xref: /qemu/hw/scsi/esp.c (revision af947a3d853a235943681a00f07f3081f5143cc3)
1 /*
2  * QEMU ESP/NCR53C9x emulation
3  *
4  * Copyright (c) 2005-2006 Fabrice Bellard
5  * Copyright (c) 2012 Herve Poussineau
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "hw/sysbus.h"
28 #include "migration/vmstate.h"
29 #include "hw/irq.h"
30 #include "hw/scsi/esp.h"
31 #include "trace.h"
32 #include "qemu/log.h"
33 #include "qemu/module.h"
34 
35 /*
36  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
37  * also produced as NCR89C100. See
38  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
39  * and
40  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
41  *
42  * On Macintosh Quadra it is a NCR53C96.
43  */
44 
45 static void esp_raise_irq(ESPState *s)
46 {
47     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
48         s->rregs[ESP_RSTAT] |= STAT_INT;
49         qemu_irq_raise(s->irq);
50         trace_esp_raise_irq();
51     }
52 }
53 
54 static void esp_lower_irq(ESPState *s)
55 {
56     if (s->rregs[ESP_RSTAT] & STAT_INT) {
57         s->rregs[ESP_RSTAT] &= ~STAT_INT;
58         qemu_irq_lower(s->irq);
59         trace_esp_lower_irq();
60     }
61 }
62 
63 static void esp_raise_drq(ESPState *s)
64 {
65     qemu_irq_raise(s->irq_data);
66     trace_esp_raise_drq();
67 }
68 
69 static void esp_lower_drq(ESPState *s)
70 {
71     qemu_irq_lower(s->irq_data);
72     trace_esp_lower_drq();
73 }
74 
75 void esp_dma_enable(ESPState *s, int irq, int level)
76 {
77     if (level) {
78         s->dma_enabled = 1;
79         trace_esp_dma_enable();
80         if (s->dma_cb) {
81             s->dma_cb(s);
82             s->dma_cb = NULL;
83         }
84     } else {
85         trace_esp_dma_disable();
86         s->dma_enabled = 0;
87     }
88 }
89 
90 void esp_request_cancelled(SCSIRequest *req)
91 {
92     ESPState *s = req->hba_private;
93 
94     if (req == s->current_req) {
95         scsi_req_unref(s->current_req);
96         s->current_req = NULL;
97         s->current_dev = NULL;
98         s->async_len = 0;
99     }
100 }
101 
102 static void esp_fifo_push(Fifo8 *fifo, uint8_t val)
103 {
104     if (fifo8_num_used(fifo) == fifo->capacity) {
105         trace_esp_error_fifo_overrun();
106         return;
107     }
108 
109     fifo8_push(fifo, val);
110 }
111 
112 static uint8_t esp_fifo_pop(Fifo8 *fifo)
113 {
114     if (fifo8_is_empty(fifo)) {
115         return 0;
116     }
117 
118     return fifo8_pop(fifo);
119 }
120 
121 static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen)
122 {
123     const uint8_t *buf;
124     uint32_t n;
125 
126     if (maxlen == 0) {
127         return 0;
128     }
129 
130     buf = fifo8_pop_buf(fifo, maxlen, &n);
131     if (dest) {
132         memcpy(dest, buf, n);
133     }
134 
135     return n;
136 }
137 
138 static uint32_t esp_get_tc(ESPState *s)
139 {
140     uint32_t dmalen;
141 
142     dmalen = s->rregs[ESP_TCLO];
143     dmalen |= s->rregs[ESP_TCMID] << 8;
144     dmalen |= s->rregs[ESP_TCHI] << 16;
145 
146     return dmalen;
147 }
148 
149 static void esp_set_tc(ESPState *s, uint32_t dmalen)
150 {
151     s->rregs[ESP_TCLO] = dmalen;
152     s->rregs[ESP_TCMID] = dmalen >> 8;
153     s->rregs[ESP_TCHI] = dmalen >> 16;
154 }
155 
156 static uint32_t esp_get_stc(ESPState *s)
157 {
158     uint32_t dmalen;
159 
160     dmalen = s->wregs[ESP_TCLO];
161     dmalen |= s->wregs[ESP_TCMID] << 8;
162     dmalen |= s->wregs[ESP_TCHI] << 16;
163 
164     return dmalen;
165 }
166 
167 static uint8_t esp_pdma_read(ESPState *s)
168 {
169     uint8_t val;
170 
171     if (s->do_cmd) {
172         val = esp_fifo_pop(&s->cmdfifo);
173     } else {
174         val = esp_fifo_pop(&s->fifo);
175     }
176 
177     return val;
178 }
179 
180 static void esp_pdma_write(ESPState *s, uint8_t val)
181 {
182     uint32_t dmalen = esp_get_tc(s);
183 
184     if (dmalen == 0) {
185         return;
186     }
187 
188     if (s->do_cmd) {
189         esp_fifo_push(&s->cmdfifo, val);
190     } else {
191         esp_fifo_push(&s->fifo, val);
192     }
193 
194     dmalen--;
195     esp_set_tc(s, dmalen);
196 }
197 
198 static int esp_select(ESPState *s)
199 {
200     int target;
201 
202     target = s->wregs[ESP_WBUSID] & BUSID_DID;
203 
204     s->ti_size = 0;
205     fifo8_reset(&s->fifo);
206 
207     if (s->current_req) {
208         /* Started a new command before the old one finished.  Cancel it.  */
209         scsi_req_cancel(s->current_req);
210     }
211 
212     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
213     if (!s->current_dev) {
214         /* No such drive */
215         s->rregs[ESP_RSTAT] = 0;
216         s->rregs[ESP_RINTR] = INTR_DC;
217         s->rregs[ESP_RSEQ] = SEQ_0;
218         esp_raise_irq(s);
219         return -1;
220     }
221 
222     /*
223      * Note that we deliberately don't raise the IRQ here: this will be done
