hw/scsi/esp.c

   1 /*
   2  * QEMU ESP/NCR53C9x emulation
   3  *
   4  * Copyright (c) 2005-2006 Fabrice Bellard
   5  * Copyright (c) 2012 Herve Poussineau
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "hw/sysbus.h"
  28 #include "migration/vmstate.h"
  29 #include "hw/irq.h"
  30 #include "hw/scsi/esp.h"
  31 #include "trace.h"
  32 #include "qemu/log.h"
  33 #include "qemu/module.h"
  34
  35 /*
  36  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
  37  * also produced as NCR89C100. See
  38  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  39  * and
  40  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
  41  *
  42  * On Macintosh Quadra it is a NCR53C96.
  43  */
  44
  45 static void esp_raise_irq(ESPState *s)
  46 {
  47     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
  48         s->rregs[ESP_RSTAT] |= STAT_INT;
  49         qemu_irq_raise(s->irq);
  50         trace_esp_raise_irq();
  51     }
  52 }
  53
  54 static void esp_lower_irq(ESPState *s)
  55 {
  56     if (s->rregs[ESP_RSTAT] & STAT_INT) {
  57         s->rregs[ESP_RSTAT] &= ~STAT_INT;
  58         qemu_irq_lower(s->irq);
  59         trace_esp_lower_irq();
  60     }
  61 }
  62
  63 static void esp_raise_drq(ESPState *s)
  64 {
  65     qemu_irq_raise(s->irq_data);
  66     trace_esp_raise_drq();
  67 }
  68
  69 static void esp_lower_drq(ESPState *s)
  70 {
  71     qemu_irq_lower(s->irq_data);
  72     trace_esp_lower_drq();
  73 }
  74
  75 void esp_dma_enable(ESPState *s, int irq, int level)
  76 {
  77     if (level) {
  78         s->dma_enabled = 1;
  79         trace_esp_dma_enable();
  80         if (s->dma_cb) {
  81             s->dma_cb(s);
  82             s->dma_cb = NULL;
  83         }
  84     } else {
  85         trace_esp_dma_disable();
  86         s->dma_enabled = 0;
  87     }
  88 }
  89
  90 void esp_request_cancelled(SCSIRequest *req)
  91 {
  92     ESPState *s = req->hba_private;
  93
  94     if (req == s->current_req) {
  95         scsi_req_unref(s->current_req);
  96         s->current_req = NULL;
  97         s->current_dev = NULL;
  98         s->async_len = 0;
  99     }
 100 }
 101
 102 static void esp_fifo_push(Fifo8 *fifo, uint8_t val)
 103 {
 104     if (fifo8_num_used(fifo) == fifo->capacity) {
 105         trace_esp_error_fifo_overrun();
 106         return;
 107     }
 108
 109     fifo8_push(fifo, val);
 110 }
 111
 112 static uint8_t esp_fifo_pop(Fifo8 *fifo)
 113 {
 114     if (fifo8_is_empty(fifo)) {
 115         return 0;
 116     }
 117
 118     return fifo8_pop(fifo);
 119 }
 120
 121 static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen)
 122 {
 123     const uint8_t *buf;
 124     uint32_t n;
 125
 126     if (maxlen == 0) {
 127         return 0;
 128     }
 129
 130     buf = fifo8_pop_buf(fifo, maxlen, &n);
 131     if (dest) {
 132         memcpy(dest, buf, n);
 133     }
 134
 135     return n;
 136 }
 137
 138 static uint32_t esp_get_tc(ESPState *s)
 139 {
 140     uint32_t dmalen;
 141
 142     dmalen = s->rregs[ESP_TCLO];
 143     dmalen |= s->rregs[ESP_TCMID] << 8;
 144     dmalen |= s->rregs[ESP_TCHI] << 16;
 145
 146     return dmalen;
 147 }
 148
 149 static void esp_set_tc(ESPState *s, uint32_t dmalen)
 150 {
 151     s->rregs[ESP_TCLO] = dmalen;
 152     s->rregs[ESP_TCMID] = dmalen >> 8;
 153     s->rregs[ESP_TCHI] = dmalen >> 16;
 154 }
 155
 156 static uint32_t esp_get_stc(ESPState *s)
 157 {
 158     uint32_t dmalen;
 159
 160     dmalen = s->wregs[ESP_TCLO];
 161     dmalen |= s->wregs[ESP_TCMID] << 8;
 162     dmalen |= s->wregs[ESP_TCHI] << 16;
 163
 164     return dmalen;
 165 }
 166
 167 static uint8_t esp_pdma_read(ESPState *s)
 168 {
 169     uint8_t val;
 170
 171     if (s->do_cmd) {
 172         val = esp_fifo_pop(&s->cmdfifo);
 173     } else {
 174         val = esp_fifo_pop(&s->fifo);
 175     }
 176
 177     return val;
 178 }
 179
 180 static void esp_pdma_write(ESPState *s, uint8_t val)
 181 {
 182     uint32_t dmalen = esp_get_tc(s);
 183
 184     if (dmalen == 0) {
 185         return;
 186     }
 187
 188     if (s->do_cmd) {
 189         esp_fifo_push(&s->cmdfifo, val);
 190     } else {
 191         esp_fifo_push(&s->fifo, val);
 192     }
 193
 194     dmalen--;
 195     esp_set_tc(s, dmalen);
 196 }
 197
 198 static void esp_set_pdma_cb(ESPState *s, enum pdma_cb cb)
 199 {
 200     s->pdma_cb = cb;
 201 }
 202
 203 static int esp_select(ESPState *s)
 204 {
 205     int target;
 206
 207     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 208
 209     s->ti_size = 0;
 210     fifo8_reset(&s->fifo);
 211
 212     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
 213     if (!s->current_dev) {
 214         /* No such drive */
 215         s->rregs[ESP_RSTAT] = 0;
 216         s->rregs[ESP_RINTR] = INTR_DC;
 217         s->rregs[ESP_RSEQ] = SEQ_0;
 218         esp_raise_irq(s);
 219         return -1;
 220     }
 221
 222     /*
 223      * Note that we deliberately don't raise the IRQ here: this will be done
 224      * either in do_command_phase() for DATA OUT transfers or by the deferred
 225      * IRQ mechanism in esp_transfer_data() for DATA IN transfers
 226      */
 227     s->rregs[ESP_RINTR] |= INTR_FC;
 228     s->rregs[ESP_RSEQ] = SEQ_CD;
 229     return 0;
 230 }
 231
 232 static uint32_t get_cmd(ESPState *s, uint32_t maxlen)
