hw/scsi/lsi53c895a.c

   1 /*
   2  * QEMU LSI53C895A SCSI Host Bus Adapter emulation
   3  *
   4  * Copyright (c) 2006 CodeSourcery.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the LGPL.
   8  */
   9
  10 /* Note:
  11  * LSI53C810 emulation is incorrect, in the sense that it supports
  12  * features added in later evolutions. This should not be a problem,
  13  * as well-behaved operating systems will not try to use them.
  14  */
  15
  16 #include "qemu/osdep.h"
  17
  18 #include "hw/irq.h"
  19 #include "hw/pci/pci_device.h"
  20 #include "hw/scsi/scsi.h"
  21 #include "migration/vmstate.h"
  22 #include "sysemu/dma.h"
  23 #include "qemu/log.h"
  24 #include "qemu/module.h"
  25 #include "trace.h"
  26 #include "qom/object.h"
  27
  28 static const char *names[] = {
  29     "SCNTL0", "SCNTL1", "SCNTL2", "SCNTL3", "SCID", "SXFER", "SDID", "GPREG",
  30     "SFBR", "SOCL", "SSID", "SBCL", "DSTAT", "SSTAT0", "SSTAT1", "SSTAT2",
  31     "DSA0", "DSA1", "DSA2", "DSA3", "ISTAT", "0x15", "0x16", "0x17",
  32     "CTEST0", "CTEST1", "CTEST2", "CTEST3", "TEMP0", "TEMP1", "TEMP2", "TEMP3",
  33     "DFIFO", "CTEST4", "CTEST5", "CTEST6", "DBC0", "DBC1", "DBC2", "DCMD",
  34     "DNAD0", "DNAD1", "DNAD2", "DNAD3", "DSP0", "DSP1", "DSP2", "DSP3",
  35     "DSPS0", "DSPS1", "DSPS2", "DSPS3", "SCRATCHA0", "SCRATCHA1", "SCRATCHA2", "SCRATCHA3",
  36     "DMODE", "DIEN", "SBR", "DCNTL", "ADDER0", "ADDER1", "ADDER2", "ADDER3",
  37     "SIEN0", "SIEN1", "SIST0", "SIST1", "SLPAR", "0x45", "MACNTL", "GPCNTL",
  38     "STIME0", "STIME1", "RESPID", "0x4b", "STEST0", "STEST1", "STEST2", "STEST3",
  39     "SIDL", "0x51", "0x52", "0x53", "SODL", "0x55", "0x56", "0x57",
  40     "SBDL", "0x59", "0x5a", "0x5b", "SCRATCHB0", "SCRATCHB1", "SCRATCHB2", "SCRATCHB3",
  41 };
  42
  43 #define LSI_MAX_DEVS 7
  44
  45 #define LSI_SCNTL0_TRG    0x01
  46 #define LSI_SCNTL0_AAP    0x02
  47 #define LSI_SCNTL0_EPC    0x08
  48 #define LSI_SCNTL0_WATN   0x10
  49 #define LSI_SCNTL0_START  0x20
  50
  51 #define LSI_SCNTL1_SST    0x01
  52 #define LSI_SCNTL1_IARB   0x02
  53 #define LSI_SCNTL1_AESP   0x04
  54 #define LSI_SCNTL1_RST    0x08
  55 #define LSI_SCNTL1_CON    0x10
  56 #define LSI_SCNTL1_DHP    0x20
  57 #define LSI_SCNTL1_ADB    0x40
  58 #define LSI_SCNTL1_EXC    0x80
  59
  60 #define LSI_SCNTL2_WSR    0x01
  61 #define LSI_SCNTL2_VUE0   0x02
  62 #define LSI_SCNTL2_VUE1   0x04
  63 #define LSI_SCNTL2_WSS    0x08
  64 #define LSI_SCNTL2_SLPHBEN 0x10
  65 #define LSI_SCNTL2_SLPMD  0x20
  66 #define LSI_SCNTL2_CHM    0x40
  67 #define LSI_SCNTL2_SDU    0x80
  68
  69 #define LSI_ISTAT0_DIP    0x01
  70 #define LSI_ISTAT0_SIP    0x02
  71 #define LSI_ISTAT0_INTF   0x04
  72 #define LSI_ISTAT0_CON    0x08
  73 #define LSI_ISTAT0_SEM    0x10
  74 #define LSI_ISTAT0_SIGP   0x20
  75 #define LSI_ISTAT0_SRST   0x40
  76 #define LSI_ISTAT0_ABRT   0x80
  77
  78 #define LSI_ISTAT1_SI     0x01
  79 #define LSI_ISTAT1_SRUN   0x02
  80 #define LSI_ISTAT1_FLSH   0x04
  81
  82 #define LSI_SSTAT0_SDP0   0x01
  83 #define LSI_SSTAT0_RST    0x02
  84 #define LSI_SSTAT0_WOA    0x04
  85 #define LSI_SSTAT0_LOA    0x08
  86 #define LSI_SSTAT0_AIP    0x10
  87 #define LSI_SSTAT0_OLF    0x20
  88 #define LSI_SSTAT0_ORF    0x40
  89 #define LSI_SSTAT0_ILF    0x80
  90
  91 #define LSI_SIST0_PAR     0x01
  92 #define LSI_SIST0_RST     0x02
  93 #define LSI_SIST0_UDC     0x04
  94 #define LSI_SIST0_SGE     0x08
  95 #define LSI_SIST0_RSL     0x10
  96 #define LSI_SIST0_SEL     0x20
  97 #define LSI_SIST0_CMP     0x40
  98 #define LSI_SIST0_MA      0x80
  99
 100 #define LSI_SIST1_HTH     0x01
 101 #define LSI_SIST1_GEN     0x02
 102 #define LSI_SIST1_STO     0x04
 103 #define LSI_SIST1_SBMC    0x10
 104
 105 #define LSI_SOCL_IO       0x01
 106 #define LSI_SOCL_CD       0x02
 107 #define LSI_SOCL_MSG      0x04
 108 #define LSI_SOCL_ATN      0x08
 109 #define LSI_SOCL_SEL      0x10
 110 #define LSI_SOCL_BSY      0x20
 111 #define LSI_SOCL_ACK      0x40
 112 #define LSI_SOCL_REQ      0x80
 113
 114 #define LSI_DSTAT_IID     0x01
 115 #define LSI_DSTAT_SIR     0x04
 116 #define LSI_DSTAT_SSI     0x08
 117 #define LSI_DSTAT_ABRT    0x10
 118 #define LSI_DSTAT_BF      0x20
 119 #define LSI_DSTAT_MDPE    0x40
 120 #define LSI_DSTAT_DFE     0x80
 121
 122 #define LSI_DCNTL_COM     0x01
 123 #define LSI_DCNTL_IRQD    0x02
 124 #define LSI_DCNTL_STD     0x04
 125 #define LSI_DCNTL_IRQM    0x08
 126 #define LSI_DCNTL_SSM     0x10
 127 #define LSI_DCNTL_PFEN    0x20
 128 #define LSI_DCNTL_PFF     0x40
 129 #define LSI_DCNTL_CLSE    0x80
 130
 131 #define LSI_DMODE_MAN     0x01
 132 #define LSI_DMODE_BOF     0x02
 133 #define LSI_DMODE_ERMP    0x04
 134 #define LSI_DMODE_ERL     0x08
 135 #define LSI_DMODE_DIOM    0x10
 136 #define LSI_DMODE_SIOM    0x20
 137
 138 #define LSI_CTEST2_DACK   0x01
 139 #define LSI_CTEST2_DREQ   0x02
 140 #define LSI_CTEST2_TEOP   0x04
 141 #define LSI_CTEST2_PCICIE 0x08
 142 #define LSI_CTEST2_CM     0x10
 143 #define LSI_CTEST2_CIO    0x20
 144 #define LSI_CTEST2_SIGP   0x40
 145 #define LSI_CTEST2_DDIR   0x80
 146
 147 #define LSI_CTEST5_BL2    0x04
 148 #define LSI_CTEST5_DDIR   0x08
 149 #define LSI_CTEST5_MASR   0x10
 150 #define LSI_CTEST5_DFSN   0x20
 151 #define LSI_CTEST5_BBCK   0x40
 152 #define LSI_CTEST5_ADCK   0x80
 153
 154 #define LSI_CCNTL0_DILS   0x01
 155 #define LSI_CCNTL0_DISFC  0x10
 156 #define LSI_CCNTL0_ENNDJ  0x20
 157 #define LSI_CCNTL0_PMJCTL 0x40
 158 #define LSI_CCNTL0_ENPMJ  0x80
 159
 160 #define LSI_CCNTL1_EN64DBMV  0x01
 161 #define LSI_CCNTL1_EN64TIBMV 0x02
 162 #define LSI_CCNTL1_64TIMOD   0x04
 163 #define LSI_CCNTL1_DDAC      0x08
 164 #define LSI_CCNTL1_ZMOD      0x80
 165
 166 #define LSI_SBCL_ATN         0x08
 167 #define LSI_SBCL_BSY         0x20
 168 #define LSI_SBCL_ACK         0x40
 169 #define LSI_SBCL_REQ         0x80
 170
 171 /* Enable Response to Reselection */
 172 #define LSI_SCID_RRE      0x60
 173
 174 #define LSI_CCNTL1_40BIT (LSI_CCNTL1_EN64TIBMV|LSI_CCNTL1_64TIMOD)
 175
 176 #define PHASE_DO          0
 177 #define PHASE_DI          1
 178 #define PHASE_CMD         2
 179 #define PHASE_ST          3
 180 #define PHASE_MO          6
 181 #define PHASE_MI          7
 182 #define PHASE_MASK        7
 183
 184 /* Maximum length of MSG IN data.  */
 185 #define LSI_MAX_MSGIN_LEN 8
 186
 187 /* Flag set if this is a tagged command.  */
 188 #define LSI_TAG_VALID     (1 << 16)
 189
 190 /* Maximum instructions to process. */
 191 #define LSI_MAX_INSN    500
 192
 193 typedef struct lsi_request {
 194     SCSIRequest *req;
 195     uint32_t tag;
 196     uint32_t dma_len;
 197     uint8_t *dma_buf;
 198     uint32_t pending;
 199     int out;
 200     QTAILQ_ENTRY(lsi_request) next;
 201 } lsi_request;
 202
 203 enum {
 204     LSI_NOWAIT, /* SCRIPTS are running or stopped */
 205     LSI_WAIT_RESELECT, /* Wait Reselect instruction has been issued */
 206     LSI_DMA_SCRIPTS, /* processing DMA from lsi_execute_script */
 207     LSI_DMA_IN_PROGRESS, /* DMA operation is in progress */
 208     LSI_WAIT_SCRIPTS, /* SCRIPTS stopped because of instruction count limit */
 209 };
 210
 211 enum {
 212     LSI_MSG_ACTION_COMMAND = 0,
 213     LSI_MSG_ACTION_DISCONNECT = 1,
 214     LSI_MSG_ACTION_DOUT = 2,
 215     LSI_MSG_ACTION_DIN = 3,
