qemu

FORK: QEMU emulator
git clone https://git.neptards.moe/neptards/qemu.git
Log | Files | Refs | Submodules | LICENSE

esp.c (41105B)


      1 /*
      2  * QEMU ESP/NCR53C9x emulation
      3  *
      4  * Copyright (c) 2005-2006 Fabrice Bellard
      5  * Copyright (c) 2012 Herve Poussineau
      6  *
      7  * Permission is hereby granted, free of charge, to any person obtaining a copy
      8  * of this software and associated documentation files (the "Software"), to deal
      9  * in the Software without restriction, including without limitation the rights
     10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     11  * copies of the Software, and to permit persons to whom the Software is
     12  * furnished to do so, subject to the following conditions:
     13  *
     14  * The above copyright notice and this permission notice shall be included in
     15  * all copies or substantial portions of the Software.
     16  *
     17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     23  * THE SOFTWARE.
     24  */
     25 
     26 #include "qemu/osdep.h"
     27 #include "hw/sysbus.h"
     28 #include "migration/vmstate.h"
     29 #include "hw/irq.h"
     30 #include "hw/scsi/esp.h"
     31 #include "trace.h"
     32 #include "qemu/log.h"
     33 #include "qemu/module.h"
     34 
     35 /*
     36  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
     37  * also produced as NCR89C100. See
     38  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
     39  * and
     40  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
     41  *
     42  * On Macintosh Quadra it is a NCR53C96.
     43  */
     44 
     45 static void esp_raise_irq(ESPState *s)
     46 {
     47     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
     48         s->rregs[ESP_RSTAT] |= STAT_INT;
     49         qemu_irq_raise(s->irq);
     50         trace_esp_raise_irq();
     51     }
     52 }
     53 
     54 static void esp_lower_irq(ESPState *s)
     55 {
     56     if (s->rregs[ESP_RSTAT] & STAT_INT) {
     57         s->rregs[ESP_RSTAT] &= ~STAT_INT;
     58         qemu_irq_lower(s->irq);
     59         trace_esp_lower_irq();
     60     }
     61 }
     62 
     63 static void esp_raise_drq(ESPState *s)
     64 {
     65     qemu_irq_raise(s->irq_data);
     66     trace_esp_raise_drq();
     67 }
     68 
     69 static void esp_lower_drq(ESPState *s)
     70 {
     71     qemu_irq_lower(s->irq_data);
     72     trace_esp_lower_drq();
     73 }
     74 
     75 void esp_dma_enable(ESPState *s, int irq, int level)
     76 {
     77     if (level) {
     78         s->dma_enabled = 1;
     79         trace_esp_dma_enable();
     80         if (s->dma_cb) {
     81             s->dma_cb(s);
     82             s->dma_cb = NULL;
     83         }
     84     } else {
     85         trace_esp_dma_disable();
     86         s->dma_enabled = 0;
     87     }
     88 }
     89 
     90 void esp_request_cancelled(SCSIRequest *req)
     91 {
     92     ESPState *s = req->hba_private;
     93 
     94     if (req == s->current_req) {
     95         scsi_req_unref(s->current_req);
     96         s->current_req = NULL;
     97         s->current_dev = NULL;
     98         s->async_len = 0;
     99     }
    100 }
    101 
    102 static void esp_fifo_push(Fifo8 *fifo, uint8_t val)
    103 {
    104     if (fifo8_num_used(fifo) == fifo->capacity) {
    105         trace_esp_error_fifo_overrun();
    106         return;
    107     }
    108 
    109     fifo8_push(fifo, val);
    110 }
    111 
    112 static uint8_t esp_fifo_pop(Fifo8 *fifo)
    113 {
    114     if (fifo8_is_empty(fifo)) {
    115         return 0;
    116     }
    117 
    118     return fifo8_pop(fifo);
    119 }
    120 
    121 static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen)
    122 {
    123     const uint8_t *buf;
    124     uint32_t n;
    125 
    126     if (maxlen == 0) {
    127         return 0;
    128     }
    129 
    130     buf = fifo8_pop_buf(fifo, maxlen, &n);
    131     if (dest) {
    132         memcpy(dest, buf, n);
    133     }
    134 
    135     return n;
    136 }
    137 
    138 static uint32_t esp_get_tc(ESPState *s)
    139 {
    140     uint32_t dmalen;
    141 
    142     dmalen = s->rregs[ESP_TCLO];
    143     dmalen |= s->rregs[ESP_TCMID] << 8;
    144     dmalen |= s->rregs[ESP_TCHI] << 16;
    145 
    146     return dmalen;
    147 }
    148 
    149 static void esp_set_tc(ESPState *s, uint32_t dmalen)
    150 {
    151     s->rregs[ESP_TCLO] = dmalen;
    152     s->rregs[ESP_TCMID] = dmalen >> 8;
    153     s->rregs[ESP_TCHI] = dmalen >> 16;
    154 }
    155 
    156 static uint32_t esp_get_stc(ESPState *s)
    157 {
    158     uint32_t dmalen;
    159 
    160     dmalen = s->wregs[ESP_TCLO];
    161     dmalen |= s->wregs[ESP_TCMID] << 8;
    162     dmalen |= s->wregs[ESP_TCHI] << 16;
    163 
    164     return dmalen;
    165 }
    166 
    167 static uint8_t esp_pdma_read(ESPState *s)
    168 {
    169     uint8_t val;
    170 
    171     if (s->do_cmd) {
    172         val = esp_fifo_pop(&s->cmdfifo);
    173     } else {
    174         val = esp_fifo_pop(&s->fifo);
    175     }
    176 
    177     return val;
    178 }
    179 
    180 static void esp_pdma_write(ESPState *s, uint8_t val)
    181 {
    182     uint32_t dmalen = esp_get_tc(s);
    183 
    184     if (dmalen == 0) {
    185         return;
    186     }
    187 
    188     if (s->do_cmd) {
    189         esp_fifo_push(&s->cmdfifo, val);
    190     } else {
    191         esp_fifo_push(&s->fifo, val);
    192     }
    193 
    194     dmalen--;
    195     esp_set_tc(s, dmalen);
    196 }
    197 
    198 static void esp_set_pdma_cb(ESPState *s, enum pdma_cb cb)
    199 {
    200     s->pdma_cb = cb;
    201 }
    202 
    203 static int esp_select(ESPState *s)
    204 {
    205     int target;
    206 
    207     target = s->wregs[ESP_WBUSID] & BUSID_DID;
    208 
    209     s->ti_size = 0;
    210     fifo8_reset(&s->fifo);
    211 
    212     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
    213     if (!s->current_dev) {
    214         /* No such drive */
    215         s->rregs[ESP_RSTAT] = 0;
    216         s->rregs[ESP_RINTR] = INTR_DC;
    217         s->rregs[ESP_RSEQ] = SEQ_0;
    218         esp_raise_irq(s);
    219         return -1;
    220     }
    221 
    222     /*
    223      * Note that we deliberately don't raise the IRQ here: this will be done
    224      * either in do_command_phase() for DATA OUT transfers or by the deferred
    225      * IRQ mechanism in esp_transfer_data() for DATA IN transfers
    226      */
    227     s->rregs[ESP_RINTR] |= INTR_FC;
    228     s->rregs[ESP_RSEQ] = SEQ_CD;
    229     return 0;
    230 }
    231 
