2 * QEMU ESP/NCR53C9x emulation
4 * Copyright (c) 2005-2006 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 #include "scsi-disk.h"
28 /* FIXME: Only needed for MAX_DISKS, which is probably wrong. */
35 * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O), also
36 * produced as NCR89C100. See
37 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
39 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
43 #define DPRINTF(fmt, args...) \
44 do { printf("ESP: " fmt , ##args); } while (0)
46 #define DPRINTF(fmt, args...)
51 #define ESP_SIZE (ESP_REGS * 4)
53 /* The HBA is ID 7, so for simplicitly limit to 7 devices. */
54 #define ESP_MAX_DEVS 7
56 typedef struct ESPState ESPState;
60 BlockDriverState **bd;
61 uint8_t rregs[ESP_REGS];
62 uint8_t wregs[ESP_REGS];
64 uint32_t ti_rptr, ti_wptr;
65 uint8_t ti_buf[TI_BUFSZ];
68 SCSIDevice *scsi_dev[MAX_DISKS];
69 SCSIDevice *current_dev;
70 uint8_t cmdbuf[TI_BUFSZ];
74 /* The amount of data left in the current DMA transfer. */
76 /* The size of the current DMA transfer. Zero if no transfer is in
104 static int get_cmd(ESPState *s, uint8_t *buf)
109 dmalen = s->rregs[0] | (s->rregs[1] << 8);
110 target = s->wregs[4] & 7;
111 DPRINTF("get_cmd: len %d target %d\n", dmalen, target);
113 espdma_memory_read(s->dma_opaque, buf, dmalen);
116 memcpy(&buf[1], s->ti_buf, dmalen);
124 if (s->current_dev) {
125 /* Started a new command before the old one finished. Cancel it. */
126 scsi_cancel_io(s->current_dev, 0);
130 if (target >= MAX_DISKS || !s->scsi_dev[target]) {
132 s->rregs[4] = STAT_IN;
133 s->rregs[5] = INTR_DC;
135 qemu_irq_raise(s->irq);
138 s->current_dev = s->scsi_dev[target];
142 static void do_cmd(ESPState *s, uint8_t *buf)
147 DPRINTF("do_cmd: busid 0x%x\n", buf[0]);
149 datalen = scsi_send_command(s->current_dev, 0, &buf[1], lun);
150 s->ti_size = datalen;
152 s->rregs[4] = STAT_IN | STAT_TC;
156 s->rregs[4] |= STAT_DI;
157 scsi_read_data(s->current_dev, 0);
159 s->rregs[4] |= STAT_DO;
160 scsi_write_data(s->current_dev, 0);
163 s->rregs[5] = INTR_BS | INTR_FC;
164 s->rregs[6] = SEQ_CD;
165 qemu_irq_raise(s->irq);
168 static void handle_satn(ESPState *s)
173 len = get_cmd(s, buf);
178 static void handle_satn_stop(ESPState *s)
180 s->cmdlen = get_cmd(s, s->cmdbuf);
182 DPRINTF("Set ATN & Stop: cmdlen %d\n", s->cmdlen);
184 s->rregs[4] = STAT_IN | STAT_TC | STAT_CD;
185 s->rregs[5] = INTR_BS | INTR_FC;
186 s->rregs[6] = SEQ_CD;
187 qemu_irq_raise(s->irq);
191 static void write_response(ESPState *s)
193 DPRINTF("Transfer status (sense=%d)\n", s->sense);
194 s->ti_buf[0] = s->sense;
197 espdma_memory_write(s->dma_opaque, s->ti_buf, 2);
198 s->rregs[4] = STAT_IN | STAT_TC | STAT_ST;
199 s->rregs[5] = INTR_BS | INTR_FC;
200 s->rregs[6] = SEQ_CD;
207 qemu_irq_raise(s->irq);
210 static void esp_dma_done(ESPState *s)
212 s->rregs[4] |= STAT_IN | STAT_TC;
213 s->rregs[5] = INTR_BS;
218 qemu_irq_raise(s->irq);
221 static void esp_do_dma(ESPState *s)
226 to_device = (s->ti_size < 0);
229 DPRINTF("command len %d + %d\n", s->cmdlen, len);
230 espdma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
234 do_cmd(s, s->cmdbuf);
