hw/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licenced under the LGPL.
   8  */
   9
  10 /* ??? Need to check if the {read,write}[wl] routines work properly on
  11    big-endian targets.  */
  12
  13 #include "hw.h"
  14 #include "pci.h"
  15 #include "scsi-disk.h"
  16
  17 //#define DEBUG_LSI
  18 //#define DEBUG_LSI_REG
  19
  20 #ifdef DEBUG_LSI
  21 #define DPRINTF(fmt, args...) \
  22 do { printf("lsi_scsi: " fmt , ##args); } while (0)
  23 #define BADF(fmt, args...) \
  24 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args); exit(1);} while (0)
  25 #else
  26 #define DPRINTF(fmt, args...) do {} while(0)
  27 #define BADF(fmt, args...) \
  28 do { fprintf(stderr, "lsi_scsi: error: " fmt , ##args);} while (0)
  29 #endif
  30
  31 #define LSI_SCNTL0_TRG    0x01
  32 #define LSI_SCNTL0_AAP    0x02
  33 #define LSI_SCNTL0_EPC    0x08
  34 #define LSI_SCNTL0_WATN   0x10
  35 #define LSI_SCNTL0_START  0x20
  36
  37 #define LSI_SCNTL1_SST    0x01
  38 #define LSI_SCNTL1_IARB   0x02
  39 #define LSI_SCNTL1_AESP   0x04
  40 #define LSI_SCNTL1_RST    0x08
  41 #define LSI_SCNTL1_CON    0x10
  42 #define LSI_SCNTL1_DHP    0x20
  43 #define LSI_SCNTL1_ADB    0x40
  44 #define LSI_SCNTL1_EXC    0x80
  45
  46 #define LSI_SCNTL2_WSR    0x01
  47 #define LSI_SCNTL2_VUE0   0x02
  48 #define LSI_SCNTL2_VUE1   0x04
  49 #define LSI_SCNTL2_WSS    0x08
  50 #define LSI_SCNTL2_SLPHBEN 0x10
  51 #define LSI_SCNTL2_SLPMD  0x20
  52 #define LSI_SCNTL2_CHM    0x40
  53 #define LSI_SCNTL2_SDU    0x80
  54
  55 #define LSI_ISTAT0_DIP    0x01
  56 #define LSI_ISTAT0_SIP    0x02
  57 #define LSI_ISTAT0_INTF   0x04
  58 #define LSI_ISTAT0_CON    0x08
  59 #define LSI_ISTAT0_SEM    0x10
  60 #define LSI_ISTAT0_SIGP   0x20
  61 #define LSI_ISTAT0_SRST   0x40
  62 #define LSI_ISTAT0_ABRT   0x80
  63
  64 #define LSI_ISTAT1_SI     0x01
  65 #define LSI_ISTAT1_SRUN   0x02
  66 #define LSI_ISTAT1_FLSH   0x04
  67
  68 #define LSI_SSTAT0_SDP0   0x01
  69 #define LSI_SSTAT0_RST    0x02
  70 #define LSI_SSTAT0_WOA    0x04
  71 #define LSI_SSTAT0_LOA    0x08
  72 #define LSI_SSTAT0_AIP    0x10
  73 #define LSI_SSTAT0_OLF    0x20
  74 #define LSI_SSTAT0_ORF    0x40
  75 #define LSI_SSTAT0_ILF    0x80
  76
  77 #define LSI_SIST0_PAR     0x01
  78 #define LSI_SIST0_RST     0x02
  79 #define LSI_SIST0_UDC     0x04
  80 #define LSI_SIST0_SGE     0x08
  81 #define LSI_SIST0_RSL     0x10
  82 #define LSI_SIST0_SEL     0x20
  83 #define LSI_SIST0_CMP     0x40
  84 #define LSI_SIST0_MA      0x80
  85
  86 #define LSI_SIST1_HTH     0x01
  87 #define LSI_SIST1_GEN     0x02
  88 #define LSI_SIST1_STO     0x04
  89 #define LSI_SIST1_SBMC    0x10
  90
  91 #define LSI_SOCL_IO       0x01
  92 #define LSI_SOCL_CD       0x02
  93 #define LSI_SOCL_MSG      0x04
  94 #define LSI_SOCL_ATN      0x08
  95 #define LSI_SOCL_SEL      0x10
  96 #define LSI_SOCL_BSY      0x20
  97 #define LSI_SOCL_ACK      0x40
  98 #define LSI_SOCL_REQ      0x80
  99
 100 #define LSI_DSTAT_IID     0x01
 101 #define LSI_DSTAT_SIR     0x04
 102 #define LSI_DSTAT_SSI     0x08
 103 #define LSI_DSTAT_ABRT    0x10
 104 #define LSI_DSTAT_BF      0x20
 105 #define LSI_DSTAT_MDPE    0x40
 106 #define LSI_DSTAT_DFE     0x80
 107
 108 #define LSI_DCNTL_COM     0x01
 109 #define LSI_DCNTL_IRQD    0x02
 110 #define LSI_DCNTL_STD     0x04
 111 #define LSI_DCNTL_IRQM    0x08
 112 #define LSI_DCNTL_SSM     0x10
 113 #define LSI_DCNTL_PFEN    0x20
 114 #define LSI_DCNTL_PFF     0x40
 115 #define LSI_DCNTL_CLSE    0x80
 116
 117 #define LSI_DMODE_MAN     0x01
 118 #define LSI_DMODE_BOF     0x02
 119 #define LSI_DMODE_ERMP    0x04
 120 #define LSI_DMODE_ERL     0x08
 121 #define LSI_DMODE_DIOM    0x10
 122 #define LSI_DMODE_SIOM    0x20
 123
 124 #define LSI_CTEST2_DACK   0x01
 125 #define LSI_CTEST2_DREQ   0x02
 126 #define LSI_CTEST2_TEOP   0x04
 127 #define LSI_CTEST2_PCICIE 0x08
 128 #define LSI_CTEST2_CM     0x10
 129 #define LSI_CTEST2_CIO    0x20
 130 #define LSI_CTEST2_SIGP   0x40
 131 #define LSI_CTEST2_DDIR   0x80
 132
 133 #define LSI_CTEST5_BL2    0x04
 134 #define LSI_CTEST5_DDIR   0x08
 135 #define LSI_CTEST5_MASR   0x10
 136 #define LSI_CTEST5_DFSN   0x20
 137 #define LSI_CTEST5_BBCK   0x40
 138 #define LSI_CTEST5_ADCK   0x80
 139
 140 #define LSI_CCNTL0_DILS   0x01
 141 #define LSI_CCNTL0_DISFC  0x10
 142 #define LSI_CCNTL0_ENNDJ  0x20
 143 #define LSI_CCNTL0_PMJCTL 0x40
 144 #define LSI_CCNTL0_ENPMJ  0x80
 145
 146 #define LSI_CCNTL1_EN64DBMV  0x01
 147 #define LSI_CCNTL1_EN64TIBMV 0x02
 148 #define LSI_CCNTL1_64TIMOD   0x04
 149 #define LSI_CCNTL1_DDAC      0x08
 150 #define LSI_CCNTL1_ZMOD      0x80
 151
 152 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 153
 154 #define PHASE_DO          0
 155 #define PHASE_DI          1
 156 #define PHASE_CMD         2
 157 #define PHASE_ST          3
 158 #define PHASE_MO          6
 159 #define PHASE_MI          7
 160 #define PHASE_MASK        7
 161
 162 /* Maximum length of MSG IN data.  */
 163 #define LSI_MAX_MSGIN_LEN 8
 164
 165 /* Flag set if this is a tagged command.  */
 166 #define LSI_TAG_VALID     (1 << 16)
 167
 168 typedef struct {
 169     uint32_t tag;
 170     uint32_t pending;
 171     int out;
 172 } lsi_queue;
 173
 174 typedef struct {
 175     PCIDevice pci_dev;
 176     int mmio_io_addr;
 177     int ram_io_addr;
 178     uint32_t script_ram_base;
 179
 180     int carry; /* ??? Should this be an a visible register somewhere?  */
 181     int sense;
 182     /* Action to take at the end of a MSG IN phase.
 183        0 = COMMAND, 1 = disconect, 2 = DATA OUT, 3 = DATA IN.  */
 184     int msg_action;
 185     int msg_len;
 186     uint8_t msg[LSI_MAX_MSGIN_LEN];
 187     /* 0 if SCRIPTS are running or stopped.
 188      * 1 if a Wait Reselect instruction has been issued.
 189      * 2 if processing DMA from lsi_execute_script.
