xref: /qemu/hw/scsi/esp.c (revision 35579b523cf8f441da12f968ce5dcf6ae0bfbfea)
1 /*
2  * QEMU ESP/NCR53C9x emulation
3  *
4  * Copyright (c) 2005-2006 Fabrice Bellard
5  * Copyright (c) 2012 Herve Poussineau
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "hw/irq.h"
30 #include "hw/scsi/esp.h"
31 #include "trace.h"
32 #include "qemu/log.h"
33 #include "qemu/module.h"
34 
35 /*
36  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
37  * also produced as NCR89C100. See
38  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
39  * and
40  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
41  *
42  * On Macintosh Quadra it is a NCR53C96.
43  */
44 
45 static void esp_raise_irq(ESPState *s)
46 {
47     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
48         s->rregs[ESP_RSTAT] |= STAT_INT;
49         qemu_irq_raise(s->irq);
50         trace_esp_raise_irq();
51     }
52 }
53 
54 static void esp_lower_irq(ESPState *s)
55 {
56     if (s->rregs[ESP_RSTAT] & STAT_INT) {
57         s->rregs[ESP_RSTAT] &= ~STAT_INT;
58         qemu_irq_lower(s->irq);
59         trace_esp_lower_irq();
60     }
61 }
62 
63 static void esp_raise_drq(ESPState *s)
64 {
65     qemu_irq_raise(s->irq_data);
66     trace_esp_raise_drq();
67 }
68 
69 static void esp_lower_drq(ESPState *s)
70 {
71     qemu_irq_lower(s->irq_data);
72     trace_esp_lower_drq();
73 }
74 
75 void esp_dma_enable(ESPState *s, int irq, int level)
76 {
77     if (level) {
78         s->dma_enabled = 1;
79         trace_esp_dma_enable();
80         if (s->dma_cb) {
81             s->dma_cb(s);
82             s->dma_cb = NULL;
83         }
84     } else {
85         trace_esp_dma_disable();
86         s->dma_enabled = 0;
87     }
88 }
89 
90 void esp_request_cancelled(SCSIRequest *req)
91 {
92     ESPState *s = req->hba_private;
93 
94     if (req == s->current_req) {
95         scsi_req_unref(s->current_req);
96         s->current_req = NULL;
97         s->current_dev = NULL;
98         s->async_len = 0;
99     }
100 }
101 
102 static void esp_fifo_push(Fifo8 *fifo, uint8_t val)
103 {
104     if (fifo8_num_used(fifo) == fifo->capacity) {
105         trace_esp_error_fifo_overrun();
106         return;
107     }
108 
109     fifo8_push(fifo, val);
110 }
111 
112 static uint8_t esp_fifo_pop(Fifo8 *fifo)
113 {
114     if (fifo8_is_empty(fifo)) {
115         return 0;
116     }
117 
118     return fifo8_pop(fifo);
119 }
120 
121 static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen)
122 {
123     const uint8_t *buf;
124     uint32_t n;
125 
126     if (maxlen == 0) {
127         return 0;
128     }
129 
130     buf = fifo8_pop_buf(fifo, maxlen, &n);
131     if (dest) {
132         memcpy(dest, buf, n);
133     }
134 
135     return n;
136 }
137 
138 static uint32_t esp_get_tc(ESPState *s)
139 {
140     uint32_t dmalen;
141 
142     dmalen = s->rregs[ESP_TCLO];
143     dmalen |= s->rregs[ESP_TCMID] << 8;
144     dmalen |= s->rregs[ESP_TCHI] << 16;
145 
146     return dmalen;
147 }
148 
149 static void esp_set_tc(ESPState *s, uint32_t dmalen)
150 {
151     s->rregs[ESP_TCLO] = dmalen;
152     s->rregs[ESP_TCMID] = dmalen >> 8;
153     s->rregs[ESP_TCHI] = dmalen >> 16;
154 }
155 
156 static uint32_t esp_get_stc(ESPState *s)
157 {
158     uint32_t dmalen;
159 
160     dmalen = s->wregs[ESP_TCLO];
161     dmalen |= s->wregs[ESP_TCMID] << 8;
162     dmalen |= s->wregs[ESP_TCHI] << 16;
163 
164     return dmalen;
165 }
166 
167 static uint8_t esp_pdma_read(ESPState *s)
168 {
169     uint8_t val;
170 
171     if (s->do_cmd) {
172         val = esp_fifo_pop(&s->cmdfifo);
173     } else {
174         val = esp_fifo_pop(&s->fifo);
175     }
176 
177     return val;
178 }
179 
180 static void esp_pdma_write(ESPState *s, uint8_t val)
181 {
182     uint32_t dmalen = esp_get_tc(s);
183 
184     if (dmalen == 0) {
185         return;
186     }
187 
188     if (s->do_cmd) {
189         esp_fifo_push(&s->cmdfifo, val);
190     } else {
191         esp_fifo_push(&s->fifo, val);
192     }
193 
194     dmalen--;
195     esp_set_tc(s, dmalen);
196 }
197 
198 static int esp_select(ESPState *s)
199 {
200     int target;
201 
202     target = s->wregs[ESP_WBUSID] & BUSID_DID;
203 
204     s->ti_size = 0;
205     fifo8_reset(&s->fifo);
206 
207     if (s->current_req) {
208         /* Started a new command before the old one finished.  Cancel it.  */
209         scsi_req_cancel(s->current_req);
210     }
211 
212     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
213     if (!s->current_dev) {
214         /* No such drive */
215         s->rregs[ESP_RSTAT] = 0;
216         s->rregs[ESP_RINTR] = INTR_DC;
217         s->rregs[ESP_RSEQ] = SEQ_0;
218         esp_raise_irq(s);
219         return -1;
220     }
221 
222     /*
223      * Note that we deliberately don't raise the IRQ here: this will be done
224      * either in do_busid_cmd() for DATA OUT transfers or by the deferred
