qemu/hw/esp.c

   1 /*
   2  * QEMU ESP/NCR53C9x emulation
   3  *
   4  * Copyright (c) 2005-2006 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "hw.h"
  25 #include "block.h"
  26 #include "scsi-disk.h"
  27 #include "scsi.h"
  28
  29 /* debug ESP card */
  30 //#define DEBUG_ESP
  31
  32 /*
  33  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
  34  * also produced as NCR89C100. See
  35  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  36  * and
  37  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
  38  */
  39
  40 #ifdef DEBUG_ESP
  41 #define DPRINTF(fmt, args...) \
  42 do { printf("ESP: " fmt , ##args); } while (0)
  43 #else
  44 #define DPRINTF(fmt, args...)
  45 #endif
  46
  47 #define ESP_MASK 0x3f
  48 #define ESP_REGS 16
  49 #define ESP_SIZE (ESP_REGS * 4)
  50 #define TI_BUFSZ 32
  51
  52 typedef struct ESPState ESPState;
  53
  54 struct ESPState {
  55     qemu_irq irq;
  56     uint8_t rregs[ESP_REGS];
  57     uint8_t wregs[ESP_REGS];
  58     int32_t ti_size;
  59     uint32_t ti_rptr, ti_wptr;
  60     uint8_t ti_buf[TI_BUFSZ];
  61     int sense;
  62     int dma;
  63     SCSIDevice *scsi_dev[ESP_MAX_DEVS];
  64     SCSIDevice *current_dev;
  65     uint8_t cmdbuf[TI_BUFSZ];
  66     int cmdlen;
  67     int do_cmd;
  68
  69     /* The amount of data left in the current DMA transfer.  */
  70     uint32_t dma_left;
  71     /* The size of the current DMA transfer.  Zero if no transfer is in
  72        progress.  */
  73     uint32_t dma_counter;
  74     uint8_t *async_buf;
  75     uint32_t async_len;
  76
  77     espdma_memory_read_write dma_memory_read;
  78     espdma_memory_read_write dma_memory_write;
  79     void *dma_opaque;
  80 };
  81
  82 #define ESP_TCLO   0x0
  83 #define ESP_TCMID  0x1
  84 #define ESP_FIFO   0x2
  85 #define ESP_CMD    0x3
  86 #define ESP_RSTAT  0x4
  87 #define ESP_WBUSID 0x4
  88 #define ESP_RINTR  0x5
  89 #define ESP_WSEL   0x5
  90 #define ESP_RSEQ   0x6
  91 #define ESP_WSYNTP 0x6
  92 #define ESP_RFLAGS 0x7
  93 #define ESP_WSYNO  0x7
  94 #define ESP_CFG1   0x8
  95 #define ESP_RRES1  0x9
  96 #define ESP_WCCF   0x9
  97 #define ESP_RRES2  0xa
  98 #define ESP_WTEST  0xa
  99 #define ESP_CFG2   0xb
 100 #define ESP_CFG3   0xc
 101 #define ESP_RES3   0xd
 102 #define ESP_TCHI   0xe
 103 #define ESP_RES4   0xf
 104
 105 #define CMD_DMA 0x80
 106 #define CMD_CMD 0x7f
 107
 108 #define CMD_NOP      0x00
 109 #define CMD_FLUSH    0x01
 110 #define CMD_RESET    0x02
 111 #define CMD_BUSRESET 0x03
 112 #define CMD_TI       0x10
 113 #define CMD_ICCS     0x11
 114 #define CMD_MSGACC   0x12
 115 #define CMD_SATN     0x1a
 116 #define CMD_SELATN   0x42
 117 #define CMD_SELATNS  0x43
 118 #define CMD_ENSEL    0x44
 119
 120 #define STAT_DO 0x00
 121 #define STAT_DI 0x01
 122 #define STAT_CD 0x02
 123 #define STAT_ST 0x03
 124 #define STAT_MI 0x06
 125 #define STAT_MO 0x07
 126 #define STAT_PIO_MASK 0x06
 127
 128 #define STAT_TC 0x10
 129 #define STAT_PE 0x20
 130 #define STAT_GE 0x40
 131 #define STAT_IN 0x80
 132
 133 #define INTR_FC 0x08
 134 #define INTR_BS 0x10
 135 #define INTR_DC 0x20
 136 #define INTR_RST 0x80
 137
 138 #define SEQ_0 0x0
 139 #define SEQ_CD 0x4
 140
 141 #define CFG1_RESREPT 0x40
 142
 143 #define CFG2_MASK 0x15
 144
 145 #define TCHI_FAS100A 0x4
