hw/scsi/esp.c

   1 /*
   2  * QEMU ESP/NCR53C9x emulation
   3  *
   4  * Copyright (c) 2005-2006 Fabrice Bellard
   5  * Copyright (c) 2012 Herve Poussineau
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "hw/sysbus.h"
  28 #include "migration/vmstate.h"
  29 #include "hw/irq.h"
  30 #include "hw/scsi/esp.h"
  31 #include "trace.h"
  32 #include "qemu/log.h"
  33 #include "qemu/module.h"
  34
  35 /*
  36  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
  37  * also produced as NCR89C100. See
  38  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  39  * and
  40  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
  41  *
  42  * On Macintosh Quadra it is a NCR53C96.
  43  */
  44
  45 static void esp_raise_irq(ESPState *s)
  46 {
  47     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
  48         s->rregs[ESP_RSTAT] |= STAT_INT;
  49         qemu_irq_raise(s->irq);
  50         trace_esp_raise_irq();
  51     }
  52 }
  53
  54 static void esp_lower_irq(ESPState *s)
  55 {
  56     if (s->rregs[ESP_RSTAT] & STAT_INT) {
  57         s->rregs[ESP_RSTAT] &= ~STAT_INT;
  58         qemu_irq_lower(s->irq);
  59         trace_esp_lower_irq();
  60     }
  61 }
  62
  63 static void esp_raise_drq(ESPState *s)
  64 {
  65     qemu_irq_raise(s->irq_data);
  66     trace_esp_raise_drq();
  67 }
  68
  69 static void esp_lower_drq(ESPState *s)
  70 {
  71     qemu_irq_lower(s->irq_data);
  72     trace_esp_lower_drq();
  73 }
  74
  75 void esp_dma_enable(ESPState *s, int irq, int level)
  76 {
  77     if (level) {
  78         s->dma_enabled = 1;
  79         trace_esp_dma_enable();
  80         if (s->dma_cb) {
  81             s->dma_cb(s);
  82             s->dma_cb = NULL;
  83         }
  84     } else {
  85         trace_esp_dma_disable();
  86         s->dma_enabled = 0;
  87     }
  88 }
  89
  90 void esp_request_cancelled(SCSIRequest *req)
  91 {
  92     ESPState *s = req->hba_private;
  93
  94     if (req == s->current_req) {
  95         scsi_req_unref(s->current_req);
  96         s->current_req = NULL;
  97         s->current_dev = NULL;
  98     }
  99 }
 100
 101 static uint32_t esp_get_tc(ESPState *s)
 102 {
 103     uint32_t dmalen;
 104
 105     dmalen = s->rregs[ESP_TCLO];
 106     dmalen |= s->rregs[ESP_TCMID] << 8;
 107     dmalen |= s->rregs[ESP_TCHI] << 16;
 108
 109     return dmalen;
 110 }
 111
 112 static void esp_set_tc(ESPState *s, uint32_t dmalen)
 113 {
 114     s->rregs[ESP_TCLO] = dmalen;
 115     s->rregs[ESP_TCMID] = dmalen >> 8;
 116     s->rregs[ESP_TCHI] = dmalen >> 16;
 117 }
 118
 119 static uint32_t esp_get_stc(ESPState *s)
 120 {
 121     uint32_t dmalen;
 122
 123     dmalen = s->wregs[ESP_TCLO];
 124     dmalen |= s->wregs[ESP_TCMID] << 8;
 125     dmalen |= s->wregs[ESP_TCHI] << 16;
 126
 127     return dmalen;
 128 }
 129
 130 static void set_pdma(ESPState *s, enum pdma_origin_id origin)
 131 {
 132     s->pdma_origin = origin;
 133 }
 134
 135 static uint8_t esp_pdma_read(ESPState *s)
 136 {
 137     uint32_t dmalen = esp_get_tc(s);
 138     uint8_t val;
 139
 140     if (dmalen == 0) {
 141         return 0;
 142     }
 143
 144     switch (s->pdma_origin) {
 145     case TI:
 146         if (s->do_cmd) {
 147             val = s->cmdbuf[s->cmdlen++];
 148         } else {
 149             val = s->ti_buf[s->ti_rptr++];
 150         }
 151         break;
 152     case ASYNC:
 153         val = s->async_buf[0];
 154         if (s->async_len > 0) {
 155             s->async_len--;
 156             s->async_buf++;
 157         }
 158         break;
 159     default:
 160         g_assert_not_reached();
 161     }
 162
 163     s->ti_size--;
 164     dmalen--;
 165     esp_set_tc(s, dmalen);