 190      * 3 if a DMA operation is in progress.  */
 191     int waiting;
 192     SCSIDevice *scsi_dev[LSI_MAX_DEVS];
 193     SCSIDevice *current_dev;
 194     int current_lun;
 195     /* The tag is a combination of the device ID and the SCSI tag.  */
 196     uint32_t current_tag;
 197     uint32_t current_dma_len;
 198     int command_complete;
 199     uint8_t *dma_buf;
 200     lsi_queue *queue;
 201     int queue_len;
 202     int active_commands;
 203
 204     uint32_t dsa;
 205     uint32_t temp;
 206     uint32_t dnad;
 207     uint32_t dbc;
 208     uint8_t istat0;
 209     uint8_t istat1;
 210     uint8_t dcmd;
 211     uint8_t dstat;
 212     uint8_t dien;
 213     uint8_t sist0;
 214     uint8_t sist1;
 215     uint8_t sien0;
 216     uint8_t sien1;
 217     uint8_t mbox0;
 218     uint8_t mbox1;
 219     uint8_t dfifo;
 220     uint8_t ctest2;
 221     uint8_t ctest3;
 222     uint8_t ctest4;
 223     uint8_t ctest5;
 224     uint8_t ccntl0;
 225     uint8_t ccntl1;
 226     uint32_t dsp;
 227     uint32_t dsps;
 228     uint8_t dmode;
 229     uint8_t dcntl;
 230     uint8_t scntl0;
 231     uint8_t scntl1;
 232     uint8_t scntl2;
 233     uint8_t scntl3;
 234     uint8_t sstat0;
 235     uint8_t sstat1;
 236     uint8_t scid;
 237     uint8_t sxfer;
 238     uint8_t socl;
 239     uint8_t sdid;
 240     uint8_t ssid;
 241     uint8_t sfbr;
 242     uint8_t stest1;
 243     uint8_t stest2;
 244     uint8_t stest3;
 245     uint8_t sidl;
 246     uint8_t stime0;
 247     uint8_t respid0;
 248     uint8_t respid1;
 249     uint32_t mmrs;
 250     uint32_t mmws;
 251     uint32_t sfs;
 252     uint32_t drs;
 253     uint32_t sbms;
 254     uint32_t dbms;
 255     uint32_t dnad64;
 256     uint32_t pmjad1;
 257     uint32_t pmjad2;
 258     uint32_t rbc;
 259     uint32_t ua;
 260     uint32_t ia;
 261     uint32_t sbc;
 262     uint32_t csbc;
 263     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 264
 265     /* Script ram is stored as 32-bit words in host byteorder.  */
 266     uint32_t script_ram[2048];
 267 } LSIState;
 268
 269 static void lsi_soft_reset(LSIState *s)
 270 {
 271     DPRINTF("Reset\n");
 272     s->carry = 0;
 273
 274     s->waiting = 0;
 275     s->dsa = 0;
 276     s->dnad = 0;
 277     s->dbc = 0;
 278     s->temp = 0;
 279     memset(s->scratch, 0, sizeof(s->scratch));
 280     s->istat0 = 0;
 281     s->istat1 = 0;
 282     s->dcmd = 0;
 283     s->dstat = 0;
 284     s->dien = 0;
 285     s->sist0 = 0;
 286     s->sist1 = 0;
 287     s->sien0 = 0;
 288     s->sien1 = 0;
 289     s->mbox0 = 0;
 290     s->mbox1 = 0;
 291     s->dfifo = 0;
 292     s->ctest2 = 0;
 293     s->ctest3 = 0;
 294     s->ctest4 = 0;
 295     s->ctest5 = 0;
 296     s->ccntl0 = 0;
 297     s->ccntl1 = 0;
 298     s->dsp = 0;
 299     s->dsps = 0;
 300     s->dmode = 0;
 301     s->dcntl = 0;
 302     s->scntl0 = 0xc0;
 303     s->scntl1 = 0;
 304     s->scntl2 = 0;
 305     s->scntl3 = 0;
 306     s->sstat0 = 0;
 307     s->sstat1 = 0;
 308     s->scid = 7;
 309     s->sxfer = 0;
 310     s->socl = 0;
 311     s->stest1 = 0;
 312     s->stest2 = 0;
 313     s->stest3 = 0;
 314     s->sidl = 0;
 315     s->stime0 = 0;
 316     s->respid0 = 0x80;
 317     s->respid1 = 0;
 318     s->mmrs = 0;
 319     s->mmws = 0;
 320     s->sfs = 0;
 321     s->drs = 0;
 322     s->sbms = 0;
 323     s->dbms = 0;
 324     s->dnad64 = 0;
 325     s->pmjad1 = 0;
 326     s->pmjad2 = 0;
 327     s->rbc = 0;
 328     s->ua = 0;
 329     s->ia = 0;
 330     s->sbc = 0;
 331     s->csbc = 0;
 332 }
 333
 334 static int lsi_dma_40bit(LSIState *s)
 335 {
 336     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 337         return 1;
 338     return 0;
 339 }
 340
 341 static int lsi_dma_ti64bit(LSIState *s)
 342 {
 343     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 344         return 1;
 345     return 0;
 346 }
 347
 348 static int lsi_dma_64bit(LSIState *s)
 349 {
 350     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 351         return 1;
 352     return 0;
 353 }
 354
 355 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 356 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 357 static void lsi_execute_script(LSIState *s);
 358
 359 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 360 {
 361     uint32_t buf;
 362
 363     /* Optimize reading from SCRIPTS RAM.  */
 364     if ((addr & 0xffffe000) == s->script_ram_base) {
 365         return s->script_ram[(addr & 0x1fff) >> 2];
 366     }
 367     cpu_physical_memory_read(addr, (uint8_t *)&buf, 4);
 368     return cpu_to_le32(buf);
 369 }
 370
 371 static void lsi_stop_script(LSIState *s)
 372 {
 373     s->istat1 &= ~LSI_ISTAT1_SRUN;
 374 }
 375
 376 static void lsi_update_irq(LSIState *s)
 377 {
 378     int level;
 379     static int last_level;
 380
 381     /* It's unclear whether the DIP/SIP bits should be cleared when the
 382        Interrupt Status Registers are cleared or when istat0 is read.
 383        We currently do the formwer, which seems to work.  */
 384     level = 0;
 385     if (s->dstat) {
 386         if (s->dstat & s->dien)
 387             level = 1;
 388         s->istat0 |= LSI_ISTAT0_DIP;
 389     } else {
 390         s->istat0 &= ~LSI_ISTAT0_DIP;
 391     }
 392
 393     if (s->sist0 || s->sist1) {
 394         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 395             level = 1;
 396         s->istat0 |= LSI_ISTAT0_SIP;
 397     } else {
 398         s->istat0 &= ~LSI_ISTAT0_SIP;
 399     }
 400     if (s->istat0 & LSI_ISTAT0_INTF)
 401         level = 1;
 402
 403     if (level != last_level) {
 404         DPRINTF("Update IRQ level %d dstat %02x sist %02x%02x\n",
 405                 level, s->dstat, s->sist1, s->sist0);
 406         last_level = level;
 407     }
 408     qemu_set_irq(s->pci_dev.irq[0], level);
 409 }
 410
 411 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 412 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 413 {
 414     uint32_t mask0;
 415     uint32_t mask1;
 416
 417     DPRINTF("SCSI Interrupt 0x%02x%02x prev 0x%02x%02x\n",
 418             stat1, stat0, s->sist1, s->sist0);
 419     s->sist0 |= stat0;
 420     s->sist1 |= stat1;
 421     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 422        we don't stop processing when raising STO.  Instead continue
 423        execution and stop at the next insn that accesses the SCSI bus.  */
 424     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 425     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 426     mask1 &= ~LSI_SIST1_STO;
 427     if (s->sist0 & mask0 || s->sist1 & mask1) {
 428         lsi_stop_script(s);
 429     }
 430     lsi_update_irq(s);
 431 }
 432
 433 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 434 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 435 {
 436     DPRINTF("DMA Interrupt 0x%x prev 0x%x\n", stat, s->dstat);
 437     s->dstat |= stat;
 438     lsi_update_irq(s);
 439     lsi_stop_script(s);
 440 }
 441
 442 static inline void lsi_set_phase(LSIState *s, int phase)
 443 {
 444     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 445 }
 446
 447 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 448 {
 449     /* Trigger a phase mismatch.  */
 450     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 451         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL) || out) {
 452             s->dsp = s->pmjad1;
 453         } else {
 454             s->dsp = s->pmjad2;
 455         }
 456         DPRINTF("Data phase mismatch jump to %08x\n", s->dsp);
 457     } else {
 458         DPRINTF("Phase mismatch interrupt\n");
 459         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 460         lsi_stop_script(s);
 461     }
 462     lsi_set_phase(s, new_phase);
 463 }
 464
 465
 466 /* Resume SCRIPTS execution after a DMA operation.  */
 467 static void lsi_resume_script(LSIState *s)
 468 {
 469     if (s->waiting != 2) {
 470         s->waiting = 0;
 471         lsi_execute_script(s);
 472     } else {
 473         s->waiting = 0;
 474     }
 475 }
 476
 477 /* Initiate a SCSI layer data transfer.  */
 478 static void lsi_do_dma(LSIState *s, int out)
 479 {
 480     uint32_t count;
 481     target_phys_addr_t addr;
 482
 483     if (!s->current_dma_len) {
 484         /* Wait until data is available.  */
 485         DPRINTF("DMA no data available\n");
 486         return;
 487     }
 488
 489     count = s->dbc;
 490     if (count > s->current_dma_len)
 491         count = s->current_dma_len;
 492
 493     addr = s->dnad;
 494     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 495     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 496         addr |= ((uint64_t)s->dnad64 << 32);
 497     else if (s->dbms)
 498         addr |= ((uint64_t)s->dbms << 32);
 499     else if (s->sbms)
 500         addr |= ((uint64_t)s->sbms << 32);
 501
 502     DPRINTF("DMA addr=0x" TARGET_FMT_plx " len=%d\n", addr, count);
 503     s->csbc += count;
 504     s->dnad += count;
 505     s->dbc -= count;
 506
 507     if (s->dma_buf == NULL) {
 508         s->dma_buf = s->current_dev->get_buf(s->current_dev,
 509                                              s->current_tag);
 510     }
 511