 216 };
 217
 218 struct LSIState {
 219     /*< private >*/
 220     PCIDevice parent_obj;
 221     /*< public >*/
 222
 223     qemu_irq ext_irq;
 224     MemoryRegion mmio_io;
 225     MemoryRegion ram_io;
 226     MemoryRegion io_io;
 227     AddressSpace pci_io_as;
 228     QEMUTimer *scripts_timer;
 229
 230     int carry; /* ??? Should this be in a visible register somewhere?  */
 231     int status;
 232     int msg_action;
 233     int msg_len;
 234     uint8_t msg[LSI_MAX_MSGIN_LEN];
 235     int waiting;
 236     SCSIBus bus;
 237     int current_lun;
 238     /* The tag is a combination of the device ID and the SCSI tag.  */
 239     uint32_t select_tag;
 240     int command_complete;
 241     QTAILQ_HEAD(, lsi_request) queue;
 242     lsi_request *current;
 243
 244     uint32_t dsa;
 245     uint32_t temp;
 246     uint32_t dnad;
 247     uint32_t dbc;
 248     uint8_t istat0;
 249     uint8_t istat1;
 250     uint8_t dcmd;
 251     uint8_t dstat;
 252     uint8_t dien;
 253     uint8_t sist0;
 254     uint8_t sist1;
 255     uint8_t sien0;
 256     uint8_t sien1;
 257     uint8_t mbox0;
 258     uint8_t mbox1;
 259     uint8_t dfifo;
 260     uint8_t ctest2;
 261     uint8_t ctest3;
 262     uint8_t ctest4;
 263     uint8_t ctest5;
 264     uint8_t ccntl0;
 265     uint8_t ccntl1;
 266     uint32_t dsp;
 267     uint32_t dsps;
 268     uint8_t dmode;
 269     uint8_t dcntl;
 270     uint8_t scntl0;
 271     uint8_t scntl1;
 272     uint8_t scntl2;
 273     uint8_t scntl3;
 274     uint8_t sstat0;
 275     uint8_t sstat1;
 276     uint8_t scid;
 277     uint8_t sxfer;
 278     uint8_t socl;
 279     uint8_t sdid;
 280     uint8_t ssid;
 281     uint8_t sfbr;
 282     uint8_t sbcl;
 283     uint8_t stest1;
 284     uint8_t stest2;
 285     uint8_t stest3;
 286     uint8_t sidl;
 287     uint8_t stime0;
 288     uint8_t respid0;
 289     uint8_t respid1;
 290     uint32_t mmrs;
 291     uint32_t mmws;
 292     uint32_t sfs;
 293     uint32_t drs;
 294     uint32_t sbms;
 295     uint32_t dbms;
 296     uint32_t dnad64;
 297     uint32_t pmjad1;
 298     uint32_t pmjad2;
 299     uint32_t rbc;
 300     uint32_t ua;
 301     uint32_t ia;
 302     uint32_t sbc;
 303     uint32_t csbc;
 304     uint32_t scratch[18]; /* SCRATCHA-SCRATCHR */
 305     uint8_t sbr;
 306     uint32_t adder;
 307
 308     uint8_t script_ram[2048 * sizeof(uint32_t)];
 309 };
 310
 311 #define TYPE_LSI53C810  "lsi53c810"
 312 #define TYPE_LSI53C895A "lsi53c895a"
 313
 314 OBJECT_DECLARE_SIMPLE_TYPE(LSIState, LSI53C895A)
 315
 316 static const char *scsi_phases[] = {
 317     "DOUT",
 318     "DIN",
 319     "CMD",
 320     "STATUS",
 321     "RSVOUT",
 322     "RSVIN",
 323     "MSGOUT",
 324     "MSGIN"
 325 };
 326
 327 static const char *scsi_phase_name(int phase)
 328 {
 329     return scsi_phases[phase & PHASE_MASK];
 330 }
 331
 332 static inline int lsi_irq_on_rsl(LSIState *s)
 333 {
 334     return (s->sien0 & LSI_SIST0_RSL) && (s->scid & LSI_SCID_RRE);
 335 }
 336
 337 static lsi_request *get_pending_req(LSIState *s)
 338 {
 339     lsi_request *p;
 340
 341     QTAILQ_FOREACH(p, &s->queue, next) {
 342         if (p->pending) {
 343             return p;
 344         }
 345     }
 346     return NULL;
 347 }
 348
 349 static void lsi_soft_reset(LSIState *s)
 350 {
 351     trace_lsi_reset();
 352     s->carry = 0;
 353
 354     s->msg_action = LSI_MSG_ACTION_COMMAND;
 355     s->msg_len = 0;
 356     s->waiting = LSI_NOWAIT;
 357     s->dsa = 0;
 358     s->dnad = 0;
 359     s->dbc = 0;
 360     s->temp = 0;
 361     memset(s->scratch, 0, sizeof(s->scratch));
 362     s->istat0 = 0;
 363     s->istat1 = 0;
 364     s->dcmd = 0x40;
 365     s->dstat = 0;
 366     s->dien = 0;
 367     s->sist0 = 0;
 368     s->sist1 = 0;
 369     s->sien0 = 0;
 370     s->sien1 = 0;
 371     s->mbox0 = 0;
 372     s->mbox1 = 0;
 373     s->dfifo = 0;
 374     s->ctest2 = LSI_CTEST2_DACK;
 375     s->ctest3 = 0;
 376     s->ctest4 = 0;
 377     s->ctest5 = 0;
 378     s->ccntl0 = 0;
 379     s->ccntl1 = 0;
 380     s->dsp = 0;
 381     s->dsps = 0;
 382     s->dmode = 0;
 383     s->dcntl = 0;
 384     s->scntl0 = 0xc0;
 385     s->scntl1 = 0;
 386     s->scntl2 = 0;
 387     s->scntl3 = 0;
 388     s->sstat0 = 0;
 389     s->sstat1 = 0;
 390     s->scid = 7;
 391     s->sxfer = 0;
 392     s->socl = 0;
 393     s->sdid = 0;
 394     s->ssid = 0;
 395     s->sbcl = 0;
 396     s->stest1 = 0;
 397     s->stest2 = 0;
 398     s->stest3 = 0;
 399     s->sidl = 0;
 400     s->stime0 = 0;
 401     s->respid0 = 0x80;
 402     s->respid1 = 0;
 403     s->mmrs = 0;
 404     s->mmws = 0;
 405     s->sfs = 0;
 406     s->drs = 0;
 407     s->sbms = 0;
 408     s->dbms = 0;
 409     s->dnad64 = 0;
 410     s->pmjad1 = 0;
 411     s->pmjad2 = 0;
 412     s->rbc = 0;
 413     s->ua = 0;
 414     s->ia = 0;
 415     s->sbc = 0;
 416     s->csbc = 0;
 417     s->sbr = 0;
 418     assert(QTAILQ_EMPTY(&s->queue));
 419     assert(!s->current);
 420     timer_del(s->scripts_timer);
 421 }
 422
 423 static int lsi_dma_40bit(LSIState *s)
 424 {
 425     if ((s->ccntl1 & LSI_CCNTL1_40BIT) == LSI_CCNTL1_40BIT)
 426         return 1;
 427     return 0;
 428 }
 429
 430 static int lsi_dma_ti64bit(LSIState *s)
 431 {
 432     if ((s->ccntl1 & LSI_CCNTL1_EN64TIBMV) == LSI_CCNTL1_EN64TIBMV)
 433         return 1;
 434     return 0;
 435 }
 436
 437 static int lsi_dma_64bit(LSIState *s)
 438 {
 439     if ((s->ccntl1 & LSI_CCNTL1_EN64DBMV) == LSI_CCNTL1_EN64DBMV)
 440         return 1;
 441     return 0;
 442 }
 443
 444 static uint8_t lsi_reg_readb(LSIState *s, int offset);
 445 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val);
 446 static void lsi_execute_script(LSIState *s);
 447 static void lsi_reselect(LSIState *s, lsi_request *p);
 448
 449 static inline void lsi_mem_read(LSIState *s, dma_addr_t addr,
 450                                void *buf, dma_addr_t len)
 451 {
 452     if (s->dmode & LSI_DMODE_SIOM) {
 453         address_space_read(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
 454                            buf, len);
 455     } else {
 456         pci_dma_read(PCI_DEVICE(s), addr, buf, len);
 457     }
 458 }
 459
 460 static inline void lsi_mem_write(LSIState *s, dma_addr_t addr,
 461                                 const void *buf, dma_addr_t len)
 462 {
 463     if (s->dmode & LSI_DMODE_DIOM) {
 464         address_space_write(&s->pci_io_as, addr, MEMTXATTRS_UNSPECIFIED,
 465                             buf, len);
 466     } else {
 467         pci_dma_write(PCI_DEVICE(s), addr, buf, len);
 468     }
 469 }
 470
 471 static inline uint32_t read_dword(LSIState *s, uint32_t addr)
 472 {
 473     uint32_t buf;
 474
 475     pci_dma_read(PCI_DEVICE(s), addr, &buf, 4);
 476     return cpu_to_le32(buf);
 477 }
 478
 479 static void lsi_stop_script(LSIState *s)
 480 {
 481     s->istat1 &= ~LSI_ISTAT1_SRUN;
 482 }
 483
 484 static void lsi_set_irq(LSIState *s, int level)
 485 {
 486     PCIDevice *d = PCI_DEVICE(s);
 487
 488     if (s->ext_irq) {
 489         qemu_set_irq(s->ext_irq, level);
 490     } else {
 491         pci_set_irq(d, level);
 492     }
 493 }
 494
 495 static void lsi_update_irq(LSIState *s)
 496 {
 497     int level;
 498     static int last_level;