 166
 167     return val;
 168 }
 169
 170 static void esp_pdma_write(ESPState *s, uint8_t val)
 171 {
 172     uint32_t dmalen = esp_get_tc(s);
 173
 174     if (dmalen == 0) {
 175         return;
 176     }
 177
 178     switch (s->pdma_origin) {
 179     case TI:
 180         if (s->do_cmd) {
 181             s->cmdbuf[s->cmdlen++] = val;
 182         } else {
 183             s->ti_buf[s->ti_wptr++] = val;
 184         }
 185         break;
 186     case ASYNC:
 187         s->async_buf[0] = val;
 188         if (s->async_len > 0) {
 189             s->async_len--;
 190             s->async_buf++;
 191         }
 192         break;
 193     default:
 194         g_assert_not_reached();
 195     }
 196
 197     s->ti_size++;
 198     dmalen--;
 199     esp_set_tc(s, dmalen);
 200 }
 201
 202 static int esp_select(ESPState *s)
 203 {
 204     int target;
 205
 206     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 207
 208     s->ti_size = 0;
 209     s->ti_rptr = 0;
 210     s->ti_wptr = 0;
 211
 212     if (s->current_req) {
 213         /* Started a new command before the old one finished.  Cancel it.  */
 214         scsi_req_cancel(s->current_req);
 215         s->async_len = 0;
 216     }
 217
 218     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
 219     if (!s->current_dev) {
 220         /* No such drive */
 221         s->rregs[ESP_RSTAT] = 0;
 222         s->rregs[ESP_RINTR] = INTR_DC;
 223         s->rregs[ESP_RSEQ] = SEQ_0;
 224         esp_raise_irq(s);
 225         return -1;
 226     }
 227     return 0;
 228 }
 229
 230 static uint32_t get_cmd(ESPState *s)
 231 {
 232     uint8_t *buf = s->cmdbuf;
 233     uint32_t dmalen;
 234     int target;
 235
 236     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 237     if (s->dma) {
 238         dmalen = esp_get_tc(s);
 239         if (dmalen > ESP_CMDBUF_SZ) {
 240             return 0;
 241         }
 242         if (s->dma_memory_read) {
 243             s->dma_memory_read(s->dma_opaque, buf, dmalen);
 244         } else {
 245             set_pdma(s, TI);
 246             if (esp_select(s) < 0) {
 247                 return -1;
 248             }
 249             esp_raise_drq(s);
 250             return 0;
 251         }
 252     } else {
 253         dmalen = s->ti_size;
 254         if (dmalen > TI_BUFSZ) {
 255             return 0;
 256         }
 257         memcpy(buf, s->ti_buf, dmalen);
 258         buf[0] = buf[2] >> 5;
 259     }
 260     trace_esp_get_cmd(dmalen, target);
 261
 262     if (esp_select(s) < 0) {
 263         return -1;
 264     }
 265     return dmalen;
 266 }
 267
 268 static void do_busid_cmd(ESPState *s, uint8_t *buf, uint8_t busid)
 269 {
 270     int32_t datalen;
 271     int lun;
 272     SCSIDevice *current_lun;
 273
 274     trace_esp_do_busid_cmd(busid);
 275     lun = busid & 7;
 276     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, lun);
 277     s->current_req = scsi_req_new(current_lun, 0, lun, buf, s);
 278     datalen = scsi_req_enqueue(s->current_req);
 279     s->ti_size = datalen;
 280     if (datalen != 0) {
 281         s->rregs[ESP_RSTAT] = STAT_TC;
 282         esp_set_tc(s, 0);
 283         if (datalen > 0) {
 284             s->rregs[ESP_RSTAT] |= STAT_DI;
 285         } else {
 286             s->rregs[ESP_RSTAT] |= STAT_DO;
 287         }
 288         scsi_req_continue(s->current_req);
 289     }
 290     s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 291     s->rregs[ESP_RSEQ] = SEQ_CD;
 292     esp_raise_irq(s);
 293 }
 294
 295 static void do_cmd(ESPState *s)
 296 {
 297     uint8_t *buf = s->cmdbuf;
 298     uint8_t busid = buf[0];
 299
 300     do_busid_cmd(s, &buf[1], busid);
 301 }
 302