 146
 147 static int get_cmd(ESPState *s, uint8_t *buf)
 148 {
 149     uint32_t dmalen;
 150     int target;
 151
 152     dmalen = s->rregs[ESP_TCLO] | (s->rregs[ESP_TCMID] << 8);
 153     target = s->wregs[ESP_WBUSID] & 7;
 154     DPRINTF("get_cmd: len %d target %d\n", dmalen, target);
 155     if (s->dma) {
 156         s->dma_memory_read(s->dma_opaque, buf, dmalen);
 157     } else {
 158         buf[0] = 0;
 159         memcpy(&buf[1], s->ti_buf, dmalen);
 160         dmalen++;
 161     }
 162
 163     s->ti_size = 0;
 164     s->ti_rptr = 0;
 165     s->ti_wptr = 0;
 166
 167     if (s->current_dev) {
 168         /* Started a new command before the old one finished.  Cancel it.  */
 169         s->current_dev->cancel_io(s->current_dev, 0);
 170         s->async_len = 0;
 171     }
 172
 173     if (target >= ESP_MAX_DEVS || !s->scsi_dev[target]) {
 174         // No such drive
 175         s->rregs[ESP_RSTAT] = STAT_IN;
 176         s->rregs[ESP_RINTR] = INTR_DC;
 177         s->rregs[ESP_RSEQ] = SEQ_0;
 178         qemu_irq_raise(s->irq);
 179         return 0;
 180     }
 181     s->current_dev = s->scsi_dev[target];
 182     return dmalen;
 183 }
 184
 185 static void do_cmd(ESPState *s, uint8_t *buf)
 186 {
 187     int32_t datalen;
 188     int lun;
 189
 190     DPRINTF("do_cmd: busid 0x%x\n", buf[0]);
 191     lun = buf[0] & 7;
 192     datalen = s->current_dev->send_command(s->current_dev, 0, &buf[1], lun);
 193     s->ti_size = datalen;
 194     if (datalen != 0) {
 195         s->rregs[ESP_RSTAT] = STAT_IN | STAT_TC;
 196         s->dma_left = 0;
 197         s->dma_counter = 0;
 198         if (datalen > 0) {
 199             s->rregs[ESP_RSTAT] |= STAT_DI;
 200             s->current_dev->read_data(s->current_dev, 0);
 201         } else {
 202             s->rregs[ESP_RSTAT] |= STAT_DO;
 203             s->current_dev->write_data(s->current_dev, 0);
 204         }
 205     }
 206     s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 207     s->rregs[ESP_RSEQ] = SEQ_CD;
 208     qemu_irq_raise(s->irq);
 209 }
 210
 211 static void handle_satn(ESPState *s)
 212 {
 213     uint8_t buf[32];
 214     int len;
 215
 216     len = get_cmd(s, buf);
 217     if (len)
 218         do_cmd(s, buf);
 219 }
 220
 221 static void handle_satn_stop(ESPState *s)
 222 {
 223     s->cmdlen = get_cmd(s, s->cmdbuf);
 224     if (s->cmdlen) {
 225         DPRINTF("Set ATN & Stop: cmdlen %d\n", s->cmdlen);
 226         s->do_cmd = 1;
 227         s->rregs[ESP_RSTAT] = STAT_IN | STAT_TC | STAT_CD;
 228         s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 229         s->rregs[ESP_RSEQ] = SEQ_CD;
 230         qemu_irq_raise(s->irq);
 231     }
 232 }
 233
 234 static void write_response(ESPState *s)
 235 {
 236     DPRINTF("Transfer status (sense=%d)\n", s->sense);
 237     s->ti_buf[0] = s->sense;
 238     s->ti_buf[1] = 0;
 239     if (s->dma) {
 240         s->dma_memory_write(s->dma_opaque, s->ti_buf, 2);
 241         s->rregs[ESP_RSTAT] = STAT_IN | STAT_TC | STAT_ST;
 242         s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 243         s->rregs[ESP_RSEQ] = SEQ_CD;
 244     } else {
 245         s->ti_size = 2;
 246         s->ti_rptr = 0;
 247         s->ti_wptr = 0;
 248         s->rregs[ESP_RFLAGS] = 2;
 249     }
 250     qemu_irq_raise(s->irq);
