hw/scsi/esp.c

   1 /*
   2  * QEMU ESP/NCR53C9x emulation
   3  *
   4  * Copyright (c) 2005-2006 Fabrice Bellard
   5  * Copyright (c) 2012 Herve Poussineau
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "hw/sysbus.h"
  28 #include "migration/vmstate.h"
  29 #include "hw/irq.h"
  30 #include "hw/scsi/esp.h"
  31 #include "trace.h"
  32 #include "qemu/log.h"
  33 #include "qemu/module.h"
  34
  35 /*
  36  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
  37  * also produced as NCR89C100. See
  38  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  39  * and
  40  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
  41  *
  42  * On Macintosh Quadra it is a NCR53C96.
  43  */
  44
  45 static void esp_raise_irq(ESPState *s)
  46 {
  47     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
  48         s->rregs[ESP_RSTAT] |= STAT_INT;
  49         qemu_irq_raise(s->irq);
  50         trace_esp_raise_irq();
  51     }
  52 }
  53
  54 static void esp_lower_irq(ESPState *s)
  55 {
  56     if (s->rregs[ESP_RSTAT] & STAT_INT) {
  57         s->rregs[ESP_RSTAT] &= ~STAT_INT;
  58         qemu_irq_lower(s->irq);
  59         trace_esp_lower_irq();
  60     }
  61 }
  62
  63 static void esp_raise_drq(ESPState *s)
  64 {
  65     qemu_irq_raise(s->irq_data);
  66     trace_esp_raise_drq();
  67 }
  68
  69 static void esp_lower_drq(ESPState *s)
  70 {
  71     qemu_irq_lower(s->irq_data);
  72     trace_esp_lower_drq();
  73 }
  74
  75 void esp_dma_enable(ESPState *s, int irq, int level)
  76 {
  77     if (level) {
  78         s->dma_enabled = 1;
  79         trace_esp_dma_enable();
  80         if (s->dma_cb) {
  81             s->dma_cb(s);
  82             s->dma_cb = NULL;
  83         }
  84     } else {
  85         trace_esp_dma_disable();
  86         s->dma_enabled = 0;
  87     }
  88 }
  89
  90 void esp_request_cancelled(SCSIRequest *req)
  91 {
  92     ESPState *s = req->hba_private;
  93
  94     if (req == s->current_req) {
  95         scsi_req_unref(s->current_req);
  96         s->current_req = NULL;
  97         s->current_dev = NULL;
  98         s->async_len = 0;
  99     }
 100 }
 101
 102 static void esp_fifo_push(Fifo8 *fifo, uint8_t val)
 103 {
 104     if (fifo8_num_used(fifo) == fifo->capacity) {
 105         trace_esp_error_fifo_overrun();
 106         return;
 107     }
 108
 109     fifo8_push(fifo, val);
 110 }
 111
 112 static uint8_t esp_fifo_pop(Fifo8 *fifo)
 113 {
 114     if (fifo8_is_empty(fifo)) {
 115         return 0;
 116     }
 117
 118     return fifo8_pop(fifo);
 119 }
 120
 121 static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen)
 122 {
 123     const uint8_t *buf;
 124     uint32_t n;
 125
 126     if (maxlen == 0) {
 127         return 0;
 128     }
 129
 130     buf = fifo8_pop_buf(fifo, maxlen, &n);
 131     if (dest) {
 132         memcpy(dest, buf, n);
 133     }
 134
 135     return n;
 136 }
 137
 138 static uint32_t esp_get_tc(ESPState *s)
 139 {
 140     uint32_t dmalen;
 141
 142     dmalen = s->rregs[ESP_TCLO];
 143     dmalen |= s->rregs[ESP_TCMID] << 8;
 144     dmalen |= s->rregs[ESP_TCHI] << 16;
 145
 146     return dmalen;
 147 }
 148
 149 static void esp_set_tc(ESPState *s, uint32_t dmalen)
 150 {
 151     s->rregs[ESP_TCLO] = dmalen;
 152     s->rregs[ESP_TCMID] = dmalen >> 8;
 153     s->rregs[ESP_TCHI] = dmalen >> 16;
 154 }
 155
 156 static uint32_t esp_get_stc(ESPState *s)
 157 {
 158     uint32_t dmalen;
 159
 160     dmalen = s->wregs[ESP_TCLO];
 161     dmalen |= s->wregs[ESP_TCMID] << 8;
 162     dmalen |= s->wregs[ESP_TCHI] << 16;
 163
 164     return dmalen;
 165 }
 166
 167 static uint8_t esp_pdma_read(ESPState *s)
 168 {
 169     uint8_t val;
 170
 171     if (s->do_cmd) {
 172         val = esp_fifo_pop(&s->cmdfifo);
 173     } else {
 174         val = esp_fifo_pop(&s->fifo);
 175     }
 176
 177     return val;
 178 }
 179
 180 static void esp_pdma_write(ESPState *s, uint8_t val)
 181 {
 182     uint32_t dmalen = esp_get_tc(s);
 183
 184     if (dmalen == 0) {
 185         return;
 186     }
 187
 188     if (s->do_cmd) {
 189         esp_fifo_push(&s->cmdfifo, val);
 190     } else {
 191         esp_fifo_push(&s->fifo, val);
 192     }
 193
 194     dmalen--;
 195     esp_set_tc(s, dmalen);
 196 }
 197
 198 static void esp_set_pdma_cb(ESPState *s, enum pdma_cb cb)
 199 {
 200     s->pdma_cb = cb;
 201 }
 202
 203 static int esp_select(ESPState *s)
 204 {
 205     int target;
 206
 207     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 208
 209     s->ti_size = 0;
 210     fifo8_reset(&s->fifo);
 211
 212     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
 213     if (!s->current_dev) {
 214         /* No such drive */
 215         s->rregs[ESP_RSTAT] = 0;
 216         s->rregs[ESP_RINTR] = INTR_DC;
 217         s->rregs[ESP_RSEQ] = SEQ_0;
 218         esp_raise_irq(s);
 219         return -1;
 220     }
 221
 222     /*
 223      * Note that we deliberately don't raise the IRQ here: this will be done
 224      * either in do_command_phase() for DATA OUT transfers or by the deferred
 225      * IRQ mechanism in esp_transfer_data() for DATA IN transfers
 226      */
 227     s->rregs[ESP_RINTR] |= INTR_FC;
 228     s->rregs[ESP_RSEQ] = SEQ_CD;
 229     return 0;
 230 }
 231
 232 static uint32_t get_cmd(ESPState *s, uint32_t maxlen)