 303 static void satn_pdma_cb(ESPState *s)
 304 {
 305     s->do_cmd = 0;
 306     if (s->cmdlen) {
 307         do_cmd(s);
 308     }
 309 }
 310
 311 static void handle_satn(ESPState *s)
 312 {
 313     int32_t cmdlen;
 314
 315     if (s->dma && !s->dma_enabled) {
 316         s->dma_cb = handle_satn;
 317         return;
 318     }
 319     s->pdma_cb = satn_pdma_cb;
 320     cmdlen = get_cmd(s);
 321     if (cmdlen > 0) {
 322         s->cmdlen = cmdlen;
 323         do_cmd(s);
 324     } else if (cmdlen == 0) {
 325         s->cmdlen = 0;
 326         s->do_cmd = 1;
 327         /* Target present, but no cmd yet - switch to command phase */
 328         s->rregs[ESP_RSEQ] = SEQ_CD;
 329         s->rregs[ESP_RSTAT] = STAT_CD;
 330     }
 331 }
 332
 333 static void s_without_satn_pdma_cb(ESPState *s)
 334 {
 335     s->do_cmd = 0;
 336     if (s->cmdlen) {
 337         do_busid_cmd(s, s->cmdbuf, 0);
 338     }
 339 }
 340
 341 static void handle_s_without_atn(ESPState *s)
 342 {
 343     int32_t cmdlen;
 344
 345     if (s->dma && !s->dma_enabled) {
 346         s->dma_cb = handle_s_without_atn;
 347         return;
 348     }
 349     s->pdma_cb = s_without_satn_pdma_cb;
 350     cmdlen = get_cmd(s);
 351     if (cmdlen > 0) {
 352         s->cmdlen = cmdlen;
 353         do_busid_cmd(s, s->cmdbuf, 0);
 354     } else if (cmdlen == 0) {
 355         s->cmdlen = 0;
 356         s->do_cmd = 1;
 357         /* Target present, but no cmd yet - switch to command phase */
 358         s->rregs[ESP_RSEQ] = SEQ_CD;
 359         s->rregs[ESP_RSTAT] = STAT_CD;
 360     }
 361 }
 362
 363 static void satn_stop_pdma_cb(ESPState *s)
 364 {
 365     s->do_cmd = 0;
 366     if (s->cmdlen) {
 367         trace_esp_handle_satn_stop(s->cmdlen);
 368         s->do_cmd = 1;
 369         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 370         s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 371         s->rregs[ESP_RSEQ] = SEQ_CD;
 372         esp_raise_irq(s);
 373     }
 374 }
 375
 376 static void handle_satn_stop(ESPState *s)
 377 {
 378     int32_t cmdlen;
 379
 380     if (s->dma && !s->dma_enabled) {
 381         s->dma_cb = handle_satn_stop;
 382         return;
 383     }
 384     s->pdma_cb = satn_stop_pdma_cb;
 385     cmdlen = get_cmd(s);
 386     if (cmdlen > 0) {
 387         trace_esp_handle_satn_stop(s->cmdlen);
 388         s->cmdlen = cmdlen;
 389         s->do_cmd = 1;
 390         s->rregs[ESP_RSTAT] = STAT_TC | STAT_CD;
 391         s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 392         s->rregs[ESP_RSEQ] = SEQ_CD;
 393         esp_raise_irq(s);
 394     } else if (cmdlen == 0) {
 395         s->cmdlen = 0;
 396         s->do_cmd = 1;
 397         /* Target present, but no cmd yet - switch to command phase */
 398         s->rregs[ESP_RSEQ] = SEQ_CD;
 399         s->rregs[ESP_RSTAT] = STAT_CD;
 400     }
 401 }
 402
 403 static void write_response_pdma_cb(ESPState *s)
 404 {
 405     s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 406     s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 407     s->rregs[ESP_RSEQ] = SEQ_CD;
 408     esp_raise_irq(s);
 409 }
 410
 411 static void write_response(ESPState *s)
 412 {
 413     trace_esp_write_response(s->status);
 414     s->ti_buf[0] = s->status;
 415     s->ti_buf[1] = 0;
 416     if (s->dma) {
 417         if (s->dma_memory_write) {
 418             s->dma_memory_write(s->dma_opaque, s->ti_buf, 2);
 419             s->rregs[ESP_RSTAT] = STAT_TC | STAT_ST;
 420             s->rregs[ESP_RINTR] = INTR_BS | INTR_FC;
 421             s->rregs[ESP_RSEQ] = SEQ_CD;
 422         } else {
 423             set_pdma(s, TI);
 424             s->pdma_cb = write_response_pdma_cb;
