1202         /* Some windows drivers make the device spin waiting for a memory
1203            location to change.  If we have been executed a lot of code then
1204            assume this is the case and force an unexpected device disconnect.
1205            This is apparently sufficient to beat the drivers into submission.
1206          */
1207         if (!(s->sien0 & LSI_SIST0_UDC))
1208             fprintf(stderr, "inf. loop with UDC masked\n");
1209         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1210         lsi_disconnect(s);
1211     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1212         if (s->dcntl & LSI_DCNTL_SSM) {
1213             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1214         } else {
1215             goto again;
1216         }
1217     }
1218     DPRINTF("SCRIPTS execution stopped\n");
1219 }
1220
1221 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1222 {
1223     uint8_t tmp;
1224 #define CASE_GET_REG32(name, addr) \
1225     case addr: return s->name & 0xff; \
1226     case addr + 1: return (s->name >> 8) & 0xff; \
1227     case addr + 2: return (s->name >> 16) & 0xff; \
1228     case addr + 3: return (s->name >> 24) & 0xff;
1229
1230 #ifdef DEBUG_LSI_REG
1231     DPRINTF("Read reg %x\n", offset);
1232 #endif
1233     switch (offset) {
1234     case 0x00: /* SCNTL0 */
1235         return s->scntl0;
1236     case 0x01: /* SCNTL1 */
1237         return s->scntl1;
1238     case 0x02: /* SCNTL2 */
1239         return s->scntl2;
1240     case 0x03: /* SCNTL3 */
1241         return s->scntl3;
1242     case 0x04: /* SCID */
1243         return s->scid;
1244     case 0x05: /* SXFER */
1245         return s->sxfer;
1246     case 0x06: /* SDID */
1247         return s->sdid;
1248     case 0x07: /* GPREG0 */
1249         return 0x7f;
1250     case 0x08: /* Revision ID */
1251         return 0x00;
1252     case 0xa: /* SSID */
1253         return s->ssid;
1254     case 0xb: /* SBCL */
1255         /* ??? This is not correct. However it's (hopefully) only
1256            used for diagnostics, so should be ok.  */
1257         return 0;
1258     case 0xc: /* DSTAT */
1259         tmp = s->dstat | 0x80;
1260         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1261             s->dstat = 0;
1262         lsi_update_irq(s);
1263         return tmp;
1264     case 0x0d: /* SSTAT0 */
1265         return s->sstat0;
1266     case 0x0e: /* SSTAT1 */
1267         return s->sstat1;
1268     case 0x0f: /* SSTAT2 */
1269         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1270     CASE_GET_REG32(dsa, 0x10)
1271     case 0x14: /* ISTAT0 */
1272         return s->istat0;
1273     case 0x16: /* MBOX0 */
1274         return s->mbox0;
1275     case 0x17: /* MBOX1 */
1276         return s->mbox1;
1277     case 0x18: /* CTEST0 */
1278         return 0xff;
1279     case 0x19: /* CTEST1 */
1280         return 0;
1281     case 0x1a: /* CTEST2 */
1282         tmp = LSI_CTEST2_DACK | LSI_CTEST2_CM;
1283         if (s->istat0 & LSI_ISTAT0_SIGP) {
1284             s->istat0 &= ~LSI_ISTAT0_SIGP;
1285             tmp |= LSI_CTEST2_SIGP;
1286         }
1287         return tmp;
1288     case 0x1b: /* CTEST3 */
1289         return s->ctest3;
1290     CASE_GET_REG32(temp, 0x1c)
1291     case 0x20: /* DFIFO */
1292         return 0;
1293     case 0x21: /* CTEST4 */
1294         return s->ctest4;
1295     case 0x22: /* CTEST5 */
1296         return s->ctest5;
1297     case 0x23: /* CTEST6 */
1298          return 0;
1299     case 0x24: /* DBC[0:7] */
1300         return s->dbc & 0xff;
1301     case 0x25: /* DBC[8:15] */
1302         return (s->dbc >> 8) & 0xff;
1303     case 0x26: /* DBC[16->23] */
1304         return (s->dbc >> 16) & 0xff;
1305     case 0x27: /* DCMD */
1306         return s->dcmd;
1307     CASE_GET_REG32(dsp, 0x2c)