 512     /* ??? Set SFBR to first data byte.  */
 513     if (out) {
 514         cpu_physical_memory_read(addr, s->dma_buf, count);
 515     } else {
 516         cpu_physical_memory_write(addr, s->dma_buf, count);
 517     }
 518     s->current_dma_len -= count;
 519     if (s->current_dma_len == 0) {
 520         s->dma_buf = NULL;
 521         if (out) {
 522             /* Write the data.  */
 523             s->current_dev->write_data(s->current_dev, s->current_tag);
 524         } else {
 525             /* Request any remaining data.  */
 526             s->current_dev->read_data(s->current_dev, s->current_tag);
 527         }
 528     } else {
 529         s->dma_buf += count;
 530         lsi_resume_script(s);
 531     }
 532 }
 533
 534
 535 /* Add a command to the queue.  */
 536 static void lsi_queue_command(LSIState *s)
 537 {
 538     lsi_queue *p;
 539
 540     DPRINTF("Queueing tag=0x%x\n", s->current_tag);
 541     if (s->queue_len == s->active_commands) {
 542         s->queue_len++;
 543         s->queue = qemu_realloc(s->queue, s->queue_len * sizeof(lsi_queue));
 544     }
 545     p = &s->queue[s->active_commands++];
 546     p->tag = s->current_tag;
 547     p->pending = 0;
 548     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 549 }
 550
 551 /* Queue a byte for a MSG IN phase.  */
 552 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 553 {
 554     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 555         BADF("MSG IN data too long\n");
 556     } else {
 557         DPRINTF("MSG IN 0x%02x\n", data);
 558         s->msg[s->msg_len++] = data;
 559     }
 560 }
 561
 562 /* Perform reselection to continue a command.  */
 563 static void lsi_reselect(LSIState *s, uint32_t tag)
 564 {
 565     lsi_queue *p;
 566     int n;
 567     int id;
 568
 569     p = NULL;
 570     for (n = 0; n < s->active_commands; n++) {
 571         p = &s->queue[n];
 572         if (p->tag == tag)
 573             break;
 574     }
 575     if (n == s->active_commands) {
 576         BADF("Reselected non-existant command tag=0x%x\n", tag);
 577         return;
 578     }
 579     id = (tag >> 8) & 0xf;
 580     s->ssid = id | 0x80;
 581     DPRINTF("Reselected target %d\n", id);
 582     s->current_dev = s->scsi_dev[id];
 583     s->current_tag = tag;
 584     s->scntl1 |= LSI_SCNTL1_CON;
 585     lsi_set_phase(s, PHASE_MI);
 586     s->msg_action = p->out ? 2 : 3;
 587     s->current_dma_len = p->pending;
 588     s->dma_buf = NULL;
 589     lsi_add_msg_byte(s, 0x80);
 590     if (s->current_tag & LSI_TAG_VALID) {
 591         lsi_add_msg_byte(s, 0x20);
 592         lsi_add_msg_byte(s, tag & 0xff);
 593     }
 594
 595     s->active_commands--;
 596     if (n != s->active_commands) {
 597         s->queue[n] = s->queue[s->active_commands];
 598     }
 599 }
 600
 601 /* Record that data is available for a queued command.  Returns zero if
 602    the device was reselected, nonzero if the IO is deferred.  */
 603 static int lsi_queue_tag(LSIState *s, uint32_t tag, uint32_t arg)
 604 {
 605     lsi_queue *p;
 606     int i;
 607     for (i = 0; i < s->active_commands; i++) {
 608         p = &s->queue[i];
 609         if (p->tag == tag) {
 610             if (p->pending) {
 611                 BADF("Multiple IO pending for tag %d\n", tag);
 612             }
 613             p->pending = arg;
 614             if (s->waiting == 1) {
 615                 /* Reselect device.  */
 616                 lsi_reselect(s, tag);
 617                 return 0;
 618             } else {
 619                DPRINTF("Queueing IO tag=0x%x\n", tag);
 620                 p->pending = arg;
 621                 return 1;
 622             }
 623         }
 624     }
 625     BADF("IO with unknown tag %d\n", tag);
 626     return 1;
 627 }
 628
 629 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 630 static void lsi_command_complete(void *opaque, int reason, uint32_t tag,
 631                                  uint32_t arg)
 632 {
 633     LSIState *s = (LSIState *)opaque;
 634     int out;
 635
 636     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 637     if (reason == SCSI_REASON_DONE) {
 638         DPRINTF("Command complete sense=%d\n", (int)arg);
 639         s->sense = arg;
 640         s->command_complete = 2;
 641         if (s->waiting && s->dbc != 0) {
 642             /* Raise phase mismatch for short transfers.  */
 643             lsi_bad_phase(s, out, PHASE_ST);
 644         } else {
 645             lsi_set_phase(s, PHASE_ST);
 646         }
 647         lsi_resume_script(s);
 648         return;
 649     }
 650
 651     if (s->waiting == 1 || tag != s->current_tag) {
 652         if (lsi_queue_tag(s, tag, arg))
 653             return;
 654     }
 655     DPRINTF("Data ready tag=0x%x len=%d\n", tag, arg);
 656     s->current_dma_len = arg;
 657     s->command_complete = 1;
 658     if (!s->waiting)
 659         return;
 660     if (s->waiting == 1 || s->dbc == 0) {
 661         lsi_resume_script(s);
 662     } else {
 663         lsi_do_dma(s, out);
 664     }
 665 }
 666
 667 static void lsi_do_command(LSIState *s)
 668 {
 669     uint8_t buf[16];
 670     int n;
 671
 672     DPRINTF("Send command len=%d\n", s->dbc);
 673     if (s->dbc > 16)
 674         s->dbc = 16;
 675     cpu_physical_memory_read(s->dnad, buf, s->dbc);
 676     s->sfbr = buf[0];
 677     s->command_complete = 0;
 678     n = s->current_dev->send_command(s->current_dev, s->current_tag, buf,
 679                                      s->current_lun);
 680     if (n > 0) {
 681         lsi_set_phase(s, PHASE_DI);
 682         s->current_dev->read_data(s->current_dev, s->current_tag);
 683     } else if (n < 0) {
 684         lsi_set_phase(s, PHASE_DO);
 685         s->current_dev->write_data(s->current_dev, s->current_tag);
 686     }
 687
 688     if (!s->command_complete) {
 689         if (n) {
 690             /* Command did not complete immediately so disconnect.  */
 691             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 692             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 693             /* wait data */
 694             lsi_set_phase(s, PHASE_MI);
 695             s->msg_action = 1;
 696             lsi_queue_command(s);
 697         } else {
 698             /* wait command complete */
 699             lsi_set_phase(s, PHASE_DI);
 700         }
 701     }
 702 }
 703
 704 static void lsi_do_status(LSIState *s)
 705 {
 706     uint8_t sense;
 707     DPRINTF("Get status len=%d sense=%d\n", s->dbc, s->sense);
 708     if (s->dbc != 1)
 709         BADF("Bad Status move\n");
 710     s->dbc = 1;
 711     sense = s->sense;
 712     s->sfbr = sense;
 713     cpu_physical_memory_write(s->dnad, &sense, 1);
 714     lsi_set_phase(s, PHASE_MI);
 715     s->msg_action = 1;
 716     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 717 }
 718
 719 static void lsi_disconnect(LSIState *s)
 720 {
 721     s->scntl1 &= ~LSI_SCNTL1_CON;
 722     s->sstat1 &= ~PHASE_MASK;
 723 }
 724
 725 static void lsi_do_msgin(LSIState *s)
 726 {
 727     int len;
 728     DPRINTF("Message in len=%d/%d\n", s->dbc, s->msg_len);
 729     s->sfbr = s->msg[0];
 730     len = s->msg_len;
 731     if (len > s->dbc)
 732         len = s->dbc;
 733     cpu_physical_memory_write(s->dnad, s->msg, len);
 734     /* Linux drivers rely on the last byte being in the SIDL.  */
 735     s->sidl = s->msg[len - 1];
 736     s->msg_len -= len;
 737     if (s->msg_len) {
 738         memmove(s->msg, s->msg + len, s->msg_len);
 739     } else {
 740         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 741            switch to PHASE_MO.  */
 742         switch (s->msg_action) {
 743         case 0:
 744             lsi_set_phase(s, PHASE_CMD);
 745             break;
 746         case 1:
 747             lsi_disconnect(s);
 748             break;
 749         case 2:
 750             lsi_set_phase(s, PHASE_DO);
 751             break;
 752         case 3:
 753             lsi_set_phase(s, PHASE_DI);
 754             break;
 755         default:
 756             abort();
 757         }
 758     }
 759 }
 760
 761 /* Read the next byte during a MSGOUT phase.  */
 762 static uint8_t lsi_get_msgbyte(LSIState *s)
 763 {
 764     uint8_t data;
 765     cpu_physical_memory_read(s->dnad, &data, 1);
 766     s->dnad++;
 767     s->dbc--;
 768     return data;
 769 }
 770
 771 static void lsi_do_msgout(LSIState *s)
 772 {
 773     uint8_t msg;
 774     int len;
 775
 776     DPRINTF("MSG out len=%d\n", s->dbc);
 777     while (s->dbc) {
 778         msg = lsi_get_msgbyte(s);
 779         s->sfbr = msg;
 780
 781         switch (msg) {
 782         case 0x00:
 783             DPRINTF("MSG: Disconnect\n");
 784             lsi_disconnect(s);
 785             break;
 786         case 0x08:
 787             DPRINTF("MSG: No Operation\n");
 788             lsi_set_phase(s, PHASE_CMD);
 789             break;
 790         case 0x01:
 791             len = lsi_get_msgbyte(s);
 792             msg = lsi_get_msgbyte(s);
 793             DPRINTF("Extended message 0x%x (len %d)\n", msg, len);
 794             switch (msg) {
 795             case 1:
 796                 DPRINTF("SDTR (ignored)\n");
 797                 s->dbc -= 2;
