hw/scsi/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the LGPL.
   8  */
   9
  10 /* Note:
  11  * LSI53C810 emulation is incorrect, in the sense that it supports
  12  * features added in later evolutions. This should not be a problem,
  13  * as well-behaved operating systems will not try to use them.
  14  */
  15
  16 #include "qemu/osdep.h"
  17
  18 #include "hw/hw.h"
  19 #include "hw/pci/pci.h"
  20 #include "hw/scsi/scsi.h"
  21 #include "sysemu/dma.h"
  22 #include "qemu/log.h"
  23 #include "trace.h"
  24
  25 static const char *names[] = {
  26     "SCNTL0", "SCNTL1", "SCNTL2", "SCNTL3", "SCID", "SXFER", "SDID", "GPREG",
  27     "SFBR", "SOCL", "SSID", "SBCL", "DSTAT", "SSTAT0", "SSTAT1", "SSTAT2",
  28     "DSA0", "DSA1", "DSA2", "DSA3", "ISTAT", "0x15", "0x16", "0x17",
  29     "CTEST0", "CTEST1", "CTEST2", "CTEST3", "TEMP0", "TEMP1", "TEMP2", "TEMP3",
  30     "DFIFO", "CTEST4", "CTEST5", "CTEST6", "DBC0", "DBC1", "DBC2", "DCMD",
  31     "DNAD0", "DNAD1", "DNAD2", "DNAD3", "DSP0", "DSP1", "DSP2", "DSP3",
  32     "DSPS0", "DSPS1", "DSPS2", "DSPS3", "SCRATCHA0", "SCRATCHA1", "SCRATCHA2", "SCRATCHA3",
  33     "DMODE", "DIEN", "SBR", "DCNTL", "ADDER0", "ADDER1", "ADDER2", "ADDER3",
  34     "SIEN0", "SIEN1", "SIST0", "SIST1", "SLPAR", "0x45", "MACNTL", "GPCNTL",
  35     "STIME0", "STIME1", "RESPID", "0x4b", "STEST0", "STEST1", "STEST2", "STEST3",
  36     "SIDL", "0x51", "0x52", "0x53", "SODL", "0x55", "0x56", "0x57",
  37     "SBDL", "0x59", "0x5a", "0x5b", "SCRATCHB0", "SCRATCHB1", "SCRATCHB2", "SCRATCHB3",
  38 };
  39
  40 #define LSI_MAX_DEVS 7
  41
  42 #define LSI_SCNTL0_TRG    0x01
  43 #define LSI_SCNTL0_AAP    0x02
  44 #define LSI_SCNTL0_EPC    0x08
  45 #define LSI_SCNTL0_WATN   0x10
  46 #define LSI_SCNTL0_START  0x20
  47
  48 #define LSI_SCNTL1_SST    0x01
  49 #define LSI_SCNTL1_IARB   0x02
  50 #define LSI_SCNTL1_AESP   0x04
  51 #define LSI_SCNTL1_RST    0x08
  52 #define LSI_SCNTL1_CON    0x10
  53 #define LSI_SCNTL1_DHP    0x20
  54 #define LSI_SCNTL1_ADB    0x40
  55 #define LSI_SCNTL1_EXC    0x80
  56
  57 #define LSI_SCNTL2_WSR    0x01
  58 #define LSI_SCNTL2_VUE0   0x02
  59 #define LSI_SCNTL2_VUE1   0x04
  60 #define LSI_SCNTL2_WSS    0x08
  61 #define LSI_SCNTL2_SLPHBEN 0x10
  62 #define LSI_SCNTL2_SLPMD  0x20
  63 #define LSI_SCNTL2_CHM    0x40
  64 #define LSI_SCNTL2_SDU    0x80
  65
  66 #define LSI_ISTAT0_DIP    0x01
  67 #define LSI_ISTAT0_SIP    0x02
  68 #define LSI_ISTAT0_INTF   0x04
  69 #define LSI_ISTAT0_CON    0x08
  70 #define LSI_ISTAT0_SEM    0x10
  71 #define LSI_ISTAT0_SIGP   0x20
  72 #define LSI_ISTAT0_SRST   0x40
  73 #define LSI_ISTAT0_ABRT   0x80
  74
  75 #define LSI_ISTAT1_SI     0x01
  76 #define LSI_ISTAT1_SRUN   0x02
  77 #define LSI_ISTAT1_FLSH   0x04
  78
  79 #define LSI_SSTAT0_SDP0   0x01
  80 #define LSI_SSTAT0_RST    0x02
  81 #define LSI_SSTAT0_WOA    0x04
  82 #define LSI_SSTAT0_LOA    0x08
  83 #define LSI_SSTAT0_AIP    0x10
  84 #define LSI_SSTAT0_OLF    0x20
  85 #define LSI_SSTAT0_ORF    0x40
  86 #define LSI_SSTAT0_ILF    0x80
  87
  88 #define LSI_SIST0_PAR     0x01
  89 #define LSI_SIST0_RST     0x02
  90 #define LSI_SIST0_UDC     0x04
  91 #define LSI_SIST0_SGE     0x08
  92 #define LSI_SIST0_RSL     0x10
  93 #define LSI_SIST0_SEL     0x20
  94 #define LSI_SIST0_CMP     0x40
  95 #define LSI_SIST0_MA      0x80
  96
  97 #define LSI_SIST1_HTH     0x01
  98 #define LSI_SIST1_GEN     0x02
  99 #define LSI_SIST1_STO     0x04
 100 #define LSI_SIST1_SBMC    0x10
 101
 102 #define LSI_SOCL_IO       0x01
 103 #define LSI_SOCL_CD       0x02
 104 #define LSI_SOCL_MSG      0x04
 105 #define LSI_SOCL_ATN      0x08
 106 #define LSI_SOCL_SEL      0x10
 107 #define LSI_SOCL_BSY      0x20
 108 #define LSI_SOCL_ACK      0x40
 109 #define LSI_SOCL_REQ      0x80
 110
 111 #define LSI_DSTAT_IID     0x01
 112 #define LSI_DSTAT_SIR     0x04
 113 #define LSI_DSTAT_SSI     0x08
 114 #define LSI_DSTAT_ABRT    0x10
 115 #define LSI_DSTAT_BF      0x20
 116 #define LSI_DSTAT_MDPE    0x40
 117 #define LSI_DSTAT_DFE     0x80
 118
 119 #define LSI_DCNTL_COM     0x01
 120 #define LSI_DCNTL_IRQD    0x02
 121 #define LSI_DCNTL_STD     0x04
 122 #define LSI_DCNTL_IRQM    0x08
 123 #define LSI_DCNTL_SSM     0x10
 124 #define LSI_DCNTL_PFEN    0x20
 125 #define LSI_DCNTL_PFF     0x40
 126 #define LSI_DCNTL_CLSE    0x80
 127
 128 #define LSI_DMODE_MAN     0x01
 129 #define LSI_DMODE_BOF     0x02
 130 #define LSI_DMODE_ERMP    0x04
 131 #define LSI_DMODE_ERL     0x08
 132 #define LSI_DMODE_DIOM    0x10
 133 #define LSI_DMODE_SIOM    0x20
 134
 135 #define LSI_CTEST2_DACK   0x01
 136 #define LSI_CTEST2_DREQ   0x02
 137 #define LSI_CTEST2_TEOP   0x04
 138 #define LSI_CTEST2_PCICIE 0x08
 139 #define LSI_CTEST2_CM     0x10
 140 #define LSI_CTEST2_CIO    0x20
 141 #define LSI_CTEST2_SIGP   0x40
 142 #define LSI_CTEST2_DDIR   0x80
 143
 144 #define LSI_CTEST5_BL2    0x04
 145 #define LSI_CTEST5_DDIR   0x08
 146 #define LSI_CTEST5_MASR   0x10
 147 #define LSI_CTEST5_DFSN   0x20
 148 #define LSI_CTEST5_BBCK   0x40
 149 #define LSI_CTEST5_ADCK   0x80
 150
 151 #define LSI_CCNTL0_DILS   0x01
 152 #define LSI_CCNTL0_DISFC  0x10
 153 #define LSI_CCNTL0_ENNDJ  0x20
 154 #define LSI_CCNTL0_PMJCTL 0x40
 155 #define LSI_CCNTL0_ENPMJ  0x80
 156
 157 #define LSI_CCNTL1_EN64DBMV  0x01
 158 #define LSI_CCNTL1_EN64TIBMV 0x02
 159 #define LSI_CCNTL1_64TIMOD   0x04
 160 #define LSI_CCNTL1_DDAC      0x08
 161 #define LSI_CCNTL1_ZMOD      0x80
 162
 163 #define LSI_SBCL_ATN         0x08
 164 #define LSI_SBCL_BSY         0x20
 165 #define LSI_SBCL_ACK         0x40
 166 #define LSI_SBCL_REQ         0x80
 167
 168 /* Enable Response to Reselection */
 169 #define LSI_SCID_RRE      0x60
 170
 171 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 172
 173 #define PHASE_DO          0
 174 #define PHASE_DI          1
 175 #define PHASE_CMD         2
 176 #define PHASE_ST          3
 177 #define PHASE_MO          6
 178 #define PHASE_MI          7
 179 #define PHASE_MASK        7
 180
 181 /* Maximum length of MSG IN data.  */
 182 #define LSI_MAX_MSGIN_LEN 8
 183
 184 /* Flag set if this is a tagged command.  */
 185 #define LSI_TAG_VALID     (1 << 16)
 186
 187 typedef struct lsi_request {
 188     SCSIRequest *req;
 189     uint32_t tag;
 190     uint32_t dma_len;
 191     uint8_t *dma_buf;
 192     uint32_t pending;
 193     int out;
 194     QTAILQ_ENTRY(lsi_request) next;
 195 } lsi_request;
 196
 197 enum {
 198     LSI_NOWAIT, /* SCRIPTS are running or stopped */
 199     LSI_WAIT_RESELECT, /* Wait Reselect instruction has been issued */
 200     LSI_DMA_SCRIPTS, /* processing DMA from lsi_execute_script */
 201     LSI_DMA_IN_PROGRESS, /* DMA operation is in progress */
 202 };
 203
 204 enum {
 205     LSI_MSG_ACTION_COMMAND = 0,
 206     LSI_MSG_ACTION_DISCONNECT = 1,
 207     LSI_MSG_ACTION_DOUT = 2,
 208     LSI_MSG_ACTION_DIN = 3,
 209 };
 210
 211 typedef struct {
 212     /*< private >*/
 213     PCIDevice parent_obj;
 214     /*< public >*/
 215
 216     qemu_irq ext_irq;
 217     MemoryRegion mmio_io;
