xref: /openbmc/qemu/hw/scsi/esp.c (revision 2e1cacfb)
1 /*
2  * QEMU ESP/NCR53C9x emulation
3  *
4  * Copyright (c) 2005-2006 Fabrice Bellard
5  * Copyright (c) 2012 Herve Poussineau
6  * Copyright (c) 2023 Mark Cave-Ayland
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  */
26 
27 #include "qemu/osdep.h"
28 #include "hw/sysbus.h"
29 #include "migration/vmstate.h"
30 #include "hw/irq.h"
31 #include "hw/scsi/esp.h"
32 #include "trace.h"
33 #include "qemu/log.h"
34 #include "qemu/module.h"
35 
36 /*
37  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
38  * also produced as NCR89C100. See
39  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
40  * and
41  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
42  *
43  * On Macintosh Quadra it is a NCR53C96.
44  */
45 
46 static void esp_raise_irq(ESPState *s)
47 {
48     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
49         s->rregs[ESP_RSTAT] |= STAT_INT;
50         qemu_irq_raise(s->irq);
51         trace_esp_raise_irq();
52     }
53 }
54 
55 static void esp_lower_irq(ESPState *s)
56 {
57     if (s->rregs[ESP_RSTAT] & STAT_INT) {
58         s->rregs[ESP_RSTAT] &= ~STAT_INT;
59         qemu_irq_lower(s->irq);
60         trace_esp_lower_irq();
61     }
62 }
63 
64 static void esp_raise_drq(ESPState *s)
65 {
66     if (!(s->drq_state)) {
67         qemu_irq_raise(s->drq_irq);
68         trace_esp_raise_drq();
69         s->drq_state = true;
70     }
71 }
72 
73 static void esp_lower_drq(ESPState *s)
74 {
75     if (s->drq_state) {
76         qemu_irq_lower(s->drq_irq);
77         trace_esp_lower_drq();
78         s->drq_state = false;
79     }
80 }
81 
82 static const char *esp_phase_names[8] = {
83     "DATA OUT", "DATA IN", "COMMAND", "STATUS",
84     "(reserved)", "(reserved)", "MESSAGE OUT", "MESSAGE IN"
85 };
86 
87 static void esp_set_phase(ESPState *s, uint8_t phase)
88 {
89     s->rregs[ESP_RSTAT] &= ~7;
90     s->rregs[ESP_RSTAT] |= phase;
91 
92     trace_esp_set_phase(esp_phase_names[phase]);
93 }
94 
95 static uint8_t esp_get_phase(ESPState *s)
96 {
97     return s->rregs[ESP_RSTAT] & 7;
98 }
99 
100 void esp_dma_enable(ESPState *s, int irq, int level)
101 {
102     if (level) {
103         s->dma_enabled = 1;
104         trace_esp_dma_enable();
105         if (s->dma_cb) {
106             s->dma_cb(s);
107             s->dma_cb = NULL;
108         }
109     } else {
110         trace_esp_dma_disable();
111         s->dma_enabled = 0;
112     }
113 }
114 
115 void esp_request_cancelled(SCSIRequest *req)
116 {
117     ESPState *s = req->hba_private;
118 
119     if (req == s->current_req) {
120         scsi_req_unref(s->current_req);
121         s->current_req = NULL;
122         s->current_dev = NULL;
123         s->async_len = 0;
124     }
125 }
126 
127 static void esp_update_drq(ESPState *s)
128 {
129     bool to_device;
130 
131     switch (esp_get_phase(s)) {
132     case STAT_MO:
133     case STAT_CD:
134     case STAT_DO:
135         to_device = true;
136         break;
137 
138     case STAT_DI:
139     case STAT_ST:
140     case STAT_MI:
141         to_device = false;
142         break;
143 
144     default:
145         return;
146     }
147 
148     if (s->dma) {
149         /* DMA request so update DRQ according to transfer direction */
150         if (to_device) {
151             if (fifo8_num_free(&s->fifo) < 2) {
152                 esp_lower_drq(s);
153             } else {
154                 esp_raise_drq(s);
155             }
156         } else {
157             if (fifo8_num_used(&s->fifo) < 2) {
158                 esp_lower_drq(s);
159             } else {
160                 esp_raise_drq(s);
161             }
162         }
163     } else {
164         /* Not a DMA request */
165         esp_lower_drq(s);
166     }
167 }
168 
169 static void esp_fifo_push(ESPState *s, uint8_t val)
170 {
171     if (fifo8_num_used(&s->fifo) == s->fifo.capacity) {
172         trace_esp_error_fifo_overrun();
173     } else {
174         fifo8_push(&s->fifo, val);
175     }
176 
177     esp_update_drq(s);
178 }
179 
180 static void esp_fifo_push_buf(ESPState *s, uint8_t *buf, int len)
181 {
182     fifo8_push_all(&s->fifo, buf, len);
183     esp_update_drq(s);
184 }
185 
186 static uint8_t esp_fifo_pop(ESPState *s)
187 {
188     uint8_t val;
189 
190     if (fifo8_is_empty(&s->fifo)) {
191         val = 0;
192     } else {
193         val = fifo8_pop(&s->fifo);
194     }
195 
196     esp_update_drq(s);
197     return val;
198 }
199 
200 static uint32_t esp_fifo_pop_buf(ESPState *s, uint8_t *dest, int maxlen)
201 {
202     uint32_t len = fifo8_pop_buf(&s->fifo, dest, maxlen);
203 
204     esp_update_drq(s);
205     return len;
206 }
207 
208 static uint32_t esp_get_tc(ESPState *s)
209 {
210     uint32_t dmalen;
211 
212     dmalen = s->rregs[ESP_TCLO];
213     dmalen |= s->rregs[ESP_TCMID] << 8;
214     dmalen |= s->rregs[ESP_TCHI] << 16;
215 
216     return dmalen;
217 }
218 
219 static void esp_set_tc(ESPState *s, uint32_t dmalen)
220 {
221     uint32_t old_tc = esp_get_tc(s);
222 
223     s->rregs[ESP_TCLO] = dmalen;
224     s->rregs[ESP_TCMID] = dmalen >> 8;
225     s->rregs[ESP_TCHI] = dmalen >> 16;
226 
227     if (old_tc && dmalen == 0) {
228         s->rregs[ESP_RSTAT] |= STAT_TC;
229     }
230 }
231 
232 static uint32_t esp_get_stc(ESPState *s)
233 {
234     uint32_t dmalen;
235 
236     dmalen = s->wregs[ESP_TCLO];
237     dmalen |= s->wregs[ESP_TCMID] << 8;
238     dmalen |= s->wregs[ESP_TCHI] << 16;
239 
240     return dmalen;
241 }
242 
243 static uint8_t esp_pdma_read(ESPState *s)
244 {
245     uint8_t val;
246 
247     val = esp_fifo_pop(s);
248     return val;
249 }
250 
251 static void esp_pdma_write(ESPState *s, uint8_t val)
252 {
253     uint32_t dmalen = esp_get_tc(s);
254 
255     esp_fifo_push(s, val);
256 
257     if (dmalen && s->drq_state) {
258         dmalen--;
259         esp_set_tc(s, dmalen);
260     }
261 }
262 
263 static int esp_select(ESPState *s)
264 {
265     int target;
