xref: /qemu/hw/scsi/esp.c (revision 4ca2ba6fb0bdf1099a742a361d1e2ad227c3bbf4)
1 /*
2  * QEMU ESP/NCR53C9x emulation
3  *
4  * Copyright (c) 2005-2006 Fabrice Bellard
5  * Copyright (c) 2012 Herve Poussineau
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "hw/irq.h"
30 #include "hw/scsi/esp.h"
31 #include "trace.h"
32 #include "qemu/log.h"
33 #include "qemu/module.h"
34 
35 /*
36  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
37  * also produced as NCR89C100. See
38  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
39  * and
40  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
41  *
42  * On Macintosh Quadra it is a NCR53C96.
43  */
44 
45 static void esp_raise_irq(ESPState *s)
46 {
47     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
48         s->rregs[ESP_RSTAT] |= STAT_INT;
49         qemu_irq_raise(s->irq);
50         trace_esp_raise_irq();
51     }
52 }
53 
54 static void esp_lower_irq(ESPState *s)
55 {
56     if (s->rregs[ESP_RSTAT] & STAT_INT) {
57         s->rregs[ESP_RSTAT] &= ~STAT_INT;
58         qemu_irq_lower(s->irq);
59         trace_esp_lower_irq();
60     }
61 }
62 
63 static void esp_raise_drq(ESPState *s)
64 {
65     qemu_irq_raise(s->irq_data);
66     trace_esp_raise_drq();
67 }
68 
69 static void esp_lower_drq(ESPState *s)
70 {
71     qemu_irq_lower(s->irq_data);
72     trace_esp_lower_drq();
73 }
74 
75 void esp_dma_enable(ESPState *s, int irq, int level)
76 {
77     if (level) {
78         s->dma_enabled = 1;
79         trace_esp_dma_enable();
80         if (s->dma_cb) {
81             s->dma_cb(s);
82             s->dma_cb = NULL;
83         }
84     } else {
85         trace_esp_dma_disable();
86         s->dma_enabled = 0;
87     }
88 }
89 
90 void esp_request_cancelled(SCSIRequest *req)
91 {
92     ESPState *s = req->hba_private;
93 
94     if (req == s->current_req) {
95         scsi_req_unref(s->current_req);
96         s->current_req = NULL;
97         s->current_dev = NULL;
98     }
99 }
100 
101 static void set_pdma(ESPState *s, enum pdma_origin_id origin,
102                      uint32_t index, uint32_t len)
103 {
104     s->pdma_origin = origin;
105     s->pdma_start = index;
106     s->pdma_cur = index;
107     s->pdma_len = len;
108 }
109 
110 static uint8_t *get_pdma_buf(ESPState *s)
111 {
112     switch (s->pdma_origin) {
113     case PDMA:
114         return s->pdma_buf;
115     case TI:
116         return s->ti_buf;
117     case CMD:
118         return s->cmdbuf;
119     case ASYNC:
120         return s->async_buf;
121     }
122     return NULL;
123 }
124 
125 static int get_cmd_cb(ESPState *s)
126 {
127     int target;
128 
129     target = s->wregs[ESP_WBUSID] & BUSID_DID;
130 
131     s->ti_size = 0;
132     s->ti_rptr = 0;
133     s->ti_wptr = 0;
134 
135     if (s->current_req) {
136         /* Started a new command before the old one finished.  Cancel it.  */
137         scsi_req_cancel(s->current_req);
138         s->async_len = 0;
139     }
140 
141     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
142     if (!s->current_dev) {
143         /* No such drive */
144         s->rregs[ESP_RSTAT] = 0;
145         s->rregs[ESP_RINTR] = INTR_DC;
146         s->rregs[ESP_RSEQ] = SEQ_0;
147         esp_raise_irq(s);
148         return -1;
149     }
150     return 0;
151 }
152 
153 static uint32_t get_cmd(ESPState *s, uint8_t *buf, uint8_t buflen)
154 {
155     uint32_t dmalen;
156     int target;
157 
158     target = s->wregs[ESP_WBUSID] & BUSID_DID;
159     if (s->dma) {
160         dmalen = s->rregs[ESP_TCLO];
161         dmalen |= s->rregs[ESP_TCMID] << 8;
162         dmalen |= s->rregs[ESP_TCHI] << 16;
163         if (dmalen > buflen) {
164             return 0;
165         }
166         if (s->dma_memory_read) {
167             s->dma_memory_read(s->dma_opaque, buf, dmalen);
168         } else {
169             memcpy(s->pdma_buf, buf, dmalen);
170             set_pdma(s, PDMA, 0, dmalen);
171             esp_raise_drq(s);
172             return 0;
173         }
174     } else {
175         dmalen = s->ti_size;
176         if (dmalen > TI_BUFSZ) {
177             return 0;
178         }
179         memcpy(buf, s->ti_buf, dmalen);