    232 static uint32_t get_cmd(ESPState *s, uint32_t maxlen)
    233 {
    234     uint8_t buf[ESP_CMDFIFO_SZ];
    235     uint32_t dmalen, n;
    236     int target;
    237 
    238     if (s->current_req) {
    239         /* Started a new command before the old one finished.  Cancel it.  */
    240         scsi_req_cancel(s->current_req);
    241     }
    242 
    243     target = s->wregs[ESP_WBUSID] & BUSID_DID;
    244     if (s->dma) {
    245         dmalen = MIN(esp_get_tc(s), maxlen);
    246         if (dmalen == 0) {
    247             return 0;
    248         }
    249         if (s->dma_memory_read) {
    250             s->dma_memory_read(s->dma_opaque, buf, dmalen);
    251             dmalen = MIN(fifo8_num_free(&s->cmdfifo), dmalen);
    252             fifo8_push_all(&s->cmdfifo, buf, dmalen);
    253         } else {
    254             if (esp_select(s) < 0) {
    255                 fifo8_reset(&s->cmdfifo);
    256                 return -1;
    257             }
    258             esp_raise_drq(s);
    259             fifo8_reset(&s->cmdfifo);
    260             return 0;
    261         }
    262     } else {
    263         dmalen = MIN(fifo8_num_used(&s->fifo), maxlen);
    264         if (dmalen == 0) {
    265             return 0;
    266         }
    267         n = esp_fifo_pop_buf(&s->fifo, buf, dmalen);
    268         n = MIN(fifo8_num_free(&s->cmdfifo), n);
    269         fifo8_push_all(&s->cmdfifo, buf, n);
    270     }
    271     trace_esp_get_cmd(dmalen, target);
    272 
    273     if (esp_select(s) < 0) {
    274         fifo8_reset(&s->cmdfifo);
    275         return -1;
    276     }
    277     return dmalen;
    278 }
    279 
    280 static void do_command_phase(ESPState *s)
    281 {
    282     uint32_t cmdlen;
    283     int32_t datalen;
    284     SCSIDevice *current_lun;
    285     uint8_t buf[ESP_CMDFIFO_SZ];
    286 
    287     trace_esp_do_command_phase(s->lun);
    288     cmdlen = fifo8_num_used(&s->cmdfifo);
    289     if (!cmdlen || !s->current_dev) {
    290         return;
    291     }
    292     esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
    293 
    294     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
    295     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
    296     datalen = scsi_req_enqueue(s->current_req);
    297     s->ti_size = datalen;
    298     fifo8_reset(&s->cmdfifo);
    299     if (datalen != 0) {
    300         s->rregs[ESP_RSTAT] = STAT_TC;
    301         s->rregs[ESP_RSEQ] = SEQ_CD;
    302         s->ti_cmd = 0;
    303         esp_set_tc(s, 0);
    304         if (datalen > 0) {
    305             /*
    306              * Switch to DATA IN phase but wait until initial data xfer is
    307              * complete before raising the command completion interrupt
    308              */
    309             s->data_in_ready = false;
    310             s->rregs[ESP_RSTAT] |= STAT_DI;
    311         } else {
    312             s->rregs[ESP_RSTAT] |= STAT_DO;
    313             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
    314             esp_raise_irq(s);
    315             esp_lower_drq(s);
    316         }
    317         scsi_req_continue(s->current_req);
    318         return;
    319     }
    320 }
    321 
    322 static void do_message_phase(ESPState *s)
    323 {
    324     if (s->cmdfifo_cdb_offset) {
    325         uint8_t message = esp_fifo_pop(&s->cmdfifo);
    326 
    327         trace_esp_do_identify(message);
    328         s->lun = message & 7;
    329         s->cmdfifo_cdb_offset--;
    330     }
    331 
    332     /* Ignore extended messages for now */
    333     if (s->cmdfifo_cdb_offset) {
    334         int len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
    335         esp_fifo_pop_buf(&s->cmdfifo, NULL, len);
    336         s->cmdfifo_cdb_offset = 0;
    337     }
    338 }
    339 
    340 static void do_cmd(ESPState *s)
    341 {
    342     do_message_phase(s);
    343     assert(s->cmdfifo_cdb_offset == 0);
    344     do_command_phase(s);
    345 }
    346 
    347 static void satn_pdma_cb(ESPState *s)
    348 {
    349     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
    350         s->cmdfifo_cdb_offset = 1;
    351         s->do_cmd = 0;
    352         do_cmd(s);
    353     }
    354 }
    355 
    356 static void handle_satn(ESPState *s)
    357 {
    358     int32_t cmdlen;
    359 
    360     if (s->dma && !s->dma_enabled) {
    361         s->dma_cb = handle_satn;
    362         return;
    363     }
    364     esp_set_pdma_cb(s, SATN_PDMA_CB);
    365     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
    366     if (cmdlen > 0) {
    367         s->cmdfifo_cdb_offset = 1;
    368         s->do_cmd = 0;
    369         do_cmd(s);
    370     } else if (cmdlen == 0) {
    371         s->do_cmd = 1;
    372         /* Target present, but no cmd yet - switch to command phase */
    373         s->rregs[ESP_RSEQ] = SEQ_CD;
    374         s->rregs[ESP_RSTAT] = STAT_CD;
    375     }
    376 }
    377 
    378 static void s_without_satn_pdma_cb(ESPState *s)
    379 {
    380     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
    381         s->cmdfifo_cdb_offset = 0;
    382         s->do_cmd = 0;
    383         do_cmd(s);
    384     }
    385 }
    386 
    387 static void handle_s_without_atn(ESPState *s)
    388 {
    389     int32_t cmdlen;
    390 
    391     if (s->dma && !s->dma_enabled) {
    392         s->dma_cb = handle_s_without_atn;
    393         return;
    394     }
    395     esp_set_pdma_cb(s, S_WITHOUT_SATN_PDMA_CB);
    396     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
    397     if (cmdlen > 0) {
    398         s->cmdfifo_cdb_offset = 0;
    399         s->do_cmd = 0;
    400         do_cmd(s);
    401     } else if (cmdlen == 0) {
    402         s->do_cmd = 1;
    403         /* Target present, but no cmd yet - switch to command phase */
    404         s->rregs[ESP_RSEQ] = SEQ_CD;
    405         s->rregs[ESP_RSTAT] = STAT_CD;
    406     }
    407 }
    408 
    409 static void satn_stop_pdma_cb(ESPState *s)
    410 {
    411     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
    412         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
    413         s->do_cmd = 1;
    414         s->cmdfifo_cdb_offset = 1;
    415         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
    416         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
    417         s->rregs[ESP_RSEQ] = SEQ_CD;
    418         esp_raise_irq(s);
    419     }
    420 }
    421 
    422 static void handle_satn_stop(ESPState *s)
    423 {
    424     int32_t cmdlen;
    425 
    426     if (s->dma && !s->dma_enabled) {
    427         s->dma_cb = handle_satn_stop;