266 
267     target = s->wregs[ESP_WBUSID] & BUSID_DID;
268 
269     s->ti_size = 0;
270     s->rregs[ESP_RSEQ] = SEQ_0;
271 
272     if (s->current_req) {
273         /* Started a new command before the old one finished. Cancel it. */
274         scsi_req_cancel(s->current_req);
275     }
276 
277     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
278     if (!s->current_dev) {
279         /* No such drive */
280         s->rregs[ESP_RSTAT] = 0;
281         s->rregs[ESP_RINTR] = INTR_DC;
282         esp_raise_irq(s);
283         return -1;
284     }
285 
286     /*
287      * Note that we deliberately don't raise the IRQ here: this will be done
288      * either in esp_transfer_data() or esp_command_complete()
289      */
290     return 0;
291 }
292 
293 static void esp_do_dma(ESPState *s);
294 static void esp_do_nodma(ESPState *s);
295 
296 static void do_command_phase(ESPState *s)
297 {
298     uint32_t cmdlen;
299     int32_t datalen;
300     SCSIDevice *current_lun;
301     uint8_t buf[ESP_CMDFIFO_SZ];
302 
303     trace_esp_do_command_phase(s->lun);
304     cmdlen = fifo8_num_used(&s->cmdfifo);
305     if (!cmdlen || !s->current_dev) {
306         return;
307     }
308     fifo8_pop_buf(&s->cmdfifo, buf, cmdlen);
309 
310     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
311     if (!current_lun) {
312         /* No such drive */
313         s->rregs[ESP_RSTAT] = 0;
314         s->rregs[ESP_RINTR] = INTR_DC;
315         s->rregs[ESP_RSEQ] = SEQ_0;
316         esp_raise_irq(s);
317         return;
318     }
319 
320     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
321     datalen = scsi_req_enqueue(s->current_req);
322     s->ti_size = datalen;
323     fifo8_reset(&s->cmdfifo);
324     s->data_ready = false;
325     if (datalen != 0) {
326         /*
327          * Switch to DATA phase but wait until initial data xfer is
328          * complete before raising the command completion interrupt
329          */
330         if (datalen > 0) {
331             esp_set_phase(s, STAT_DI);
332         } else {
333             esp_set_phase(s, STAT_DO);
334         }
335         scsi_req_continue(s->current_req);
336         return;
337     }
338 }
339 
340 static void do_message_phase(ESPState *s)
341 {
342     if (s->cmdfifo_cdb_offset) {
343         uint8_t message = fifo8_is_empty(&s->cmdfifo) ? 0 :
344                           fifo8_pop(&s->cmdfifo);
345 
346         trace_esp_do_identify(message);
347         s->lun = message & 7;
348         s->cmdfifo_cdb_offset--;
349     }
350 
351     /* Ignore extended messages for now */
352     if (s->cmdfifo_cdb_offset) {
353         int len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
354         fifo8_drop(&s->cmdfifo, len);
355         s->cmdfifo_cdb_offset = 0;
356     }
357 }
358 
359 static void do_cmd(ESPState *s)
360 {
361     do_message_phase(s);
362     assert(s->cmdfifo_cdb_offset == 0);
363     do_command_phase(s);
364 }
365 
366 static void handle_satn(ESPState *s)
367 {
368     if (s->dma && !s->dma_enabled) {
369         s->dma_cb = handle_satn;
370         return;
371     }
372 
373     if (esp_select(s) < 0) {
374         return;
375     }
376 
377     esp_set_phase(s, STAT_MO);
378 
379     if (s->dma) {
380         esp_do_dma(s);
381     } else {
382         esp_do_nodma(s);
383     }
384 }
385 
386 static void handle_s_without_atn(ESPState *s)
387 {
388     if (s->dma && !s->dma_enabled) {
389         s->dma_cb = handle_s_without_atn;
390         return;
391     }
392 
393     if (esp_select(s) < 0) {
394         return;
395     }
396 
397     esp_set_phase(s, STAT_CD);
398     s->cmdfifo_cdb_offset = 0;
399 
400     if (s->dma) {
401         esp_do_dma(s);
402     } else {
403         esp_do_nodma(s);
404     }
405 }
406 
407 static void handle_satn_stop(ESPState *s)
408 {
409     if (s->dma && !s->dma_enabled) {
410         s->dma_cb = handle_satn_stop;
411         return;
412     }
413 
414     if (esp_select(s) < 0) {
415         return;
416     }
417 
418     esp_set_phase(s, STAT_MO);
419     s->cmdfifo_cdb_offset = 0;
420 
421     if (s->dma) {
422         esp_do_dma(s);
423     } else {
424         esp_do_nodma(s);
425     }
426 }
427 
428 static void handle_pad(ESPState *s)
429 {
430     if (s->dma) {
431         esp_do_dma(s);
432     } else {
433         esp_do_nodma(s);
434     }
435 }
436 
437 static void write_response(ESPState *s)
438 {
439     trace_esp_write_response(s->status);
440 
441     if (s->dma) {
442         esp_do_dma(s);
443     } else {
444         esp_do_nodma(s);
445     }
446 }
447 
448 static bool esp_cdb_ready(ESPState *s)
449 {
450     int len = fifo8_num_used(&s->cmdfifo) - s->cmdfifo_cdb_offset;
451     const uint8_t *pbuf;
452     uint32_t n;
453     int cdblen;
454 
455     if (len <= 0) {
456         return false;
457     }
458 
459     pbuf = fifo8_peek_bufptr(&s->cmdfifo, len, &n);
460     if (n < len) {
461         /*
462          * In normal use the cmdfifo should never wrap, but include this check
463          * to prevent a malicious guest from reading past the end of the
464          * cmdfifo data buffer below
465          */
466         return false;
467     }
468 
469     cdblen = scsi_cdb_length((uint8_t *)&pbuf[s->cmdfifo_cdb_offset]);
470 
471     return cdblen < 0 ? false : (len >= cdblen);
472 }
473 
474 static void esp_dma_ti_check(ESPState *s)
475 {
476     if (esp_get_tc(s) == 0 && fifo8_num_used(&s->fifo) < 2) {
477         s->rregs[ESP_RINTR] |= INTR_BS;
478         esp_raise_irq(s);
479     }
480 }
481 
482 static void esp_do_dma(ESPState *s)
483 {
484     uint32_t len, cmdlen;
485     uint8_t buf[ESP_CMDFIFO_SZ];
486 
487     len = esp_get_tc(s);
488 
489     switch (esp_get_phase(s)) {
490     case STAT_MO:
491         if (s->dma_memory_read) {
492             len = MIN(len, fifo8_num_free(&s->cmdfifo));
493             s->dma_memory_read(s->dma_opaque, buf, len);
494             esp_set_tc(s, esp_get_tc(s) - len);
495         } else {