 499
 500     /* It's unclear whether the DIP/SIP bits should be cleared when the
 501        Interrupt Status Registers are cleared or when istat0 is read.
 502        We currently do the formwer, which seems to work.  */
 503     level = 0;
 504     if (s->dstat) {
 505         if (s->dstat & s->dien)
 506             level = 1;
 507         s->istat0 |= LSI_ISTAT0_DIP;
 508     } else {
 509         s->istat0 &= ~LSI_ISTAT0_DIP;
 510     }
 511
 512     if (s->sist0 || s->sist1) {
 513         if ((s->sist0 & s->sien0) || (s->sist1 & s->sien1))
 514             level = 1;
 515         s->istat0 |= LSI_ISTAT0_SIP;
 516     } else {
 517         s->istat0 &= ~LSI_ISTAT0_SIP;
 518     }
 519     if (s->istat0 & LSI_ISTAT0_INTF)
 520         level = 1;
 521
 522     if (level != last_level) {
 523         trace_lsi_update_irq(level, s->dstat, s->sist1, s->sist0);
 524         last_level = level;
 525     }
 526     lsi_set_irq(s, level);
 527
 528     if (!s->current && !level && lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON)) {
 529         lsi_request *p;
 530
 531         trace_lsi_update_irq_disconnected();
 532         p = get_pending_req(s);
 533         if (p) {
 534             lsi_reselect(s, p);
 535         }
 536     }
 537 }
 538
 539 /* Stop SCRIPTS execution and raise a SCSI interrupt.  */
 540 static void lsi_script_scsi_interrupt(LSIState *s, int stat0, int stat1)
 541 {
 542     uint32_t mask0;
 543     uint32_t mask1;
 544
 545     trace_lsi_script_scsi_interrupt(stat1, stat0, s->sist1, s->sist0);
 546     s->sist0 |= stat0;
 547     s->sist1 |= stat1;
 548     /* Stop processor on fatal or unmasked interrupt.  As a special hack
 549        we don't stop processing when raising STO.  Instead continue
 550        execution and stop at the next insn that accesses the SCSI bus.  */
 551     mask0 = s->sien0 | ~(LSI_SIST0_CMP | LSI_SIST0_SEL | LSI_SIST0_RSL);
 552     mask1 = s->sien1 | ~(LSI_SIST1_GEN | LSI_SIST1_HTH);
 553     mask1 &= ~LSI_SIST1_STO;
 554     if (s->sist0 & mask0 || s->sist1 & mask1) {
 555         lsi_stop_script(s);
 556     }
 557     lsi_update_irq(s);
 558 }
 559
 560 /* Stop SCRIPTS execution and raise a DMA interrupt.  */
 561 static void lsi_script_dma_interrupt(LSIState *s, int stat)
 562 {
 563     trace_lsi_script_dma_interrupt(stat, s->dstat);
 564     s->dstat |= stat;
 565     lsi_update_irq(s);
 566     lsi_stop_script(s);
 567 }
 568
 569 static inline void lsi_set_phase(LSIState *s, int phase)
 570 {
 571     s->sbcl &= ~PHASE_MASK;
 572     s->sbcl |= phase | LSI_SBCL_REQ;
 573     s->sstat1 = (s->sstat1 & ~PHASE_MASK) | phase;
 574 }
 575
 576 static int lsi_bad_phase(LSIState *s, int out, int new_phase)
 577 {
 578     int ret = 0;
 579     /* Trigger a phase mismatch.  */
 580     if (s->ccntl0 & LSI_CCNTL0_ENPMJ) {
 581         if ((s->ccntl0 & LSI_CCNTL0_PMJCTL)) {
 582             s->dsp = out ? s->pmjad1 : s->pmjad2;
 583         } else {
 584             s->dsp = (s->scntl2 & LSI_SCNTL2_WSR ? s->pmjad2 : s->pmjad1);
 585         }
 586         trace_lsi_bad_phase_jump(s->dsp);
 587     } else {
 588         trace_lsi_bad_phase_interrupt();
 589         lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
 590         lsi_stop_script(s);
 591         ret = 1;
 592     }
 593     lsi_set_phase(s, new_phase);
 594     return ret;
 595 }
 596
 597
 598 /* Resume SCRIPTS execution after a DMA operation.  */
 599 static void lsi_resume_script(LSIState *s)
 600 {
 601     if (s->waiting != 2) {
 602         s->waiting = LSI_NOWAIT;
 603         lsi_execute_script(s);
 604     } else {
 605         s->waiting = LSI_NOWAIT;
 606     }
 607 }
 608
 609 static void lsi_disconnect(LSIState *s)
 610 {
 611     s->scntl1 &= ~LSI_SCNTL1_CON;
 612     s->sstat1 &= ~PHASE_MASK;
 613     s->sbcl = 0;
 614 }
 615
 616 static void lsi_bad_selection(LSIState *s, uint32_t id)
 617 {
 618     trace_lsi_bad_selection(id);
 619     lsi_script_scsi_interrupt(s, 0, LSI_SIST1_STO);
 620     lsi_disconnect(s);
 621 }
 622
 623 /* Initiate a SCSI layer data transfer.  */
 624 static void lsi_do_dma(LSIState *s, int out)
 625 {
 626     uint32_t count;
 627     dma_addr_t addr;
 628     SCSIDevice *dev;
 629
 630     if (!s->current || !s->current->dma_len) {
 631         /* Wait until data is available.  */
 632         trace_lsi_do_dma_unavailable();
 633         return;
 634     }
 635
 636     dev = s->current->req->dev;
 637     assert(dev);
 638
 639     count = s->dbc;
 640     if (count > s->current->dma_len)
 641         count = s->current->dma_len;
 642
 643     addr = s->dnad;
 644     /* both 40 and Table Indirect 64-bit DMAs store upper bits in dnad64 */
 645     if (lsi_dma_40bit(s) || lsi_dma_ti64bit(s))
 646         addr |= ((uint64_t)s->dnad64 << 32);
 647     else if (s->dbms)
 648         addr |= ((uint64_t)s->dbms << 32);
 649     else if (s->sbms)
 650         addr |= ((uint64_t)s->sbms << 32);
 651
 652     trace_lsi_do_dma(addr, count);
 653     s->csbc += count;
 654     s->dnad += count;
 655     s->dbc -= count;
 656      if (s->current->dma_buf == NULL) {
 657         s->current->dma_buf = scsi_req_get_buf(s->current->req);
 658     }
 659     /* ??? Set SFBR to first data byte.  */
 660     if (out) {
 661         lsi_mem_read(s, addr, s->current->dma_buf, count);
 662     } else {
 663         lsi_mem_write(s, addr, s->current->dma_buf, count);
 664     }
 665     s->current->dma_len -= count;
 666     if (s->current->dma_len == 0) {
 667         s->current->dma_buf = NULL;
 668         scsi_req_continue(s->current->req);
 669     } else {
 670         s->current->dma_buf += count;
 671         lsi_resume_script(s);
 672     }
 673 }
 674
 675
 676 /* Add a command to the queue.  */
 677 static void lsi_queue_command(LSIState *s)
 678 {
 679     lsi_request *p = s->current;
 680
 681     trace_lsi_queue_command(p->tag);
 682     assert(s->current != NULL);
 683     assert(s->current->dma_len == 0);
 684     QTAILQ_INSERT_TAIL(&s->queue, s->current, next);
 685     s->current = NULL;
 686
 687     p->pending = 0;
 688     p->out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 689 }
 690
 691 /* Queue a byte for a MSG IN phase.  */
 692 static void lsi_add_msg_byte(LSIState *s, uint8_t data)
 693 {
 694     if (s->msg_len >= LSI_MAX_MSGIN_LEN) {
 695         trace_lsi_add_msg_byte_error();
 696     } else {
 697         trace_lsi_add_msg_byte(data);
 698         s->msg[s->msg_len++] = data;
 699     }
 700 }
 701
 702 /* Perform reselection to continue a command.  */
 703 static void lsi_reselect(LSIState *s, lsi_request *p)
 704 {
 705     int id;
 706
 707     assert(s->current == NULL);
 708     QTAILQ_REMOVE(&s->queue, p, next);
 709     s->current = p;
 710
 711     id = (p->tag >> 8) & 0xf;
 712     s->ssid = id | 0x80;
 713     /* LSI53C700 Family Compatibility, see LSI53C895A 4-73 */
 714     if (!(s->dcntl & LSI_DCNTL_COM)) {
 715         s->sfbr = 1 << (id & 0x7);
 716     }
 717     trace_lsi_reselect(id);
 718     s->scntl1 |= LSI_SCNTL1_CON;
 719     lsi_set_phase(s, PHASE_MI);
 720     s->msg_action = p->out ? LSI_MSG_ACTION_DOUT : LSI_MSG_ACTION_DIN;
 721     s->current->dma_len = p->pending;
 722     lsi_add_msg_byte(s, 0x80);
 723     if (s->current->tag & LSI_TAG_VALID) {
 724         lsi_add_msg_byte(s, 0x20);
 725         lsi_add_msg_byte(s, p->tag & 0xff);
 726     }
 727
 728     if (lsi_irq_on_rsl(s)) {
 729         lsi_script_scsi_interrupt(s, LSI_SIST0_RSL, 0);
 730     }
 731 }
 732
 733 static lsi_request *lsi_find_by_tag(LSIState *s, uint32_t tag)
 734 {
 735     lsi_request *p;
 736
 737     QTAILQ_FOREACH(p, &s->queue, next) {
 738         if (p->tag == tag) {
 739             return p;
 740         }
 741     }
 742
 743     return NULL;
 744 }
 745
 746 static void lsi_request_free(LSIState *s, lsi_request *p)
 747 {
 748     if (p == s->current) {
 749         s->current = NULL;
 750     } else {
 751         QTAILQ_REMOVE(&s->queue, p, next);
 752     }
 753     g_free(p);
 754 }
 755
 756 static void lsi_request_cancelled(SCSIRequest *req)
 757 {
 758     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 759     lsi_request *p = req->hba_private;
 760
 761     req->hba_private = NULL;
 762     lsi_request_free(s, p);
 763     scsi_req_unref(req);
 764 }
 765
 766 /* Record that data is available for a queued command.  Returns zero if
 767    the device was reselected, nonzero if the IO is deferred.  */
 768 static int lsi_queue_req(LSIState *s, SCSIRequest *req, uint32_t len)
 769 {
 770     lsi_request *p = req->hba_private;
 771
 772     if (p->pending) {
 773         trace_lsi_queue_req_error(p);
 774     }
 775     p->pending = len;
 776     /* Reselect if waiting for it, or if reselection triggers an IRQ
 777        and the bus is free.
 778        Since no interrupt stacking is implemented in the emulation, it
 779        is also required that there are no pending interrupts waiting
 780        for service from the device driver. */
 781     if (s->waiting == LSI_WAIT_RESELECT ||
 782         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON) &&
 783          !(s->istat0 & (LSI_ISTAT0_SIP | LSI_ISTAT0_DIP)))) {
 784         /* Reselect device.  */
 785         lsi_reselect(s, p);
 786         return 0;
 787     } else {
 788         trace_lsi_queue_req(p->tag);
 789         p->pending = len;
 790         return 1;
 791     }
 792 }
 793
 794  /* Callback to indicate that the SCSI layer has completed a command.  */
 795 static void lsi_command_complete(SCSIRequest *req, size_t resid)
 796 {
 797     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 798     int out, stop = 0;
 799
 800     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 801     trace_lsi_command_complete(req->status);
 802     s->status = req->status;
 803     s->command_complete = 2;
 804     if (s->waiting && s->dbc != 0) {
 805         /* Raise phase mismatch for short transfers.  */
 806         stop = lsi_bad_phase(s, out, PHASE_ST);
 807         if (stop) {
 808             s->waiting = 0;
 809         }
 810     } else {
 811         lsi_set_phase(s, PHASE_ST);
 812     }
 813
 814     if (req->hba_private == s->current) {
 815         req->hba_private = NULL;
 816         lsi_request_free(s, s->current);
 817         scsi_req_unref(req);
 818     }
 819     if (!stop) {
 820         lsi_resume_script(s);
 821     }
 822 }
 823
 824  /* Callback to indicate that the SCSI layer has completed a transfer.  */
 825 static void lsi_transfer_data(SCSIRequest *req, uint32_t len)
 826 {
 827     LSIState *s = LSI53C895A(req->bus->qbus.parent);
 828     int out;
 829
 830     assert(req->hba_private);
 831     if (s->waiting == LSI_WAIT_RESELECT || req->hba_private != s->current ||
 832         (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {
 833         if (lsi_queue_req(s, req, len)) {
 834             return;
 835         }
 836     }
 837
 838     out = (s->sstat1 & PHASE_MASK) == PHASE_DO;
 839
 840     /* host adapter (re)connected */
 841     trace_lsi_transfer_data(req->tag, len);
 842     s->current->dma_len = len;
 843     s->command_complete = 1;
 844     if (s->waiting) {
 845         if (s->waiting == LSI_WAIT_RESELECT || s->dbc == 0) {
 846             lsi_resume_script(s);
 847         } else {
 848             lsi_do_dma(s, out);
 849         }
 850     }
 851 }
 852
 853 static void lsi_do_command(LSIState *s)
 854 {