225      * IRQ mechanism in esp_transfer_data() for DATA IN transfers
226      */
227     s->rregs[ESP_RINTR] |= INTR_FC;
228     s->rregs[ESP_RSEQ] = SEQ_CD;
229     return 0;
230 }
231 
232 static uint32_t get_cmd(ESPState *s, uint32_t maxlen)
233 {
234     uint8_t buf[ESP_CMDFIFO_SZ];
235     uint32_t dmalen, n;
236     int target;
237 
238     target = s->wregs[ESP_WBUSID] & BUSID_DID;
239     if (s->dma) {
240         dmalen = MIN(esp_get_tc(s), maxlen);
241         if (dmalen == 0) {
242             return 0;
243         }
244         if (s->dma_memory_read) {
245             s->dma_memory_read(s->dma_opaque, buf, dmalen);
246             dmalen = MIN(fifo8_num_free(&s->cmdfifo), dmalen);
247             fifo8_push_all(&s->cmdfifo, buf, dmalen);
248         } else {
249             if (esp_select(s) < 0) {
250                 fifo8_reset(&s->cmdfifo);
251                 return -1;
252             }
253             esp_raise_drq(s);
254             fifo8_reset(&s->cmdfifo);
255             return 0;
256         }
257     } else {
258         dmalen = MIN(fifo8_num_used(&s->fifo), maxlen);
259         if (dmalen == 0) {
260             return 0;
261         }
262         n = esp_fifo_pop_buf(&s->fifo, buf, dmalen);
263         n = MIN(fifo8_num_free(&s->cmdfifo), n);
264         fifo8_push_all(&s->cmdfifo, buf, n);
265     }
266     trace_esp_get_cmd(dmalen, target);
267 
268     if (esp_select(s) < 0) {
269         fifo8_reset(&s->cmdfifo);
270         return -1;
271     }
272     return dmalen;
273 }
274 
275 static void do_busid_cmd(ESPState *s, uint8_t busid)
276 {
277     uint32_t cmdlen;
278     int32_t datalen;
279     int lun;
280     SCSIDevice *current_lun;
281     uint8_t buf[ESP_CMDFIFO_SZ];
282 
283     trace_esp_do_busid_cmd(busid);
284     lun = busid & 7;
285     cmdlen = fifo8_num_used(&s->cmdfifo);
286     if (!cmdlen || !s->current_dev) {
287         return;
288     }
289     esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
290 
291     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun);
292     s->current_req = scsi_req_new(current_lun, 0, lun, buf, s);
293     datalen = scsi_req_enqueue(s->current_req);
294     s->ti_size = datalen;
295     fifo8_reset(&s->cmdfifo);
296     if (datalen != 0) {
297         s->rregs[ESP_RSTAT] = STAT_TC;
298         s->rregs[ESP_RSEQ] = SEQ_CD;
299         s->ti_cmd = 0;
300         esp_set_tc(s, 0);
301         if (datalen > 0) {
302             /*
303              * Switch to DATA IN phase but wait until initial data xfer is
304              * complete before raising the command completion interrupt
305              */
306             s->data_in_ready = false;
307             s->rregs[ESP_RSTAT] |= STAT_DI;
308         } else {
309             s->rregs[ESP_RSTAT] |= STAT_DO;
310             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
311             esp_raise_irq(s);
312             esp_lower_drq(s);
313         }
314         scsi_req_continue(s->current_req);
315         return;
316     }
317 }
318 
319 static void do_cmd(ESPState *s)
320 {
321     uint8_t busid = esp_fifo_pop(&s->cmdfifo);
322     int len;
323 
324     s->cmdfifo_cdb_offset--;
325 
326     /* Ignore extended messages for now */
327     if (s->cmdfifo_cdb_offset) {
328         len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
329         esp_fifo_pop_buf(&s->cmdfifo, NULL, len);
330         s->cmdfifo_cdb_offset = 0;
331     }
332 
333     do_busid_cmd(s, busid);
334 }
335 
336 static void satn_pdma_cb(ESPState *s)
337 {
338     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
339         s->cmdfifo_cdb_offset = 1;
340         s->do_cmd = 0;
341         do_cmd(s);
342     }
343 }
344 
345 static void handle_satn(ESPState *s)
346 {
347     int32_t cmdlen;
348 
349     if (s->dma && !s->dma_enabled) {
350         s->dma_cb = handle_satn;
351         return;
352     }
353     s->pdma_cb = satn_pdma_cb;
354     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
355     if (cmdlen > 0) {
356         s->cmdfifo_cdb_offset = 1;
357         s->do_cmd = 0;
358         do_cmd(s);
359     } else if (cmdlen == 0) {
360         s->do_cmd = 1;
361         /* Target present, but no cmd yet - switch to command phase */
362         s->rregs[ESP_RSEQ] = SEQ_CD;
363         s->rregs[ESP_RSTAT] = STAT_CD;
364     }
365 }
366 
367 static void s_without_satn_pdma_cb(ESPState *s)
368 {
369     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
370         s->cmdfifo_cdb_offset = 0;
371         s->do_cmd = 0;
372         do_busid_cmd(s, 0);
373     }
374 }
375 
376 static void handle_s_without_atn(ESPState *s)
377 {
378     int32_t cmdlen;
379 
380     if (s->dma && !s->dma_enabled) {
381         s->dma_cb = handle_s_without_atn;
382         return;
383     }
384     s->pdma_cb = s_without_satn_pdma_cb;