496             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
497             len = MIN(fifo8_num_free(&s->cmdfifo), len);
498         }
499 
500         fifo8_push_all(&s->cmdfifo, buf, len);
501         s->cmdfifo_cdb_offset += len;
502 
503         switch (s->rregs[ESP_CMD]) {
504         case CMD_SELATN | CMD_DMA:
505             if (fifo8_num_used(&s->cmdfifo) >= 1) {
506                 /* First byte received, switch to command phase */
507                 esp_set_phase(s, STAT_CD);
508                 s->rregs[ESP_RSEQ] = SEQ_CD;
509                 s->cmdfifo_cdb_offset = 1;
510 
511                 if (fifo8_num_used(&s->cmdfifo) > 1) {
512                     /* Process any additional command phase data */
513                     esp_do_dma(s);
514                 }
515             }
516             break;
517 
518         case CMD_SELATNS | CMD_DMA:
519             if (fifo8_num_used(&s->cmdfifo) == 1) {
520                 /* First byte received, stop in message out phase */
521                 s->rregs[ESP_RSEQ] = SEQ_MO;
522                 s->cmdfifo_cdb_offset = 1;
523 
524                 /* Raise command completion interrupt */
525                 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
526                 esp_raise_irq(s);
527             }
528             break;
529 
530         case CMD_TI | CMD_DMA:
531             /* ATN remains asserted until TC == 0 */
532             if (esp_get_tc(s) == 0) {
533                 esp_set_phase(s, STAT_CD);
534                 s->rregs[ESP_CMD] = 0;
535                 s->rregs[ESP_RINTR] |= INTR_BS;
536                 esp_raise_irq(s);
537             }
538             break;
539         }
540         break;
541 
542     case STAT_CD:
543         cmdlen = fifo8_num_used(&s->cmdfifo);
544         trace_esp_do_dma(cmdlen, len);
545         if (s->dma_memory_read) {
546             len = MIN(len, fifo8_num_free(&s->cmdfifo));
547             s->dma_memory_read(s->dma_opaque, buf, len);
548             fifo8_push_all(&s->cmdfifo, buf, len);
549             esp_set_tc(s, esp_get_tc(s) - len);
550         } else {
551             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
552             len = MIN(fifo8_num_free(&s->cmdfifo), len);
553             fifo8_push_all(&s->cmdfifo, buf, len);
554         }
555         trace_esp_handle_ti_cmd(cmdlen);
556         s->ti_size = 0;
557         if (esp_get_tc(s) == 0) {
558             /* Command has been received */
559             do_cmd(s);
560         }
561         break;
562 
563     case STAT_DO:
564         if (!s->current_req) {
565             return;
566         }
567         if (s->async_len == 0 && esp_get_tc(s)) {
568             /* Defer until data is available.  */
569             return;
570         }
571         if (len > s->async_len) {
572             len = s->async_len;
573         }
574 
575         switch (s->rregs[ESP_CMD]) {
576         case CMD_TI | CMD_DMA:
577             if (s->dma_memory_read) {
578                 s->dma_memory_read(s->dma_opaque, s->async_buf, len);
579                 esp_set_tc(s, esp_get_tc(s) - len);
580             } else {
581                 /* Copy FIFO data to device */
582                 len = MIN(s->async_len, ESP_FIFO_SZ);
583                 len = MIN(len, fifo8_num_used(&s->fifo));
584                 len = esp_fifo_pop_buf(s, s->async_buf, len);
585             }
586 
587             s->async_buf += len;
588             s->async_len -= len;
589             s->ti_size += len;
590             break;
591 
592         case CMD_PAD | CMD_DMA:
593             /* Copy TC zero bytes into the incoming stream */
594             if (!s->dma_memory_read) {
595                 len = MIN(s->async_len, ESP_FIFO_SZ);
596                 len = MIN(len, fifo8_num_free(&s->fifo));
597             }
598 
599             memset(s->async_buf, 0, len);
600 
601             s->async_buf += len;
602             s->async_len -= len;
603             s->ti_size += len;
604             break;
605         }
606 
607         if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) {
608             /* Defer until the scsi layer has completed */
609             scsi_req_continue(s->current_req);
610             return;
611         }
612 
613         esp_dma_ti_check(s);
614         break;
615 
616     case STAT_DI:
617         if (!s->current_req) {
618             return;
619         }
620         if (s->async_len == 0 && esp_get_tc(s)) {
621             /* Defer until data is available.  */
622             return;
623         }
624         if (len > s->async_len) {
625             len = s->async_len;
626         }
627 
628         switch (s->rregs[ESP_CMD]) {
629         case CMD_TI | CMD_DMA:
630             if (s->dma_memory_write) {
631                 s->dma_memory_write(s->dma_opaque, s->async_buf, len);
632             } else {
633                 /* Copy device data to FIFO */
634                 len = MIN(len, fifo8_num_free(&s->fifo));
635                 esp_fifo_push_buf(s, s->async_buf, len);
636             }
637 
638             s->async_buf += len;
639             s->async_len -= len;
640             s->ti_size -= len;
641             esp_set_tc(s, esp_get_tc(s) - len);
642             break;
643 
644         case CMD_PAD | CMD_DMA:
645             /* Drop TC bytes from the incoming stream */
646             if (!s->dma_memory_write) {
647                 len = MIN(len, fifo8_num_free(&s->fifo));
648             }
649 
650             s->async_buf += len;
651             s->async_len -= len;
652             s->ti_size -= len;
653             esp_set_tc(s, esp_get_tc(s) - len);
654             break;
655         }
656 
657         if (s->async_len == 0 && s->ti_size == 0 && esp_get_tc(s)) {
658             /* If the guest underflows TC then terminate SCSI request */
659             scsi_req_continue(s->current_req);
660             return;
661         }
662 
663         if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) {