1308     CASE_GET_REG32(dsps, 0x30)
1309     CASE_GET_REG32(scratch[0], 0x34)
1310     case 0x38: /* DMODE */
1311         return s->dmode;
1312     case 0x39: /* DIEN */
1313         return s->dien;
1314     case 0x3b: /* DCNTL */
1315         return s->dcntl;
1316     case 0x40: /* SIEN0 */
1317         return s->sien0;
1318     case 0x41: /* SIEN1 */
1319         return s->sien1;
1320     case 0x42: /* SIST0 */
1321         tmp = s->sist0;
1322         s->sist0 = 0;
1323         lsi_update_irq(s);
1324         return tmp;
1325     case 0x43: /* SIST1 */
1326         tmp = s->sist1;
1327         s->sist1 = 0;
1328         lsi_update_irq(s);
1329         return tmp;
1330     case 0x47: /* GPCNTL0 */
1331         return 0x0f;
1332     case 0x48: /* STIME0 */
1333         return s->stime0;
1334     case 0x4a: /* RESPID0 */
1335         return s->respid0;
1336     case 0x4b: /* RESPID1 */
1337         return s->respid1;
1338     case 0x4d: /* STEST1 */
1339         return s->stest1;
1340     case 0x4e: /* STEST2 */
1341         return s->stest2;
1342     case 0x4f: /* STEST3 */
1343         return s->stest3;
1344     case 0x50: /* SIDL */
1345         /* This is needed by the linux drivers.  We currently only update it
1346            during the MSG IN phase.  */
1347         return s->sidl;
1348     case 0x52: /* STEST4 */
1349         return 0xe0;
1350     case 0x56: /* CCNTL0 */
1351         return s->ccntl0;
1352     case 0x57: /* CCNTL1 */
1353         return s->ccntl1;
1354     case 0x58: /* SBDL */
1355         /* Some drivers peek at the data bus during the MSG IN phase.  */
1356         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1357             return s->msg[0];
1358         return 0;
1359     case 0x59: /* SBDL high */
1360         return 0;
1361     CASE_GET_REG32(mmrs, 0xa0)
1362     CASE_GET_REG32(mmws, 0xa4)
1363     CASE_GET_REG32(sfs, 0xa8)
1364     CASE_GET_REG32(drs, 0xac)
1365     CASE_GET_REG32(sbms, 0xb0)
1366     CASE_GET_REG32(dmbs, 0xb4)
1367     CASE_GET_REG32(dnad64, 0xb8)
1368     CASE_GET_REG32(pmjad1, 0xc0)
1369     CASE_GET_REG32(pmjad2, 0xc4)
1370     CASE_GET_REG32(rbc, 0xc8)
1371     CASE_GET_REG32(ua, 0xcc)
1372     CASE_GET_REG32(ia, 0xd4)
1373     CASE_GET_REG32(sbc, 0xd8)
1374     CASE_GET_REG32(csbc, 0xdc)
1375     }
1376     if (offset >= 0x5c && offset < 0xa0) {
1377         int n;
1378         int shift;
1379         n = (offset - 0x58) >> 2;
1380         shift = (offset & 3) * 8;
1381         return (s->scratch[n] >> shift) & 0xff;
1382     }
1383     BADF("readb 0x%x\n", offset);
1384     exit(1);
1385 #undef CASE_GET_REG32
1386 }
1387
1388 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1389 {
1390 #define CASE_SET_REG32(name, addr) \
1391     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1392     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1393     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1394     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1395
1396 #ifdef DEBUG_LSI_REG
1397     DPRINTF("Write reg %x = %02x\n", offset, val);
1398 #endif
1399     switch (offset) {
1400     case 0x00: /* SCNTL0 */
1401         s->scntl0 = val;
1402         if (val & LSI_SCNTL0_START) {
1403             BADF("Start sequence not implemented\n");
1404         }
1405         break;
1406     case 0x01: /* SCNTL1 */
1407         s->scntl1 = val & ~LSI_SCNTL1_SST;
1408         if (val & LSI_SCNTL1_IARB) {
1409             BADF("Immediate Arbritration not implemented\n");
1410         }
1411         if (val & LSI_SCNTL1_RST) {
1412             s->sstat0 |= LSI_SSTAT0_RST;
1413             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1414         } else {
1415             s->sstat0 &= ~LSI_SSTAT0_RST;
1416         }
1417         break;
1418     case 0x02: /* SCNTL2 */