 218     MemoryRegion ram_io;
 219     MemoryRegion io_io;
 220     AddressSpace pci_io_as;
 221
 222     int carry; /* ??? Should this be an a visible register somewhere?  */
 223     int status;
 224     int msg_action;
 225     int msg_len;
 226     uint8_t msg[LSI_MAX_MSGIN_LEN];
 227     int waiting;
 228     SCSIBus bus;
 229     int current_lun;
 230     /* The tag is a combination of the device ID and the SCSI tag.  */
 231     uint32_t select_tag;
 232     int command_complete;
 233     QTAILQ_HEAD(, lsi_request) queue;
 234     lsi_request *current;
 235
 236     uint32_t dsa;
 237     uint32_t temp;
 238     uint32_t dnad;
 239     uint32_t dbc;
 240     uint8_t istat0;
 241     uint8_t istat1;
 242     uint8_t dcmd;
 243     uint8_t dstat;
 244     uint8_t dien;
 245     uint8_t sist0;
 246     uint8_t sist1;
 247     uint8_t sien0;
 248     uint8_t sien1;
 249     uint8_t mbox0;
 250     uint8_t mbox1;
 251     uint8_t dfifo;
 252     uint8_t ctest2;
 253     uint8_t ctest3;
 254     uint8_t ctest4;
 255     uint8_t ctest5;
 256     uint8_t ccntl0;
 257     uint8_t ccntl1;
 258     uint32_t dsp;
 259     uint32_t dsps;
 260     uint8_t dmode;
 261     uint8_t dcntl;
 262     uint8_t scntl0;
 263     uint8_t scntl1;
 264     uint8_t scntl2;
 265     uint8_t scntl3;
 266     uint8_t sstat0;
 267     uint8_t sstat1;
 268     uint8_t scid;
 269     uint8_t sxfer;
 270     uint8_t socl;
 271     uint8_t sdid;
 272     uint8_t ssid;
 273     uint8_t sfbr;
 274     uint8_t sbcl;
 275     uint8_t stest1;
 276     uint8_t stest2;
 277     uint8_t stest3;
 278     uint8_t sidl;
 279     uint8_t stime0;
 280     uint8_t respid0;
 281     uint8_t respid1;
 282     uint32_t mmrs;
 283     uint32_t mmws;
 284     uint32_t sfs;
 285     uint32_t drs;
 286     uint32_t sbms;
 287     uint32_t dbms;
 288     uint32_t dnad64;
 289     uint32_t pmjad1;
 290     uint32_t pmjad2;
 291     uint32_t rbc;
 292     uint32_t ua;
 293     uint32_t ia;
 294     uint32_t sbc;
 295     uint32_t csbc;
 296     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 297     uint8_t sbr;
 298     uint32_t adder;
 299
 300     uint8_t script_ram[2048 * sizeof(uint32_t)];
 301 } LSIState;
 302
 303 #define TYPE_LSI53C810  "lsi53c810"
 304 #define TYPE_LSI53C895A "lsi53c895a"
 305
 306 #define LSI53C895A(obj) \
 307     OBJECT_CHECK(LSIState, (obj), TYPE_LSI53C895A)
 308
 309 static const char *scsi_phases[] = {
 310     "DOUT",
 311     "DIN",
 312     "CMD",
 313     "STATUS",
 314     "RSVOUT",
 315     "RSVIN",
 316     "MSGOUT",
 317     "MSGIN"
 318 };
 319
 320 static const char *scsi_phase_name(int phase)
 321 {
 322     return scsi_phases[phase & PHASE_MASK];
 323 }
 324
 325 static inline int lsi_irq_on_rsl(LSIState *s)
 326 {
 327     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
 328 }
 329
 330 static lsi_request *get_pending_req(LSIState *s)
 331 {
 332     lsi_request *p;
 333
 334     QTAILQ_FOREACH(p, &s->queue, next) {
 335         if (p->pending) {
 336             return p;
 337         }
 338     }
 339     return NULL;
 340 }
 341
 342 static void lsi_soft_reset(LSIState *s)
 343 {
 344     trace_lsi_reset();
 345     s->carry = 0;
 346
 347     s->msg_action = LSI_MSG_ACTION_COMMAND;
 348     s->msg_len = 0;
 349     s->waiting = LSI_NOWAIT;
 350     s->dsa = 0;
 351     s->dnad = 0;
 352     s->dbc = 0;
 353     s->temp = 0;
 354     memset(s->scratch, 0, sizeof(s->scratch));
 355     s->istat0 = 0;
 356     s->istat1 = 0;
 357     s->dcmd = 0x40;
 358     s->dstat = 0;
 359     s->dien = 0;
 360     s->sist0 = 0;
 361     s->sist1 = 0;
 362     s->sien0 = 0;
 363     s->sien1 = 0;
 364     s->mbox0 = 0;
 365     s->mbox1 = 0;
 366     s->dfifo = 0;
 367     s->ctest2 = LSI_CTEST2_DACK;
 368     s->ctest3 = 0;
 369     s->ctest4 = 0;
 370     s->ctest5 = 0;
 371     s->ccntl0 = 0;
 372     s->ccntl1 = 0;
 373     s->dsp = 0;
 374     s->dsps = 0;
 375     s->dmode = 0;
 376     s->dcntl = 0;
 377     s->scntl0 = 0xc0;
 378     s->scntl1 = 0;
 379     s->scntl2 = 0;
 380     s->scntl3 = 0;
 381     s->sstat0 = 0;
 382     s->sstat1 = 0;
 383     s->scid = 7;
 384     s->sxfer = 0;
 385     s->socl = 0;
 386     s->sdid = 0;
 387     s->ssid = 0;
 388     s->sbcl = 0;
 389     s->stest1 = 0;
 390     s->stest2 = 0;
 391     s->stest3 = 0;
 392     s->sidl = 0;
 393     s->stime0 = 0;
 394     s->respid0 = 0x80;
 395     s->respid1 = 0;
 396     s->mmrs = 0;
 397     s->mmws = 0;
 398     s->sfs = 0;
 399     s->drs = 0;
 400     s->sbms = 0;
 401     s->dbms = 0;
 402     s->dnad64 = 0;
 403     s->pmjad1 = 0;
 404     s->pmjad2 = 0;
 405     s->rbc = 0;
 406     s->ua = 0;
 407     s->ia = 0;
 408     s->sbc = 0;
 409     s->csbc = 0;
 410     s->sbr = 0;
 411     assert(QTAILQ_EMPTY(&s->queue));
 412     assert(!s->current);
 413 }
 414
 415 static int lsi_dma_40bit(LSIState *s)
 416 {
 417     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 418         return 1;
 419     return 0;
 420 }
 421
 422 static int lsi_dma_ti64bit(LSIState *s)
 423 {
 424     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 425         return 1;
 426     return 0;
 427 }
 428
 429 static int lsi_dma_64bit(LSIState *s)
 430 {
 431     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 432         return 1;
 433     return 0;
 434 }
 435
 436 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 437 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 438 static void lsi_execute_script(LSIState *s);
 439 static void lsi_reselect(LSIState *s, lsi_request *p);
 440
 441 static inline void lsi_mem_read(LSIState *s, dma_addr_t addr,
 442                                void *buf, dma_addr_t len)
 443 {
 444     if (s->dmode & LSI_DMODE_SIOM) {
 445         address_space_read(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
 446                            buf, len);
 447     } else {
 448         pci_dma_read(PCI_DEVICE(s), addr, buf, len);
 449     }
 450 }
 451
 452 static inline void lsi_mem_write(LSIState *s, dma_addr_t addr,
 453                                 const void *buf, dma_addr_t len)
 454 {
 455     if (s->dmode & LSI_DMODE_DIOM) {
 456         address_space_write(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
 457                             buf, len);
 458     } else {
 459         pci_dma_write(PCI_DEVICE(s), addr, buf, len);
 460     }
 461 }
 462
 463 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 464 {
 465     uint32_t buf;
 466
 467     pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
 468     return cpu_to_le32(buf);
 469 }
 470
 471 static void lsi_stop_script(LSIState *s)
 472 {
 473     s->istat1 &= ~LSI_ISTAT1_SRUN;
 474 }
 475
 476 static void lsi_set_irq(LSIState *s, int level)
 477 {
 478     PCIDevice *d = PCI_DEVICE(s);
 479
 480     if (s->ext_irq) {
 481         qemu_set_irq(s->ext_irq, level);
 482     } else {
 483         pci_set_irq(d, level);
 484     }
 485 }
 486
 487 static void lsi_update_irq(LSIState *s)
 488 {
 489     int level;
 490     static int last_level;