224      * either in do_busid_cmd() for DATA OUT transfers or by the deferred
225      * IRQ mechanism in esp_transfer_data() for DATA IN transfers
226      */
227     s->rregs[ESP_RINTR] |= INTR_FC;
228     s->rregs[ESP_RSEQ] = SEQ_CD;
229     return 0;
230 }
231 
232 static uint32_t get_cmd(ESPState *s, uint32_t maxlen)
233 {
234     uint8_t buf[ESP_CMDFIFO_SZ];
235     uint32_t dmalen, n;
236     int target;
237 
238     target = s->wregs[ESP_WBUSID] & BUSID_DID;
239     if (s->dma) {
240         dmalen = MIN(esp_get_tc(s), maxlen);
241         if (dmalen == 0) {
242             return 0;
243         }
244         if (s->dma_memory_read) {
245             s->dma_memory_read(s->dma_opaque, buf, dmalen);
246             dmalen = MIN(fifo8_num_free(&s->cmdfifo), dmalen);
247             fifo8_push_all(&s->cmdfifo, buf, dmalen);
248         } else {
249             if (esp_select(s) < 0) {
250                 fifo8_reset(&s->cmdfifo);
251                 return -1;
252             }
253             esp_raise_drq(s);
254             fifo8_reset(&s->cmdfifo);
255             return 0;
256         }
257     } else {
258         dmalen = MIN(fifo8_num_used(&s->fifo), maxlen);
259         if (dmalen == 0) {
260             return 0;
261         }
262         n = esp_fifo_pop_buf(&s->fifo, buf, dmalen);
263         if (n >= 3) {
264             buf[0] = buf[2] >> 5;
265         }
266         n = MIN(fifo8_num_free(&s->cmdfifo), n);
267         fifo8_push_all(&s->cmdfifo, buf, n);
268     }
269     trace_esp_get_cmd(dmalen, target);
270 
271     if (esp_select(s) < 0) {
272         fifo8_reset(&s->cmdfifo);
273         return -1;
274     }
275     return dmalen;
276 }
277 
278 static void do_busid_cmd(ESPState *s, uint8_t busid)
279 {
280     uint32_t cmdlen;
281     int32_t datalen;
282     int lun;
283     SCSIDevice *current_lun;
284     uint8_t buf[ESP_CMDFIFO_SZ];
285 
286     trace_esp_do_busid_cmd(busid);
287     lun = busid & 7;
288     cmdlen = fifo8_num_used(&s->cmdfifo);
289     if (!cmdlen || !s->current_dev) {
290         return;
291     }
292     esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen);
293 
294     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun);
295     s->current_req = scsi_req_new(current_lun, 0, lun, buf, s);
296     datalen = scsi_req_enqueue(s->current_req);
297     s->ti_size = datalen;
298     fifo8_reset(&s->cmdfifo);
299     if (datalen != 0) {
300         s->rregs[ESP_RSTAT] = STAT_TC;
301         s->rregs[ESP_RSEQ] = SEQ_CD;
302         s->ti_cmd = 0;
303         esp_set_tc(s, 0);
304         if (datalen > 0) {
305             /*
306              * Switch to DATA IN phase but wait until initial data xfer is
307              * complete before raising the command completion interrupt
308              */
309             s->data_in_ready = false;
310             s->rregs[ESP_RSTAT] |= STAT_DI;
311         } else {
312             s->rregs[ESP_RSTAT] |= STAT_DO;
313             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
314             esp_raise_irq(s);
315             esp_lower_drq(s);
316         }
317         scsi_req_continue(s->current_req);
318         return;
319     }
320 }
321 
322 static void do_cmd(ESPState *s)
323 {
324     uint8_t busid = esp_fifo_pop(&s->cmdfifo);
325     int len;
326 
327     s->cmdfifo_cdb_offset--;
328 
329     /* Ignore extended messages for now */
330     if (s->cmdfifo_cdb_offset) {
331         len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
332         esp_fifo_pop_buf(&s->cmdfifo, NULL, len);
333         s->cmdfifo_cdb_offset = 0;
334     }
335 
336     do_busid_cmd(s, busid);
337 }
338 
339 static void satn_pdma_cb(ESPState *s)
340 {
341     s->do_cmd = 0;
342     if (!fifo8_is_empty(&s->cmdfifo)) {
343         s->cmdfifo_cdb_offset = 1;
344         do_cmd(s);
345     }
346 }
347 
348 static void handle_satn(ESPState *s)
349 {
350     int32_t cmdlen;
351 
352     if (s->dma && !s->dma_enabled) {
353         s->dma_cb = handle_satn;
354         return;
355     }
356     s->pdma_cb = satn_pdma_cb;
357     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
358     if (cmdlen > 0) {
359         s->cmdfifo_cdb_offset = 1;
360         s->do_cmd = 0;
361         do_cmd(s);
362     } else if (cmdlen == 0) {
363         s->do_cmd = 1;
364         /* Target present, but no cmd yet - switch to command phase */
365         s->rregs[ESP_RSEQ] = SEQ_CD;
366         s->rregs[ESP_RSTAT] = STAT_CD;
367     }
368 }
369 
370 static void s_without_satn_pdma_cb(ESPState *s)
371 {
372     uint32_t len;
373 
374     s->do_cmd = 0;
375     len = fifo8_num_used(&s->cmdfifo);
376     if (len) {
377         s->cmdfifo_cdb_offset = 0;
378         do_busid_cmd(s, 0);
379     }
380 }
381 
382 static void handle_s_without_atn(ESPState *s)
383 {
384     int32_t cmdlen;
385 