 233 {
 234     uint8_t buf[ESP_CMDFIFO_SZ];
 235     uint32_t dmalen, n;
 236     int target;
 237
 238     if (s->current_req) {
 239         /* Started a new command before the old one finished.  Cancel it.  */
 240         scsi_req_cancel(s->current_req);
 241     }
 242
 243     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 244     if (s->dma) {
 245         dmalen = MIN(esp_get_tc(s), maxlen);
 246         if (dmalen == 0) {
 247             return 0;
 248         }
 249         if (s->dma_memory_read) {
 250             s->dma_memory_read(s->dma_opaque, buf, dmalen);
 251             dmalen = MIN(fifo8_num_free(&s->cmdfifo), dmalen);
 252             fifo8_push_all(&s->cmdfifo, buf, dmalen);
 253         } else {
 254             if (esp_select(s) < 0) {
 255                 fifo8_reset(&s->cmdfifo);
 256                 return -1;
 257             }
 258             esp_raise_drq(s);
 259             fifo8_reset(&s->cmdfifo);
 260             return 0;
 261         }
 262     } else {
 263         dmalen = MIN(fifo8_num_used(&s->fifo), maxlen);
 264         if (dmalen == 0) {
 265             return 0;
 266         }
 267         n = esp_fifo_pop_buf(&s->fifo, buf, dmalen);
 268         n = MIN(fifo8_num_free(&s->cmdfifo), n);
 269         fifo8_push_all(&s->cmdfifo, buf, n);
 270     }
 271     trace_esp_get_cmd(dmalen, target);
 272
 273     if (esp_select(s) < 0) {
 274         fifo8_reset(&s->cmdfifo);
 275         return -1;
 276     }
 277     return dmalen;
 278 }
 279
 280 static void do_command_phase(ESPState *s)
 281 {
 282     uint32_t cmdlen;
 283     int32_t datalen;
 284     SCSIDevice *current_lun;
 285     uint8_t buf[ESP_CMDFIFO_SZ];
 286
 287     trace_esp_do_command_phase(s->lun);
 288     cmdlen = fifo8_num_used(&s->cmdfifo);
 289     if (!cmdlen || !s->current_dev) {
 290         return;
 291     }
 292     esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
 293
 294     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
 295     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
 296     datalen = scsi_req_enqueue(s->current_req);
 297     s->ti_size = datalen;
 298     fifo8_reset(&s->cmdfifo);
 299     if (datalen != 0) {
 300         s->rregs[ESP_RSTAT] = STAT_TC;
 301         s->rregs[ESP_RSEQ] = SEQ_CD;
 302         s->ti_cmd = 0;
 303         esp_set_tc(s, 0);
 304         if (datalen > 0) {
 305             /*
 306              * Switch to DATA IN phase but wait until initial data xfer is
 307              * complete before raising the command completion interrupt
 308              */
 309             s->data_in_ready = false;
 310             s->rregs[ESP_RSTAT] |= STAT_DI;
 311         } else {
 312             s->rregs[ESP_RSTAT] |= STAT_DO;
 313             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 314             esp_raise_irq(s);
 315             esp_lower_drq(s);
 316         }
 317         scsi_req_continue(s->current_req);
 318         return;
 319     }
 320 }
 321
 322 static void do_message_phase(ESPState *s)
 323 {
 324     if (s->cmdfifo_cdb_offset) {
 325         uint8_t message = esp_fifo_pop(&s->cmdfifo);
 326
 327         trace_esp_do_identify(message);
 328         s->lun = message & 7;
 329         s->cmdfifo_cdb_offset--;
 330     }
 331
 332     /* Ignore extended messages for now */
 333     if (s->cmdfifo_cdb_offset) {
 334         int len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
 335         esp_fifo_pop_buf(&s->cmdfifo, NULL, len);
 336         s->cmdfifo_cdb_offset = 0;
 337     }
 338 }
 339
 340 static void do_cmd(ESPState *s)
 341 {
 342     do_message_phase(s);
 343     assert(s->cmdfifo_cdb_offset == 0);
 344     do_command_phase(s);
 345 }
 346
 347 static void satn_pdma_cb(ESPState *s)
 348 {
 349     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
 350         s->cmdfifo_cdb_offset = 1;
 351         s->do_cmd = 0;
 352         do_cmd(s);
 353     }
 354 }
 355
 356 static void handle_satn(ESPState *s)
 357 {
 358     int32_t cmdlen;
 359
 360     if (s->dma && !s->dma_enabled) {
 361         s->dma_cb = handle_satn;
 362         return;
 363     }
 364     esp_set_pdma_cb(s, SATN_PDMA_CB);
 365     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
 366     if (cmdlen > 0) {
 367         s->cmdfifo_cdb_offset = 1;
 368         s->do_cmd = 0;
 369         do_cmd(s);
 370     } else if (cmdlen == 0) {
 371         s->do_cmd = 1;
 372         /* Target present, but no cmd yet - switch to command phase */
 373         s->rregs[ESP_RSEQ] = SEQ_CD;
 374         s->rregs[ESP_RSTAT] = STAT_CD;
 375     }
 376 }
 377
 378 static void s_without_satn_pdma_cb(ESPState *s)
 379 {
 380     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
 381         s->cmdfifo_cdb_offset = 0;
 382         s->do_cmd = 0;
 383         do_cmd(s);
 384     }
 385 }
 386
 387 static void handle_s_without_atn(ESPState *s)
 388 {
 389     int32_t cmdlen;
 390
 391     if (s->dma && !s->dma_enabled) {
 392         s->dma_cb = handle_s_without_atn;
 393         return;
 394     }
 395     esp_set_pdma_cb(s, S_WITHOUT_SATN_PDMA_CB);
 396     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
 397     if (cmdlen > 0) {
 398         s->cmdfifo_cdb_offset = 0;
 399         s->do_cmd = 0;
 400         do_cmd(s);
