hw/scsi/esp.c

   1 /*
   2  * QEMU ESP/NCR53C9x emulation
   3  *
   4  * Copyright (c) 2005-2006 Fabrice Bellard
   5  * Copyright (c) 2012 Herve Poussineau
   6  * Copyright (c) 2023 Mark Cave-Ayland
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  24  * THE SOFTWARE.
  25  */
  26
  27 #include "qemu/osdep.h"
  28 #include "hw/sysbus.h"
  29 #include "migration/vmstate.h"
  30 #include "hw/irq.h"
  31 #include "hw/scsi/esp.h"
  32 #include "trace.h"
  33 #include "qemu/log.h"
  34 #include "qemu/module.h"
  35
  36 /*
  37  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
  38  * also produced as NCR89C100. See
  39  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  40  * and
  41  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
  42  *
  43  * On Macintosh Quadra it is a NCR53C96.
  44  */
  45
  46 static void esp_raise_irq(ESPState *s)
  47 {
  48     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
  49         s->rregs[ESP_RSTAT] |= STAT_INT;
  50         qemu_irq_raise(s->irq);
  51         trace_esp_raise_irq();
  52     }
  53 }
  54
  55 static void esp_lower_irq(ESPState *s)
  56 {
  57     if (s->rregs[ESP_RSTAT] & STAT_INT) {
  58         s->rregs[ESP_RSTAT] &= ~STAT_INT;
  59         qemu_irq_lower(s->irq);
  60         trace_esp_lower_irq();
  61     }
  62 }
  63
  64 static void esp_raise_drq(ESPState *s)
  65 {
  66     if (!(s->drq_state)) {
  67         qemu_irq_raise(s->drq_irq);
  68         trace_esp_raise_drq();
  69         s->drq_state = true;
  70     }
  71 }
  72
  73 static void esp_lower_drq(ESPState *s)
  74 {
  75     if (s->drq_state) {
  76         qemu_irq_lower(s->drq_irq);
  77         trace_esp_lower_drq();
  78         s->drq_state = false;
  79     }
  80 }
  81
  82 static const char *esp_phase_names[8] = {
  83     "DATA OUT", "DATA IN", "COMMAND", "STATUS",
  84     "(reserved)", "(reserved)", "MESSAGE OUT", "MESSAGE IN"
  85 };
  86
  87 static void esp_set_phase(ESPState *s, uint8_t phase)
  88 {
  89     s->rregs[ESP_RSTAT] &= ~7;
  90     s->rregs[ESP_RSTAT] |= phase;
  91
  92     trace_esp_set_phase(esp_phase_names[phase]);
  93 }
  94
  95 static uint8_t esp_get_phase(ESPState *s)
  96 {
  97     return s->rregs[ESP_RSTAT] & 7;
  98 }
  99
 100 void esp_dma_enable(ESPState *s, int irq, int level)
 101 {
 102     if (level) {
 103         s->dma_enabled = 1;
 104         trace_esp_dma_enable();
 105         if (s->dma_cb) {
 106             s->dma_cb(s);
 107             s->dma_cb = NULL;
 108         }
 109     } else {
 110         trace_esp_dma_disable();
 111         s->dma_enabled = 0;
 112     }
 113 }
 114
 115 void esp_request_cancelled(SCSIRequest *req)
 116 {
 117     ESPState *s = req->hba_private;
 118
 119     if (req == s->current_req) {
 120         scsi_req_unref(s->current_req);
 121         s->current_req = NULL;
 122         s->current_dev = NULL;
 123         s->async_len = 0;
 124     }
 125 }
 126
 127 static void esp_update_drq(ESPState *s)
 128 {
 129     bool to_device;
 130
 131     switch (esp_get_phase(s)) {
 132     case STAT_MO:
 133     case STAT_CD:
 134     case STAT_DO:
 135         to_device = true;
 136         break;
 137
 138     case STAT_DI:
 139     case STAT_ST:
 140     case STAT_MI:
 141         to_device = false;
 142         break;
 143
 144     default:
 145         return;
 146     }
 147
 148     if (s->dma) {
 149         /* DMA request so update DRQ according to transfer direction */
 150         if (to_device) {
 151             if (fifo8_num_free(&s->fifo) < 2) {
 152                 esp_lower_drq(s);
 153             } else {
 154                 esp_raise_drq(s);
 155             }
 156         } else {
 157             if (fifo8_num_used(&s->fifo) < 2) {
 158                 esp_lower_drq(s);
 159             } else {
 160                 esp_raise_drq(s);
 161             }
 162         }
 163     } else {
 164         /* Not a DMA request */
 165         esp_lower_drq(s);
 166     }
 167 }
 168
 169 static void esp_fifo_push(ESPState *s, uint8_t val)
 170 {
 171     if (fifo8_num_used(&s->fifo) == s->fifo.capacity) {
 172         trace_esp_error_fifo_overrun();
 173     } else {
 174         fifo8_push(&s->fifo, val);
 175     }
 176
 177     esp_update_drq(s);
 178 }
 179
 180 static void esp_fifo_push_buf(ESPState *s, uint8_t *buf, int len)
 181 {
 182     fifo8_push_all(&s->fifo, buf, len);
 183     esp_update_drq(s);
 184 }
 185
 186 static uint8_t esp_fifo_pop(ESPState *s)
 187 {
 188     uint8_t val;
 189
 190     if (fifo8_is_empty(&s->fifo)) {
 191         val = 0;
 192     } else {
 193         val = fifo8_pop(&s->fifo);
 194     }
 195
 196     esp_update_drq(s);
 197     return val;
 198 }
 199
 200 static uint32_t esp_fifo8_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen)
 201 {
 202     const uint8_t *buf;
 203     uint32_t n, n2;
 204     int len;
 205
 206     if (maxlen == 0) {
 207         return 0;
 208     }
 209
 210     len = maxlen;
 211     buf = fifo8_pop_buf(fifo, len, &n);
 212     if (dest) {
 213         memcpy(dest, buf, n);
 214     }
 215
 216     /* Add FIFO wraparound if needed */
 217     len -= n;
 218     len = MIN(len, fifo8_num_used(fifo));
 219     if (len) {
 220         buf = fifo8_pop_buf(fifo, len, &n2);
 221         if (dest) {
 222             memcpy(&dest[n], buf, n2);
 223         }
 224         n += n2;
 225     }
 226
 227     return n;
 228 }
 229
 230 static uint32_t esp_fifo_pop_buf(ESPState *s, uint8_t *dest, int maxlen)
 231 {
 232     uint32_t len = esp_fifo8_pop_buf(&s->fifo, dest, maxlen);
 233
 234     esp_update_drq(s);
 235     return len;
 236 }
 237
 238 static uint32_t esp_get_tc(ESPState *s)
 239 {
 240     uint32_t dmalen;
 241
 242     dmalen = s->rregs[ESP_TCLO];
 243     dmalen |= s->rregs[ESP_TCMID] << 8;
 244     dmalen |= s->rregs[ESP_TCHI] << 16;
 245
 246     return dmalen;
 247 }
 248
 249 static void esp_set_tc(ESPState *s, uint32_t dmalen)
 250 {
 251     uint32_t old_tc = esp_get_tc(s);
 252
 253     s->rregs[ESP_TCLO] = dmalen;
 254     s->rregs[ESP_TCMID] = dmalen >> 8;
 255     s->rregs[ESP_TCHI] = dmalen >> 16;
 256
 257     if (old_tc && dmalen == 0) {
 258         s->rregs[ESP_RSTAT] |= STAT_TC;
 259     }
 260 }
 261
 262 static uint32_t esp_get_stc(ESPState *s)
 263 {
 264     uint32_t dmalen;
 265
 266     dmalen = s->wregs[ESP_TCLO];