 425             esp_raise_drq(s);
 426             return;
 427         }
 428     } else {
 429         s->ti_size = 2;
 430         s->ti_rptr = 0;
 431         s->ti_wptr = 2;
 432         s->rregs[ESP_RFLAGS] = 2;
 433     }
 434     esp_raise_irq(s);
 435 }
 436
 437 static void esp_dma_done(ESPState *s)
 438 {
 439     s->rregs[ESP_RSTAT] |= STAT_TC;
 440     s->rregs[ESP_RINTR] = INTR_BS;
 441     s->rregs[ESP_RSEQ] = 0;
 442     s->rregs[ESP_RFLAGS] = 0;
 443     esp_set_tc(s, 0);
 444     esp_raise_irq(s);
 445 }
 446
 447 static void do_dma_pdma_cb(ESPState *s)
 448 {
 449     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 450
 451     if (s->do_cmd) {
 452         s->ti_size = 0;
 453         s->cmdlen = 0;
 454         s->do_cmd = 0;
 455         do_cmd(s);
 456         return;
 457     }
 458     if (s->async_len == 0) {
 459         scsi_req_continue(s->current_req);
 460         /*
 461          * If there is still data to be read from the device then
 462          * complete the DMA operation immediately.  Otherwise defer
 463          * until the scsi layer has completed.
 464          */
 465         if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
 466             return;
 467         }
 468     }
 469
 470     /* Partially filled a scsi buffer. Complete immediately.  */
 471     esp_dma_done(s);
 472 }
 473
 474 static void esp_do_dma(ESPState *s)
 475 {
 476     uint32_t len;
 477     int to_device = ((s->rregs[ESP_RSTAT] & 7) == STAT_DO);
 478
 479     len = esp_get_tc(s);
 480     if (s->do_cmd) {
 481         /*
 482          * handle_ti_cmd() case: esp_do_dma() is called only from
 483          * handle_ti_cmd() with do_cmd != NULL (see the assert())
 484          */
 485         trace_esp_do_dma(s->cmdlen, len);
 486         assert(s->cmdlen <= sizeof(s->cmdbuf) &&
 487                len <= sizeof(s->cmdbuf) - s->cmdlen);
 488         if (s->dma_memory_read) {
 489             s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
 490         } else {
 491             set_pdma(s, TI);
 492             s->pdma_cb = do_dma_pdma_cb;
 493             esp_raise_drq(s);
 494             return;
 495         }
 496         trace_esp_handle_ti_cmd(s->cmdlen);
 497         s->ti_size = 0;
 498         s->cmdlen = 0;
 499         s->do_cmd = 0;
 500         do_cmd(s);
 501         return;
 502     }
 503     if (s->async_len == 0) {
 504         /* Defer until data is available.  */
 505         return;
 506     }
 507     if (len > s->async_len) {
 508         len = s->async_len;
 509     }
 510     if (to_device) {
 511         if (s->dma_memory_read) {
 512             s->dma_memory_read(s->dma_opaque, s->async_buf, len);
 513         } else {
 514             set_pdma(s, ASYNC);
 515             s->pdma_cb = do_dma_pdma_cb;
 516             esp_raise_drq(s);
 517             return;
 518         }
 519     } else {
 520         if (s->dma_memory_write) {
 521             s->dma_memory_write(s->dma_opaque, s->async_buf, len);
 522         } else {
 523             set_pdma(s, ASYNC);
 524             s->pdma_cb = do_dma_pdma_cb;
 525             esp_raise_drq(s);
 526             return;
 527         }
 528     }
 529     esp_set_tc(s, esp_get_tc(s) - len);
 530     s->async_buf += len;
 531     s->async_len -= len;
 532     if (to_device) {
 533         s->ti_size += len;
 534     } else {
 535         s->ti_size -= len;
 536     }
 537     if (s->async_len == 0) {
 538         scsi_req_continue(s->current_req);
 539         /*
 540          * If there is still data to be read from the device then
 541          * complete the DMA operation immediately.  Otherwise defer
 542          * until the scsi layer has completed.