386     if (s->dma && !s->dma_enabled) {
387         s->dma_cb = handle_s_without_atn;
388         return;
389     }
390     s->pdma_cb = s_without_satn_pdma_cb;
391     cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
392     if (cmdlen > 0) {
393         s->cmdfifo_cdb_offset = 0;
394         s->do_cmd = 0;
395         do_busid_cmd(s, 0);
396     } else if (cmdlen == 0) {
397         s->do_cmd = 1;
398         /* Target present, but no cmd yet - switch to command phase */
399         s->rregs[ESP_RSEQ] = SEQ_CD;
400         s->rregs[ESP_RSTAT] = STAT_CD;
401     }
402 }
403 
404 static void satn_stop_pdma_cb(ESPState *s)
405 {
406     s->do_cmd = 0;
407     if (!fifo8_is_empty(&s->cmdfifo)) {
408         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
409         s->do_cmd = 1;
410         s->cmdfifo_cdb_offset = 1;
411         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
412         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
413         s->rregs[ESP_RSEQ] = SEQ_CD;
414         esp_raise_irq(s);
415     }
416 }
417 
418 static void handle_satn_stop(ESPState *s)
419 {
420     int32_t cmdlen;
421 
422     if (s->dma && !s->dma_enabled) {
423         s->dma_cb = handle_satn_stop;
424         return;
425     }
426     s->pdma_cb = satn_stop_pdma_cb;
427     cmdlen = get_cmd(s, 1);
428     if (cmdlen > 0) {
429         trace_esp_handle_satn_stop(fifo8_num_used(&s->cmdfifo));
430         s->do_cmd = 1;
431         s->cmdfifo_cdb_offset = 1;
432         s->rregs[ESP_RSTAT] = STAT_MO;
433         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
434         s->rregs[ESP_RSEQ] = SEQ_MO;
435         esp_raise_irq(s);
436     } else if (cmdlen == 0) {
437         s->do_cmd = 1;
438         /* Target present, switch to message out phase */
439         s->rregs[ESP_RSEQ] = SEQ_MO;
440         s->rregs[ESP_RSTAT] = STAT_MO;
441     }
442 }
443 
444 static void write_response_pdma_cb(ESPState *s)
445 {
446     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
447     s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
448     s->rregs[ESP_RSEQ] = SEQ_CD;
449     esp_raise_irq(s);
450 }
451 
452 static void write_response(ESPState *s)
453 {
454     uint8_t buf[2];
455 
456     trace_esp_write_response(s->status);
457 
458     buf[0] = s->status;
459     buf[1] = 0;
460 
461     if (s->dma) {
462         if (s->dma_memory_write) {
463             s->dma_memory_write(s->dma_opaque, buf, 2);
464             s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
465             s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
466             s->rregs[ESP_RSEQ] = SEQ_CD;
467         } else {
468             s->pdma_cb = write_response_pdma_cb;
469             esp_raise_drq(s);
470             return;
471         }
472     } else {
473         fifo8_reset(&s->fifo);
474         fifo8_push_all(&s->fifo, buf, 2);
475         s->rregs[ESP_RFLAGS] = 2;
476     }
477     esp_raise_irq(s);
478 }
479 
480 static void esp_dma_done(ESPState *s)
481 {
482     s->rregs[ESP_RSTAT] |= STAT_TC;
483     s->rregs[ESP_RINTR] |= INTR_BS;
484     s->rregs[ESP_RFLAGS] = 0;
485     esp_set_tc(s, 0);
486     esp_raise_irq(s);
487 }
488 
489 static void do_dma_pdma_cb(ESPState *s)
490 {
491     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
492     int len;
493     uint32_t n;
494 
495     if (s->do_cmd) {
496         s->ti_size = 0;
497         s->do_cmd = 0;
498         do_cmd(s);
499         esp_lower_drq(s);
500         return;
501     }
502 
503     if (!s->current_req) {
504         return;
505     }
506 
507     if (to_device) {
508         /* Copy FIFO data to device */
509         len = MIN(s->async_len, ESP_FIFO_SZ);
510         len = MIN(len, fifo8_num_used(&s->fifo));
511         n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
512         s->async_buf += n;
513         s->async_len -= n;
514         s->ti_size += n;
515 
516         if (n < len) {
517             /* Unaligned accesses can cause FIFO wraparound */
518             len = len - n;
519             n = esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
520             s->async_buf += n;
521             s->async_len -= n;
522             s->ti_size += n;
523         }
524 
525         if (s->async_len == 0) {
526             scsi_req_continue(s->current_req);
527             return;
528         }
529 
530         if (esp_get_tc(s) == 0) {
531             esp_lower_drq(s);
532             esp_dma_done(s);
533         }
534 
535         return;
536     } else {
537         if (s->async_len == 0) {
538             /* Defer until the scsi layer has completed */
539             scsi_req_continue(s->current_req);
540             s->data_in_ready = false;
541             return;
542         }
543 
544         if (esp_get_tc(s) != 0) {
545             /* Copy device data to FIFO */
546             len = MIN(s->async_len, esp_get_tc(s));
