hw/esp.c

   1 /*
   2  * QEMU ESP/NCR53C9x emulation
   3  *
   4  * Copyright (c) 2005-2006 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "vl.h"
  25
  26 /* debug ESP card */
  27 //#define DEBUG_ESP
  28
  29 /*
  30  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O), also
  31  * produced as NCR89C100. See
  32  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  33  * and
  34  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
  35  */
  36
  37 #ifdef DEBUG_ESP
  38 #define DPRINTF(fmt, args...) \
  39 do { printf("ESP: " fmt , ##args); } while (0)
  40 #else
  41 #define DPRINTF(fmt, args...)
  42 #endif
  43
  44 #define ESP_MASK 0x3f
  45 #define ESP_REGS 16
  46 #define ESP_SIZE (ESP_REGS * 4)
  47 #define TI_BUFSZ 32
  48 /* The HBA is ID 7, so for simplicitly limit to 7 devices.  */
  49 #define ESP_MAX_DEVS      7
  50
  51 typedef struct ESPState ESPState;
  52
  53 struct ESPState {
  54     qemu_irq irq;
  55     BlockDriverState **bd;
  56     uint8_t rregs[ESP_REGS];
  57     uint8_t wregs[ESP_REGS];
  58     int32_t ti_size;
  59     uint32_t ti_rptr, ti_wptr;
  60     uint8_t ti_buf[TI_BUFSZ];
  61     int sense;
  62     int dma;
  63     SCSIDevice *scsi_dev[MAX_DISKS];
  64     SCSIDevice *current_dev;
  65     uint8_t cmdbuf[TI_BUFSZ];
  66     int cmdlen;
  67     int do_cmd;
  68
  69     /* The amount of data left in the current DMA transfer.  */
  70     uint32_t dma_left;
  71     /* The size of the current DMA transfer.  Zero if no transfer is in
  72        progress.  */
  73     uint32_t dma_counter;
  74     uint8_t *async_buf;
  75     uint32_t async_len;
  76     void *dma_opaque;
  77 };
  78
  79 #define STAT_DO 0x00
  80 #define STAT_DI 0x01
  81 #define STAT_CD 0x02
  82 #define STAT_ST 0x03
  83 #define STAT_MI 0x06
  84 #define STAT_MO 0x07
  85
  86 #define STAT_TC 0x10
  87 #define STAT_PE 0x20
  88 #define STAT_GE 0x40
  89 #define STAT_IN 0x80
  90
  91 #define INTR_FC 0x08
  92 #define INTR_BS 0x10
  93 #define INTR_DC 0x20
  94 #define INTR_RST 0x80
  95
  96 #define SEQ_0 0x0
  97 #define SEQ_CD 0x4
  98
  99 static int get_cmd(ESPState *s, uint8_t *buf)
 100 {
 101     uint32_t dmalen;
 102     int target;
 103
 104     dmalen = s->rregs[0] | (s->rregs[1] << 8);
 105     target = s->wregs[4] & 7;
 106     DPRINTF("get_cmd: len %d target %d\n", dmalen, target);
 107     if (s->dma) {
 108         espdma_memory_read(s->dma_opaque, buf, dmalen);
 109     } else {
 110         buf[0] = 0;
 111         memcpy(&buf[1], s->ti_buf, dmalen);
 112         dmalen++;
 113     }
 114
 115     s->ti_size = 0;
 116     s->ti_rptr = 0;
 117     s->ti_wptr = 0;
 118
 119     if (s->current_dev) {
 120         /* Started a new command before the old one finished.  Cancel it.  */
 121         scsi_cancel_io(s->current_dev, 0);
 122         s->async_len = 0;
 123     }
 124
 125     if (target >= MAX_DISKS || !s->scsi_dev[target]) {
 126         // No such drive
 127         s->rregs[4] = STAT_IN;
 128         s->rregs[5] = INTR_DC;
 129         s->rregs[6] = SEQ_0;
 130         qemu_irq_raise(s->irq);
 131         return 0;
 132     }
 133     s->current_dev = s->scsi_dev[target];
 134     return dmalen;
 135 }
 136
 137 static void do_cmd(ESPState *s, uint8_t *buf)
 138 {
 139     int32_t datalen;
 140     int lun;
 141
 142     DPRINTF("do_cmd: busid 0x%x\n", buf[0]);
 143     lun = buf[0] & 7;
 144     datalen = scsi_send_command(s->current_dev, 0, &buf[1], lun);
 145     s->ti_size = datalen;