 543          */
 544         if (to_device || esp_get_tc(s) != 0 || s->ti_size == 0) {
 545             return;
 546         }
 547     }
 548
 549     /* Partially filled a scsi buffer. Complete immediately.  */
 550     esp_dma_done(s);
 551 }
 552
 553 static void esp_report_command_complete(ESPState *s, uint32_t status)
 554 {
 555     trace_esp_command_complete();
 556     if (s->ti_size != 0) {
 557         trace_esp_command_complete_unexpected();
 558     }
 559     s->ti_size = 0;
 560     s->async_len = 0;
 561     if (status) {
 562         trace_esp_command_complete_fail();
 563     }
 564     s->status = status;
 565     s->rregs[ESP_RSTAT] = STAT_ST;
 566     esp_dma_done(s);
 567     if (s->current_req) {
 568         scsi_req_unref(s->current_req);
 569         s->current_req = NULL;
 570         s->current_dev = NULL;
 571     }
 572 }
 573
 574 void esp_command_complete(SCSIRequest *req, size_t resid)
 575 {
 576     ESPState *s = req->hba_private;
 577
 578     if (s->rregs[ESP_RSTAT] & STAT_INT) {
 579         /*
 580          * Defer handling command complete until the previous
 581          * interrupt has been handled.
 582          */
 583         trace_esp_command_complete_deferred();
 584         s->deferred_status = req->status;
 585         s->deferred_complete = true;
 586         return;
 587     }
 588     esp_report_command_complete(s, req->status);
 589 }
 590
 591 void esp_transfer_data(SCSIRequest *req, uint32_t len)
 592 {
 593     ESPState *s = req->hba_private;
 594     uint32_t dmalen = esp_get_tc(s);
 595
 596     assert(!s->do_cmd);
 597     trace_esp_transfer_data(dmalen, s->ti_size);
 598     s->async_len = len;
 599     s->async_buf = scsi_req_get_buf(req);
 600     if (dmalen) {
 601         esp_do_dma(s);
 602     } else if (s->ti_size <= 0) {
 603         /*
 604          * If this was the last part of a DMA transfer then the
 605          * completion interrupt is deferred to here.