180         buf[0] = buf[2] >> 5;
181     }
182     trace_esp_get_cmd(dmalen, target);
183 
184     if (get_cmd_cb(s) < 0) {
185         return 0;
186     }
187     return dmalen;
188 }
189 
190 static void do_busid_cmd(ESPState *s, uint8_t *buf, uint8_t busid)
191 {
192     int32_t datalen;
193     int lun;
194     SCSIDevice *current_lun;
195 
196     trace_esp_do_busid_cmd(busid);
197     lun = busid & 7;
198     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun);
199     s->current_req = scsi_req_new(current_lun, 0, lun, buf, s);
200     datalen = scsi_req_enqueue(s->current_req);
201     s->ti_size = datalen;
202     if (datalen != 0) {
203         s->rregs[ESP_RSTAT] = STAT_TC;
204         s->dma_left = 0;
205         s->dma_counter = 0;
206         if (datalen > 0) {
207             s->rregs[ESP_RSTAT] |= STAT_DI;
208         } else {
209             s->rregs[ESP_RSTAT] |= STAT_DO;
210         }
211         scsi_req_continue(s->current_req);
212     }
213     s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
214     s->rregs[ESP_RSEQ] = SEQ_CD;
215     esp_raise_irq(s);
216 }
217 
218 static void do_cmd(ESPState *s, uint8_t *buf)
219 {
220     uint8_t busid = buf[0];
221 
222     do_busid_cmd(s, &buf[1], busid);
223 }
224 
225 static void satn_pdma_cb(ESPState *s)
226 {
227     if (get_cmd_cb(s) < 0) {
228         return;
229     }
230     if (s->pdma_cur != s->pdma_start) {
231         do_cmd(s, get_pdma_buf(s) + s->pdma_start);
232     }
233 }
234 
235 static void handle_satn(ESPState *s)
236 {
237     uint8_t buf[32];
238     int len;
239 
240     if (s->dma && !s->dma_enabled) {
241         s->dma_cb = handle_satn;
242         return;
243     }
244     s->pdma_cb = satn_pdma_cb;
245     len = get_cmd(s, buf, sizeof(buf));
246     if (len) {
247         do_cmd(s, buf);
248     }
249 }
250 
251 static void s_without_satn_pdma_cb(ESPState *s)
252 {
253     if (get_cmd_cb(s) < 0) {
254         return;
255     }
256     if (s->pdma_cur != s->pdma_start) {
257         do_busid_cmd(s, get_pdma_buf(s) + s->pdma_start, 0);
258     }
259 }
260 
261 static void handle_s_without_atn(ESPState *s)
262 {
263     uint8_t buf[32];
264     int len;
265 
266     if (s->dma && !s->dma_enabled) {
267         s->dma_cb = handle_s_without_atn;
268         return;
269     }
270     s->pdma_cb = s_without_satn_pdma_cb;
271     len = get_cmd(s, buf, sizeof(buf));
272     if (len) {
273         do_busid_cmd(s, buf, 0);
274     }
275 }
276 
277 static void satn_stop_pdma_cb(ESPState *s)
278 {
279     if (get_cmd_cb(s) < 0) {
280         return;
281     }
282     s->cmdlen = s->pdma_cur - s->pdma_start;
283     if (s->cmdlen) {
284         trace_esp_handle_satn_stop(s->cmdlen);
285         s->do_cmd = 1;
286         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
287         s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
288         s->rregs[ESP_RSEQ] = SEQ_CD;
289         esp_raise_irq(s);
290     }
291 }
292 
293 static void handle_satn_stop(ESPState *s)
294 {
295     if (s->dma && !s->dma_enabled) {
296         s->dma_cb = handle_satn_stop;
297         return;
298     }
299     s->pdma_cb = satn_stop_pdma_cb;
300     s->cmdlen = get_cmd(s, s->cmdbuf, sizeof(s->cmdbuf));
301     if (s->cmdlen) {
302         trace_esp_handle_satn_stop(s->cmdlen);
303         s->do_cmd = 1;
304         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
305         s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
306         s->rregs[ESP_RSEQ] = SEQ_CD;
307         esp_raise_irq(s);
308     }
309 }
310 
311 static void write_response_pdma_cb(ESPState *s)
312 {
313     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
314     s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
315     s->rregs[ESP_RSEQ] = SEQ_CD;
316     esp_raise_irq(s);
317 }
318 
319 static void write_response(ESPState *s)
320 {
321     trace_esp_write_response(s->status);
322     s->ti_buf[0] = s->status;
323     s->ti_buf[1] = 0;
324     if (s->dma) {
325         if (s->dma_memory_write) {
326             s->dma_memory_write(s->dma_opaque, s->ti_buf, 2);
327             s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