 146     if (datalen != 0) {
 147         s->rregs[4] = STAT_IN | STAT_TC;
 148         s->dma_left = 0;
 149         s->dma_counter = 0;
 150         if (datalen > 0) {
 151             s->rregs[4] |= STAT_DI;
 152             scsi_read_data(s->current_dev, 0);
 153         } else {
 154             s->rregs[4] |= STAT_DO;
 155             scsi_write_data(s->current_dev, 0);
 156         }
 157     }
 158     s->rregs[5] = INTR_BS | INTR_FC;
 159     s->rregs[6] = SEQ_CD;
 160     qemu_irq_raise(s->irq);
 161 }
 162
 163 static void handle_satn(ESPState *s)
 164 {
 165     uint8_t buf[32];
 166     int len;
 167
 168     len = get_cmd(s, buf);
 169     if (len)
 170         do_cmd(s, buf);
 171 }
 172
 173 static void handle_satn_stop(ESPState *s)
 174 {
 175     s->cmdlen = get_cmd(s, s->cmdbuf);
 176     if (s->cmdlen) {
 177         DPRINTF("Set ATN & Stop: cmdlen %d\n", s->cmdlen);
 178         s->do_cmd = 1;
 179         s->rregs[4] = STAT_IN | STAT_TC | STAT_CD;
 180         s->rregs[5] = INTR_BS | INTR_FC;
 181         s->rregs[6] = SEQ_CD;
 182         qemu_irq_raise(s->irq);
 183     }
 184 }
 185
 186 static void write_response(ESPState *s)
 187 {
 188     DPRINTF("Transfer status (sense=%d)\n", s->sense);
 189     s->ti_buf[0] = s->sense;
 190     s->ti_buf[1] = 0;
 191     if (s->dma) {
 192         espdma_memory_write(s->dma_opaque, s->ti_buf, 2);
 193         s->rregs[4] = STAT_IN | STAT_TC | STAT_ST;
 194         s->rregs[5] = INTR_BS | INTR_FC;
 195         s->rregs[6] = SEQ_CD;
 196     } else {
 197         s->ti_size = 2;
 198         s->ti_rptr = 0;
 199         s->ti_wptr = 0;
 200         s->rregs[7] = 2;
 201     }
 202     qemu_irq_raise(s->irq);
 203 }
 204
 205 static void esp_dma_done(ESPState *s)
 206 {
 207     s->rregs[4] |= STAT_IN | STAT_TC;
 208     s->rregs[5] = INTR_BS;
 209     s->rregs[6] = 0;
 210     s->rregs[7] = 0;
 211     s->rregs[0] = 0;
 212     s->rregs[1] = 0;
 213     qemu_irq_raise(s->irq);
 214 }
 215
 216 static void esp_do_dma(ESPState *s)
 217 {
 218     uint32_t len;
 219     int to_device;
 220
 221     to_device = (s->ti_size < 0);
 222     len = s->dma_left;
 223     if (s->do_cmd) {
 224         DPRINTF("command len %d + %d\n", s->cmdlen, len);
 225         espdma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
 226         s->ti_size = 0;
 227         s->cmdlen = 0;
 228         s->do_cmd = 0;
 229         do_cmd(s, s->cmdbuf);
 230         return;
 231     }
 232     if (s->async_len == 0) {
 233         /* Defer until data is available.  */
 234         return;
 235     }
 236     if (len > s->async_len) {
 237         len = s->async_len;
 238     }
 239     if (to_device) {
 240         espdma_memory_read(s->dma_opaque, s->async_buf, len);
 241     } else {
 242         espdma_memory_write(s->dma_opaque, s->async_buf, len);
 243     }
 244     s->dma_left -= len;
 245     s->async_buf += len;
 246     s->async_len -= len;
 247     if (to_device)
 248         s->ti_size += len;
 249     else
 250         s->ti_size -= len;
 251     if (s->async_len == 0) {
 252         if (to_device) {
 253             // ti_size is negative
 254             scsi_write_data(s->current_dev, 0);
 255         } else {
 256             scsi_read_data(s->current_dev, 0);
 257             /* If there is still data to be read from the device then
 258                complete the DMA operation immeriately.  Otherwise defer
 259                until the scsi layer has completed.  */