664             /* Defer until the scsi layer has completed */
665             scsi_req_continue(s->current_req);
666             return;
667         }
668 
669         esp_dma_ti_check(s);
670         break;
671 
672     case STAT_ST:
673         switch (s->rregs[ESP_CMD]) {
674         case CMD_ICCS | CMD_DMA:
675             len = MIN(len, 1);
676 
677             if (len) {
678                 buf[0] = s->status;
679 
680                 if (s->dma_memory_write) {
681                     s->dma_memory_write(s->dma_opaque, buf, len);
682                 } else {
683                     esp_fifo_push_buf(s, buf, len);
684                 }
685 
686                 esp_set_tc(s, esp_get_tc(s) - len);
687                 esp_set_phase(s, STAT_MI);
688 
689                 if (esp_get_tc(s) > 0) {
690                     /* Process any message in phase data */
691                     esp_do_dma(s);
692                 }
693             }
694             break;
695 
696         default:
697             /* Consume remaining data if the guest underflows TC */
698             if (fifo8_num_used(&s->fifo) < 2) {
699                 s->rregs[ESP_RINTR] |= INTR_BS;
700                 esp_raise_irq(s);
701             }
702             break;
703         }
704         break;
705 
706     case STAT_MI:
707         switch (s->rregs[ESP_CMD]) {
708         case CMD_ICCS | CMD_DMA:
709             len = MIN(len, 1);
710 
711             if (len) {
712                 buf[0] = 0;
713 
714                 if (s->dma_memory_write) {
715                     s->dma_memory_write(s->dma_opaque, buf, len);
716                 } else {
717                     esp_fifo_push_buf(s, buf, len);
718                 }
719 
720                 esp_set_tc(s, esp_get_tc(s) - len);
721 
722                 /* Raise end of command interrupt */
723                 s->rregs[ESP_RINTR] |= INTR_FC;
724                 esp_raise_irq(s);
725             }
726             break;
727         }
728         break;
729     }
730 }
731 
732 static void esp_nodma_ti_dataout(ESPState *s)
733 {
734     int len;
735 
736     if (!s->current_req) {
737         return;
738     }
739     if (s->async_len == 0) {
740         /* Defer until data is available.  */
741         return;
742     }
743     len = MIN(s->async_len, ESP_FIFO_SZ);
744     len = MIN(len, fifo8_num_used(&s->fifo));
745     esp_fifo_pop_buf(s, s->async_buf, len);
746     s->async_buf += len;
747     s->async_len -= len;
748     s->ti_size += len;
749 
750     if (s->async_len == 0) {
751         scsi_req_continue(s->current_req);
752         return;
753     }
754 
755     s->rregs[ESP_RINTR] |= INTR_BS;
756     esp_raise_irq(s);
757 }
758 
759 static void esp_do_nodma(ESPState *s)
760 {
761     uint8_t buf[ESP_FIFO_SZ];
762     uint32_t cmdlen;
763     int len;
764 
765     switch (esp_get_phase(s)) {
766     case STAT_MO:
767         switch (s->rregs[ESP_CMD]) {
768         case CMD_SELATN:
769             /* Copy FIFO into cmdfifo */
770             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
771             len = MIN(fifo8_num_free(&s->cmdfifo), len);
772             fifo8_push_all(&s->cmdfifo, buf, len);
773 
774             if (fifo8_num_used(&s->cmdfifo) >= 1) {
775                 /* First byte received, switch to command phase */
776                 esp_set_phase(s, STAT_CD);
777                 s->rregs[ESP_RSEQ] = SEQ_CD;
778                 s->cmdfifo_cdb_offset = 1;
779 
780                 if (fifo8_num_used(&s->cmdfifo) > 1) {
781                     /* Process any additional command phase data */
782                     esp_do_nodma(s);
783                 }
784             }
785             break;
786 
787         case CMD_SELATNS:
788             /* Copy one byte from FIFO into cmdfifo */
789             len = esp_fifo_pop_buf(s, buf,
790                                    MIN(fifo8_num_used(&s->fifo), 1));
791             len = MIN(fifo8_num_free(&s->cmdfifo), len);
792             fifo8_push_all(&s->cmdfifo, buf, len);
793 
794             if (fifo8_num_used(&s->cmdfifo) >= 1) {
795                 /* First byte received, stop in message out phase */
796                 s->rregs[ESP_RSEQ] = SEQ_MO;
797                 s->cmdfifo_cdb_offset = 1;
798 
799                 /* Raise command completion interrupt */
800                 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
801                 esp_raise_irq(s);
802             }
803             break;
804 
805         case CMD_TI:
806             /* Copy FIFO into cmdfifo */
807             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
808             len = MIN(fifo8_num_free(&s->cmdfifo), len);
809             fifo8_push_all(&s->cmdfifo, buf, len);
810 
811             /* ATN remains asserted until FIFO empty */
812             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
813             esp_set_phase(s, STAT_CD);
814             s->rregs[ESP_CMD] = 0;
815             s->rregs[ESP_RINTR] |= INTR_BS;
816             esp_raise_irq(s);
817             break;
818         }
819         break;
820 
821     case STAT_CD:
822         switch (s->rregs[ESP_CMD]) {
823         case CMD_TI:
824             /* Copy FIFO into cmdfifo */
825             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
826             len = MIN(fifo8_num_free(&s->cmdfifo), len);
827             fifo8_push_all(&s->cmdfifo, buf, len);
828 
829             cmdlen = fifo8_num_used(&s->cmdfifo);
830             trace_esp_handle_ti_cmd(cmdlen);
831 
832             /* CDB may be transferred in one or more TI commands */
833             if (esp_cdb_ready(s)) {
834                 /* Command has been received */
835                 do_cmd(s);
836             } else {
837                 /*
838                  * If data was transferred from the FIFO then raise bus
839                  * service interrupt to indicate transfer complete. Otherwise
840                  * defer until the next FIFO write.