    428         return;
    429     }
    430     esp_set_pdma_cb(s, SATN_STOP_PDMA_CB);
    431     cmdlen = get_cmd(s, 1);
    432     if (cmdlen > 0) {
    433         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
    434         s->do_cmd = 1;
    435         s->cmdfifo_cdb_offset = 1;
    436         s->rregs[ESP_RSTAT] = STAT_MO;
    437         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
    438         s->rregs[ESP_RSEQ] = SEQ_MO;
    439         esp_raise_irq(s);
    440     } else if (cmdlen == 0) {
    441         s->do_cmd = 1;
    442         /* Target present, switch to message out phase */
    443         s->rregs[ESP_RSEQ] = SEQ_MO;
    444         s->rregs[ESP_RSTAT] = STAT_MO;
    445     }
    446 }
    447 
    448 static void write_response_pdma_cb(ESPState *s)
    449 {
    450     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
    451     s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
    452     s->rregs[ESP_RSEQ] = SEQ_CD;
    453     esp_raise_irq(s);
    454 }
    455 
    456 static void write_response(ESPState *s)
    457 {
    458     uint8_t buf[2];
    459 
    460     trace_esp_write_response(s->status);
    461 
    462     buf[0] = s->status;
    463     buf[1] = 0;
    464 
    465     if (s->dma) {
    466         if (s->dma_memory_write) {
    467             s->dma_memory_write(s->dma_opaque, buf, 2);
    468             s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
    469             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
    470             s->rregs[ESP_RSEQ] = SEQ_CD;
    471         } else {
    472             esp_set_pdma_cb(s, WRITE_RESPONSE_PDMA_CB);
    473             esp_raise_drq(s);
    474             return;
    475         }
    476     } else {
    477         fifo8_reset(&s->fifo);
    478         fifo8_push_all(&s->fifo, buf, 2);
    479         s->rregs[ESP_RFLAGS] = 2;
    480     }
    481     esp_raise_irq(s);
    482 }
    483 
    484 static void esp_dma_done(ESPState *s)
    485 {
    486     s->rregs[ESP_RSTAT] |= STAT_TC;
    487     s->rregs[ESP_RINTR] |= INTR_BS;
    488     s->rregs[ESP_RFLAGS] = 0;
    489     esp_set_tc(s, 0);
    490     esp_raise_irq(s);
    491 }
    492 
    493 static void do_dma_pdma_cb(ESPState *s)
    494 {
    495     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
    496     int len;
    497     uint32_t n;
    498 
    499     if (s->do_cmd) {
    500         /* Ensure we have received complete command after SATN and stop */
    501         if (esp_get_tc(s) || fifo8_is_empty(&s->cmdfifo)) {
    502             return;
    503         }
    504 
    505         s->ti_size = 0;
    506         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
    507             /* No command received */
    508             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
    509                 return;
    510             }
    511 
    512             /* Command has been received */
    513             s->do_cmd = 0;
    514             do_cmd(s);
    515         } else {
    516             /*
    517              * Extra message out bytes received: update cmdfifo_cdb_offset
    518              * and then switch to command phase
    519              */
    520             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
    521             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
    522             s->rregs[ESP_RSEQ] = SEQ_CD;
    523             s->rregs[ESP_RINTR] |= INTR_BS;
    524             esp_raise_irq(s);
    525         }
    526         return;
    527     }
    528 
    529     if (!s->current_req) {
    530         return;
    531     }
    532 
    533     if (to_device) {
    534         /* Copy FIFO data to device */
    535         len = MIN(s->async_len, ESP_FIFO_SZ);
    536         len = MIN(len, fifo8_num_used(&s->fifo));
    537         n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
    538         s->async_buf += n;
    539         s->async_len -= n;
    540         s->ti_size += n;
    541 
    542         if (n < len) {
    543             /* Unaligned accesses can cause FIFO wraparound */
    544             len = len - n;
    545             n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
    546             s->async_buf += n;
    547             s->async_len -= n;
    548             s->ti_size += n;
    549         }
    550 
    551         if (s->async_len == 0) {
    552             scsi_req_continue(s->current_req);
    553             return;
    554         }
    555 
    556         if (esp_get_tc(s) == 0) {
    557             esp_lower_drq(s);
    558             esp_dma_done(s);
    559         }
    560 
    561         return;
    562     } else {
    563         if (s->async_len == 0) {
    564             /* Defer until the scsi layer has completed */
    565             scsi_req_continue(s->current_req);
    566             s->data_in_ready = false;
    567             return;
    568         }
    569 
    570         if (esp_get_tc(s) != 0) {
    571             /* Copy device data to FIFO */
    572             len = MIN(s->async_len, esp_get_tc(s));
    573             len = MIN(len, fifo8_num_free(&s->fifo));
    574             fifo8_push_all(&s->fifo, s->async_buf, len);
    575             s->async_buf += len;
    576             s->async_len -= len;
    577             s->ti_size -= len;
    578             esp_set_tc(s, esp_get_tc(s) - len);
    579 
    580             if (esp_get_tc(s) == 0) {
    581                 /* Indicate transfer to FIFO is complete */
    582                  s->rregs[ESP_RSTAT] |= STAT_TC;
    583             }
    584             return;
    585         }
    586 
    587         /* Partially filled a scsi buffer. Complete immediately.  */
    588         esp_lower_drq(s);
    589         esp_dma_done(s);
    590     }
    591 }
    592 
    593 static void esp_do_dma(ESPState *s)
    594 {
    595     uint32_t len, cmdlen;
    596     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
    597     uint8_t buf[ESP_CMDFIFO_SZ];
    598 
    599     len = esp_get_tc(s);
    600     if (s->do_cmd) {
    601         /*
    602          * handle_ti_cmd() case: esp_do_dma() is called only from
    603          * handle_ti_cmd() with do_cmd != NULL (see the assert())
    604          */
    605         cmdlen = fifo8_num_used(&s->cmdfifo);
    606         trace_esp_do_dma(cmdlen, len);
    607         if (s->dma_memory_read) {
    608             len = MIN(len, fifo8_num_free(&s->cmdfifo));
    609             s->dma_memory_read(s->dma_opaque, buf, len);
    610             fifo8_push_all(&s->cmdfifo, buf, len);
    611         } else {
    612             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
    613             esp_raise_drq(s);
    614             return;