385     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
386     if (cmdlen > 0) {
387         s->cmdfifo_cdb_offset = 0;
388         s->do_cmd = 0;
389         do_busid_cmd(s, 0);
390     } else if (cmdlen == 0) {
391         s->do_cmd = 1;
392         /* Target present, but no cmd yet - switch to command phase */
393         s->rregs[ESP_RSEQ] = SEQ_CD;
394         s->rregs[ESP_RSTAT] = STAT_CD;
395     }
396 }
397 
398 static void satn_stop_pdma_cb(ESPState *s)
399 {
400     if (!esp_get_tc(s) && !fifo8_is_empty(&s->cmdfifo)) {
401         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
402         s->do_cmd = 1;
403         s->cmdfifo_cdb_offset = 1;
404         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
405         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
406         s->rregs[ESP_RSEQ] = SEQ_CD;
407         esp_raise_irq(s);
408     }
409 }
410 
411 static void handle_satn_stop(ESPState *s)
412 {
413     int32_t cmdlen;
414 
415     if (s->dma && !s->dma_enabled) {
416         s->dma_cb = handle_satn_stop;
417         return;
418     }
419     s->pdma_cb = satn_stop_pdma_cb;
420     cmdlen = get_cmd(s, 1);
421     if (cmdlen > 0) {
422         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
423         s->do_cmd = 1;
424         s->cmdfifo_cdb_offset = 1;
425         s->rregs[ESP_RSTAT] = STAT_MO;
426         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
427         s->rregs[ESP_RSEQ] = SEQ_MO;
428         esp_raise_irq(s);
429     } else if (cmdlen == 0) {
430         s->do_cmd = 1;
431         /* Target present, switch to message out phase */
432         s->rregs[ESP_RSEQ] = SEQ_MO;
433         s->rregs[ESP_RSTAT] = STAT_MO;
434     }
435 }
436 
437 static void write_response_pdma_cb(ESPState *s)
438 {
439     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
440     s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
441     s->rregs[ESP_RSEQ] = SEQ_CD;
442     esp_raise_irq(s);
443 }
444 
445 static void write_response(ESPState *s)
446 {
447     uint8_t buf[2];
448 
449     trace_esp_write_response(s->status);
450 
451     buf[0] = s->status;
452     buf[1] = 0;
453 
454     if (s->dma) {
455         if (s->dma_memory_write) {
456             s->dma_memory_write(s->dma_opaque, buf, 2);
457             s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
458             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
459             s->rregs[ESP_RSEQ] = SEQ_CD;
460         } else {
461             s->pdma_cb = write_response_pdma_cb;
462             esp_raise_drq(s);
463             return;
464         }
465     } else {
466         fifo8_reset(&s->fifo);
467         fifo8_push_all(&s->fifo, buf, 2);
468         s->rregs[ESP_RFLAGS] = 2;
469     }
470     esp_raise_irq(s);
471 }
472 
473 static void esp_dma_done(ESPState *s)
474 {
475     s->rregs[ESP_RSTAT] |= STAT_TC;
476     s->rregs[ESP_RINTR] |= INTR_BS;
477     s->rregs[ESP_RFLAGS] = 0;
478     esp_set_tc(s, 0);
479     esp_raise_irq(s);
480 }
481 
482 static void do_dma_pdma_cb(ESPState *s)
483 {
484     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
485     int len;
486     uint32_t n;
487 
488     if (s->do_cmd) {
489         /* Ensure we have received complete command after SATN and stop */
490         if (esp_get_tc(s) || fifo8_is_empty(&s->cmdfifo)) {
491             return;
492         }
493 
494         s->ti_size = 0;
495         s->do_cmd = 0;
496         do_cmd(s);
497         esp_lower_drq(s);
498         return;
499     }
500 
501     if (!s->current_req) {
502         return;
503     }
504 
505     if (to_device) {
506         /* Copy FIFO data to device */
507         len = MIN(s->async_len, ESP_FIFO_SZ);
508         len = MIN(len, fifo8_num_used(&s->fifo));
509         n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
510         s->async_buf += n;
511         s->async_len -= n;
512         s->ti_size += n;
513 
514         if (n < len) {
515             /* Unaligned accesses can cause FIFO wraparound */
516             len = len - n;
517             n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
518             s->async_buf += n;
519             s->async_len -= n;
520             s->ti_size += n;
521         }
522 
523         if (s->async_len == 0) {
524             scsi_req_continue(s->current_req);
525             return;
526         }
527 
528         if (esp_get_tc(s) == 0) {
529             esp_lower_drq(s);
530             esp_dma_done(s);
531         }
532 
533         return;
534     } else {
535         if (s->async_len == 0) {
536             /* Defer until the scsi layer has completed */
537             scsi_req_continue(s->current_req);
538             s->data_in_ready = false;
539             return;
540         }
541 
542         if (esp_get_tc(s) != 0) {
543             /* Copy device data to FIFO */
544             len = MIN(s->async_len, esp_get_tc(s));