 267     dmalen |= s->wregs[ESP_TCMID] << 8;
 268     dmalen |= s->wregs[ESP_TCHI] << 16;
 269
 270     return dmalen;
 271 }
 272
 273 static uint8_t esp_pdma_read(ESPState *s)
 274 {
 275     uint8_t val;
 276
 277     val = esp_fifo_pop(s);
 278     return val;
 279 }
 280
 281 static void esp_pdma_write(ESPState *s, uint8_t val)
 282 {
 283     uint32_t dmalen = esp_get_tc(s);
 284
 285     esp_fifo_push(s, val);
 286
 287     if (dmalen && s->drq_state) {
 288         dmalen--;
 289         esp_set_tc(s, dmalen);
 290     }
 291 }
 292
 293 static int esp_select(ESPState *s)
 294 {
 295     int target;
 296
 297     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 298
 299     s->ti_size = 0;
 300     s->rregs[ESP_RSEQ] = SEQ_0;
 301
 302     if (s->current_req) {
 303         /* Started a new command before the old one finished. Cancel it. */
 304         scsi_req_cancel(s->current_req);
 305     }
 306
 307     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
 308     if (!s->current_dev) {
 309         /* No such drive */
 310         s->rregs[ESP_RSTAT] = 0;
 311         s->rregs[ESP_RINTR] = INTR_DC;
 312         esp_raise_irq(s);
 313         return -1;
 314     }
 315
 316     /*
 317      * Note that we deliberately don't raise the IRQ here: this will be done
 318      * either in esp_transfer_data() or esp_command_complete()
 319      */
 320     return 0;
 321 }
 322
 323 static void esp_do_dma(ESPState *s);
 324 static void esp_do_nodma(ESPState *s);
 325
 326 static void do_command_phase(ESPState *s)
 327 {
 328     uint32_t cmdlen;
 329     int32_t datalen;
 330     SCSIDevice *current_lun;
 331     uint8_t buf[ESP_CMDFIFO_SZ];
 332
 333     trace_esp_do_command_phase(s->lun);
 334     cmdlen = fifo8_num_used(&s->cmdfifo);
 335     if (!cmdlen || !s->current_dev) {
 336         return;
 337     }
 338     esp_fifo8_pop_buf(&s->cmdfifo, buf, cmdlen);
 339
 340     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
 341     if (!current_lun) {
 342         /* No such drive */
 343         s->rregs[ESP_RSTAT] = 0;
 344         s->rregs[ESP_RINTR] = INTR_DC;
 345         s->rregs[ESP_RSEQ] = SEQ_0;
 346         esp_raise_irq(s);
 347         return;
 348     }
 349
 350     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
 351     datalen = scsi_req_enqueue(s->current_req);
 352     s->ti_size = datalen;
 353     fifo8_reset(&s->cmdfifo);
 354     s->data_ready = false;
 355     if (datalen != 0) {
 356         /*
 357          * Switch to DATA phase but wait until initial data xfer is
 358          * complete before raising the command completion interrupt
 359          */
 360         if (datalen > 0) {
 361             esp_set_phase(s, STAT_DI);
 362         } else {
 363             esp_set_phase(s, STAT_DO);
 364         }
 365         scsi_req_continue(s->current_req);
 366         return;
 367     }
 368 }
 369
 370 static void do_message_phase(ESPState *s)
 371 {
 372     if (s->cmdfifo_cdb_offset) {
 373         uint8_t message = fifo8_is_empty(&s->cmdfifo) ? 0 :
 374                           fifo8_pop(&s->cmdfifo);
 375
 376         trace_esp_do_identify(message);
 377         s->lun = message & 7;
 378         s->cmdfifo_cdb_offset--;
 379     }
 380
 381     /* Ignore extended messages for now */
 382     if (s->cmdfifo_cdb_offset) {
 383         int len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
 384         esp_fifo8_pop_buf(&s->cmdfifo, NULL, len);
 385         s->cmdfifo_cdb_offset = 0;
 386     }
 387 }
 388
 389 static void do_cmd(ESPState *s)
 390 {
 391     do_message_phase(s);
 392     assert(s->cmdfifo_cdb_offset == 0);
 393     do_command_phase(s);
 394 }
 395
 396 static void handle_satn(ESPState *s)
 397 {
 398     if (s->dma && !s->dma_enabled) {
 399         s->dma_cb = handle_satn;
 400         return;
 401     }
 402
 403     if (esp_select(s) < 0) {
 404         return;
 405     }
 406
 407     esp_set_phase(s, STAT_MO);
 408
 409     if (s->dma) {
 410         esp_do_dma(s);
 411     } else {
 412         esp_do_nodma(s);
 413     }
 414 }
 415
 416 static void handle_s_without_atn(ESPState *s)
 417 {
 418     if (s->dma && !s->dma_enabled) {
 419         s->dma_cb = handle_s_without_atn;
 420         return;
 421     }
 422
 423     if (esp_select(s) < 0) {
 424         return;
 425     }
 426
 427     esp_set_phase(s, STAT_CD);
 428     s->cmdfifo_cdb_offset = 0;
 429
 430     if (s->dma) {
 431         esp_do_dma(s);
 432     } else {
 433         esp_do_nodma(s);
 434     }
 435 }
 436
 437 static void handle_satn_stop(ESPState *s)
 438 {
 439     if (s->dma && !s->dma_enabled) {
 440         s->dma_cb = handle_satn_stop;
 441         return;
 442     }
 443
 444     if (esp_select(s) < 0) {
 445         return;
 446     }
 447
 448     esp_set_phase(s, STAT_MO);
 449     s->cmdfifo_cdb_offset = 0;
 450
 451     if (s->dma) {
 452         esp_do_dma(s);
 453     } else {
 454         esp_do_nodma(s);
 455     }
 456 }
 457
 458 static void handle_pad(ESPState *s)
 459 {
 460     if (s->dma) {
 461         esp_do_dma(s);
 462     } else {
 463         esp_do_nodma(s);
 464     }
 465 }
 466
 467 static void write_response(ESPState *s)
 468 {
 469     trace_esp_write_response(s->status);
 470
 471     if (s->dma) {
 472         esp_do_dma(s);
 473     } else {
 474         esp_do_nodma(s);
 475     }
 476 }
 477
 478 static bool esp_cdb_ready(ESPState *s)
 479 {
 480     int len = fifo8_num_used(&s->cmdfifo) - s->cmdfifo_cdb_offset;
 481     const uint8_t *pbuf;
 482     uint32_t n;
 483     int cdblen;
 484
 485     if (len <= 0) {
 486         return false;
 487     }
 488
 489     pbuf = fifo8_peek_buf(&s->cmdfifo, len, &n);
 490     if (n < len) {
 491         /*
 492          * In normal use the cmdfifo should never wrap, but include this check
 493          * to prevent a malicious guest from reading past the end of the
 494          * cmdfifo data buffer below
 495          */
 496         return false;
 497     }
 498
 499     cdblen = scsi_cdb_length((uint8_t *)&pbuf[s->cmdfifo_cdb_offset]);
 500
 501     return cdblen < 0 ? false : (len >= cdblen);
 502 }
 503
 504 static void esp_dma_ti_check(ESPState *s)
 505 {
 506     if (esp_get_tc(s) == 0 && fifo8_num_used(&s->fifo) < 2) {
 507         s->rregs[ESP_RINTR] |= INTR_BS;
 508         esp_raise_irq(s);
 509     }
 510 }
 511
 512 static void esp_do_dma(ESPState *s)