328             s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
329             s->rregs[ESP_RSEQ] = SEQ_CD;
330         } else {
331             set_pdma(s, TI, 0, 2);
332             s->pdma_cb = write_response_pdma_cb;
333             esp_raise_drq(s);
334             return;
335         }
336     } else {
337         s->ti_size = 2;
338         s->ti_rptr = 0;
339         s->ti_wptr = 2;
340         s->rregs[ESP_RFLAGS] = 2;
341     }
342     esp_raise_irq(s);
343 }
344 
345 static void esp_dma_done(ESPState *s)
346 {
347     s->rregs[ESP_RSTAT] |= STAT_TC;
348     s->rregs[ESP_RINTR] = INTR_BS;
349     s->rregs[ESP_RSEQ] = 0;
350     s->rregs[ESP_RFLAGS] = 0;
351     s->rregs[ESP_TCLO] = 0;
352     s->rregs[ESP_TCMID] = 0;
353     s->rregs[ESP_TCHI] = 0;
354     esp_raise_irq(s);
355 }
356 
357 static void do_dma_pdma_cb(ESPState *s)
358 {
359     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
360     int len = s->pdma_cur - s->pdma_start;
361     if (s->do_cmd) {
362         s->ti_size = 0;
363         s->cmdlen = 0;
364         s->do_cmd = 0;
365         do_cmd(s, s->cmdbuf);
366         return;
367     }
368     s->dma_left -= len;
369     s->async_buf += len;
370     s->async_len -= len;
371     if (to_device) {
372         s->ti_size += len;
373     } else {
374         s->ti_size -= len;
375     }
376     if (s->async_len == 0) {
377         scsi_req_continue(s->current_req);
378         /*
379          * If there is still data to be read from the device then
380          * complete the DMA operation immediately.  Otherwise defer
381          * until the scsi layer has completed.
382          */
383         if (to_device || s->dma_left != 0 || s->ti_size == 0) {
384             return;
385         }
386     }
387 
388     /* Partially filled a scsi buffer. Complete immediately.  */
389     esp_dma_done(s);
390 }
391 
392 static void esp_do_dma(ESPState *s)
393 {
394     uint32_t len;
395     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
396 
397     len = s->dma_left;
398     if (s->do_cmd) {
399         /*
400          * handle_ti_cmd() case: esp_do_dma() is called only from
401          * handle_ti_cmd() with do_cmd != NULL (see the assert())
402          */
403         trace_esp_do_dma(s->cmdlen, len);
404         assert(s->cmdlen <= sizeof(s->cmdbuf) &&
405                len <= sizeof(s->cmdbuf) - s->cmdlen);
406         if (s->dma_memory_read) {
407             s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
408         } else {
409             set_pdma(s, CMD, s->cmdlen, len);
410             s->pdma_cb = do_dma_pdma_cb;
411             esp_raise_drq(s);
412             return;
413         }
414         trace_esp_handle_ti_cmd(s->cmdlen);
415         s->ti_size = 0;
416         s->cmdlen = 0;
417         s->do_cmd = 0;
418         do_cmd(s, s->cmdbuf);
419         return;
420     }
421     if (s->async_len == 0) {
422         /* Defer until data is available.  */
423         return;
424     }
425     if (len > s->async_len) {
426         len = s->async_len;
427     }
428     if (to_device) {
429         if (s->dma_memory_read) {
430             s->dma_memory_read(s->dma_opaque, s->async_buf, len);
431         } else {
432             set_pdma(s, ASYNC, 0, len);
433             s->pdma_cb = do_dma_pdma_cb;
434             esp_raise_drq(s);
435             return;
436         }
437     } else {
438         if (s->dma_memory_write) {
439             s->dma_memory_write(s->dma_opaque, s->async_buf, len);
440         } else {
441             set_pdma(s, ASYNC, 0, len);
442             s->pdma_cb = do_dma_pdma_cb;
443             esp_raise_drq(s);
444             return;
445         }
446     }
447     s->dma_left -= len;
448     s->async_buf += len;
449     s->async_len -= len;
450     if (to_device) {
451         s->ti_size += len;
452     } else {
453         s->ti_size -= len;
454     }
455     if (s->async_len == 0) {
456         scsi_req_continue(s->current_req);
457         /*
458          * If there is still data to be read from the device then
459          * complete the DMA operation immediately.  Otherwise defer
460          * until the scsi layer has completed.