 606          */
 607         esp_dma_done(s);
 608     }
 609 }
 610
 611 static void handle_ti(ESPState *s)
 612 {
 613     uint32_t dmalen;
 614
 615     if (s->dma && !s->dma_enabled) {
 616         s->dma_cb = handle_ti;
 617         return;
 618     }
 619
 620     dmalen = esp_get_tc(s);
 621     if (s->dma) {
 622         trace_esp_handle_ti(dmalen);
 623         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 624         esp_do_dma(s);
 625     } else if (s->do_cmd) {
 626         trace_esp_handle_ti_cmd(s->cmdlen);
 627         s->ti_size = 0;
 628         s->cmdlen = 0;
 629         s->do_cmd = 0;
 630         do_cmd(s);
 631     }
 632 }
 633
 634 void esp_hard_reset(ESPState *s)
 635 {
 636     memset(s->rregs, 0, ESP_REGS);
 637     memset(s->wregs, 0, ESP_REGS);
 638     s->tchi_written = 0;
 639     s->ti_size = 0;
 640     s->ti_rptr = 0;
 641     s->ti_wptr = 0;
 642     s->dma = 0;
 643     s->do_cmd = 0;
 644     s->dma_cb = NULL;
 645
 646     s->rregs[ESP_CFG1] = 7;
 647 }
 648
 649 static void esp_soft_reset(ESPState *s)
 650 {
 651     qemu_irq_lower(s->irq);
 652     qemu_irq_lower(s->irq_data);
 653     esp_hard_reset(s);
 654 }
 655
 656 static void parent_esp_reset(ESPState *s, int irq, int level)
 657 {
 658     if (level) {
 659         esp_soft_reset(s);
 660     }
 661 }
 662
 663 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
 664 {
 665     uint32_t val;
 666
 667     switch (saddr) {
 668     case ESP_FIFO:
 669         if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) {
 670             /* Data out.  */
 671             qemu_log_mask(LOG_UNIMP, "esp: PIO data read not implemented\n");
 672             s->rregs[ESP_FIFO] = 0;
 673         } else if (s->ti_rptr < s->ti_wptr) {
 674             s->ti_size--;
 675             s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++];
 676         }
 677         if (s->ti_rptr == s->ti_wptr) {
 678             s->ti_rptr = 0;
 679             s->ti_wptr = 0;
 680         }
 681         val = s->rregs[ESP_FIFO];
 682         break;
 683     case ESP_RINTR:
 684         /*
 685          * Clear sequence step, interrupt register and all status bits
 686          * except TC
 687          */
 688         val = s->rregs[ESP_RINTR];
 689         s->rregs[ESP_RINTR] = 0;
 690         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 691         s->rregs[ESP_RSEQ] = SEQ_CD;
 692         esp_lower_irq(s);
 693         if (s->deferred_complete) {
 694             esp_report_command_complete(s, s->deferred_status);
 695             s->deferred_complete = false;
 696         }
 697         break;
 698     case ESP_TCHI:
 699         /* Return the unique id if the value has never been written */
 700         if (!s->tchi_written) {
 701             val = s->chip_id;
 702         } else {
 703             val = s->rregs[saddr];
 704         }
 705         break;
 706     default:
 707         val = s->rregs[saddr];
 708         break;
 709     }
 710
 711     trace_esp_mem_readb(saddr, val);
 712     return val;
 713 }
 714
 715 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
 716 {
 717     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
 718     switch (saddr) {
 719     case ESP_TCHI:
 720         s->tchi_written = true;
 721         /* fall through */
 722     case ESP_TCLO:
 723     case ESP_TCMID:
 724         s->rregs[ESP_RSTAT] &= ~STAT_TC;
 725         break;
 726     case ESP_FIFO:
 727         if (s->do_cmd) {
 728             if (s->cmdlen < ESP_CMDBUF_SZ) {
 729                 s->cmdbuf[s->cmdlen++] = val & 0xff;
 730             } else {
 731                 trace_esp_error_fifo_overrun();
 732             }
 733         } else if (s->ti_wptr == TI_BUFSZ - 1) {
 734             trace_esp_error_fifo_overrun();
 735         } else {
 736             s->ti_size++;
 737             s->ti_buf[s->ti_wptr++] = val & 0xff;
 738         }
 739         break;
 740     case ESP_CMD:
 741         s->rregs[saddr] = val;
 742         if (val & CMD_DMA) {
 743             s->dma = 1;
 744             /* Reload DMA counter.  */
 745             if (esp_get_stc(s) == 0) {