    615         }
    616         trace_esp_handle_ti_cmd(cmdlen);
    617         s->ti_size = 0;
    618         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
    619             /* No command received */
    620             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
    621                 return;
    622             }
    623 
    624             /* Command has been received */
    625             s->do_cmd = 0;
    626             do_cmd(s);
    627         } else {
    628             /*
    629              * Extra message out bytes received: update cmdfifo_cdb_offset
    630              * and then switch to command phase
    631              */
    632             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
    633             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
    634             s->rregs[ESP_RSEQ] = SEQ_CD;
    635             s->rregs[ESP_RINTR] |= INTR_BS;
    636             esp_raise_irq(s);
    637         }
    638         return;
    639     }
    640     if (!s->current_req) {
    641         return;
    642     }
    643     if (s->async_len == 0) {
    644         /* Defer until data is available.  */
    645         return;
    646     }
    647     if (len > s->async_len) {
    648         len = s->async_len;
    649     }
    650     if (to_device) {
    651         if (s->dma_memory_read) {
    652             s->dma_memory_read(s->dma_opaque, s->async_buf, len);
    653         } else {
    654             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
    655             esp_raise_drq(s);
    656             return;
    657         }
    658     } else {
    659         if (s->dma_memory_write) {
    660             s->dma_memory_write(s->dma_opaque, s->async_buf, len);
    661         } else {
    662             /* Adjust TC for any leftover data in the FIFO */
    663             if (!fifo8_is_empty(&s->fifo)) {
    664                 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo));
    665             }
    666 
    667             /* Copy device data to FIFO */
    668             len = MIN(len, fifo8_num_free(&s->fifo));
    669             fifo8_push_all(&s->fifo, s->async_buf, len);
    670             s->async_buf += len;
    671             s->async_len -= len;
    672             s->ti_size -= len;
    673 
    674             /*
    675              * MacOS toolbox uses a TI length of 16 bytes for all commands, so
    676              * commands shorter than this must be padded accordingly
    677              */
    678             if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) {
    679                 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) {
    680                     esp_fifo_push(&s->fifo, 0);
    681                     len++;
    682                 }
    683             }
    684 
    685             esp_set_tc(s, esp_get_tc(s) - len);
    686             esp_set_pdma_cb(s, DO_DMA_PDMA_CB);
    687             esp_raise_drq(s);
    688 
    689             /* Indicate transfer to FIFO is complete */
    690             s->rregs[ESP_RSTAT] |= STAT_TC;
    691             return;
    692         }
    693     }
    694     esp_set_tc(s, esp_get_tc(s) - len);
    695     s->async_buf += len;
    696     s->async_len -= len;
    697     if (to_device) {
    698         s->ti_size += len;
    699     } else {
    700         s->ti_size -= len;
    701     }
    702     if (s->async_len == 0) {
    703         scsi_req_continue(s->current_req);
    704         /*
    705          * If there is still data to be read from the device then
    706          * complete the DMA operation immediately.  Otherwise defer
    707          * until the scsi layer has completed.
    708          */
    709         if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
    710             return;
    711         }
    712     }
    713 
    714     /* Partially filled a scsi buffer. Complete immediately.  */
    715     esp_dma_done(s);
    716     esp_lower_drq(s);
    717 }
    718 
    719 static void esp_do_nodma(ESPState *s)
    720 {
    721     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
    722     uint32_t cmdlen;
    723     int len;
    724 
    725     if (s->do_cmd) {
    726         cmdlen = fifo8_num_used(&s->cmdfifo);
    727         trace_esp_handle_ti_cmd(cmdlen);
    728         s->ti_size = 0;
    729         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
    730             /* No command received */
    731             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
    732                 return;
    733             }
    734 
    735             /* Command has been received */
    736             s->do_cmd = 0;
    737             do_cmd(s);
    738         } else {
    739             /*
    740              * Extra message out bytes received: update cmdfifo_cdb_offset
    741              * and then switch to command phase
    742              */
    743             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
    744             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
    745             s->rregs[ESP_RSEQ] = SEQ_CD;
    746             s->rregs[ESP_RINTR] |= INTR_BS;
    747             esp_raise_irq(s);
    748         }
    749         return;
    750     }
    751 
    752     if (!s->current_req) {
    753         return;
    754     }
    755 
    756     if (s->async_len == 0) {
    757         /* Defer until data is available.  */
    758         return;
    759     }
    760 
    761     if (to_device) {
    762         len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
    763         esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
    764         s->async_buf += len;
    765         s->async_len -= len;
    766         s->ti_size += len;
    767     } else {
    768         if (fifo8_is_empty(&s->fifo)) {
    769             fifo8_push(&s->fifo, s->async_buf[0]);
    770             s->async_buf++;
    771             s->async_len--;
    772             s->ti_size--;
    773         }
    774     }
    775 
    776     if (s->async_len == 0) {
    777         scsi_req_continue(s->current_req);
    778         return;
    779     }
    780 
    781     s->rregs[ESP_RINTR] |= INTR_BS;
    782     esp_raise_irq(s);
    783 }
    784 
    785 static void esp_pdma_cb(ESPState *s)
    786 {
    787     switch (s->pdma_cb) {
    788     case SATN_PDMA_CB:
    789         satn_pdma_cb(s);
    790         break;
    791     case S_WITHOUT_SATN_PDMA_CB:
    792         s_without_satn_pdma_cb(s);
    793         break;
    794     case SATN_STOP_PDMA_CB:
    795         satn_stop_pdma_cb(s);
    796         break;
    797     case WRITE_RESPONSE_PDMA_CB:
    798         write_response_pdma_cb(s);
    799         break;