545             len = MIN(len, fifo8_num_free(&s->fifo));
546             fifo8_push_all(&s->fifo, s->async_buf, len);
547             s->async_buf += len;
548             s->async_len -= len;
549             s->ti_size -= len;
550             esp_set_tc(s, esp_get_tc(s) - len);
551 
552             if (esp_get_tc(s) == 0) {
553                 /* Indicate transfer to FIFO is complete */
554                  s->rregs[ESP_RSTAT] |= STAT_TC;
555             }
556             return;
557         }
558 
559         /* Partially filled a scsi buffer. Complete immediately.  */
560         esp_lower_drq(s);
561         esp_dma_done(s);
562     }
563 }
564 
565 static void esp_do_dma(ESPState *s)
566 {
567     uint32_t len, cmdlen;
568     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
569     uint8_t buf[ESP_CMDFIFO_SZ];
570 
571     len = esp_get_tc(s);
572     if (s->do_cmd) {
573         /*
574          * handle_ti_cmd() case: esp_do_dma() is called only from
575          * handle_ti_cmd() with do_cmd != NULL (see the assert())
576          */
577         cmdlen = fifo8_num_used(&s->cmdfifo);
578         trace_esp_do_dma(cmdlen, len);
579         if (s->dma_memory_read) {
580             len = MIN(len, fifo8_num_free(&s->cmdfifo));
581             s->dma_memory_read(s->dma_opaque, buf, len);
582             fifo8_push_all(&s->cmdfifo, buf, len);
583         } else {
584             s->pdma_cb = do_dma_pdma_cb;
585             esp_raise_drq(s);
586             return;
587         }
588         trace_esp_handle_ti_cmd(cmdlen);
589         s->ti_size = 0;
590         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
591             /* No command received */
592             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
593                 return;
594             }
595 
596             /* Command has been received */
597             s->do_cmd = 0;
598             do_cmd(s);
599         } else {
600             /*
601              * Extra message out bytes received: update cmdfifo_cdb_offset
602              * and then switch to commmand phase
603              */
604             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
605             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
606             s->rregs[ESP_RSEQ] = SEQ_CD;
607             s->rregs[ESP_RINTR] |= INTR_BS;
608             esp_raise_irq(s);
609         }
610         return;
611     }
612     if (!s->current_req) {
613         return;
614     }
615     if (s->async_len == 0) {
616         /* Defer until data is available.  */
617         return;
618     }
619     if (len > s->async_len) {
620         len = s->async_len;
621     }
622     if (to_device) {
623         if (s->dma_memory_read) {
624             s->dma_memory_read(s->dma_opaque, s->async_buf, len);
625         } else {
626             s->pdma_cb = do_dma_pdma_cb;
627             esp_raise_drq(s);
628             return;
629         }
630     } else {
631         if (s->dma_memory_write) {
632             s->dma_memory_write(s->dma_opaque, s->async_buf, len);
633         } else {
634             /* Adjust TC for any leftover data in the FIFO */
635             if (!fifo8_is_empty(&s->fifo)) {
636                 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo));
637             }
638 
639             /* Copy device data to FIFO */
640             len = MIN(len, fifo8_num_free(&s->fifo));
641             fifo8_push_all(&s->fifo, s->async_buf, len);
642             s->async_buf += len;
643             s->async_len -= len;
644             s->ti_size -= len;
645 
646             /*
647              * MacOS toolbox uses a TI length of 16 bytes for all commands, so
648              * commands shorter than this must be padded accordingly
649              */
650             if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) {
651                 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) {
652                     esp_fifo_push(&s->fifo, 0);
653                     len++;
654                 }
655             }
656 
657             esp_set_tc(s, esp_get_tc(s) - len);
658             s->pdma_cb = do_dma_pdma_cb;
659             esp_raise_drq(s);
660 
661             /* Indicate transfer to FIFO is complete */
662             s->rregs[ESP_RSTAT] |= STAT_TC;
663             return;
664         }
665     }
666     esp_set_tc(s, esp_get_tc(s) - len);
667     s->async_buf += len;
668     s->async_len -= len;
669     if (to_device) {
670         s->ti_size += len;
671     } else {
672         s->ti_size -= len;
673     }
674     if (s->async_len == 0) {
675         scsi_req_continue(s->current_req);
676         /*
677          * If there is still data to be read from the device then
678          * complete the DMA operation immediately.  Otherwise defer
679          * until the scsi layer has completed.