 855     SCSIDevice *dev;
 856     uint8_t buf[16];
 857     uint32_t id;
 858     int n;
 859
 860     trace_lsi_do_command(s->dbc);
 861     if (s->dbc > 16)
 862         s->dbc = 16;
 863     pci_dma_read(PCI_DEVICE(s), s->dnad, buf, s->dbc);
 864     s->sfbr = buf[0];
 865     s->command_complete = 0;
 866
 867     id = (s->select_tag >> 8) & 0xf;
 868     dev = scsi_device_find(&s->bus, 0, id, s->current_lun);
 869     if (!dev) {
 870         lsi_bad_selection(s, id);
 871         return;
 872     }
 873
 874     assert(s->current == NULL);
 875     s->current = g_new0(lsi_request, 1);
 876     s->current->tag = s->select_tag;
 877     s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
 878                                    s->dbc, s->current);
 879
 880     n = scsi_req_enqueue(s->current->req);
 881     if (n) {
 882         if (n > 0) {
 883             lsi_set_phase(s, PHASE_DI);
 884         } else if (n < 0) {
 885             lsi_set_phase(s, PHASE_DO);
 886         }
 887         scsi_req_continue(s->current->req);
 888     }
 889     if (!s->command_complete) {
 890         if (n) {
 891             /* Command did not complete immediately so disconnect.  */
 892             lsi_add_msg_byte(s, 2); /* SAVE DATA POINTER */
 893             lsi_add_msg_byte(s, 4); /* DISCONNECT */
 894             /* wait data */
 895             lsi_set_phase(s, PHASE_MI);
 896             s->msg_action = LSI_MSG_ACTION_DISCONNECT;
 897             lsi_queue_command(s);
 898         } else {
 899             /* wait command complete */
 900             lsi_set_phase(s, PHASE_DI);
 901         }
 902     }
 903 }
 904
 905 static void lsi_do_status(LSIState *s)
 906 {
 907     uint8_t status;
 908     trace_lsi_do_status(s->dbc, s->status);
 909     if (s->dbc != 1) {
 910         trace_lsi_do_status_error();
 911     }
 912     s->dbc = 1;
 913     status = s->status;
 914     s->sfbr = status;
 915     pci_dma_write(PCI_DEVICE(s), s->dnad, &status, 1);
 916     lsi_set_phase(s, PHASE_MI);
 917     s->msg_action = LSI_MSG_ACTION_DISCONNECT;
 918     lsi_add_msg_byte(s, 0); /* COMMAND COMPLETE */
 919 }
 920
 921 static void lsi_do_msgin(LSIState *s)
 922 {
 923     uint8_t len;
 924     trace_lsi_do_msgin(s->dbc, s->msg_len);
 925     s->sfbr = s->msg[0];
 926     len = s->msg_len;
 927     assert(len > 0 && len <= LSI_MAX_MSGIN_LEN);
 928     if (len > s->dbc)
 929         len = s->dbc;
 930
 931     if (len) {
 932         pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
 933         /* Linux drivers rely on the last byte being in the SIDL.  */
 934         s->sidl = s->msg[len - 1];
 935         s->msg_len -= len;
 936         if (s->msg_len) {
 937             memmove(s->msg, s->msg + len, s->msg_len);
 938         }
 939     }
 940
 941     if (!s->msg_len) {
 942         /* ??? Check if ATN (not yet implemented) is asserted and maybe
 943            switch to PHASE_MO.  */
 944         switch (s->msg_action) {
 945         case LSI_MSG_ACTION_COMMAND:
 946             lsi_set_phase(s, PHASE_CMD);
 947             break;
 948         case LSI_MSG_ACTION_DISCONNECT:
 949             lsi_disconnect(s);
 950             break;
 951         case LSI_MSG_ACTION_DOUT:
 952             lsi_set_phase(s, PHASE_DO);
 953             break;
 954         case LSI_MSG_ACTION_DIN:
 955             lsi_set_phase(s, PHASE_DI);
 956             break;
 957         default:
 958             abort();
 959         }
 960     }
 961 }
 962
 963 /* Read the next byte during a MSGOUT phase.  */
 964 static uint8_t lsi_get_msgbyte(LSIState *s)
 965 {
 966     uint8_t data;
 967     pci_dma_read(PCI_DEVICE(s), s->dnad, &data, 1);
 968     s->dnad++;
 969     s->dbc--;
 970     return data;
 971 }
 972
 973 /* Skip the next n bytes during a MSGOUT phase. */
 974 static void lsi_skip_msgbytes(LSIState *s, unsigned int n)
 975 {
 976     s->dnad += n;
 977     s->dbc  -= n;
 978 }
 979
 980 static void lsi_do_msgout(LSIState *s)
 981 {
 982     uint8_t msg;
 983     int len;
 984     uint32_t current_tag;
 985     lsi_request *current_req, *p, *p_next;
 986
 987     if (s->current) {
 988         current_tag = s->current->tag;
 989         current_req = s->current;
 990     } else {
 991         current_tag = s->select_tag;
 992         current_req = lsi_find_by_tag(s, current_tag);
 993     }
 994
 995     trace_lsi_do_msgout(s->dbc);
 996     while (s->dbc) {
 997         msg = lsi_get_msgbyte(s);
 998         s->sfbr = msg;
 999
1000         switch (msg) {
1001         case 0x04:
1002             trace_lsi_do_msgout_disconnect();
1003             lsi_disconnect(s);
1004             break;
1005         case 0x08:
1006             trace_lsi_do_msgout_noop();
1007             lsi_set_phase(s, PHASE_CMD);
1008             break;
1009         case 0x01:
1010             len = lsi_get_msgbyte(s);
1011             msg = lsi_get_msgbyte(s);
1012             (void)len; /* avoid a warning about unused variable*/
1013             trace_lsi_do_msgout_extended(msg, len);
1014             switch (msg) {
1015             case 1:
1016                 trace_lsi_do_msgout_ignored("SDTR");
1017                 lsi_skip_msgbytes(s, 2);
1018                 break;
1019             case 3:
1020                 trace_lsi_do_msgout_ignored("WDTR");
1021                 lsi_skip_msgbytes(s, 1);
1022                 break;
1023             case 4:
1024                 trace_lsi_do_msgout_ignored("PPR");
1025                 lsi_skip_msgbytes(s, 5);
1026                 break;
1027             default:
1028                 goto bad;
1029             }
1030             break;
1031         case 0x20: /* SIMPLE queue */
1032             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1033             trace_lsi_do_msgout_simplequeue(s->select_tag & 0xff);
1034             break;
1035         case 0x21: /* HEAD of queue */
1036             qemu_log_mask(LOG_UNIMP, "lsi_scsi: HEAD queue not implemented\n");
1037             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1038             break;
1039         case 0x22: /* ORDERED queue */
1040             qemu_log_mask(LOG_UNIMP,
1041                           "lsi_scsi: ORDERED queue not implemented\n");
1042             s->select_tag |= lsi_get_msgbyte(s) | LSI_TAG_VALID;
1043             break;
1044         case 0x0d:
1045             /* The ABORT TAG message clears the current I/O process only. */
1046             trace_lsi_do_msgout_abort(current_tag);
1047             if (current_req && current_req->req) {
1048                 scsi_req_cancel(current_req->req);
1049                 current_req = NULL;
1050             }
1051             lsi_disconnect(s);
1052             break;
1053         case 0x06:
1054         case 0x0e:
1055         case 0x0c:
1056             /* The ABORT message clears all I/O processes for the selecting
1057                initiator on the specified logical unit of the target. */
1058             if (msg == 0x06) {
1059                 trace_lsi_do_msgout_abort(current_tag);
1060             }
1061             /* The CLEAR QUEUE message clears all I/O processes for all
1062                initiators on the specified logical unit of the target. */
1063             if (msg == 0x0e) {
1064                 trace_lsi_do_msgout_clearqueue(current_tag);
1065             }
1066             /* The BUS DEVICE RESET message clears all I/O processes for all
1067                initiators on all logical units of the target. */
1068             if (msg == 0x0c) {
1069                 trace_lsi_do_msgout_busdevicereset(current_tag);
1070             }
1071
1072             /* clear the current I/O process */
1073             if (s->current) {
1074                 scsi_req_cancel(s->current->req);
1075                 current_req = NULL;
1076             }
1077
1078             /* As the current implemented devices scsi_disk and scsi_generic
1079                only support one LUN, we don't need to keep track of LUNs.
1080                Clearing I/O processes for other initiators could be possible
1081                for scsi_generic by sending a SG_SCSI_RESET to the /dev/sgX
1082                device, but this is currently not implemented (and seems not
1083                to be really necessary). So let's simply clear all queued
1084                commands for the current device: */
1085             QTAILQ_FOREACH_SAFE(p, &s->queue, next, p_next) {
1086                 if ((p->tag & 0x0000ff00) == (current_tag & 0x0000ff00)) {
1087                     scsi_req_cancel(p->req);
1088                 }
1089             }
1090
1091             lsi_disconnect(s);
1092             break;
1093         default:
1094             if ((msg & 0x80) == 0) {
1095                 goto bad;
1096             }
1097             s->current_lun = msg & 7;
1098             trace_lsi_do_msgout_select(s->current_lun);
1099             lsi_set_phase(s, PHASE_CMD);
1100             break;
1101         }
1102     }
1103     return;
1104 bad:
1105     qemu_log_mask(LOG_UNIMP, "Unimplemented message 0x%02x\n", msg);
1106     lsi_set_phase(s, PHASE_MI);
1107     lsi_add_msg_byte(s, 7); /* MESSAGE REJECT */
1108     s->msg_action = LSI_MSG_ACTION_COMMAND;
1109 }
1110
1111 #define LSI_BUF_SIZE 4096
1112 static void lsi_memcpy(LSIState *s, uint32_t dest, uint32_t src, int count)
1113 {
1114     int n;
1115     uint8_t buf[LSI_BUF_SIZE];
1116
1117     trace_lsi_memcpy(dest, src, count);
1118     while (count) {
1119         n = (count > LSI_BUF_SIZE) ? LSI_BUF_SIZE : count;
1120         lsi_mem_read(s, src, buf, n);
1121         lsi_mem_write(s, dest, buf, n);
1122         src += n;
1123         dest += n;
1124         count -= n;
1125     }
1126 }
1127
1128 static void lsi_wait_reselect(LSIState *s)
1129 {
1130     lsi_request *p;
1131
1132     trace_lsi_wait_reselect();
1133
1134     if (s->current) {
1135         return;
1136     }
1137     p = get_pending_req(s);
1138     if (p) {
1139         lsi_reselect(s, p);
1140     }
1141     if (s->current == NULL) {
1142         s->waiting = LSI_WAIT_RESELECT;
1143     }
1144 }
1145
1146 static void lsi_scripts_timer_start(LSIState *s)
1147 {
1148     trace_lsi_scripts_timer_start();
1149     timer_mod(s->scripts_timer, qemu_clock_get_us(QEMU_CLOCK_VIRTUAL) + 500);
1150 }
1151
1152 static void lsi_execute_script(LSIState *s)
1153 {
1154     PCIDevice *pci_dev = PCI_DEVICE(s);
1155     uint32_t insn;
1156     uint32_t addr, addr_high;
1157     int opcode;
1158     int insn_processed = 0;
1159     static int reentrancy_level;
1160
1161     if (s->waiting == LSI_WAIT_SCRIPTS) {
1162         timer_del(s->scripts_timer);
1163         s->waiting = LSI_NOWAIT;
1164     }
1165
1166     reentrancy_level++;
1167
1168     s->istat1 |= LSI_ISTAT1_SRUN;
1169 again:
1170     /*
1171      * Some windows drivers make the device spin waiting for a memory location
1172      * to change. If we have executed more than LSI_MAX_INSN instructions then
1173      * assume this is the case and start a timer. Until the timer fires, the
1174      * host CPU has a chance to run and change the memory location.
1175      *
1176      * Another issue (CVE-2023-0330) can occur if the script is programmed to
1177      * trigger itself again and again. Avoid this problem by stopping after
1178      * being called multiple times in a reentrant way (8 is an arbitrary value
1179      * which should be enough for all valid use cases).