841                  */
842                 if (len) {
843                     /* Raise interrupt to indicate transfer complete */
844                     s->rregs[ESP_RINTR] |= INTR_BS;
845                     esp_raise_irq(s);
846                 }
847             }
848             break;
849 
850         case CMD_SEL | CMD_DMA:
851         case CMD_SELATN | CMD_DMA:
852             /* Copy FIFO into cmdfifo */
853             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
854             len = MIN(fifo8_num_free(&s->cmdfifo), len);
855             fifo8_push_all(&s->cmdfifo, buf, len);
856 
857             /* Handle when DMA transfer is terminated by non-DMA FIFO write */
858             if (esp_cdb_ready(s)) {
859                 /* Command has been received */
860                 do_cmd(s);
861             }
862             break;
863 
864         case CMD_SEL:
865         case CMD_SELATN:
866             /* FIFO already contain entire CDB: copy to cmdfifo and execute */
867             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
868             len = MIN(fifo8_num_free(&s->cmdfifo), len);
869             fifo8_push_all(&s->cmdfifo, buf, len);
870 
871             do_cmd(s);
872             break;
873         }
874         break;
875 
876     case STAT_DO:
877         /* Accumulate data in FIFO until non-DMA TI is executed */
878         break;
879 
880     case STAT_DI:
881         if (!s->current_req) {
882             return;
883         }
884         if (s->async_len == 0) {
885             /* Defer until data is available.  */
886             return;
887         }
888         if (fifo8_is_empty(&s->fifo)) {
889             esp_fifo_push(s, s->async_buf[0]);
890             s->async_buf++;
891             s->async_len--;
892             s->ti_size--;
893         }
894 
895         if (s->async_len == 0) {
896             scsi_req_continue(s->current_req);
897             return;
898         }
899 
900         /* If preloading the FIFO, defer until TI command issued */
901         if (s->rregs[ESP_CMD] != CMD_TI) {
902             return;
903         }
904 
905         s->rregs[ESP_RINTR] |= INTR_BS;
906         esp_raise_irq(s);
907         break;
908 
909     case STAT_ST:
910         switch (s->rregs[ESP_CMD]) {
911         case CMD_ICCS:
912             esp_fifo_push(s, s->status);
913             esp_set_phase(s, STAT_MI);
914 
915             /* Process any message in phase data */
916             esp_do_nodma(s);
917             break;
918         }
919         break;
920 
921     case STAT_MI:
922         switch (s->rregs[ESP_CMD]) {
923         case CMD_ICCS:
924             esp_fifo_push(s, 0);
925 
926             /* Raise end of command interrupt */
927             s->rregs[ESP_RINTR] |= INTR_FC;
928             esp_raise_irq(s);
929             break;
930         }
931         break;
932     }
933 }
934 
935 void esp_command_complete(SCSIRequest *req, size_t resid)
936 {
937     ESPState *s = req->hba_private;
938     int to_device = (esp_get_phase(s) == STAT_DO);
939 
940     trace_esp_command_complete();
941 
942     /*
943      * Non-DMA transfers from the target will leave the last byte in
944      * the FIFO so don't reset ti_size in this case
945      */
946     if (s->dma || to_device) {
947         if (s->ti_size != 0) {
948             trace_esp_command_complete_unexpected();
949         }
950     }
951 
952     s->async_len = 0;
953     if (req->status) {
954         trace_esp_command_complete_fail();
955     }
956     s->status = req->status;
957 
958     /*
959      * Switch to status phase. For non-DMA transfers from the target the last
960      * byte is still in the FIFO
961      */
962     s->ti_size = 0;
963 
964     switch (s->rregs[ESP_CMD]) {
965     case CMD_SEL | CMD_DMA:
966     case CMD_SEL:
967     case CMD_SELATN | CMD_DMA:
968     case CMD_SELATN:
969         /*
970          * No data phase for sequencer command so raise deferred bus service
971          * and function complete interrupt
972          */
973         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
974         s->rregs[ESP_RSEQ] = SEQ_CD;
975         break;
976 
977     case CMD_TI | CMD_DMA:
978     case CMD_TI:
979         s->rregs[ESP_CMD] = 0;
980         break;
981     }
982 
983     /* Raise bus service interrupt to indicate change to STATUS phase */
984     esp_set_phase(s, STAT_ST);
985     s->rregs[ESP_RINTR] |= INTR_BS;
986     esp_raise_irq(s);
987 
988     if (s->current_req) {
989         scsi_req_unref(s->current_req);
990         s->current_req = NULL;
991         s->current_dev = NULL;
992     }
993 }
994 
995 void esp_transfer_data(SCSIRequest *req, uint32_t len)
996 {
997     ESPState *s = req->hba_private;
998     uint32_t dmalen = esp_get_tc(s);
999 
1000     trace_esp_transfer_data(dmalen, s->ti_size);
1001     s->async_len = len;
1002     s->async_buf = scsi_req_get_buf(req);
1003 
1004     if (!s->data_ready) {
1005         s->data_ready = true;
1006 
1007         switch (s->rregs[ESP_CMD]) {
1008         case CMD_SEL | CMD_DMA:
1009         case CMD_SEL:
1010         case CMD_SELATN | CMD_DMA:
1011         case CMD_SELATN:
1012             /*
1013              * Initial incoming data xfer is complete for sequencer command
1014              * so raise deferred bus service and function complete interrupt
1015              */
1016              s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
1017              s->rregs[ESP_RSEQ] = SEQ_CD;
1018              break;
1019 
1020         case CMD_SELATNS | CMD_DMA:
1021         case CMD_SELATNS:
1022             /*
1023              * Initial incoming data xfer is complete so raise command
1024              * completion interrupt
1025              */
1026              s->rregs[ESP_RINTR] |= INTR_BS;
1027              s->rregs[ESP_RSEQ] = SEQ_MO;
1028              break;
1029 
1030         case CMD_TI | CMD_DMA:
1031         case CMD_TI:
1032             /*
1033              * Bus service interrupt raised because of initial change to
1034              * DATA phase
1035              */
1036             s->rregs[ESP_CMD] = 0;
1037             s->rregs[ESP_RINTR] |= INTR_BS;
1038             break;
1039         }
1040 
1041         esp_raise_irq(s);
1042     }
1043 
1044     /*
1045      * Always perform the initial transfer upon reception of the next TI
1046      * command to ensure the DMA/non-DMA status of the command is correct.