 491
 492     /* It's unclear whether the DIP/SIP bits should be cleared when the
 493        Interrupt Status Registers are cleared or when istat0 is read.
 494        We currently do the formwer, which seems to work.  */
 495     level = 0;
 496     if (s->dstat) {
 497         if (s->dstat & s->dien)
 498             level = 1;
 499         s->istat0 |= LSI_ISTAT0_DIP;
 500     } else {
 501         s->istat0 &= ~LSI_ISTAT0_DIP;
 502     }
 503
 504     if (s->sist0 || s->sist1) {
 505         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 506             level = 1;
 507         s->istat0 |= LSI_ISTAT0_SIP;
 508     } else {
 509         s->istat0 &= ~LSI_ISTAT0_SIP;
 510     }
 511     if (s->istat0 & LSI_ISTAT0_INTF)
 512         level = 1;
 513
 514     if (level != last_level) {
 515         trace_lsi_update_irq(level, s->dstat, s->sist1, s->sist0);
 516         last_level = level;
 517     }
 518     lsi_set_irq(s, level);
 519
 520     if (!s->current && !level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
 521         lsi_request *p;
 522
 523         trace_lsi_update_irq_disconnected();
 524         p = get_pending_req(s);
 525         if (p) {
 526             lsi_reselect(s, p);
 527         }
 528     }
 529 }
 530
 531 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 532 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 533 {
 534     uint32_t mask0;
 535     uint32_t mask1;
 536
 537     trace_lsi_script_scsi_interrupt(stat1, stat0, s->sist1, s->sist0);
 538     s->sist0 |= stat0;
 539     s->sist1 |= stat1;
 540     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 541        we don't stop processing when raising STO.  Instead continue
 542        execution and stop at the next insn that accesses the SCSI bus.  */
 543     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 544     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 545     mask1 &= ~LSI_SIST1_STO;
 546     if (s->sist0 & mask0 || s->sist1 & mask1) {
 547         lsi_stop_script(s);
 548     }
 549     lsi_update_irq(s);
 550 }
 551
 552 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 553 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 554 {
 555     trace_lsi_script_dma_interrupt(stat, s->dstat);
 556     s->dstat |= stat;
 557     lsi_update_irq(s);
 558     lsi_stop_script(s);
 559 }
 560
 561 static inline void lsi_set_phase(LSIState *s, int phase)
 562 {
 563     s->sbcl &= ~PHASE_MASK;
 564     s->sbcl |= phase | LSI_SBCL_REQ;
 565     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 566 }
 567
 568 static void lsi_bad_phase(LSIState *s, int out, int new_phase)
 569 {
 570     /* Trigger a phase mismatch.  */
 571     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 572         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
 573             s->dsp = out ? s->pmjad1 : s->pmjad2;
 574         } else {
 575             s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
 576         }
 577         trace_lsi_bad_phase_jump(s->dsp);
 578     } else {
 579         trace_lsi_bad_phase_interrupt();
 580         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 581         lsi_stop_script(s);
 582     }
 583     lsi_set_phase(s, new_phase);
 584 }
 585
 586
 587 /* Resume SCRIPTS execution after a DMA operation.  */
 588 static void lsi_resume_script(LSIState *s)
 589 {
 590     if (s->waiting != 2) {
 591         s->waiting = LSI_NOWAIT;
 592         lsi_execute_script(s);
 593     } else {
 594         s->waiting = LSI_NOWAIT;
 595     }
 596 }
 597
 598 static void lsi_disconnect(LSIState *s)
 599 {
 600     s->scntl1 &= ~LSI_SCNTL1_CON;
 601     s->sstat1 &= ~PHASE_MASK;
 602     s->sbcl = 0;
 603 }
 604
 605 static void lsi_bad_selection(LSIState *s, uint32_t id)
 606 {
 607     trace_lsi_bad_selection(id);
 608     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 609     lsi_disconnect(s);
 610 }
 611
 612 /* Initiate a SCSI layer data transfer.  */
 613 static void lsi_do_dma(LSIState *s, int out)
 614 {
 615     uint32_t count;
 616     dma_addr_t addr;
 617     SCSIDevice *dev;
 618
 619     assert(s->current);
 620     if (!s->current->dma_len) {
 621         /* Wait until data is available.  */
 622         trace_lsi_do_dma_unavailable();
 623         return;
 624     }
 625
 626     dev = s->current->req->dev;
 627     assert(dev);
 628
 629     count = s->dbc;
 630     if (count > s->current->dma_len)
 631         count = s->current->dma_len;
 632
 633     addr = s->dnad;
 634     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 635     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 636         addr |= ((uint64_t)s->dnad64 << 32);
 637     else if (s->dbms)
 638         addr |= ((uint64_t)s->dbms << 32);
 639     else if (s->sbms)
 640         addr |= ((uint64_t)s->sbms << 32);
 641
 642     trace_lsi_do_dma(addr, count);
 643     s->csbc += count;
 644     s->dnad += count;
 645     s->dbc -= count;
 646      if (s->current->dma_buf == NULL) {
 647         s->current->dma_buf = scsi_req_get_buf(s->current->req);
 648     }
 649     /* ??? Set SFBR to first data byte.  */
 650     if (out) {
 651         lsi_mem_read(s, addr, s->current->dma_buf, count);
 652     } else {
 653         lsi_mem_write(s, addr, s->current->dma_buf, count);
 654     }
 655     s->current->dma_len -= count;
 656     if (s->current->dma_len == 0) {
 657         s->current->dma_buf = NULL;
 658         scsi_req_continue(s->current->req);
 659     } else {
 660         s->current->dma_buf += count;
 661         lsi_resume_script(s);
 662     }
 663 }
 664
 665
 666 /* Add a command to the queue.  */
 667 static void lsi_queue_command(LSIState *s)
 668 {
 669     lsi_request *p = s->current;
 670
 671     trace_lsi_queue_command(p->tag);
 672     assert(s->current != NULL);
 673     assert(s->current->dma_len == 0);
 674     QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
 675     s->current = NULL;
 676
 677     p->pending = 0;
 678     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 679 }
 680
 681 /* Queue a byte for a MSG IN phase.  */
 682 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 683 {
 684     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 685         trace_lsi_add_msg_byte_error();
 686     } else {
 687         trace_lsi_add_msg_byte(data);
 688         s->msg[s->msg_len++] = data;
 689     }
 690 }
 691
 692 /* Perform reselection to continue a command.  */
 693 static void lsi_reselect(LSIState *s, lsi_request *p)
 694 {
 695     int id;
 696
 697     assert(s->current == NULL);
 698     QTAILQ_REMOVE(&s->queue, p, next);
 699     s->current = p;
 700
 701     id = (p->tag >> 8) & 0xf;
 702     s->ssid = id | 0x80;
 703     /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
 704     if (!(s->dcntl & LSI_DCNTL_COM)) {
 705         s->sfbr = 1 << (id & 0x7);
 706     }
 707     trace_lsi_reselect(id);
 708     s->scntl1 |= LSI_SCNTL1_CON;
 709     lsi_set_phase(s, PHASE_MI);
 710     s->msg_action = p->out ? LSI_MSG_ACTION_DOUT : LSI_MSG_ACTION_DIN;
 711     s->current->dma_len = p->pending;
 712     lsi_add_msg_byte(s, 0x80);
 713     if (s->current->tag & LSI_TAG_VALID) {
 714         lsi_add_msg_byte(s, 0x20);
 715         lsi_add_msg_byte(s, p->tag & 0xff);
 716     }
 717
 718     if (lsi_irq_on_rsl(s)) {
 719         lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
 720     }
 721 }
 722
 723 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
 724 {
 725     lsi_request *p;
 726
 727     QTAILQ_FOREACH(p, &s->queue, next) {
 728         if (p->tag == tag) {
 729             return p;
 730         }
 731     }
 732
 733     return NULL;
 734 }
 735
 736 static void lsi_request_free(LSIState *s, lsi_request *p)
 737 {
 738     if (p == s->current) {
 739         s->current = NULL;
 740     } else {
 741         QTAILQ_REMOVE(&s->queue, p, next);
 742     }
 743     g_free(p);
 744 }
 745
 746 static void lsi_request_cancelled(SCSIRequest *req)
 747 {
 748     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 749     lsi_request *p = req->hba_private;
 750
 751     req->hba_private = NULL;
 752     lsi_request_free(s, p);
 753     scsi_req_unref(req);
 754 }
 755
 756 /* Record that data is available for a queued command.  Returns zero if
 757    the device was reselected, nonzero if the IO is deferred.  */
 758 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
 759 {
 760     lsi_request *p = req->hba_private;
 761
 762     if (p->pending) {
 763         trace_lsi_queue_req_error(p);
 764     }
 765     p->pending = len;
 766     /* Reselect if waiting for it, or if reselection triggers an IRQ
 767        and the bus is free.
 768        Since no interrupt stacking is implemented in the emulation, it
 769        is also required that there are no pending interrupts waiting
 770        for service from the device driver. */
 771     if (s->waiting == LSI_WAIT_RESELECT ||
 772         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
 773          !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
 774         /* Reselect device.  */
 775         lsi_reselect(s, p);
 776         return 0;
 777     } else {
 778         trace_lsi_queue_req(p->tag);
 779         p->pending = len;
 780         return 1;
 781     }
 782 }
 783
 784  /* Callback to indicate that the SCSI layer has completed a command.  */
 785 static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
 786 {
 787     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 788     int out;
 789
 790     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 791     trace_lsi_command_complete(status);
 792     s->status = status;
 793     s->command_complete = 2;
 794     if (s->waiting && s->dbc != 0) {
 795         /* Raise phase mismatch for short transfers.  */
 796         lsi_bad_phase(s, out, PHASE_ST);
 797     } else {
 798         lsi_set_phase(s, PHASE_ST);
 799     }
 800
 801     if (req->hba_private == s->current) {
 802         req->hba_private = NULL;
 803         lsi_request_free(s, s->current);
 804         scsi_req_unref(req);
 805     }
 806     lsi_resume_script(s);
 807 }
 808
 809  /* Callback to indicate that the SCSI layer has completed a transfer.  */
 810 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
 811 {
 812     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 813     int out;
 814
 815     assert(req->hba_private);
 816     if (s->waiting == LSI_WAIT_RESELECT || req->hba_private != s->current ||
 817         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
 818         if (lsi_queue_req(s, req, len)) {
 819             return;
 820         }
 821     }
 822
 823     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 824
 825     /* host adapter (re)connected */
 826     trace_lsi_transfer_data(req->tag, len);
 827     s->current->dma_len = len;
 828     s->command_complete = 1;
 829     if (s->waiting) {
 830         if (s->waiting == LSI_WAIT_RESELECT || s->dbc == 0) {
 831             lsi_resume_script(s);
 832         } else {
 833             lsi_do_dma(s, out);
 834         }
 835     }
 836 }
 837
 838 static void lsi_do_command(LSIState *s)
 839 {
 840     SCSIDevice *dev;
 841     uint8_t buf[16];
 842     uint32_t id;
 843     int n;
 844
 845     trace_lsi_do_command(s->dbc);
 846     if (s->dbc > 16)
 847         s->dbc = 16;
 848     pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
 849     s->sfbr = buf[0];
 850     s->command_complete = 0;
 851
 852     id = (s->select_tag >> 8) & 0xf;
 853     dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
 854     if (!dev) {
 855         lsi_bad_selection(s, id);
 856         return;
 857     }
 858
 859     assert(s->current == NULL);
 860     s->current = g_new0(lsi_request, 1);
 861     s->current->tag = s->select_tag;
 862     s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
 863                                    s->current);
 864
 865     n = scsi_req_enqueue(s->current->req);
 866     if (n) {
 867         if (n > 0) {
 868             lsi_set_phase(s, PHASE_DI);
 869         } else if (n < 0) {
 870             lsi_set_phase(s, PHASE_DO);
 871         }
 872         scsi_req_continue(s->current->req);
 873     }
 874     if (!s->command_complete) {
 875         if (n) {
 876             /* Command did not complete immediately so disconnect.  */
 877             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 878             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 879             /* wait data */
 880             lsi_set_phase(s, PHASE_MI);
 881             s->msg_action = LSI_MSG_ACTION_DISCONNECT;
 882             lsi_queue_command(s);
 883         } else {
 884             /* wait command complete */
 885             lsi_set_phase(s, PHASE_DI);
 886         }
 887     }
 888 }
 889
 890 static void lsi_do_status(LSIState *s)
 891 {
 892     uint8_t status;
 893     trace_lsi_do_status(s->dbc, s->status);
 894     if (s->dbc != 1) {
 895         trace_lsi_do_status_error();
 896     }
 897     s->dbc = 1;
 898     status = s->status;
 899     s->sfbr = status;
 900     pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
 901     lsi_set_phase(s, PHASE_MI);
 902     s->msg_action = LSI_MSG_ACTION_DISCONNECT;
 903     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 904 }
 905
 906 static void lsi_do_msgin(LSIState *s)
 907 {
 908     uint8_t len;
 909     trace_lsi_do_msgin(s->dbc, s->msg_len);
 910     s->sfbr = s->msg[0];
 911     len = s->msg_len;
 912     assert(len > 0 && len <= LSI_MAX_MSGIN_LEN);
 913     if (len > s->dbc)
 914         len = s->dbc;
 915     pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
 916     /* Linux drivers rely on the last byte being in the SIDL.  */
 917     s->sidl = s->msg[len - 1];
 918     s->msg_len -= len;
 919     if (s->msg_len) {
 920         memmove(s->msg, s->msg + len, s->msg_len);
 921     } else {
 922         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 923            switch to PHASE_MO.  */