    800     case DO_DMA_PDMA_CB:
    801         do_dma_pdma_cb(s);
    802         break;
    803     default:
    804         g_assert_not_reached();
    805     }
    806 }
    807 
    808 void esp_command_complete(SCSIRequest *req, size_t resid)
    809 {
    810     ESPState *s = req->hba_private;
    811     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
    812 
    813     trace_esp_command_complete();
    814 
    815     /*
    816      * Non-DMA transfers from the target will leave the last byte in
    817      * the FIFO so don't reset ti_size in this case
    818      */
    819     if (s->dma || to_device) {
    820         if (s->ti_size != 0) {
    821             trace_esp_command_complete_unexpected();
    822         }
    823         s->ti_size = 0;
    824     }
    825 
    826     s->async_len = 0;
    827     if (req->status) {
    828         trace_esp_command_complete_fail();
    829     }
    830     s->status = req->status;
    831 
    832     /*
    833      * If the transfer is finished, switch to status phase. For non-DMA
    834      * transfers from the target the last byte is still in the FIFO
    835      */
    836     if (s->ti_size == 0) {
    837         s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
    838         esp_dma_done(s);
    839         esp_lower_drq(s);
    840     }
    841 
    842     if (s->current_req) {
    843         scsi_req_unref(s->current_req);
    844         s->current_req = NULL;
    845         s->current_dev = NULL;
    846     }
    847 }
    848 
    849 void esp_transfer_data(SCSIRequest *req, uint32_t len)
    850 {
    851     ESPState *s = req->hba_private;
    852     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
    853     uint32_t dmalen = esp_get_tc(s);
    854 
    855     assert(!s->do_cmd);
    856     trace_esp_transfer_data(dmalen, s->ti_size);
    857     s->async_len = len;
    858     s->async_buf = scsi_req_get_buf(req);
    859 
    860     if (!to_device && !s->data_in_ready) {
    861         /*
    862          * Initial incoming data xfer is complete so raise command
    863          * completion interrupt
    864          */
    865         s->data_in_ready = true;
    866         s->rregs[ESP_RSTAT] |= STAT_TC;
    867         s->rregs[ESP_RINTR] |= INTR_BS;
    868         esp_raise_irq(s);
    869     }
    870 
    871     if (s->ti_cmd == 0) {
    872         /*
    873          * Always perform the initial transfer upon reception of the next TI
    874          * command to ensure the DMA/non-DMA status of the command is correct.
    875          * It is not possible to use s->dma directly in the section below as
    876          * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
    877          * async data transfer is delayed then s->dma is set incorrectly.
    878          */
    879         return;
    880     }
    881 
    882     if (s->ti_cmd == (CMD_TI | CMD_DMA)) {
    883         if (dmalen) {
    884             esp_do_dma(s);
    885         } else if (s->ti_size <= 0) {
    886             /*
    887              * If this was the last part of a DMA transfer then the
    888              * completion interrupt is deferred to here.
    889              */
    890             esp_dma_done(s);
    891             esp_lower_drq(s);
    892         }
    893     } else if (s->ti_cmd == CMD_TI) {
    894         esp_do_nodma(s);
    895     }
    896 }
    897 
    898 static void handle_ti(ESPState *s)
    899 {
    900     uint32_t dmalen;
    901 
    902     if (s->dma && !s->dma_enabled) {
    903         s->dma_cb = handle_ti;
    904         return;
    905     }
    906 
    907     s->ti_cmd = s->rregs[ESP_CMD];
    908     if (s->dma) {
    909         dmalen = esp_get_tc(s);
    910         trace_esp_handle_ti(dmalen);
    911         s->rregs[ESP_RSTAT] &= ~STAT_TC;
    912         esp_do_dma(s);
    913     } else {
    914         trace_esp_handle_ti(s->ti_size);
    915         esp_do_nodma(s);
    916     }
    917 }
    918 
    919 void esp_hard_reset(ESPState *s)
    920 {
    921     memset(s->rregs, 0, ESP_REGS);
    922     memset(s->wregs, 0, ESP_REGS);
    923     s->tchi_written = 0;
    924     s->ti_size = 0;
    925     s->async_len = 0;
    926     fifo8_reset(&s->fifo);
    927     fifo8_reset(&s->cmdfifo);
    928     s->dma = 0;
    929     s->do_cmd = 0;
    930     s->dma_cb = NULL;
    931 
    932     s->rregs[ESP_CFG1] = 7;
    933 }
    934 
    935 static void esp_soft_reset(ESPState *s)
    936 {
    937     qemu_irq_lower(s->irq);
    938     qemu_irq_lower(s->irq_data);
    939     esp_hard_reset(s);
    940 }
    941 
    942 static void esp_bus_reset(ESPState *s)
    943 {
    944     bus_cold_reset(BUS(&s->bus));
    945 }
    946 
    947 static void parent_esp_reset(ESPState *s, int irq, int level)
    948 {
    949     if (level) {
    950         esp_soft_reset(s);
    951     }
    952 }
    953 
    954 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
    955 {
    956     uint32_t val;
    957 
    958     switch (saddr) {
    959     case ESP_FIFO:
    960         if (s->dma_memory_read && s->dma_memory_write &&
    961                 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
    962             /* Data out.  */
    963             qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
    964             s->rregs[ESP_FIFO] = 0;
    965         } else {
    966             if ((s->rregs[ESP_RSTAT] & 0x7) == STAT_DI) {
    967                 if (s->ti_size) {
    968                     esp_do_nodma(s);
    969                 } else {
    970                     /*
    971                      * The last byte of a non-DMA transfer has been read out
    972                      * of the FIFO so switch to status phase
    973                      */
    974                     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
    975                 }
    976             }
    977             s->rregs[ESP_FIFO] = esp_fifo_pop(&s->fifo);
    978         }
    979         val = s->rregs[ESP_FIFO];
    980         break;
    981     case ESP_RINTR:
    982         /*
    983          * Clear sequence step, interrupt register and all status bits
    984          * except TC
    985          */
    986         val = s->rregs[ESP_RINTR];
    987         s->rregs[ESP_RINTR] = 0;
    988         s->rregs[ESP_RSTAT] &= ~STAT_TC;
    989         /*
    990          * According to the datasheet ESP_RSEQ should be cleared, but as the
    991          * emulation currently defers information transfers to the next TI
    992          * command leave it for now so that pedantic guests such as the old
    993          * Linux 2.6 driver see the correct flags before the next SCSI phase
    994          * transition.