237 if (s->async_len == 0) {
238 /* Defer until data is available. */
241 if (len > s->async_len) {
245 espdma_memory_read(s->dma_opaque, s->async_buf, len);
247 espdma_memory_write(s->dma_opaque, s->async_buf, len);
256 if (s->async_len == 0) {
258 // ti_size is negative
259 scsi_write_data(s->current_dev, 0);
261 scsi_read_data(s->current_dev, 0);
262 /* If there is still data to be read from the device then
263 complete the DMA operation immeriately. Otherwise defer
264 until the scsi layer has completed. */
265 if (s->dma_left == 0 && s->ti_size > 0) {
270 /* Partially filled a scsi buffer. Complete immediately. */
275 static void esp_command_complete(void *opaque, int reason, uint32_t tag,
278 ESPState *s = (ESPState *)opaque;
280 if (reason == SCSI_REASON_DONE) {
281 DPRINTF("SCSI Command complete\n");
283 DPRINTF("SCSI command completed unexpectedly\n");
288 DPRINTF("Command failed\n");
290 s->rregs[4] = STAT_ST;
292 s->current_dev = NULL;
294 DPRINTF("transfer %d/%d\n", s->dma_left, s->ti_size);
296 s->async_buf = scsi_get_buf(s->current_dev, 0);
299 } else if (s->dma_counter != 0 && s->ti_size <= 0) {
300 /* If this was the last part of a DMA transfer then the
301 completion interrupt is deferred to here. */
307 static void handle_ti(ESPState *s)
309 uint32_t dmalen, minlen;
311 dmalen = s->rregs[0] | (s->rregs[1] << 8);
315 s->dma_counter = dmalen;
318 minlen = (dmalen < 32) ? dmalen : 32;
319 else if (s->ti_size < 0)
320 minlen = (dmalen < -s->ti_size) ? dmalen : -s->ti_size;
322 minlen = (dmalen < s->ti_size) ? dmalen : s->ti_size;
323 DPRINTF("Transfer Information len %d\n", minlen);
325 s->dma_left = minlen;
326 s->rregs[4] &= ~STAT_TC;
328 } else if (s->do_cmd) {
329 DPRINTF("command len %d\n", s->cmdlen);
333 do_cmd(s, s->cmdbuf);
338 static void esp_reset(void *opaque)
340 ESPState *s = opaque;
342 memset(s->rregs, 0, ESP_REGS);
343 memset(s->wregs, 0, ESP_REGS);
344 s->rregs[0x0e] = 0x4; // Indicate fas100a
352 static void parent_esp_reset(void *opaque, int irq, int level)
358 static uint32_t esp_mem_readb(void *opaque, target_phys_addr_t addr)
360 ESPState *s = opaque;
363 saddr = (addr & ESP_MASK) >> 2;
364 DPRINTF("read reg[%d]: 0x%2.2x\n", saddr, s->rregs[saddr]);
368 if (s->ti_size > 0) {
370 if ((s->rregs[4] & 6) == 0) {
372 fprintf(stderr, "esp: PIO data read not implemented\n");
375 s->rregs[2] = s->ti_buf[s->ti_rptr++];
377 qemu_irq_raise(s->irq);
379 if (s->ti_size == 0) {
386 // Clear interrupt/error status bits
387 s->rregs[4] &= ~(STAT_IN | STAT_GE | STAT_PE);
388 qemu_irq_lower(s->irq);
393 return s->rregs[saddr];
396 static void esp_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
398 ESPState *s = opaque;
401 saddr = (addr & ESP_MASK) >> 2;
402 DPRINTF("write reg[%d]: 0x%2.2x -> 0x%2.2x\n", saddr, s->wregs[saddr], val);
406 s->rregs[4] &= ~STAT_TC;
411 s->cmdbuf[s->cmdlen++] = val & 0xff;
412 } else if ((s->rregs[4] & 6) == 0) {
416 fprintf(stderr, "esp: PIO data write not implemented\n");
419 s->ti_buf[s->ti_wptr++] = val & 0xff;
423 s->rregs[saddr] = val;
427 /* Reload DMA counter. */
428 s->rregs[0] = s->wregs[0];