1047      * It is not possible to use s->dma directly in the section below as
1048      * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
1049      * async data transfer is delayed then s->dma is set incorrectly.
1050      */
1051 
1052     if (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA)) {
1053         /* When the SCSI layer returns more data, raise deferred INTR_BS */
1054         esp_dma_ti_check(s);
1055 
1056         esp_do_dma(s);
1057     } else if (s->rregs[ESP_CMD] == CMD_TI) {
1058         esp_do_nodma(s);
1059     }
1060 }
1061 
1062 static void handle_ti(ESPState *s)
1063 {
1064     uint32_t dmalen;
1065 
1066     if (s->dma && !s->dma_enabled) {
1067         s->dma_cb = handle_ti;
1068         return;
1069     }
1070 
1071     if (s->dma) {
1072         dmalen = esp_get_tc(s);
1073         trace_esp_handle_ti(dmalen);
1074         esp_do_dma(s);
1075     } else {
1076         trace_esp_handle_ti(s->ti_size);
1077         esp_do_nodma(s);
1078 
1079         if (esp_get_phase(s) == STAT_DO) {
1080             esp_nodma_ti_dataout(s);
1081         }
1082     }
1083 }
1084 
1085 void esp_hard_reset(ESPState *s)
1086 {
1087     memset(s->rregs, 0, ESP_REGS);
1088     memset(s->wregs, 0, ESP_REGS);
1089     s->tchi_written = 0;
1090     s->ti_size = 0;
1091     s->async_len = 0;
1092     fifo8_reset(&s->fifo);
1093     fifo8_reset(&s->cmdfifo);
1094     s->dma = 0;
1095     s->dma_cb = NULL;
1096 
1097     s->rregs[ESP_CFG1] = 7;
1098 }
1099 
1100 static void esp_soft_reset(ESPState *s)
1101 {
1102     qemu_irq_lower(s->irq);
1103     qemu_irq_lower(s->drq_irq);
1104     esp_hard_reset(s);
1105 }
1106 
1107 static void esp_bus_reset(ESPState *s)
1108 {
1109     bus_cold_reset(BUS(&s->bus));
1110 }
1111 
1112 static void parent_esp_reset(ESPState *s, int irq, int level)
1113 {
1114     if (level) {
1115         esp_soft_reset(s);
1116     }
1117 }
1118 
1119 static void esp_run_cmd(ESPState *s)
1120 {
1121     uint8_t cmd = s->rregs[ESP_CMD];
1122 
1123     if (cmd & CMD_DMA) {
1124         s->dma = 1;
1125         /* Reload DMA counter.  */
1126         if (esp_get_stc(s) == 0) {
1127             esp_set_tc(s, 0x10000);
1128         } else {
1129             esp_set_tc(s, esp_get_stc(s));
1130         }
1131     } else {
1132         s->dma = 0;
1133     }
1134     switch (cmd & CMD_CMD) {
1135     case CMD_NOP:
1136         trace_esp_mem_writeb_cmd_nop(cmd);
1137         break;
1138     case CMD_FLUSH:
1139         trace_esp_mem_writeb_cmd_flush(cmd);
1140         fifo8_reset(&s->fifo);
1141         break;
1142     case CMD_RESET:
1143         trace_esp_mem_writeb_cmd_reset(cmd);
1144         esp_soft_reset(s);
1145         break;
1146     case CMD_BUSRESET:
1147         trace_esp_mem_writeb_cmd_bus_reset(cmd);
1148         esp_bus_reset(s);
1149         if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
1150             s->rregs[ESP_RINTR] |= INTR_RST;
1151             esp_raise_irq(s);
1152         }
1153         break;
1154     case CMD_TI:
1155         trace_esp_mem_writeb_cmd_ti(cmd);
1156         handle_ti(s);
1157         break;
1158     case CMD_ICCS:
1159         trace_esp_mem_writeb_cmd_iccs(cmd);
1160         write_response(s);
1161         break;
1162     case CMD_MSGACC:
1163         trace_esp_mem_writeb_cmd_msgacc(cmd);
1164         s->rregs[ESP_RINTR] |= INTR_DC;
1165         s->rregs[ESP_RSEQ] = 0;
1166         s->rregs[ESP_RFLAGS] = 0;
1167         esp_raise_irq(s);
1168         break;
1169     case CMD_PAD:
1170         trace_esp_mem_writeb_cmd_pad(cmd);
1171         handle_pad(s);
1172         break;
1173     case CMD_SATN:
1174         trace_esp_mem_writeb_cmd_satn(cmd);
1175         break;
1176     case CMD_RSTATN:
1177         trace_esp_mem_writeb_cmd_rstatn(cmd);
1178         break;
1179     case CMD_SEL:
1180         trace_esp_mem_writeb_cmd_sel(cmd);
1181         handle_s_without_atn(s);
1182         break;
1183     case CMD_SELATN:
1184         trace_esp_mem_writeb_cmd_selatn(cmd);
1185         handle_satn(s);
1186         break;
1187     case CMD_SELATNS:
1188         trace_esp_mem_writeb_cmd_selatns(cmd);
1189         handle_satn_stop(s);
1190         break;
1191     case CMD_ENSEL:
1192         trace_esp_mem_writeb_cmd_ensel(cmd);
1193         s->rregs[ESP_RINTR] = 0;
1194         break;
1195     case CMD_DISSEL:
1196         trace_esp_mem_writeb_cmd_dissel(cmd);
1197         s->rregs[ESP_RINTR] = 0;
1198         esp_raise_irq(s);
1199         break;
1200     default:
1201         trace_esp_error_unhandled_command(cmd);
1202         break;
1203     }
1204 }
1205 
1206 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
1207 {
1208     uint32_t val;
1209 
1210     switch (saddr) {
1211     case ESP_FIFO:
1212         s->rregs[ESP_FIFO] = esp_fifo_pop(s);
1213         val = s->rregs[ESP_FIFO];
1214         break;
1215     case ESP_RINTR:
1216         /*
1217          * Clear sequence step, interrupt register and all status bits
1218          * except TC
1219          */
1220         val = s->rregs[ESP_RINTR];
1221         s->rregs[ESP_RINTR] = 0;
1222         esp_lower_irq(s);
1223         s->rregs[ESP_RSTAT] &= STAT_TC | 7;
1224         /*
1225          * According to the datasheet ESP_RSEQ should be cleared, but as the
1226          * emulation currently defers information transfers to the next TI
1227          * command leave it for now so that pedantic guests such as the old
1228          * Linux 2.6 driver see the correct flags before the next SCSI phase
1229          * transition.