 513 {
 514     uint32_t len, cmdlen;
 515     uint8_t buf[ESP_CMDFIFO_SZ];
 516
 517     len = esp_get_tc(s);
 518
 519     switch (esp_get_phase(s)) {
 520     case STAT_MO:
 521         if (s->dma_memory_read) {
 522             len = MIN(len, fifo8_num_free(&s->cmdfifo));
 523             s->dma_memory_read(s->dma_opaque, buf, len);
 524             esp_set_tc(s, esp_get_tc(s) - len);
 525         } else {
 526             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 527             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 528         }
 529
 530         fifo8_push_all(&s->cmdfifo, buf, len);
 531         s->cmdfifo_cdb_offset += len;
 532
 533         switch (s->rregs[ESP_CMD]) {
 534         case CMD_SELATN | CMD_DMA:
 535             if (fifo8_num_used(&s->cmdfifo) >= 1) {
 536                 /* First byte received, switch to command phase */
 537                 esp_set_phase(s, STAT_CD);
 538                 s->rregs[ESP_RSEQ] = SEQ_CD;
 539                 s->cmdfifo_cdb_offset = 1;
 540
 541                 if (fifo8_num_used(&s->cmdfifo) > 1) {
 542                     /* Process any additional command phase data */
 543                     esp_do_dma(s);
 544                 }
 545             }
 546             break;
 547
 548         case CMD_SELATNS | CMD_DMA:
 549             if (fifo8_num_used(&s->cmdfifo) == 1) {
 550                 /* First byte received, stop in message out phase */
 551                 s->rregs[ESP_RSEQ] = SEQ_MO;
 552                 s->cmdfifo_cdb_offset = 1;
 553
 554                 /* Raise command completion interrupt */
 555                 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 556                 esp_raise_irq(s);
 557             }
 558             break;
 559
 560         case CMD_TI | CMD_DMA:
 561             /* ATN remains asserted until TC == 0 */
 562             if (esp_get_tc(s) == 0) {
 563                 esp_set_phase(s, STAT_CD);
 564                 s->rregs[ESP_CMD] = 0;
 565                 s->rregs[ESP_RINTR] |= INTR_BS;
 566                 esp_raise_irq(s);
 567             }
 568             break;
 569         }
 570         break;
 571
 572     case STAT_CD:
 573         cmdlen = fifo8_num_used(&s->cmdfifo);
 574         trace_esp_do_dma(cmdlen, len);
 575         if (s->dma_memory_read) {
 576             len = MIN(len, fifo8_num_free(&s->cmdfifo));
 577             s->dma_memory_read(s->dma_opaque, buf, len);
 578             fifo8_push_all(&s->cmdfifo, buf, len);
 579             esp_set_tc(s, esp_get_tc(s) - len);
 580         } else {
 581             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 582             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 583             fifo8_push_all(&s->cmdfifo, buf, len);
 584         }
 585         trace_esp_handle_ti_cmd(cmdlen);
 586         s->ti_size = 0;
 587         if (esp_get_tc(s) == 0) {
 588             /* Command has been received */
 589             do_cmd(s);
 590         }
 591         break;
 592
 593     case STAT_DO:
 594         if (!s->current_req) {
 595             return;
 596         }
 597         if (s->async_len == 0 && esp_get_tc(s) && s->ti_size) {
 598             /* Defer until data is available.  */
 599             return;
 600         }
 601         if (len > s->async_len) {
 602             len = s->async_len;
 603         }
 604
 605         switch (s->rregs[ESP_CMD]) {
 606         case CMD_TI | CMD_DMA:
 607             if (s->dma_memory_read) {
 608                 s->dma_memory_read(s->dma_opaque, s->async_buf, len);
 609                 esp_set_tc(s, esp_get_tc(s) - len);
 610             } else {
 611                 /* Copy FIFO data to device */
 612                 len = MIN(s->async_len, ESP_FIFO_SZ);
 613                 len = MIN(len, fifo8_num_used(&s->fifo));
 614                 len = esp_fifo_pop_buf(s, s->async_buf, len);
 615             }
 616
 617             s->async_buf += len;
 618             s->async_len -= len;
 619             s->ti_size += len;
 620             break;
 621
 622         case CMD_PAD | CMD_DMA:
 623             /* Copy TC zero bytes into the incoming stream */
 624             if (!s->dma_memory_read) {
 625                 len = MIN(s->async_len, ESP_FIFO_SZ);
 626                 len = MIN(len, fifo8_num_free(&s->fifo));
 627             }
 628
 629             memset(s->async_buf, 0, len);
 630
 631             s->async_buf += len;
 632             s->async_len -= len;
 633             s->ti_size += len;
 634             break;
 635         }
 636
 637         if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) {
 638             /* Defer until the scsi layer has completed */
 639             scsi_req_continue(s->current_req);
 640             return;
 641         }
 642
 643         esp_dma_ti_check(s);
 644         break;
 645
 646     case STAT_DI:
 647         if (!s->current_req) {
 648             return;
 649         }
 650         if (s->async_len == 0 && esp_get_tc(s) && s->ti_size) {
 651             /* Defer until data is available.  */
 652             return;
 653         }
 654         if (len > s->async_len) {
 655             len = s->async_len;
 656         }
 657
 658         switch (s->rregs[ESP_CMD]) {
 659         case CMD_TI | CMD_DMA:
 660             if (s->dma_memory_write) {
 661                 s->dma_memory_write(s->dma_opaque, s->async_buf, len);
 662             } else {
 663                 /* Copy device data to FIFO */
 664                 len = MIN(len, fifo8_num_free(&s->fifo));
 665                 esp_fifo_push_buf(s, s->async_buf, len);
 666             }
 667
 668             s->async_buf += len;
 669             s->async_len -= len;
 670             s->ti_size -= len;
 671             esp_set_tc(s, esp_get_tc(s) - len);
 672             break;
 673
 674         case CMD_PAD | CMD_DMA:
 675             /* Drop TC bytes from the incoming stream */
 676             if (!s->dma_memory_write) {
 677                 len = MIN(len, fifo8_num_free(&s->fifo));
 678             }
 679
 680             s->async_buf += len;
 681             s->async_len -= len;
 682             s->ti_size -= len;
 683             esp_set_tc(s, esp_get_tc(s) - len);
 684             break;
 685         }
 686
 687         if (s->async_len == 0 && s->ti_size == 0 && esp_get_tc(s)) {