547             len = MIN(len, fifo8_num_free(&s->fifo));
548             fifo8_push_all(&s->fifo, s->async_buf, len);
549             s->async_buf += len;
550             s->async_len -= len;
551             s->ti_size -= len;
552             esp_set_tc(s, esp_get_tc(s) - len);
553 
554             if (esp_get_tc(s) == 0) {
555                 /* Indicate transfer to FIFO is complete */
556                  s->rregs[ESP_RSTAT] |= STAT_TC;
557             }
558             return;
559         }
560 
561         /* Partially filled a scsi buffer. Complete immediately.  */
562         esp_lower_drq(s);
563         esp_dma_done(s);
564     }
565 }
566 
567 static void esp_do_dma(ESPState *s)
568 {
569     uint32_t len, cmdlen;
570     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
571     uint8_t buf[ESP_CMDFIFO_SZ];
572 
573     len = esp_get_tc(s);
574     if (s->do_cmd) {
575         /*
576          * handle_ti_cmd() case: esp_do_dma() is called only from
577          * handle_ti_cmd() with do_cmd != NULL (see the assert())
578          */
579         cmdlen = fifo8_num_used(&s->cmdfifo);
580         trace_esp_do_dma(cmdlen, len);
581         if (s->dma_memory_read) {
582             len = MIN(len, fifo8_num_free(&s->cmdfifo));
583             s->dma_memory_read(s->dma_opaque, buf, len);
584             fifo8_push_all(&s->cmdfifo, buf, len);
585         } else {
586             s->pdma_cb = do_dma_pdma_cb;
587             esp_raise_drq(s);
588             return;
589         }
590         trace_esp_handle_ti_cmd(cmdlen);
591         s->ti_size = 0;
592         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
593             /* No command received */
594             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
595                 return;
596             }
597 
598             /* Command has been received */
599             s->do_cmd = 0;
600             do_cmd(s);
601         } else {
602             /*
603              * Extra message out bytes received: update cmdfifo_cdb_offset
604              * and then switch to commmand phase
605              */
606             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
607             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
608             s->rregs[ESP_RSEQ] = SEQ_CD;
609             s->rregs[ESP_RINTR] |= INTR_BS;
610             esp_raise_irq(s);
611         }
612         return;
613     }
614     if (!s->current_req) {
615         return;
616     }
617     if (s->async_len == 0) {
618         /* Defer until data is available.  */
619         return;
620     }
621     if (len > s->async_len) {
622         len = s->async_len;
623     }
624     if (to_device) {
625         if (s->dma_memory_read) {
626             s->dma_memory_read(s->dma_opaque, s->async_buf, len);
627         } else {
628             s->pdma_cb = do_dma_pdma_cb;
629             esp_raise_drq(s);
630             return;
631         }
632     } else {
633         if (s->dma_memory_write) {
634             s->dma_memory_write(s->dma_opaque, s->async_buf, len);
635         } else {
636             /* Adjust TC for any leftover data in the FIFO */
637             if (!fifo8_is_empty(&s->fifo)) {
638                 esp_set_tc(s, esp_get_tc(s) - fifo8_num_used(&s->fifo));
639             }
640 
641             /* Copy device data to FIFO */
642             len = MIN(len, fifo8_num_free(&s->fifo));
643             fifo8_push_all(&s->fifo, s->async_buf, len);
644             s->async_buf += len;
645             s->async_len -= len;
646             s->ti_size -= len;
647 
648             /*
649              * MacOS toolbox uses a TI length of 16 bytes for all commands, so
650              * commands shorter than this must be padded accordingly
651              */
652             if (len < esp_get_tc(s) && esp_get_tc(s) <= ESP_FIFO_SZ) {
653                 while (fifo8_num_used(&s->fifo) < ESP_FIFO_SZ) {
654                     esp_fifo_push(&s->fifo, 0);
655                     len++;
656                 }
657             }
658 
659             esp_set_tc(s, esp_get_tc(s) - len);
660             s->pdma_cb = do_dma_pdma_cb;
661             esp_raise_drq(s);
662 
663             /* Indicate transfer to FIFO is complete */
664             s->rregs[ESP_RSTAT] |= STAT_TC;
665             return;
666         }
667     }
668     esp_set_tc(s, esp_get_tc(s) - len);
669     s->async_buf += len;
670     s->async_len -= len;
671     if (to_device) {
672         s->ti_size += len;
673     } else {
674         s->ti_size -= len;
675     }
676     if (s->async_len == 0) {
677         scsi_req_continue(s->current_req);
678         /*
679          * If there is still data to be read from the device then
680          * complete the DMA operation immediately.  Otherwise defer
681          * until the scsi layer has completed.