 798                 break;
 799             case 3:
 800                 DPRINTF("WDTR (ignored)\n");
 801                 s->dbc -= 1;
 802                 break;
 803             default:
 804                 goto bad;
 805             }
 806             break;
 807         case 0x20: /* SIMPLE queue */
 808             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 809             DPRINTF("SIMPLE queue tag=0x%x\n", s->current_tag & 0xff);
 810             break;
 811         case 0x21: /* HEAD of queue */
 812             BADF("HEAD queue not implemented\n");
 813             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 814             break;
 815         case 0x22: /* ORDERED queue */
 816             BADF("ORDERED queue not implemented\n");
 817             s->current_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
 818             break;
 819         default:
 820             if ((msg & 0x80) == 0) {
 821                 goto bad;
 822             }
 823             s->current_lun = msg & 7;
 824             DPRINTF("Select LUN %d\n", s->current_lun);
 825             lsi_set_phase(s, PHASE_CMD);
 826             break;
 827         }
 828     }
 829     return;
 830 bad:
 831     BADF("Unimplemented message 0x%02x\n", msg);
 832     lsi_set_phase(s, PHASE_MI);
 833     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
 834     s->msg_action = 0;
 835 }
 836
 837 /* Sign extend a 24-bit value.  */
 838 static inline int32_t sxt24(int32_t n)
 839 {
 840     return (n << 8) >> 8;
 841 }
 842
 843 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
 844 {
 845     int n;
 846     uint8_t buf[TARGET_PAGE_SIZE];
 847
 848     DPRINTF("memcpy dest 0x%08x src 0x%08x count %d\n", dest, src, count);
 849     while (count) {
 850         n = (count > TARGET_PAGE_SIZE) ? TARGET_PAGE_SIZE : count;
 851         cpu_physical_memory_read(src, buf, n);
 852         cpu_physical_memory_write(dest, buf, n);
 853         src += n;
 854         dest += n;
 855         count -= n;
 856     }
 857 }
 858
 859 static void lsi_wait_reselect(LSIState *s)
 860 {
 861     int i;
 862     DPRINTF("Wait Reselect\n");
 863     if (s->current_dma_len)
 864         BADF("Reselect with pending DMA\n");
 865     for (i = 0; i < s->active_commands; i++) {
 866         if (s->queue[i].pending) {
 867             lsi_reselect(s, s->queue[i].tag);
 868             break;
 869         }
 870     }
 871     if (s->current_dma_len == 0) {
 872         s->waiting = 1;
 873     }
 874 }
 875
 876 static void lsi_execute_script(LSIState *s)
 877 {
 878     uint32_t insn;
 879     uint32_t addr, addr_high;
 880     int opcode;
 881     int insn_processed = 0;
 882
 883     s->istat1 |= LSI_ISTAT1_SRUN;
 884 again:
 885     insn_processed++;
 886     insn = read_dword(s, s->dsp);
 887     if (!insn) {
 888         /* If we receive an empty opcode increment the DSP by 4 bytes
 889            instead of 8 and execute the next opcode at that location */
 890         s->dsp += 4;
 891         goto again;
 892     }
 893     addr = read_dword(s, s->dsp + 4);
 894     addr_high = 0;
 895     DPRINTF("SCRIPTS dsp=%08x opcode %08x arg %08x\n", s->dsp, insn, addr);
 896     s->dsps = addr;
 897     s->dcmd = insn >> 24;
 898     s->dsp += 8;
 899     switch (insn >> 30) {
 900     case 0: /* Block move.  */
 901         if (s->sist1 & LSI_SIST1_STO) {
 902             DPRINTF("Delayed select timeout\n");
 903             lsi_stop_script(s);
 904             break;
 905         }
 906         s->dbc = insn & 0xffffff;
 907         s->rbc = s->dbc;
 908         /* ??? Set ESA.  */
 909         s->ia = s->dsp - 8;
 910         if (insn & (1 << 29)) {
 911             /* Indirect addressing.  */
 912             addr = read_dword(s, addr);
 913         } else if (insn & (1 << 28)) {
 914             uint32_t buf[2];
 915             int32_t offset;
 916             /* Table indirect addressing.  */
 917
 918             /* 32-bit Table indirect */
 919             offset = sxt24(addr);
 920             cpu_physical_memory_read(s->dsa + offset, (uint8_t *)buf, 8);
 921             /* byte count is stored in bits 0:23 only */
 922             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
 923             s->rbc = s->dbc;
 924             addr = cpu_to_le32(buf[1]);
 925
 926             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
 927              * table, bits [31:24] */
 928             if (lsi_dma_40bit(s))
 929                 addr_high = cpu_to_le32(buf[0]) >> 24;
 930             else if (lsi_dma_ti64bit(s)) {
 931                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
 932                 switch (selector) {
 933                 case 0 ... 0x0f:
 934                     /* offset index into scratch registers since
 935                      * TI64 mode can use registers C to R */
 936                     addr_high = s->scratch[2 + selector];
 937                     break;
 938                 case 0x10:
 939                     addr_high = s->mmrs;
 940                     break;
 941                 case 0x11:
 942                     addr_high = s->mmws;
 943                     break;
 944                 case 0x12:
 945                     addr_high = s->sfs;
 946                     break;
 947                 case 0x13:
 948                     addr_high = s->drs;
 949                     break;
 950                 case 0x14:
 951                     addr_high = s->sbms;
 952                     break;
 953                 case 0x15:
 954                     addr_high = s->dbms;
 955                     break;
 956                 default:
 957                     BADF("Illegal selector specified (0x%x > 0x15)"
 958                          " for 64-bit DMA block move", selector);
 959                     break;
 960                 }
 961             }
 962         } else if (lsi_dma_64bit(s)) {
 963             /* fetch a 3rd dword if 64-bit direct move is enabled and
 964                only if we're not doing table indirect or indirect addressing */
 965             s->dbms = read_dword(s, s->dsp);
 966             s->dsp += 4;
 967             s->ia = s->dsp - 12;
 968         }
 969         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
 970             DPRINTF("Wrong phase got %d expected %d\n",
 971                     s->sstat1 & PHASE_MASK, (insn >> 24) & 7);
 972             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 973             break;
 974         }
 975         s->dnad = addr;
 976         s->dnad64 = addr_high;
 977         switch (s->sstat1 & 0x7) {
 978         case PHASE_DO:
 979             s->waiting = 2;
 980             lsi_do_dma(s, 1);
 981             if (s->waiting)
 982                 s->waiting = 3;
 983             break;
 984         case PHASE_DI:
 985             s->waiting = 2;
 986             lsi_do_dma(s, 0);
 987             if (s->waiting)
 988                 s->waiting = 3;
 989             break;
 990         case PHASE_CMD:
 991             lsi_do_command(s);
 992             break;
 993         case PHASE_ST:
 994             lsi_do_status(s);
 995             break;
 996         case PHASE_MO:
 997             lsi_do_msgout(s);
 998             break;
 999         case PHASE_MI:
1000             lsi_do_msgin(s);
1001             break;
1002         default:
1003             BADF("Unimplemented phase %d\n", s->sstat1 & PHASE_MASK);
1004             exit(1);
1005         }
1006         s->dfifo = s->dbc & 0xff;
1007         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1008         s->sbc = s->dbc;
1009         s->rbc -= s->dbc;
1010         s->ua = addr + s->dbc;
1011         break;
1012
1013     case 1: /* IO or Read/Write instruction.  */
1014         opcode = (insn >> 27) & 7;
1015         if (opcode < 5) {
1016             uint32_t id;
1017
1018             if (insn & (1 << 25)) {
1019                 id = read_dword(s, s->dsa + sxt24(insn));
1020             } else {
1021                 id = addr;
1022             }
1023             id = (id >> 16) & 0xf;
1024             if (insn & (1 << 26)) {
1025                 addr = s->dsp + sxt24(addr);
1026             }
1027             s->dnad = addr;
1028             switch (opcode) {
1029             case 0: /* Select */
1030                 s->sdid = id;
1031                 if (s->current_dma_len && (s->ssid & 0xf) == id) {
1032                     DPRINTF("Already reselected by target %d\n", id);
1033                     break;
1034                 }
1035                 s->sstat0 |= LSI_SSTAT0_WOA;
1036                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1037                 if (id >= LSI_MAX_DEVS || !s->scsi_dev[id]) {
1038                     DPRINTF("Selected absent target %d\n", id);
1039                     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
1040                     lsi_disconnect(s);
1041                     break;
1042                 }
1043                 DPRINTF("Selected target %d%s\n",
1044                         id, insn & (1 << 3) ? " ATN" : "");
1045                 /* ??? Linux drivers compain when this is set.  Maybe
1046                    it only applies in low-level mode (unimplemented).