 688             /* If the guest underflows TC then terminate SCSI request */
 689             scsi_req_continue(s->current_req);
 690             return;
 691         }
 692
 693         if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) {
 694             /* Defer until the scsi layer has completed */
 695             scsi_req_continue(s->current_req);
 696             return;
 697         }
 698
 699         esp_dma_ti_check(s);
 700         break;
 701
 702     case STAT_ST:
 703         switch (s->rregs[ESP_CMD]) {
 704         case CMD_ICCS | CMD_DMA:
 705             len = MIN(len, 1);
 706
 707             if (len) {
 708                 buf[0] = s->status;
 709
 710                 if (s->dma_memory_write) {
 711                     s->dma_memory_write(s->dma_opaque, buf, len);
 712                 } else {
 713                     esp_fifo_push_buf(s, buf, len);
 714                 }
 715
 716                 esp_set_tc(s, esp_get_tc(s) - len);
 717                 esp_set_phase(s, STAT_MI);
 718
 719                 if (esp_get_tc(s) > 0) {
 720                     /* Process any message in phase data */
 721                     esp_do_dma(s);
 722                 }
 723             }
 724             break;
 725
 726         default:
 727             /* Consume remaining data if the guest underflows TC */
 728             if (fifo8_num_used(&s->fifo) < 2) {
 729                 s->rregs[ESP_RINTR] |= INTR_BS;
 730                 esp_raise_irq(s);
 731             }
 732             break;
 733         }
 734         break;
 735
 736     case STAT_MI:
 737         switch (s->rregs[ESP_CMD]) {
 738         case CMD_ICCS | CMD_DMA:
 739             len = MIN(len, 1);
 740
 741             if (len) {
 742                 buf[0] = 0;
 743
 744                 if (s->dma_memory_write) {
 745                     s->dma_memory_write(s->dma_opaque, buf, len);
 746                 } else {
 747                     esp_fifo_push_buf(s, buf, len);
 748                 }
 749
 750                 esp_set_tc(s, esp_get_tc(s) - len);
 751
 752                 /* Raise end of command interrupt */
 753                 s->rregs[ESP_RINTR] |= INTR_FC;
 754                 esp_raise_irq(s);
 755             }
 756             break;
 757         }
 758         break;
 759     }
 760 }
 761
 762 static void esp_nodma_ti_dataout(ESPState *s)
 763 {
 764     int len;
 765
 766     if (!s->current_req) {
 767         return;
 768     }
 769     if (s->async_len == 0) {
 770         /* Defer until data is available.  */
 771         return;
 772     }
 773     len = MIN(s->async_len, ESP_FIFO_SZ);
 774     len = MIN(len, fifo8_num_used(&s->fifo));
 775     esp_fifo_pop_buf(s, s->async_buf, len);
 776     s->async_buf += len;
 777     s->async_len -= len;
 778     s->ti_size += len;
 779
 780     if (s->async_len == 0) {
 781         scsi_req_continue(s->current_req);
 782         return;
 783     }
 784
 785     s->rregs[ESP_RINTR] |= INTR_BS;
 786     esp_raise_irq(s);
 787 }
 788
 789 static void esp_do_nodma(ESPState *s)
 790 {
 791     uint8_t buf[ESP_FIFO_SZ];
 792     uint32_t cmdlen;
 793     int len;
 794
 795     switch (esp_get_phase(s)) {
 796     case STAT_MO:
 797         switch (s->rregs[ESP_CMD]) {
 798         case CMD_SELATN:
 799             /* Copy FIFO into cmdfifo */
 800             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 801             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 802             fifo8_push_all(&s->cmdfifo, buf, len);
 803
 804             if (fifo8_num_used(&s->cmdfifo) >= 1) {
 805                 /* First byte received, switch to command phase */
 806                 esp_set_phase(s, STAT_CD);
 807                 s->rregs[ESP_RSEQ] = SEQ_CD;
 808                 s->cmdfifo_cdb_offset = 1;
 809
 810                 if (fifo8_num_used(&s->cmdfifo) > 1) {
 811                     /* Process any additional command phase data */
 812                     esp_do_nodma(s);
 813                 }
 814             }
 815             break;
 816
 817         case CMD_SELATNS:
 818             /* Copy one byte from FIFO into cmdfifo */
 819             len = esp_fifo_pop_buf(s, buf,
 820                                    MIN(fifo8_num_used(&s->fifo), 1));
 821             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 822             fifo8_push_all(&s->cmdfifo, buf, len);
 823
 824             if (fifo8_num_used(&s->cmdfifo) >= 1) {
 825                 /* First byte received, stop in message out phase */
 826                 s->rregs[ESP_RSEQ] = SEQ_MO;
 827                 s->cmdfifo_cdb_offset = 1;
 828
 829                 /* Raise command completion interrupt */
 830                 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 831                 esp_raise_irq(s);
 832             }
 833             break;
 834
 835         case CMD_TI:
 836             /* Copy FIFO into cmdfifo */
 837             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 838             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 839             fifo8_push_all(&s->cmdfifo, buf, len);
 840
 841             /* ATN remains asserted until FIFO empty */
 842             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 843             esp_set_phase(s, STAT_CD);
 844             s->rregs[ESP_CMD] = 0;
 845             s->rregs[ESP_RINTR] |= INTR_BS;
 846             esp_raise_irq(s);
 847             break;
 848         }
 849         break;
 850
 851     case STAT_CD:
 852         switch (s->rregs[ESP_CMD]) {
 853         case CMD_TI:
 854             /* Copy FIFO into cmdfifo */
 855             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 856             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 857             fifo8_push_all(&s->cmdfifo, buf, len);
 858
 859             cmdlen = fifo8_num_used(&s->cmdfifo);
 860             trace_esp_handle_ti_cmd(cmdlen);
 861
 862             /* CDB may be transferred in one or more TI commands */
 863             if (esp_cdb_ready(s)) {
 864                 /* Command has been received */
 865                 do_cmd(s);
 866             } else {
 867                 /*
 868                  * If data was transferred from the FIFO then raise bus
 869                  * service interrupt to indicate transfer complete. Otherwise
 870                  * defer until the next FIFO write.