 251 }
 252
 253 static void esp_dma_done(ESPState *s)
 254 {
 255     s->rregs[ESP_RSTAT] |= STAT_IN | STAT_TC;
 256     s->rregs[ESP_RINTR] = INTR_BS;
 257     s->rregs[ESP_RSEQ] = 0;
 258     s->rregs[ESP_RFLAGS] = 0;
 259     s->rregs[ESP_TCLO] = 0;
 260     s->rregs[ESP_TCMID] = 0;
 261     qemu_irq_raise(s->irq);
 262 }
 263
 264 static void esp_do_dma(ESPState *s)
 265 {
 266     uint32_t len;
 267     int to_device;
 268
 269     to_device = (s->ti_size < 0);
 270     len = s->dma_left;
 271     if (s->do_cmd) {
 272         DPRINTF("command len %d + %d\n", s->cmdlen, len);
 273         s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
 274         s->ti_size = 0;
 275         s->cmdlen = 0;
 276         s->do_cmd = 0;
 277         do_cmd(s, s->cmdbuf);
 278         return;
 279     }
 280     if (s->async_len == 0) {
 281         /* Defer until data is available.  */
 282         return;
 283     }
 284     if (len > s->async_len) {
 285         len = s->async_len;
 286     }
 287     if (to_device) {
 288         s->dma_memory_read(s->dma_opaque, s->async_buf, len);
 289     } else {
 290         s->dma_memory_write(s->dma_opaque, s->async_buf, len);
 291     }
 292     s->dma_left -= len;
 293     s->async_buf += len;
 294     s->async_len -= len;
 295     if (to_device)
 296         s->ti_size += len;
 297     else
 298         s->ti_size -= len;
 299     if (s->async_len == 0) {
 300         if (to_device) {
 301             // ti_size is negative
 302             s->current_dev->write_data(s->current_dev, 0);
 303         } else {
 304             s->current_dev->read_data(s->current_dev, 0);
 305             /* If there is still data to be read from the device then
 306                complete the DMA operation immeriately.  Otherwise defer
 307                until the scsi layer has completed.  */
 308             if (s->dma_left == 0 && s->ti_size > 0) {
 309                 esp_dma_done(s);
 310             }
 311         }
 312     } else {
 313         /* Partially filled a scsi buffer. Complete immediately.  */
 314         esp_dma_done(s);
 315     }
 316 }
 317
 318 static void esp_command_complete(void *opaque, int reason, uint32_t tag,
 319                                  uint32_t arg)
 320 {
 321     ESPState *s = (ESPState *)opaque;
 322
 323     if (reason == SCSI_REASON_DONE) {
 324         DPRINTF("SCSI Command complete\n");
 325         if (s->ti_size != 0)
 326             DPRINTF("SCSI command completed unexpectedly\n");
 327         s->ti_size = 0;
 328         s->dma_left = 0;
 329         s->async_len = 0;
 330         if (arg)
 331             DPRINTF("Command failed\n");
 332         s->sense = arg;
 333         s->rregs[ESP_RSTAT] = STAT_ST;
 334         esp_dma_done(s);
 335         s->current_dev = NULL;
 336     } else {
 337         DPRINTF("transfer %d/%d\n", s->dma_left, s->ti_size);
 338         s->async_len = arg;
 339         s->async_buf = s->current_dev->get_buf(s->current_dev, 0);
 340         if (s->dma_left) {
 341             esp_do_dma(s);
 342         } else if (s->dma_counter != 0 && s->ti_size <= 0) {
 343             /* If this was the last part of a DMA transfer then the
 344                completion interrupt is deferred to here.  */
 345             esp_dma_done(s);
 346         }
