2 * QEMU ESP/NCR53C9x emulation
4 * Copyright (c) 2005-2006 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26 #include "scsi-disk.h"
33 * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
34 * also produced as NCR89C100. See
35 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
37 * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
41 #define DPRINTF(fmt, ...) \
42 do { printf("ESP: " fmt , ## __VA_ARGS__); } while (0)
44 #define DPRINTF(fmt, ...) do {} while (0)
47 #define ESP_ERROR(fmt, ...) \
48 do { printf("ESP ERROR: %s: " fmt, __func__ , ## __VA_ARGS__); } while (0)
53 typedef struct ESPState ESPState
;
59 uint8_t rregs
[ESP_REGS
];
60 uint8_t wregs
[ESP_REGS
];
62 uint32_t ti_rptr
, ti_wptr
;
63 uint8_t ti_buf
[TI_BUFSZ
];
66 SCSIDevice
*scsi_dev
[ESP_MAX_DEVS
];
67 SCSIDevice
*current_dev
;
68 uint8_t cmdbuf
[TI_BUFSZ
];
72 /* The amount of data left in the current DMA transfer. */
74 /* The size of the current DMA transfer. Zero if no transfer is in
80 espdma_memory_read_write dma_memory_read
;
81 espdma_memory_read_write dma_memory_write
;
90 #define ESP_WBUSID 0x4
94 #define ESP_WSYNTP 0x6
95 #define ESP_RFLAGS 0x7
100 #define ESP_RRES2 0xa
101 #define ESP_WTEST 0xa
112 #define CMD_FLUSH 0x01
113 #define CMD_RESET 0x02
114 #define CMD_BUSRESET 0x03
116 #define CMD_ICCS 0x11
117 #define CMD_MSGACC 0x12
118 #define CMD_SATN 0x1a
120 #define CMD_SELATN 0x42
121 #define CMD_SELATNS 0x43
122 #define CMD_ENSEL 0x44
130 #define STAT_PIO_MASK 0x06
135 #define STAT_INT 0x80
137 #define BUSID_DID 0x07
142 #define INTR_RST 0x80
147 #define CFG1_RESREPT 0x40
149 #define TCHI_FAS100A 0x4
151 static void esp_raise_irq(ESPState
*s
)
153 if (!(s
->rregs
[ESP_RSTAT
] & STAT_INT
)) {
154 s
->rregs
[ESP_RSTAT
] |= STAT_INT
;
155 qemu_irq_raise(s
->irq
);
159 static void esp_lower_irq(ESPState
*s
)
161 if (s
->rregs
[ESP_RSTAT
] & STAT_INT
) {
162 s
->rregs
[ESP_RSTAT
] &= ~STAT_INT
;
163 qemu_irq_lower(s
->irq
);
167 static uint32_t get_cmd(ESPState
*s
, uint8_t *buf
)
172 target
= s
->wregs
[ESP_WBUSID
] & BUSID_DID
;
174 dmalen
= s
->rregs
[ESP_TCLO
] | (s
->rregs
[ESP_TCMID
] << 8);
175 s
->dma_memory_read(s
->dma_opaque
, buf
, dmalen
);
178 memcpy(buf
, s
->ti_buf
, dmalen
);
181 DPRINTF("get_cmd: len %d target %d\n", dmalen
, target
);
187 if (s
->current_dev
) {
188 /* Started a new command before the old one finished. Cancel it. */
189 s
->current_dev
->cancel_io(s
->current_dev
, 0);
193 if (target
>= ESP_MAX_DEVS
|| !s
->scsi_dev
[target
]) {
195 s
->rregs
[ESP_RSTAT