 924         switch (s->msg_action) {
 925         case LSI_MSG_ACTION_COMMAND:
 926             lsi_set_phase(s, PHASE_CMD);
 927             break;
 928         case LSI_MSG_ACTION_DISCONNECT:
 929             lsi_disconnect(s);
 930             break;
 931         case LSI_MSG_ACTION_DOUT:
 932             lsi_set_phase(s, PHASE_DO);
 933             break;
 934         case LSI_MSG_ACTION_DIN:
 935             lsi_set_phase(s, PHASE_DI);
 936             break;
 937         default:
 938             abort();
 939         }
 940     }
 941 }
 942
 943 /* Read the next byte during a MSGOUT phase.  */
 944 static uint8_t lsi_get_msgbyte(LSIState *s)
 945 {
 946     uint8_t data;
 947     pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
 948     s->dnad++;
 949     s->dbc--;
 950     return data;
 951 }
 952
 953 /* Skip the next n bytes during a MSGOUT phase. */
 954 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
 955 {
 956     s->dnad += n;
 957     s->dbc  -= n;
 958 }
 959
 960 static void lsi_do_msgout(LSIState *s)
 961 {
 962     uint8_t msg;
 963     int len;
 964     uint32_t current_tag;
 965     lsi_request *current_req, *p, *p_next;
 966
 967     if (s->current) {
 968         current_tag = s->current->tag;
 969         current_req = s->current;
 970     } else {
 971         current_tag = s->select_tag;
 972         current_req = lsi_find_by_tag(s, current_tag);
 973     }
 974
 975     trace_lsi_do_msgout(s->dbc);
 976     while (s->dbc) {
 977         msg = lsi_get_msgbyte(s);
 978         s->sfbr = msg;
 979
 980         switch (msg) {
 981         case 0x04:
 982             trace_lsi_do_msgout_disconnect();
 983             lsi_disconnect(s);
 984             break;
 985         case 0x08:
 986             trace_lsi_do_msgout_noop();
 987             lsi_set_phase(s, PHASE_CMD);
 988             break;
 989         case 0x01:
 990             len = lsi_get_msgbyte(s);
 991             msg = lsi_get_msgbyte(s);
 992             (void)len; /* avoid a warning about unused variable*/
 993             trace_lsi_do_msgout_extended(msg, len);
 994             switch (msg) {
 995             case 1:
 996                 trace_lsi_do_msgout_ignored("SDTR");
 997                 lsi_skip_msgbytes(s, 2);
 998                 break;
 999             case 3:
1000                 trace_lsi_do_msgout_ignored("WDTR");
1001                 lsi_skip_msgbytes(s, 1);
1002                 break;
1003             case 4:
1004                 trace_lsi_do_msgout_ignored("PPR");
1005                 lsi_skip_msgbytes(s, 5);
1006                 break;
1007             default:
1008                 goto bad;
1009             }
1010             break;
1011         case 0x20: /* SIMPLE queue */
1012             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1013             trace_lsi_do_msgout_simplequeue(s->select_tag & 0xff);
1014             break;
1015         case 0x21: /* HEAD of queue */
1016             qemu_log_mask(LOG_UNIMP, "lsi_scsi: HEAD queue not implemented\n");
1017             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1018             break;
1019         case 0x22: /* ORDERED queue */
1020             qemu_log_mask(LOG_UNIMP,
1021                           "lsi_scsi: ORDERED queue not implemented\n");
1022             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1023             break;
1024         case 0x0d:
1025             /* The ABORT TAG message clears the current I/O process only. */
1026             trace_lsi_do_msgout_abort(current_tag);
1027             if (current_req) {
1028                 scsi_req_cancel(current_req->req);
1029             }
1030             lsi_disconnect(s);
1031             break;
1032         case 0x06:
1033         case 0x0e:
1034         case 0x0c:
1035             /* The ABORT message clears all I/O processes for the selecting
1036                initiator on the specified logical unit of the target. */
1037             if (msg == 0x06) {
1038                 trace_lsi_do_msgout_abort(current_tag);
1039             }
1040             /* The CLEAR QUEUE message clears all I/O processes for all
1041                initiators on the specified logical unit of the target. */
1042             if (msg == 0x0e) {
1043                 trace_lsi_do_msgout_clearqueue(current_tag);
1044             }
1045             /* The BUS DEVICE RESET message clears all I/O processes for all
1046                initiators on all logical units of the target. */
1047             if (msg == 0x0c) {
1048                 trace_lsi_do_msgout_busdevicereset(current_tag);
1049             }
1050
1051             /* clear the current I/O process */
1052             if (s->current) {
1053                 scsi_req_cancel(s->current->req);
1054             }
1055
1056             /* As the current implemented devices scsi_disk and scsi_generic
1057                only support one LUN, we don't need to keep track of LUNs.
1058                Clearing I/O processes for other initiators could be possible
1059                for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
1060                device, but this is currently not implemented (and seems not
1061                to be really necessary). So let's simply clear all queued
1062                commands for the current device: */
1063             QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
1064                 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
1065                     scsi_req_cancel(p->req);
1066                 }
1067             }
1068
1069             lsi_disconnect(s);
1070             break;
1071         default:
1072             if ((msg & 0x80) == 0) {
1073                 goto bad;
1074             }
1075             s->current_lun = msg & 7;
1076             trace_lsi_do_msgout_select(s->current_lun);
1077             lsi_set_phase(s, PHASE_CMD);
1078             break;
1079         }
1080     }
1081     return;
1082 bad:
1083     qemu_log_mask(LOG_UNIMP, "Unimplemented message 0x%02x\n", msg);
1084     lsi_set_phase(s, PHASE_MI);
1085     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1086     s->msg_action = LSI_MSG_ACTION_COMMAND;
1087 }
1088
1089 #define LSI_BUF_SIZE 4096
1090 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1091 {
1092     int n;
1093     uint8_t buf[LSI_BUF_SIZE];
1094
1095     trace_lsi_memcpy(dest, src, count);
1096     while (count) {
1097         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1098         lsi_mem_read(s, src, buf, n);
1099         lsi_mem_write(s, dest, buf, n);
1100         src += n;
1101         dest += n;
1102         count -= n;
1103     }
1104 }
1105
1106 static void lsi_wait_reselect(LSIState *s)
1107 {
1108     lsi_request *p;
1109
1110     trace_lsi_wait_reselect();
1111
1112     if (s->current) {
1113         return;
1114     }
1115     p = get_pending_req(s);
1116     if (p) {
1117         lsi_reselect(s, p);
1118     }
1119     if (s->current == NULL) {
1120         s->waiting = LSI_WAIT_RESELECT;
1121     }
1122 }
1123
1124 static void lsi_execute_script(LSIState *s)
1125 {
1126     PCIDevice *pci_dev = PCI_DEVICE(s);
1127     uint32_t insn;
1128     uint32_t addr, addr_high;
1129     int opcode;
1130     int insn_processed = 0;
1131
1132     s->istat1 |= LSI_ISTAT1_SRUN;
1133 again:
1134     insn_processed++;
1135     insn = read_dword(s, s->dsp);
1136     if (!insn) {
1137         /* If we receive an empty opcode increment the DSP by 4 bytes
1138            instead of 8 and execute the next opcode at that location */
1139         s->dsp += 4;
1140         goto again;
1141     }
1142     addr = read_dword(s, s->dsp + 4);
1143     addr_high = 0;
1144     trace_lsi_execute_script(s->dsp, insn, addr);
1145     s->dsps = addr;
1146     s->dcmd = insn >> 24;
1147     s->dsp += 8;
1148     switch (insn >> 30) {
1149     case 0: /* Block move.  */
1150         if (s->sist1 & LSI_SIST1_STO) {
1151             trace_lsi_execute_script_blockmove_delayed();
1152             lsi_stop_script(s);
1153             break;
1154         }
1155         s->dbc = insn & 0xffffff;
1156         s->rbc = s->dbc;
1157         /* ??? Set ESA.  */
1158         s->ia = s->dsp - 8;
1159         if (insn & (1 << 29)) {
1160             /* Indirect addressing.  */
1161             addr = read_dword(s, addr);
1162         } else if (insn & (1 << 28)) {
1163             uint32_t buf[2];
1164             int32_t offset;
1165             /* Table indirect addressing.  */
1166
1167             /* 32-bit Table indirect */
1168             offset = sextract32(addr, 0, 24);
1169             pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
1170             /* byte count is stored in bits 0:23 only */
1171             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1172             s->rbc = s->dbc;
1173             addr = cpu_to_le32(buf[1]);
1174
1175             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1176              * table, bits [31:24] */
1177             if (lsi_dma_40bit(s))
1178                 addr_high = cpu_to_le32(buf[0]) >> 24;
1179             else if (lsi_dma_ti64bit(s)) {
1180                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1181                 switch (selector) {
1182                 case 0 ... 0x0f:
1183                     /* offset index into scratch registers since
1184                      * TI64 mode can use registers C to R */
1185                     addr_high = s->scratch[2 + selector];
1186                     break;
1187                 case 0x10:
1188                     addr_high = s->mmrs;
1189                     break;
1190                 case 0x11:
1191                     addr_high = s->mmws;
1192                     break;
1193                 case 0x12:
1194                     addr_high = s->sfs;
1195                     break;
1196                 case 0x13:
1197                     addr_high = s->drs;
1198                     break;
1199                 case 0x14:
1200                     addr_high = s->sbms;
1201                     break;
1202                 case 0x15:
1203                     addr_high = s->dbms;
1204                     break;
1205                 default:
1206                     qemu_log_mask(LOG_GUEST_ERROR,
1207                           "lsi_scsi: Illegal selector specified (0x%x > 0x15) "
1208                           "for 64-bit DMA block move", selector);
1209                     break;
1210                 }
1211             }
1212         } else if (lsi_dma_64bit(s)) {
1213             /* fetch a 3rd dword if 64-bit direct move is enabled and
1214                only if we're not doing table indirect or indirect addressing */
1215             s->dbms = read_dword(s, s->dsp);
1216             s->dsp += 4;
1217             s->ia = s->dsp - 12;
1218         }
1219         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1220             trace_lsi_execute_script_blockmove_badphase(
1221                     scsi_phase_name(s->sstat1),
1222                     scsi_phase_name(insn >> 24));
1223             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1224             break;
1225         }
1226         s->dnad = addr;
1227         s->dnad64 = addr_high;
1228         switch (s->sstat1 & 0x7) {
1229         case PHASE_DO:
1230             s->waiting = LSI_DMA_SCRIPTS;
1231             lsi_do_dma(s, 1);
1232             if (s->waiting)
1233                 s->waiting = LSI_DMA_IN_PROGRESS;
1234             break;
1235         case PHASE_DI:
1236             s->waiting = LSI_DMA_SCRIPTS;
1237             lsi_do_dma(s, 0);
1238             if (s->waiting)
1239                 s->waiting = LSI_DMA_IN_PROGRESS;
1240             break;
1241         case PHASE_CMD:
1242             lsi_do_command(s);
1243             break;
1244         case PHASE_ST:
1245             lsi_do_status(s);
1246             break;
1247         case PHASE_MO:
1248             lsi_do_msgout(s);
1249             break;
1250         case PHASE_MI:
1251             lsi_do_msgin(s);
1252             break;
1253         default:
1254             qemu_log_mask(LOG_UNIMP, "lsi_scsi: Unimplemented phase %s\n",
1255                           scsi_phase_name(s->sstat1));
1256         }
1257         s->dfifo = s->dbc & 0xff;
1258         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1259         s->sbc = s->dbc;
1260         s->rbc -= s->dbc;
1261         s->ua = addr + s->dbc;
1262         break;
1263
1264     case 1: /* IO or Read/Write instruction.  */
1265         opcode = (insn >> 27) & 7;
1266         if (opcode < 5) {
1267             uint32_t id;
1268
1269             if (insn & (1 << 25)) {
1270                 id = read_dword(s, s->dsa + sextract32(insn, 0, 24));
1271             } else {
1272                 id = insn;
1273             }
1274             id = (id >> 16) & 0xf;
1275             if (insn & (1 << 26)) {
1276                 addr = s->dsp + sextract32(addr, 0, 24);
1277             }
1278             s->dnad = addr;
1279             switch (opcode) {
1280             case 0: /* Select */
1281                 s->sdid = id;
1282                 if (s->scntl1 & LSI_SCNTL1_CON) {
1283                     trace_lsi_execute_script_io_alreadyreselected();
1284                     s->dsp = s->dnad;
1285                     break;
1286                 }
1287                 s->sstat0 |= LSI_SSTAT0_WOA;
1288                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1289                 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1290                     lsi_bad_selection(s, id);
1291                     break;
1292                 }
1293                 trace_lsi_execute_script_io_selected(id,
1294                                              insn & (1 << 3) ? " ATN" : "");
1295                 /* ??? Linux drivers compain when this is set.  Maybe
1296                    it only applies in low-level mode (unimplemented).