 401     } else if (cmdlen == 0) {
 402         s->do_cmd = 1;
 403         /* Target present, but no cmd yet - switch to command phase */
 404         s->rregs[ESP_RSEQ] = SEQ_CD;
 405         s->rregs[ESP_RSTAT] = STAT_CD;
 406     }
 407 }
 408
 409 static void satn_stop_pdma_cb(ESPState *s)
 410 {
 411     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
 412         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
 413         s->do_cmd = 1;
 414         s->cmdfifo_cdb_offset = 1;
 415         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 416         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 417         s->rregs[ESP_RSEQ] = SEQ_CD;
 418         esp_raise_irq(s);
 419     }
 420 }
 421
 422 static void handle_satn_stop(ESPState *s)
 423 {
 424     int32_t cmdlen;
 425
 426     if (s->dma && !s->dma_enabled) {
 427         s->dma_cb = handle_satn_stop;
 428         return;
 429     }
 430     esp_set_pdma_cb(s, SATN_STOP_PDMA_CB);
 431     cmdlen = get_cmd(s, 1);
 432     if (cmdlen > 0) {
 433         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
 434         s->do_cmd = 1;
 435         s->cmdfifo_cdb_offset = 1;
 436         s->rregs[ESP_RSTAT] = STAT_MO;
 437         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 438         s->rregs[ESP_RSEQ] = SEQ_MO;
 439         esp_raise_irq(s);
 440     } else if (cmdlen == 0) {
 441         s->do_cmd = 1;
 442         /* Target present, switch to message out phase */
 443         s->rregs[ESP_RSEQ] = SEQ_MO;
 444         s->rregs[ESP_RSTAT] = STAT_MO;
 445     }
 446 }
 447
 448 static void write_response_pdma_cb(ESPState *s)
 449 {
 450     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 451     s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 452     s->rregs[ESP_RSEQ] = SEQ_CD;
 453     esp_raise_irq(s);
 454 }
 455
 456 static void write_response(ESPState *s)
 457 {
 458     uint8_t buf[2];
 459
 460     trace_esp_write_response(s->status);
 461
 462     buf[0] = s->status;
 463     buf[1] = 0;
 464
 465     if (s->dma) {
 466         if (s->dma_memory_write) {
 467             s->dma_memory_write(s->dma_opaque, buf, 2);
 468             s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 469             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 470             s->rregs[ESP_RSEQ] = SEQ_CD;
 471         } else {
 472             esp_set_pdma_cb(s, WRITE_RESPONSE_PDMA_CB);
 473             esp_raise_drq(s);
 474             return;
 475         }
 476     } else {
 477         fifo8_reset(&s->fifo);
 478         fifo8_push_all(&s->fifo, buf, 2);
 479         s->rregs[ESP_RFLAGS] = 2;
 480     }
 481     esp_raise_irq(s);
 482 }
 483
 484 static void esp_dma_done(ESPState *s)
 485 {
 486     s->rregs[ESP_RSTAT] |= STAT_TC;
 487     s->rregs[ESP_RINTR] |= INTR_BS;
 488     s->rregs[ESP_RFLAGS] = 0;
 489     esp_set_tc(s, 0);
 490     esp_raise_irq(s);
 491 }
 492
 493 static void do_dma_pdma_cb(ESPState *s)
 494 {
 495     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 496     int len;
 497     uint32_t n;
 498
 499     if (s->do_cmd) {
 500         /* Ensure we have received complete command after SATN and stop */
 501         if (esp_get_tc(s) || fifo8_is_empty(&s->cmdfifo)) {
 502             return;
 503         }
 504
 505         s->ti_size = 0;
 506         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
 507             /* No command received */
 508             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
 509                 return;
 510             }
 511
 512             /* Command has been received */
 513             s->do_cmd = 0;
 514             do_cmd(s);
 515         } else {
 516             /*
 517              * Extra message out bytes received: update cmdfifo_cdb_offset
 518              * and then switch to command phase
 519              */
 520             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 521             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 522             s->rregs[ESP_RSEQ] = SEQ_CD;
 523             s->rregs[ESP_RINTR] |= INTR_BS;
 524             esp_raise_irq(s);
 525         }
 526         return;
 527     }
 528
 529     if (!s->current_req) {
 530         return;
 531     }
 532
 533     if (to_device) {
 534         /* Copy FIFO data to device */
 535         len = MIN(s->async_len, ESP_FIFO_SZ);
 536         len = MIN(len, fifo8_num_used(&s->fifo));
 537         n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
 538         s->async_buf += n;
 539         s->async_len -= n;
 540         s->ti_size += n;
 541
 542         if (n < len) {
 543             /* Unaligned accesses can cause FIFO wraparound */
 544             len = len - n;
 545             n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
 546             s->async_buf += n;
 547             s->async_len -= n;
 548             s->ti_size += n;
 549         }
 550
 551         if (s->async_len == 0) {
 552             scsi_req_continue(s->current_req);
 553             return;
 554         }
 555
 556         if (esp_get_tc(s) == 0) {
 557             esp_lower_drq(s);
 558             esp_dma_done(s);
 559         }
 560
 561         return;
 562     } else {
 563         if (s->async_len == 0) {
 564             /* Defer until the scsi layer has completed */