 233 {
 234     uint8_t buf[ESP_CMDFIFO_SZ];
 235     uint32_t dmalen, n;
 236     int target;
 237
 238     if (s->current_req) {
 239         /* Started a new command before the old one finished.  Cancel it.  */
 240         scsi_req_cancel(s->current_req);
 241     }
 242
 243     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 244     if (s->dma) {
 245         dmalen = MIN(esp_get_tc(s), maxlen);
 246         if (dmalen == 0) {
 247             return 0;
 248         }
 249         if (s->dma_memory_read) {
 250             s->dma_memory_read(s->dma_opaque, buf, dmalen);
 251             dmalen = MIN(fifo8_num_free(&s->cmdfifo), dmalen);
 252             fifo8_push_all(&s->cmdfifo, buf, dmalen);
 253         } else {
 254             if (esp_select(s) < 0) {
 255                 fifo8_reset(&s->cmdfifo);
 256                 return -1;
 257             }
 258             esp_raise_drq(s);
 259             fifo8_reset(&s->cmdfifo);
 260             return 0;
 261         }
 262     } else {
 263         dmalen = MIN(fifo8_num_used(&s->fifo), maxlen);
 264         if (dmalen == 0) {
 265             return 0;
 266         }
 267         n = esp_fifo_pop_buf(&s->fifo, buf, dmalen);
 268         n = MIN(fifo8_num_free(&s->cmdfifo), n);
 269         fifo8_push_all(&s->cmdfifo, buf, n);
 270     }
 271     trace_esp_get_cmd(dmalen, target);
 272
 273     if (esp_select(s) < 0) {
 274         fifo8_reset(&s->cmdfifo);
 275         return -1;
 276     }
 277     return dmalen;
 278 }
 279
 280 static void do_command_phase(ESPState *s)
 281 {
 282     uint32_t cmdlen;
 283     int32_t datalen;
 284     SCSIDevice *current_lun;
 285     uint8_t buf[ESP_CMDFIFO_SZ];
 286
 287     trace_esp_do_command_phase(s->lun);
 288     cmdlen = fifo8_num_used(&s->cmdfifo);
 289     if (!cmdlen || !s->current_dev) {
 290         return;
 291     }
 292     esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
 293
 294     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
 295     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, s);
 296     datalen = scsi_req_enqueue(s->current_req);
 297     s->ti_size = datalen;
 298     fifo8_reset(&s->cmdfifo);
 299     if (datalen != 0) {
 300         s->rregs[ESP_RSTAT] = STAT_TC;
 301         s->rregs[ESP_RSEQ] = SEQ_CD;
 302         s->ti_cmd = 0;
 303         esp_set_tc(s, 0);
 304         if (datalen > 0) {
 305             /*
 306              * Switch to DATA IN phase but wait until initial data xfer is
 307              * complete before raising the command completion interrupt
 308              */
 309             s->data_in_ready = false;
 310             s->rregs[ESP_RSTAT] |= STAT_DI;
 311         } else {
 312             s->rregs[ESP_RSTAT] |= STAT_DO;
 313             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 314             esp_raise_irq(s);
 315             esp_lower_drq(s);
 316         }
 317         scsi_req_continue(s->current_req);
 318         return;
 319     }
 320 }
 321
 322 static void do_message_phase(ESPState *s)
 323 {
 324     if (s->cmdfifo_cdb_offset) {
 325         uint8_t message = esp_fifo_pop(&s->cmdfifo);
 326
 327         trace_esp_do_identify(message);
 328         s->lun = message & 7;
 329         s->cmdfifo_cdb_offset--;
 330     }
 331
 332     /* Ignore extended messages for now */
 333     if (s->cmdfifo_cdb_offset) {
 334         int len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
 335         esp_fifo_pop_buf(&s->cmdfifo, NULL, len);
 336         s->cmdfifo_cdb_offset = 0;
 337     }
 338 }
 339
 340 static void do_cmd(ESPState *s)
 341 {
 342     do_message_phase(s);
 343     assert(s->cmdfifo_cdb_offset == 0);
 344     do_command_phase(s);
 345 }
 346
 347 static void satn_pdma_cb(ESPState *s)
 348 {
 349     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
 350         s->cmdfifo_cdb_offset = 1;
 351         s->do_cmd = 0;
 352         do_cmd(s);
 353     }
 354 }
 355
 356 static void handle_satn(ESPState *s)
 357 {
 358     int32_t cmdlen;
 359
 360     if (s->dma && !s->dma_enabled) {
 361         s->dma_cb = handle_satn;
 362         return;
 363     }
 364     esp_set_pdma_cb(s, SATN_PDMA_CB);
 365     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
 366     if (cmdlen > 0) {
 367         s->cmdfifo_cdb_offset = 1;
 368         s->do_cmd = 0;
 369         do_cmd(s);
 370     } else if (cmdlen == 0) {
 371         s->do_cmd = 1;
 372         /* Target present, but no cmd yet - switch to command phase */
 373         s->rregs[ESP_RSEQ] = SEQ_CD;
 374         s->rregs[ESP_RSTAT] = STAT_CD;
 375     }
 376 }
 377
 378 static void s_without_satn_pdma_cb(ESPState *s)
 379 {
 380     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
 381         s->cmdfifo_cdb_offset = 0;
 382         s->do_cmd = 0;
 383         do_cmd(s);
 384     }
 385 }
 386
 387 static void handle_s_without_atn(ESPState *s)
 388 {
 389     int32_t cmdlen;
 390
 391     if (s->dma && !s->dma_enabled) {
 392         s->dma_cb = handle_s_without_atn;
 393         return;
 394     }
 395     esp_set_pdma_cb(s, S_WITHOUT_SATN_PDMA_CB);
 396     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
 397     if (cmdlen > 0) {
 398         s->cmdfifo_cdb_offset = 0;
 399         s->do_cmd = 0;
 400         do_cmd(s);