1419         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1420         s->scntl2 = val;
1421         break;
1422     case 0x03: /* SCNTL3 */
1423         s->scntl3 = val;
1424         break;
1425     case 0x04: /* SCID */
1426         s->scid = val;
1427         break;
1428     case 0x05: /* SXFER */
1429         s->sxfer = val;
1430         break;
1431     case 0x06: /* SDID */
1432         if ((val & 0xf) != (s->ssid & 0xf))
1433             BADF("Destination ID does not match SSID\n");
1434         s->sdid = val & 0xf;
1435         break;
1436     case 0x07: /* GPREG0 */
1437         break;
1438     case 0x08: /* SFBR */
1439         /* The CPU is not allowed to write to this register.  However the
1440            SCRIPTS register move instructions are.  */
1441         s->sfbr = val;
1442         break;
1443     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1444         /* Linux writes to these readonly registers on startup.  */
1445         return;
1446     CASE_SET_REG32(dsa, 0x10)
1447     case 0x14: /* ISTAT0 */
1448         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1449         if (val & LSI_ISTAT0_ABRT) {
1450             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1451         }
1452         if (val & LSI_ISTAT0_INTF) {
1453             s->istat0 &= ~LSI_ISTAT0_INTF;
1454             lsi_update_irq(s);
1455         }
1456         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1457             DPRINTF("Woken by SIGP\n");
1458             s->waiting = 0;
1459             s->dsp = s->dnad;
1460             lsi_execute_script(s);
1461         }
1462         if (val & LSI_ISTAT0_SRST) {
1463             lsi_soft_reset(s);
1464         }
1465         break;
1466     case 0x16: /* MBOX0 */
1467         s->mbox0 = val;
1468         break;
1469     case 0x17: /* MBOX1 */
1470         s->mbox1 = val;
1471         break;
1472     case 0x1b: /* CTEST3 */
1473         s->ctest3 = val & 0x0f;
1474         break;
1475     CASE_SET_REG32(temp, 0x1c)
1476     case 0x21: /* CTEST4 */
1477         if (val & 7) {
1478            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1479         }
1480         s->ctest4 = val;
1481         break;
1482     case 0x22: /* CTEST5 */
1483         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1484             BADF("CTEST5 DMA increment not implemented\n");
1485         }
1486         s->ctest5 = val;
1487         break;
1488     case 0x2c: /* DSP[0:7] */
1489         s->dsp &= 0xffffff00;
1490         s->dsp |= val;
1491         break;
1492     case 0x2d: /* DSP[8:15] */
1493         s->dsp &= 0xffff00ff;
1494         s->dsp |= val << 8;
1495         break;
1496     case 0x2e: /* DSP[16:23] */
1497         s->dsp &= 0xff00ffff;
1498         s->dsp |= val << 16;
1499         break;
1500     case 0x2f: /* DSP[24:31] */
1501         s->dsp &= 0x00ffffff;
1502         s->dsp |= val << 24;
1503         if ((s->dmode & LSI_DMODE_MAN) == 0
1504             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1505             lsi_execute_script(s);
1506         break;
1507     CASE_SET_REG32(dsps, 0x30)
1508     CASE_SET_REG32(scratch[0], 0x34)
1509     case 0x38: /* DMODE */
1510         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1511             BADF("IO mappings not implemented\n");
1512         }
1513         s->dmode = val;
1514         break;
1515     case 0x39: /* DIEN */
1516         s->dien = val;
1517         lsi_update_irq(s);
1518         break;
1519     case 0x3b: /* DCNTL */
1520         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1521         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1522             lsi_execute_script(s);
1523         break;
1524     case 0x40: /* SIEN0 */
1525         s->sien0 = val;
1526         lsi_update_irq(s);
1527         break;
1528     case 0x41: /* SIEN1 */
1529         s->sien1 = val;