    995          *
    996          * s->rregs[ESP_RSEQ] = SEQ_0;
    997          */
    998         esp_lower_irq(s);
    999         break;
   1000     case ESP_TCHI:
   1001         /* Return the unique id if the value has never been written */
   1002         if (!s->tchi_written) {
   1003             val = s->chip_id;
   1004         } else {
   1005             val = s->rregs[saddr];
   1006         }
   1007         break;
   1008      case ESP_RFLAGS:
   1009         /* Bottom 5 bits indicate number of bytes in FIFO */
   1010         val = fifo8_num_used(&s->fifo);
   1011         break;
   1012     default:
   1013         val = s->rregs[saddr];
   1014         break;
   1015     }
   1016 
   1017     trace_esp_mem_readb(saddr, val);
   1018     return val;
   1019 }
   1020 
   1021 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
   1022 {
   1023     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
   1024     switch (saddr) {
   1025     case ESP_TCHI:
   1026         s->tchi_written = true;
   1027         /* fall through */
   1028     case ESP_TCLO:
   1029     case ESP_TCMID:
   1030         s->rregs[ESP_RSTAT] &= ~STAT_TC;
   1031         break;
   1032     case ESP_FIFO:
   1033         if (s->do_cmd) {
   1034             esp_fifo_push(&s->cmdfifo, val);
   1035 
   1036             /*
   1037              * If any unexpected message out/command phase data is
   1038              * transferred using non-DMA, raise the interrupt
   1039              */
   1040             if (s->rregs[ESP_CMD] == CMD_TI) {
   1041                 s->rregs[ESP_RINTR] |= INTR_BS;
   1042                 esp_raise_irq(s);
   1043             }
   1044         } else {
   1045             esp_fifo_push(&s->fifo, val);
   1046         }
   1047         break;
   1048     case ESP_CMD:
   1049         s->rregs[saddr] = val;
   1050         if (val & CMD_DMA) {
   1051             s->dma = 1;
   1052             /* Reload DMA counter.  */
   1053             if (esp_get_stc(s) == 0) {
   1054                 esp_set_tc(s, 0x10000);
   1055             } else {
   1056                 esp_set_tc(s, esp_get_stc(s));
   1057             }
   1058         } else {
   1059             s->dma = 0;
   1060         }
   1061         switch (val & CMD_CMD) {
   1062         case CMD_NOP:
   1063             trace_esp_mem_writeb_cmd_nop(val);
   1064             break;
   1065         case CMD_FLUSH:
   1066             trace_esp_mem_writeb_cmd_flush(val);
   1067             fifo8_reset(&s->fifo);
   1068             break;
   1069         case CMD_RESET:
   1070             trace_esp_mem_writeb_cmd_reset(val);
   1071             esp_soft_reset(s);
   1072             break;
   1073         case CMD_BUSRESET:
   1074             trace_esp_mem_writeb_cmd_bus_reset(val);
   1075             esp_bus_reset(s);
   1076             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
   1077                 s->rregs[ESP_RINTR] |= INTR_RST;
   1078                 esp_raise_irq(s);
   1079             }
   1080             break;
   1081         case CMD_TI:
   1082             trace_esp_mem_writeb_cmd_ti(val);
   1083             handle_ti(s);
   1084             break;
   1085         case CMD_ICCS:
   1086             trace_esp_mem_writeb_cmd_iccs(val);
   1087             write_response(s);
   1088             s->rregs[ESP_RINTR] |= INTR_FC;
   1089             s->rregs[ESP_RSTAT] |= STAT_MI;
   1090             break;
   1091         case CMD_MSGACC:
   1092             trace_esp_mem_writeb_cmd_msgacc(val);
   1093             s->rregs[ESP_RINTR] |= INTR_DC;
   1094             s->rregs[ESP_RSEQ] = 0;
   1095             s->rregs[ESP_RFLAGS] = 0;
   1096             esp_raise_irq(s);
   1097             break;
   1098         case CMD_PAD:
   1099             trace_esp_mem_writeb_cmd_pad(val);
   1100             s->rregs[ESP_RSTAT] = STAT_TC;
   1101             s->rregs[ESP_RINTR] |= INTR_FC;
   1102             s->rregs[ESP_RSEQ] = 0;
   1103             break;
   1104         case CMD_SATN:
   1105             trace_esp_mem_writeb_cmd_satn(val);
   1106             break;
   1107         case CMD_RSTATN:
   1108             trace_esp_mem_writeb_cmd_rstatn(val);
   1109             break;
   1110         case CMD_SEL:
   1111             trace_esp_mem_writeb_cmd_sel(val);
   1112             handle_s_without_atn(s);
   1113             break;
   1114         case CMD_SELATN:
   1115             trace_esp_mem_writeb_cmd_selatn(val);
   1116             handle_satn(s);
   1117             break;
   1118         case CMD_SELATNS:
   1119             trace_esp_mem_writeb_cmd_selatns(val);
   1120             handle_satn_stop(s);
   1121             break;
   1122         case CMD_ENSEL:
   1123             trace_esp_mem_writeb_cmd_ensel(val);
   1124             s->rregs[ESP_RINTR] = 0;
   1125             break;
   1126         case CMD_DISSEL:
   1127             trace_esp_mem_writeb_cmd_dissel(val);
   1128             s->rregs[ESP_RINTR] = 0;
   1129             esp_raise_irq(s);
   1130             break;
   1131         default:
   1132             trace_esp_error_unhandled_command(val);
   1133             break;
   1134         }
   1135         break;
   1136     case ESP_WBUSID ... ESP_WSYNO:
   1137         break;
   1138     case ESP_CFG1:
   1139     case ESP_CFG2: case ESP_CFG3:
   1140     case ESP_RES3: case ESP_RES4:
   1141         s->rregs[saddr] = val;
   1142         break;
   1143     case ESP_WCCF ... ESP_WTEST:
   1144         break;
   1145     default:
   1146         trace_esp_error_invalid_write(val, saddr);
   1147         return;
   1148     }
   1149     s->wregs[saddr] = val;
   1150 }
   1151 
   1152 static bool esp_mem_accepts(void *opaque, hwaddr addr,
   1153                             unsigned size, bool is_write,
   1154                             MemTxAttrs attrs)
   1155 {
   1156     return (size == 1) || (is_write && size == 4);
   1157 }
   1158 
   1159 static bool esp_is_before_version_5(void *opaque, int version_id)
   1160 {
   1161     ESPState *s = ESP(opaque);
   1162 
   1163     version_id = MIN(version_id, s->mig_version_id);
   1164     return version_id < 5;