461          */
462         if (to_device || s->dma_left != 0 || s->ti_size == 0) {
463             return;
464         }
465     }
466 
467     /* Partially filled a scsi buffer. Complete immediately.  */
468     esp_dma_done(s);
469 }
470 
471 static void esp_report_command_complete(ESPState *s, uint32_t status)
472 {
473     trace_esp_command_complete();
474     if (s->ti_size != 0) {
475         trace_esp_command_complete_unexpected();
476     }
477     s->ti_size = 0;
478     s->dma_left = 0;
479     s->async_len = 0;
480     if (status) {
481         trace_esp_command_complete_fail();
482     }
483     s->status = status;
484     s->rregs[ESP_RSTAT] = STAT_ST;
485     esp_dma_done(s);
486     if (s->current_req) {
487         scsi_req_unref(s->current_req);
488         s->current_req = NULL;
489         s->current_dev = NULL;
490     }
491 }
492 
493 void esp_command_complete(SCSIRequest *req, size_t resid)
494 {
495     ESPState *s = req->hba_private;
496 
497     if (s->rregs[ESP_RSTAT] & STAT_INT) {
498         /*
499          * Defer handling command complete until the previous
500          * interrupt has been handled.
501          */
502         trace_esp_command_complete_deferred();
503         s->deferred_status = req->status;
504         s->deferred_complete = true;
505         return;
506     }
507     esp_report_command_complete(s, req->status);
508 }
509 
510 void esp_transfer_data(SCSIRequest *req, uint32_t len)
511 {
512     ESPState *s = req->hba_private;
513 
514     assert(!s->do_cmd);
515     trace_esp_transfer_data(s->dma_left, s->ti_size);
516     s->async_len = len;
517     s->async_buf = scsi_req_get_buf(req);
518     if (s->dma_left) {
519         esp_do_dma(s);
520     } else if (s->dma_counter != 0 && s->ti_size <= 0) {
521         /*
522          * If this was the last part of a DMA transfer then the
523          * completion interrupt is deferred to here.
524          */
525         esp_dma_done(s);
526     }
527 }
528 
529 static void handle_ti(ESPState *s)
530 {
531     uint32_t dmalen, minlen;
532 
533     if (s->dma && !s->dma_enabled) {
534         s->dma_cb = handle_ti;
535         return;
536     }
537 
538     dmalen = s->rregs[ESP_TCLO];
539     dmalen |= s->rregs[ESP_TCMID] << 8;
540     dmalen |= s->rregs[ESP_TCHI] << 16;
541     if (dmalen == 0) {
542         dmalen = 0x10000;
543     }
544     s->dma_counter = dmalen;
545 
546     if (s->do_cmd) {
547         minlen = (dmalen < ESP_CMDBUF_SZ) ? dmalen : ESP_CMDBUF_SZ;
548     } else if (s->ti_size < 0) {
549         minlen = (dmalen < -s->ti_size) ? dmalen : -s->ti_size;
550     } else {
551         minlen = (dmalen < s->ti_size) ? dmalen : s->ti_size;
552     }
553     trace_esp_handle_ti(minlen);
554     if (s->dma) {
555         s->dma_left = minlen;
556         s->rregs[ESP_RSTAT] &= ~STAT_TC;
557         esp_do_dma(s);
558     } else if (s->do_cmd) {
559         trace_esp_handle_ti_cmd(s->cmdlen);
560         s->ti_size = 0;
561         s->cmdlen = 0;
562         s->do_cmd = 0;
563         do_cmd(s, s->cmdbuf);
564     }
565 }
566 
567 void esp_hard_reset(ESPState *s)
568 {
569     memset(s->rregs, 0, ESP_REGS);
570     memset(s->wregs, 0, ESP_REGS);
571     s->tchi_written = 0;
572     s->ti_size = 0;
573     s->ti_rptr = 0;
574     s->ti_wptr = 0;
575     s->dma = 0;
576     s->do_cmd = 0;
577     s->dma_cb = NULL;
578 
579     s->rregs[ESP_CFG1] = 7;
580 }
581 
582 static void esp_soft_reset(ESPState *s)
583 {
584     qemu_irq_lower(s->irq);
585     qemu_irq_lower(s->irq_data);
586     esp_hard_reset(s);
587 }
588 
589 static void parent_esp_reset(ESPState *s, int irq, int level)
590 {
591     if (level) {
592         esp_soft_reset(s);
593     }
594 }
595 
596 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
597 {
598     uint32_t val;
599 