1530         lsi_update_irq(s);
1531         break;
1532     case 0x47: /* GPCNTL0 */
1533         break;
1534     case 0x48: /* STIME0 */
1535         s->stime0 = val;
1536         break;
1537     case 0x49: /* STIME1 */
1538         if (val & 0xf) {
1539             DPRINTF("General purpose timer not implemented\n");
1540             /* ??? Raising the interrupt immediately seems to be sufficient
1541                to keep the FreeBSD driver happy.  */
1542             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1543         }
1544         break;
1545     case 0x4a: /* RESPID0 */
1546         s->respid0 = val;
1547         break;
1548     case 0x4b: /* RESPID1 */
1549         s->respid1 = val;
1550         break;
1551     case 0x4d: /* STEST1 */
1552         s->stest1 = val;
1553         break;
1554     case 0x4e: /* STEST2 */
1555         if (val & 1) {
1556             BADF("Low level mode not implemented\n");
1557         }
1558         s->stest2 = val;
1559         break;
1560     case 0x4f: /* STEST3 */
1561         if (val & 0x41) {
1562             BADF("SCSI FIFO test mode not implemented\n");
1563         }
1564         s->stest3 = val;
1565         break;
1566     case 0x56: /* CCNTL0 */
1567         s->ccntl0 = val;
1568         break;
1569     case 0x57: /* CCNTL1 */
1570         s->ccntl1 = val;
1571         break;
1572     CASE_SET_REG32(mmrs, 0xa0)
1573     CASE_SET_REG32(mmws, 0xa4)
1574     CASE_SET_REG32(sfs, 0xa8)
1575     CASE_SET_REG32(drs, 0xac)
1576     CASE_SET_REG32(sbms, 0xb0)
1577     CASE_SET_REG32(dmbs, 0xb4)
1578     CASE_SET_REG32(dnad64, 0xb8)
1579     CASE_SET_REG32(pmjad1, 0xc0)
1580     CASE_SET_REG32(pmjad2, 0xc4)
1581     CASE_SET_REG32(rbc, 0xc8)
1582     CASE_SET_REG32(ua, 0xcc)
1583     CASE_SET_REG32(ia, 0xd4)
1584     CASE_SET_REG32(sbc, 0xd8)
1585     CASE_SET_REG32(csbc, 0xdc)
1586     default:
1587         if (offset >= 0x5c && offset < 0xa0) {
1588             int n;
1589             int shift;
1590             n = (offset - 0x58) >> 2;
1591             shift = (offset & 3) * 8;
1592             s->scratch[n] &= ~(0xff << shift);
1593             s->scratch[n] |= (val & 0xff) << shift;
1594         } else {
1595             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1596         }
1597     }
1598 #undef CASE_SET_REG32
1599 }
1600
1601 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1602 {
1603     LSIState *s = (LSIState *)opaque;
1604
1605     lsi_reg_writeb(s, addr & 0xff, val);
1606 }
1607
1608 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1609 {
1610     LSIState *s = (LSIState *)opaque;
1611
1612     addr &= 0xff;
1613     lsi_reg_writeb(s, addr, val & 0xff);
1614     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1615 }
1616
1617 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1618 {
1619     LSIState *s = (LSIState *)opaque;
1620
1621     addr &= 0xff;
1622     lsi_reg_writeb(s, addr, val & 0xff);
1623     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1624     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1625     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1626 }
1627
1628 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1629 {
1630     LSIState *s = (LSIState *)opaque;
1631
1632     return lsi_reg_readb(s, addr & 0xff);
1633 }
1634
1635 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1636 {
1637     LSIState *s = (LSIState *)opaque;
1638     uint32_t val;
1639
1640     addr &= 0xff;
1641     val = lsi_reg_readb(s, addr);
1642     val |= lsi_reg_readb(s, addr + 1) << 8;
1643     return val;
1644 }
1645
1646 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1647 {
1648     LSIState *s = (LSIState *)opaque;
1649     uint32_t val;
1650     addr &= 0xff;
1651     val = lsi_reg_readb(s, addr);
1652     val |= lsi_reg_readb(s, addr + 1) << 8;