 401     } else if (cmdlen == 0) {
 402         s->do_cmd = 1;
 403         /* Target present, but no cmd yet - switch to command phase */
 404         s->rregs[ESP_RSEQ] = SEQ_CD;
 405         s->rregs[ESP_RSTAT] = STAT_CD;
 406     }
 407 }
 408
 409 static void satn_stop_pdma_cb(ESPState *s)
 410 {
 411     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
 412         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
 413         s->do_cmd = 1;
 414         s->cmdfifo_cdb_offset = 1;
 415         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 416         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 417         s->rregs[ESP_RSEQ] = SEQ_CD;
 418         esp_raise_irq(s);
 419     }
 420 }
 421
 422 static void handle_satn_stop(ESPState *s)
 423 {
 424     int32_t cmdlen;
 425
 426     if (s->dma && !s->dma_enabled) {
 427         s->dma_cb = handle_satn_stop;
 428         return;
 429     }
 430     esp_set_pdma_cb(s, SATN_STOP_PDMA_CB);
 431     cmdlen = get_cmd(s, 1);
 432     if (cmdlen > 0) {
 433         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
 434         s->do_cmd = 1;
 435         s->cmdfifo_cdb_offset = 1;
 436         s->rregs[ESP_RSTAT] = STAT_MO;
 437         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 438         s->rregs[ESP_RSEQ] = SEQ_MO;
 439         esp_raise_irq(s);
 440     } else if (cmdlen == 0) {
 441         s->do_cmd = 1;
 442         /* Target present, switch to message out phase */
 443         s->rregs[ESP_RSEQ] = SEQ_MO;
 444         s->rregs[ESP_RSTAT] = STAT_MO;
 445     }
 446 }
 447
 448 static void write_response_pdma_cb(ESPState *s)
 449 {
 450     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 451     s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 452     s->rregs[ESP_RSEQ] = SEQ_CD;
 453     esp_raise_irq(s);
 454 }
 455
 456 static void write_response(ESPState *s)
 457 {
 458     uint8_t buf[2];
 459
 460     trace_esp_write_response(s->status);
 461
 462     buf[0] = s->status;
 463     buf[1] = 0;
 464
 465     if (s->dma) {
 466         if (s->dma_memory_write) {
 467             s->dma_memory_write(s->dma_opaque, buf, 2);
 468             s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 469             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 470             s->rregs[ESP_RSEQ] = SEQ_CD;
 471         } else {
 472             esp_set_pdma_cb(s, WRITE_RESPONSE_PDMA_CB);
 473             esp_raise_drq(s);
 474             return;
 475         }
 476     } else {
 477         fifo8_reset(&s->fifo);
 478         fifo8_push_all(&s->fifo, buf, 2);
 479         s->rregs[ESP_RFLAGS] = 2;
 480     }
 481     esp_raise_irq(s);
 482 }
 483
 484 static void esp_dma_done(ESPState *s)
 485 {
 486     s->rregs[ESP_RSTAT] |= STAT_TC;
 487     s->rregs[ESP_RINTR] |= INTR_BS;
 488     s->rregs[ESP_RFLAGS] = 0;
 489     esp_set_tc(s, 0);
 490     esp_raise_irq(s);
 491 }
 492
 493 static void do_dma_pdma_cb(ESPState *s)
 494 {
 495     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 496     int len;
 497     uint32_t n;
 498
 499     if (s->do_cmd) {
 500         /* Ensure we have received complete command after SATN and stop */
 501         if (esp_get_tc(s) || fifo8_is_empty(&s->cmdfifo)) {
 502             return;
 503         }
 504
 505         s->ti_size = 0;
 506         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
 507             /* No command received */
 508             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
 509                 return;
 510             }
 511
 512             /* Command has been received */
 513             s->do_cmd = 0;
 514             do_cmd(s);
 515         } else {
 516             /*
 517              * Extra message out bytes received: update cmdfifo_cdb_offset
 518              * and then switch to commmand phase
 519              */
 520             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 521             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 522             s->rregs[ESP_RSEQ] = SEQ_CD;
 523             s->rregs[ESP_RINTR] |= INTR_BS;
 524             esp_raise_irq(s);
 525         }
 526         return;
 527     }
 528
 529     if (!s->current_req) {
 530         return;
 531     }
 532
 533     if (to_device) {
 534         /* Copy FIFO data to device */
 535         len = MIN(s->async_len, ESP_FIFO_SZ);
 536         len = MIN(len, fifo8_num_used(&s->fifo));
 537         n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
 538         s->async_buf += n;
 539         s->async_len -= n;
 540         s->ti_size += n;
 541
 542         if (n < len) {
 543             /* Unaligned accesses can cause FIFO wraparound */
 544             len = len - n;
 545             n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
 546             s->async_buf += n;
 547             s->async_len -= n;
 548             s->ti_size += n;
 549         }
 550
 551         if (s->async_len == 0) {
 552             scsi_req_continue(s->current_req);
 553             return;
 554         }
 555
 556         if (esp_get_tc(s) == 0) {
 557             esp_lower_drq(s);
 558             esp_dma_done(s);
 559         }
 560
 561         return;
 562     } else {
 563         if (s->async_len == 0) {
 564             /* Defer until the scsi layer has completed */