600     switch (saddr) {
601     case ESP_FIFO:
602         if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
603             /* Data out.  */
604             qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
605             s->rregs[ESP_FIFO] = 0;
606         } else if (s->ti_rptr < s->ti_wptr) {
607             s->ti_size--;
608             s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
609         }
610         if (s->ti_rptr == s->ti_wptr) {
611             s->ti_rptr = 0;
612             s->ti_wptr = 0;
613         }
614         val = s->rregs[ESP_FIFO];
615         break;
616     case ESP_RINTR:
617         /*
618          * Clear sequence step, interrupt register and all status bits
619          * except TC
620          */
621         val = s->rregs[ESP_RINTR];
622         s->rregs[ESP_RINTR] = 0;
623         s->rregs[ESP_RSTAT] &= ~STAT_TC;
624         s->rregs[ESP_RSEQ] = SEQ_CD;
625         esp_lower_irq(s);
626         if (s->deferred_complete) {
627             esp_report_command_complete(s, s->deferred_status);
628             s->deferred_complete = false;
629         }
630         break;
631     case ESP_TCHI:
632         /* Return the unique id if the value has never been written */
633         if (!s->tchi_written) {
634             val = s->chip_id;
635         } else {
636             val = s->rregs[saddr];
637         }
638         break;
639     default:
640         val = s->rregs[saddr];
641         break;
642     }
643 
644     trace_esp_mem_readb(saddr, val);
645     return val;
646 }
647 
648 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
649 {
650     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
651     switch (saddr) {
652     case ESP_TCHI:
653         s->tchi_written = true;
654         /* fall through */
655     case ESP_TCLO:
656     case ESP_TCMID:
657         s->rregs[ESP_RSTAT] &= ~STAT_TC;
658         break;
659     case ESP_FIFO:
660         if (s->do_cmd) {
661             if (s->cmdlen < ESP_CMDBUF_SZ) {
662                 s->cmdbuf[s->cmdlen++] = val & 0xff;
663             } else {
664                 trace_esp_error_fifo_overrun();
665             }
666         } else if (s->ti_wptr == TI_BUFSZ - 1) {
667             trace_esp_error_fifo_overrun();
668         } else {
669             s->ti_size++;
670             s->ti_buf[s->ti_wptr++] = val & 0xff;
671         }
672         break;
673     case ESP_CMD:
674         s->rregs[saddr] = val;
675         if (val & CMD_DMA) {
676             s->dma = 1;
677             /* Reload DMA counter.  */
678             s->rregs[ESP_TCLO] = s->wregs[ESP_TCLO];
679             s->rregs[ESP_TCMID] = s->wregs[ESP_TCMID];
680             s->rregs[ESP_TCHI] = s->wregs[ESP_TCHI];
681         } else {
682             s->dma = 0;
683         }
684         switch (val & CMD_CMD) {
685         case CMD_NOP:
686             trace_esp_mem_writeb_cmd_nop(val);
687             break;
688         case CMD_FLUSH:
689             trace_esp_mem_writeb_cmd_flush(val);
690             /*s->ti_size = 0;*/
691             s->rregs[ESP_RINTR] = INTR_FC;
692             s->rregs[ESP_RSEQ] = 0;
693             s->rregs[ESP_RFLAGS] = 0;
694             break;
695         case CMD_RESET:
696             trace_esp_mem_writeb_cmd_reset(val);
697             esp_soft_reset(s);
698             break;
699         case CMD_BUSRESET:
700             trace_esp_mem_writeb_cmd_bus_reset(val);
701             s->rregs[ESP_RINTR] = INTR_RST;
702             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
703                 esp_raise_irq(s);
704             }
705             break;
706         case CMD_TI:
707             trace_esp_mem_writeb_cmd_ti(val);
708             handle_ti(s);
709             break;
710         case CMD_ICCS:
711             trace_esp_mem_writeb_cmd_iccs(val);