 347     }
 348 }
 349
 350 static void handle_ti(ESPState *s)
 351 {
 352     uint32_t dmalen, minlen;
 353
 354     dmalen = s->rregs[ESP_TCLO] | (s->rregs[ESP_TCMID] << 8);
 355     if (dmalen==0) {
 356       dmalen=0x10000;
 357     }
 358     s->dma_counter = dmalen;
 359
 360     if (s->do_cmd)
 361         minlen = (dmalen < 32) ? dmalen : 32;
 362     else if (s->ti_size < 0)
 363         minlen = (dmalen < -s->ti_size) ? dmalen : -s->ti_size;
 364     else
 365         minlen = (dmalen < s->ti_size) ? dmalen : s->ti_size;
 366     DPRINTF("Transfer Information len %d\n", minlen);
 367     if (s->dma) {
 368         s->dma_left = minlen;
 369         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 370         esp_do_dma(s);
 371     } else if (s->do_cmd) {
 372         DPRINTF("command len %d\n", s->cmdlen);
 373         s->ti_size = 0;
 374         s->cmdlen = 0;
 375         s->do_cmd = 0;
 376         do_cmd(s, s->cmdbuf);
 377         return;
 378     }
 379 }
 380
 381 static void esp_reset(void *opaque)
 382 {
 383     ESPState *s = opaque;
 384
 385     memset(s->rregs, 0, ESP_REGS);
 386     memset(s->wregs, 0, ESP_REGS);
 387     s->rregs[ESP_TCHI] = TCHI_FAS100A; // Indicate fas100a
 388     s->ti_size = 0;
 389     s->ti_rptr = 0;
 390     s->ti_wptr = 0;
 391     s->dma = 0;
 392     s->do_cmd = 0;
 393 }
 394
 395 static void parent_esp_reset(void *opaque, int irq, int level)
 396 {
 397     if (level)
 398         esp_reset(opaque);
 399 }
 400
 401 static uint32_t esp_mem_readb(void *opaque, target_phys_addr_t addr)
 402 {
 403     ESPState *s = opaque;
 404     uint32_t saddr;
 405
 406     saddr = (addr & ESP_MASK) >> 2;
 407     DPRINTF("read reg[%d]: 0x%2.2x\n", saddr, s->rregs[saddr]);
 408     switch (saddr) {
 409     case ESP_FIFO:
 410         if (s->ti_size > 0) {
 411             s->ti_size--;
 412             if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
 413                 /* Data in/out.  */
 414                 fprintf(stderr, "esp: PIO data read not implemented\n");
 415                 s->rregs[ESP_FIFO] = 0;
 416             } else {
 417                 s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
 418             }
 419             qemu_irq_raise(s->irq);
 420         }
 421         if (s->ti_size == 0) {
 422             s->ti_rptr = 0;
 423             s->ti_wptr = 0;
 424         }
 425         break;
 426     case ESP_RINTR:
 427         // Clear interrupt/error status bits
 428         s->rregs[ESP_RSTAT] &= ~(STAT_IN | STAT_GE | STAT_PE);
 429         qemu_irq_lower(s->irq);
 430         break;
 431     default:
 432         break;
 433     }
 434     return s->rregs[saddr];
 435 }
 436
 437 static void esp_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 438 {
 439     ESPState *s = opaque;
 440     uint32_t saddr;
 441
 442     saddr = (addr & ESP_MASK) >> 2;
 443     DPRINTF("write reg[%d]: 0x%2.2x -> 0x%2.2x\n", saddr, s->wregs[saddr],
 444             val);
 445     switch (saddr) {
 446     case ESP_TCLO:
 447     case ESP_TCMID:
 448         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 449         break;
 450     case ESP_FIFO:
 451         if (s->do_cmd) {
 452             s->cmdbuf[s->cmdlen++] = val & 0xff;
 453         } else if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