 565             scsi_req_continue(s->current_req);
 566             s->data_in_ready = false;
 567             return;
 568         }
 569
 570         if (esp_get_tc(s) != 0) {
 571             /* Copy device data to FIFO */
 572             len = MIN(s->async_len, esp_get_tc(s));
 573             len = MIN(len, fifo8_num_free(&s->fifo));
 574             fifo8_push_all(&s->fifo, s->async_buf, len);
 575             s->async_buf += len;
 576             s->async_len -= len;
 577             s->ti_size -= len;
 578             esp_set_tc(s, esp_get_tc(s) - len);
 579
 580             if (esp_get_tc(s) == 0) {
 581                 /* Indicate transfer to FIFO is complete */
 582                  s->rregs[ESP_RSTAT] |= STAT_TC;
 583             }
 584             return;
 585         }
 586
 587         /* Partially filled a scsi buffer. Complete immediately.  */
 588         esp_lower_drq(s);
 589         esp_dma_done(s);
 590     }
 591 }
 592
 593 static void esp_do_dma(ESPState *s)
 594 {
 595     uint32_t len, cmdlen;
 596     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 597     uint8_t buf[ESP_CMDFIFO_SZ];
 598
 599     len = esp_get_tc(s);
 600     if (s->do_cmd) {
 601         /*
 602          * handle_ti_cmd() case: esp_do_dma() is called only from
 603          * handle_ti_cmd() with do_cmd != NULL (see the assert())
 604          */
 605         cmdlen = fifo8_num_used(&s->cmdfifo);
 606         trace_esp_do_dma(cmdlen, len);
 607         if (s->dma_memory_read) {
 608             len = MIN(len, fifo8_num_free(&s->cmdfifo));
 609             s->dma_memory_read(s->dma_opaque, buf, len);
 610             fifo8_push_all(&s->cmdfifo, buf, len);
 611         } else {
 612             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
 613             esp_raise_drq(s);
 614             return;
 615         }
 616         trace_esp_handle_ti_cmd(cmdlen);
 617         s->ti_size = 0;
 618         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
 619             /* No command received */
 620             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
 621                 return;
 622             }
 623
 624             /* Command has been received */
 625             s->do_cmd = 0;
 626             do_cmd(s);
 627         } else {
 628             /*
 629              * Extra message out bytes received: update cmdfifo_cdb_offset
 630              * and then switch to command phase
 631              */
 632             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 633             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 634             s->rregs[ESP_RSEQ] = SEQ_CD;
 635             s->rregs[ESP_RINTR] |= INTR_BS;
 636             esp_raise_irq(s);
 637         }
 638         return;
 639     }
 640     if (!s->current_req) {
 641         return;
 642     }
 643     if (s->async_len == 0) {
 644         /* Defer until data is available.  */
 645         return;
 646     }
 647     if (len > s->async_len) {
 648         len = s->async_len;
 649     }
 650     if (to_device) {
 651         if (s->dma_memory_read) {
 652             s->dma_memory_read(s->dma_opaque, s->async_buf, len);
 653         } else {
 654             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
 655             esp_raise_drq(s);
 656             return;
 657         }
 658     } else {
 659         if (s->dma_memory_write) {
 660             s->dma_memory_write(s->dma_opaque, s->async_buf, len);
 661         } else {
 662             /* Adjust TC for any leftover data in the FIFO */
 663             if (!fifo8_is_empty(&s->fifo)) {
 664                 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo));
 665             }
 666
 667             /* Copy device data to FIFO */
 668             len = MIN(len, fifo8_num_free(&s->fifo));
 669             fifo8_push_all(&s->fifo, s->async_buf, len);
 670             s->async_buf += len;
 671             s->async_len -= len;
 672             s->ti_size -= len;
 673
 674             /*
 675              * MacOS toolbox uses a TI length of 16 bytes for all commands, so
 676              * commands shorter than this must be padded accordingly
 677              */
 678             if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) {
 679                 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) {
 680                     esp_fifo_push(&s->fifo, 0);
 681                     len++;
 682                 }
 683             }
 684
 685             esp_set_tc(s, esp_get_tc(s) - len);
 686             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
 687             esp_raise_drq(s);
 688
 689             /* Indicate transfer to FIFO is complete */
 690             s->rregs[ESP_RSTAT] |= STAT_TC;
 691             return;
 692         }
 693     }
 694     esp_set_tc(s, esp_get_tc(s) - len);
 695     s->async_buf += len;
 696     s->async_len -= len;
 697     if (to_device) {
 698         s->ti_size += len;
 699     } else {
 700         s->ti_size -= len;
 701     }
 702     if (s->async_len == 0) {
 703         scsi_req_continue(s->current_req);
 704         /*
 705          * If there is still data to be read from the device then
 706          * complete the DMA operation immediately.  Otherwise defer
 707          * until the scsi layer has completed.