1297                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1298                 s->select_tag = id << 8;
1299                 s->scntl1 |= LSI_SCNTL1_CON;
1300                 if (insn & (1 << 3)) {
1301                     s->socl |= LSI_SOCL_ATN;
1302                     s->sbcl |= LSI_SBCL_ATN;
1303                 }
1304                 s->sbcl |= LSI_SBCL_BSY;
1305                 lsi_set_phase(s, PHASE_MO);
1306                 s->waiting = LSI_NOWAIT;
1307                 break;
1308             case 1: /* Disconnect */
1309                 trace_lsi_execute_script_io_disconnect();
1310                 s->scntl1 &= ~LSI_SCNTL1_CON;
1311                 /* FIXME: this is not entirely correct; the target need not ask
1312                  * for reselection until it has to send data, while here we force a
1313                  * reselection as soon as the bus is free.  The correct flow would
1314                  * reselect before lsi_transfer_data and disconnect as soon as
1315                  * DMA ends.
1316                  */
1317                 if (!s->current) {
1318                     lsi_request *p = get_pending_req(s);
1319                     if (p) {
1320                         lsi_reselect(s, p);
1321                     }
1322                 }
1323                 break;
1324             case 2: /* Wait Reselect */
1325                 if (s->istat0 & LSI_ISTAT0_SIGP) {
1326                     s->dsp = s->dnad;
1327                 } else if (!lsi_irq_on_rsl(s)) {
1328                         lsi_wait_reselect(s);
1329                 }
1330                 break;
1331             case 3: /* Set */
1332                 trace_lsi_execute_script_io_set(
1333                         insn & (1 << 3) ? " ATN" : "",
1334                         insn & (1 << 6) ? " ACK" : "",
1335                         insn & (1 << 9) ? " TM" : "",
1336                         insn & (1 << 10) ? " CC" : "");
1337                 if (insn & (1 << 3)) {
1338                     s->socl |= LSI_SOCL_ATN;
1339                     s->sbcl |= LSI_SBCL_ATN;
1340                     lsi_set_phase(s, PHASE_MO);
1341                 }
1342
1343                 if (insn & (1 << 6)) {
1344                     s->sbcl |= LSI_SBCL_ACK;
1345                 }
1346
1347                 if (insn & (1 << 9)) {
1348                     qemu_log_mask(LOG_UNIMP,
1349                         "lsi_scsi: Target mode not implemented\n");
1350                 }
1351                 if (insn & (1 << 10))
1352                     s->carry = 1;
1353                 break;
1354             case 4: /* Clear */
1355                 trace_lsi_execute_script_io_clear(
1356                         insn & (1 << 3) ? " ATN" : "",
1357                         insn & (1 << 6) ? " ACK" : "",
1358                         insn & (1 << 9) ? " TM" : "",
1359                         insn & (1 << 10) ? " CC" : "");
1360                 if (insn & (1 << 3)) {
1361                     s->socl &= ~LSI_SOCL_ATN;
1362                     s->sbcl &= ~LSI_SBCL_ATN;
1363                 }
1364
1365                 if (insn & (1 << 6)) {
1366                     s->sbcl &= ~LSI_SBCL_ACK;
1367                 }
1368
1369                 if (insn & (1 << 10))
1370                     s->carry = 0;
1371                 break;
1372             }
1373         } else {
1374             uint8_t op0;
1375             uint8_t op1;
1376             uint8_t data8;
1377             int reg;
1378             int operator;
1379
1380             static const char *opcode_names[3] =
1381                 {"Write", "Read", "Read-Modify-Write"};
1382             static const char *operator_names[8] =
1383                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1384
1385             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1386             data8 = (insn >> 8) & 0xff;
1387             opcode = (insn >> 27) & 7;
1388             operator = (insn >> 24) & 7;
1389             trace_lsi_execute_script_io_opcode(
1390                     opcode_names[opcode - 5], reg,
1391                     operator_names[operator], data8, s->sfbr,
1392                     (insn & (1 << 23)) ? " SFBR" : "");
1393             op0 = op1 = 0;
1394             switch (opcode) {
1395             case 5: /* From SFBR */
1396                 op0 = s->sfbr;
1397                 op1 = data8;
1398                 break;
1399             case 6: /* To SFBR */
1400                 if (operator)
1401                     op0 = lsi_reg_readb(s, reg);
1402                 op1 = data8;
1403                 break;
1404             case 7: /* Read-modify-write */
1405                 if (operator)
1406                     op0 = lsi_reg_readb(s, reg);
1407                 if (insn & (1 << 23)) {
1408                     op1 = s->sfbr;
1409                 } else {
1410                     op1 = data8;
1411                 }
1412                 break;
1413             }
1414
1415             switch (operator) {
1416             case 0: /* move */
1417                 op0 = op1;
1418                 break;
1419             case 1: /* Shift left */
1420                 op1 = op0 >> 7;
1421                 op0 = (op0 << 1) | s->carry;
1422                 s->carry = op1;
1423                 break;
1424             case 2: /* OR */
1425                 op0 |= op1;
1426                 break;
1427             case 3: /* XOR */
1428                 op0 ^= op1;
1429                 break;
1430             case 4: /* AND */
1431                 op0 &= op1;
1432                 break;
1433             case 5: /* SHR */
1434                 op1 = op0 & 1;
1435                 op0 = (op0 >> 1) | (s->carry << 7);
1436                 s->carry = op1;
1437                 break;
1438             case 6: /* ADD */
1439                 op0 += op1;
1440                 s->carry = op0 < op1;
1441                 break;
1442             case 7: /* ADC */
1443                 op0 += op1 + s->carry;
1444                 if (s->carry)
1445                     s->carry = op0 <= op1;
1446                 else
1447                     s->carry = op0 < op1;
1448                 break;
1449             }
1450
1451             switch (opcode) {
1452             case 5: /* From SFBR */
1453             case 7: /* Read-modify-write */
1454                 lsi_reg_writeb(s, reg, op0);
1455                 break;
1456             case 6: /* To SFBR */
1457                 s->sfbr = op0;
1458                 break;
1459             }
1460         }
1461         break;
1462
1463     case 2: /* Transfer Control.  */
1464         {
1465             int cond;
1466             int jmp;
1467
1468             if ((insn & 0x002e0000) == 0) {
1469                 trace_lsi_execute_script_tc_nop();
1470                 break;
1471             }
1472             if (s->sist1 & LSI_SIST1_STO) {
1473                 trace_lsi_execute_script_tc_delayedselect_timeout();
1474                 lsi_stop_script(s);
1475                 break;
1476             }
1477             cond = jmp = (insn & (1 << 19)) != 0;
1478             if (cond == jmp && (insn & (1 << 21))) {
1479                 trace_lsi_execute_script_tc_compc(s->carry == jmp);
1480                 cond = s->carry != 0;
1481             }
1482             if (cond == jmp && (insn & (1 << 17))) {
1483                 trace_lsi_execute_script_tc_compp(scsi_phase_name(s->sstat1),
1484                         jmp ? '=' : '!', scsi_phase_name(insn >> 24));
1485                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1486             }
1487             if (cond == jmp && (insn & (1 << 18))) {
1488                 uint8_t mask;
1489
1490                 mask = (~insn >> 8) & 0xff;
1491                 trace_lsi_execute_script_tc_compd(
1492                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1493                 cond = (s->sfbr & mask) == (insn & mask);
1494             }
1495             if (cond == jmp) {
1496                 if (insn & (1 << 23)) {
1497                     /* Relative address.  */
1498                     addr = s->dsp + sextract32(addr, 0, 24);
1499                 }
1500                 switch ((insn >> 27) & 7) {
1501                 case 0: /* Jump */
1502                     trace_lsi_execute_script_tc_jump(addr);
1503                     s->adder = addr;
1504                     s->dsp = addr;
1505                     break;
1506                 case 1: /* Call */
1507                     trace_lsi_execute_script_tc_call(addr);
1508                     s->temp = s->dsp;
1509                     s->dsp = addr;
1510                     break;
1511                 case 2: /* Return */
1512                     trace_lsi_execute_script_tc_return(s->temp);
1513                     s->dsp = s->temp;
1514                     break;
1515                 case 3: /* Interrupt */
1516                     trace_lsi_execute_script_tc_interrupt(s->dsps);
1517                     if ((insn & (1 << 20)) != 0) {
1518                         s->istat0 |= LSI_ISTAT0_INTF;
1519                         lsi_update_irq(s);
1520                     } else {
1521                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1522                     }
1523                     break;
1524                 default:
1525                     trace_lsi_execute_script_tc_illegal();
1526                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1527                     break;
1528                 }
1529             } else {
1530                 trace_lsi_execute_script_tc_cc_failed();
1531             }
1532         }
1533         break;
1534
1535     case 3:
1536         if ((insn & (1 << 29)) == 0) {
1537             /* Memory move.  */
1538             uint32_t dest;
1539             /* ??? The docs imply the destination address is loaded into
1540                the TEMP register.  However the Linux drivers rely on
1541                the value being presrved.  */
1542             dest = read_dword(s, s->dsp);
1543             s->dsp += 4;
1544             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1545         } else {
1546             uint8_t data[7];
1547             int reg;
1548             int n;
1549             int i;
1550
1551             if (insn & (1 << 28)) {
1552                 addr = s->dsa + sextract32(addr, 0, 24);
1553             }
1554             n = (insn & 7);
1555             reg = (insn >> 16) & 0xff;
1556             if (insn & (1 << 24)) {
1557                 pci_dma_read(pci_dev, addr, data, n);
1558                 trace_lsi_execute_script_mm_load(reg, n, addr, *(int *)data);
1559                 for (i = 0; i < n; i++) {
1560                     lsi_reg_writeb(s, reg + i, data[i]);
1561                 }
1562             } else {
1563                 trace_lsi_execute_script_mm_store(reg, n, addr);
1564                 for (i = 0; i < n; i++) {
1565                     data[i] = lsi_reg_readb(s, reg + i);
1566                 }
1567                 pci_dma_write(pci_dev, addr, data, n);
1568             }
1569         }
1570     }
1571     if (insn_processed > 10000 && s->waiting == LSI_NOWAIT) {
1572         /* Some windows drivers make the device spin waiting for a memory
1573            location to change.  If we have been executed a lot of code then
1574            assume this is the case and force an unexpected device disconnect.