 871                  */
 872                 if (len) {
 873                     /* Raise interrupt to indicate transfer complete */
 874                     s->rregs[ESP_RINTR] |= INTR_BS;
 875                     esp_raise_irq(s);
 876                 }
 877             }
 878             break;
 879
 880         case CMD_SEL | CMD_DMA:
 881         case CMD_SELATN | CMD_DMA:
 882             /* Copy FIFO into cmdfifo */
 883             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 884             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 885             fifo8_push_all(&s->cmdfifo, buf, len);
 886
 887             /* Handle when DMA transfer is terminated by non-DMA FIFO write */
 888             if (esp_cdb_ready(s)) {
 889                 /* Command has been received */
 890                 do_cmd(s);
 891             }
 892             break;
 893
 894         case CMD_SEL:
 895         case CMD_SELATN:
 896             /* FIFO already contain entire CDB: copy to cmdfifo and execute */
 897             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 898             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 899             fifo8_push_all(&s->cmdfifo, buf, len);
 900
 901             do_cmd(s);
 902             break;
 903         }
 904         break;
 905
 906     case STAT_DO:
 907         /* Accumulate data in FIFO until non-DMA TI is executed */
 908         break;
 909
 910     case STAT_DI:
 911         if (!s->current_req) {
 912             return;
 913         }
 914         if (s->async_len == 0) {
 915             /* Defer until data is available.  */
 916             return;
 917         }
 918         if (fifo8_is_empty(&s->fifo)) {
 919             esp_fifo_push(s, s->async_buf[0]);
 920             s->async_buf++;
 921             s->async_len--;
 922             s->ti_size--;
 923         }
 924
 925         if (s->async_len == 0) {
 926             scsi_req_continue(s->current_req);
 927             return;
 928         }
 929
 930         /* If preloading the FIFO, defer until TI command issued */
 931         if (s->rregs[ESP_CMD] != CMD_TI) {
 932             return;
 933         }
 934
 935         s->rregs[ESP_RINTR] |= INTR_BS;
 936         esp_raise_irq(s);
 937         break;
 938
 939     case STAT_ST:
 940         switch (s->rregs[ESP_CMD]) {
 941         case CMD_ICCS:
 942             esp_fifo_push(s, s->status);
 943             esp_set_phase(s, STAT_MI);
 944
 945             /* Process any message in phase data */
 946             esp_do_nodma(s);
 947             break;
 948         }
 949         break;
 950
 951     case STAT_MI:
 952         switch (s->rregs[ESP_CMD]) {
 953         case CMD_ICCS:
 954             esp_fifo_push(s, 0);
 955
 956             /* Raise end of command interrupt */
 957             s->rregs[ESP_RINTR] |= INTR_FC;
 958             esp_raise_irq(s);
 959             break;
 960         }
 961         break;
 962     }
 963 }
 964
 965 void esp_command_complete(SCSIRequest *req, size_t resid)
 966 {
 967     ESPState *s = req->hba_private;
 968     int to_device = (esp_get_phase(s) == STAT_DO);
 969
 970     trace_esp_command_complete();
 971
 972     /*
 973      * Non-DMA transfers from the target will leave the last byte in
 974      * the FIFO so don't reset ti_size in this case
 975      */
 976     if (s->dma || to_device) {
 977         if (s->ti_size != 0) {
 978             trace_esp_command_complete_unexpected();
 979         }
 980     }
 981
 982     s->async_len = 0;
 983     if (req->status) {
 984         trace_esp_command_complete_fail();
 985     }
 986     s->status = req->status;
 987
 988     /*
 989      * Switch to status phase. For non-DMA transfers from the target the last
 990      * byte is still in the FIFO
 991      */
 992     s->ti_size = 0;
 993
 994     switch (s->rregs[ESP_CMD]) {
 995     case CMD_SEL | CMD_DMA:
 996     case CMD_SEL:
 997     case CMD_SELATN | CMD_DMA:
 998     case CMD_SELATN:
 999         /*
1000          * No data phase for sequencer command so raise deferred bus service
1001          * and function complete interrupt
1002          */
1003         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
1004         s->rregs[ESP_RSEQ] = SEQ_CD;
1005         break;
1006
1007     case CMD_TI | CMD_DMA:
1008     case CMD_TI:
1009         s->rregs[ESP_CMD] = 0;
1010         break;
1011     }
1012
1013     /* Raise bus service interrupt to indicate change to STATUS phase */
1014     esp_set_phase(s, STAT_ST);
1015     s->rregs[ESP_RINTR] |= INTR_BS;
1016     esp_raise_irq(s);
1017
1018     if (s->current_req) {
1019         scsi_req_unref(s->current_req);
1020         s->current_req = NULL;
1021         s->current_dev = NULL;
1022     }
1023 }
1024
1025 void esp_transfer_data(SCSIRequest *req, uint32_t len)
1026 {
1027     ESPState *s = req->hba_private;
1028     uint32_t dmalen = esp_get_tc(s);
1029
1030     trace_esp_transfer_data(dmalen, s->ti_size);
1031     s->async_len = len;
1032     s->async_buf = scsi_req_get_buf(req);
1033
1034     if (!s->data_ready) {
1035         s->data_ready = true;
1036
1037         switch (s->rregs[ESP_CMD]) {
1038         case CMD_SEL | CMD_DMA:
1039         case CMD_SEL:
1040         case CMD_SELATN | CMD_DMA:
1041         case CMD_SELATN:
1042             /*
1043              * Initial incoming data xfer is complete for sequencer command
1044              * so raise deferred bus service and function complete interrupt
1045              */
1046              s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
1047              s->rregs[ESP_RSEQ] = SEQ_CD;
1048              break;
1049
1050         case CMD_SELATNS | CMD_DMA:
1051         case CMD_SELATNS:
1052             /*
1053              * Initial incoming data xfer is complete so raise command
1054              * completion interrupt
1055              */
1056              s->rregs[ESP_RINTR] |= INTR_BS;
1057              s->rregs[ESP_RSEQ] = SEQ_MO;
1058              break;
1059
1060         case CMD_TI | CMD_DMA:
1061         case CMD_TI:
1062             /*
1063              * Bus service interrupt raised because of initial change to
1064              * DATA phase
1065              */
1066             s->rregs[ESP_CMD] = 0;
1067             s->rregs[ESP_RINTR] |= INTR_BS;
1068             break;
1069         }
1070
1071         esp_raise_irq(s);
1072     }
1073
1074     /*
1075      * Always perform the initial transfer upon reception of the next TI
1076      * command to ensure the DMA/non-DMA status of the command is correct.