 708          */
 709         if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
 710             return;
 711         }
 712     }
 713
 714     /* Partially filled a scsi buffer. Complete immediately.  */
 715     esp_dma_done(s);
 716     esp_lower_drq(s);
 717 }
 718
 719 static void esp_do_nodma(ESPState *s)
 720 {
 721     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 722     uint32_t cmdlen;
 723     int len;
 724
 725     if (s->do_cmd) {
 726         cmdlen = fifo8_num_used(&s->cmdfifo);
 727         trace_esp_handle_ti_cmd(cmdlen);
 728         s->ti_size = 0;
 729         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
 730             /* No command received */
 731             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
 732                 return;
 733             }
 734
 735             /* Command has been received */
 736             s->do_cmd = 0;
 737             do_cmd(s);
 738         } else {
 739             /*
 740              * Extra message out bytes received: update cmdfifo_cdb_offset
 741              * and then switch to command phase
 742              */
 743             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 744             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 745             s->rregs[ESP_RSEQ] = SEQ_CD;
 746             s->rregs[ESP_RINTR] |= INTR_BS;
 747             esp_raise_irq(s);
 748         }
 749         return;
 750     }
 751
 752     if (!s->current_req) {
 753         return;
 754     }
 755
 756     if (s->async_len == 0) {
 757         /* Defer until data is available.  */
 758         return;
 759     }
 760
 761     if (to_device) {
 762         len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
 763         esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
 764         s->async_buf += len;
 765         s->async_len -= len;
 766         s->ti_size += len;
 767     } else {
 768         if (fifo8_is_empty(&s->fifo)) {
 769             fifo8_push(&s->fifo, s->async_buf[0]);
 770             s->async_buf++;
 771             s->async_len--;
 772             s->ti_size--;
 773         }
 774     }
 775
 776     if (s->async_len == 0) {
 777         scsi_req_continue(s->current_req);
 778         return;
 779     }
 780
 781     s->rregs[ESP_RINTR] |= INTR_BS;
 782     esp_raise_irq(s);
 783 }
 784
 785 static void esp_pdma_cb(ESPState *s)
 786 {
 787     switch (s->pdma_cb) {
 788     case SATN_PDMA_CB:
 789         satn_pdma_cb(s);
 790         break;
 791     case S_WITHOUT_SATN_PDMA_CB:
 792         s_without_satn_pdma_cb(s);
 793         break;
 794     case SATN_STOP_PDMA_CB:
 795         satn_stop_pdma_cb(s);
 796         break;
 797     case WRITE_RESPONSE_PDMA_CB:
 798         write_response_pdma_cb(s);
 799         break;
 800     case DO_DMA_PDMA_CB:
 801         do_dma_pdma_cb(s);
 802         break;
 803     default:
 804         g_assert_not_reached();
 805     }
 806 }
 807
 808 void esp_command_complete(SCSIRequest *req, size_t resid)
 809 {
 810     ESPState *s = req->hba_private;
 811     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 812
 813     trace_esp_command_complete();
 814
 815     /*
 816      * Non-DMA transfers from the target will leave the last byte in
 817      * the FIFO so don't reset ti_size in this case
 818      */
 819     if (s->dma || to_device) {
 820         if (s->ti_size != 0) {
 821             trace_esp_command_complete_unexpected();
 822         }
 823         s->ti_size = 0;
 824     }
 825
 826     s->async_len = 0;
 827     if (req->status) {
 828         trace_esp_command_complete_fail();
 829     }
 830     s->status = req->status;
 831
 832     /*
 833      * If the transfer is finished, switch to status phase. For non-DMA
 834      * transfers from the target the last byte is still in the FIFO
 835      */
 836     if (s->ti_size == 0) {
 837         s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 838         esp_dma_done(s);
 839         esp_lower_drq(s);
 840     }
 841
 842     if (s->current_req) {
 843         scsi_req_unref(s->current_req);
 844         s->current_req = NULL;
 845         s->current_dev = NULL;
 846     }
 847 }
 848
 849 void esp_transfer_data(SCSIRequest *req, uint32_t len)
 850 {
 851     ESPState *s = req->hba_private;
 852     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 853     uint32_t dmalen = esp_get_tc(s);
 854
 855     assert(!s->do_cmd);
 856     trace_esp_transfer_data(dmalen, s->ti_size);
 857     s->async_len = len;
 858     s->async_buf = scsi_req_get_buf(req);
 859
 860     if (!to_device && !s->data_in_ready) {
 861         /*
 862          * Initial incoming data xfer is complete so raise command
 863          * completion interrupt
 864          */
 865         s->data_in_ready = true;
 866         s->rregs[ESP_RSTAT] |= STAT_TC;
 867         s->rregs[ESP_RINTR] |= INTR_BS;
 868         esp_raise_irq(s);
 869     }
 870
 871     if (s->ti_cmd == 0) {
 872         /*
 873          * Always perform the initial transfer upon reception of the next TI
 874          * command to ensure the DMA/non-DMA status of the command is correct.
 875          * It is not possible to use s->dma directly in the section below as
 876          * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
 877          * async data transfer is delayed then s->dma is set incorrectly.
 878          */
 879         return;
 880     }
 881
 882     if (s->ti_cmd == (CMD_TI | CMD_DMA)) {
 883         if (dmalen) {
 884             esp_do_dma(s);
 885         } else if (s->ti_size <= 0) {
 886             /*
 887              * If this was the last part of a DMA transfer then the
 888              * completion interrupt is deferred to here.
 889              */
 890             esp_dma_done(s);
 891             esp_lower_drq(s);
 892         }
 893     } else if (s->ti_cmd == CMD_TI) {
 894         esp_do_nodma(s);
 895     }
 896 }
 897
 898 static void handle_ti(ESPState *s)
 899 {
 900     uint32_t dmalen;
 901
 902     if (s->dma && !s->dma_enabled) {
 903         s->dma_cb = handle_ti;
 904         return;
 905     }
 906
 907     s->ti_cmd = s->rregs[ESP_CMD];
 908     if (s->dma) {
 909         dmalen = esp_get_tc(s);
 910         trace_esp_handle_ti(dmalen);
 911         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 912         esp_do_dma(s);
 913     } else {
 914         trace_esp_handle_ti(s->ti_size);
 915         esp_do_nodma(s);
 916     }
 917 }
 918
 919 void esp_hard_reset(ESPState *s)
 920 {
 921     memset(s->rregs, 0, ESP_REGS);
 922     memset(s->wregs, 0, ESP_REGS);
 923     s->tchi_written = 0;
 924     s->ti_size = 0;
 925     s->async_len = 0;
 926     fifo8_reset(&s->fifo);
 927     fifo8_reset(&s->cmdfifo);
 928     s->dma = 0;
 929     s->do_cmd = 0;
 930     s->dma_cb = NULL;
 931
 932     s->rregs[ESP_CFG1] = 7;
 933 }
 934
 935 static void esp_soft_reset(ESPState *s)
 936 {
 937     qemu_irq_lower(s->irq);
 938     qemu_irq_lower(s->irq_data);
 939     esp_hard_reset(s);
 940 }
 941
 942 static void esp_bus_reset(ESPState *s)
 943 {
 944     bus_cold_reset(BUS(&s->bus));
 945 }
 946
 947 static void parent_esp_reset(ESPState *s, int irq, int level)
 948 {
 949     if (level) {
 950         esp_soft_reset(s);
 951     }
 952 }
 953
 954 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
 955 {
 956     uint32_t val;
 957
 958     switch (saddr) {
 959     case ESP_FIFO:
 960         if (s->dma_memory_read && s->dma_memory_write &&
 961                 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
 962             /* Data out.  */
 963             qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
 964             s->rregs[ESP_FIFO] = 0;
 965         } else {
 966             if ((s->rregs[ESP_RSTAT] & 0x7) == STAT_DI) {
 967                 if (s->ti_size) {
 968                     esp_do_nodma(s);
 969                 } else {
 970                     /*
 971                      * The last byte of a non-DMA transfer has been read out
 972                      * of the FIFO so switch to status phase
 973                      */
 974                     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 975                 }
 976             }
 977             s->rregs[ESP_FIFO] = esp_fifo_pop(&s->fifo);
 978         }
 979         val = s->rregs[ESP_FIFO];
 980         break;
 981     case ESP_RINTR:
 982         /*
 983          * Clear sequence step, interrupt register and all status bits
 984          * except TC
 985          */
 986         val = s->rregs[ESP_RINTR];
 987         s->rregs[ESP_RINTR] = 0;
 988         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 989         /*
 990          * According to the datasheet ESP_RSEQ should be cleared, but as the
 991          * emulation currently defers information transfers to the next TI
 992          * command leave it for now so that pedantic guests such as the old
 993          * Linux 2.6 driver see the correct flags before the next SCSI phase
 994          * transition.