1180      */
1181     if (++insn_processed > LSI_MAX_INSN || reentrancy_level > 8) {
1182         s->waiting = LSI_WAIT_SCRIPTS;
1183         lsi_scripts_timer_start(s);
1184         reentrancy_level--;
1185         return;
1186     }
1187     insn = read_dword(s, s->dsp);
1188     if (!insn) {
1189         /* If we receive an empty opcode increment the DSP by 4 bytes
1190            instead of 8 and execute the next opcode at that location */
1191         s->dsp += 4;
1192         goto again;
1193     }
1194     addr = read_dword(s, s->dsp + 4);
1195     addr_high = 0;
1196     trace_lsi_execute_script(s->dsp, insn, addr);
1197     s->dsps = addr;
1198     s->dcmd = insn >> 24;
1199     s->dsp += 8;
1200     switch (insn >> 30) {
1201     case 0: /* Block move.  */
1202         if (s->sist1 & LSI_SIST1_STO) {
1203             trace_lsi_execute_script_blockmove_delayed();
1204             lsi_stop_script(s);
1205             break;
1206         }
1207         s->dbc = insn & 0xffffff;
1208         s->rbc = s->dbc;
1209         /* ??? Set ESA.  */
1210         s->ia = s->dsp - 8;
1211         if (insn & (1 << 29)) {
1212             /* Indirect addressing.  */
1213             addr = read_dword(s, addr);
1214         } else if (insn & (1 << 28)) {
1215             uint32_t buf[2];
1216             int32_t offset;
1217             /* Table indirect addressing.  */
1218
1219             /* 32-bit Table indirect */
1220             offset = sextract32(addr, 0, 24);
1221             pci_dma_read(pci_dev, s->dsa + offset, buf, 8);
1222             /* byte count is stored in bits 0:23 only */
1223             s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
1224             s->rbc = s->dbc;
1225             addr = cpu_to_le32(buf[1]);
1226
1227             /* 40-bit DMA, upper addr bits [39:32] stored in first DWORD of
1228              * table, bits [31:24] */
1229             if (lsi_dma_40bit(s))
1230                 addr_high = cpu_to_le32(buf[0]) >> 24;
1231             else if (lsi_dma_ti64bit(s)) {
1232                 int selector = (cpu_to_le32(buf[0]) >> 24) & 0x1f;
1233                 switch (selector) {
1234                 case 0 ... 0x0f:
1235                     /* offset index into scratch registers since
1236                      * TI64 mode can use registers C to R */
1237                     addr_high = s->scratch[2 + selector];
1238                     break;
1239                 case 0x10:
1240                     addr_high = s->mmrs;
1241                     break;
1242                 case 0x11:
1243                     addr_high = s->mmws;
1244                     break;
1245                 case 0x12:
1246                     addr_high = s->sfs;
1247                     break;
1248                 case 0x13:
1249                     addr_high = s->drs;
1250                     break;
1251                 case 0x14:
1252                     addr_high = s->sbms;
1253                     break;
1254                 case 0x15:
1255                     addr_high = s->dbms;
1256                     break;
1257                 default:
1258                     qemu_log_mask(LOG_GUEST_ERROR,
1259                           "lsi_scsi: Illegal selector specified (0x%x > 0x15) "
1260                           "for 64-bit DMA block move", selector);
1261                     break;
1262                 }
1263             }
1264         } else if (lsi_dma_64bit(s)) {
1265             /* fetch a 3rd dword if 64-bit direct move is enabled and
1266                only if we're not doing table indirect or indirect addressing */
1267             s->dbms = read_dword(s, s->dsp);
1268             s->dsp += 4;
1269             s->ia = s->dsp - 12;
1270         }
1271         if ((s->sstat1 & PHASE_MASK) != ((insn >> 24) & 7)) {
1272             trace_lsi_execute_script_blockmove_badphase(
1273                     scsi_phase_name(s->sstat1),
1274                     scsi_phase_name(insn >> 24));
1275             lsi_script_scsi_interrupt(s, LSI_SIST0_MA, 0);
1276             break;
1277         }
1278         s->dnad = addr;
1279         s->dnad64 = addr_high;
1280         switch (s->sstat1 & 0x7) {
1281         case PHASE_DO:
1282             s->waiting = LSI_DMA_SCRIPTS;
1283             lsi_do_dma(s, 1);
1284             if (s->waiting)
1285                 s->waiting = LSI_DMA_IN_PROGRESS;
1286             break;
1287         case PHASE_DI:
1288             s->waiting = LSI_DMA_SCRIPTS;
1289             lsi_do_dma(s, 0);
1290             if (s->waiting)
1291                 s->waiting = LSI_DMA_IN_PROGRESS;
1292             break;
1293         case PHASE_CMD:
1294             lsi_do_command(s);
1295             break;
1296         case PHASE_ST:
1297             lsi_do_status(s);
1298             break;
1299         case PHASE_MO:
1300             lsi_do_msgout(s);
1301             break;
1302         case PHASE_MI:
1303             lsi_do_msgin(s);
1304             break;
1305         default:
1306             qemu_log_mask(LOG_UNIMP, "lsi_scsi: Unimplemented phase %s\n",
1307                           scsi_phase_name(s->sstat1));
1308         }
1309         s->dfifo = s->dbc & 0xff;
1310         s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
1311         s->sbc = s->dbc;
1312         s->rbc -= s->dbc;
1313         s->ua = addr + s->dbc;
1314         break;
1315
1316     case 1: /* IO or Read/Write instruction.  */
1317         opcode = (insn >> 27) & 7;
1318         if (opcode < 5) {
1319             uint32_t id;
1320
1321             if (insn & (1 << 25)) {
1322                 id = read_dword(s, s->dsa + sextract32(insn, 0, 24));
1323             } else {
1324                 id = insn;
1325             }
1326             id = (id >> 16) & 0xf;
1327             if (insn & (1 << 26)) {
1328                 addr = s->dsp + sextract32(addr, 0, 24);
1329             }
1330             s->dnad = addr;
1331             switch (opcode) {
1332             case 0: /* Select */
1333                 s->sdid = id;
1334                 if (s->scntl1 & LSI_SCNTL1_CON) {
1335                     trace_lsi_execute_script_io_alreadyreselected();
1336                     s->dsp = s->dnad;
1337                     break;
1338                 }
1339                 s->sstat0 |= LSI_SSTAT0_WOA;
1340                 s->scntl1 &= ~LSI_SCNTL1_IARB;
1341                 if (!scsi_device_find(&s->bus, 0, id, 0)) {
1342                     lsi_bad_selection(s, id);
1343                     break;
1344                 }
1345                 trace_lsi_execute_script_io_selected(id,
1346                                              insn & (1 << 3) ? " ATN" : "");
1347                 /* ??? Linux drivers complain when this is set.  Maybe
1348                    it only applies in low-level mode (unimplemented).
1349                 lsi_script_scsi_interrupt(s, LSI_SIST0_CMP, 0); */
1350                 s->select_tag = id << 8;
1351                 s->scntl1 |= LSI_SCNTL1_CON;
1352                 if (insn & (1 << 3)) {
1353                     s->socl |= LSI_SOCL_ATN;
1354                     s->sbcl |= LSI_SBCL_ATN;
1355                 }
1356                 s->sbcl |= LSI_SBCL_BSY;
1357                 lsi_set_phase(s, PHASE_MO);
1358                 s->waiting = LSI_NOWAIT;
1359                 break;
1360             case 1: /* Disconnect */
1361                 trace_lsi_execute_script_io_disconnect();
1362                 s->scntl1 &= ~LSI_SCNTL1_CON;
1363                 /* FIXME: this is not entirely correct; the target need not ask
1364                  * for reselection until it has to send data, while here we force a
1365                  * reselection as soon as the bus is free.  The correct flow would
1366                  * reselect before lsi_transfer_data and disconnect as soon as
1367                  * DMA ends.
1368                  */
1369                 if (!s->current) {
1370                     lsi_request *p = get_pending_req(s);
1371                     if (p) {
1372                         lsi_reselect(s, p);
1373                     }
1374                 }
1375                 break;
1376             case 2: /* Wait Reselect */
1377                 if (s->istat0 & LSI_ISTAT0_SIGP) {
1378                     s->dsp = s->dnad;
1379                 } else if (!lsi_irq_on_rsl(s)) {
1380                         lsi_wait_reselect(s);
1381                 }
1382                 break;
1383             case 3: /* Set */
1384                 trace_lsi_execute_script_io_set(
1385                         insn & (1 << 3) ? " ATN" : "",
1386                         insn & (1 << 6) ? " ACK" : "",
1387                         insn & (1 << 9) ? " TM" : "",
1388                         insn & (1 << 10) ? " CC" : "");
1389                 if (insn & (1 << 3)) {
1390                     s->socl |= LSI_SOCL_ATN;
1391                     s->sbcl |= LSI_SBCL_ATN;
1392                     lsi_set_phase(s, PHASE_MO);
1393                 }
1394
1395                 if (insn & (1 << 6)) {
1396                     s->sbcl |= LSI_SBCL_ACK;
1397                 }
1398
1399                 if (insn & (1 << 9)) {
1400                     qemu_log_mask(LOG_UNIMP,
1401                         "lsi_scsi: Target mode not implemented\n");
1402                 }
1403                 if (insn & (1 << 10))
1404                     s->carry = 1;
1405                 break;
1406             case 4: /* Clear */
1407                 trace_lsi_execute_script_io_clear(
1408                         insn & (1 << 3) ? " ATN" : "",
1409                         insn & (1 << 6) ? " ACK" : "",
1410                         insn & (1 << 9) ? " TM" : "",
1411                         insn & (1 << 10) ? " CC" : "");
1412                 if (insn & (1 << 3)) {
1413                     s->socl &= ~LSI_SOCL_ATN;
1414                     s->sbcl &= ~LSI_SBCL_ATN;
1415                 }
1416
1417                 if (insn & (1 << 6)) {
1418                     s->sbcl &= ~LSI_SBCL_ACK;
1419                 }
1420
1421                 if (insn & (1 << 10))
1422                     s->carry = 0;
1423                 break;
1424             }
1425         } else {
1426             uint8_t op0;
1427             uint8_t op1;
1428             uint8_t data8;
1429             int reg;
1430             int operator;
1431
1432             static const char *opcode_names[3] =
1433                 {"Write", "Read", "Read-Modify-Write"};
1434             static const char *operator_names[8] =
1435                 {"MOV", "SHL", "OR", "XOR", "AND", "SHR", "ADD", "ADC"};
1436
1437             reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
1438             data8 = (insn >> 8) & 0xff;
1439             opcode = (insn >> 27) & 7;
1440             operator = (insn >> 24) & 7;
1441             trace_lsi_execute_script_io_opcode(
1442                     opcode_names[opcode - 5], reg,
1443                     operator_names[operator], data8, s->sfbr,
1444                     (insn & (1 << 23)) ? " SFBR" : "");
1445             op0 = op1 = 0;
1446             switch (opcode) {
1447             case 5: /* From SFBR */
1448                 op0 = s->sfbr;
1449                 op1 = data8;
1450                 break;