1575            This is apparently sufficient to beat the drivers into submission.
1576          */
1577         if (!(s->sien0 & LSI_SIST0_UDC)) {
1578             qemu_log_mask(LOG_GUEST_ERROR,
1579                           "lsi_scsi: inf. loop with UDC masked");
1580         }
1581         lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
1582         lsi_disconnect(s);
1583     } else if (s->istat1 & LSI_ISTAT1_SRUN && s->waiting == LSI_NOWAIT) {
1584         if (s->dcntl & LSI_DCNTL_SSM) {
1585             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1586         } else {
1587             goto again;
1588         }
1589     }
1590     trace_lsi_execute_script_stop();
1591 }
1592
1593 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1594 {
1595     uint8_t ret;
1596
1597 #define CASE_GET_REG24(name, addr) \
1598     case addr: ret = s->name & 0xff; break; \
1599     case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1600     case addr + 2: ret = (s->name >> 16) & 0xff; break;
1601
1602 #define CASE_GET_REG32(name, addr) \
1603     case addr: ret = s->name & 0xff; break; \
1604     case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1605     case addr + 2: ret = (s->name >> 16) & 0xff; break; \
1606     case addr + 3: ret = (s->name >> 24) & 0xff; break;
1607
1608     switch (offset) {
1609     case 0x00: /* SCNTL0 */
1610         ret = s->scntl0;
1611         break;
1612     case 0x01: /* SCNTL1 */
1613         ret = s->scntl1;
1614         break;
1615     case 0x02: /* SCNTL2 */
1616         ret = s->scntl2;
1617         break;
1618     case 0x03: /* SCNTL3 */
1619         ret = s->scntl3;
1620         break;
1621     case 0x04: /* SCID */
1622         ret = s->scid;
1623         break;
1624     case 0x05: /* SXFER */
1625         ret = s->sxfer;
1626         break;
1627     case 0x06: /* SDID */
1628         ret = s->sdid;
1629         break;
1630     case 0x07: /* GPREG0 */
1631         ret = 0x7f;
1632         break;
1633     case 0x08: /* Revision ID */
1634         ret = 0x00;
1635         break;
1636     case 0x09: /* SOCL */
1637         ret = s->socl;
1638         break;
1639     case 0xa: /* SSID */
1640         ret = s->ssid;
1641         break;
1642     case 0xb: /* SBCL */
1643         ret = s->sbcl;
1644         break;
1645     case 0xc: /* DSTAT */
1646         ret = s->dstat | LSI_DSTAT_DFE;
1647         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1648             s->dstat = 0;
1649         lsi_update_irq(s);
1650         break;
1651     case 0x0d: /* SSTAT0 */
1652         ret = s->sstat0;
1653         break;
1654     case 0x0e: /* SSTAT1 */
1655         ret = s->sstat1;
1656         break;
1657     case 0x0f: /* SSTAT2 */
1658         ret = s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1659         break;
1660     CASE_GET_REG32(dsa, 0x10)
1661     case 0x14: /* ISTAT0 */
1662         ret = s->istat0;
1663         break;
1664     case 0x15: /* ISTAT1 */
1665         ret = s->istat1;
1666         break;
1667     case 0x16: /* MBOX0 */
1668         ret = s->mbox0;
1669         break;
1670     case 0x17: /* MBOX1 */
1671         ret = s->mbox1;
1672         break;
1673     case 0x18: /* CTEST0 */
1674         ret = 0xff;
1675         break;
1676     case 0x19: /* CTEST1 */
1677         ret = 0;
1678         break;
1679     case 0x1a: /* CTEST2 */
1680         ret = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1681         if (s->istat0 & LSI_ISTAT0_SIGP) {
1682             s->istat0 &= ~LSI_ISTAT0_SIGP;
1683             ret |= LSI_CTEST2_SIGP;
1684         }
1685         break;
1686     case 0x1b: /* CTEST3 */
1687         ret = s->ctest3;
1688         break;
1689     CASE_GET_REG32(temp, 0x1c)
1690     case 0x20: /* DFIFO */
1691         ret = s->dfifo;
1692         break;
1693     case 0x21: /* CTEST4 */
1694         ret = s->ctest4;
1695         break;
1696     case 0x22: /* CTEST5 */
1697         ret = s->ctest5;
1698         break;
1699     case 0x23: /* CTEST6 */
1700         ret = 0;
1701         break;
1702     CASE_GET_REG24(dbc, 0x24)
1703     case 0x27: /* DCMD */
1704         ret = s->dcmd;
1705         break;
1706     CASE_GET_REG32(dnad, 0x28)
1707     CASE_GET_REG32(dsp, 0x2c)
1708     CASE_GET_REG32(dsps, 0x30)
1709     CASE_GET_REG32(scratch[0], 0x34)
1710     case 0x38: /* DMODE */
1711         ret = s->dmode;
1712         break;
1713     case 0x39: /* DIEN */
1714         ret = s->dien;
1715         break;
1716     case 0x3a: /* SBR */
1717         ret = s->sbr;
1718         break;
1719     case 0x3b: /* DCNTL */
1720         ret = s->dcntl;
1721         break;
1722     /* ADDER Output (Debug of relative jump address) */
1723     CASE_GET_REG32(adder, 0x3c)
1724     case 0x40: /* SIEN0 */
1725         ret = s->sien0;
1726         break;
1727     case 0x41: /* SIEN1 */
1728         ret = s->sien1;
1729         break;
1730     case 0x42: /* SIST0 */
1731         ret = s->sist0;
1732         s->sist0 = 0;
1733         lsi_update_irq(s);
1734         break;
1735     case 0x43: /* SIST1 */
1736         ret = s->sist1;
1737         s->sist1 = 0;
1738         lsi_update_irq(s);
1739         break;
1740     case 0x46: /* MACNTL */
1741         ret = 0x0f;
1742         break;
1743     case 0x47: /* GPCNTL0 */
1744         ret = 0x0f;
1745         break;
1746     case 0x48: /* STIME0 */
1747         ret = s->stime0;
1748         break;
1749     case 0x4a: /* RESPID0 */
1750         ret = s->respid0;
1751         break;
1752     case 0x4b: /* RESPID1 */
1753         ret = s->respid1;
1754         break;
1755     case 0x4d: /* STEST1 */
1756         ret = s->stest1;
1757         break;
1758     case 0x4e: /* STEST2 */
1759         ret = s->stest2;
1760         break;
1761     case 0x4f: /* STEST3 */
1762         ret = s->stest3;
1763         break;
1764     case 0x50: /* SIDL */
1765         /* This is needed by the linux drivers.  We currently only update it
1766            during the MSG IN phase.  */
1767         ret = s->sidl;
1768         break;
1769     case 0x52: /* STEST4 */
1770         ret = 0xe0;
1771         break;
1772     case 0x56: /* CCNTL0 */
1773         ret = s->ccntl0;
1774         break;
1775     case 0x57: /* CCNTL1 */
1776         ret = s->ccntl1;
1777         break;
1778     case 0x58: /* SBDL */
1779         /* Some drivers peek at the data bus during the MSG IN phase.  */
1780         if ((s->sstat1 & PHASE_MASK) == PHASE_MI) {
1781             assert(s->msg_len > 0);
1782             return s->msg[0];
1783         }
1784         ret = 0;
1785         break;
1786     case 0x59: /* SBDL high */
1787         ret = 0;
1788         break;
1789     CASE_GET_REG32(mmrs, 0xa0)
1790     CASE_GET_REG32(mmws, 0xa4)
1791     CASE_GET_REG32(sfs, 0xa8)
1792     CASE_GET_REG32(drs, 0xac)
1793     CASE_GET_REG32(sbms, 0xb0)
1794     CASE_GET_REG32(dbms, 0xb4)
1795     CASE_GET_REG32(dnad64, 0xb8)
1796     CASE_GET_REG32(pmjad1, 0xc0)
1797     CASE_GET_REG32(pmjad2, 0xc4)
1798     CASE_GET_REG32(rbc, 0xc8)
1799     CASE_GET_REG32(ua, 0xcc)
1800     CASE_GET_REG32(ia, 0xd4)
1801     CASE_GET_REG32(sbc, 0xd8)
1802     CASE_GET_REG32(csbc, 0xdc)
1803     case 0x5c ... 0x9f:
1804     {
1805         int n;
1806         int shift;
1807         n = (offset - 0x58) >> 2;
1808         shift = (offset & 3) * 8;
1809         ret = (s->scratch[n] >> shift) & 0xff;
1810         break;
1811     }
1812     default:
1813     {
1814         qemu_log_mask(LOG_GUEST_ERROR,
1815                       "lsi_scsi: invalid read from reg %s %x\n",
1816                       offset < ARRAY_SIZE(names) ? names[offset] : "???",
1817                       offset);
1818         ret = 0xff;
1819         break;
1820     }
1821     }
1822 #undef CASE_GET_REG24
1823 #undef CASE_GET_REG32
1824
1825     trace_lsi_reg_read(offset < ARRAY_SIZE(names) ? names[offset] : "???",
1826                        offset, ret);
1827
1828     return ret;
1829 }
1830
1831 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1832 {
1833 #define CASE_SET_REG24(name, addr) \
1834     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1835     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1836     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1837
1838 #define CASE_SET_REG32(name, addr) \
1839     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1840     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1841     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1842     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1843
1844     trace_lsi_reg_write(offset < ARRAY_SIZE(names) ? names[offset] : "???",
1845                         offset, val);
1846
1847     switch (offset) {
1848     case 0x00: /* SCNTL0 */
1849         s->scntl0 = val;
1850         if (val & LSI_SCNTL0_START) {
1851             qemu_log_mask(LOG_UNIMP,