 995          *
 996          * s->rregs[ESP_RSEQ] = SEQ_0;
 997          */
 998         esp_lower_irq(s);
 999         break;
1000     case ESP_TCHI:
1001         /* Return the unique id if the value has never been written */
1002         if (!s->tchi_written) {
1003             val = s->chip_id;
1004         } else {
1005             val = s->rregs[saddr];
1006         }
1007         break;
1008      case ESP_RFLAGS:
1009         /* Bottom 5 bits indicate number of bytes in FIFO */
1010         val = fifo8_num_used(&s->fifo);
1011         break;
1012     default:
1013         val = s->rregs[saddr];
1014         break;
1015     }
1016
1017     trace_esp_mem_readb(saddr, val);
1018     return val;
1019 }
1020
1021 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
1022 {
1023     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
1024     switch (saddr) {
1025     case ESP_TCHI:
1026         s->tchi_written = true;
1027         /* fall through */
1028     case ESP_TCLO:
1029     case ESP_TCMID:
1030         s->rregs[ESP_RSTAT] &= ~STAT_TC;
1031         break;
1032     case ESP_FIFO:
1033         if (s->do_cmd) {
1034             esp_fifo_push(&s->cmdfifo, val);
1035
1036             /*
1037              * If any unexpected message out/command phase data is
1038              * transferred using non-DMA, raise the interrupt
1039              */
1040             if (s->rregs[ESP_CMD] == CMD_TI) {
1041                 s->rregs[ESP_RINTR] |= INTR_BS;
1042                 esp_raise_irq(s);
1043             }
1044         } else {
1045             esp_fifo_push(&s->fifo, val);
1046         }
1047         break;
1048     case ESP_CMD:
1049         s->rregs[saddr] = val;
1050         if (val & CMD_DMA) {
1051             s->dma = 1;
1052             /* Reload DMA counter.  */
1053             if (esp_get_stc(s) == 0) {
1054                 esp_set_tc(s, 0x10000);
1055             } else {
1056                 esp_set_tc(s, esp_get_stc(s));
1057             }
1058         } else {
1059             s->dma = 0;
1060         }
1061         switch (val & CMD_CMD) {
1062         case CMD_NOP:
1063             trace_esp_mem_writeb_cmd_nop(val);
1064             break;
1065         case CMD_FLUSH:
1066             trace_esp_mem_writeb_cmd_flush(val);
1067             fifo8_reset(&s->fifo);
1068             break;
1069         case CMD_RESET:
1070             trace_esp_mem_writeb_cmd_reset(val);
1071             esp_soft_reset(s);
1072             break;
1073         case CMD_BUSRESET:
1074             trace_esp_mem_writeb_cmd_bus_reset(val);
1075             esp_bus_reset(s);
1076             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
1077                 s->rregs[ESP_RINTR] |= INTR_RST;
1078                 esp_raise_irq(s);
1079             }
1080             break;
1081         case CMD_TI:
1082             trace_esp_mem_writeb_cmd_ti(val);
1083             handle_ti(s);
1084             break;
1085         case CMD_ICCS:
1086             trace_esp_mem_writeb_cmd_iccs(val);
1087             write_response(s);
1088             s->rregs[ESP_RINTR] |= INTR_FC;
1089             s->rregs[ESP_RSTAT] |= STAT_MI;
1090             break;
1091         case CMD_MSGACC:
1092             trace_esp_mem_writeb_cmd_msgacc(val);
1093             s->rregs[ESP_RINTR] |= INTR_DC;
1094             s->rregs[ESP_RSEQ] = 0;
1095             s->rregs[ESP_RFLAGS] = 0;
1096             esp_raise_irq(s);
1097             break;
1098         case CMD_PAD:
1099             trace_esp_mem_writeb_cmd_pad(val);
1100             s->rregs[ESP_RSTAT] = STAT_TC;
1101             s->rregs[ESP_RINTR] |= INTR_FC;
1102             s->rregs[ESP_RSEQ] = 0;
1103             break;
1104         case CMD_SATN:
1105             trace_esp_mem_writeb_cmd_satn(val);
1106             break;
1107         case CMD_RSTATN:
1108             trace_esp_mem_writeb_cmd_rstatn(val);
1109             break;
1110         case CMD_SEL:
1111             trace_esp_mem_writeb_cmd_sel(val);
1112             handle_s_without_atn(s);
1113             break;
1114         case CMD_SELATN:
1115             trace_esp_mem_writeb_cmd_selatn(val);
1116             handle_satn(s);
1117             break;
1118         case CMD_SELATNS:
1119             trace_esp_mem_writeb_cmd_selatns(val);
1120             handle_satn_stop(s);
1121             break;
1122         case CMD_ENSEL:
1123             trace_esp_mem_writeb_cmd_ensel(val);
1124             s->rregs[ESP_RINTR] = 0;
1125             break;
1126         case CMD_DISSEL:
1127             trace_esp_mem_writeb_cmd_dissel(val);
1128             s->rregs[ESP_RINTR] = 0;
1129             esp_raise_irq(s);
1130             break;
1131         default:
1132             trace_esp_error_unhandled_command(val);
1133             break;
1134         }
1135         break;
1136     case ESP_WBUSID ... ESP_WSYNO:
1137         break;
1138     case ESP_CFG1:
1139     case ESP_CFG2: case ESP_CFG3:
1140     case ESP_RES3: case ESP_RES4:
1141         s->rregs[saddr] = val;
1142         break;
1143     case ESP_WCCF ... ESP_WTEST:
1144         break;
1145     default:
1146         trace_esp_error_invalid_write(val, saddr);
1147         return;
1148     }
1149     s->wregs[saddr] = val;
1150 }
1151
1152 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1153                             unsigned size, bool is_write,
1154                             MemTxAttrs attrs)
1155 {
1156     return (size == 1) || (is_write && size == 4);
1157 }
1158
1159 static bool esp_is_before_version_5(void *opaque, int version_id)
1160 {
1161     ESPState *s = ESP(opaque);
1162
1163     version_id = MIN(version_id, s->mig_version_id);