1451             case 6: /* To SFBR */
1452                 if (operator)
1453                     op0 = lsi_reg_readb(s, reg);
1454                 op1 = data8;
1455                 break;
1456             case 7: /* Read-modify-write */
1457                 if (operator)
1458                     op0 = lsi_reg_readb(s, reg);
1459                 if (insn & (1 << 23)) {
1460                     op1 = s->sfbr;
1461                 } else {
1462                     op1 = data8;
1463                 }
1464                 break;
1465             }
1466
1467             switch (operator) {
1468             case 0: /* move */
1469                 op0 = op1;
1470                 break;
1471             case 1: /* Shift left */
1472                 op1 = op0 >> 7;
1473                 op0 = (op0 << 1) | s->carry;
1474                 s->carry = op1;
1475                 break;
1476             case 2: /* OR */
1477                 op0 |= op1;
1478                 break;
1479             case 3: /* XOR */
1480                 op0 ^= op1;
1481                 break;
1482             case 4: /* AND */
1483                 op0 &= op1;
1484                 break;
1485             case 5: /* SHR */
1486                 op1 = op0 & 1;
1487                 op0 = (op0 >> 1) | (s->carry << 7);
1488                 s->carry = op1;
1489                 break;
1490             case 6: /* ADD */
1491                 op0 += op1;
1492                 s->carry = op0 < op1;
1493                 break;
1494             case 7: /* ADC */
1495                 op0 += op1 + s->carry;
1496                 if (s->carry)
1497                     s->carry = op0 <= op1;
1498                 else
1499                     s->carry = op0 < op1;
1500                 break;
1501             }
1502
1503             switch (opcode) {
1504             case 5: /* From SFBR */
1505             case 7: /* Read-modify-write */
1506                 lsi_reg_writeb(s, reg, op0);
1507                 break;
1508             case 6: /* To SFBR */
1509                 s->sfbr = op0;
1510                 break;
1511             }
1512         }
1513         break;
1514
1515     case 2: /* Transfer Control.  */
1516         {
1517             int cond;
1518             int jmp;
1519
1520             if ((insn & 0x002e0000) == 0) {
1521                 trace_lsi_execute_script_tc_nop();
1522                 break;
1523             }
1524             if (s->sist1 & LSI_SIST1_STO) {
1525                 trace_lsi_execute_script_tc_delayedselect_timeout();
1526                 lsi_stop_script(s);
1527                 break;
1528             }
1529             cond = jmp = (insn & (1 << 19)) != 0;
1530             if (cond == jmp && (insn & (1 << 21))) {
1531                 trace_lsi_execute_script_tc_compc(s->carry == jmp);
1532                 cond = s->carry != 0;
1533             }
1534             if (cond == jmp && (insn & (1 << 17))) {
1535                 trace_lsi_execute_script_tc_compp(scsi_phase_name(s->sstat1),
1536                         jmp ? '=' : '!', scsi_phase_name(insn >> 24));
1537                 cond = (s->sstat1 & PHASE_MASK) == ((insn >> 24) & 7);
1538             }
1539             if (cond == jmp && (insn & (1 << 18))) {
1540                 uint8_t mask;
1541
1542                 mask = (~insn >> 8) & 0xff;
1543                 trace_lsi_execute_script_tc_compd(
1544                         s->sfbr, mask, jmp ? '=' : '!', insn & mask);
1545                 cond = (s->sfbr & mask) == (insn & mask);
1546             }
1547             if (cond == jmp) {
1548                 if (insn & (1 << 23)) {
1549                     /* Relative address.  */
1550                     addr = s->dsp + sextract32(addr, 0, 24);
1551                 }
1552                 switch ((insn >> 27) & 7) {
1553                 case 0: /* Jump */
1554                     trace_lsi_execute_script_tc_jump(addr);
1555                     s->adder = addr;
1556                     s->dsp = addr;
1557                     break;
1558                 case 1: /* Call */
1559                     trace_lsi_execute_script_tc_call(addr);
1560                     s->temp = s->dsp;
1561                     s->dsp = addr;
1562                     break;
1563                 case 2: /* Return */
1564                     trace_lsi_execute_script_tc_return(s->temp);
1565                     s->dsp = s->temp;
1566                     break;
1567                 case 3: /* Interrupt */
1568                     trace_lsi_execute_script_tc_interrupt(s->dsps);
1569                     if ((insn & (1 << 20)) != 0) {
1570                         s->istat0 |= LSI_ISTAT0_INTF;
1571                         lsi_update_irq(s);
1572                     } else {
1573                         lsi_script_dma_interrupt(s, LSI_DSTAT_SIR);
1574                     }
1575                     break;
1576                 default:
1577                     trace_lsi_execute_script_tc_illegal();
1578                     lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
1579                     break;
1580                 }
1581             } else {
1582                 trace_lsi_execute_script_tc_cc_failed();
1583             }
1584         }
1585         break;
1586
1587     case 3:
1588         if ((insn & (1 << 29)) == 0) {
1589             /* Memory move.  */
1590             uint32_t dest;
1591             /* ??? The docs imply the destination address is loaded into
1592                the TEMP register.  However the Linux drivers rely on
1593                the value being presrved.  */
1594             dest = read_dword(s, s->dsp);
1595             s->dsp += 4;
1596             lsi_memcpy(s, dest, addr, insn & 0xffffff);
1597         } else {
1598             uint8_t data[7];
1599             int reg;
1600             int n;
1601             int i;
1602
1603             if (insn & (1 << 28)) {
1604                 addr = s->dsa + sextract32(addr, 0, 24);
1605             }
1606             n = (insn & 7);
1607             reg = (insn >> 16) & 0xff;
1608             if (insn & (1 << 24)) {
1609                 pci_dma_read(pci_dev, addr, data, n);
1610                 trace_lsi_execute_script_mm_load(reg, n, addr, *(int *)data);
1611                 for (i = 0; i < n; i++) {
1612                     lsi_reg_writeb(s, reg + i, data[i]);
1613                 }
1614             } else {
1615                 trace_lsi_execute_script_mm_store(reg, n, addr);
1616                 for (i = 0; i < n; i++) {
1617                     data[i] = lsi_reg_readb(s, reg + i);
1618                 }
1619                 pci_dma_write(pci_dev, addr, data, n);
1620             }
1621         }
1622     }
1623     if (s->istat1 & LSI_ISTAT1_SRUN && s->waiting == LSI_NOWAIT) {
1624         if (s->dcntl & LSI_DCNTL_SSM) {
1625             lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
1626         } else {
1627             goto again;
1628         }
1629     }
1630     trace_lsi_execute_script_stop();
1631
1632     reentrancy_level--;
1633 }
1634
1635 static uint8_t lsi_reg_readb(LSIState *s, int offset)
1636 {
1637     uint8_t ret;
1638
1639 #define CASE_GET_REG24(name, addr) \
1640     case addr: ret = s->name & 0xff; break; \
1641     case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1642     case addr + 2: ret = (s->name >> 16) & 0xff; break;
1643
1644 #define CASE_GET_REG32(name, addr) \
1645     case addr: ret = s->name & 0xff; break; \
1646     case addr + 1: ret = (s->name >> 8) & 0xff; break; \
1647     case addr + 2: ret = (s->name >> 16) & 0xff; break; \
1648     case addr + 3: ret = (s->name >> 24) & 0xff; break;
1649
1650     switch (offset) {
1651     case 0x00: /* SCNTL0 */
1652         ret = s->scntl0;
1653         break;
1654     case 0x01: /* SCNTL1 */
1655         ret = s->scntl1;
1656         break;
1657     case 0x02: /* SCNTL2 */
1658         ret = s->scntl2;
1659         break;
1660     case 0x03: /* SCNTL3 */
1661         ret = s->scntl3;
1662         break;
1663     case 0x04: /* SCID */
1664         ret = s->scid;
1665         break;
1666     case 0x05: /* SXFER */
1667         ret = s->sxfer;
1668         break;
1669     case 0x06: /* SDID */
1670         ret = s->sdid;
1671         break;
1672     case 0x07: /* GPREG0 */
1673         ret = 0x7f;
1674         break;
1675     case 0x08: /* Revision ID */
1676         ret = 0x00;
1677         break;
1678     case 0x09: /* SOCL */
1679         ret = s->socl;
1680         break;
1681     case 0xa: /* SSID */
1682         ret = s->ssid;
1683         break;
1684     case 0xb: /* SBCL */
1685         ret = s->sbcl;
1686         break;
1687     case 0xc: /* DSTAT */
1688         ret = s->dstat | LSI_DSTAT_DFE;
1689         if ((s->istat0 & LSI_ISTAT0_INTF) == 0)
1690             s->dstat = 0;
1691         lsi_update_irq(s);
1692         break;
1693     case 0x0d: /* SSTAT0 */
1694         ret = s->sstat0;
1695         break;
1696     case 0x0e: /* SSTAT1 */
1697         ret = s->sstat1;
1698         break;
1699     case 0x0f: /* SSTAT2 */
1700         ret = s->scntl1 & LSI_SCNTL1_CON ? 0 : 2;
1701         break;
1702     CASE_GET_REG32(dsa, 0x10)
1703     case 0x14: /* ISTAT0 */
1704         ret = s->istat0;
1705         break;
1706     case 0x15: /* ISTAT1 */
1707         ret = s->istat1;
1708         break;
1709     case 0x16: /* MBOX0 */
1710         ret = s->mbox0;
1711         break;
1712     case 0x17: /* MBOX1 */
1713         ret = s->mbox1;
1714         break;
1715     case 0x18: /* CTEST0 */
1716         ret = 0xff;
1717         break;
1718     case 0x19: /* CTEST1 */
1719         ret = 0;
1720         break;
1721     case 0x1a: /* CTEST2 */
1722         ret = s->ctest2 | LSI_CTEST2_DACK | LSI_CTEST2_CM;
1723         if (s->istat0 & LSI_ISTAT0_SIGP) {
1724             s->istat0 &= ~LSI_ISTAT0_SIGP;
1725             ret |= LSI_CTEST2_SIGP;
1726         }
1727         break;
1728     case 0x1b: /* CTEST3 */
1729         ret = s->ctest3;
1730         break;
1731     CASE_GET_REG32(temp, 0x1c)
1732     case 0x20: /* DFIFO */
1733         ret = s->dfifo;
1734         break;
1735     case 0x21: /* CTEST4 */
1736         ret = s->ctest4;
1737         break;
1738     case 0x22: /* CTEST5 */
1739         ret = s->ctest5;
1740         break;
1741     case 0x23: /* CTEST6 */
1742         ret = 0;
1743         break;
1744     CASE_GET_REG24(dbc, 0x24)
1745     case 0x27: /* DCMD */
1746         ret = s->dcmd;
1747         break;
1748     CASE_GET_REG32(dnad, 0x28)
1749     CASE_GET_REG32(dsp, 0x2c)
1750     CASE_GET_REG32(dsps, 0x30)
1751     CASE_GET_REG32(scratch[0], 0x34)
1752     case 0x38: /* DMODE */
1753         ret = s->dmode;
1754         break;
1755     case 0x39: /* DIEN */
1756         ret = s->dien;
1757         break;
1758     case 0x3a: /* SBR */
1759         ret = s->sbr;
1760         break;
1761     case 0x3b: /* DCNTL */
1762         ret = s->dcntl;
1763         break;
1764     /* ADDER Output (Debug of relative jump address) */
1765     CASE_GET_REG32(adder, 0x3c)
1766     case 0x40: /* SIEN0 */
1767         ret = s->sien0;
1768         break;
1769     case 0x41: /* SIEN1 */
1770         ret = s->sien1;
1771         break;
1772     case 0x42: /* SIST0 */
1773         ret = s->sist0;
1774         s->sist0 = 0;