1047                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1048                 s->current_dev = s->scsi_dev[id];
1049                 s->current_tag = id << 8;
1050                 s->scntl1 |= LSI_SCNTL1_CON;
1051                 if (insn & (1 << 3)) {
1052                     s->socl |= LSI_SOCL_ATN;
1053                 }
1054                 lsi_set_phase(s, PHASE_MO);
1055                 break;
1056             case 1: /* Disconnect */
1057                 DPRINTF("Wait Disconect\n");
1058                 s->scntl1 &= ~LSI_SCNTL1_CON;
1059                 break;
1060             case 2: /* Wait Reselect */
1061                 lsi_wait_reselect(s);
1062                 break;
1063             case 3: /* Set */
1064                 DPRINTF("Set%s%s%s%s\n",
1065                         insn & (1 << 3) ? " ATN" : "",
1066                         insn & (1 << 6) ? " ACK" : "",
1067                         insn & (1 << 9) ? " TM" : "",
1068                         insn & (1 << 10) ? " CC" : "");
1069                 if (insn & (1 << 3)) {
1070                     s->socl |= LSI_SOCL_ATN;
1071                     lsi_set_phase(s, PHASE_MO);
1072                 }
1073                 if (insn & (1 << 9)) {
1074                     BADF("Target mode not implemented\n");
1075                     exit(1);
1076                 }
1077                 if (insn & (1 << 10))
1078                     s->carry = 1;
1079                 break;
1080             case 4: /* Clear */
1081                 DPRINTF("Clear%s%s%s%s\n",
1082                         insn & (1 << 3) ? " ATN" : "",
1083                         insn & (1 << 6) ? " ACK" : "",
1084                         insn & (1 << 9) ? " TM" : "",
1085                         insn & (1 << 10) ? " CC" : "");
1086                 if (insn & (1 << 3)) {
1087                     s->socl &= ~LSI_SOCL_ATN;
1088                 }
1089                 if (insn & (1 << 10))
1090                     s->carry = 0;
1091                 break;
1092             }
1093         } else {
1094             uint8_t op0;
1095             uint8_t op1;
1096             uint8_t data8;
1097             int reg;
1098             int operator;
1099 #ifdef DEBUG_LSI
1100             static const char *opcode_names[3] =
1101                 {"Write", "Read", "Read-Modify-Write"};
1102             static const char *operator_names[8] =
1103                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1104 #endif
1105
1106             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1107             data8 = (insn >> 8) & 0xff;
1108             opcode = (insn >> 27) & 7;
1109             operator = (insn >> 24) & 7;
1110             DPRINTF("%s reg 0x%x %s data8=0x%02x sfbr=0x%02x%s\n",
1111                     opcode_names[opcode - 5], reg,
1112                     operator_names[operator], data8, s->sfbr,
1113                     (insn & (1 << 23)) ? " SFBR" : "");
1114             op0 = op1 = 0;
1115             switch (opcode) {
1116             case 5: /* From SFBR */
1117                 op0 = s->sfbr;
1118                 op1 = data8;
1119                 break;
1120             case 6: /* To SFBR */
1121                 if (operator)
1122                     op0 = lsi_reg_readb(s, reg);
1123                 op1 = data8;
1124                 break;
1125             case 7: /* Read-modify-write */
1126                 if (operator)
1127                     op0 = lsi_reg_readb(s, reg);
1128                 if (insn & (1 << 23)) {
1129                     op1 = s->sfbr;
1130                 } else {
1131                     op1 = data8;
1132                 }
1133                 break;
1134             }
1135
1136             switch (operator) {
1137             case 0: /* move */
1138                 op0 = op1;
1139                 break;
1140             case 1: /* Shift left */
1141                 op1 = op0 >> 7;
1142                 op0 = (op0 << 1) | s->carry;
1143                 s->carry = op1;
1144                 break;
1145             case 2: /* OR */
1146                 op0 |= op1;
1147                 break;
1148             case 3: /* XOR */
1149                 op0 ^= op1;
1150                 break;
1151             case 4: /* AND */
1152                 op0 &= op1;
1153                 break;
1154             case 5: /* SHR */
1155                 op1 = op0 & 1;
1156                 op0 = (op0 >> 1) | (s->carry << 7);
1157                 s->carry = op1;
1158                 break;
1159             case 6: /* ADD */
1160                 op0 += op1;
1161                 s->carry = op0 < op1;
1162                 break;
1163             case 7: /* ADC */
1164                 op0 += op1 + s->carry;
1165                 if (s->carry)
1166                     s->carry = op0 <= op1;
1167                 else
1168                     s->carry = op0 < op1;
1169                 break;
1170             }
1171
1172             switch (opcode) {
1173             case 5: /* From SFBR */
1174             case 7: /* Read-modify-write */
1175                 lsi_reg_writeb(s, reg, op0);
1176                 break;
1177             case 6: /* To SFBR */
1178                 s->sfbr = op0;
1179                 break;
1180             }
1181         }
1182         break;
1183
1184     case 2: /* Transfer Control.  */
1185         {
1186             int cond;
1187             int jmp;
1188
1189             if ((insn & 0x002e0000) == 0) {
1190                 DPRINTF("NOP\n");
1191                 break;
1192             }
1193             if (s->sist1 & LSI_SIST1_STO) {
1194                 DPRINTF("Delayed select timeout\n");
1195                 lsi_stop_script(s);
1196                 break;
1197             }
1198             cond = jmp = (insn & (1 << 19)) != 0;
1199             if (cond == jmp && (insn & (1 << 21))) {
1200                 DPRINTF("Compare carry %d\n", s->carry == jmp);
1201                 cond = s->carry != 0;
1202             }
1203             if (cond == jmp && (insn & (1 << 17))) {
1204                 DPRINTF("Compare phase %d %c= %d\n",
1205                         (s->sstat1 & PHASE_MASK),
1206                         jmp ? '=' : '!',
1207                         ((insn >> 24) & 7));
1208                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1209             }
1210             if (cond == jmp && (insn & (1 << 18))) {
1211                 uint8_t mask;
1212
1213                 mask = (~insn >> 8) & 0xff;
1214                 DPRINTF("Compare data 0x%x & 0x%x %c= 0x%x\n",
1215                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1216                 cond = (s->sfbr & mask) == (insn & mask);
1217             }
1218             if (cond == jmp) {
1219                 if (insn & (1 << 23)) {
1220                     /* Relative address.  */
1221                     addr = s->dsp + sxt24(addr);
1222                 }
1223                 switch ((insn >> 27) & 7) {
1224                 case 0: /* Jump */
1225                     DPRINTF("Jump to 0x%08x\n", addr);
1226                     s->dsp = addr;
1227                     break;
1228                 case 1: /* Call */
1229                     DPRINTF("Call 0x%08x\n", addr);
1230                     s->temp = s->dsp;
1231                     s->dsp = addr;
1232                     break;
1233                 case 2: /* Return */
1234                     DPRINTF("Return to 0x%08x\n", s->temp);
1235                     s->dsp = s->temp;
1236                     break;
1237                 case 3: /* Interrupt */
1238                     DPRINTF("Interrupt 0x%08x\n", s->dsps);
1239                     if ((insn & (1 << 20)) != 0) {
1240                         s->istat0 |= LSI_ISTAT0_INTF;
1241                         lsi_update_irq(s);
1242                     } else {
1243                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1244                     }
1245                     break;
1246                 default:
1247                     DPRINTF("Illegal transfer control\n");
1248                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1249                     break;
1250                 }
1251             } else {
1252                 DPRINTF("Control condition failed\n");
1253             }
1254         }
1255         break;
1256
1257     case 3:
1258         if ((insn & (1 << 29)) == 0) {
1259             /* Memory move.  */
1260             uint32_t dest;
1261             /* ??? The docs imply the destination address is loaded into
1262                the TEMP register.  However the Linux drivers rely on
1263                the value being presrved.  */
1264             dest = read_dword(s, s->dsp);
1265             s->dsp += 4;
1266             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1267         } else {
1268             uint8_t data[7];
1269             int reg;
1270             int n;
1271             int i;
1272
1273             if (insn & (1 << 28)) {
1274                 addr = s->dsa + sxt24(addr);
1275             }
1276             n = (insn & 7);
1277             reg = (insn >> 16) & 0xff;
1278             if (insn & (1 << 24)) {
1279                 cpu_physical_memory_read(addr, data, n);
1280                 DPRINTF("Load reg 0x%x size %d addr 0x%08x = %08x\n", reg, n,
1281                         addr, *(int *)data);
1282                 for (i = 0; i < n; i++) {
1283                     lsi_reg_writeb(s, reg + i, data[i]);
1284                 }
1285             } else {
1286                 DPRINTF("Store reg 0x%x size %d addr 0x%08x\n", reg, n, addr);
1287                 for (i = 0; i < n; i++) {
1288                     data[i] = lsi_reg_readb(s, reg + i);
1289                 }
1290                 cpu_physical_memory_write(addr, data, n);
1291             }
1292         }
1293     }
1294     if (insn_processed > 10000 && !s->waiting) {
1295         /* Some windows drivers make the device spin waiting for a memory
1296            location to change.  If we have been executed a lot of code then
1297            assume this is the case and force an unexpected device disconnect.