] = 0;
196 s
->rregs
[ESP_RINTR
] = INTR_DC
;
197 s
->rregs
[ESP_RSEQ
] = SEQ_0
;
201 s
->current_dev
= s
->scsi_dev
[target
];
205 static void do_cmd(ESPState
*s
, uint8_t *buf
)
210 DPRINTF("do_cmd: busid 0x%x\n", buf
[0]);
212 datalen
= s
->current_dev
->send_command(s
->current_dev
, 0, &buf
[1], lun
);
213 s
->ti_size
= datalen
;
215 s
->rregs
[ESP_RSTAT
] = STAT_TC
;
219 s
->rregs
[ESP_RSTAT
] |= STAT_DI
;
220 s
->current_dev
->read_data(s
->current_dev
, 0);
222 s
->rregs
[ESP_RSTAT
] |= STAT_DO
;
223 s
->current_dev
->write_data(s
->current_dev
, 0);
226 s
->rregs
[ESP_RINTR
] = INTR_BS
| INTR_FC
;
227 s
->rregs
[ESP_RSEQ
] = SEQ_CD
;
231 static void handle_satn(ESPState
*s
)
236 len
= get_cmd(s
, buf
);
241 static void handle_satn_stop(ESPState
*s
)
243 s
->cmdlen
= get_cmd(s
, s
->cmdbuf
);
245 DPRINTF("Set ATN & Stop: cmdlen %d\n", s
->cmdlen
);
247 s
->rregs
[ESP_RSTAT
] = STAT_TC
| STAT_CD
;
248 s
->rregs
[ESP_RINTR
] = INTR_BS
| INTR_FC
;
249 s
->rregs
[ESP_RSEQ
] = SEQ_CD
;
254 static void write_response(ESPState
*s
)
256 DPRINTF("Transfer status (sense=%d)\n", s
->sense
);
257 s
->ti_buf
[0] = s
->sense
;
260 s
->dma_memory_write(s
->dma_opaque
, s
->ti_buf
, 2);
261 s
->rregs
[ESP_RSTAT
] = STAT_TC
| STAT_ST
;
262 s
->rregs
[ESP_RINTR
] = INTR_BS
| INTR_FC
;
263 s
->rregs
[ESP_RSEQ
] = SEQ_CD
;
268 s
->rregs
[ESP_RFLAGS
] = 2;
273 static void esp_dma_done(ESPState
*s
)
275 s
->rregs
[ESP_RSTAT
] |= STAT_TC
;
276 s
->rregs
[ESP_RINTR
] = INTR_BS
;
277 s
->rregs
[ESP_RSEQ
] = 0;
278 s
->rregs
[ESP_RFLAGS
] = 0;
279 s
->rregs
[ESP_TCLO
] = 0;
280 s
->rregs
[ESP_TCMID
] = 0;
284 static void esp_do_dma(ESPState
*s
)
289 to_device
= (s
->ti_size
< 0);
292 DPRINTF("command len %d + %d\n", s
->cmdlen
, len
);
293 s
->dma_memory_read(s
->dma_opaque
, &s
->cmdbuf
[s
->cmdlen
], len
);
297 do_cmd(s
, s
->cmdbuf
);
300 if (s
->async_len
== 0) {
301 /* Defer until data is available. */
304 if (len
> s
->async_len
) {
308 s
->dma_memory_read(s
->dma_opaque
, s
->async_buf
, len
);
310 s
->dma_memory_write(s
->dma_opaque
, s
->async_buf
, len
);
319 if (s
->async_len
== 0) {
321 // ti_size is negative
322 s
->current_dev
->write_data(s
->current_dev
, 0);
324 s
->current_dev
->read_data(s
->current_dev
, 0);
325 /* If there is still data to be read from the device then
326 complete the DMA operation immediately. Otherwise defer
327 until the scsi layer has completed. */
328 if (s
->dma_left
== 0 && s
->ti_size
> 0) {
333 /* Partially filled a scsi buffer. Complete immediately. */