1775         lsi_update_irq(s);
1776         break;
1777     case 0x43: /* SIST1 */
1778         ret = s->sist1;
1779         s->sist1 = 0;
1780         lsi_update_irq(s);
1781         break;
1782     case 0x46: /* MACNTL */
1783         ret = 0x0f;
1784         break;
1785     case 0x47: /* GPCNTL0 */
1786         ret = 0x0f;
1787         break;
1788     case 0x48: /* STIME0 */
1789         ret = s->stime0;
1790         break;
1791     case 0x4a: /* RESPID0 */
1792         ret = s->respid0;
1793         break;
1794     case 0x4b: /* RESPID1 */
1795         ret = s->respid1;
1796         break;
1797     case 0x4d: /* STEST1 */
1798         ret = s->stest1;
1799         break;
1800     case 0x4e: /* STEST2 */
1801         ret = s->stest2;
1802         break;
1803     case 0x4f: /* STEST3 */
1804         ret = s->stest3;
1805         break;
1806     case 0x50: /* SIDL */
1807         /* This is needed by the linux drivers.  We currently only update it
1808            during the MSG IN phase.  */
1809         ret = s->sidl;
1810         break;
1811     case 0x52: /* STEST4 */
1812         ret = 0xe0;
1813         break;
1814     case 0x56: /* CCNTL0 */
1815         ret = s->ccntl0;
1816         break;
1817     case 0x57: /* CCNTL1 */
1818         ret = s->ccntl1;
1819         break;
1820     case 0x58: /* SBDL */
1821         /* Some drivers peek at the data bus during the MSG IN phase.  */
1822         if ((s->sstat1 & PHASE_MASK) == PHASE_MI) {
1823             assert(s->msg_len > 0);
1824             return s->msg[0];
1825         }
1826         ret = 0;
1827         break;
1828     case 0x59: /* SBDL high */
1829         ret = 0;
1830         break;
1831     CASE_GET_REG32(mmrs, 0xa0)
1832     CASE_GET_REG32(mmws, 0xa4)
1833     CASE_GET_REG32(sfs, 0xa8)
1834     CASE_GET_REG32(drs, 0xac)
1835     CASE_GET_REG32(sbms, 0xb0)
1836     CASE_GET_REG32(dbms, 0xb4)
1837     CASE_GET_REG32(dnad64, 0xb8)
1838     CASE_GET_REG32(pmjad1, 0xc0)
1839     CASE_GET_REG32(pmjad2, 0xc4)
1840     CASE_GET_REG32(rbc, 0xc8)
1841     CASE_GET_REG32(ua, 0xcc)
1842     CASE_GET_REG32(ia, 0xd4)
1843     CASE_GET_REG32(sbc, 0xd8)
1844     CASE_GET_REG32(csbc, 0xdc)
1845     case 0x5c ... 0x9f:
1846     {
1847         int n;
1848         int shift;
1849         n = (offset - 0x58) >> 2;
1850         shift = (offset & 3) * 8;
1851         ret = (s->scratch[n] >> shift) & 0xff;
1852         break;
1853     }
1854     default:
1855     {
1856         qemu_log_mask(LOG_GUEST_ERROR,
1857                       "lsi_scsi: invalid read from reg %s %x\n",
1858                       offset < ARRAY_SIZE(names) ? names[offset] : "???",
1859                       offset);
1860         ret = 0xff;
1861         break;
1862     }
1863     }
1864 #undef CASE_GET_REG24
1865 #undef CASE_GET_REG32
1866
1867     trace_lsi_reg_read(offset < ARRAY_SIZE(names) ? names[offset] : "???",
1868                        offset, ret);
1869
1870     return ret;
1871 }
1872
1873 static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
1874 {
1875 #define CASE_SET_REG24(name, addr) \
1876     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1877     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1878     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break;
1879
1880 #define CASE_SET_REG32(name, addr) \
1881     case addr    : s->name &= 0xffffff00; s->name |= val;       break; \
1882     case addr + 1: s->name &= 0xffff00ff; s->name |= val << 8;  break; \
1883     case addr + 2: s->name &= 0xff00ffff; s->name |= val << 16; break; \
1884     case addr + 3: s->name &= 0x00ffffff; s->name |= val << 24; break;
1885
1886     trace_lsi_reg_write(offset < ARRAY_SIZE(names) ? names[offset] : "???",
1887                         offset, val);
1888
1889     switch (offset) {
1890     case 0x00: /* SCNTL0 */
1891         s->scntl0 = val;
1892         if (val & LSI_SCNTL0_START) {
1893             qemu_log_mask(LOG_UNIMP,
1894                           "lsi_scsi: Start sequence not implemented\n");
1895         }
1896         break;
1897     case 0x01: /* SCNTL1 */
1898         s->scntl1 = val & ~LSI_SCNTL1_SST;
1899         if (val & LSI_SCNTL1_IARB) {
1900             qemu_log_mask(LOG_UNIMP,
1901                       "lsi_scsi: Immediate Arbritration not implemented\n");
1902         }
1903         if (val & LSI_SCNTL1_RST) {
1904             if (!(s->sstat0 & LSI_SSTAT0_RST)) {
1905                 bus_cold_reset(BUS(&s->bus));
1906                 s->sstat0 |= LSI_SSTAT0_RST;
1907                 lsi_script_scsi_interrupt(s, LSI_SIST0_RST, 0);
1908             }
1909         } else {
1910             s->sstat0 &= ~LSI_SSTAT0_RST;
1911         }
1912         break;
1913     case 0x02: /* SCNTL2 */
1914         val &= ~(LSI_SCNTL2_WSR | LSI_SCNTL2_WSS);
1915         s->scntl2 = val;
1916         break;
1917     case 0x03: /* SCNTL3 */
1918         s->scntl3 = val;
1919         break;
1920     case 0x04: /* SCID */
1921         s->scid = val;
1922         break;
1923     case 0x05: /* SXFER */
1924         s->sxfer = val;
1925         break;
1926     case 0x06: /* SDID */
1927         if ((s->ssid & 0x80) && (val & 0xf) != (s->ssid & 0xf)) {
1928             qemu_log_mask(LOG_GUEST_ERROR,
1929                           "lsi_scsi: Destination ID does not match SSID\n");
1930         }
1931         s->sdid = val & 0xf;
1932         break;
1933     case 0x07: /* GPREG0 */
1934         break;
1935     case 0x08: /* SFBR */
1936         /* The CPU is not allowed to write to this register.  However the
1937            SCRIPTS register move instructions are.  */
1938         s->sfbr = val;
1939         break;
1940     case 0x0a: case 0x0b:
1941         /* Openserver writes to these readonly registers on startup */
1942         return;
1943     case 0x0c: case 0x0d: case 0x0e: case 0x0f:
1944         /* Linux writes to these readonly registers on startup.  */
1945         return;
1946     CASE_SET_REG32(dsa, 0x10)
1947     case 0x14: /* ISTAT0 */
1948         s->istat0 = (s->istat0 & 0x0f) | (val & 0xf0);
1949         if (val & LSI_ISTAT0_ABRT) {
1950             lsi_script_dma_interrupt(s, LSI_DSTAT_ABRT);
1951         }
1952         if (val & LSI_ISTAT0_INTF) {
1953             s->istat0 &= ~LSI_ISTAT0_INTF;
1954             lsi_update_irq(s);
1955         }
1956         if (s->waiting == LSI_WAIT_RESELECT && val & LSI_ISTAT0_SIGP) {
1957             trace_lsi_awoken();
1958             s->waiting = LSI_NOWAIT;
1959             s->dsp = s->dnad;
1960             lsi_execute_script(s);
1961         }
1962         if (val & LSI_ISTAT0_SRST) {
1963             device_cold_reset(DEVICE(s));
1964         }
1965         break;
1966     case 0x16: /* MBOX0 */
1967         s->mbox0 = val;
1968         break;
1969     case 0x17: /* MBOX1 */
1970         s->mbox1 = val;
1971         break;
1972     case 0x18: /* CTEST0 */
1973         /* nothing to do */
1974         break;
1975     case 0x1a: /* CTEST2 */
1976         s->ctest2 = val & LSI_CTEST2_PCICIE;
1977         break;
1978     case 0x1b: /* CTEST3 */
1979         s->ctest3 = val & 0x0f;
1980         break;
1981     CASE_SET_REG32(temp, 0x1c)
1982     case 0x21: /* CTEST4 */
1983         if (val & 7) {
1984             qemu_log_mask(LOG_UNIMP,
1985                           "lsi_scsi: Unimplemented CTEST4-FBL 0x%x\n", val);
1986         }
1987         s->ctest4 = val;
1988         break;
1989     case 0x22: /* CTEST5 */
1990         if (val & (LSI_CTEST5_ADCK | LSI_CTEST5_BBCK)) {
1991             qemu_log_mask(LOG_UNIMP,
1992                           "lsi_scsi: CTEST5 DMA increment not implemented\n");
1993         }
1994         s->ctest5 = val;
1995         break;
1996     CASE_SET_REG24(dbc, 0x24)
1997     CASE_SET_REG32(dnad, 0x28)
1998     case 0x2c: /* DSP[0:7] */
1999         s->dsp &= 0xffffff00;
2000         s->dsp |= val;
2001         break;
2002     case 0x2d: /* DSP[8:15] */
2003         s->dsp &= 0xffff00ff;
2004         s->dsp |= val << 8;
2005         break;
2006     case 0x2e: /* DSP[16:23] */
2007         s->dsp &= 0xff00ffff;
2008         s->dsp |= val << 16;
2009         break;
2010     case 0x2f: /* DSP[24:31] */
2011         s->dsp &= 0x00ffffff;
2012         s->dsp |= val << 24;
2013         /*
2014          * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
2015          * instruction.  Is this correct?
2016          */
2017         if ((s->dmode & LSI_DMODE_MAN) == 0
2018             && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
2019             lsi_execute_script(s);
2020         break;
2021     CASE_SET_REG32(dsps, 0x30)
2022     CASE_SET_REG32(scratch[0], 0x34)
2023     case 0x38: /* DMODE */
2024         s->dmode = val;
2025         break;
2026     case 0x39: /* DIEN */
2027         s->dien = val;
2028         lsi_update_irq(s);
2029         break;
2030     case 0x3a: /* SBR */
2031         s->sbr = val;
2032         break;
2033     case 0x3b: /* DCNTL */
2034         s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
2035         /*
2036          * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
2037          * instruction.  Is this correct?
2038          */
2039         if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
2040             lsi_execute_script(s);
2041         break;
2042     case 0x40: /* SIEN0 */
2043         s->sien0 = val;
2044         lsi_update_irq(s);
2045         break;
2046     case 0x41: /* SIEN1 */
2047         s->sien1 = val;
2048         lsi_update_irq(s);
2049         break;
2050     case 0x47: /* GPCNTL0 */
2051         break;
2052     case 0x48: /* STIME0 */
2053         s->stime0 = val;
2054         break;
2055     case 0x49: /* STIME1 */
2056         if (val & 0xf) {
2057             qemu_log_mask(LOG_UNIMP,
2058                           "lsi_scsi: General purpose timer not implemented\n");
2059             /* ??? Raising the interrupt immediately seems to be sufficient
2060                to keep the FreeBSD driver happy.  */
2061             lsi_script_scsi_interrupt(s, 0, LSI_SIST1_GEN);
2062         }
2063         break;
2064     case 0x4a: /* RESPID0 */
2065         s->respid0 = val;
2066         break;
2067     case 0x4b: /* RESPID1 */
2068         s->respid1 = val;
2069         break;
2070     case 0x4d: /* STEST1 */
2071         s->stest1 = val;
2072         break;
2073     case 0x4e: /* STEST2 */
2074         if (val & 1) {
2075             qemu_log_mask(LOG_UNIMP,
2076                           "lsi_scsi: Low level mode not implemented\n");
2077         }
2078         s->stest2 = val;
2079         break;
2080     case 0x4f: /* STEST3 */
2081         if (val & 0x41) {
2082             qemu_log_mask(LOG_UNIMP,
2083                           "lsi_scsi: SCSI FIFO test mode not implemented\n");
2084         }
2085         s->stest3 = val;
2086         break;
2087     case 0x56: /* CCNTL0 */
2088         s->ccntl0 = val;
2089         break;
2090     case 0x57: /* CCNTL1 */
2091         s->ccntl1 = val;
2092         break;
2093     CASE_SET_REG32(mmrs, 0xa0)
2094     CASE_SET_REG32(mmws, 0xa4)
2095     CASE_SET_REG32(sfs, 0xa8)
2096     CASE_SET_REG32(drs, 0xac)
2097     CASE_SET_REG32(sbms, 0xb0)
2098     CASE_SET_REG32(dbms, 0xb4)
2099     CASE_SET_REG32(dnad64, 0xb8)