712             write_response(s);
713             s->rregs[ESP_RINTR] = INTR_FC;
714             s->rregs[ESP_RSTAT] |= STAT_MI;
715             break;
716         case CMD_MSGACC:
717             trace_esp_mem_writeb_cmd_msgacc(val);
718             s->rregs[ESP_RINTR] = INTR_DC;
719             s->rregs[ESP_RSEQ] = 0;
720             s->rregs[ESP_RFLAGS] = 0;
721             esp_raise_irq(s);
722             break;
723         case CMD_PAD:
724             trace_esp_mem_writeb_cmd_pad(val);
725             s->rregs[ESP_RSTAT] = STAT_TC;
726             s->rregs[ESP_RINTR] = INTR_FC;
727             s->rregs[ESP_RSEQ] = 0;
728             break;
729         case CMD_SATN:
730             trace_esp_mem_writeb_cmd_satn(val);
731             break;
732         case CMD_RSTATN:
733             trace_esp_mem_writeb_cmd_rstatn(val);
734             break;
735         case CMD_SEL:
736             trace_esp_mem_writeb_cmd_sel(val);
737             handle_s_without_atn(s);
738             break;
739         case CMD_SELATN:
740             trace_esp_mem_writeb_cmd_selatn(val);
741             handle_satn(s);
742             break;
743         case CMD_SELATNS:
744             trace_esp_mem_writeb_cmd_selatns(val);
745             handle_satn_stop(s);
746             break;
747         case CMD_ENSEL:
748             trace_esp_mem_writeb_cmd_ensel(val);
749             s->rregs[ESP_RINTR] = 0;
750             break;
751         case CMD_DISSEL:
752             trace_esp_mem_writeb_cmd_dissel(val);
753             s->rregs[ESP_RINTR] = 0;
754             esp_raise_irq(s);
755             break;
756         default:
757             trace_esp_error_unhandled_command(val);
758             break;
759         }
760         break;
761     case ESP_WBUSID ... ESP_WSYNO:
762         break;
763     case ESP_CFG1:
764     case ESP_CFG2: case ESP_CFG3:
765     case ESP_RES3: case ESP_RES4:
766         s->rregs[saddr] = val;
767         break;
768     case ESP_WCCF ... ESP_WTEST:
769         break;
770     default:
771         trace_esp_error_invalid_write(val, saddr);
772         return;
773     }
774     s->wregs[saddr] = val;
775 }
776 
777 static bool esp_mem_accepts(void *opaque, hwaddr addr,
778                             unsigned size, bool is_write,
779                             MemTxAttrs attrs)
780 {
781     return (size == 1) || (is_write && size == 4);
782 }
783 
784 static bool esp_pdma_needed(void *opaque)
785 {
786     ESPState *s = opaque;
787     return s->dma_memory_read == NULL && s->dma_memory_write == NULL &&
788            s->dma_enabled;
789 }
790 
791 static const VMStateDescription vmstate_esp_pdma = {
792     .name = "esp/pdma",
793     .version_id = 1,
794     .minimum_version_id = 1,
795     .needed = esp_pdma_needed,
796     .fields = (VMStateField[]) {
797         VMSTATE_BUFFER(pdma_buf, ESPState),
798         VMSTATE_INT32(pdma_origin, ESPState),
799         VMSTATE_UINT32(pdma_len, ESPState),
800         VMSTATE_UINT32(pdma_start, ESPState),
801         VMSTATE_UINT32(pdma_cur, ESPState),
802         VMSTATE_END_OF_LIST()
803     }
804 };
805 
806 static int esp_pre_save(void *opaque)
807 {
808     ESPState *s = ESP(opaque);
809 
810     s->mig_version_id = vmstate_esp.version_id;
811     return 0;
812 }
813 
814 static int esp_post_load(void *opaque, int version_id)
815 {
816     ESPState *s = ESP(opaque);
817 
818     s->mig_version_id = vmstate_esp.version_id;
819     return 0;
820 }
821 
822 const VMStateDescription vmstate_esp = {
823     .name = "esp",
824     .version_id = 5,
825     .minimum_version_id = 3,
826     .pre_save = esp_pre_save,
827     .post_load = esp_post_load,
828     .fields = (VMStateField[]) {
829         VMSTATE_BUFFER(rregs, ESPState),
830         VMSTATE_BUFFER(wregs, ESPState),
831         VMSTATE_INT32(ti_size, ESPState),