682          */
683         if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
684             return;
685         }
686     }
687 
688     /* Partially filled a scsi buffer. Complete immediately.  */
689     esp_dma_done(s);
690     esp_lower_drq(s);
691 }
692 
693 static void esp_do_nodma(ESPState *s)
694 {
695     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
696     uint32_t cmdlen;
697     int len;
698 
699     if (s->do_cmd) {
700         cmdlen = fifo8_num_used(&s->cmdfifo);
701         trace_esp_handle_ti_cmd(cmdlen);
702         s->ti_size = 0;
703         if ((s->rregs[ESP_RSTAT] & 7) == STAT_CD) {
704             /* No command received */
705             if (s->cmdfifo_cdb_offset == fifo8_num_used(&s->cmdfifo)) {
706                 return;
707             }
708 
709             /* Command has been received */
710             s->do_cmd = 0;
711             do_cmd(s);
712         } else {
713             /*
714              * Extra message out bytes received: update cmdfifo_cdb_offset
715              * and then switch to commmand phase
716              */
717             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
718             s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
719             s->rregs[ESP_RSEQ] = SEQ_CD;
720             s->rregs[ESP_RINTR] |= INTR_BS;
721             esp_raise_irq(s);
722         }
723         return;
724     }
725 
726     if (!s->current_req) {
727         return;
728     }
729 
730     if (s->async_len == 0) {
731         /* Defer until data is available.  */
732         return;
733     }
734 
735     if (to_device) {
736         len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
737         esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
738         s->async_buf += len;
739         s->async_len -= len;
740         s->ti_size += len;
741     } else {
742         len = MIN(s->ti_size, s->async_len);
743         len = MIN(len, fifo8_num_free(&s->fifo));
744         fifo8_push_all(&s->fifo, s->async_buf, len);
745         s->async_buf += len;
746         s->async_len -= len;
747         s->ti_size -= len;
748     }
749 
750     if (s->async_len == 0) {
751         scsi_req_continue(s->current_req);
752 
753         if (to_device || s->ti_size == 0) {
754             return;
755         }
756     }
757 
758     s->rregs[ESP_RINTR] |= INTR_BS;
759     esp_raise_irq(s);
760 }
761 
762 void esp_command_complete(SCSIRequest *req, size_t resid)
763 {
764     ESPState *s = req->hba_private;
765 
766     trace_esp_command_complete();
767     if (s->ti_size != 0) {
768         trace_esp_command_complete_unexpected();
769     }
770     s->ti_size = 0;
771     s->async_len = 0;
772     if (req->status) {
773         trace_esp_command_complete_fail();
774     }
775     s->status = req->status;
776     s->rregs[ESP_RSTAT] = STAT_ST;
777     esp_dma_done(s);
778     esp_lower_drq(s);
779     if (s->current_req) {
780         scsi_req_unref(s->current_req);
781         s->current_req = NULL;
782         s->current_dev = NULL;
783     }
784 }
785 
786 void esp_transfer_data(SCSIRequest *req, uint32_t len)
787 {
788     ESPState *s = req->hba_private;
789     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
790     uint32_t dmalen = esp_get_tc(s);
791 
792     assert(!s->do_cmd);
793     trace_esp_transfer_data(dmalen, s->ti_size);
794     s->async_len = len;
795     s->async_buf = scsi_req_get_buf(req);
796 
797     if (!to_device && !s->data_in_ready) {
798         /*
799          * Initial incoming data xfer is complete so raise command
800          * completion interrupt
801          */
802         s->data_in_ready = true;
803         s->rregs[ESP_RSTAT] |= STAT_TC;
804         s->rregs[ESP_RINTR] |= INTR_BS;
805         esp_raise_irq(s);
806 
807         /*
808          * If data is ready to transfer and the TI command has already
809          * been executed, start DMA immediately. Otherwise DMA will start
810          * when host sends the TI command
811          */
812         if (s->ti_size && (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA))) {
813             esp_do_dma(s);
814         }
815         return;
816     }
817 
818     if (s->ti_cmd == 0) {
819         /*
820          * Always perform the initial transfer upon reception of the next TI
821          * command to ensure the DMA/non-DMA status of the command is correct.
822          * It is not possible to use s->dma directly in the section below as
823          * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
824          * async data transfer is delayed then s->dma is set incorrectly.
825          */
826         return;
827     }
828 
829     if (s->ti_cmd & CMD_DMA) {
830         if (dmalen) {
831             esp_do_dma(s);
832         } else if (s->ti_size <= 0) {
833             /*
834              * If this was the last part of a DMA transfer then the
835              * completion interrupt is deferred to here.
836              */
837             esp_dma_done(s);
838             esp_lower_drq(s);
839         }
840     } else {
841         esp_do_nodma(s);
842     }
843 }
844 
845 static void handle_ti(ESPState *s)
846 {
847     uint32_t dmalen;
848 
849     if (s->dma && !s->dma_enabled) {
850         s->dma_cb = handle_ti;
851         return;
852     }
853 
854     s->ti_cmd = s->rregs[ESP_CMD];
855     if (s->dma) {
856         dmalen = esp_get_tc(s);
857         trace_esp_handle_ti(dmalen);
858         s->rregs[ESP_RSTAT] &= ~STAT_TC;
859         esp_do_dma(s);
860     } else {
861         trace_esp_handle_ti(s->ti_size);
862         esp_do_nodma(s);
863     }
864 }
865 
866 void esp_hard_reset(ESPState *s)
867 {
868     memset(s->rregs, 0, ESP_REGS);
869     memset(s->wregs, 0, ESP_REGS);
870     s->tchi_written = 0;
871     s->ti_size = 0;
872     fifo8_reset(&s->fifo);
873     fifo8_reset(&s->cmdfifo);
874     s->dma = 0;
875     s->do_cmd = 0;
876     s->dma_cb = NULL;
877 
878     s->rregs[ESP_CFG1] = 7;
879 }
880 
881 static void esp_soft_reset(ESPState *s)
882 {
883     qemu_irq_lower(s->irq);
884     qemu_irq_lower(s->irq_data);
885     esp_hard_reset(s);
886 }
887 
888 static void parent_esp_reset(ESPState *s, int irq, int level)
889 {
890     if (level) {
891         esp_soft_reset(s);
892     }
893 }
894 
895 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
896 {
897     uint32_t val;
898 
899     switch (saddr) {
900     case ESP_FIFO:
901         if (s->dma_memory_read && s->dma_memory_write &&
902                 (s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
903             /* Data out.  */
904             qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
905             s->rregs[ESP_FIFO] = 0;
906         } else {
907             s->rregs[ESP_FIFO] = esp_fifo_pop(&s->fifo);
908         }
909         val = s->rregs[ESP_FIFO];
910         break;
911     case ESP_RINTR:
912         /*
913          * Clear sequence step, interrupt register and all status bits
914          * except TC
915          */
916         val = s->rregs[ESP_RINTR];
917         s->rregs[ESP_RINTR] = 0;
918         s->rregs[ESP_RSTAT] &= ~STAT_TC;
919         /*
920          * According to the datasheet ESP_RSEQ should be cleared, but as the
921          * emulation currently defers information transfers to the next TI
922          * command leave it for now so that pedantic guests such as the old
923          * Linux 2.6 driver see the correct flags before the next SCSI phase
924          * transition.