429 s->rregs[1] = s->wregs[1];
435 DPRINTF("NOP (%2.2x)\n", val);
438 DPRINTF("Flush FIFO (%2.2x)\n", val);
440 s->rregs[5] = INTR_FC;
444 DPRINTF("Chip reset (%2.2x)\n", val);
448 DPRINTF("Bus reset (%2.2x)\n", val);
449 s->rregs[5] = INTR_RST;
450 if (!(s->wregs[8] & 0x40)) {
451 qemu_irq_raise(s->irq);
458 DPRINTF("Initiator Command Complete Sequence (%2.2x)\n", val);
462 DPRINTF("Message Accepted (%2.2x)\n", val);
464 s->rregs[5] = INTR_DC;
468 DPRINTF("Set ATN (%2.2x)\n", val);
471 DPRINTF("Set ATN (%2.2x)\n", val);
475 DPRINTF("Set ATN & stop (%2.2x)\n", val);
479 DPRINTF("Enable selection (%2.2x)\n", val);
482 DPRINTF("Unhandled ESP command (%2.2x)\n", val);
489 s->rregs[saddr] = val;
494 s->rregs[saddr] = val & 0x15;
497 s->rregs[saddr] = val;
502 s->wregs[saddr] = val;
505 static CPUReadMemoryFunc *esp_mem_read[3] = {
511 static CPUWriteMemoryFunc *esp_mem_write[3] = {
517 static void esp_save(QEMUFile *f, void *opaque)
519 ESPState *s = opaque;
521 qemu_put_buffer(f, s->rregs, ESP_REGS);
522 qemu_put_buffer(f, s->wregs, ESP_REGS);
523 qemu_put_be32s(f, &s->ti_size);
524 qemu_put_be32s(f, &s->ti_rptr);
525 qemu_put_be32s(f, &s->ti_wptr);
526 qemu_put_buffer(f, s->ti_buf, TI_BUFSZ);
527 qemu_put_be32s(f, &s->sense);
528 qemu_put_be32s(f, &s->dma);
529 qemu_put_buffer(f, s->cmdbuf, TI_BUFSZ);
530 qemu_put_be32s(f, &s->cmdlen);
531 qemu_put_be32s(f, &s->do_cmd);
532 qemu_put_be32s(f, &s->dma_left);
533 // There should be no transfers in progress, so dma_counter is not saved
536 static int esp_load(QEMUFile *f, void *opaque, int version_id)
538 ESPState *s = opaque;
541 return -EINVAL; // Cannot emulate 2
543 qemu_get_buffer(f, s->rregs, ESP_REGS);
544 qemu_get_buffer(f, s->wregs, ESP_REGS);
545 qemu_get_be32s(f, &s->ti_size);
546 qemu_get_be32s(f, &s->ti_rptr);
547 qemu_get_be32s(f, &s->ti_wptr);
548 qemu_get_buffer(f, s->ti_buf, TI_BUFSZ);
549 qemu_get_be32s(f, &s->sense);
550 qemu_get_be32s(f, &s->dma);
551 qemu_get_buffer(f, s->cmdbuf, TI_BUFSZ);
552 qemu_get_be32s(f, &s->cmdlen);
553 qemu_get_be32s(f, &s->do_cmd);
554 qemu_get_be32s(f, &s->dma_left);
559 void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id)
561 ESPState *s = (ESPState *)opaque;
564 for (id = 0; id < ESP_MAX_DEVS; id++) {
565 if (s->scsi_dev[id] == NULL)
569 if (id >= ESP_MAX_DEVS) {
570 DPRINTF("Bad Device ID %d\n", id);
573 if (s->scsi_dev[id]) {
574 DPRINTF("Destroying device %d\n", id);
575 scsi_disk_destroy(s->scsi_dev[id]);
577 DPRINTF("Attaching block device %d\n", id);
578 /* Command queueing is not implemented. */
579 s->scsi_dev[id] = scsi_disk_init(bd, 0, esp_command_complete, s);
582 void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
583 void *dma_opaque, qemu_irq irq, qemu_irq *reset)
588 s = qemu_mallocz(sizeof(ESPState));
594 s->dma_opaque = dma_opaque;
596 esp_io_memory = cpu_register_io_memory(0, esp_mem_read, esp_mem_write, s);
597 cpu_register_physical_memory(espaddr, ESP_SIZE, esp_io_memory);
601 register_savevm("esp", espaddr, 3, esp_save, esp_load, s);
602 qemu_register_reset(esp_reset, s);
604 *reset = *qemu_allocate_irqs(parent_esp_reset, s, 1);