   1165 }
   1166 
   1167 static bool esp_is_version_5(void *opaque, int version_id)
   1168 {
   1169     ESPState *s = ESP(opaque);
   1170 
   1171     version_id = MIN(version_id, s->mig_version_id);
   1172     return version_id >= 5;
   1173 }
   1174 
   1175 static bool esp_is_version_6(void *opaque, int version_id)
   1176 {
   1177     ESPState *s = ESP(opaque);
   1178 
   1179     version_id = MIN(version_id, s->mig_version_id);
   1180     return version_id >= 6;
   1181 }
   1182 
   1183 int esp_pre_save(void *opaque)
   1184 {
   1185     ESPState *s = ESP(object_resolve_path_component(
   1186                       OBJECT(opaque), "esp"));
   1187 
   1188     s->mig_version_id = vmstate_esp.version_id;
   1189     return 0;
   1190 }
   1191 
   1192 static int esp_post_load(void *opaque, int version_id)
   1193 {
   1194     ESPState *s = ESP(opaque);
   1195     int len, i;
   1196 
   1197     version_id = MIN(version_id, s->mig_version_id);
   1198 
   1199     if (version_id < 5) {
   1200         esp_set_tc(s, s->mig_dma_left);
   1201 
   1202         /* Migrate ti_buf to fifo */
   1203         len = s->mig_ti_wptr - s->mig_ti_rptr;
   1204         for (i = 0; i < len; i++) {
   1205             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
   1206         }
   1207 
   1208         /* Migrate cmdbuf to cmdfifo */
   1209         for (i = 0; i < s->mig_cmdlen; i++) {
   1210             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
   1211         }
   1212     }
   1213 
   1214     s->mig_version_id = vmstate_esp.version_id;
   1215     return 0;
   1216 }
   1217 
   1218 /*
   1219  * PDMA (or pseudo-DMA) is only used on the Macintosh and requires the
   1220  * guest CPU to perform the transfers between the SCSI bus and memory
   1221  * itself. This is indicated by the dma_memory_read and dma_memory_write
   1222  * functions being NULL (in contrast to the ESP PCI device) whilst
   1223  * dma_enabled is still set.
   1224  */
   1225 
   1226 static bool esp_pdma_needed(void *opaque)
   1227 {
   1228     ESPState *s = ESP(opaque);
   1229 
   1230     return s->dma_memory_read == NULL && s->dma_memory_write == NULL &&
   1231            s->dma_enabled;
   1232 }
   1233 
   1234 static const VMStateDescription vmstate_esp_pdma = {
   1235     .name = "esp/pdma",
   1236     .version_id = 0,
   1237     .minimum_version_id = 0,
   1238     .needed = esp_pdma_needed,
   1239     .fields = (VMStateField[]) {
   1240         VMSTATE_UINT8(pdma_cb, ESPState),
   1241         VMSTATE_END_OF_LIST()
   1242     }
   1243 };
   1244 
   1245 const VMStateDescription vmstate_esp = {
   1246     .name = "esp",
   1247     .version_id = 6,
   1248     .minimum_version_id = 3,
   1249     .post_load = esp_post_load,
   1250     .fields = (VMStateField[]) {
   1251         VMSTATE_BUFFER(rregs, ESPState),
   1252         VMSTATE_BUFFER(wregs, ESPState),
   1253         VMSTATE_INT32(ti_size, ESPState),
   1254         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
   1255         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
   1256         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
   1257         VMSTATE_UINT32(status, ESPState),
   1258         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
   1259                             esp_is_before_version_5),
   1260         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
   1261                           esp_is_before_version_5),
   1262         VMSTATE_UINT32(dma, ESPState),
   1263         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
   1264                               esp_is_before_version_5, 0, 16),
   1265         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
   1266                               esp_is_before_version_5, 16,
   1267                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
   1268         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
   1269         VMSTATE_UINT32(do_cmd, ESPState),
   1270         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
   1271         VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5),
   1272         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
   1273         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
   1274         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
   1275         VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5),
   1276         VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6),
   1277         VMSTATE_END_OF_LIST()
   1278     },
   1279     .subsections = (const VMStateDescription * []) {
   1280         &vmstate_esp_pdma,
   1281         NULL
   1282     }
   1283 };
   1284 
   1285 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
   1286                                  uint64_t val, unsigned int size)
   1287 {
   1288     SysBusESPState *sysbus = opaque;
   1289     ESPState *s = ESP(&sysbus->esp);
   1290     uint32_t saddr;
   1291 
   1292     saddr = addr >> sysbus->it_shift;
   1293     esp_reg_write(s, saddr, val);
   1294 }
   1295 
   1296 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
   1297                                     unsigned int size)
   1298 {
   1299     SysBusESPState *sysbus = opaque;
   1300     ESPState *s = ESP(&sysbus->esp);
   1301     uint32_t saddr;
   1302 
   1303     saddr = addr >> sysbus->it_shift;
   1304     return esp_reg_read(s, saddr);
   1305 }
   1306 
   1307 static const MemoryRegionOps sysbus_esp_mem_ops = {
   1308     .read = sysbus_esp_mem_read,
   1309     .write = sysbus_esp_mem_write,
   1310     .endianness = DEVICE_NATIVE_ENDIAN,
   1311     .valid.accepts = esp_mem_accepts,
   1312 };
   1313 
   1314 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
   1315                                   uint64_t val, unsigned int size)
   1316 {
   1317     SysBusESPState *sysbus = opaque;
   1318     ESPState *s = ESP(&sysbus->esp);
   1319 
   1320     trace_esp_pdma_write(size);
   1321 
   1322     switch (size) {
   1323     case 1:
   1324         esp_pdma_write(s, val);
   1325         break;
   1326     case 2:
   1327         esp_pdma_write(s, val >> 8);