1077      * It is not possible to use s->dma directly in the section below as
1078      * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
1079      * async data transfer is delayed then s->dma is set incorrectly.
1080      */
1081
1082     if (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA)) {
1083         /* When the SCSI layer returns more data, raise deferred INTR_BS */
1084         esp_dma_ti_check(s);
1085
1086         esp_do_dma(s);
1087     } else if (s->rregs[ESP_CMD] == CMD_TI) {
1088         esp_do_nodma(s);
1089     }
1090 }
1091
1092 static void handle_ti(ESPState *s)
1093 {
1094     uint32_t dmalen;
1095
1096     if (s->dma && !s->dma_enabled) {
1097         s->dma_cb = handle_ti;
1098         return;
1099     }
1100
1101     if (s->dma) {
1102         dmalen = esp_get_tc(s);
1103         trace_esp_handle_ti(dmalen);
1104         esp_do_dma(s);
1105     } else {
1106         trace_esp_handle_ti(s->ti_size);
1107         esp_do_nodma(s);
1108
1109         if (esp_get_phase(s) == STAT_DO) {
1110             esp_nodma_ti_dataout(s);
1111         }
1112     }
1113 }
1114
1115 void esp_hard_reset(ESPState *s)
1116 {
1117     memset(s->rregs, 0, ESP_REGS);
1118     memset(s->wregs, 0, ESP_REGS);
1119     s->tchi_written = 0;
1120     s->ti_size = 0;
1121     s->async_len = 0;
1122     fifo8_reset(&s->fifo);
1123     fifo8_reset(&s->cmdfifo);
1124     s->dma = 0;
1125     s->dma_cb = NULL;
1126
1127     s->rregs[ESP_CFG1] = 7;
1128 }
1129
1130 static void esp_soft_reset(ESPState *s)
1131 {
1132     qemu_irq_lower(s->irq);
1133     qemu_irq_lower(s->drq_irq);
1134     esp_hard_reset(s);
1135 }
1136
1137 static void esp_bus_reset(ESPState *s)
1138 {
1139     bus_cold_reset(BUS(&s->bus));
1140 }
1141
1142 static void parent_esp_reset(ESPState *s, int irq, int level)
1143 {
1144     if (level) {
1145         esp_soft_reset(s);
1146     }
1147 }
1148
1149 static void esp_run_cmd(ESPState *s)
1150 {
1151     uint8_t cmd = s->rregs[ESP_CMD];
1152
1153     if (cmd & CMD_DMA) {
1154         s->dma = 1;
1155         /* Reload DMA counter.  */
1156         if (esp_get_stc(s) == 0) {
1157             esp_set_tc(s, 0x10000);
1158         } else {
1159             esp_set_tc(s, esp_get_stc(s));
1160         }
1161     } else {
1162         s->dma = 0;
1163     }
1164     switch (cmd & CMD_CMD) {
1165     case CMD_NOP:
1166         trace_esp_mem_writeb_cmd_nop(cmd);
1167         break;
1168     case CMD_FLUSH:
1169         trace_esp_mem_writeb_cmd_flush(cmd);
1170         fifo8_reset(&s->fifo);
1171         break;
1172     case CMD_RESET:
1173         trace_esp_mem_writeb_cmd_reset(cmd);
1174         esp_soft_reset(s);
1175         break;
1176     case CMD_BUSRESET:
1177         trace_esp_mem_writeb_cmd_bus_reset(cmd);
1178         esp_bus_reset(s);
1179         if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
1180             s->rregs[ESP_RINTR] |= INTR_RST;
1181             esp_raise_irq(s);
1182         }
1183         break;
1184     case CMD_TI:
1185         trace_esp_mem_writeb_cmd_ti(cmd);
1186         handle_ti(s);
1187         break;
1188     case CMD_ICCS:
1189         trace_esp_mem_writeb_cmd_iccs(cmd);
1190         write_response(s);
1191         break;
1192     case CMD_MSGACC:
1193         trace_esp_mem_writeb_cmd_msgacc(cmd);
1194         s->rregs[ESP_RINTR] |= INTR_DC;
1195         s->rregs[ESP_RSEQ] = 0;
1196         s->rregs[ESP_RFLAGS] = 0;
1197         esp_raise_irq(s);
1198         break;
1199     case CMD_PAD:
1200         trace_esp_mem_writeb_cmd_pad(cmd);
1201         handle_pad(s);
1202         break;
1203     case CMD_SATN:
1204         trace_esp_mem_writeb_cmd_satn(cmd);
1205         break;
1206     case CMD_RSTATN:
1207         trace_esp_mem_writeb_cmd_rstatn(cmd);
1208         break;
1209     case CMD_SEL:
1210         trace_esp_mem_writeb_cmd_sel(cmd);
1211         handle_s_without_atn(s);
1212         break;
1213     case CMD_SELATN:
1214         trace_esp_mem_writeb_cmd_selatn(cmd);
1215         handle_satn(s);
1216         break;
1217     case CMD_SELATNS:
1218         trace_esp_mem_writeb_cmd_selatns(cmd);
1219         handle_satn_stop(s);
1220         break;
1221     case CMD_ENSEL:
1222         trace_esp_mem_writeb_cmd_ensel(cmd);
1223         s->rregs[ESP_RINTR] = 0;
1224         break;
1225     case CMD_DISSEL:
1226         trace_esp_mem_writeb_cmd_dissel(cmd);
1227         s->rregs[ESP_RINTR] = 0;
1228         esp_raise_irq(s);
1229         break;
1230     default:
1231         trace_esp_error_unhandled_command(cmd);
1232         break;
1233     }
1234 }
1235
1236 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
1237 {
1238     uint32_t val;
1239
1240     switch (saddr) {
1241     case ESP_FIFO:
1242         s->rregs[ESP_FIFO] = esp_fifo_pop(s);
1243         val = s->rregs[ESP_FIFO];
1244         break;
1245     case ESP_RINTR:
1246         /*
1247          * Clear sequence step, interrupt register and all status bits
1248          * except TC
1249          */
1250         val = s->rregs[ESP_RINTR];
1251         s->rregs[ESP_RINTR] = 0;
1252         esp_lower_irq(s);
1253         s->rregs[ESP_RSTAT] &= STAT_TC | 7;
1254         /*
1255          * According to the datasheet ESP_RSEQ should be cleared, but as the
1256          * emulation currently defers information transfers to the next TI
1257          * command leave it for now so that pedantic guests such as the old
1258          * Linux 2.6 driver see the correct flags before the next SCSI phase
1259          * transition.