 260             if (s->dma_left == 0 && s->ti_size > 0) {
 261                 esp_dma_done(s);
 262             }
 263         }
 264     } else {
 265         /* Partially filled a scsi buffer. Complete immediately.  */
 266         esp_dma_done(s);
 267     }
 268 }
 269
 270 static void esp_command_complete(void *opaque, int reason, uint32_t tag,
 271                                  uint32_t arg)
 272 {
 273     ESPState *s = (ESPState *)opaque;
 274
 275     if (reason == SCSI_REASON_DONE) {
 276         DPRINTF("SCSI Command complete\n");
 277         if (s->ti_size != 0)
 278             DPRINTF("SCSI command completed unexpectedly\n");
 279         s->ti_size = 0;
 280         s->dma_left = 0;
 281         s->async_len = 0;
 282         if (arg)
 283             DPRINTF("Command failed\n");
 284         s->sense = arg;
 285         s->rregs[4] = STAT_ST;
 286         esp_dma_done(s);
 287         s->current_dev = NULL;
 288     } else {
 289         DPRINTF("transfer %d/%d\n", s->dma_left, s->ti_size);
 290         s->async_len = arg;
 291         s->async_buf = scsi_get_buf(s->current_dev, 0);
 292         if (s->dma_left) {
 293             esp_do_dma(s);
 294         } else if (s->dma_counter != 0 && s->ti_size <= 0) {
 295             /* If this was the last part of a DMA transfer then the
 296                completion interrupt is deferred to here.  */
 297             esp_dma_done(s);
 298         }
 299     }
 300 }
 301
 302 static void handle_ti(ESPState *s)
 303 {
 304     uint32_t dmalen, minlen;
 305
 306     dmalen = s->rregs[0] | (s->rregs[1] << 8);
 307     if (dmalen==0) {
 308       dmalen=0x10000;
 309     }
 310     s->dma_counter = dmalen;
 311
 312     if (s->do_cmd)
 313         minlen = (dmalen < 32) ? dmalen : 32;
 314     else if (s->ti_size < 0)
 315         minlen = (dmalen < -s->ti_size) ? dmalen : -s->ti_size;
 316     else
 317         minlen = (dmalen < s->ti_size) ? dmalen : s->ti_size;
 318     DPRINTF("Transfer Information len %d\n", minlen);
 319     if (s->dma) {
 320         s->dma_left = minlen;
 321         s->rregs[4] &= ~STAT_TC;
 322         esp_do_dma(s);
 323     } else if (s->do_cmd) {
 324         DPRINTF("command len %d\n", s->cmdlen);
 325         s->ti_size = 0;
 326         s->cmdlen = 0;
 327         s->do_cmd = 0;
 328         do_cmd(s, s->cmdbuf);
 329         return;
 330     }
 331 }
 332
 333 static void esp_reset(void *opaque)
 334 {
 335     ESPState *s = opaque;
 336
 337     memset(s->rregs, 0, ESP_REGS);
 338     memset(s->wregs, 0, ESP_REGS);
 339     s->rregs[0x0e] = 0x4; // Indicate fas100a
 340     s->ti_size = 0;
 341     s->ti_rptr = 0;
 342     s->ti_wptr = 0;
 343     s->dma = 0;
 344     s->do_cmd = 0;
 345 }
 346
 347 static uint32_t esp_mem_readb(void *opaque, target_phys_addr_t addr)
 348 {
 349     ESPState *s = opaque;
 350     uint32_t saddr;
 351
 352     saddr = (addr & ESP_MASK) >> 2;
 353     DPRINTF("read reg[%d]: 0x%2.2x\n", saddr, s->rregs[saddr]);
 354     switch (saddr) {
 355     case 2:
 356         // FIFO
 357         if (s->ti_size > 0) {
 358             s->ti_size--;
 359             if ((s->rregs[4] & 6) == 0) {
 360                 /* Data in/out.  */
 361                 fprintf(stderr, "esp: PIO data read not implemented\n");
 362                 s->rregs[2] = 0;
 363             } else {
 364                 s->rregs[2] = s->ti_buf[s->ti_rptr++];
 365             }
 366             qemu_irq_raise(s->irq);
 367         }