832         VMSTATE_UINT32(ti_rptr, ESPState),
833         VMSTATE_UINT32(ti_wptr, ESPState),
834         VMSTATE_BUFFER(ti_buf, ESPState),
835         VMSTATE_UINT32(status, ESPState),
836         VMSTATE_UINT32(deferred_status, ESPState),
837         VMSTATE_BOOL(deferred_complete, ESPState),
838         VMSTATE_UINT32(dma, ESPState),
839         VMSTATE_PARTIAL_BUFFER(cmdbuf, ESPState, 16),
840         VMSTATE_BUFFER_START_MIDDLE_V(cmdbuf, ESPState, 16, 4),
841         VMSTATE_UINT32(cmdlen, ESPState),
842         VMSTATE_UINT32(do_cmd, ESPState),
843         VMSTATE_UINT32(dma_left, ESPState),
844         VMSTATE_END_OF_LIST()
845     },
846     .subsections = (const VMStateDescription * []) {
847         &vmstate_esp_pdma,
848         NULL
849     }
850 };
851 
852 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
853                                  uint64_t val, unsigned int size)
854 {
855     SysBusESPState *sysbus = opaque;
856     ESPState *s = ESP(&sysbus->esp);
857     uint32_t saddr;
858 
859     saddr = addr >> sysbus->it_shift;
860     esp_reg_write(s, saddr, val);
861 }
862 
863 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
864                                     unsigned int size)
865 {
866     SysBusESPState *sysbus = opaque;
867     ESPState *s = ESP(&sysbus->esp);
868     uint32_t saddr;
869 
870     saddr = addr >> sysbus->it_shift;
871     return esp_reg_read(s, saddr);
872 }
873 
874 static const MemoryRegionOps sysbus_esp_mem_ops = {
875     .read = sysbus_esp_mem_read,
876     .write = sysbus_esp_mem_write,
877     .endianness = DEVICE_NATIVE_ENDIAN,
878     .valid.accepts = esp_mem_accepts,
879 };
880 
881 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
882                                   uint64_t val, unsigned int size)
883 {
884     SysBusESPState *sysbus = opaque;
885     ESPState *s = ESP(&sysbus->esp);
886     uint32_t dmalen;
887     uint8_t *buf = get_pdma_buf(s);
888 
889     trace_esp_pdma_write(size);
890 
891     dmalen = s->rregs[ESP_TCLO];
892     dmalen |= s->rregs[ESP_TCMID] << 8;
893     dmalen |= s->rregs[ESP_TCHI] << 16;
894     if (dmalen == 0 || s->pdma_len == 0) {
895         return;
896     }
897     switch (size) {
898     case 1:
899         buf[s->pdma_cur++] = val;
900         s->pdma_len--;
901         dmalen--;
902         break;
903     case 2:
904         buf[s->pdma_cur++] = val >> 8;
905         buf[s->pdma_cur++] = val;
906         s->pdma_len -= 2;
907         dmalen -= 2;
908         break;
909     }
910     s->rregs[ESP_TCLO] = dmalen & 0xff;
911     s->rregs[ESP_TCMID] = dmalen >> 8;
912     s->rregs[ESP_TCHI] = dmalen >> 16;
913     if (s->pdma_len == 0 && s->pdma_cb) {
914         esp_lower_drq(s);
915         s->pdma_cb(s);
916         s->pdma_cb = NULL;
917     }
918 }
919 
920 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
921                                      unsigned int size)
922 {
923     SysBusESPState *sysbus = opaque;
924     ESPState *s = ESP(&sysbus->esp);
925     uint8_t *buf = get_pdma_buf(s);
926     uint64_t val = 0;
927 
928     trace_esp_pdma_read(size);
929 
930     if (s->pdma_len == 0) {
931         return 0;
932     }
933     switch (size) {
934     case 1:
935         val = buf[s->pdma_cur++];
936         s->pdma_len--;
937         break;
938     case 2:
939         val = buf[s->pdma_cur++];
940         val = (val << 8) | buf[s->pdma_cur++];
941         s->pdma_len -= 2;
942         break;
943     }
944 
945     if (s->pdma_len == 0 && s->pdma_cb) {
946         esp_lower_drq(s);
947         s->pdma_cb(s);
948         s->pdma_cb = NULL;
949     }
950     return val;
951 }
952 
953 static const MemoryRegionOps sysbus_esp_pdma_ops = {
954     .read = sysbus_esp_pdma_read,
955     .write = sysbus_esp_pdma_write,
956     .endianness = DEVICE_NATIVE_ENDIAN,