1260          *
1261          * s->rregs[ESP_RSEQ] = SEQ_0;
1262          */
1263         break;
1264     case ESP_TCHI:
1265         /* Return the unique id if the value has never been written */
1266         if (!s->tchi_written) {
1267             val = s->chip_id;
1268         } else {
1269             val = s->rregs[saddr];
1270         }
1271         break;
1272      case ESP_RFLAGS:
1273         /* Bottom 5 bits indicate number of bytes in FIFO */
1274         val = fifo8_num_used(&s->fifo);
1275         break;
1276     default:
1277         val = s->rregs[saddr];
1278         break;
1279     }
1280
1281     trace_esp_mem_readb(saddr, val);
1282     return val;
1283 }
1284
1285 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
1286 {
1287     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
1288     switch (saddr) {
1289     case ESP_TCHI:
1290         s->tchi_written = true;
1291         /* fall through */
1292     case ESP_TCLO:
1293     case ESP_TCMID:
1294         s->rregs[ESP_RSTAT] &= ~STAT_TC;
1295         break;
1296     case ESP_FIFO:
1297         if (!fifo8_is_full(&s->fifo)) {
1298             esp_fifo_push(s, val);
1299         }
1300         esp_do_nodma(s);
1301         break;
1302     case ESP_CMD:
1303         s->rregs[saddr] = val;
1304         esp_run_cmd(s);
1305         break;
1306     case ESP_WBUSID ... ESP_WSYNO:
1307         break;
1308     case ESP_CFG1:
1309     case ESP_CFG2: case ESP_CFG3:
1310     case ESP_RES3: case ESP_RES4:
1311         s->rregs[saddr] = val;
1312         break;
1313     case ESP_WCCF ... ESP_WTEST:
1314         break;
1315     default:
1316         trace_esp_error_invalid_write(val, saddr);
1317         return;
1318     }
1319     s->wregs[saddr] = val;
1320 }
1321
1322 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1323                             unsigned size, bool is_write,
1324                             MemTxAttrs attrs)
1325 {
1326     return (size == 1) || (is_write && size == 4);
1327 }
1328
1329 static bool esp_is_before_version_5(void *opaque, int version_id)
1330 {
1331     ESPState *s = ESP(opaque);
1332
1333     version_id = MIN(version_id, s->mig_version_id);
1334     return version_id < 5;
1335 }
1336
1337 static bool esp_is_version_5(void *opaque, int version_id)
1338 {
1339     ESPState *s = ESP(opaque);
1340
1341     version_id = MIN(version_id, s->mig_version_id);
1342     return version_id >= 5;
1343 }
1344
1345 static bool esp_is_version_6(void *opaque, int version_id)
1346 {
1347     ESPState *s = ESP(opaque);
1348
1349     version_id = MIN(version_id, s->mig_version_id);
1350     return version_id >= 6;
1351 }
1352
1353 static bool esp_is_between_version_5_and_6(void *opaque, int version_id)
1354 {
1355     ESPState *s = ESP(opaque);
1356
1357     version_id = MIN(version_id, s->mig_version_id);
1358     return version_id >= 5 && version_id <= 6;
1359 }
1360
1361 int esp_pre_save(void *opaque)
1362 {
1363     ESPState *s = ESP(object_resolve_path_component(
1364                       OBJECT(opaque), "esp"));
1365
1366     s->mig_version_id = vmstate_esp.version_id;
1367     return 0;
1368 }
1369
1370 static int esp_post_load(void *opaque, int version_id)
1371 {
1372     ESPState *s = ESP(opaque);
1373     int len, i;
1374
1375     version_id = MIN(version_id, s->mig_version_id);
1376
1377     if (version_id < 5) {
1378         esp_set_tc(s, s->mig_dma_left);
1379
1380         /* Migrate ti_buf to fifo */
1381         len = s->mig_ti_wptr - s->mig_ti_rptr;
1382         for (i = 0; i < len; i++) {
1383             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1384         }
1385
1386         /* Migrate cmdbuf to cmdfifo */
1387         for (i = 0; i < s->mig_cmdlen; i++) {
1388             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1389         }
1390     }
1391
1392     s->mig_version_id = vmstate_esp.version_id;
1393     return 0;
1394 }
1395
1396 const VMStateDescription vmstate_esp = {
1397     .name = "esp",
1398     .version_id = 7,
1399     .minimum_version_id = 3,
1400     .post_load = esp_post_load,
1401     .fields = (const VMStateField[]) {
1402         VMSTATE_BUFFER(rregs, ESPState),
1403         VMSTATE_BUFFER(wregs, ESPState),
1404         VMSTATE_INT32(ti_size, ESPState),
1405         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1406         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1407         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1408         VMSTATE_UINT32(status, ESPState),
1409         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1410                             esp_is_before_version_5),
1411         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1412                           esp_is_before_version_5),
1413         VMSTATE_UINT32(dma, ESPState),
1414         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1415                               esp_is_before_version_5, 0, 16),
1416         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1417                               esp_is_before_version_5, 16,
1418                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
1419         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1420         VMSTATE_UINT32(do_cmd, ESPState),
1421         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1422         VMSTATE_BOOL_TEST(data_ready, ESPState, esp_is_version_5),
1423         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1424         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1425         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1426         VMSTATE_UINT8_TEST(mig_ti_cmd, ESPState,
1427                            esp_is_between_version_5_and_6),
1428         VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6),
1429         VMSTATE_BOOL(drq_state, ESPState),
1430         VMSTATE_END_OF_LIST()
1431     },
1432 };
1433
1434 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1435                                  uint64_t val, unsigned int size)
1436 {
1437     SysBusESPState *sysbus = opaque;
1438     ESPState *s = ESP(&sysbus->esp);
1439     uint32_t saddr;
1440
1441     saddr = addr >> sysbus->it_shift;
1442     esp_reg_write(s, saddr, val);
1443 }
1444
1445 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1446                                     unsigned int size)