1298            This is apparently sufficient to beat the drivers into submission.
1299          */
1300         if (!(s->sien0 & LSI_SIST0_UDC))
1301             fprintf(stderr, "inf. loop with UDC masked\n");
1302         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1303         lsi_disconnect(s);
1304     } else if (s->istat1 & LSI_ISTAT1_SRUN && !s->waiting) {
1305         if (s->dcntl & LSI_DCNTL_SSM) {
1306             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1307         } else {
1308             goto again;
1309         }
1310     }
1311     DPRINTF("SCRIPTS execution stopped\n");
1312 }
1313
1314 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1315 {
1316     uint8_t tmp;
1317 #define CASE_GET_REG24(name, addr) \
1318     case addr: return s->name & 0xff; \
1319     case addr + 1: return (s->name >> 8) & 0xff; \
1320     case addr + 2: return (s->name >> 16) & 0xff;
1321
1322 #define CASE_GET_REG32(name, addr) \
1323     case addr: return s->name & 0xff; \
1324     case addr + 1: return (s->name >> 8) & 0xff; \
1325     case addr + 2: return (s->name >> 16) & 0xff; \
1326     case addr + 3: return (s->name >> 24) & 0xff;
1327
1328 #ifdef DEBUG_LSI_REG
1329     DPRINTF("Read reg %x\n", offset);
1330 #endif
1331     switch (offset) {
1332     case 0x00: /* SCNTL0 */
1333         return s->scntl0;
1334     case 0x01: /* SCNTL1 */
1335         return s->scntl1;
1336     case 0x02: /* SCNTL2 */
1337         return s->scntl2;
1338     case 0x03: /* SCNTL3 */
1339         return s->scntl3;
1340     case 0x04: /* SCID */
1341         return s->scid;
1342     case 0x05: /* SXFER */
1343         return s->sxfer;
1344     case 0x06: /* SDID */
1345         return s->sdid;
1346     case 0x07: /* GPREG0 */
1347         return 0x7f;
1348     case 0x08: /* Revision ID */
1349         return 0x00;
1350     case 0xa: /* SSID */
1351         return s->ssid;
1352     case 0xb: /* SBCL */
1353         /* ??? This is not correct. However it's (hopefully) only
1354            used for diagnostics, so should be ok.  */
1355         return 0;
1356     case 0xc: /* DSTAT */
1357         tmp = s->dstat | 0x80;
1358         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1359             s->dstat = 0;
1360         lsi_update_irq(s);
1361         return tmp;
1362     case 0x0d: /* SSTAT0 */
1363         return s->sstat0;
1364     case 0x0e: /* SSTAT1 */
1365         return s->sstat1;
1366     case 0x0f: /* SSTAT2 */
1367         return s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1368     CASE_GET_REG32(dsa, 0x10)
1369     case 0x14: /* ISTAT0 */
1370         return s->istat0;
1371     case 0x16: /* MBOX0 */
1372         return s->mbox0;
1373     case 0x17: /* MBOX1 */
1374         return s->mbox1;
1375     case 0x18: /* CTEST0 */
1376         return 0xff;
1377     case 0x19: /* CTEST1 */
1378         return 0;
1379     case 0x1a: /* CTEST2 */
1380         tmp = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1381         if (s->istat0 & LSI_ISTAT0_SIGP) {
1382             s->istat0 &= ~LSI_ISTAT0_SIGP;
1383             tmp |= LSI_CTEST2_SIGP;
1384         }
1385         return tmp;
1386     case 0x1b: /* CTEST3 */
1387         return s->ctest3;
1388     CASE_GET_REG32(temp, 0x1c)
1389     case 0x20: /* DFIFO */
1390         return 0;
1391     case 0x21: /* CTEST4 */
1392         return s->ctest4;
1393     case 0x22: /* CTEST5 */
1394         return s->ctest5;
1395     case 0x23: /* CTEST6 */
1396          return 0;
1397     CASE_GET_REG24(dbc, 0x24)
1398     case 0x27: /* DCMD */
1399         return s->dcmd;
1400     CASE_GET_REG32(dsp, 0x2c)
1401     CASE_GET_REG32(dsps, 0x30)
1402     CASE_GET_REG32(scratch[0], 0x34)
1403     case 0x38: /* DMODE */
1404         return s->dmode;
1405     case 0x39: /* DIEN */
1406         return s->dien;
1407     case 0x3b: /* DCNTL */
1408         return s->dcntl;
1409     case 0x40: /* SIEN0 */
1410         return s->sien0;
1411     case 0x41: /* SIEN1 */
1412         return s->sien1;
1413     case 0x42: /* SIST0 */
1414         tmp = s->sist0;
1415         s->sist0 = 0;
1416         lsi_update_irq(s);
1417         return tmp;
1418     case 0x43: /* SIST1 */
1419         tmp = s->sist1;
1420         s->sist1 = 0;
1421         lsi_update_irq(s);
1422         return tmp;
1423     case 0x46: /* MACNTL */
1424         return 0x0f;
1425     case 0x47: /* GPCNTL0 */
1426         return 0x0f;
1427     case 0x48: /* STIME0 */
1428         return s->stime0;
1429     case 0x4a: /* RESPID0 */
1430         return s->respid0;
1431     case 0x4b: /* RESPID1 */
1432         return s->respid1;
1433     case 0x4d: /* STEST1 */
1434         return s->stest1;
1435     case 0x4e: /* STEST2 */
1436         return s->stest2;
1437     case 0x4f: /* STEST3 */
1438         return s->stest3;
1439     case 0x50: /* SIDL */
1440         /* This is needed by the linux drivers.  We currently only update it
1441            during the MSG IN phase.  */
1442         return s->sidl;
1443     case 0x52: /* STEST4 */
1444         return 0xe0;
1445     case 0x56: /* CCNTL0 */
1446         return s->ccntl0;
1447     case 0x57: /* CCNTL1 */
1448         return s->ccntl1;
1449     case 0x58: /* SBDL */
1450         /* Some drivers peek at the data bus during the MSG IN phase.  */
1451         if ((s->sstat1 & PHASE_MASK) == PHASE_MI)
1452             return s->msg[0];
1453         return 0;
1454     case 0x59: /* SBDL high */
1455         return 0;
1456     CASE_GET_REG32(mmrs, 0xa0)
1457     CASE_GET_REG32(mmws, 0xa4)
1458     CASE_GET_REG32(sfs, 0xa8)
1459     CASE_GET_REG32(drs, 0xac)
1460     CASE_GET_REG32(sbms, 0xb0)
1461     CASE_GET_REG32(dbms, 0xb4)
1462     CASE_GET_REG32(dnad64, 0xb8)
1463     CASE_GET_REG32(pmjad1, 0xc0)
1464     CASE_GET_REG32(pmjad2, 0xc4)
1465     CASE_GET_REG32(rbc, 0xc8)
1466     CASE_GET_REG32(ua, 0xcc)
1467     CASE_GET_REG32(ia, 0xd4)
1468     CASE_GET_REG32(sbc, 0xd8)
1469     CASE_GET_REG32(csbc, 0xdc)
1470     }
1471     if (offset >= 0x5c && offset < 0xa0) {
1472         int n;
1473         int shift;
1474         n = (offset - 0x58) >> 2;
1475         shift = (offset & 3) * 8;
1476         return (s->scratch[n] >> shift) & 0xff;
1477     }
1478     BADF("readb 0x%x\n", offset);
1479     exit(1);
1480 #undef CASE_GET_REG24
1481 #undef CASE_GET_REG32
1482 }
1483
1484 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1485 {
1486 #define CASE_SET_REG32(name, addr) \
1487     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1488     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1489     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1490     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1491
1492 #ifdef DEBUG_LSI_REG
1493     DPRINTF("Write reg %x = %02x\n", offset, val);
1494 #endif
1495     switch (offset) {
1496     case 0x00: /* SCNTL0 */
1497         s->scntl0 = val;
1498         if (val & LSI_SCNTL0_START) {
1499             BADF("Start sequence not implemented\n");
1500         }
1501         break;
1502     case 0x01: /* SCNTL1 */
1503         s->scntl1 = val & ~LSI_SCNTL1_SST;
1504         if (val & LSI_SCNTL1_IARB) {
1505             BADF("Immediate Arbritration not implemented\n");
1506         }
1507         if (val & LSI_SCNTL1_RST) {
1508             s->sstat0 |= LSI_SSTAT0_RST;
1509             lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1510         } else {
1511             s->sstat0 &= ~LSI_SSTAT0_RST;
1512         }
1513         break;
1514     case 0x02: /* SCNTL2 */
1515         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1516         s->scntl2 = val;
1517         break;
1518     case 0x03: /* SCNTL3 */
1519         s->scntl3 = val;
1520         break;
1521     case 0x04: /* SCID */
1522         s->scid = val;
1523         break;
1524     case 0x05: /* SXFER */
1525         s->sxfer = val;
1526         break;
1527     case 0x06: /* SDID */
1528         if ((val & 0xf) != (s->ssid & 0xf))