1852                           "lsi_scsi: Start sequence not implemented\n");
1853         }
1854         break;
1855     case 0x01: /* SCNTL1 */
1856         s->scntl1 = val & ~LSI_SCNTL1_SST;
1857         if (val & LSI_SCNTL1_IARB) {
1858             qemu_log_mask(LOG_UNIMP,
1859                       "lsi_scsi: Immediate Arbritration not implemented\n");
1860         }
1861         if (val & LSI_SCNTL1_RST) {
1862             if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1863                 qbus_reset_all(&s->bus.qbus);
1864                 s->sstat0 |= LSI_SSTAT0_RST;
1865                 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1866             }
1867         } else {
1868             s->sstat0 &= ~LSI_SSTAT0_RST;
1869         }
1870         break;
1871     case 0x02: /* SCNTL2 */
1872         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1873         s->scntl2 = val;
1874         break;
1875     case 0x03: /* SCNTL3 */
1876         s->scntl3 = val;
1877         break;
1878     case 0x04: /* SCID */
1879         s->scid = val;
1880         break;
1881     case 0x05: /* SXFER */
1882         s->sxfer = val;
1883         break;
1884     case 0x06: /* SDID */
1885         if ((s->ssid & 0x80) && (val & 0xf) != (s->ssid & 0xf)) {
1886             qemu_log_mask(LOG_GUEST_ERROR,
1887                           "lsi_scsi: Destination ID does not match SSID\n");
1888         }
1889         s->sdid = val & 0xf;
1890         break;
1891     case 0x07: /* GPREG0 */
1892         break;
1893     case 0x08: /* SFBR */
1894         /* The CPU is not allowed to write to this register.  However the
1895            SCRIPTS register move instructions are.  */
1896         s->sfbr = val;
1897         break;
1898     case 0x0a: case 0x0b:
1899         /* Openserver writes to these readonly registers on startup */
1900         return;
1901     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1902         /* Linux writes to these readonly registers on startup.  */
1903         return;
1904     CASE_SET_REG32(dsa, 0x10)
1905     case 0x14: /* ISTAT0 */
1906         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1907         if (val & LSI_ISTAT0_ABRT) {
1908             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1909         }
1910         if (val & LSI_ISTAT0_INTF) {
1911             s->istat0 &= ~LSI_ISTAT0_INTF;
1912             lsi_update_irq(s);
1913         }
1914         if (s->waiting == LSI_WAIT_RESELECT && val & LSI_ISTAT0_SIGP) {
1915             trace_lsi_awoken();
1916             s->waiting = LSI_NOWAIT;
1917             s->dsp = s->dnad;
1918             lsi_execute_script(s);
1919         }
1920         if (val & LSI_ISTAT0_SRST) {
1921             qdev_reset_all(DEVICE(s));
1922         }
1923         break;
1924     case 0x16: /* MBOX0 */
1925         s->mbox0 = val;
1926         break;
1927     case 0x17: /* MBOX1 */
1928         s->mbox1 = val;
1929         break;
1930     case 0x18: /* CTEST0 */
1931         /* nothing to do */
1932         break;
1933     case 0x1a: /* CTEST2 */
1934         s->ctest2 = val & LSI_CTEST2_PCICIE;
1935         break;
1936     case 0x1b: /* CTEST3 */
1937         s->ctest3 = val & 0x0f;
1938         break;
1939     CASE_SET_REG32(temp, 0x1c)
1940     case 0x21: /* CTEST4 */
1941         if (val & 7) {
1942             qemu_log_mask(LOG_UNIMP,
1943                           "lsi_scsi: Unimplemented CTEST4-FBL 0x%x\n", val);
1944         }
1945         s->ctest4 = val;
1946         break;
1947     case 0x22: /* CTEST5 */
1948         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1949             qemu_log_mask(LOG_UNIMP,
1950                           "lsi_scsi: CTEST5 DMA increment not implemented\n");
1951         }
1952         s->ctest5 = val;
1953         break;
1954     CASE_SET_REG24(dbc, 0x24)
1955     CASE_SET_REG32(dnad, 0x28)
1956     case 0x2c: /* DSP[0:7] */
1957         s->dsp &= 0xffffff00;
1958         s->dsp |= val;
1959         break;
1960     case 0x2d: /* DSP[8:15] */
1961         s->dsp &= 0xffff00ff;
1962         s->dsp |= val << 8;
1963         break;
1964     case 0x2e: /* DSP[16:23] */
1965         s->dsp &= 0xff00ffff;
1966         s->dsp |= val << 16;
1967         break;
1968     case 0x2f: /* DSP[24:31] */
1969         s->dsp &= 0x00ffffff;
1970         s->dsp |= val << 24;
1971         if ((s->dmode & LSI_DMODE_MAN) == 0
1972             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1973             lsi_execute_script(s);
1974         break;
1975     CASE_SET_REG32(dsps, 0x30)
1976     CASE_SET_REG32(scratch[0], 0x34)
1977     case 0x38: /* DMODE */
1978         s->dmode = val;
1979         break;
1980     case 0x39: /* DIEN */
1981         s->dien = val;
1982         lsi_update_irq(s);
1983         break;
1984     case 0x3a: /* SBR */
1985         s->sbr = val;
1986         break;
1987     case 0x3b: /* DCNTL */
1988         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
1989         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
1990             lsi_execute_script(s);
1991         break;
1992     case 0x40: /* SIEN0 */
1993         s->sien0 = val;
1994         lsi_update_irq(s);
1995         break;
1996     case 0x41: /* SIEN1 */
1997         s->sien1 = val;
1998         lsi_update_irq(s);
1999         break;
2000     case 0x47: /* GPCNTL0 */
2001         break;
2002     case 0x48: /* STIME0 */
2003         s->stime0 = val;
2004         break;
2005     case 0x49: /* STIME1 */
2006         if (val & 0xf) {
2007             qemu_log_mask(LOG_UNIMP,
2008                           "lsi_scsi: General purpose timer not implemented\n");
2009             /* ??? Raising the interrupt immediately seems to be sufficient
2010                to keep the FreeBSD driver happy.  */
2011             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
2012         }
2013         break;
2014     case 0x4a: /* RESPID0 */
2015         s->respid0 = val;
2016         break;
2017     case 0x4b: /* RESPID1 */
2018         s->respid1 = val;
2019         break;
2020     case 0x4d: /* STEST1 */
2021         s->stest1 = val;
2022         break;
2023     case 0x4e: /* STEST2 */
2024         if (val & 1) {
2025             qemu_log_mask(LOG_UNIMP,
2026                           "lsi_scsi: Low level mode not implemented\n");
2027         }
2028         s->stest2 = val;
2029         break;
2030     case 0x4f: /* STEST3 */
2031         if (val & 0x41) {
2032             qemu_log_mask(LOG_UNIMP,
2033                           "lsi_scsi: SCSI FIFO test mode not implemented\n");
2034         }
2035         s->stest3 = val;
2036         break;
2037     case 0x56: /* CCNTL0 */
2038         s->ccntl0 = val;
2039         break;
2040     case 0x57: /* CCNTL1 */
2041         s->ccntl1 = val;
2042         break;
2043     CASE_SET_REG32(mmrs, 0xa0)
2044     CASE_SET_REG32(mmws, 0xa4)
2045     CASE_SET_REG32(sfs, 0xa8)
2046     CASE_SET_REG32(drs, 0xac)
2047     CASE_SET_REG32(sbms, 0xb0)
2048     CASE_SET_REG32(dbms, 0xb4)
2049     CASE_SET_REG32(dnad64, 0xb8)
2050     CASE_SET_REG32(pmjad1, 0xc0)
2051     CASE_SET_REG32(pmjad2, 0xc4)
2052     CASE_SET_REG32(rbc, 0xc8)
2053     CASE_SET_REG32(ua, 0xcc)
2054     CASE_SET_REG32(ia, 0xd4)
2055     CASE_SET_REG32(sbc, 0xd8)
2056     CASE_SET_REG32(csbc, 0xdc)
2057     default:
2058         if (offset >= 0x5c && offset < 0xa0) {
2059             int n;
2060             int shift;
2061             n = (offset - 0x58) >> 2;
2062             shift = (offset & 3) * 8;
2063             s->scratch[n] = deposit32(s->scratch[n], shift, 8, val);
2064         } else {
2065             qemu_log_mask(LOG_GUEST_ERROR,
2066                           "lsi_scsi: invalid write to reg %s %x (0x%02x)\n",
2067                           offset < ARRAY_SIZE(names) ? names[offset] : "???",
2068                           offset, val);
2069         }
2070     }
2071 #undef CASE_SET_REG24
2072 #undef CASE_SET_REG32
2073 }
2074
2075 static void lsi_mmio_write(void *opaque, hwaddr addr,
2076                            uint64_t val, unsigned size)
2077 {
2078     LSIState *s = opaque;
2079
2080     lsi_reg_writeb(s, addr & 0xff, val);
2081 }
2082
2083 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr,
2084                               unsigned size)
2085 {
2086     LSIState *s = opaque;
2087     return lsi_reg_readb(s, addr & 0xff);
2088 }
2089
2090 static const MemoryRegionOps lsi_mmio_ops = {
2091     .read = lsi_mmio_read,
2092     .write = lsi_mmio_write,
2093     .endianness = DEVICE_LITTLE_ENDIAN,
2094     .impl = {
2095         .min_access_size = 1,
2096         .max_access_size = 1,
2097     },
2098 };
2099
2100 static void lsi_ram_write(void *opaque, hwaddr addr,
2101                           uint64_t val, unsigned size)
2102 {
2103     LSIState *s = opaque;