 368         if (s->ti_size == 0) {
 369             s->ti_rptr = 0;
 370             s->ti_wptr = 0;
 371         }
 372         break;
 373     case 5:
 374         // interrupt
 375         // Clear interrupt/error status bits
 376         s->rregs[4] &= ~(STAT_IN | STAT_GE | STAT_PE);
 377         qemu_irq_lower(s->irq);
 378         break;
 379     default:
 380         break;
 381     }
 382     return s->rregs[saddr];
 383 }
 384
 385 static void esp_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 386 {
 387     ESPState *s = opaque;
 388     uint32_t saddr;
 389
 390     saddr = (addr & ESP_MASK) >> 2;
 391     DPRINTF("write reg[%d]: 0x%2.2x -> 0x%2.2x\n", saddr, s->wregs[saddr], val);
 392     switch (saddr) {
 393     case 0:
 394     case 1:
 395         s->rregs[4] &= ~STAT_TC;
 396         break;
 397     case 2:
 398         // FIFO
 399         if (s->do_cmd) {
 400             s->cmdbuf[s->cmdlen++] = val & 0xff;
 401         } else if ((s->rregs[4] & 6) == 0) {
 402             uint8_t buf;
 403             buf = val & 0xff;
 404             s->ti_size--;
 405             fprintf(stderr, "esp: PIO data write not implemented\n");
 406         } else {
 407             s->ti_size++;
 408             s->ti_buf[s->ti_wptr++] = val & 0xff;
 409         }
 410         break;
 411     case 3:
 412         s->rregs[saddr] = val;
 413         // Command
 414         if (val & 0x80) {
 415             s->dma = 1;
 416             /* Reload DMA counter.  */
 417             s->rregs[0] = s->wregs[0];
 418             s->rregs[1] = s->wregs[1];
 419         } else {
 420             s->dma = 0;
 421         }
 422         switch(val & 0x7f) {
 423         case 0:
 424             DPRINTF("NOP (%2.2x)\n", val);
 425             break;
 426         case 1:
 427             DPRINTF("Flush FIFO (%2.2x)\n", val);
 428             //s->ti_size = 0;
 429             s->rregs[5] = INTR_FC;
 430             s->rregs[6] = 0;
 431             break;
 432         case 2:
 433             DPRINTF("Chip reset (%2.2x)\n", val);
 434             esp_reset(s);
 435             break;
 436         case 3:
 437             DPRINTF("Bus reset (%2.2x)\n", val);
 438             s->rregs[5] = INTR_RST;
 439             if (!(s->wregs[8] & 0x40)) {
 440                 qemu_irq_raise(s->irq);
 441             }
 442             break;
 443         case 0x10:
 444             handle_ti(s);
 445             break;
 446         case 0x11:
 447             DPRINTF("Initiator Command Complete Sequence (%2.2x)\n", val);
 448             write_response(s);
 449             break;
 450         case 0x12:
 451             DPRINTF("Message Accepted (%2.2x)\n", val);
 452             write_response(s);
 453             s->rregs[5] = INTR_DC;
 454             s->rregs[6] = 0;
 455             break;
 456         case 0x1a:
 457             DPRINTF("Set ATN (%2.2x)\n", val);
 458             break;
 459         case 0x42:
 460             DPRINTF("Set ATN (%2.2x)\n", val);
 461             handle_satn(s);
 462             break;
 463         case 0x43:
 464             DPRINTF("Set ATN & stop (%2.2x)\n", val);
 465             handle_satn_stop(s);
 466             break;
 467         default:
 468             DPRINTF("Unhandled ESP command (%2.2x)\n", val);
 469             break;
 470         }
 471         break;
 472     case 4 ... 7:
 473         break;
 474     case 8:
 475         s->rregs[saddr] = val;
 476         break;
 477     case 9 ... 10:
 478         break;