1653     val |= lsi_reg_readb(s, addr + 2) << 16;
1654     val |= lsi_reg_readb(s, addr + 3) << 24;
1655     return val;
1656 }
1657
1658 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1659     lsi_mmio_readb,
1660     lsi_mmio_readw,
1661     lsi_mmio_readl,
1662 };
1663
1664 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1665     lsi_mmio_writeb,
1666     lsi_mmio_writew,
1667     lsi_mmio_writel,
1668 };
1669
1670 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1671 {
1672     LSIState *s = (LSIState *)opaque;
1673     uint32_t newval;
1674     int shift;
1675
1676     addr &= 0x1fff;
1677     newval = s->script_ram[addr >> 2];
1678     shift = (addr & 3) * 8;
1679     newval &= ~(0xff << shift);
1680     newval |= val << shift;
1681     s->script_ram[addr >> 2] = newval;
1682 }
1683
1684 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1685 {
1686     LSIState *s = (LSIState *)opaque;
1687     uint32_t newval;
1688
1689     addr &= 0x1fff;
1690     newval = s->script_ram[addr >> 2];
1691     if (addr & 2) {
1692         newval = (newval & 0xffff) | (val << 16);
1693     } else {
1694         newval = (newval & 0xffff0000) | val;
1695     }
1696     s->script_ram[addr >> 2] = newval;
1697 }
1698
1699
1700 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1701 {
1702     LSIState *s = (LSIState *)opaque;
1703
1704     addr &= 0x1fff;
1705     s->script_ram[addr >> 2] = val;
1706 }
1707
1708 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1709 {
1710     LSIState *s = (LSIState *)opaque;
1711     uint32_t val;
1712
1713     addr &= 0x1fff;
1714     val = s->script_ram[addr >> 2];
1715     val >>= (addr & 3) * 8;
1716     return val & 0xff;
1717 }
1718
1719 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1720 {
1721     LSIState *s = (LSIState *)opaque;
1722     uint32_t val;
1723
1724     addr &= 0x1fff;
1725     val = s->script_ram[addr >> 2];
1726     if (addr & 2)
1727         val >>= 16;
1728     return le16_to_cpu(val);
1729 }
1730
1731 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1732 {
1733     LSIState *s = (LSIState *)opaque;
1734
1735     addr &= 0x1fff;
1736     return le32_to_cpu(s->script_ram[addr >> 2]);
1737 }
1738
1739 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1740     lsi_ram_readb,
1741     lsi_ram_readw,
1742     lsi_ram_readl,
1743 };
1744
1745 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1746     lsi_ram_writeb,
1747     lsi_ram_writew,
1748     lsi_ram_writel,
1749 };
1750
1751 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1752 {
1753     LSIState *s = (LSIState *)opaque;
1754     return lsi_reg_readb(s, addr & 0xff);
1755 }
1756
1757 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1758 {
1759     LSIState *s = (LSIState *)opaque;
1760     uint32_t val;
1761     addr &= 0xff;
1762     val = lsi_reg_readb(s, addr);
1763     val |= lsi_reg_readb(s, addr + 1) << 8;
1764     return val;
1765 }
1766
1767 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1768 {
1769     LSIState *s = (LSIState *)opaque;
1770     uint32_t val;
1771     addr &= 0xff;
1772     val = lsi_reg_readb(s, addr);
1773     val |= lsi_reg_readb(s, addr + 1) << 8;
1774     val |= lsi_reg_readb(s, addr + 2) << 16;
1775     val |= lsi_reg_readb(s, addr + 3) << 24;
1776     return val;
1777 }
1778
1779 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1780 {
1781     LSIState *s = (LSIState *)opaque;
1782     lsi_reg_writeb(s, addr & 0xff, val);
1783 }
1784
1785 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1786 {
1787     LSIState *s = (LSIState *)opaque;
1788     addr &= 0xff;
1789     lsi_reg_writeb(s, addr, val & 0xff);
1790     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1791 }
1792
1793 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1794 {
1795     LSIState *s = (LSIState *)opaque;