925          *
926          * s->rregs[ESP_RSEQ] = SEQ_0;
927          */
928         esp_lower_irq(s);
929         break;
930     case ESP_TCHI:
931         /* Return the unique id if the value has never been written */
932         if (!s->tchi_written) {
933             val = s->chip_id;
934         } else {
935             val = s->rregs[saddr];
936         }
937         break;
938      case ESP_RFLAGS:
939         /* Bottom 5 bits indicate number of bytes in FIFO */
940         val = fifo8_num_used(&s->fifo);
941         break;
942     default:
943         val = s->rregs[saddr];
944         break;
945     }
946 
947     trace_esp_mem_readb(saddr, val);
948     return val;
949 }
950 
951 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
952 {
953     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
954     switch (saddr) {
955     case ESP_TCHI:
956         s->tchi_written = true;
957         /* fall through */
958     case ESP_TCLO:
959     case ESP_TCMID:
960         s->rregs[ESP_RSTAT] &= ~STAT_TC;
961         break;
962     case ESP_FIFO:
963         if (s->do_cmd) {
964             esp_fifo_push(&s->cmdfifo, val);
965         } else {
966             esp_fifo_push(&s->fifo, val);
967         }
968 
969         /* Non-DMA transfers raise an interrupt after every byte */
970         if (s->rregs[ESP_CMD] == CMD_TI) {
971             s->rregs[ESP_RINTR] |= INTR_FC | INTR_BS;
972             esp_raise_irq(s);
973         }
974         break;
975     case ESP_CMD:
976         s->rregs[saddr] = val;
977         if (val & CMD_DMA) {
978             s->dma = 1;
979             /* Reload DMA counter.  */
980             if (esp_get_stc(s) == 0) {
981                 esp_set_tc(s, 0x10000);
982             } else {
983                 esp_set_tc(s, esp_get_stc(s));
984             }
985         } else {
986             s->dma = 0;
987         }
988         switch (val & CMD_CMD) {
989         case CMD_NOP:
990             trace_esp_mem_writeb_cmd_nop(val);
991             break;
992         case CMD_FLUSH:
993             trace_esp_mem_writeb_cmd_flush(val);
994             fifo8_reset(&s->fifo);
995             break;
996         case CMD_RESET:
997             trace_esp_mem_writeb_cmd_reset(val);
998             esp_soft_reset(s);
999             break;
1000         case CMD_BUSRESET:
1001             trace_esp_mem_writeb_cmd_bus_reset(val);
1002             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
1003                 s->rregs[ESP_RINTR] |= INTR_RST;
1004                 esp_raise_irq(s);
1005             }
1006             break;
1007         case CMD_TI:
1008             trace_esp_mem_writeb_cmd_ti(val);
1009             handle_ti(s);
1010             break;
1011         case CMD_ICCS:
1012             trace_esp_mem_writeb_cmd_iccs(val);
1013             write_response(s);
1014             s->rregs[ESP_RINTR] |= INTR_FC;
1015             s->rregs[ESP_RSTAT] |= STAT_MI;
1016             break;
1017         case CMD_MSGACC:
1018             trace_esp_mem_writeb_cmd_msgacc(val);
1019             s->rregs[ESP_RINTR] |= INTR_DC;
1020             s->rregs[ESP_RSEQ] = 0;
1021             s->rregs[ESP_RFLAGS] = 0;
1022             esp_raise_irq(s);
1023             break;
1024         case CMD_PAD:
1025             trace_esp_mem_writeb_cmd_pad(val);
1026             s->rregs[ESP_RSTAT] = STAT_TC;
1027             s->rregs[ESP_RINTR] |= INTR_FC;
1028             s->rregs[ESP_RSEQ] = 0;
1029             break;
1030         case CMD_SATN:
1031             trace_esp_mem_writeb_cmd_satn(val);
1032             break;
1033         case CMD_RSTATN:
1034             trace_esp_mem_writeb_cmd_rstatn(val);
1035             break;
1036         case CMD_SEL:
1037             trace_esp_mem_writeb_cmd_sel(val);
1038             handle_s_without_atn(s);
1039             break;
1040         case CMD_SELATN:
1041             trace_esp_mem_writeb_cmd_selatn(val);
1042             handle_satn(s);
1043             break;
1044         case CMD_SELATNS:
1045             trace_esp_mem_writeb_cmd_selatns(val);
1046             handle_satn_stop(s);
1047             break;
1048         case CMD_ENSEL:
1049             trace_esp_mem_writeb_cmd_ensel(val);
1050             s->rregs[ESP_RINTR] = 0;
1051             break;
1052         case CMD_DISSEL:
1053             trace_esp_mem_writeb_cmd_dissel(val);
1054             s->rregs[ESP_RINTR] = 0;
1055             esp_raise_irq(s);
1056             break;
1057         default:
1058             trace_esp_error_unhandled_command(val);
1059             break;
1060         }
1061         break;
1062     case ESP_WBUSID ... ESP_WSYNO:
1063         break;
1064     case ESP_CFG1:
1065     case ESP_CFG2: case ESP_CFG3:
1066     case ESP_RES3: case ESP_RES4:
1067         s->rregs[saddr] = val;
1068         break;
1069     case ESP_WCCF ... ESP_WTEST:
1070         break;
1071     default:
1072         trace_esp_error_invalid_write(val, saddr);
1073         return;
1074     }
1075     s->wregs[saddr] = val;
1076 }
1077 
1078 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1079                             unsigned size, bool is_write,