1529             BADF("Destination ID does not match SSID\n");
1530         s->sdid = val & 0xf;
1531         break;
1532     case 0x07: /* GPREG0 */
1533         break;
1534     case 0x08: /* SFBR */
1535         /* The CPU is not allowed to write to this register.  However the
1536            SCRIPTS register move instructions are.  */
1537         s->sfbr = val;
1538         break;
1539     case 0x0a: case 0x0b:
1540         /* Openserver writes to these readonly registers on startup */
1541         return;
1542     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1543         /* Linux writes to these readonly registers on startup.  */
1544         return;
1545     CASE_SET_REG32(dsa, 0x10)
1546     case 0x14: /* ISTAT0 */
1547         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1548         if (val & LSI_ISTAT0_ABRT) {
1549             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1550         }
1551         if (val & LSI_ISTAT0_INTF) {
1552             s->istat0 &= ~LSI_ISTAT0_INTF;
1553             lsi_update_irq(s);
1554         }
1555         if (s->waiting == 1 && val & LSI_ISTAT0_SIGP) {
1556             DPRINTF("Woken by SIGP\n");
1557             s->waiting = 0;
1558             s->dsp = s->dnad;
1559             lsi_execute_script(s);
1560         }
1561         if (val & LSI_ISTAT0_SRST) {
1562             lsi_soft_reset(s);
1563         }
1564         break;
1565     case 0x16: /* MBOX0 */
1566         s->mbox0 = val;
1567         break;
1568     case 0x17: /* MBOX1 */
1569         s->mbox1 = val;
1570         break;
1571     case 0x1a: /* CTEST2 */
1572         s->ctest2 = val & LSI_CTEST2_PCICIE;
1573         break;
1574     case 0x1b: /* CTEST3 */
1575         s->ctest3 = val & 0x0f;
1576         break;
1577     CASE_SET_REG32(temp, 0x1c)
1578     case 0x21: /* CTEST4 */
1579         if (val & 7) {
1580            BADF("Unimplemented CTEST4-FBL 0x%x\n", val);
1581         }
1582         s->ctest4 = val;
1583         break;
1584     case 0x22: /* CTEST5 */
1585         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1586             BADF("CTEST5 DMA increment not implemented\n");
1587         }
1588         s->ctest5 = val;
1589         break;
1590     case 0x2c: /* DSP[0:7] */
1591         s->dsp &= 0xffffff00;
1592         s->dsp |= val;
1593         break;
1594     case 0x2d: /* DSP[8:15] */
1595         s->dsp &= 0xffff00ff;
1596         s->dsp |= val << 8;
1597         break;
1598     case 0x2e: /* DSP[16:23] */
1599         s->dsp &= 0xff00ffff;
1600         s->dsp |= val << 16;
1601         break;
1602     case 0x2f: /* DSP[24:31] */
1603         s->dsp &= 0x00ffffff;
1604         s->dsp |= val << 24;
1605         if ((s->dmode & LSI_DMODE_MAN) == 0
1606             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1607             lsi_execute_script(s);
1608         break;
1609     CASE_SET_REG32(dsps, 0x30)
1610     CASE_SET_REG32(scratch[0], 0x34)
1611     case 0x38: /* DMODE */
1612         if (val & (LSI_DMODE_SIOM | LSI_DMODE_DIOM)) {
1613             BADF("IO mappings not implemented\n");
1614         }
1615         s->dmode = val;
1616         break;
1617     case 0x39: /* DIEN */
1618         s->dien = val;
1619         lsi_update_irq(s);
1620         break;
1621     case 0x3b: /* DCNTL */
1622         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1623         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1624             lsi_execute_script(s);
1625         break;
1626     case 0x40: /* SIEN0 */
1627         s->sien0 = val;
1628         lsi_update_irq(s);
1629         break;
1630     case 0x41: /* SIEN1 */
1631         s->sien1 = val;
1632         lsi_update_irq(s);
1633         break;
1634     case 0x47: /* GPCNTL0 */
1635         break;
1636     case 0x48: /* STIME0 */
1637         s->stime0 = val;
1638         break;
1639     case 0x49: /* STIME1 */
1640         if (val & 0xf) {
1641             DPRINTF("General purpose timer not implemented\n");
1642             /* ??? Raising the interrupt immediately seems to be sufficient
1643                to keep the FreeBSD driver happy.  */
1644             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
1645         }
1646         break;
1647     case 0x4a: /* RESPID0 */
1648         s->respid0 = val;
1649         break;
1650     case 0x4b: /* RESPID1 */
1651         s->respid1 = val;
1652         break;
1653     case 0x4d: /* STEST1 */
1654         s->stest1 = val;
1655         break;
1656     case 0x4e: /* STEST2 */
1657         if (val & 1) {
1658             BADF("Low level mode not implemented\n");
1659         }
1660         s->stest2 = val;
1661         break;
1662     case 0x4f: /* STEST3 */
1663         if (val & 0x41) {
1664             BADF("SCSI FIFO test mode not implemented\n");
1665         }
1666         s->stest3 = val;
1667         break;
1668     case 0x56: /* CCNTL0 */
1669         s->ccntl0 = val;
1670         break;
1671     case 0x57: /* CCNTL1 */
1672         s->ccntl1 = val;
1673         break;
1674     CASE_SET_REG32(mmrs, 0xa0)
1675     CASE_SET_REG32(mmws, 0xa4)
1676     CASE_SET_REG32(sfs, 0xa8)
1677     CASE_SET_REG32(drs, 0xac)
1678     CASE_SET_REG32(sbms, 0xb0)
1679     CASE_SET_REG32(dbms, 0xb4)
1680     CASE_SET_REG32(dnad64, 0xb8)
1681     CASE_SET_REG32(pmjad1, 0xc0)
1682     CASE_SET_REG32(pmjad2, 0xc4)
1683     CASE_SET_REG32(rbc, 0xc8)
1684     CASE_SET_REG32(ua, 0xcc)
1685     CASE_SET_REG32(ia, 0xd4)
1686     CASE_SET_REG32(sbc, 0xd8)
1687     CASE_SET_REG32(csbc, 0xdc)
1688     default:
1689         if (offset >= 0x5c && offset < 0xa0) {
1690             int n;
1691             int shift;
1692             n = (offset - 0x58) >> 2;
1693             shift = (offset & 3) * 8;
1694             s->scratch[n] &= ~(0xff << shift);
1695             s->scratch[n] |= (val & 0xff) << shift;
1696         } else {
1697             BADF("Unhandled writeb 0x%x = 0x%x\n", offset, val);
1698         }
1699     }
1700 #undef CASE_SET_REG32
1701 }
1702
1703 static void lsi_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1704 {
1705     LSIState *s = (LSIState *)opaque;
1706
1707     lsi_reg_writeb(s, addr & 0xff, val);
1708 }
1709
1710 static void lsi_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1711 {
1712     LSIState *s = (LSIState *)opaque;
1713
1714     addr &= 0xff;
1715     lsi_reg_writeb(s, addr, val & 0xff);
1716     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1717 }
1718
1719 static void lsi_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1720 {
1721     LSIState *s = (LSIState *)opaque;
1722
1723     addr &= 0xff;
1724     lsi_reg_writeb(s, addr, val & 0xff);
1725     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1726     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1727     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1728 }
1729
1730 static uint32_t lsi_mmio_readb(void *opaque, target_phys_addr_t addr)
1731 {
1732     LSIState *s = (LSIState *)opaque;
1733
1734     return lsi_reg_readb(s, addr & 0xff);
1735 }
1736
1737 static uint32_t lsi_mmio_readw(void *opaque, target_phys_addr_t addr)
1738 {
1739     LSIState *s = (LSIState *)opaque;
1740     uint32_t val;
1741
1742     addr &= 0xff;
1743     val = lsi_reg_readb(s, addr);
1744     val |= lsi_reg_readb(s, addr + 1) << 8;
1745     return val;
1746 }
1747
1748 static uint32_t lsi_mmio_readl(void *opaque, target_phys_addr_t addr)
1749 {
1750     LSIState *s = (LSIState *)opaque;
1751     uint32_t val;
1752     addr &= 0xff;
1753     val = lsi_reg_readb(s, addr);
1754     val |= lsi_reg_readb(s, addr + 1) << 8;
1755     val |= lsi_reg_readb(s, addr + 2) << 16;
1756     val |= lsi_reg_readb(s, addr + 3) << 24;
1757     return val;
1758 }
1759
1760 static CPUReadMemoryFunc *lsi_mmio_readfn[3] = {
1761     lsi_mmio_readb,
1762     lsi_mmio_readw,
1763     lsi_mmio_readl,
1764 };
1765
1766 static CPUWriteMemoryFunc *lsi_mmio_writefn[3] = {