1230          *
1231          * s->rregs[ESP_RSEQ] = SEQ_0;
1232          */
1233         break;
1234     case ESP_TCHI:
1235         /* Return the unique id if the value has never been written */
1236         if (!s->tchi_written) {
1237             val = s->chip_id;
1238         } else {
1239             val = s->rregs[saddr];
1240         }
1241         break;
1242      case ESP_RFLAGS:
1243         /* Bottom 5 bits indicate number of bytes in FIFO */
1244         val = fifo8_num_used(&s->fifo);
1245         break;
1246     default:
1247         val = s->rregs[saddr];
1248         break;
1249     }
1250 
1251     trace_esp_mem_readb(saddr, val);
1252     return val;
1253 }
1254 
1255 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
1256 {
1257     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
1258     switch (saddr) {
1259     case ESP_TCHI:
1260         s->tchi_written = true;
1261         /* fall through */
1262     case ESP_TCLO:
1263     case ESP_TCMID:
1264         s->rregs[ESP_RSTAT] &= ~STAT_TC;
1265         break;
1266     case ESP_FIFO:
1267         if (!fifo8_is_full(&s->fifo)) {
1268             esp_fifo_push(s, val);
1269         }
1270         esp_do_nodma(s);
1271         break;
1272     case ESP_CMD:
1273         s->rregs[saddr] = val;
1274         esp_run_cmd(s);
1275         break;
1276     case ESP_WBUSID ... ESP_WSYNO:
1277         break;
1278     case ESP_CFG1:
1279     case ESP_CFG2: case ESP_CFG3:
1280     case ESP_RES3: case ESP_RES4:
1281         s->rregs[saddr] = val;
1282         break;
1283     case ESP_WCCF ... ESP_WTEST:
1284         break;
1285     default:
1286         trace_esp_error_invalid_write(val, saddr);
1287         return;
1288     }
1289     s->wregs[saddr] = val;
1290 }
1291 
1292 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1293                             unsigned size, bool is_write,
1294                             MemTxAttrs attrs)
1295 {
1296     return (size == 1) || (is_write && size == 4);
1297 }
1298 
1299 static bool esp_is_before_version_5(void *opaque, int version_id)
1300 {
1301     ESPState *s = ESP(opaque);
1302 
1303     version_id = MIN(version_id, s->mig_version_id);
1304     return version_id < 5;
1305 }
1306 
1307 static bool esp_is_version_5(void *opaque, int version_id)
1308 {
1309     ESPState *s = ESP(opaque);
1310 
1311     version_id = MIN(version_id, s->mig_version_id);
1312     return version_id >= 5;
1313 }
1314 
1315 static bool esp_is_version_6(void *opaque, int version_id)
1316 {
1317     ESPState *s = ESP(opaque);
1318 
1319     version_id = MIN(version_id, s->mig_version_id);
1320     return version_id >= 6;
1321 }
1322 
1323 static bool esp_is_between_version_5_and_6(void *opaque, int version_id)
1324 {
1325     ESPState *s = ESP(opaque);
1326 
1327     version_id = MIN(version_id, s->mig_version_id);
1328     return version_id >= 5 && version_id <= 6;
1329 }
1330 
1331 int esp_pre_save(void *opaque)
1332 {
1333     ESPState *s = ESP(object_resolve_path_component(
1334                       OBJECT(opaque), "esp"));
1335 
1336     s->mig_version_id = vmstate_esp.version_id;
1337     return 0;
1338 }
1339 
1340 static int esp_post_load(void *opaque, int version_id)
1341 {
1342     ESPState *s = ESP(opaque);
1343     int len, i;
1344 
1345     version_id = MIN(version_id, s->mig_version_id);
1346 
1347     if (version_id < 5) {
1348         esp_set_tc(s, s->mig_dma_left);
1349 
1350         /* Migrate ti_buf to fifo */
1351         len = s->mig_ti_wptr - s->mig_ti_rptr;
1352         for (i = 0; i < len; i++) {
1353             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1354         }
1355 
1356         /* Migrate cmdbuf to cmdfifo */
1357         for (i = 0; i < s->mig_cmdlen; i++) {
1358             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1359         }
1360     }
1361 
1362     s->mig_version_id = vmstate_esp.version_id;
1363     return 0;
1364 }
1365 
1366 const VMStateDescription vmstate_esp = {
1367     .name = "esp",
1368     .version_id = 7,
1369     .minimum_version_id = 3,
1370     .post_load = esp_post_load,
1371     .fields = (const VMStateField[]) {
1372         VMSTATE_BUFFER(rregs, ESPState),
1373         VMSTATE_BUFFER(wregs, ESPState),
1374         VMSTATE_INT32(ti_size, ESPState),
1375         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1376         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1377         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1378         VMSTATE_UINT32(status, ESPState),
1379         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1380                             esp_is_before_version_5),
1381         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1382                           esp_is_before_version_5),
1383         VMSTATE_UINT32(dma, ESPState),
1384         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1385                               esp_is_before_version_5, 0, 16),
1386         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1387                               esp_is_before_version_5, 16,
1388                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
1389         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1390         VMSTATE_UINT32(do_cmd, ESPState),
1391         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1392         VMSTATE_BOOL_TEST(data_ready, ESPState, esp_is_version_5),
1393         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1394         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1395         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1396         VMSTATE_UINT8_TEST(mig_ti_cmd, ESPState,
1397                            esp_is_between_version_5_and_6),
1398         VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6),
1399         VMSTATE_BOOL(drq_state, ESPState),
1400         VMSTATE_END_OF_LIST()
1401     },
1402 };
1403 
1404 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1405                                  uint64_t val, unsigned int size)
1406 {
1407     SysBusESPState *sysbus = opaque;
1408     ESPState *s = ESP(&sysbus->esp);
1409     uint32_t saddr;
1410 
1411     saddr = addr >> sysbus->it_shift;
1412     esp_reg_write(s, saddr, val);
1413 }
1414 
1415 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1416                                     unsigned int size)