   1328         esp_pdma_write(s, val);
   1329         break;
   1330     }
   1331     esp_pdma_cb(s);
   1332 }
   1333 
   1334 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
   1335                                      unsigned int size)
   1336 {
   1337     SysBusESPState *sysbus = opaque;
   1338     ESPState *s = ESP(&sysbus->esp);
   1339     uint64_t val = 0;
   1340 
   1341     trace_esp_pdma_read(size);
   1342 
   1343     switch (size) {
   1344     case 1:
   1345         val = esp_pdma_read(s);
   1346         break;
   1347     case 2:
   1348         val = esp_pdma_read(s);
   1349         val = (val << 8) | esp_pdma_read(s);
   1350         break;
   1351     }
   1352     if (fifo8_num_used(&s->fifo) < 2) {
   1353         esp_pdma_cb(s);
   1354     }
   1355     return val;
   1356 }
   1357 
   1358 static void *esp_load_request(QEMUFile *f, SCSIRequest *req)
   1359 {
   1360     ESPState *s = container_of(req->bus, ESPState, bus);
   1361 
   1362     scsi_req_ref(req);
   1363     s->current_req = req;
   1364     return s;
   1365 }
   1366 
   1367 static const MemoryRegionOps sysbus_esp_pdma_ops = {
   1368     .read = sysbus_esp_pdma_read,
   1369     .write = sysbus_esp_pdma_write,
   1370     .endianness = DEVICE_NATIVE_ENDIAN,
   1371     .valid.min_access_size = 1,
   1372     .valid.max_access_size = 4,
   1373     .impl.min_access_size = 1,
   1374     .impl.max_access_size = 2,
   1375 };
   1376 
   1377 static const struct SCSIBusInfo esp_scsi_info = {
   1378     .tcq = false,
   1379     .max_target = ESP_MAX_DEVS,
   1380     .max_lun = 7,
   1381 
   1382     .load_request = esp_load_request,
   1383     .transfer_data = esp_transfer_data,
   1384     .complete = esp_command_complete,
   1385     .cancel = esp_request_cancelled
   1386 };
   1387 
   1388 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
   1389 {
   1390     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
   1391     ESPState *s = ESP(&sysbus->esp);
   1392 
   1393     switch (irq) {
   1394     case 0:
   1395         parent_esp_reset(s, irq, level);
   1396         break;
   1397     case 1:
   1398         esp_dma_enable(opaque, irq, level);
   1399         break;
   1400     }
   1401 }
   1402 
   1403 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
   1404 {
   1405     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
   1406     SysBusESPState *sysbus = SYSBUS_ESP(dev);
   1407     ESPState *s = ESP(&sysbus->esp);
   1408 
   1409     if (!qdev_realize(DEVICE(s), NULL, errp)) {
   1410         return;
   1411     }
   1412 
   1413     sysbus_init_irq(sbd, &s->irq);
   1414     sysbus_init_irq(sbd, &s->irq_data);
   1415     assert(sysbus->it_shift != -1);
   1416 
   1417     s->chip_id = TCHI_FAS100A;
   1418     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
   1419                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
   1420     sysbus_init_mmio(sbd, &sysbus->iomem);
   1421     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
   1422                           sysbus, "esp-pdma", 4);
   1423     sysbus_init_mmio(sbd, &sysbus->pdma);
   1424 
   1425     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
   1426 
   1427     scsi_bus_init(&s->bus, sizeof(s->bus), dev, &esp_scsi_info);
   1428 }
   1429 
   1430 static void sysbus_esp_hard_reset(DeviceState *dev)
   1431 {
   1432     SysBusESPState *sysbus = SYSBUS_ESP(dev);
   1433     ESPState *s = ESP(&sysbus->esp);
   1434 
   1435     esp_hard_reset(s);
   1436 }
   1437 
   1438 static void sysbus_esp_init(Object *obj)
   1439 {
   1440     SysBusESPState *sysbus = SYSBUS_ESP(obj);
   1441 
   1442     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
   1443 }
   1444 
   1445 static const VMStateDescription vmstate_sysbus_esp_scsi = {
   1446     .name = "sysbusespscsi",
   1447     .version_id = 2,
   1448     .minimum_version_id = 1,
   1449     .pre_save = esp_pre_save,
   1450     .fields = (VMStateField[]) {
   1451         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
   1452         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
   1453         VMSTATE_END_OF_LIST()
   1454     }
   1455 };
   1456 
   1457 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
   1458 {
   1459     DeviceClass *dc = DEVICE_CLASS(klass);
   1460 
   1461     dc->realize = sysbus_esp_realize;
   1462     dc->reset = sysbus_esp_hard_reset;
   1463     dc->vmsd = &vmstate_sysbus_esp_scsi;
   1464     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
   1465 }
   1466 
   1467 static const TypeInfo sysbus_esp_info = {
   1468     .name          = TYPE_SYSBUS_ESP,
   1469     .parent        = TYPE_SYS_BUS_DEVICE,
   1470     .instance_init = sysbus_esp_init,
   1471     .instance_size = sizeof(SysBusESPState),
   1472     .class_init    = sysbus_esp_class_init,
   1473 };
   1474 
   1475 static void esp_finalize(Object *obj)
   1476 {
   1477     ESPState *s = ESP(obj);
   1478 
   1479     fifo8_destroy(&s->fifo);
   1480     fifo8_destroy(&s->cmdfifo);
   1481 }
   1482 
   1483 static void esp_init(Object *obj)
   1484 {
   1485     ESPState *s = ESP(obj);
   1486 
   1487     fifo8_create(&s->fifo, ESP_FIFO_SZ);
   1488     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
   1489 }
   1490 
   1491 static void esp_class_init(ObjectClass *klass, void *data)
   1492 {
   1493     DeviceClass *dc = DEVICE_CLASS(klass);
   1494 
   1495     /* internal device for sysbusesp/pciespscsi, not user-creatable */
   1496     dc->user_creatable = false;
   1497     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
   1498 }
   1499 
   1500 static const TypeInfo esp_info = {
   1501     .name = TYPE_ESP,
   1502     .parent = TYPE_DEVICE,
   1503     .instance_init = esp_init,
   1504     .instance_finalize = esp_finalize,
   1505     .instance_size = sizeof(ESPState),
   1506     .class_init = esp_class_init,
   1507 };
   1508 
   1509 static void esp_register_types(void)
   1510 {
   1511     type_register_static(&sysbus_esp_info);
   1512     type_register_static(&esp_info);
   1513 }
   1514 
   1515 type_init(esp_register_types)