2100     CASE_SET_REG32(pmjad1, 0xc0)
2101     CASE_SET_REG32(pmjad2, 0xc4)
2102     CASE_SET_REG32(rbc, 0xc8)
2103     CASE_SET_REG32(ua, 0xcc)
2104     CASE_SET_REG32(ia, 0xd4)
2105     CASE_SET_REG32(sbc, 0xd8)
2106     CASE_SET_REG32(csbc, 0xdc)
2107     default:
2108         if (offset >= 0x5c && offset < 0xa0) {
2109             int n;
2110             int shift;
2111             n = (offset - 0x58) >> 2;
2112             shift = (offset & 3) * 8;
2113             s->scratch[n] = deposit32(s->scratch[n], shift, 8, val);
2114         } else {
2115             qemu_log_mask(LOG_GUEST_ERROR,
2116                           "lsi_scsi: invalid write to reg %s %x (0x%02x)\n",
2117                           offset < ARRAY_SIZE(names) ? names[offset] : "???",
2118                           offset, val);
2119         }
2120     }
2121 #undef CASE_SET_REG24
2122 #undef CASE_SET_REG32
2123 }
2124
2125 static void lsi_mmio_write(void *opaque, hwaddr addr,
2126                            uint64_t val, unsigned size)
2127 {
2128     LSIState *s = opaque;
2129
2130     lsi_reg_writeb(s, addr & 0xff, val);
2131 }
2132
2133 static uint64_t lsi_mmio_read(void *opaque, hwaddr addr,
2134                               unsigned size)
2135 {
2136     LSIState *s = opaque;
2137     return lsi_reg_readb(s, addr & 0xff);
2138 }
2139
2140 static const MemoryRegionOps lsi_mmio_ops = {
2141     .read = lsi_mmio_read,
2142     .write = lsi_mmio_write,
2143     .endianness = DEVICE_LITTLE_ENDIAN,
2144     .impl = {
2145         .min_access_size = 1,
2146         .max_access_size = 1,
2147     },
2148 };
2149
2150 static void lsi_ram_write(void *opaque, hwaddr addr,
2151                           uint64_t val, unsigned size)
2152 {
2153     LSIState *s = opaque;
2154     stn_le_p(s->script_ram + addr, size, val);
2155 }
2156
2157 static uint64_t lsi_ram_read(void *opaque, hwaddr addr,
2158                              unsigned size)
2159 {
2160     LSIState *s = opaque;
2161     return ldn_le_p(s->script_ram + addr, size);
2162 }
2163
2164 static const MemoryRegionOps lsi_ram_ops = {
2165     .read = lsi_ram_read,
2166     .write = lsi_ram_write,
2167     .endianness = DEVICE_LITTLE_ENDIAN,
2168 };
2169
2170 static uint64_t lsi_io_read(void *opaque, hwaddr addr,
2171                             unsigned size)
2172 {
2173     LSIState *s = opaque;
2174     return lsi_reg_readb(s, addr & 0xff);
2175 }
2176
2177 static void lsi_io_write(void *opaque, hwaddr addr,
2178                          uint64_t val, unsigned size)
2179 {
2180     LSIState *s = opaque;
2181     lsi_reg_writeb(s, addr & 0xff, val);
2182 }
2183
2184 static const MemoryRegionOps lsi_io_ops = {
2185     .read = lsi_io_read,
2186     .write = lsi_io_write,
2187     .endianness = DEVICE_LITTLE_ENDIAN,
2188     .impl = {
2189         .min_access_size = 1,
2190         .max_access_size = 1,
2191     },
2192 };
2193
2194 static void lsi_scsi_reset(DeviceState *dev)
2195 {
2196     LSIState *s = LSI53C895A(dev);
2197
2198     lsi_soft_reset(s);
2199 }
2200
2201 static int lsi_pre_save(void *opaque)
2202 {
2203     LSIState *s = opaque;
2204
2205     if (s->current) {
2206         assert(s->current->dma_buf == NULL);
2207         assert(s->current->dma_len == 0);
2208     }
2209     assert(QTAILQ_EMPTY(&s->queue));
2210
2211     return 0;
2212 }
2213
2214 static int lsi_post_load(void *opaque, int version_id)
2215 {
2216     LSIState *s = opaque;
2217
2218     if (s->msg_len < 0 || s->msg_len > LSI_MAX_MSGIN_LEN) {
2219         return -EINVAL;
2220     }
2221
2222     if (s->waiting == LSI_WAIT_SCRIPTS) {
2223         lsi_scripts_timer_start(s);
2224     }
2225     return 0;
2226 }
2227
2228 static const VMStateDescription vmstate_lsi_scsi = {
2229     .name = "lsiscsi",
2230     .version_id = 1,
2231     .minimum_version_id = 0,
2232     .pre_save = lsi_pre_save,
2233     .post_load = lsi_post_load,
2234     .fields = (const VMStateField[]) {
2235         VMSTATE_PCI_DEVICE(parent_obj, LSIState),
2236
2237         VMSTATE_INT32(carry, LSIState),
2238         VMSTATE_INT32(status, LSIState),
2239         VMSTATE_INT32(msg_action, LSIState),
2240         VMSTATE_INT32(msg_len, LSIState),
2241         VMSTATE_BUFFER(msg, LSIState),
2242         VMSTATE_INT32(waiting, LSIState),
2243
2244         VMSTATE_UINT32(dsa, LSIState),
2245         VMSTATE_UINT32(temp, LSIState),
2246         VMSTATE_UINT32(dnad, LSIState),
2247         VMSTATE_UINT32(dbc, LSIState),
2248         VMSTATE_UINT8(istat0, LSIState),
2249         VMSTATE_UINT8(istat1, LSIState),
2250         VMSTATE_UINT8(dcmd, LSIState),
2251         VMSTATE_UINT8(dstat, LSIState),
2252         VMSTATE_UINT8(dien, LSIState),
2253         VMSTATE_UINT8(sist0, LSIState),
2254         VMSTATE_UINT8(sist1, LSIState),
2255         VMSTATE_UINT8(sien0, LSIState),
2256         VMSTATE_UINT8(sien1, LSIState),
2257         VMSTATE_UINT8(mbox0, LSIState),
2258         VMSTATE_UINT8(mbox1, LSIState),
2259         VMSTATE_UINT8(dfifo, LSIState),
2260         VMSTATE_UINT8(ctest2, LSIState),
2261         VMSTATE_UINT8(ctest3, LSIState),
2262         VMSTATE_UINT8(ctest4, LSIState),
2263         VMSTATE_UINT8(ctest5, LSIState),
2264         VMSTATE_UINT8(ccntl0, LSIState),
2265         VMSTATE_UINT8(ccntl1, LSIState),
2266         VMSTATE_UINT32(dsp, LSIState),
2267         VMSTATE_UINT32(dsps, LSIState),
2268         VMSTATE_UINT8(dmode, LSIState),
2269         VMSTATE_UINT8(dcntl, LSIState),
2270         VMSTATE_UINT8(scntl0, LSIState),
2271         VMSTATE_UINT8(scntl1, LSIState),
2272         VMSTATE_UINT8(scntl2, LSIState),
2273         VMSTATE_UINT8(scntl3, LSIState),
2274         VMSTATE_UINT8(sstat0, LSIState),
2275         VMSTATE_UINT8(sstat1, LSIState),
2276         VMSTATE_UINT8(scid, LSIState),
2277         VMSTATE_UINT8(sxfer, LSIState),
2278         VMSTATE_UINT8(socl, LSIState),
2279         VMSTATE_UINT8(sdid, LSIState),
2280         VMSTATE_UINT8(ssid, LSIState),
2281         VMSTATE_UINT8(sfbr, LSIState),
2282         VMSTATE_UINT8(stest1, LSIState),
2283         VMSTATE_UINT8(stest2, LSIState),
2284         VMSTATE_UINT8(stest3, LSIState),
2285         VMSTATE_UINT8(sidl, LSIState),
2286         VMSTATE_UINT8(stime0, LSIState),
2287         VMSTATE_UINT8(respid0, LSIState),
2288         VMSTATE_UINT8(respid1, LSIState),
2289         VMSTATE_UINT8_V(sbcl, LSIState, 1),
2290         VMSTATE_UINT32(mmrs, LSIState),
2291         VMSTATE_UINT32(mmws, LSIState),
2292         VMSTATE_UINT32(sfs, LSIState),
2293         VMSTATE_UINT32(drs, LSIState),
2294         VMSTATE_UINT32(sbms, LSIState),
2295         VMSTATE_UINT32(dbms, LSIState),
2296         VMSTATE_UINT32(dnad64, LSIState),
2297         VMSTATE_UINT32(pmjad1, LSIState),
2298         VMSTATE_UINT32(pmjad2, LSIState),
2299         VMSTATE_UINT32(rbc, LSIState),
2300         VMSTATE_UINT32(ua, LSIState),
2301         VMSTATE_UINT32(ia, LSIState),
2302         VMSTATE_UINT32(sbc, LSIState),
2303         VMSTATE_UINT32(csbc, LSIState),
2304         VMSTATE_BUFFER_UNSAFE(scratch, LSIState, 0, 18 * sizeof(uint32_t)),
2305         VMSTATE_UINT8(sbr, LSIState),
2306
2307         VMSTATE_BUFFER_UNSAFE(script_ram, LSIState, 0, 8192),
2308         VMSTATE_END_OF_LIST()
2309     }
2310 };
2311
2312 static const struct SCSIBusInfo lsi_scsi_info = {
2313     .tcq = true,
2314     .max_target = LSI_MAX_DEVS,
2315     .max_lun = 0,  /* LUN support is buggy */
2316
2317     .transfer_data = lsi_transfer_data,
2318     .complete = lsi_command_complete,
2319     .cancel = lsi_request_cancelled
2320 };
2321
2322 static void scripts_timer_cb(void *opaque)
2323 {
2324     LSIState *s = opaque;
2325
2326     trace_lsi_scripts_timer_triggered();
2327     s->waiting = LSI_NOWAIT;
2328     lsi_execute_script(s);
2329 }
2330
2331 static void lsi_scsi_realize(PCIDevice *dev, Error **errp)
2332 {
2333     LSIState *s = LSI53C895A(dev);
2334     DeviceState *d = DEVICE(dev);
2335     uint8_t *pci_conf;
2336
2337     pci_conf = dev->config;
2338
2339     /* PCI latency timer = 255 */
2340     pci_conf[PCI_LATENCY_TIMER] = 0xff;
2341     /* Interrupt pin A */
2342     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2343
2344     memory_region_init_io(&s->mmio_io, OBJECT(s), &lsi_mmio_ops, s,
2345                           "lsi-mmio", 0x400);
2346     memory_region_init_io(&s->ram_io, OBJECT(s), &lsi_ram_ops, s,
2347                           "lsi-ram", 0x2000);
2348     memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
2349                           "lsi-io", 256);
2350     s->scripts_timer = timer_new_us(QEMU_CLOCK_VIRTUAL, scripts_timer_cb, s);
2351
2352     /*
2353      * Since we use the address-space API to interact with ram_io, disable the
2354      * re-entrancy guard.
2355      */
2356     s->ram_io.disable_reentrancy_guard = true;
2357     s->mmio_io.disable_reentrancy_guard = true;
2358
2359     address_space_init(&s->pci_io_as, pci_address_space_io(dev), "lsi-pci-io");
2360     qdev_init_gpio_out(d, &s->ext_irq, 1);
2361
2362     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io_io);
2363     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->mmio_io);
2364     pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->ram_io);
2365     QTAILQ_INIT(&s->queue);
2366
2367     scsi_bus_init(&s->bus, sizeof(s->bus), d, &lsi_scsi_info);
2368 }
2369
2370 static void lsi_scsi_exit(PCIDevice *dev)
2371 {
2372     LSIState *s = LSI53C895A(dev);
2373
2374     address_space_destroy(&s->pci_io_as);
2375     timer_del(s->scripts_timer);
2376 }
2377
2378 static void lsi_class_init(ObjectClass *klass, void *data)
2379 {
2380     DeviceClass *dc = DEVICE_CLASS(klass);
2381     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2382
2383     k->realize = lsi_scsi_realize;
2384     k->exit = lsi_scsi_exit;
2385     k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2386     k->device_id = PCI_DEVICE_ID_LSI_53C895A;
2387     k->class_id = PCI_CLASS_STORAGE_SCSI;
2388     k->subsystem_id = 0x1000;
2389     dc->reset = lsi_scsi_reset;
2390     dc->vmsd = &vmstate_lsi_scsi;
2391     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2392 }
2393
2394 static const TypeInfo lsi_info = {
2395     .name          = TYPE_LSI53C895A,
2396     .parent        = TYPE_PCI_DEVICE,
2397     .instance_size = sizeof(LSIState),
2398     .class_init    = lsi_class_init,
2399     .interfaces = (InterfaceInfo[]) {
2400         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2401         { },
2402     },
2403 };
2404
2405 static void lsi53c810_class_init(ObjectClass *klass, void *data)
2406 {
2407     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
2408
2409     k->device_id = PCI_DEVICE_ID_LSI_53C810;
2410 }
2411
2412 static const TypeInfo lsi53c810_info = {
2413     .name          = TYPE_LSI53C810,
2414     .parent        = TYPE_LSI53C895A,
2415     .class_init    = lsi53c810_class_init,
2416 };
2417
2418 static void lsi53c895a_register_types(void)
2419 {
2420     type_register_static(&lsi_info);
2421     type_register_static(&lsi53c810_info);
2422 }
2423
2424 type_init(lsi53c895a_register_types)
2425
2426 void lsi53c8xx_handle_legacy_cmdline(DeviceState *lsi_dev)
2427 {
2428     LSIState *s = LSI53C895A(lsi_dev);
2429
2430     scsi_bus_legacy_handle_cmdline(&s->bus);
2431 }