957     .valid.min_access_size = 1,
958     .valid.max_access_size = 2,
959 };
960 
961 static const struct SCSIBusInfo esp_scsi_info = {
962     .tcq = false,
963     .max_target = ESP_MAX_DEVS,
964     .max_lun = 7,
965 
966     .transfer_data = esp_transfer_data,
967     .complete = esp_command_complete,
968     .cancel = esp_request_cancelled
969 };
970 
971 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
972 {
973     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
974     ESPState *s = ESP(&sysbus->esp);
975 
976     switch (irq) {
977     case 0:
978         parent_esp_reset(s, irq, level);
979         break;
980     case 1:
981         esp_dma_enable(opaque, irq, level);
982         break;
983     }
984 }
985 
986 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
987 {
988     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
989     SysBusESPState *sysbus = SYSBUS_ESP(dev);
990     ESPState *s = ESP(&sysbus->esp);
991 
992     if (!qdev_realize(DEVICE(s), NULL, errp)) {
993         return;
994     }
995 
996     sysbus_init_irq(sbd, &s->irq);
997     sysbus_init_irq(sbd, &s->irq_data);
998     assert(sysbus->it_shift != -1);
999 
1000     s->chip_id = TCHI_FAS100A;
1001     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1002                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1003     sysbus_init_mmio(sbd, &sysbus->iomem);
1004     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1005                           sysbus, "esp-pdma", 2);
1006     sysbus_init_mmio(sbd, &sysbus->pdma);
1007 
1008     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1009 
1010     scsi_bus_new(&s->bus, sizeof(s->bus), dev, &esp_scsi_info, NULL);
1011 }
1012 
1013 static void sysbus_esp_hard_reset(DeviceState *dev)
1014 {
1015     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1016     ESPState *s = ESP(&sysbus->esp);
1017 
1018     esp_hard_reset(s);
1019 }
1020 
1021 static void sysbus_esp_init(Object *obj)
1022 {
1023     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1024 
1025     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1026 }
1027 
1028 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1029     .name = "sysbusespscsi",
1030     .version_id = 2,
1031     .minimum_version_id = 1,
1032     .fields = (VMStateField[]) {
1033         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1034         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1035         VMSTATE_END_OF_LIST()
1036     }
1037 };
1038 
1039 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1040 {
1041     DeviceClass *dc = DEVICE_CLASS(klass);
1042 
1043     dc->realize = sysbus_esp_realize;
1044     dc->reset = sysbus_esp_hard_reset;
1045     dc->vmsd = &vmstate_sysbus_esp_scsi;
1046     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1047 }
1048 
1049 static const TypeInfo sysbus_esp_info = {
1050     .name          = TYPE_SYSBUS_ESP,
1051     .parent        = TYPE_SYS_BUS_DEVICE,
1052     .instance_init = sysbus_esp_init,
1053     .instance_size = sizeof(SysBusESPState),
1054     .class_init    = sysbus_esp_class_init,
1055 };
1056 
1057 static void esp_class_init(ObjectClass *klass, void *data)
1058 {
1059     DeviceClass *dc = DEVICE_CLASS(klass);
1060 
1061     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1062     dc->user_creatable = false;
1063     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1064 }
1065 
1066 static const TypeInfo esp_info = {
1067     .name = TYPE_ESP,
1068     .parent = TYPE_DEVICE,
1069     .instance_size = sizeof(ESPState),
1070     .class_init = esp_class_init,
1071 };
1072 
1073 static void esp_register_types(void)
1074 {
1075     type_register_static(&sysbus_esp_info);
1076     type_register_static(&esp_info);
1077 }
1078 
1079 type_init(esp_register_types)
1080