 565             scsi_req_continue(s->current_req);
 566             s->data_in_ready = false;
 567             return;
 568         }
 569
 570         if (esp_get_tc(s) != 0) {
 571             /* Copy device data to FIFO */
 572             len = MIN(s->async_len, esp_get_tc(s));
 573             len = MIN(len, fifo8_num_free(&s->fifo));
 574             fifo8_push_all(&s->fifo, s->async_buf, len);
 575             s->async_buf += len;
 576             s->async_len -= len;
 577             s->ti_size -= len;
 578             esp_set_tc(s, esp_get_tc(s) - len);
 579
 580             if (esp_get_tc(s) == 0) {
 581                 /* Indicate transfer to FIFO is complete */
 582                  s->rregs[ESP_RSTAT] |= STAT_TC;
 583             }
 584             return;
 585         }
 586
 587         /* Partially filled a scsi buffer. Complete immediately.  */
 588         esp_lower_drq(s);
 589         esp_dma_done(s);
 590     }
 591 }
 592
 593 static void esp_do_dma(ESPState *s)
 594 {
 595     uint32_t len, cmdlen;
 596     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 597     uint8_t buf[ESP_CMDFIFO_SZ];
 598
 599     len = esp_get_tc(s);
 600     if (s->do_cmd) {
 601         /*
 602          * handle_ti_cmd() case: esp_do_dma() is called only from
 603          * handle_ti_cmd() with do_cmd != NULL (see the assert())
 604          */
 605         cmdlen = fifo8_num_used(&s->cmdfifo);
 606         trace_esp_do_dma(cmdlen, len);
 607         if (s->dma_memory_read) {
 608             len = MIN(len, fifo8_num_free(&s->cmdfifo));
 609             s->dma_memory_read(s->dma_opaque, buf, len);
 610             fifo8_push_all(&s->cmdfifo, buf, len);
 611         } else {
 612             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
 613             esp_raise_drq(s);
 614             return;
 615         }
 616         trace_esp_handle_ti_cmd(cmdlen);
 617         s->ti_size = 0;
 618         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
 619             /* No command received */
 620             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
 621                 return;
 622             }
 623
 624             /* Command has been received */
 625             s->do_cmd = 0;
 626             do_cmd(s);
 627         } else {
 628             /*
 629              * Extra message out bytes received: update cmdfifo_cdb_offset
 630              * and then switch to commmand phase
 631              */
 632             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 633             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 634             s->rregs[ESP_RSEQ] = SEQ_CD;
 635             s->rregs[ESP_RINTR] |= INTR_BS;
 636             esp_raise_irq(s);
 637         }
 638         return;
 639     }
 640     if (!s->current_req) {
 641         return;
 642     }
 643     if (s->async_len == 0) {
 644         /* Defer until data is available.  */
 645         return;
 646     }
 647     if (len > s->async_len) {
 648         len = s->async_len;
 649     }
 650     if (to_device) {
 651         if (s->dma_memory_read) {
 652             s->dma_memory_read(s->dma_opaque, s->async_buf, len);
 653         } else {
 654             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
 655             esp_raise_drq(s);
 656             return;
 657         }
 658     } else {
 659         if (s->dma_memory_write) {
 660             s->dma_memory_write(s->dma_opaque, s->async_buf, len);
 661         } else {
 662             /* Adjust TC for any leftover data in the FIFO */
 663             if (!fifo8_is_empty(&s->fifo)) {
 664                 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo));
 665             }
 666
 667             /* Copy device data to FIFO */
 668             len = MIN(len, fifo8_num_free(&s->fifo));
 669             fifo8_push_all(&s->fifo, s->async_buf, len);
 670             s->async_buf += len;
 671             s->async_len -= len;
 672             s->ti_size -= len;
 673
 674             /*
 675              * MacOS toolbox uses a TI length of 16 bytes for all commands, so
 676              * commands shorter than this must be padded accordingly
 677              */
 678             if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) {
 679                 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) {
 680                     esp_fifo_push(&s->fifo, 0);
 681                     len++;
 682                 }
 683             }
 684
 685             esp_set_tc(s, esp_get_tc(s) - len);
 686             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
 687             esp_raise_drq(s);
 688
 689             /* Indicate transfer to FIFO is complete */
 690             s->rregs[ESP_RSTAT] |= STAT_TC;
 691             return;
 692         }
 693     }
 694     esp_set_tc(s, esp_get_tc(s) - len);
 695     s->async_buf += len;
 696     s->async_len -= len;
 697     if (to_device) {
 698         s->ti_size += len;
 699     } else {
 700         s->ti_size -= len;
 701     }
 702     if (s->async_len == 0) {
 703         scsi_req_continue(s->current_req);
 704         /*
 705          * If there is still data to be read from the device then
 706          * complete the DMA operation immediately.  Otherwise defer
 707          * until the scsi layer has completed.