 479     case 11:
 480         s->rregs[saddr] = val & 0x15;
 481         break;
 482     case 12 ... 15:
 483         s->rregs[saddr] = val;
 484         break;
 485     default:
 486         break;
 487     }
 488     s->wregs[saddr] = val;
 489 }
 490
 491 static CPUReadMemoryFunc *esp_mem_read[3] = {
 492     esp_mem_readb,
 493     esp_mem_readb,
 494     esp_mem_readb,
 495 };
 496
 497 static CPUWriteMemoryFunc *esp_mem_write[3] = {
 498     esp_mem_writeb,
 499     esp_mem_writeb,
 500     esp_mem_writeb,
 501 };
 502
 503 static void esp_save(QEMUFile *f, void *opaque)
 504 {
 505     ESPState *s = opaque;
 506
 507     qemu_put_buffer(f, s->rregs, ESP_REGS);
 508     qemu_put_buffer(f, s->wregs, ESP_REGS);
 509     qemu_put_be32s(f, &s->ti_size);
 510     qemu_put_be32s(f, &s->ti_rptr);
 511     qemu_put_be32s(f, &s->ti_wptr);
 512     qemu_put_buffer(f, s->ti_buf, TI_BUFSZ);
 513     qemu_put_be32s(f, &s->sense);
 514     qemu_put_be32s(f, &s->dma);
 515     qemu_put_buffer(f, s->cmdbuf, TI_BUFSZ);
 516     qemu_put_be32s(f, &s->cmdlen);
 517     qemu_put_be32s(f, &s->do_cmd);
 518     qemu_put_be32s(f, &s->dma_left);
 519     // There should be no transfers in progress, so dma_counter is not saved
 520 }
 521
 522 static int esp_load(QEMUFile *f, void *opaque, int version_id)
 523 {
 524     ESPState *s = opaque;
 525
 526     if (version_id != 3)
 527         return -EINVAL; // Cannot emulate 2
 528
 529     qemu_get_buffer(f, s->rregs, ESP_REGS);
 530     qemu_get_buffer(f, s->wregs, ESP_REGS);
 531     qemu_get_be32s(f, &s->ti_size);
 532     qemu_get_be32s(f, &s->ti_rptr);
 533     qemu_get_be32s(f, &s->ti_wptr);
 534     qemu_get_buffer(f, s->ti_buf, TI_BUFSZ);
 535     qemu_get_be32s(f, &s->sense);
 536     qemu_get_be32s(f, &s->dma);
 537     qemu_get_buffer(f, s->cmdbuf, TI_BUFSZ);
 538     qemu_get_be32s(f, &s->cmdlen);
 539     qemu_get_be32s(f, &s->do_cmd);
 540     qemu_get_be32s(f, &s->dma_left);
 541
 542     return 0;
 543 }
 544
 545 void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id)
 546 {
 547     ESPState *s = (ESPState *)opaque;
 548
 549     if (id < 0) {
 550         for (id = 0; id < ESP_MAX_DEVS; id++) {
 551             if (s->scsi_dev[id] == NULL)
 552                 break;
 553         }
 554     }
 555     if (id >= ESP_MAX_DEVS) {
 556         DPRINTF("Bad Device ID %d\n", id);
 557         return;
 558     }
 559     if (s->scsi_dev[id]) {
 560         DPRINTF("Destroying device %d\n", id);
 561         scsi_disk_destroy(s->scsi_dev[id]);
 562     }
 563     DPRINTF("Attaching block device %d\n", id);
 564     /* Command queueing is not implemented.  */
 565     s->scsi_dev[id] = scsi_disk_init(bd, 0, esp_command_complete, s);
 566 }
 567
 568 void *esp_init(BlockDriverState **bd, target_phys_addr_t espaddr,
 569                void *dma_opaque, qemu_irq irq)
 570 {
 571     ESPState *s;
 572     int esp_io_memory;
 573
 574     s = qemu_mallocz(sizeof(ESPState));
 575     if (!s)
 576         return NULL;
 577
 578     s->bd = bd;
 579     s->irq = irq;
 580     s->dma_opaque = dma_opaque;
 581     sparc32_dma_set_reset_data(dma_opaque, esp_reset, s);
 582
 583     esp_io_memory = cpu_register_io_memory(0, esp_mem_read, esp_mem_write, s);
 584     cpu_register_physical_memory(espaddr, ESP_SIZE, esp_io_memory);
 585
 586     esp_reset(s);
 587
 588     register_savevm("esp", espaddr, 3, esp_save, esp_load, s);
 589     qemu_register_reset(esp_reset, s);
 590
 591     return s;
 592 }