1417 {
1418     SysBusESPState *sysbus = opaque;
1419     ESPState *s = ESP(&sysbus->esp);
1420     uint32_t saddr;
1421 
1422     saddr = addr >> sysbus->it_shift;
1423     return esp_reg_read(s, saddr);
1424 }
1425 
1426 static const MemoryRegionOps sysbus_esp_mem_ops = {
1427     .read = sysbus_esp_mem_read,
1428     .write = sysbus_esp_mem_write,
1429     .endianness = DEVICE_NATIVE_ENDIAN,
1430     .valid.accepts = esp_mem_accepts,
1431 };
1432 
1433 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1434                                   uint64_t val, unsigned int size)
1435 {
1436     SysBusESPState *sysbus = opaque;
1437     ESPState *s = ESP(&sysbus->esp);
1438 
1439     trace_esp_pdma_write(size);
1440 
1441     switch (size) {
1442     case 1:
1443         esp_pdma_write(s, val);
1444         break;
1445     case 2:
1446         esp_pdma_write(s, val >> 8);
1447         esp_pdma_write(s, val);
1448         break;
1449     }
1450     esp_do_dma(s);
1451 }
1452 
1453 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1454                                      unsigned int size)
1455 {
1456     SysBusESPState *sysbus = opaque;
1457     ESPState *s = ESP(&sysbus->esp);
1458     uint64_t val = 0;
1459 
1460     trace_esp_pdma_read(size);
1461 
1462     switch (size) {
1463     case 1:
1464         val = esp_pdma_read(s);
1465         break;
1466     case 2:
1467         val = esp_pdma_read(s);
1468         val = (val << 8) | esp_pdma_read(s);
1469         break;
1470     }
1471     esp_do_dma(s);
1472     return val;
1473 }
1474 
1475 static void *esp_load_request(QEMUFile *f, SCSIRequest *req)
1476 {
1477     ESPState *s = container_of(req->bus, ESPState, bus);
1478 
1479     scsi_req_ref(req);
1480     s->current_req = req;
1481     return s;
1482 }
1483 
1484 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1485     .read = sysbus_esp_pdma_read,
1486     .write = sysbus_esp_pdma_write,
1487     .endianness = DEVICE_NATIVE_ENDIAN,
1488     .valid.min_access_size = 1,
1489     .valid.max_access_size = 4,
1490     .impl.min_access_size = 1,
1491     .impl.max_access_size = 2,
1492 };
1493 
1494 static const struct SCSIBusInfo esp_scsi_info = {
1495     .tcq = false,
1496     .max_target = ESP_MAX_DEVS,
1497     .max_lun = 7,
1498 
1499     .load_request = esp_load_request,
1500     .transfer_data = esp_transfer_data,
1501     .complete = esp_command_complete,
1502     .cancel = esp_request_cancelled
1503 };
1504 
1505 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1506 {
1507     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1508     ESPState *s = ESP(&sysbus->esp);
1509 
1510     switch (irq) {
1511     case 0:
1512         parent_esp_reset(s, irq, level);
1513         break;
1514     case 1:
1515         esp_dma_enable(s, irq, level);
1516         break;
1517     }
1518 }
1519 
1520 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1521 {
1522     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1523     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1524     ESPState *s = ESP(&sysbus->esp);
1525 
1526     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1527         return;
1528     }
1529 
1530     sysbus_init_irq(sbd, &s->irq);
1531     sysbus_init_irq(sbd, &s->drq_irq);
1532     assert(sysbus->it_shift != -1);
1533 
1534     s->chip_id = TCHI_FAS100A;
1535     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1536                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1537     sysbus_init_mmio(sbd, &sysbus->iomem);
1538     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1539                           sysbus, "esp-pdma", 4);
1540     sysbus_init_mmio(sbd, &sysbus->pdma);
1541 
1542     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1543 
1544     scsi_bus_init(&s->bus, sizeof(s->bus), dev, &esp_scsi_info);
1545 }
1546 
1547 static void sysbus_esp_hard_reset(DeviceState *dev)
1548 {
1549     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1550     ESPState *s = ESP(&sysbus->esp);
1551 
1552     esp_hard_reset(s);
1553 }
1554 
1555 static void sysbus_esp_init(Object *obj)
1556 {
1557     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1558 
1559     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1560 }
1561 
1562 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1563     .name = "sysbusespscsi",
1564     .version_id = 2,
1565     .minimum_version_id = 1,
1566     .pre_save = esp_pre_save,
1567     .fields = (const VMStateField[]) {
1568         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1569         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1570         VMSTATE_END_OF_LIST()
1571     }
1572 };
1573 
1574 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1575 {
1576     DeviceClass *dc = DEVICE_CLASS(klass);
1577 
1578     dc->realize = sysbus_esp_realize;
1579     device_class_set_legacy_reset(dc, sysbus_esp_hard_reset);
1580     dc->vmsd = &vmstate_sysbus_esp_scsi;
1581     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1582 }
1583 
1584 static void esp_finalize(Object *obj)
1585 {
1586     ESPState *s = ESP(obj);
1587 
1588     fifo8_destroy(&s->fifo);
1589     fifo8_destroy(&s->cmdfifo);
1590 }
1591 
1592 static void esp_init(Object *obj)
1593 {
1594     ESPState *s = ESP(obj);
1595 
1596     fifo8_create(&s->fifo, ESP_FIFO_SZ);
1597     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1598 }
1599 
1600 static void esp_class_init(ObjectClass *klass, void *data)
1601 {
1602     DeviceClass *dc = DEVICE_CLASS(klass);
1603 
1604     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1605     dc->user_creatable = false;
1606     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1607 }
1608 
1609 static const TypeInfo esp_info_types[] = {
1610     {
1611         .name          = TYPE_SYSBUS_ESP,
1612         .parent        = TYPE_SYS_BUS_DEVICE,
1613         .instance_init = sysbus_esp_init,
1614         .instance_size = sizeof(SysBusESPState),
1615         .class_init    = sysbus_esp_class_init,
1616     },
1617     {
1618         .name = TYPE_ESP,
1619         .parent = TYPE_DEVICE,
1620         .instance_init = esp_init,
1621         .instance_finalize = esp_finalize,
1622         .instance_size = sizeof(ESPState),
1623         .class_init = esp_class_init,
1624     },
1625 };
1626 
1627 DEFINE_TYPES(esp_info_types)
1628