 708          */
 709         if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
 710             return;
 711         }
 712     }
 713
 714     /* Partially filled a scsi buffer. Complete immediately.  */
 715     esp_dma_done(s);
 716     esp_lower_drq(s);
 717 }
 718
 719 static void esp_do_nodma(ESPState *s)
 720 {
 721     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 722     uint32_t cmdlen;
 723     int len;
 724
 725     if (s->do_cmd) {
 726         cmdlen = fifo8_num_used(&s->cmdfifo);
 727         trace_esp_handle_ti_cmd(cmdlen);
 728         s->ti_size = 0;
 729         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
 730             /* No command received */
 731             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
 732                 return;
 733             }
 734
 735             /* Command has been received */
 736             s->do_cmd = 0;
 737             do_cmd(s);
 738         } else {
 739             /*
 740              * Extra message out bytes received: update cmdfifo_cdb_offset
 741              * and then switch to commmand phase
 742              */
 743             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 744             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 745             s->rregs[ESP_RSEQ] = SEQ_CD;
 746             s->rregs[ESP_RINTR] |= INTR_BS;
 747             esp_raise_irq(s);
 748         }
 749         return;
 750     }
 751
 752     if (!s->current_req) {
 753         return;
 754     }
 755
 756     if (s->async_len == 0) {
 757         /* Defer until data is available.  */
 758         return;
 759     }
 760
 761     if (to_device) {
 762         len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
 763         esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
 764         s->async_buf += len;
 765         s->async_len -= len;
 766         s->ti_size += len;
 767     } else {
 768         if (fifo8_is_empty(&s->fifo)) {
 769             fifo8_push(&s->fifo, s->async_buf[0]);
 770             s->async_buf++;
 771             s->async_len--;
 772             s->ti_size--;
 773         }
 774     }
 775
 776     if (s->async_len == 0) {
 777         scsi_req_continue(s->current_req);
 778         return;
 779     }
 780
 781     s->rregs[ESP_RINTR] |= INTR_BS;
 782     esp_raise_irq(s);
 783 }
 784
 785 static void esp_pdma_cb(ESPState *s)
 786 {
 787     switch (s->pdma_cb) {
 788     case SATN_PDMA_CB:
 789         satn_pdma_cb(s);
 790         break;
 791     case S_WITHOUT_SATN_PDMA_CB:
 792         s_without_satn_pdma_cb(s);
 793         break;
 794     case SATN_STOP_PDMA_CB:
 795         satn_stop_pdma_cb(s);
 796         break;
 797     case WRITE_RESPONSE_PDMA_CB:
 798         write_response_pdma_cb(s);
 799         break;
 800     case DO_DMA_PDMA_CB:
 801         do_dma_pdma_cb(s);
 802         break;
 803     default:
 804         g_assert_not_reached();
 805     }
 806 }
 807
 808 void esp_command_complete(SCSIRequest *req, size_t resid)
 809 {
 810     ESPState *s = req->hba_private;
 811     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 812
 813     trace_esp_command_complete();
 814
 815     /*
 816      * Non-DMA transfers from the target will leave the last byte in
 817      * the FIFO so don't reset ti_size in this case
 818      */
 819     if (s->dma || to_device) {
 820         if (s->ti_size != 0) {
 821             trace_esp_command_complete_unexpected();
 822         }
 823         s->ti_size = 0;
 824     }
 825
 826     s->async_len = 0;
 827     if (req->status) {
 828         trace_esp_command_complete_fail();
 829     }
 830     s->status = req->status;
 831
 832     /*
 833      * If the transfer is finished, switch to status phase. For non-DMA
 834      * transfers from the target the last byte is still in the FIFO
 835      */
 836     if (s->ti_size == 0) {
 837         s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 838         esp_dma_done(s);
 839         esp_lower_drq(s);
 840     }
 841
 842     if (s->current_req) {
 843         scsi_req_unref(s->current_req);
 844         s->current_req = NULL;
 845         s->current_dev = NULL;
 846     }
 847 }
 848
 849 void esp_transfer_data(SCSIRequest *req, uint32_t len)
 850 {
 851     ESPState *s = req->hba_private;
 852     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 853     uint32_t dmalen = esp_get_tc(s);
 854
 855     assert(!s->do_cmd);
 856     trace_esp_transfer_data(dmalen, s->ti_size);
 857     s->async_len = len;
 858     s->async_buf = scsi_req_get_buf(req);
 859
 860     if (!to_device && !s->data_in_ready) {
 861         /*
 862          * Initial incoming data xfer is complete so raise command
 863          * completion interrupt
 864          */
 865         s->data_in_ready = true;
 866         s->rregs[ESP_RSTAT] |= STAT_TC;
 867         s->rregs[ESP_RINTR] |= INTR_BS;
 868         esp_raise_irq(s);
 869     }
 870
 871     if (s->ti_cmd == 0) {
 872         /*
 873          * Always perform the initial transfer upon reception of the next TI
 874          * command to ensure the DMA/non-DMA status of the command is correct.
 875          * It is not possible to use s->dma directly in the section below as
 876          * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
 877          * async data transfer is delayed then s->dma is set incorrectly.
 878          */
 879         return;
 880     }
 881
 882     if (s->ti_cmd == (CMD_TI | CMD_DMA)) {
 883         if (dmalen) {
 884             esp_do_dma(s);
 885         } else if (s->ti_size <= 0) {
 886             /*
 887              * If this was the last part of a DMA transfer then the
 888              * completion interrupt is deferred to here.
 889              */
 890             esp_dma_done(s);
 891             esp_lower_drq(s);
 892         }
 893     } else if (s->ti_cmd == CMD_TI) {
 894         esp_do_nodma(s);
 895     }
 896 }
 897
 898 static void handle_ti(ESPState *s)
 899 {
 900     uint32_t dmalen;
 901
 902     if (s->dma && !s->dma_enabled) {
 903         s->dma_cb = handle_ti;
 904         return;
 905     }
 906
 907     s->ti_cmd = s->rregs[ESP_CMD];
 908     if (s->dma) {
 909         dmalen = esp_get_tc(s);
 910         trace_esp_handle_ti(dmalen);
 911         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 912         esp_do_dma(s);
 913     } else {
 914         trace_esp_handle_ti(s->ti_size);
 915         esp_do_nodma(s);
 916     }
 917 }
 918
 919 void esp_hard_reset(ESPState *s)
 920 {
 921     memset(s->rregs, 0, ESP_REGS);
 922     memset(s->wregs, 0, ESP_REGS);
 923     s->tchi_written = 0;
 924     s->ti_size = 0;
 925     s->async_len = 0;
 926     fifo8_reset(&s->fifo);
 927     fifo8_reset(&s->cmdfifo);
 928     s->dma = 0;
 929     s->do_cmd = 0;
 930     s->dma_cb = NULL;
 931
 932     s->rregs[ESP_CFG1] = 7;
 933 }
 934
 935 static void esp_soft_reset(ESPState *s)
 936 {
 937     qemu_irq_lower(s->irq);
 938     qemu_irq_lower(s->irq_data);
 939     esp_hard_reset(s);
 940 }
 941
 942 static void parent_esp_reset(ESPState *s, int irq, int level)
 943 {
 944     if (level) {
 945         esp_soft_reset(s);
 946     }
 947 }
 948
 949 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
 950 {
 951     uint32_t val;
 952
 953     switch (saddr) {
 954     case ESP_FIFO:
 955         if (s->dma_memory_read && s->dma_memory_write &&
 956                 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
 957             /* Data out.  */
 958             qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
 959             s->rregs[ESP_FIFO] = 0;
 960         } else {
 961             if ((s->rregs[ESP_RSTAT] & 0x7) == STAT_DI) {
 962                 if (s->ti_size) {
 963                     esp_do_nodma(s);
 964                 } else {
 965                     /*
 966                      * The last byte of a non-DMA transfer has been read out
 967                      * of the FIFO so switch to status phase
 968                      */
 969                     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 970                 }
 971             }
 972             s->rregs[ESP_FIFO] = esp_fifo_pop(&s->fifo);
 973         }
 974         val = s->rregs[ESP_FIFO];
 975         break;
 976     case ESP_RINTR:
 977         /*
 978          * Clear sequence step, interrupt register and all status bits
 979          * except TC
 980          */
 981         val = s->rregs[ESP_RINTR];
 982         s->rregs[ESP_RINTR] = 0;
 983         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 984         /*
 985          * According to the datasheet ESP_RSEQ should be cleared, but as the
 986          * emulation currently defers information transfers to the next TI
 987          * command leave it for now so that pedantic guests such as the old
 988          * Linux 2.6 driver see the correct flags before the next SCSI phase
 989          * transition.