2104     stn_le_p(s->script_ram + addr, size, val);
2105 }
2106
2107 static uint64_t lsi_ram_read(void *opaque, hwaddr addr,
2108                              unsigned size)
2109 {
2110     LSIState *s = opaque;
2111     return ldn_le_p(s->script_ram + addr, size);
2112 }
2113
2114 static const MemoryRegionOps lsi_ram_ops = {
2115     .read = lsi_ram_read,
2116     .write = lsi_ram_write,
2117     .endianness = DEVICE_LITTLE_ENDIAN,
2118 };
2119
2120 static uint64_t lsi_io_read(void *opaque, hwaddr addr,
2121                             unsigned size)
2122 {
2123     LSIState *s = opaque;
2124     return lsi_reg_readb(s, addr & 0xff);
2125 }
2126
2127 static void lsi_io_write(void *opaque, hwaddr addr,
2128                          uint64_t val, unsigned size)
2129 {
2130     LSIState *s = opaque;
2131     lsi_reg_writeb(s, addr & 0xff, val);
2132 }
2133
2134 static const MemoryRegionOps lsi_io_ops = {
2135     .read = lsi_io_read,
2136     .write = lsi_io_write,
2137     .endianness = DEVICE_LITTLE_ENDIAN,
2138     .impl = {
2139         .min_access_size = 1,
2140         .max_access_size = 1,
2141     },
2142 };
2143
2144 static void lsi_scsi_reset(DeviceState *dev)
2145 {
2146     LSIState *s = LSI53C895A(dev);
2147
2148     lsi_soft_reset(s);
2149 }
2150
2151 static int lsi_pre_save(void *opaque)
2152 {
2153     LSIState *s = opaque;
2154
2155     if (s->current) {
2156         assert(s->current->dma_buf == NULL);
2157         assert(s->current->dma_len == 0);
2158     }
2159     assert(QTAILQ_EMPTY(&s->queue));
2160
2161     return 0;
2162 }
2163
2164 static int lsi_post_load(void *opaque, int version_id)
2165 {
2166     LSIState *s = opaque;
2167
2168     if (s->msg_len < 0 || s->msg_len > LSI_MAX_MSGIN_LEN) {
2169         return -EINVAL;
2170     }
2171
2172     return 0;
2173 }
2174
2175 static const VMStateDescription vmstate_lsi_scsi = {
2176     .name = "lsiscsi",
2177     .version_id = 1,
2178     .minimum_version_id = 0,
2179     .pre_save = lsi_pre_save,
2180     .post_load = lsi_post_load,
2181     .fields = (VMStateField[]) {
2182         VMSTATE_PCI_DEVICE(parent_obj, LSIState),
2183
2184         VMSTATE_INT32(carry, LSIState),
2185         VMSTATE_INT32(status, LSIState),
2186         VMSTATE_INT32(msg_action, LSIState),
2187         VMSTATE_INT32(msg_len, LSIState),
2188         VMSTATE_BUFFER(msg, LSIState),
2189         VMSTATE_INT32(waiting, LSIState),
2190
2191         VMSTATE_UINT32(dsa, LSIState),
2192         VMSTATE_UINT32(temp, LSIState),
2193         VMSTATE_UINT32(dnad, LSIState),
2194         VMSTATE_UINT32(dbc, LSIState),
2195         VMSTATE_UINT8(istat0, LSIState),
2196         VMSTATE_UINT8(istat1, LSIState),
2197         VMSTATE_UINT8(dcmd, LSIState),
2198         VMSTATE_UINT8(dstat, LSIState),
2199         VMSTATE_UINT8(dien, LSIState),
2200         VMSTATE_UINT8(sist0, LSIState),
2201         VMSTATE_UINT8(sist1, LSIState),
2202         VMSTATE_UINT8(sien0, LSIState),
2203         VMSTATE_UINT8(sien1, LSIState),
2204         VMSTATE_UINT8(mbox0, LSIState),
2205         VMSTATE_UINT8(mbox1, LSIState),
2206         VMSTATE_UINT8(dfifo, LSIState),
2207         VMSTATE_UINT8(ctest2, LSIState),
2208         VMSTATE_UINT8(ctest3, LSIState),
2209         VMSTATE_UINT8(ctest4, LSIState),
2210         VMSTATE_UINT8(ctest5, LSIState),
2211         VMSTATE_UINT8(ccntl0, LSIState),
2212         VMSTATE_UINT8(ccntl1, LSIState),
2213         VMSTATE_UINT32(dsp, LSIState),
2214         VMSTATE_UINT32(dsps, LSIState),
2215         VMSTATE_UINT8(dmode, LSIState),
2216         VMSTATE_UINT8(dcntl, LSIState),
2217         VMSTATE_UINT8(scntl0, LSIState),
2218         VMSTATE_UINT8(scntl1, LSIState),
2219         VMSTATE_UINT8(scntl2, LSIState),
2220         VMSTATE_UINT8(scntl3, LSIState),
2221         VMSTATE_UINT8(sstat0, LSIState),
2222         VMSTATE_UINT8(sstat1, LSIState),
2223         VMSTATE_UINT8(scid, LSIState),
2224         VMSTATE_UINT8(sxfer, LSIState),
2225         VMSTATE_UINT8(socl, LSIState),
2226         VMSTATE_UINT8(sdid, LSIState),
2227         VMSTATE_UINT8(ssid, LSIState),
2228         VMSTATE_UINT8(sfbr, LSIState),
2229         VMSTATE_UINT8(stest1, LSIState),
2230         VMSTATE_UINT8(stest2, LSIState),
2231         VMSTATE_UINT8(stest3, LSIState),
2232         VMSTATE_UINT8(sidl, LSIState),
2233         VMSTATE_UINT8(stime0, LSIState),
2234         VMSTATE_UINT8(respid0, LSIState),
2235         VMSTATE_UINT8(respid1, LSIState),
2236         VMSTATE_UINT8_V(sbcl, LSIState, 1),
2237         VMSTATE_UINT32(mmrs, LSIState),
2238         VMSTATE_UINT32(mmws, LSIState),
2239         VMSTATE_UINT32(sfs, LSIState),
2240         VMSTATE_UINT32(drs, LSIState),
2241         VMSTATE_UINT32(sbms, LSIState),
2242         VMSTATE_UINT32(dbms, LSIState),
2243         VMSTATE_UINT32(dnad64, LSIState),
2244         VMSTATE_UINT32(pmjad1, LSIState),
2245         VMSTATE_UINT32(pmjad2, LSIState),
2246         VMSTATE_UINT32(rbc, LSIState),
2247         VMSTATE_UINT32(ua, LSIState),
2248         VMSTATE_UINT32(ia, LSIState),
2249         VMSTATE_UINT32(sbc, LSIState),
2250         VMSTATE_UINT32(csbc, LSIState),
2251         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2252         VMSTATE_UINT8(sbr, LSIState),
2253
2254         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 8192),
2255         VMSTATE_END_OF_LIST()
2256     }
2257 };
2258
2259 static const struct SCSIBusInfo lsi_scsi_info = {
2260     .tcq = true,
2261     .max_target = LSI_MAX_DEVS,
2262     .max_lun = 0,  /* LUN support is buggy */
2263
2264     .transfer_data = lsi_transfer_data,
2265     .complete = lsi_command_complete,
2266     .cancel = lsi_request_cancelled
2267 };
2268
2269 static void lsi_scsi_realize(PCIDevice *dev, Error **errp)
2270 {
2271     LSIState *s = LSI53C895A(dev);
2272     DeviceState *d = DEVICE(dev);
2273     uint8_t *pci_conf;
2274
2275     pci_conf = dev->config;
2276
2277     /* PCI latency timer = 255 */
2278     pci_conf[PCI_LATENCY_TIMER] = 0xff;
2279     /* Interrupt pin A */
2280     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2281
2282     memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
2283                           "lsi-mmio", 0x400);
2284     memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
2285                           "lsi-ram", 0x2000);
2286     memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
2287                           "lsi-io", 256);
2288
2289     address_space_init(&s->pci_io_as, pci_address_space_io(dev), "lsi-pci-io");
2290     qdev_init_gpio_out(d, &s->ext_irq, 1);
2291
2292     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2293     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio_io);
2294     pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2295     QTAILQ_INIT(&s->queue);
2296
2297     scsi_bus_new(&s->bus, sizeof(s->bus), d, &lsi_scsi_info, NULL);
2298 }
2299
2300 static void lsi_scsi_unrealize(DeviceState *dev, Error **errp)
2301 {
2302     LSIState *s = LSI53C895A(dev);
2303
2304     address_space_destroy(&s->pci_io_as);
2305 }
2306
2307 static void lsi_class_init(ObjectClass *klass, void *data)
2308 {
2309     DeviceClass *dc = DEVICE_CLASS(klass);
2310     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2311
2312     k->realize = lsi_scsi_realize;
2313     k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2314     k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2315     k->class_id = PCI_CLASS_STORAGE_SCSI;
2316     k->subsystem_id = 0x1000;
2317     dc->unrealize = lsi_scsi_unrealize;
2318     dc->reset = lsi_scsi_reset;
2319     dc->vmsd = &vmstate_lsi_scsi;
2320     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2321 }
2322
2323 static const TypeInfo lsi_info = {
2324     .name          = TYPE_LSI53C895A,
2325     .parent        = TYPE_PCI_DEVICE,
2326     .instance_size = sizeof(LSIState),
2327     .class_init    = lsi_class_init,
2328     .interfaces = (InterfaceInfo[]) {
2329         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2330         { },
2331     },
2332 };
2333
2334 static void lsi53c810_class_init(ObjectClass *klass, void *data)
2335 {
2336     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2337
2338     k->device_id = PCI_DEVICE_ID_LSI_53C810;
2339 }
2340
2341 static TypeInfo lsi53c810_info = {
2342     .name          = TYPE_LSI53C810,
2343     .parent        = TYPE_LSI53C895A,
2344     .class_init    = lsi53c810_class_init,
2345 };
2346
2347 static void lsi53c895a_register_types(void)
2348 {
2349     type_register_static(&lsi_info);
2350     type_register_static(&lsi53c810_info);
2351 }
2352
2353 type_init(lsi53c895a_register_types)
2354
2355 void lsi53c8xx_handle_legacy_cmdline(DeviceState *lsi_dev)
2356 {
2357     LSIState *s = LSI53C895A(lsi_dev);
2358
2359     scsi_bus_legacy_handle_cmdline(&s->bus);
2360 }