680          */
681         if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
682             return;
683         }
684     }
685 
686     /* Partially filled a scsi buffer. Complete immediately.  */
687     esp_dma_done(s);
688     esp_lower_drq(s);
689 }
690 
691 static void esp_do_nodma(ESPState *s)
692 {
693     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
694     uint32_t cmdlen;
695     int len;
696 
697     if (s->do_cmd) {
698         cmdlen = fifo8_num_used(&s->cmdfifo);
699         trace_esp_handle_ti_cmd(cmdlen);
700         s->ti_size = 0;
701         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
702             /* No command received */
703             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
704                 return;
705             }
706 
707             /* Command has been received */
708             s->do_cmd = 0;
709             do_cmd(s);
710         } else {
711             /*
712              * Extra message out bytes received: update cmdfifo_cdb_offset
713              * and then switch to commmand phase
714              */
715             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
716             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
717             s->rregs[ESP_RSEQ] = SEQ_CD;
718             s->rregs[ESP_RINTR] |= INTR_BS;
719             esp_raise_irq(s);
720         }
721         return;
722     }
723 
724     if (!s->current_req) {
725         return;
726     }
727 
728     if (s->async_len == 0) {
729         /* Defer until data is available.  */
730         return;
731     }
732 
733     if (to_device) {
734         len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
735         esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
736         s->async_buf += len;
737         s->async_len -= len;
738         s->ti_size += len;
739     } else {
740         if (fifo8_is_empty(&s->fifo)) {
741             fifo8_push(&s->fifo, s->async_buf[0]);
742             s->async_buf++;
743             s->async_len--;
744             s->ti_size--;
745         }
746     }
747 
748     if (s->async_len == 0) {
749         scsi_req_continue(s->current_req);
750         return;
751     }
752 
753     s->rregs[ESP_RINTR] |= INTR_BS;
754     esp_raise_irq(s);
755 }
756 
757 void esp_command_complete(SCSIRequest *req, size_t resid)
758 {
759     ESPState *s = req->hba_private;
760     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
761 
762     trace_esp_command_complete();
763 
764     /*
765      * Non-DMA transfers from the target will leave the last byte in
766      * the FIFO so don't reset ti_size in this case
767      */
768     if (s->dma || to_device) {
769         if (s->ti_size != 0) {
770             trace_esp_command_complete_unexpected();
771         }
772         s->ti_size = 0;
773     }
774 
775     s->async_len = 0;
776     if (req->status) {
777         trace_esp_command_complete_fail();
778     }
779     s->status = req->status;
780 
781     /*
782      * If the transfer is finished, switch to status phase. For non-DMA
783      * transfers from the target the last byte is still in the FIFO
784      */
785     if (s->ti_size == 0) {
786         s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
787         esp_dma_done(s);
788         esp_lower_drq(s);
789     }
790 
791     if (s->current_req) {
792         scsi_req_unref(s->current_req);
793         s->current_req = NULL;
794         s->current_dev = NULL;
795     }
796 }
797 
798 void esp_transfer_data(SCSIRequest *req, uint32_t len)
799 {
800     ESPState *s = req->hba_private;
801     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
802     uint32_t dmalen = esp_get_tc(s);
803 
804     assert(!s->do_cmd);
805     trace_esp_transfer_data(dmalen, s->ti_size);
806     s->async_len = len;
807     s->async_buf = scsi_req_get_buf(req);
808 
809     if (!to_device && !s->data_in_ready) {
810         /*
811          * Initial incoming data xfer is complete so raise command
812          * completion interrupt
813          */
814         s->data_in_ready = true;
815         s->rregs[ESP_RSTAT] |= STAT_TC;
816         s->rregs[ESP_RINTR] |= INTR_BS;
817         esp_raise_irq(s);
818     }
819 
820     if (s->ti_cmd == 0) {
821         /*
822          * Always perform the initial transfer upon reception of the next TI
823          * command to ensure the DMA/non-DMA status of the command is correct.
824          * It is not possible to use s->dma directly in the section below as
825          * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
826          * async data transfer is delayed then s->dma is set incorrectly.
827          */
828         return;
829     }
830 
831     if (s->ti_cmd == (CMD_TI | CMD_DMA)) {
832         if (dmalen) {
833             esp_do_dma(s);
834         } else if (s->ti_size <= 0) {
835             /*
836              * If this was the last part of a DMA transfer then the
837              * completion interrupt is deferred to here.
838              */
839             esp_dma_done(s);
840             esp_lower_drq(s);
841         }
842     } else if (s->ti_cmd == CMD_TI) {
843         esp_do_nodma(s);
844     }
845 }
846 
847 static void handle_ti(ESPState *s)
848 {
849     uint32_t dmalen;
850 
851     if (s->dma && !s->dma_enabled) {
852         s->dma_cb = handle_ti;
853         return;
854     }
855 
856     s->ti_cmd = s->rregs[ESP_CMD];
857     if (s->dma) {
858         dmalen = esp_get_tc(s);
859         trace_esp_handle_ti(dmalen);
860         s->rregs[ESP_RSTAT] &= ~STAT_TC;
861         esp_do_dma(s);
862     } else {
863         trace_esp_handle_ti(s->ti_size);
864         esp_do_nodma(s);
865     }
866 }
867 
868 void esp_hard_reset(ESPState *s)
869 {
870     memset(s->rregs, 0, ESP_REGS);
871     memset(s->wregs, 0, ESP_REGS);
872     s->tchi_written = 0;
873     s->ti_size = 0;
874     fifo8_reset(&s->fifo);
875     fifo8_reset(&s->cmdfifo);
876     s->dma = 0;
877     s->do_cmd = 0;
878     s->dma_cb = NULL;
879 
880     s->rregs[ESP_CFG1] = 7;
881 }
882 
883 static void esp_soft_reset(ESPState *s)
884 {
885     qemu_irq_lower(s->irq);
886     qemu_irq_lower(s->irq_data);
887     esp_hard_reset(s);
888 }
889 
890 static void parent_esp_reset(ESPState *s, int irq, int level)
891 {
892     if (level) {
893         esp_soft_reset(s);
894     }
895 }
896 
897 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
898 {
899     uint32_t val;
900 
901     switch (saddr) {
902     case ESP_FIFO:
903         if (s->dma_memory_read && s->dma_memory_write &&
904                 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
905             /* Data out.  */
906             qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
907             s->rregs[ESP_FIFO] = 0;
908         } else {
909             if ((s->rregs[ESP_RSTAT] & 0x7) == STAT_DI) {
910                 if (s->ti_size) {
911                     esp_do_nodma(s);
912                 } else {
913                     /*
914                      * The last byte of a non-DMA transfer has been read out
915                      * of the FIFO so switch to status phase
916                      */
917                     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
918                 }
919             }
920             s->rregs[ESP_FIFO] = esp_fifo_pop(&s->fifo);
921         }
922         val = s->rregs[ESP_FIFO];
923         break;
924     case ESP_RINTR:
925         /*
926          * Clear sequence step, interrupt register and all status bits
927          * except TC
928          */
929         val = s->rregs[ESP_RINTR];
930         s->rregs[ESP_RINTR] = 0;
931         s->rregs[ESP_RSTAT] &= ~STAT_TC;
932         /*
933          * According to the datasheet ESP_RSEQ should be cleared, but as the
934          * emulation currently defers information transfers to the next TI
935          * command leave it for now so that pedantic guests such as the old
936          * Linux 2.6 driver see the correct flags before the next SCSI phase
937          * transition.