 990          *
 991          * s->rregs[ESP_RSEQ] = SEQ_0;
 992          */
 993         esp_lower_irq(s);
 994         break;
 995     case ESP_TCHI:
 996         /* Return the unique id if the value has never been written */
 997         if (!s->tchi_written) {
 998             val = s->chip_id;
 999         } else {
1000             val = s->rregs[saddr];
1001         }
1002         break;
1003      case ESP_RFLAGS:
1004         /* Bottom 5 bits indicate number of bytes in FIFO */
1005         val = fifo8_num_used(&s->fifo);
1006         break;
1007     default:
1008         val = s->rregs[saddr];
1009         break;
1010     }
1011
1012     trace_esp_mem_readb(saddr, val);
1013     return val;
1014 }
1015
1016 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
1017 {
1018     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
1019     switch (saddr) {
1020     case ESP_TCHI:
1021         s->tchi_written = true;
1022         /* fall through */
1023     case ESP_TCLO:
1024     case ESP_TCMID:
1025         s->rregs[ESP_RSTAT] &= ~STAT_TC;
1026         break;
1027     case ESP_FIFO:
1028         if (s->do_cmd) {
1029             esp_fifo_push(&s->cmdfifo, val);
1030
1031             /*
1032              * If any unexpected message out/command phase data is
1033              * transferred using non-DMA, raise the interrupt
1034              */
1035             if (s->rregs[ESP_CMD] == CMD_TI) {
1036                 s->rregs[ESP_RINTR] |= INTR_BS;
1037                 esp_raise_irq(s);
1038             }
1039         } else {
1040             esp_fifo_push(&s->fifo, val);
1041         }
1042         break;
1043     case ESP_CMD:
1044         s->rregs[saddr] = val;
1045         if (val & CMD_DMA) {
1046             s->dma = 1;
1047             /* Reload DMA counter.  */
1048             if (esp_get_stc(s) == 0) {
1049                 esp_set_tc(s, 0x10000);
1050             } else {
1051                 esp_set_tc(s, esp_get_stc(s));
1052             }
1053         } else {
1054             s->dma = 0;
1055         }
1056         switch (val & CMD_CMD) {
1057         case CMD_NOP:
1058             trace_esp_mem_writeb_cmd_nop(val);
1059             break;
1060         case CMD_FLUSH:
1061             trace_esp_mem_writeb_cmd_flush(val);
1062             fifo8_reset(&s->fifo);
1063             break;
1064         case CMD_RESET:
1065             trace_esp_mem_writeb_cmd_reset(val);
1066             esp_soft_reset(s);
1067             break;
1068         case CMD_BUSRESET:
1069             trace_esp_mem_writeb_cmd_bus_reset(val);
1070             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
1071                 s->rregs[ESP_RINTR] |= INTR_RST;
1072                 esp_raise_irq(s);
1073             }
1074             break;
1075         case CMD_TI:
1076             trace_esp_mem_writeb_cmd_ti(val);
1077             handle_ti(s);
1078             break;
1079         case CMD_ICCS:
1080             trace_esp_mem_writeb_cmd_iccs(val);
1081             write_response(s);
1082             s->rregs[ESP_RINTR] |= INTR_FC;
1083             s->rregs[ESP_RSTAT] |= STAT_MI;
1084             break;
1085         case CMD_MSGACC:
1086             trace_esp_mem_writeb_cmd_msgacc(val);
1087             s->rregs[ESP_RINTR] |= INTR_DC;
1088             s->rregs[ESP_RSEQ] = 0;
1089             s->rregs[ESP_RFLAGS] = 0;
1090             esp_raise_irq(s);
1091             break;
1092         case CMD_PAD:
1093             trace_esp_mem_writeb_cmd_pad(val);
1094             s->rregs[ESP_RSTAT] = STAT_TC;
1095             s->rregs[ESP_RINTR] |= INTR_FC;
1096             s->rregs[ESP_RSEQ] = 0;
1097             break;
1098         case CMD_SATN:
1099             trace_esp_mem_writeb_cmd_satn(val);
1100             break;
1101         case CMD_RSTATN:
1102             trace_esp_mem_writeb_cmd_rstatn(val);
1103             break;
1104         case CMD_SEL:
1105             trace_esp_mem_writeb_cmd_sel(val);
1106             handle_s_without_atn(s);
1107             break;
1108         case CMD_SELATN:
1109             trace_esp_mem_writeb_cmd_selatn(val);
1110             handle_satn(s);
1111             break;
1112         case CMD_SELATNS:
1113             trace_esp_mem_writeb_cmd_selatns(val);
1114             handle_satn_stop(s);
1115             break;
1116         case CMD_ENSEL:
1117             trace_esp_mem_writeb_cmd_ensel(val);
1118             s->rregs[ESP_RINTR] = 0;
1119             break;
1120         case CMD_DISSEL:
1121             trace_esp_mem_writeb_cmd_dissel(val);
1122             s->rregs[ESP_RINTR] = 0;
1123             esp_raise_irq(s);
1124             break;
1125         default:
1126             trace_esp_error_unhandled_command(val);
1127             break;
1128         }
1129         break;
1130     case ESP_WBUSID ... ESP_WSYNO:
1131         break;
1132     case ESP_CFG1:
1133     case ESP_CFG2: case ESP_CFG3:
1134     case ESP_RES3: case ESP_RES4:
1135         s->rregs[saddr] = val;
1136         break;
1137     case ESP_WCCF ... ESP_WTEST:
1138         break;
1139     default:
1140         trace_esp_error_invalid_write(val, saddr);
1141         return;
1142     }
1143     s->wregs[saddr] = val;
1144 }
1145
1146 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1147                             unsigned size, bool is_write,
1148                             MemTxAttrs attrs)
1149 {
1150     return (size == 1) || (is_write && size == 4);
1151 }
1152
1153 static bool esp_is_before_version_5(void *opaque, int version_id)
1154 {
1155     ESPState *s = ESP(opaque);
1156
1157     version_id = MIN(version_id, s->mig_version_id);