1796     addr &= 0xff;
1797     lsi_reg_writeb(s, addr, val & 0xff);
1798     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1799     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1800     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1801 }
1802
1803 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1804                            uint32_t addr, uint32_t size, int type)
1805 {
1806     LSIState *s = (LSIState *)pci_dev;
1807
1808     DPRINTF("Mapping IO at %08x\n", addr);
1809
1810     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1811     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1812     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1813     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1814     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1815     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1816 }
1817
1818 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1819                             uint32_t addr, uint32_t size, int type)
1820 {
1821     LSIState *s = (LSIState *)pci_dev;
1822
1823     DPRINTF("Mapping ram at %08x\n", addr);
1824     s->script_ram_base = addr;
1825     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1826 }
1827
1828 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1829                              uint32_t addr, uint32_t size, int type)
1830 {
1831     LSIState *s = (LSIState *)pci_dev;
1832
1833     DPRINTF("Mapping registers at %08x\n", addr);
1834     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1835 }
1836
1837 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1838 {
1839     LSIState *s = (LSIState *)opaque;
1840
1841     if (id < 0) {
1842         for (id = 0; id < LSI_MAX_DEVS; id++) {
1843             if (s->scsi_dev[id] == NULL)
1844                 break;
1845         }
1846     }
1847     if (id >= LSI_MAX_DEVS) {
1848         BADF("Bad Device ID %d\n", id);
1849         return;
1850     }
1851     if (s->scsi_dev[id]) {
1852         DPRINTF("Destroying device %d\n", id);
1853         s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1854     }
1855     DPRINTF("Attaching block device %d\n", id);
1856     s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1857     if (s->scsi_dev[id] == NULL)
1858         s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1859 }
1860
1861 void *lsi_scsi_init(PCIBus *bus, int devfn)
1862 {
1863     LSIState *s;
1864
1865     s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1866                                         sizeof(*s), devfn, NULL, NULL);
1867     if (s == NULL) {
1868         fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1869         return NULL;
1870     }
1871
1872     s->pci_dev.config[0x00] = 0x00;
1873     s->pci_dev.config[0x01] = 0x10;
1874     s->pci_dev.config[0x02] = 0x12;
1875     s->pci_dev.config[0x03] = 0x00;
1876     s->pci_dev.config[0x0b] = 0x01;
1877     s->pci_dev.config[0x3d] = 0x01; /* interrupt pin 1 */
1878
1879     s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1880                                              lsi_mmio_writefn, s);
1881     s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1882                                             lsi_ram_writefn, s);
1883
1884     pci_register_io_region((struct PCIDevice *)s, 0, 256,
1885                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1886     pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1887                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
1888     pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
1889                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
1890     s->queue = qemu_malloc(sizeof(lsi_queue));
1891     s->queue_len = 1;
1892     s->active_commands = 0;
1893
1894     lsi_soft_reset(s);
1895
1896     return s;
1897 }
1898