938          *
939          * s->rregs[ESP_RSEQ] = SEQ_0;
940          */
941         esp_lower_irq(s);
942         break;
943     case ESP_TCHI:
944         /* Return the unique id if the value has never been written */
945         if (!s->tchi_written) {
946             val = s->chip_id;
947         } else {
948             val = s->rregs[saddr];
949         }
950         break;
951      case ESP_RFLAGS:
952         /* Bottom 5 bits indicate number of bytes in FIFO */
953         val = fifo8_num_used(&s->fifo);
954         break;
955     default:
956         val = s->rregs[saddr];
957         break;
958     }
959 
960     trace_esp_mem_readb(saddr, val);
961     return val;
962 }
963 
964 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
965 {
966     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
967     switch (saddr) {
968     case ESP_TCHI:
969         s->tchi_written = true;
970         /* fall through */
971     case ESP_TCLO:
972     case ESP_TCMID:
973         s->rregs[ESP_RSTAT] &= ~STAT_TC;
974         break;
975     case ESP_FIFO:
976         if (s->do_cmd) {
977             esp_fifo_push(&s->cmdfifo, val);
978 
979             /*
980              * If any unexpected message out/command phase data is
981              * transferred using non-DMA, raise the interrupt
982              */
983             if (s->rregs[ESP_CMD] == CMD_TI) {
984                 s->rregs[ESP_RINTR] |= INTR_BS;
985                 esp_raise_irq(s);
986             }
987         } else {
988             esp_fifo_push(&s->fifo, val);
989         }
990         break;
991     case ESP_CMD:
992         s->rregs[saddr] = val;
993         if (val & CMD_DMA) {
994             s->dma = 1;
995             /* Reload DMA counter.  */
996             if (esp_get_stc(s) == 0) {
997                 esp_set_tc(s, 0x10000);
998             } else {
999                 esp_set_tc(s, esp_get_stc(s));
1000             }
1001         } else {
1002             s->dma = 0;
1003         }
1004         switch (val & CMD_CMD) {
1005         case CMD_NOP:
1006             trace_esp_mem_writeb_cmd_nop(val);
1007             break;
1008         case CMD_FLUSH:
1009             trace_esp_mem_writeb_cmd_flush(val);
1010             fifo8_reset(&s->fifo);
1011             break;
1012         case CMD_RESET:
1013             trace_esp_mem_writeb_cmd_reset(val);
1014             esp_soft_reset(s);
1015             break;
1016         case CMD_BUSRESET:
1017             trace_esp_mem_writeb_cmd_bus_reset(val);
1018             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
1019                 s->rregs[ESP_RINTR] |= INTR_RST;
1020                 esp_raise_irq(s);
1021             }
1022             break;
1023         case CMD_TI:
1024             trace_esp_mem_writeb_cmd_ti(val);
1025             handle_ti(s);
1026             break;
1027         case CMD_ICCS:
1028             trace_esp_mem_writeb_cmd_iccs(val);
1029             write_response(s);
1030             s->rregs[ESP_RINTR] |= INTR_FC;
1031             s->rregs[ESP_RSTAT] |= STAT_MI;
1032             break;
1033         case CMD_MSGACC:
1034             trace_esp_mem_writeb_cmd_msgacc(val);
1035             s->rregs[ESP_RINTR] |= INTR_DC;
1036             s->rregs[ESP_RSEQ] = 0;
1037             s->rregs[ESP_RFLAGS] = 0;
1038             esp_raise_irq(s);
1039             break;
1040         case CMD_PAD:
1041             trace_esp_mem_writeb_cmd_pad(val);
1042             s->rregs[ESP_RSTAT] = STAT_TC;
1043             s->rregs[ESP_RINTR] |= INTR_FC;
1044             s->rregs[ESP_RSEQ] = 0;
1045             break;
1046         case CMD_SATN:
1047             trace_esp_mem_writeb_cmd_satn(val);
1048             break;
1049         case CMD_RSTATN:
1050             trace_esp_mem_writeb_cmd_rstatn(val);
1051             break;
1052         case CMD_SEL:
1053             trace_esp_mem_writeb_cmd_sel(val);
1054             handle_s_without_atn(s);
1055             break;
1056         case CMD_SELATN:
1057             trace_esp_mem_writeb_cmd_selatn(val);
1058             handle_satn(s);
1059             break;
1060         case CMD_SELATNS:
1061             trace_esp_mem_writeb_cmd_selatns(val);
1062             handle_satn_stop(s);
1063             break;
1064         case CMD_ENSEL:
1065             trace_esp_mem_writeb_cmd_ensel(val);
1066             s->rregs[ESP_RINTR] = 0;
1067             break;
1068         case CMD_DISSEL:
1069             trace_esp_mem_writeb_cmd_dissel(val);
1070             s->rregs[ESP_RINTR] = 0;
1071             esp_raise_irq(s);
1072             break;
1073         default:
1074             trace_esp_error_unhandled_command(val);
1075             break;
1076         }
1077         break;
1078     case ESP_WBUSID ... ESP_WSYNO:
1079         break;
1080     case ESP_CFG1:
1081     case ESP_CFG2: case ESP_CFG3:
1082     case ESP_RES3: case ESP_RES4:
1083         s->rregs[saddr] = val;
1084         break;
1085     case ESP_WCCF ... ESP_WTEST:
1086         break;
1087     default:
1088         trace_esp_error_invalid_write(val, saddr);
1089         return;
1090     }