338 static void esp_command_complete(void *opaque
, int reason
, uint32_t tag
,
341 ESPState
*s
= (ESPState
*)opaque
;
343 if (reason
== SCSI_REASON_DONE
) {
344 DPRINTF("SCSI Command complete\n");
346 DPRINTF("SCSI command completed unexpectedly\n");
351 DPRINTF("Command failed\n");
353 s
->rregs
[ESP_RSTAT
] = STAT_ST
;
355 s
->current_dev
= NULL
;
357 DPRINTF("transfer %d/%d\n", s
->dma_left
, s
->ti_size
);
359 s
->async_buf
= s
->current_dev
->get_buf(s
->current_dev
, 0);
362 } else if (s
->dma_counter
!= 0 && s
->ti_size
<= 0) {
363 /* If this was the last part of a DMA transfer then the
364 completion interrupt is deferred to here. */
370 static void handle_ti(ESPState
*s
)
372 uint32_t dmalen
, minlen
;
374 dmalen
= s
->rregs
[ESP_TCLO
] | (s
->rregs
[ESP_TCMID
] << 8);
378 s
->dma_counter
= dmalen
;
381 minlen
= (dmalen
< 32) ? dmalen
: 32;
382 else if (s
->ti_size
< 0)
383 minlen
= (dmalen
< -s
->ti_size
) ? dmalen
: -s
->ti_size
;
385 minlen
= (dmalen
< s
->ti_size
) ? dmalen
: s
->ti_size
;
386 DPRINTF("Transfer Information len %d\n", minlen
);
388 s
->dma_left
= minlen
;
389 s
->rregs
[ESP_RSTAT
] &= ~STAT_TC
;
391 } else if (s
->do_cmd
) {
392 DPRINTF("command len %d\n", s
->cmdlen
);
396 do_cmd(s
, s
->cmdbuf
);
401 static void esp_reset(void *opaque
)
403 ESPState
*s
= opaque
;
405 memset(s
->rregs
, 0, ESP_REGS
);
406 memset(s
->wregs
, 0, ESP_REGS
);
407 s
->rregs
[ESP_TCHI
] = TCHI_FAS100A
; // Indicate fas100a
414 s
->rregs
[ESP_CFG1
] = 7;
417 static void parent_esp_reset(void *opaque
, int irq
, int level
)
423 static uint32_t esp_mem_readb(void *opaque
, target_phys_addr_t addr
)
425 ESPState
*s
= opaque
;
426 uint32_t saddr
, old_val
;
428 saddr
= addr
>> s
->it_shift
;
429 DPRINTF("read reg[%d]: 0x%2.2x\n", saddr
, s
->rregs
[saddr
]);
432 if (s
->ti_size
> 0) {
434 if ((s
->rregs
[ESP_RSTAT
] & STAT_PIO_MASK
) == 0) {
436 ESP_ERROR("PIO data read not implemented\n");
437 s
->rregs
[ESP_FIFO
] = 0;
439 s
->rregs
[ESP_FIFO
] = s
->ti_buf
[s
->ti_rptr
++];
443 if (s
->ti_size
== 0) {
449 /* Clear sequence step, interrupt register and all status bits
451 old_val
= s
->rregs
[ESP_RINTR
];
452 s
->rregs
[ESP_RINTR
] = 0;
453 s
->rregs
[ESP_RSTAT
] &= ~STAT_TC
;
454 s
->rregs
[ESP_RSEQ
] = SEQ_CD
;
461 return s
->rregs
[saddr
];
464 static void esp_mem_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
466 ESPState
*s
= opaque
;
469 saddr
= addr
>> s
->it_shift
;
470 DPRINTF("write reg[%d]: 0x%2.2x -> 0x%2.2x\n", saddr
, s
->wregs
[saddr
],
475 s
->rregs