1447 {
1448     SysBusESPState *sysbus = opaque;
1449     ESPState *s = ESP(&sysbus->esp);
1450     uint32_t saddr;
1451
1452     saddr = addr >> sysbus->it_shift;
1453     return esp_reg_read(s, saddr);
1454 }
1455
1456 static const MemoryRegionOps sysbus_esp_mem_ops = {
1457     .read = sysbus_esp_mem_read,
1458     .write = sysbus_esp_mem_write,
1459     .endianness = DEVICE_NATIVE_ENDIAN,
1460     .valid.accepts = esp_mem_accepts,
1461 };
1462
1463 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1464                                   uint64_t val, unsigned int size)
1465 {
1466     SysBusESPState *sysbus = opaque;
1467     ESPState *s = ESP(&sysbus->esp);
1468
1469     trace_esp_pdma_write(size);
1470
1471     switch (size) {
1472     case 1:
1473         esp_pdma_write(s, val);
1474         break;
1475     case 2:
1476         esp_pdma_write(s, val >> 8);
1477         esp_pdma_write(s, val);
1478         break;
1479     }
1480     esp_do_dma(s);
1481 }
1482
1483 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1484                                      unsigned int size)
1485 {
1486     SysBusESPState *sysbus = opaque;
1487     ESPState *s = ESP(&sysbus->esp);
1488     uint64_t val = 0;
1489
1490     trace_esp_pdma_read(size);
1491
1492     switch (size) {
1493     case 1:
1494         val = esp_pdma_read(s);
1495         break;
1496     case 2:
1497         val = esp_pdma_read(s);
1498         val = (val << 8) | esp_pdma_read(s);
1499         break;
1500     }
1501     esp_do_dma(s);
1502     return val;
1503 }
1504
1505 static void *esp_load_request(QEMUFile *f, SCSIRequest *req)
1506 {
1507     ESPState *s = container_of(req->bus, ESPState, bus);
1508
1509     scsi_req_ref(req);
1510     s->current_req = req;
1511     return s;
1512 }
1513
1514 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1515     .read = sysbus_esp_pdma_read,
1516     .write = sysbus_esp_pdma_write,
1517     .endianness = DEVICE_NATIVE_ENDIAN,
1518     .valid.min_access_size = 1,
1519     .valid.max_access_size = 4,
1520     .impl.min_access_size = 1,
1521     .impl.max_access_size = 2,
1522 };
1523
1524 static const struct SCSIBusInfo esp_scsi_info = {
1525     .tcq = false,
1526     .max_target = ESP_MAX_DEVS,
1527     .max_lun = 7,
1528
1529     .load_request = esp_load_request,
1530     .transfer_data = esp_transfer_data,
1531     .complete = esp_command_complete,
1532     .cancel = esp_request_cancelled
1533 };
1534
1535 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1536 {
1537     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1538     ESPState *s = ESP(&sysbus->esp);
1539
1540     switch (irq) {
1541     case 0:
1542         parent_esp_reset(s, irq, level);
1543         break;
1544     case 1:
1545         esp_dma_enable(s, irq, level);
1546         break;
1547     }
1548 }
1549
1550 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1551 {
1552     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1553     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1554     ESPState *s = ESP(&sysbus->esp);
1555
1556     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1557         return;
1558     }
1559
1560     sysbus_init_irq(sbd, &s->irq);
1561     sysbus_init_irq(sbd, &s->drq_irq);
1562     assert(sysbus->it_shift != -1);
1563
1564     s->chip_id = TCHI_FAS100A;
1565     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1566                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1567     sysbus_init_mmio(sbd, &sysbus->iomem);
1568     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1569                           sysbus, "esp-pdma", 4);
1570     sysbus_init_mmio(sbd, &sysbus->pdma);
1571
1572     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1573
1574     scsi_bus_init(&s->bus, sizeof(s->bus), dev, &esp_scsi_info);
1575 }
1576
1577 static void sysbus_esp_hard_reset(DeviceState *dev)
1578 {
1579     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1580     ESPState *s = ESP(&sysbus->esp);
1581
1582     esp_hard_reset(s);
1583 }
1584
1585 static void sysbus_esp_init(Object *obj)
1586 {
1587     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1588
1589     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1590 }
1591
1592 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1593     .name = "sysbusespscsi",
1594     .version_id = 2,
1595     .minimum_version_id = 1,
1596     .pre_save = esp_pre_save,
1597     .fields = (const VMStateField[]) {
1598         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1599         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1600         VMSTATE_END_OF_LIST()
1601     }
1602 };
1603
1604 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1605 {
1606     DeviceClass *dc = DEVICE_CLASS(klass);
1607
1608     dc->realize = sysbus_esp_realize;
1609     dc->reset = sysbus_esp_hard_reset;
1610     dc->vmsd = &vmstate_sysbus_esp_scsi;
1611     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1612 }
1613
1614 static void esp_finalize(Object *obj)
1615 {
1616     ESPState *s = ESP(obj);
1617
1618     fifo8_destroy(&s->fifo);
1619     fifo8_destroy(&s->cmdfifo);
1620 }
1621
1622 static void esp_init(Object *obj)
1623 {
1624     ESPState *s = ESP(obj);
1625
1626     fifo8_create(&s->fifo, ESP_FIFO_SZ);
1627     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1628 }
1629
1630 static void esp_class_init(ObjectClass *klass, void *data)
1631 {
1632     DeviceClass *dc = DEVICE_CLASS(klass);
1633
1634     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1635     dc->user_creatable = false;
1636     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1637 }
1638
1639 static const TypeInfo esp_info_types[] = {
1640     {
1641         .name          = TYPE_SYSBUS_ESP,
1642         .parent        = TYPE_SYS_BUS_DEVICE,
1643         .instance_init = sysbus_esp_init,
1644         .instance_size = sizeof(SysBusESPState),
1645         .class_init    = sysbus_esp_class_init,
1646     },
1647     {
1648         .name = TYPE_ESP,
1649         .parent = TYPE_DEVICE,
1650         .instance_init = esp_init,
1651         .instance_finalize = esp_finalize,
1652         .instance_size = sizeof(ESPState),
1653         .class_init = esp_class_init,
1654     },
1655 };
1656
1657 DEFINE_TYPES(esp_info_types)