1158     return version_id < 5;
1159 }
1160
1161 static bool esp_is_version_5(void *opaque, int version_id)
1162 {
1163     ESPState *s = ESP(opaque);
1164
1165     version_id = MIN(version_id, s->mig_version_id);
1166     return version_id >= 5;
1167 }
1168
1169 static bool esp_is_version_6(void *opaque, int version_id)
1170 {
1171     ESPState *s = ESP(opaque);
1172
1173     version_id = MIN(version_id, s->mig_version_id);
1174     return version_id >= 6;
1175 }
1176
1177 int esp_pre_save(void *opaque)
1178 {
1179     ESPState *s = ESP(object_resolve_path_component(
1180                       OBJECT(opaque), "esp"));
1181
1182     s->mig_version_id = vmstate_esp.version_id;
1183     return 0;
1184 }
1185
1186 static int esp_post_load(void *opaque, int version_id)
1187 {
1188     ESPState *s = ESP(opaque);
1189     int len, i;
1190
1191     version_id = MIN(version_id, s->mig_version_id);
1192
1193     if (version_id < 5) {
1194         esp_set_tc(s, s->mig_dma_left);
1195
1196         /* Migrate ti_buf to fifo */
1197         len = s->mig_ti_wptr - s->mig_ti_rptr;
1198         for (i = 0; i < len; i++) {
1199             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1200         }
1201
1202         /* Migrate cmdbuf to cmdfifo */
1203         for (i = 0; i < s->mig_cmdlen; i++) {
1204             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1205         }
1206     }
1207
1208     s->mig_version_id = vmstate_esp.version_id;
1209     return 0;
1210 }
1211
1212 /*
1213  * PDMA (or pseudo-DMA) is only used on the Macintosh and requires the
1214  * guest CPU to perform the transfers between the SCSI bus and memory
1215  * itself. This is indicated by the dma_memory_read and dma_memory_write
1216  * functions being NULL (in contrast to the ESP PCI device) whilst
1217  * dma_enabled is still set.
1218  */
1219
1220 static bool esp_pdma_needed(void *opaque)
1221 {
1222     ESPState *s = ESP(opaque);
1223
1224     return s->dma_memory_read == NULL && s->dma_memory_write == NULL &&
1225            s->dma_enabled;
1226 }
1227
1228 static const VMStateDescription vmstate_esp_pdma = {
1229     .name = "esp/pdma",
1230     .version_id = 0,
1231     .minimum_version_id = 0,
1232     .needed = esp_pdma_needed,
1233     .fields = (VMStateField[]) {
1234         VMSTATE_UINT8(pdma_cb, ESPState),
1235         VMSTATE_END_OF_LIST()
1236     }
1237 };
1238
1239 const VMStateDescription vmstate_esp = {
1240     .name = "esp",
1241     .version_id = 6,
1242     .minimum_version_id = 3,
1243     .post_load = esp_post_load,
1244     .fields = (VMStateField[]) {
1245         VMSTATE_BUFFER(rregs, ESPState),
1246         VMSTATE_BUFFER(wregs, ESPState),
1247         VMSTATE_INT32(ti_size, ESPState),
1248         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1249         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1250         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1251         VMSTATE_UINT32(status, ESPState),
1252         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1253                             esp_is_before_version_5),
1254         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1255                           esp_is_before_version_5),
1256         VMSTATE_UINT32(dma, ESPState),
1257         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1258                               esp_is_before_version_5, 0, 16),
1259         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1260                               esp_is_before_version_5, 16,
1261                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
1262         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1263         VMSTATE_UINT32(do_cmd, ESPState),
1264         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1265         VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5),
1266         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1267         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1268         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1269         VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5),
1270         VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6),
1271         VMSTATE_END_OF_LIST()
1272     },
1273     .subsections = (const VMStateDescription * []) {
1274         &vmstate_esp_pdma,
1275         NULL
1276     }
1277 };
1278
1279 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1280                                  uint64_t val, unsigned int size)
1281 {
1282     SysBusESPState *sysbus = opaque;
1283     ESPState *s = ESP(&sysbus->esp);
1284     uint32_t saddr;
1285
1286     saddr = addr >> sysbus->it_shift;
1287     esp_reg_write(s, saddr, val);
1288 }
1289
1290 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1291                                     unsigned int size)
1292 {
1293     SysBusESPState *sysbus = opaque;
1294     ESPState *s = ESP(&sysbus->esp);
1295     uint32_t saddr;
1296
1297     saddr = addr >> sysbus->it_shift;
1298     return esp_reg_read(s, saddr);
1299 }
1300
1301 static const MemoryRegionOps sysbus_esp_mem_ops = {
1302     .read = sysbus_esp_mem_read,
1303     .write = sysbus_esp_mem_write,
1304     .endianness = DEVICE_NATIVE_ENDIAN,
1305     .valid.accepts = esp_mem_accepts,
1306 };
1307
1308 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1309                                   uint64_t val, unsigned int size)
1310 {
1311     SysBusESPState *sysbus = opaque;
1312     ESPState *s = ESP(&sysbus->esp);
1313
1314     trace_esp_pdma_write(size);
1315
1316     switch (size) {
1317     case 1:
1318         esp_pdma_write(s, val);
1319         break;