1091     s->wregs[saddr] = val;
1092 }
1093 
1094 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1095                             unsigned size, bool is_write,
1096                             MemTxAttrs attrs)
1097 {
1098     return (size == 1) || (is_write && size == 4);
1099 }
1100 
1101 static bool esp_is_before_version_5(void *opaque, int version_id)
1102 {
1103     ESPState *s = ESP(opaque);
1104 
1105     version_id = MIN(version_id, s->mig_version_id);
1106     return version_id < 5;
1107 }
1108 
1109 static bool esp_is_version_5(void *opaque, int version_id)
1110 {
1111     ESPState *s = ESP(opaque);
1112 
1113     version_id = MIN(version_id, s->mig_version_id);
1114     return version_id == 5;
1115 }
1116 
1117 int esp_pre_save(void *opaque)
1118 {
1119     ESPState *s = ESP(object_resolve_path_component(
1120                       OBJECT(opaque), "esp"));
1121 
1122     s->mig_version_id = vmstate_esp.version_id;
1123     return 0;
1124 }
1125 
1126 static int esp_post_load(void *opaque, int version_id)
1127 {
1128     ESPState *s = ESP(opaque);
1129     int len, i;
1130 
1131     version_id = MIN(version_id, s->mig_version_id);
1132 
1133     if (version_id < 5) {
1134         esp_set_tc(s, s->mig_dma_left);
1135 
1136         /* Migrate ti_buf to fifo */
1137         len = s->mig_ti_wptr - s->mig_ti_rptr;
1138         for (i = 0; i < len; i++) {
1139             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1140         }
1141 
1142         /* Migrate cmdbuf to cmdfifo */
1143         for (i = 0; i < s->mig_cmdlen; i++) {
1144             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1145         }
1146     }
1147 
1148     s->mig_version_id = vmstate_esp.version_id;
1149     return 0;
1150 }
1151 
1152 const VMStateDescription vmstate_esp = {
1153     .name = "esp",
1154     .version_id = 5,
1155     .minimum_version_id = 3,
1156     .post_load = esp_post_load,
1157     .fields = (VMStateField[]) {
1158         VMSTATE_BUFFER(rregs, ESPState),
1159         VMSTATE_BUFFER(wregs, ESPState),
1160         VMSTATE_INT32(ti_size, ESPState),
1161         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1162         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1163         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1164         VMSTATE_UINT32(status, ESPState),
1165         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1166                             esp_is_before_version_5),
1167         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1168                           esp_is_before_version_5),
1169         VMSTATE_UINT32(dma, ESPState),
1170         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1171                               esp_is_before_version_5, 0, 16),
1172         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1173                               esp_is_before_version_5, 16,
1174                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
1175         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1176         VMSTATE_UINT32(do_cmd, ESPState),
1177         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1178         VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5),
1179         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1180         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1181         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1182         VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5),
1183         VMSTATE_END_OF_LIST()
1184     },
1185 };
1186 
1187 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1188                                  uint64_t val, unsigned int size)
1189 {
1190     SysBusESPState *sysbus = opaque;
1191     ESPState *s = ESP(&sysbus->esp);
1192     uint32_t saddr;
1193 
1194     saddr = addr >> sysbus->it_shift;
1195     esp_reg_write(s, saddr, val);
1196 }
1197 
1198 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1199                                     unsigned int size)
1200 {
1201     SysBusESPState *sysbus = opaque;
1202     ESPState *s = ESP(&sysbus->esp);
1203     uint32_t saddr;
1204 
1205     saddr = addr >> sysbus->it_shift;
1206     return esp_reg_read(s, saddr);
1207 }
1208 
1209 static const MemoryRegionOps sysbus_esp_mem_ops = {
1210     .read = sysbus_esp_mem_read,
1211     .write = sysbus_esp_mem_write,
1212     .endianness = DEVICE_NATIVE_ENDIAN,
1213     .valid.accepts = esp_mem_accepts,
1214 };
1215 
1216 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1217                                   uint64_t val, unsigned int size)
1218 {
1219     SysBusESPState *sysbus = opaque;
1220     ESPState *s = ESP(&sysbus->esp);
1221 
1222     trace_esp_pdma_write(size);
1223 
1224     switch (size) {
1225     case 1:
1226         esp_pdma_write(s, val);
1227         break;
1228     case 2:
1229         esp_pdma_write(s, val >> 8);
1230         esp_pdma_write(s, val);
1231         break;
1232     }
1233     s->pdma_cb(s);
1234 }
1235 
1236 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1237                                      unsigned int size)
1238 {