1164     return version_id < 5;
1165 }
1166
1167 static bool esp_is_version_5(void *opaque, int version_id)
1168 {
1169     ESPState *s = ESP(opaque);
1170
1171     version_id = MIN(version_id, s->mig_version_id);
1172     return version_id >= 5;
1173 }
1174
1175 static bool esp_is_version_6(void *opaque, int version_id)
1176 {
1177     ESPState *s = ESP(opaque);
1178
1179     version_id = MIN(version_id, s->mig_version_id);
1180     return version_id >= 6;
1181 }
1182
1183 int esp_pre_save(void *opaque)
1184 {
1185     ESPState *s = ESP(object_resolve_path_component(
1186                       OBJECT(opaque), "esp"));
1187
1188     s->mig_version_id = vmstate_esp.version_id;
1189     return 0;
1190 }
1191
1192 static int esp_post_load(void *opaque, int version_id)
1193 {
1194     ESPState *s = ESP(opaque);
1195     int len, i;
1196
1197     version_id = MIN(version_id, s->mig_version_id);
1198
1199     if (version_id < 5) {
1200         esp_set_tc(s, s->mig_dma_left);
1201
1202         /* Migrate ti_buf to fifo */
1203         len = s->mig_ti_wptr - s->mig_ti_rptr;
1204         for (i = 0; i < len; i++) {
1205             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1206         }
1207
1208         /* Migrate cmdbuf to cmdfifo */
1209         for (i = 0; i < s->mig_cmdlen; i++) {
1210             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1211         }
1212     }
1213
1214     s->mig_version_id = vmstate_esp.version_id;
1215     return 0;
1216 }
1217
1218 /*
1219  * PDMA (or pseudo-DMA) is only used on the Macintosh and requires the
1220  * guest CPU to perform the transfers between the SCSI bus and memory
1221  * itself. This is indicated by the dma_memory_read and dma_memory_write
1222  * functions being NULL (in contrast to the ESP PCI device) whilst
1223  * dma_enabled is still set.
1224  */
1225
1226 static bool esp_pdma_needed(void *opaque)
1227 {
1228     ESPState *s = ESP(opaque);
1229
1230     return s->dma_memory_read == NULL && s->dma_memory_write == NULL &&
1231            s->dma_enabled;
1232 }
1233
1234 static const VMStateDescription vmstate_esp_pdma = {
1235     .name = "esp/pdma",
1236     .version_id = 0,
1237     .minimum_version_id = 0,
1238     .needed = esp_pdma_needed,
1239     .fields = (VMStateField[]) {
1240         VMSTATE_UINT8(pdma_cb, ESPState),
1241         VMSTATE_END_OF_LIST()
1242     }
1243 };
1244
1245 const VMStateDescription vmstate_esp = {
1246     .name = "esp",
1247     .version_id = 6,
1248     .minimum_version_id = 3,
1249     .post_load = esp_post_load,
1250     .fields = (VMStateField[]) {
1251         VMSTATE_BUFFER(rregs, ESPState),
1252         VMSTATE_BUFFER(wregs, ESPState),
1253         VMSTATE_INT32(ti_size, ESPState),
1254         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1255         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1256         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1257         VMSTATE_UINT32(status, ESPState),
1258         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1259                             esp_is_before_version_5),
1260         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1261                           esp_is_before_version_5),
1262         VMSTATE_UINT32(dma, ESPState),
1263         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1264                               esp_is_before_version_5, 0, 16),
1265         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1266                               esp_is_before_version_5, 16,
1267                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
1268         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1269         VMSTATE_UINT32(do_cmd, ESPState),
1270         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1271         VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5),
1272         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1273         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1274         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1275         VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5),
1276         VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6),
1277         VMSTATE_END_OF_LIST()
1278     },
1279     .subsections = (const VMStateDescription * []) {
1280         &vmstate_esp_pdma,
1281         NULL
1282     }
1283 };
1284
1285 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1286                                  uint64_t val, unsigned int size)
1287 {
1288     SysBusESPState *sysbus = opaque;
1289     ESPState *s = ESP(&sysbus->esp);
1290     uint32_t saddr;
1291
1292     saddr = addr >> sysbus->it_shift;
1293     esp_reg_write(s, saddr, val);
1294 }
1295
1296 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1297                                     unsigned int size)
1298 {
1299     SysBusESPState *sysbus = opaque;
1300     ESPState *s = ESP(&sysbus->esp);
1301     uint32_t saddr;
1302
1303     saddr = addr >> sysbus->it_shift;
1304     return esp_reg_read(s, saddr);
1305 }
1306
1307 static const MemoryRegionOps sysbus_esp_mem_ops = {
1308     .read = sysbus_esp_mem_read,
1309     .write = sysbus_esp_mem_write,
1310     .endianness = DEVICE_NATIVE_ENDIAN,
1311     .valid.accepts = esp_mem_accepts,
1312 };
1313
1314 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1315                                   uint64_t val, unsigned int size)
1316 {
1317     SysBusESPState *sysbus = opaque;
1318     ESPState *s = ESP(&sysbus->esp);
1319
1320     trace_esp_pdma_write(size);
1321
1322     switch (size) {
1323     case 1:
1324         esp_pdma_write(s, val);
1325         break;