1320     case 2:
1321         esp_pdma_write(s, val >> 8);
1322         esp_pdma_write(s, val);
1323         break;
1324     }
1325     esp_pdma_cb(s);
1326 }
1327
1328 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1329                                      unsigned int size)
1330 {
1331     SysBusESPState *sysbus = opaque;
1332     ESPState *s = ESP(&sysbus->esp);
1333     uint64_t val = 0;
1334
1335     trace_esp_pdma_read(size);
1336
1337     switch (size) {
1338     case 1:
1339         val = esp_pdma_read(s);
1340         break;
1341     case 2:
1342         val = esp_pdma_read(s);
1343         val = (val << 8) | esp_pdma_read(s);
1344         break;
1345     }
1346     if (fifo8_num_used(&s->fifo) < 2) {
1347         esp_pdma_cb(s);
1348     }
1349     return val;
1350 }
1351
1352 static void *esp_load_request(QEMUFile *f, SCSIRequest *req)
1353 {
1354     ESPState *s = container_of(req->bus, ESPState, bus);
1355
1356     scsi_req_ref(req);
1357     s->current_req = req;
1358     return s;
1359 }
1360
1361 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1362     .read = sysbus_esp_pdma_read,
1363     .write = sysbus_esp_pdma_write,
1364     .endianness = DEVICE_NATIVE_ENDIAN,
1365     .valid.min_access_size = 1,
1366     .valid.max_access_size = 4,
1367     .impl.min_access_size = 1,
1368     .impl.max_access_size = 2,
1369 };
1370
1371 static const struct SCSIBusInfo esp_scsi_info = {
1372     .tcq = false,
1373     .max_target = ESP_MAX_DEVS,
1374     .max_lun = 7,
1375
1376     .load_request = esp_load_request,
1377     .transfer_data = esp_transfer_data,
1378     .complete = esp_command_complete,
1379     .cancel = esp_request_cancelled
1380 };
1381
1382 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1383 {
1384     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1385     ESPState *s = ESP(&sysbus->esp);
1386
1387     switch (irq) {
1388     case 0:
1389         parent_esp_reset(s, irq, level);
1390         break;
1391     case 1:
1392         esp_dma_enable(opaque, irq, level);
1393         break;
1394     }
1395 }
1396
1397 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1398 {
1399     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1400     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1401     ESPState *s = ESP(&sysbus->esp);
1402
1403     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1404         return;
1405     }
1406
1407     sysbus_init_irq(sbd, &s->irq);
1408     sysbus_init_irq(sbd, &s->irq_data);
1409     assert(sysbus->it_shift != -1);
1410
1411     s->chip_id = TCHI_FAS100A;
1412     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1413                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1414     sysbus_init_mmio(sbd, &sysbus->iomem);
1415     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1416                           sysbus, "esp-pdma", 4);
1417     sysbus_init_mmio(sbd, &sysbus->pdma);
1418
1419     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1420
1421     scsi_bus_init(&s->bus, sizeof(s->bus), dev, &esp_scsi_info);
1422 }
1423
1424 static void sysbus_esp_hard_reset(DeviceState *dev)
1425 {
1426     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1427     ESPState *s = ESP(&sysbus->esp);
1428
1429     esp_hard_reset(s);
1430 }
1431
1432 static void sysbus_esp_init(Object *obj)
1433 {
1434     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1435
1436     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1437 }
1438
1439 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1440     .name = "sysbusespscsi",
1441     .version_id = 2,
1442     .minimum_version_id = 1,
1443     .pre_save = esp_pre_save,
1444     .fields = (VMStateField[]) {
1445         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1446         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1447         VMSTATE_END_OF_LIST()
1448     }
1449 };
1450
1451 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1452 {
1453     DeviceClass *dc = DEVICE_CLASS(klass);
1454
1455     dc->realize = sysbus_esp_realize;
1456     dc->reset = sysbus_esp_hard_reset;
1457     dc->vmsd = &vmstate_sysbus_esp_scsi;
1458     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1459 }
1460
1461 static const TypeInfo sysbus_esp_info = {
1462     .name          = TYPE_SYSBUS_ESP,
1463     .parent        = TYPE_SYS_BUS_DEVICE,
1464     .instance_init = sysbus_esp_init,
1465     .instance_size = sizeof(SysBusESPState),
1466     .class_init    = sysbus_esp_class_init,
1467 };
1468
1469 static void esp_finalize(Object *obj)
1470 {
1471     ESPState *s = ESP(obj);
1472
1473     fifo8_destroy(&s->fifo);
1474     fifo8_destroy(&s->cmdfifo);
1475 }
1476
1477 static void esp_init(Object *obj)
1478 {
1479     ESPState *s = ESP(obj);
1480
1481     fifo8_create(&s->fifo, ESP_FIFO_SZ);
1482     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1483 }
1484
1485 static void esp_class_init(ObjectClass *klass, void *data)
1486 {
1487     DeviceClass *dc = DEVICE_CLASS(klass);
1488
1489     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1490     dc->user_creatable = false;
1491     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1492 }
1493
1494 static const TypeInfo esp_info = {
1495     .name = TYPE_ESP,
1496     .parent = TYPE_DEVICE,
1497     .instance_init = esp_init,
1498     .instance_finalize = esp_finalize,
1499     .instance_size = sizeof(ESPState),
1500     .class_init = esp_class_init,
1501 };
1502
1503 static void esp_register_types(void)
1504 {
1505     type_register_static(&sysbus_esp_info);
1506     type_register_static(&esp_info);
1507 }
1508
1509 type_init(esp_register_types)