1080                             MemTxAttrs attrs)
1081 {
1082     return (size == 1) || (is_write && size == 4);
1083 }
1084 
1085 static bool esp_is_before_version_5(void *opaque, int version_id)
1086 {
1087     ESPState *s = ESP(opaque);
1088 
1089     version_id = MIN(version_id, s->mig_version_id);
1090     return version_id < 5;
1091 }
1092 
1093 static bool esp_is_version_5(void *opaque, int version_id)
1094 {
1095     ESPState *s = ESP(opaque);
1096 
1097     version_id = MIN(version_id, s->mig_version_id);
1098     return version_id == 5;
1099 }
1100 
1101 int esp_pre_save(void *opaque)
1102 {
1103     ESPState *s = ESP(object_resolve_path_component(
1104                       OBJECT(opaque), "esp"));
1105 
1106     s->mig_version_id = vmstate_esp.version_id;
1107     return 0;
1108 }
1109 
1110 static int esp_post_load(void *opaque, int version_id)
1111 {
1112     ESPState *s = ESP(opaque);
1113     int len, i;
1114 
1115     version_id = MIN(version_id, s->mig_version_id);
1116 
1117     if (version_id < 5) {
1118         esp_set_tc(s, s->mig_dma_left);
1119 
1120         /* Migrate ti_buf to fifo */
1121         len = s->mig_ti_wptr - s->mig_ti_rptr;
1122         for (i = 0; i < len; i++) {
1123             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1124         }
1125 
1126         /* Migrate cmdbuf to cmdfifo */
1127         for (i = 0; i < s->mig_cmdlen; i++) {
1128             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1129         }
1130     }
1131 
1132     s->mig_version_id = vmstate_esp.version_id;
1133     return 0;
1134 }
1135 
1136 const VMStateDescription vmstate_esp = {
1137     .name = "esp",
1138     .version_id = 5,
1139     .minimum_version_id = 3,
1140     .post_load = esp_post_load,
1141     .fields = (VMStateField[]) {
1142         VMSTATE_BUFFER(rregs, ESPState),
1143         VMSTATE_BUFFER(wregs, ESPState),
1144         VMSTATE_INT32(ti_size, ESPState),
1145         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1146         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1147         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1148         VMSTATE_UINT32(status, ESPState),
1149         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1150                             esp_is_before_version_5),
1151         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1152                           esp_is_before_version_5),
1153         VMSTATE_UINT32(dma, ESPState),
1154         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1155                               esp_is_before_version_5, 0, 16),
1156         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1157                               esp_is_before_version_5, 16,
1158                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
1159         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1160         VMSTATE_UINT32(do_cmd, ESPState),
1161         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1162         VMSTATE_BOOL_TEST(data_in_ready, ESPState, esp_is_version_5),
1163         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1164         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1165         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1166         VMSTATE_UINT8_TEST(ti_cmd, ESPState, esp_is_version_5),
1167         VMSTATE_END_OF_LIST()
1168     },
1169 };
1170 
1171 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1172                                  uint64_t val, unsigned int size)
1173 {
1174     SysBusESPState *sysbus = opaque;
1175     ESPState *s = ESP(&sysbus->esp);
1176     uint32_t saddr;
1177 
1178     saddr = addr >> sysbus->it_shift;
1179     esp_reg_write(s, saddr, val);
1180 }
1181 
1182 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1183                                     unsigned int size)
1184 {
1185     SysBusESPState *sysbus = opaque;
1186     ESPState *s = ESP(&sysbus->esp);
1187     uint32_t saddr;
1188 
1189     saddr = addr >> sysbus->it_shift;
1190     return esp_reg_read(s, saddr);
1191 }
1192 
1193 static const MemoryRegionOps sysbus_esp_mem_ops = {
1194     .read = sysbus_esp_mem_read,
1195     .write = sysbus_esp_mem_write,
1196     .endianness = DEVICE_NATIVE_ENDIAN,
1197     .valid.accepts = esp_mem_accepts,
1198 };
1199 
1200 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1201                                   uint64_t val, unsigned int size)
1202 {
1203     SysBusESPState *sysbus = opaque;
1204     ESPState *s = ESP(&sysbus->esp);
1205     uint32_t dmalen;
1206 
1207     trace_esp_pdma_write(size);
1208 
1209     switch (size) {
1210     case 1:
1211         esp_pdma_write(s, val);
1212         break;
1213     case 2:
1214         esp_pdma_write(s, val >> 8);
1215         esp_pdma_write(s, val);
1216         break;
1217     }
1218     dmalen = esp_get_tc(s);
1219     if (dmalen == 0 || fifo8_num_free(&s->fifo) < 2) {
1220         s->pdma_cb(s);
1221     }
1222 }
1223 
1224 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1225                                      unsigned int size)
1226 {