1767     lsi_mmio_writeb,
1768     lsi_mmio_writew,
1769     lsi_mmio_writel,
1770 };
1771
1772 static void lsi_ram_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1773 {
1774     LSIState *s = (LSIState *)opaque;
1775     uint32_t newval;
1776     int shift;
1777
1778     addr &= 0x1fff;
1779     newval = s->script_ram[addr >> 2];
1780     shift = (addr & 3) * 8;
1781     newval &= ~(0xff << shift);
1782     newval |= val << shift;
1783     s->script_ram[addr >> 2] = newval;
1784 }
1785
1786 static void lsi_ram_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1787 {
1788     LSIState *s = (LSIState *)opaque;
1789     uint32_t newval;
1790
1791     addr &= 0x1fff;
1792     newval = s->script_ram[addr >> 2];
1793     if (addr & 2) {
1794         newval = (newval & 0xffff) | (val << 16);
1795     } else {
1796         newval = (newval & 0xffff0000) | val;
1797     }
1798     s->script_ram[addr >> 2] = newval;
1799 }
1800
1801
1802 static void lsi_ram_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1803 {
1804     LSIState *s = (LSIState *)opaque;
1805
1806     addr &= 0x1fff;
1807     s->script_ram[addr >> 2] = val;
1808 }
1809
1810 static uint32_t lsi_ram_readb(void *opaque, target_phys_addr_t addr)
1811 {
1812     LSIState *s = (LSIState *)opaque;
1813     uint32_t val;
1814
1815     addr &= 0x1fff;
1816     val = s->script_ram[addr >> 2];
1817     val >>= (addr & 3) * 8;
1818     return val & 0xff;
1819 }
1820
1821 static uint32_t lsi_ram_readw(void *opaque, target_phys_addr_t addr)
1822 {
1823     LSIState *s = (LSIState *)opaque;
1824     uint32_t val;
1825
1826     addr &= 0x1fff;
1827     val = s->script_ram[addr >> 2];
1828     if (addr & 2)
1829         val >>= 16;
1830     return le16_to_cpu(val);
1831 }
1832
1833 static uint32_t lsi_ram_readl(void *opaque, target_phys_addr_t addr)
1834 {
1835     LSIState *s = (LSIState *)opaque;
1836
1837     addr &= 0x1fff;
1838     return le32_to_cpu(s->script_ram[addr >> 2]);
1839 }
1840
1841 static CPUReadMemoryFunc *lsi_ram_readfn[3] = {
1842     lsi_ram_readb,
1843     lsi_ram_readw,
1844     lsi_ram_readl,
1845 };
1846
1847 static CPUWriteMemoryFunc *lsi_ram_writefn[3] = {
1848     lsi_ram_writeb,
1849     lsi_ram_writew,
1850     lsi_ram_writel,
1851 };
1852
1853 static uint32_t lsi_io_readb(void *opaque, uint32_t addr)
1854 {
1855     LSIState *s = (LSIState *)opaque;
1856     return lsi_reg_readb(s, addr & 0xff);
1857 }
1858
1859 static uint32_t lsi_io_readw(void *opaque, uint32_t addr)
1860 {
1861     LSIState *s = (LSIState *)opaque;
1862     uint32_t val;
1863     addr &= 0xff;
1864     val = lsi_reg_readb(s, addr);
1865     val |= lsi_reg_readb(s, addr + 1) << 8;
1866     return val;
1867 }
1868
1869 static uint32_t lsi_io_readl(void *opaque, uint32_t addr)
1870 {
1871     LSIState *s = (LSIState *)opaque;
1872     uint32_t val;
1873     addr &= 0xff;
1874     val = lsi_reg_readb(s, addr);
1875     val |= lsi_reg_readb(s, addr + 1) << 8;
1876     val |= lsi_reg_readb(s, addr + 2) << 16;
1877     val |= lsi_reg_readb(s, addr + 3) << 24;
1878     return val;
1879 }
1880
1881 static void lsi_io_writeb(void *opaque, uint32_t addr, uint32_t val)
1882 {
1883     LSIState *s = (LSIState *)opaque;
1884     lsi_reg_writeb(s, addr & 0xff, val);
1885 }
1886
1887 static void lsi_io_writew(void *opaque, uint32_t addr, uint32_t val)
1888 {
1889     LSIState *s = (LSIState *)opaque;
1890     addr &= 0xff;
1891     lsi_reg_writeb(s, addr, val & 0xff);
1892     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1893 }
1894
1895 static void lsi_io_writel(void *opaque, uint32_t addr, uint32_t val)
1896 {
1897     LSIState *s = (LSIState *)opaque;
1898     addr &= 0xff;
1899     lsi_reg_writeb(s, addr, val & 0xff);
1900     lsi_reg_writeb(s, addr + 1, (val >> 8) & 0xff);
1901     lsi_reg_writeb(s, addr + 2, (val >> 16) & 0xff);
1902     lsi_reg_writeb(s, addr + 3, (val >> 24) & 0xff);
1903 }
1904
1905 static void lsi_io_mapfunc(PCIDevice *pci_dev, int region_num,
1906                            uint32_t addr, uint32_t size, int type)
1907 {
1908     LSIState *s = (LSIState *)pci_dev;
1909
1910     DPRINTF("Mapping IO at %08x\n", addr);
1911
1912     register_ioport_write(addr, 256, 1, lsi_io_writeb, s);
1913     register_ioport_read(addr, 256, 1, lsi_io_readb, s);
1914     register_ioport_write(addr, 256, 2, lsi_io_writew, s);
1915     register_ioport_read(addr, 256, 2, lsi_io_readw, s);
1916     register_ioport_write(addr, 256, 4, lsi_io_writel, s);
1917     register_ioport_read(addr, 256, 4, lsi_io_readl, s);
1918 }
1919
1920 static void lsi_ram_mapfunc(PCIDevice *pci_dev, int region_num,
1921                             uint32_t addr, uint32_t size, int type)
1922 {
1923     LSIState *s = (LSIState *)pci_dev;
1924
1925     DPRINTF("Mapping ram at %08x\n", addr);
1926     s->script_ram_base = addr;
1927     cpu_register_physical_memory(addr + 0, 0x2000, s->ram_io_addr);
1928 }
1929
1930 static void lsi_mmio_mapfunc(PCIDevice *pci_dev, int region_num,
1931                              uint32_t addr, uint32_t size, int type)
1932 {
1933     LSIState *s = (LSIState *)pci_dev;
1934
1935     DPRINTF("Mapping registers at %08x\n", addr);
1936     cpu_register_physical_memory(addr + 0, 0x400, s->mmio_io_addr);
1937 }
1938
1939 void lsi_scsi_attach(void *opaque, BlockDriverState *bd, int id)
1940 {
1941     LSIState *s = (LSIState *)opaque;
1942
1943     if (id < 0) {
1944         for (id = 0; id < LSI_MAX_DEVS; id++) {
1945             if (s->scsi_dev[id] == NULL)
1946                 break;
1947         }
1948     }
1949     if (id >= LSI_MAX_DEVS) {
1950         BADF("Bad Device ID %d\n", id);
1951         return;
1952     }
1953     if (s->scsi_dev[id]) {
1954         DPRINTF("Destroying device %d\n", id);
1955         s->scsi_dev[id]->destroy(s->scsi_dev[id]);
1956     }
1957     DPRINTF("Attaching block device %d\n", id);
1958     s->scsi_dev[id] = scsi_generic_init(bd, 1, lsi_command_complete, s);
1959     if (s->scsi_dev[id] == NULL)
1960         s->scsi_dev[id] = scsi_disk_init(bd, 1, lsi_command_complete, s);
1961 }
1962
1963 void *lsi_scsi_init(PCIBus *bus, int devfn)
1964 {
1965     LSIState *s;
1966     uint8_t *pci_conf;
1967
1968     s = (LSIState *)pci_register_device(bus, "LSI53C895A SCSI HBA",
1969                                         sizeof(*s), devfn, NULL, NULL);
1970     if (s == NULL) {
1971         fprintf(stderr, "lsi-scsi: Failed to register PCI device\n");
1972         return NULL;
1973     }
1974
1975     pci_conf = s->pci_dev.config;
1976
1977     /* PCI Vendor ID (word) */
1978     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);
1979     /* PCI device ID (word) */
1980     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);
1981     /* PCI base class code */
1982     pci_conf[0x0b] = 0x01;
1983     /* PCI subsystem ID */
1984     pci_conf[0x2e] = 0x00;
1985     pci_conf[0x2f] = 0x10;
1986     /* PCI latency timer = 255 */
1987     pci_conf[0x0d] = 0xff;
1988     /* Interrupt pin 1 */
1989     pci_conf[0x3d] = 0x01;
1990
1991     s->mmio_io_addr = cpu_register_io_memory(0, lsi_mmio_readfn,
1992                                              lsi_mmio_writefn, s);
1993     s->ram_io_addr = cpu_register_io_memory(0, lsi_ram_readfn,
1994                                             lsi_ram_writefn, s);
1995
1996     pci_register_io_region((struct PCIDevice *)s, 0, 256,
1997                            PCI_ADDRESS_SPACE_IO, lsi_io_mapfunc);
1998     pci_register_io_region((struct PCIDevice *)s, 1, 0x400,
1999                            PCI_ADDRESS_SPACE_MEM, lsi_mmio_mapfunc);
2000     pci_register_io_region((struct PCIDevice *)s, 2, 0x2000,
2001                            PCI_ADDRESS_SPACE_MEM, lsi_ram_mapfunc);
2002     s->queue = qemu_malloc(sizeof(lsi_queue));
2003     s->queue_len = 1;
2004     s->active_commands = 0;
2005
2006     lsi_soft_reset(s);
2007
2008     return s;
2009 }