[ESP_RSTAT
] &= ~STAT_TC
;
479 s
->cmdbuf
[s
->cmdlen
++] = val
& 0xff;
480 } else if (s
->ti_size
== TI_BUFSZ
- 1) {
481 ESP_ERROR("fifo overrun\n");
484 s
->ti_buf
[s
->ti_wptr
++] = val
& 0xff;
488 s
->rregs
[saddr
] = val
;
491 /* Reload DMA counter. */
492 s
->rregs
[ESP_TCLO
] = s
->wregs
[ESP_TCLO
];
493 s
->rregs
[ESP_TCMID
] = s
->wregs
[ESP_TCMID
];
497 switch(val
& CMD_CMD
) {
499 DPRINTF("NOP (%2.2x)\n", val
);
502 DPRINTF("Flush FIFO (%2.2x)\n", val
);
504 s
->rregs
[ESP_RINTR
] = INTR_FC
;
505 s
->rregs
[ESP_RSEQ
] = 0;
506 s
->rregs
[ESP_RFLAGS
] = 0;
509 DPRINTF("Chip reset (%2.2x)\n", val
);
513 DPRINTF("Bus reset (%2.2x)\n", val
);
514 s
->rregs
[ESP_RINTR
] = INTR_RST
;
515 if (!(s
->wregs
[ESP_CFG1
] & CFG1_RESREPT
)) {
523 DPRINTF("Initiator Command Complete Sequence (%2.2x)\n", val
);
525 s
->rregs
[ESP_RINTR
] = INTR_FC
;
526 s
->rregs
[ESP_RSTAT
] |= STAT_MI
;
529 DPRINTF("Message Accepted (%2.2x)\n", val
);
531 s
->rregs
[ESP_RINTR
] = INTR_DC
;
532 s
->rregs
[ESP_RSEQ
] = 0;
535 DPRINTF("Set ATN (%2.2x)\n", val
);
538 DPRINTF("Select without ATN (%2.2x)\n", val
);
542 DPRINTF("Select with ATN (%2.2x)\n", val
);
546 DPRINTF("Select with ATN & stop (%2.2x)\n", val
);
550 DPRINTF("Enable selection (%2.2x)\n", val
);
551 s
->rregs
[ESP_RINTR
] = 0;
554 ESP_ERROR("Unhandled ESP command (%2.2x)\n", val
);
558 case ESP_WBUSID
... ESP_WSYNO
:
561 s
->rregs
[saddr
] = val
;
563 case ESP_WCCF
... ESP_WTEST
:
565 case ESP_CFG2
... ESP_RES4
:
566 s
->rregs
[saddr
] = val
;
569 ESP_ERROR("invalid write of 0x%02x at [0x%x]\n", val
, saddr
);
572 s
->wregs
[saddr
] = val
;
575 static CPUReadMemoryFunc
*esp_mem_read
[3] = {
581 static CPUWriteMemoryFunc
*esp_mem_write
[3] = {
587 static void esp_save(QEMUFile
*f
, void *opaque
)
589 ESPState
*s
= opaque
;
591 qemu_put_buffer(f
, s
->rregs
, ESP_REGS
);
592 qemu_put_buffer(f
, s
->wregs
, ESP_REGS
);
593 qemu_put_sbe32s(f
, &s
->ti_size
);
594 qemu_put_be32s(f
, &s
->ti_rptr
);
595 qemu_put_be32s(f
, &s
->ti_wptr
);
596 qemu_put_buffer(f
, s
->ti_buf
, TI_BUFSZ
);
597 qemu_put_be32s(f
, &s
->sense
);
598 qemu_put_be32s(f
, &s
->dma
);
599 qemu_put_buffer(f
, s
->cmdbuf
, TI_BUFSZ
);
600 qemu_put_be32s(f
, &s
->cmdlen
);
601 qemu_put_be32s(f
, &s
->do_cmd
);
602 qemu_put_be32s(f
, &s
->dma_left
);
603 // There should be no transfers in progress, so dma_counter is not saved
606 static int esp_load(QEMUFile
*f
, void *opaque
, int version_id
)
608 ESPState
*s
= opaque
;
611 return -EINVAL
; // Cannot emulate 2
613 qemu_get_buffer(f