 454             uint8_t buf;
 455             buf = val & 0xff;
 456             s->ti_size--;
 457             fprintf(stderr, "esp: PIO data write not implemented\n");
 458         } else {
 459             s->ti_size++;
 460             s->ti_buf[s->ti_wptr++] = val & 0xff;
 461         }
 462         break;
 463     case ESP_CMD:
 464         s->rregs[saddr] = val;
 465         if (val & CMD_DMA) {
 466             s->dma = 1;
 467             /* Reload DMA counter.  */
 468             s->rregs[ESP_TCLO] = s->wregs[ESP_TCLO];
 469             s->rregs[ESP_TCMID] = s->wregs[ESP_TCMID];
 470         } else {
 471             s->dma = 0;
 472         }
 473         switch(val & CMD_CMD) {
 474         case CMD_NOP:
 475             DPRINTF("NOP (%2.2x)\n", val);
 476             break;
 477         case CMD_FLUSH:
 478             DPRINTF("Flush FIFO (%2.2x)\n", val);
 479             //s->ti_size = 0;
 480             s->rregs[ESP_RINTR] = INTR_FC;
 481             s->rregs[ESP_RSEQ] = 0;
 482             break;
 483         case CMD_RESET:
 484             DPRINTF("Chip reset (%2.2x)\n", val);
 485             esp_reset(s);
 486             break;
 487         case CMD_BUSRESET:
 488             DPRINTF("Bus reset (%2.2x)\n", val);
 489             s->rregs[ESP_RINTR] = INTR_RST;
 490             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
 491                 qemu_irq_raise(s->irq);
 492             }
 493             break;
 494         case CMD_TI:
 495             handle_ti(s);
 496             break;
 497         case CMD_ICCS:
 498             DPRINTF("Initiator Command Complete Sequence (%2.2x)\n", val);
 499             write_response(s);
 500             break;
 501         case CMD_MSGACC:
 502             DPRINTF("Message Accepted (%2.2x)\n", val);
 503             write_response(s);
 504             s->rregs[ESP_RINTR] = INTR_DC;
 505             s->rregs[ESP_RSEQ] = 0;
 506             break;
 507         case CMD_SATN:
 508             DPRINTF("Set ATN (%2.2x)\n", val);
 509             break;
 510         case CMD_SELATN:
 511             DPRINTF("Set ATN (%2.2x)\n", val);
 512             handle_satn(s);
 513             break;
 514         case CMD_SELATNS:
 515             DPRINTF("Set ATN & stop (%2.2x)\n", val);
 516             handle_satn_stop(s);
 517             break;
 518         case CMD_ENSEL:
 519             DPRINTF("Enable selection (%2.2x)\n", val);
 520             break;
 521         default:
 522             DPRINTF("Unhandled ESP command (%2.2x)\n", val);
 523             break;
 524         }
 525         break;
 526     case ESP_WBUSID ... ESP_WSYNO:
 527         break;
 528     case ESP_CFG1:
 529         s->rregs[saddr] = val;
 530         break;
 531     case ESP_WCCF ... ESP_WTEST:
 532         break;
 533     case ESP_CFG2:
 534         s->rregs[saddr] = val & CFG2_MASK;
 535         break;
 536     case ESP_CFG3 ... ESP_RES4:
 537         s->rregs[saddr] = val;
 538         break;
 539     default:
 540         break;
 541     }
 542     s->wregs[saddr] = val;
 543 }
 544
 545 static CPUReadMemoryFunc *esp_mem_read[3] = {
 546     esp_mem_readb,
 547     NULL,
 548     NULL,
 549 };
 550
 551 static CPUWriteMemoryFunc *esp_mem_write[3] = {
 552     esp_mem_writeb,
 553     NULL,