1239     SysBusESPState *sysbus = opaque;
1240     ESPState *s = ESP(&sysbus->esp);
1241     uint64_t val = 0;
1242 
1243     trace_esp_pdma_read(size);
1244 
1245     switch (size) {
1246     case 1:
1247         val = esp_pdma_read(s);
1248         break;
1249     case 2:
1250         val = esp_pdma_read(s);
1251         val = (val << 8) | esp_pdma_read(s);
1252         break;
1253     }
1254     if (fifo8_num_used(&s->fifo) < 2) {
1255         s->pdma_cb(s);
1256     }
1257     return val;
1258 }
1259 
1260 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1261     .read = sysbus_esp_pdma_read,
1262     .write = sysbus_esp_pdma_write,
1263     .endianness = DEVICE_NATIVE_ENDIAN,
1264     .valid.min_access_size = 1,
1265     .valid.max_access_size = 4,
1266     .impl.min_access_size = 1,
1267     .impl.max_access_size = 2,
1268 };
1269 
1270 static const struct SCSIBusInfo esp_scsi_info = {
1271     .tcq = false,
1272     .max_target = ESP_MAX_DEVS,
1273     .max_lun = 7,
1274 
1275     .transfer_data = esp_transfer_data,
1276     .complete = esp_command_complete,
1277     .cancel = esp_request_cancelled
1278 };
1279 
1280 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1281 {
1282     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1283     ESPState *s = ESP(&sysbus->esp);
1284 
1285     switch (irq) {
1286     case 0:
1287         parent_esp_reset(s, irq, level);
1288         break;
1289     case 1:
1290         esp_dma_enable(opaque, irq, level);
1291         break;
1292     }
1293 }
1294 
1295 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1296 {
1297     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1298     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1299     ESPState *s = ESP(&sysbus->esp);
1300 
1301     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1302         return;
1303     }
1304 
1305     sysbus_init_irq(sbd, &s->irq);
1306     sysbus_init_irq(sbd, &s->irq_data);
1307     assert(sysbus->it_shift != -1);
1308 
1309     s->chip_id = TCHI_FAS100A;
1310     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1311                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1312     sysbus_init_mmio(sbd, &sysbus->iomem);
1313     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1314                           sysbus, "esp-pdma", 4);
1315     sysbus_init_mmio(sbd, &sysbus->pdma);
1316 
1317     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1318 
1319     scsi_bus_new(&s->bus, sizeof(s->bus), dev, &esp_scsi_info, NULL);
1320 }
1321 
1322 static void sysbus_esp_hard_reset(DeviceState *dev)
1323 {
1324     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1325     ESPState *s = ESP(&sysbus->esp);
1326 
1327     esp_hard_reset(s);
1328 }
1329 
1330 static void sysbus_esp_init(Object *obj)
1331 {
1332     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1333 
1334     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1335 }
1336 
1337 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1338     .name = "sysbusespscsi",
1339     .version_id = 2,
1340     .minimum_version_id = 1,
1341     .pre_save = esp_pre_save,
1342     .fields = (VMStateField[]) {
1343         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1344         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1345         VMSTATE_END_OF_LIST()
1346     }
1347 };
1348 
1349 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1350 {
1351     DeviceClass *dc = DEVICE_CLASS(klass);
1352 
1353     dc->realize = sysbus_esp_realize;
1354     dc->reset = sysbus_esp_hard_reset;
1355     dc->vmsd = &vmstate_sysbus_esp_scsi;
1356     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1357 }
1358 
1359 static const TypeInfo sysbus_esp_info = {
1360     .name          = TYPE_SYSBUS_ESP,
1361     .parent        = TYPE_SYS_BUS_DEVICE,
1362     .instance_init = sysbus_esp_init,
1363     .instance_size = sizeof(SysBusESPState),
1364     .class_init    = sysbus_esp_class_init,
1365 };
1366 
1367 static void esp_finalize(Object *obj)
1368 {
1369     ESPState *s = ESP(obj);
1370 
1371     fifo8_destroy(&s->fifo);
1372     fifo8_destroy(&s->cmdfifo);
1373 }
1374 
1375 static void esp_init(Object *obj)
1376 {
1377     ESPState *s = ESP(obj);
1378 
1379     fifo8_create(&s->fifo, ESP_FIFO_SZ);
1380     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1381 }
1382 
1383 static void esp_class_init(ObjectClass *klass, void *data)
1384 {
1385     DeviceClass *dc = DEVICE_CLASS(klass);
1386 
1387     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1388     dc->user_creatable = false;
1389     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1390 }
1391 
1392 static const TypeInfo esp_info = {
1393     .name = TYPE_ESP,
1394     .parent = TYPE_DEVICE,
1395     .instance_init = esp_init,
1396     .instance_finalize = esp_finalize,
1397     .instance_size = sizeof(ESPState),
1398     .class_init = esp_class_init,
1399 };
1400 
1401 static void esp_register_types(void)
1402 {
1403     type_register_static(&sysbus_esp_info);
1404     type_register_static(&esp_info);
1405 }
1406 
1407 type_init(esp_register_types)
1408