, s
->rregs
, ESP_REGS
);
614 qemu_get_buffer(f
, s
->wregs
, ESP_REGS
);
615 qemu_get_sbe32s(f
, &s
->ti_size
);
616 qemu_get_be32s(f
, &s
->ti_rptr
);
617 qemu_get_be32s(f
, &s
->ti_wptr
);
618 qemu_get_buffer(f
, s
->ti_buf
, TI_BUFSZ
);
619 qemu_get_be32s(f
, &s
->sense
);
620 qemu_get_be32s(f
, &s
->dma
);
621 qemu_get_buffer(f
, s
->cmdbuf
, TI_BUFSZ
);
622 qemu_get_be32s(f
, &s
->cmdlen
);
623 qemu_get_be32s(f
, &s
->do_cmd
);
624 qemu_get_be32s(f
, &s
->dma_left
);
629 static void esp_scsi_attach(DeviceState
*host
, BlockDriverState
*bd
, int id
)
631 ESPState
*s
= FROM_SYSBUS(ESPState
, sysbus_from_qdev(host
));
634 for (id
= 0; id
< ESP_MAX_DEVS
; id
++) {
635 if (id
== (s
->rregs
[ESP_CFG1
] & 0x7))
637 if (s
->scsi_dev
[id
] == NULL
)
641 if (id
>= ESP_MAX_DEVS
) {
642 DPRINTF("Bad Device ID %d\n", id
);
645 if (s
->scsi_dev
[id
]) {
646 DPRINTF("Destroying device %d\n", id
);
647 s
->scsi_dev
[id
]->destroy(s
->scsi_dev
[id
]);
649 DPRINTF("Attaching block device %d\n", id
);
650 /* Command queueing is not implemented. */
651 s
->scsi_dev
[id
] = scsi_generic_init(bd
, 0, esp_command_complete
, s
);
652 if (s
->scsi_dev
[id
] == NULL
)
653 s
->scsi_dev
[id
] = scsi_disk_init(bd
, 0, esp_command_complete
, s
);
656 void esp_init(target_phys_addr_t espaddr
, int it_shift
,
657 espdma_memory_read_write dma_memory_read
,
658 espdma_memory_read_write dma_memory_write
,
659 void *dma_opaque
, qemu_irq irq
, qemu_irq
*reset
)
665 dev
= qdev_create(NULL
, "esp");
666 esp
= DO_UPCAST(ESPState
, busdev
.qdev
, dev
);
667 esp
->dma_memory_read
= dma_memory_read
;
668 esp
->dma_memory_write
= dma_memory_write
;
669 esp
->dma_opaque
= dma_opaque
;
670 esp
->it_shift
= it_shift
;
672 s
= sysbus_from_qdev(dev
);
673 sysbus_connect_irq(s
, 0, irq
);
674 sysbus_mmio_map(s
, 0, espaddr
);
675 *reset
= qdev_get_gpio_in(dev
, 0);
678 static void esp_init1(SysBusDevice
*dev
)
680 ESPState
*s
= FROM_SYSBUS(ESPState
, dev
);
683 sysbus_init_irq(dev
, &s
->irq
);
684 assert(s
->it_shift
!= -1);
686 esp_io_memory
= cpu_register_io_memory(esp_mem_read
, esp_mem_write
, s
);
687 sysbus_init_mmio(dev
, ESP_REGS
<< s
->it_shift
, esp_io_memory
);
691 register_savevm("esp", -1, 3, esp_save
, esp_load
, s
);
692 qemu_register_reset(esp_reset
, s
);
694 qdev_init_gpio_in(&dev
->qdev
, parent_esp_reset
, 1);
696 scsi_bus_new(&dev
->qdev
, esp_scsi_attach
);
699 static void esp_register_devices(void)
701 sysbus_register_dev("esp", sizeof(ESPState
), esp_init1
);
704 device_init(esp_register_devices
)