 554     NULL,
 555 };
 556
 557 static void esp_save(QEMUFile *f, void *opaque)
 558 {
 559     ESPState *s = opaque;
 560
 561     qemu_put_buffer(f, s->rregs, ESP_REGS);
 562     qemu_put_buffer(f, s->wregs, ESP_REGS);
 563     qemu_put_be32s(f, &s->ti_size);
 564     qemu_put_be32s(f, &s->ti_rptr);
 565     qemu_put_be32s(f, &s->ti_wptr);
 566     qemu_put_buffer(f, s->ti_buf, TI_BUFSZ);
 567     qemu_put_be32s(f, &s->sense);
 568     qemu_put_be32s(f, &s->dma);
 569     qemu_put_buffer(f, s->cmdbuf, TI_BUFSZ);
 570     qemu_put_be32s(f, &s->cmdlen);
 571     qemu_put_be32s(f, &s->do_cmd);
 572     qemu_put_be32s(f, &s->dma_left);
 573     // There should be no transfers in progress, so dma_counter is not saved
 574 }
 575
 576 static int esp_load(QEMUFile *f, void *opaque, int version_id)
 577 {
 578     ESPState *s = opaque;
 579
 580     if (version_id != 3)
 581         return -EINVAL; // Cannot emulate 2
 582
 583     qemu_get_buffer(f, s->rregs, ESP_REGS);
 584     qemu_get_buffer(f, s->wregs, ESP_REGS);
 585     qemu_get_be32s(f, &s->ti_size);
 586     qemu_get_be32s(f, &s->ti_rptr);
 587     qemu_get_be32s(f, &s->ti_wptr);
 588     qemu_get_buffer(f, s->ti_buf, TI_BUFSZ);
 589     qemu_get_be32s(f, &s->sense);
 590     qemu_get_be32s(f, &s->dma);
 591     qemu_get_buffer(f, s->cmdbuf, TI_BUFSZ);
 592     qemu_get_be32s(f, &s->cmdlen);
 593     qemu_get_be32s(f, &s->do_cmd);
 594     qemu_get_be32s(f, &s->dma_left);
 595
 596     return 0;
 597 }
 598
 599 void esp_scsi_attach(void *opaque, BlockDriverState *bd, int id)
 600 {
 601     ESPState *s = (ESPState *)opaque;
 602
 603     if (id < 0) {
 604         for (id = 0; id < ESP_MAX_DEVS; id++) {
 605             if (s->scsi_dev[id] == NULL)
 606                 break;
 607         }
 608     }
 609     if (id >= ESP_MAX_DEVS) {
 610         DPRINTF("Bad Device ID %d\n", id);
 611         return;
 612     }
 613     if (s->scsi_dev[id]) {
 614         DPRINTF("Destroying device %d\n", id);
 615         s->scsi_dev[id]->destroy(s->scsi_dev[id]);
 616     }
 617     DPRINTF("Attaching block device %d\n", id);
 618     /* Command queueing is not implemented.  */
 619     s->scsi_dev[id] = scsi_generic_init(bd, 0, esp_command_complete, s);
 620     if (s->scsi_dev[id] == NULL)
 621         s->scsi_dev[id] = scsi_disk_init(bd, 0, esp_command_complete, s);
 622 }
 623
 624 void *esp_init(target_phys_addr_t espaddr,
 625                espdma_memory_read_write dma_memory_read,
 626                espdma_memory_read_write dma_memory_write,
 627                void *dma_opaque, qemu_irq irq, qemu_irq *reset)
 628 {
 629     ESPState *s;
 630     int esp_io_memory;
 631
 632     s = qemu_mallocz(sizeof(ESPState));
 633     if (!s)
 634         return NULL;
 635
 636     s->irq = irq;
 637     s->dma_memory_read = dma_memory_read;
 638     s->dma_memory_write = dma_memory_write;
 639     s->dma_opaque = dma_opaque;
 640
 641     esp_io_memory = cpu_register_io_memory(0, esp_mem_read, esp_mem_write, s);
 642     cpu_register_physical_memory(espaddr, ESP_SIZE, esp_io_memory);
 643
 644     esp_reset(s);
 645
 646     register_savevm("esp", espaddr, 3, esp_save, esp_load, s);
 647     qemu_register_reset(esp_reset, s);
 648
 649     *reset = *qemu_allocate_irqs(parent_esp_reset, s, 1);
 650
 651     return s;
 652 }