1326     case 2:
1327         esp_pdma_write(s, val >> 8);
1328         esp_pdma_write(s, val);
1329         break;
1330     }
1331     esp_pdma_cb(s);
1332 }
1333
1334 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1335                                      unsigned int size)
1336 {
1337     SysBusESPState *sysbus = opaque;
1338     ESPState *s = ESP(&sysbus->esp);
1339     uint64_t val = 0;
1340
1341     trace_esp_pdma_read(size);
1342
1343     switch (size) {
1344     case 1:
1345         val = esp_pdma_read(s);
1346         break;
1347     case 2:
1348         val = esp_pdma_read(s);
1349         val = (val << 8) | esp_pdma_read(s);
1350         break;
1351     }
1352     if (fifo8_num_used(&s->fifo) < 2) {
1353         esp_pdma_cb(s);
1354     }
1355     return val;
1356 }
1357
1358 static void *esp_load_request(QEMUFile *f, SCSIRequest *req)
1359 {
1360     ESPState *s = container_of(req->bus, ESPState, bus);
1361
1362     scsi_req_ref(req);
1363     s->current_req = req;
1364     return s;
1365 }
1366
1367 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1368     .read = sysbus_esp_pdma_read,
1369     .write = sysbus_esp_pdma_write,
1370     .endianness = DEVICE_NATIVE_ENDIAN,
1371     .valid.min_access_size = 1,
1372     .valid.max_access_size = 4,
1373     .impl.min_access_size = 1,
1374     .impl.max_access_size = 2,
1375 };
1376
1377 static const struct SCSIBusInfo esp_scsi_info = {
1378     .tcq = false,
1379     .max_target = ESP_MAX_DEVS,
1380     .max_lun = 7,
1381
1382     .load_request = esp_load_request,
1383     .transfer_data = esp_transfer_data,
1384     .complete = esp_command_complete,
1385     .cancel = esp_request_cancelled
1386 };
1387
1388 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1389 {
1390     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1391     ESPState *s = ESP(&sysbus->esp);
1392
1393     switch (irq) {
1394     case 0:
1395         parent_esp_reset(s, irq, level);
1396         break;
1397     case 1:
1398         esp_dma_enable(opaque, irq, level);
1399         break;
1400     }
1401 }
1402
1403 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1404 {
1405     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1406     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1407     ESPState *s = ESP(&sysbus->esp);
1408
1409     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1410         return;
1411     }
1412
1413     sysbus_init_irq(sbd, &s->irq);
1414     sysbus_init_irq(sbd, &s->irq_data);
1415     assert(sysbus->it_shift != -1);
1416
1417     s->chip_id = TCHI_FAS100A;
1418     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1419                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1420     sysbus_init_mmio(sbd, &sysbus->iomem);
1421     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1422                           sysbus, "esp-pdma", 4);
1423     sysbus_init_mmio(sbd, &sysbus->pdma);
1424
1425     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1426
1427     scsi_bus_init(&s->bus, sizeof(s->bus), dev, &esp_scsi_info);
1428 }
1429
1430 static void sysbus_esp_hard_reset(DeviceState *dev)
1431 {
1432     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1433     ESPState *s = ESP(&sysbus->esp);
1434
1435     esp_hard_reset(s);
1436 }
1437
1438 static void sysbus_esp_init(Object *obj)
1439 {
1440     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1441
1442     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1443 }
1444
1445 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1446     .name = "sysbusespscsi",
1447     .version_id = 2,
1448     .minimum_version_id = 1,
1449     .pre_save = esp_pre_save,
1450     .fields = (VMStateField[]) {
1451         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1452         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1453         VMSTATE_END_OF_LIST()
1454     }
1455 };
1456
1457 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1458 {
1459     DeviceClass *dc = DEVICE_CLASS(klass);
1460
1461     dc->realize = sysbus_esp_realize;
1462     dc->reset = sysbus_esp_hard_reset;
1463     dc->vmsd = &vmstate_sysbus_esp_scsi;
1464     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1465 }
1466
1467 static const TypeInfo sysbus_esp_info = {
1468     .name          = TYPE_SYSBUS_ESP,
1469     .parent        = TYPE_SYS_BUS_DEVICE,
1470     .instance_init = sysbus_esp_init,
1471     .instance_size = sizeof(SysBusESPState),
1472     .class_init    = sysbus_esp_class_init,
1473 };
1474
1475 static void esp_finalize(Object *obj)
1476 {
1477     ESPState *s = ESP(obj);
1478
1479     fifo8_destroy(&s->fifo);
1480     fifo8_destroy(&s->cmdfifo);
1481 }
1482
1483 static void esp_init(Object *obj)
1484 {
1485     ESPState *s = ESP(obj);
1486
1487     fifo8_create(&s->fifo, ESP_FIFO_SZ);
1488     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1489 }
1490
1491 static void esp_class_init(ObjectClass *klass, void *data)
1492 {
1493     DeviceClass *dc = DEVICE_CLASS(klass);
1494
1495     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1496     dc->user_creatable = false;
1497     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1498 }
1499
1500 static const TypeInfo esp_info = {
1501     .name = TYPE_ESP,
1502     .parent = TYPE_DEVICE,
1503     .instance_init = esp_init,
1504     .instance_finalize = esp_finalize,
1505     .instance_size = sizeof(ESPState),
1506     .class_init = esp_class_init,
1507 };
1508
1509 static void esp_register_types(void)
1510 {
1511     type_register_static(&sysbus_esp_info);
1512     type_register_static(&esp_info);
1513 }
1514
1515 type_init(esp_register_types)