1227     SysBusESPState *sysbus = opaque;
1228     ESPState *s = ESP(&sysbus->esp);
1229     uint64_t val = 0;
1230 
1231     trace_esp_pdma_read(size);
1232 
1233     switch (size) {
1234     case 1:
1235         val = esp_pdma_read(s);
1236         break;
1237     case 2:
1238         val = esp_pdma_read(s);
1239         val = (val << 8) | esp_pdma_read(s);
1240         break;
1241     }
1242     if (fifo8_num_used(&s->fifo) < 2) {
1243         s->pdma_cb(s);
1244     }
1245     return val;
1246 }
1247 
1248 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1249     .read = sysbus_esp_pdma_read,
1250     .write = sysbus_esp_pdma_write,
1251     .endianness = DEVICE_NATIVE_ENDIAN,
1252     .valid.min_access_size = 1,
1253     .valid.max_access_size = 4,
1254     .impl.min_access_size = 1,
1255     .impl.max_access_size = 2,
1256 };
1257 
1258 static const struct SCSIBusInfo esp_scsi_info = {
1259     .tcq = false,
1260     .max_target = ESP_MAX_DEVS,
1261     .max_lun = 7,
1262 
1263     .transfer_data = esp_transfer_data,
1264     .complete = esp_command_complete,
1265     .cancel = esp_request_cancelled
1266 };
1267 
1268 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1269 {
1270     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1271     ESPState *s = ESP(&sysbus->esp);
1272 
1273     switch (irq) {
1274     case 0:
1275         parent_esp_reset(s, irq, level);
1276         break;
1277     case 1:
1278         esp_dma_enable(opaque, irq, level);
1279         break;
1280     }
1281 }
1282 
1283 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1284 {
1285     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1286     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1287     ESPState *s = ESP(&sysbus->esp);
1288 
1289     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1290         return;
1291     }
1292 
1293     sysbus_init_irq(sbd, &s->irq);
1294     sysbus_init_irq(sbd, &s->irq_data);
1295     assert(sysbus->it_shift != -1);
1296 
1297     s->chip_id = TCHI_FAS100A;
1298     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1299                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1300     sysbus_init_mmio(sbd, &sysbus->iomem);
1301     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1302                           sysbus, "esp-pdma", 4);
1303     sysbus_init_mmio(sbd, &sysbus->pdma);
1304 
1305     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1306 
1307     scsi_bus_new(&s->bus, sizeof(s->bus), dev, &esp_scsi_info, NULL);
1308 }
1309 
1310 static void sysbus_esp_hard_reset(DeviceState *dev)
1311 {
1312     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1313     ESPState *s = ESP(&sysbus->esp);
1314 
1315     esp_hard_reset(s);
1316 }
1317 
1318 static void sysbus_esp_init(Object *obj)
1319 {
1320     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1321 
1322     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1323 }
1324 
1325 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1326     .name = "sysbusespscsi",
1327     .version_id = 2,
1328     .minimum_version_id = 1,
1329     .pre_save = esp_pre_save,
1330     .fields = (VMStateField[]) {
1331         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1332         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1333         VMSTATE_END_OF_LIST()
1334     }
1335 };
1336 
1337 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1338 {
1339     DeviceClass *dc = DEVICE_CLASS(klass);
1340 
1341     dc->realize = sysbus_esp_realize;
1342     dc->reset = sysbus_esp_hard_reset;
1343     dc->vmsd = &vmstate_sysbus_esp_scsi;
1344     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1345 }
1346 
1347 static const TypeInfo sysbus_esp_info = {
1348     .name          = TYPE_SYSBUS_ESP,
1349     .parent        = TYPE_SYS_BUS_DEVICE,
1350     .instance_init = sysbus_esp_init,
1351     .instance_size = sizeof(SysBusESPState),
1352     .class_init    = sysbus_esp_class_init,
1353 };
1354 
1355 static void esp_finalize(Object *obj)
1356 {
1357     ESPState *s = ESP(obj);
1358 
1359     fifo8_destroy(&s->fifo);
1360     fifo8_destroy(&s->cmdfifo);
1361 }
1362 
1363 static void esp_init(Object *obj)
1364 {
1365     ESPState *s = ESP(obj);
1366 
1367     fifo8_create(&s->fifo, ESP_FIFO_SZ);
1368     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1369 }
1370 
1371 static void esp_class_init(ObjectClass *klass, void *data)
1372 {
1373     DeviceClass *dc = DEVICE_CLASS(klass);
1374 
1375     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1376     dc->user_creatable = false;
1377     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1378 }
1379 
1380 static const TypeInfo esp_info = {
1381     .name = TYPE_ESP,
1382     .parent = TYPE_DEVICE,
1383     .instance_init = esp_init,
1384     .instance_finalize = esp_finalize,
1385     .instance_size = sizeof(ESPState),
1386     .class_init = esp_class_init,
1387 };
1388 
1389 static void esp_register_types(void)
1390 {
1391     type_register_static(&sysbus_esp_info);
1392     type_register_static(&esp_info);
1393 }
1394 
1395 type_init(esp_register_types)
1396