 746                 esp_set_tc(s, 0x10000);
 747             } else {
 748                 esp_set_tc(s, esp_get_stc(s));
 749             }
 750         } else {
 751             s->dma = 0;
 752         }
 753         switch (val & CMD_CMD) {
 754         case CMD_NOP:
 755             trace_esp_mem_writeb_cmd_nop(val);
 756             break;
 757         case CMD_FLUSH:
 758             trace_esp_mem_writeb_cmd_flush(val);
 759             /*s->ti_size = 0;*/
 760             s->rregs[ESP_RINTR] = INTR_FC;
 761             s->rregs[ESP_RSEQ] = 0;
 762             s->rregs[ESP_RFLAGS] = 0;
 763             break;
 764         case CMD_RESET:
 765             trace_esp_mem_writeb_cmd_reset(val);
 766             esp_soft_reset(s);
 767             break;
 768         case CMD_BUSRESET:
 769             trace_esp_mem_writeb_cmd_bus_reset(val);
 770             s->rregs[ESP_RINTR] = INTR_RST;
 771             if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
 772                 esp_raise_irq(s);
 773             }
 774             break;
 775         case CMD_TI:
 776             trace_esp_mem_writeb_cmd_ti(val);
 777             handle_ti(s);
 778             break;
 779         case CMD_ICCS:
 780             trace_esp_mem_writeb_cmd_iccs(val);
 781             write_response(s);
 782             s->rregs[ESP_RINTR] = INTR_FC;
 783             s->rregs[ESP_RSTAT] |= STAT_MI;
 784             break;
 785         case CMD_MSGACC:
 786             trace_esp_mem_writeb_cmd_msgacc(val);
 787             s->rregs[ESP_RINTR] = INTR_DC;
 788             s->rregs[ESP_RSEQ] = 0;
 789             s->rregs[ESP_RFLAGS] = 0;
 790             esp_raise_irq(s);
 791             break;
 792         case CMD_PAD:
 793             trace_esp_mem_writeb_cmd_pad(val);
 794             s->rregs[ESP_RSTAT] = STAT_TC;
 795             s->rregs[ESP_RINTR] = INTR_FC;
 796             s->rregs[ESP_RSEQ] = 0;
 797             break;
 798         case CMD_SATN:
 799             trace_esp_mem_writeb_cmd_satn(val);
 800             break;
 801         case CMD_RSTATN:
 802             trace_esp_mem_writeb_cmd_rstatn(val);
 803             break;
 804         case CMD_SEL:
 805             trace_esp_mem_writeb_cmd_sel(val);
 806             handle_s_without_atn(s);
 807             break;
 808         case CMD_SELATN:
 809             trace_esp_mem_writeb_cmd_selatn(val);
 810             handle_satn(s);
 811             break;
 812         case CMD_SELATNS:
 813             trace_esp_mem_writeb_cmd_selatns(val);
 814             handle_satn_stop(s);
 815             break;
 816         case CMD_ENSEL:
 817             trace_esp_mem_writeb_cmd_ensel(val);
 818             s->rregs[ESP_RINTR] = 0;
 819             break;
 820         case CMD_DISSEL:
 821             trace_esp_mem_writeb_cmd_dissel(val);
 822             s->rregs[ESP_RINTR] = 0;
 823             esp_raise_irq(s);
 824             break;
 825         default:
 826             trace_esp_error_unhandled_command(val);
 827             break;
 828         }
 829         break;
 830     case ESP_WBUSID ... ESP_WSYNO:
 831         break;
 832     case ESP_CFG1:
 833     case ESP_CFG2: case ESP_CFG3:
 834     case ESP_RES3: case ESP_RES4:
 835         s->rregs[saddr] = val;
 836         break;
 837     case ESP_WCCF ... ESP_WTEST:
 838         break;
 839     default:
 840         trace_esp_error_invalid_write(val, saddr);
 841         return;
 842     }
 843     s->wregs[saddr] = val;
 844 }
 845
 846 static bool esp_mem_accepts(void *opaque, hwaddr addr,
 847                             unsigned size, bool is_write,
 848                             MemTxAttrs attrs)
 849 {
 850     return (size == 1) || (is_write && size == 4);
 851 }
 852
 853 static bool esp_pdma_needed(void *opaque)
 854 {
 855     ESPState *s = opaque;
 856     return s->dma_memory_read == NULL && s->dma_memory_write == NULL &&
 857            s->dma_enabled;
 858 }
 859
 860 static const VMStateDescription vmstate_esp_pdma = {
 861     .name = "esp/pdma",
 862     .version_id = 2,
 863     .minimum_version_id = 2,
 864     .needed = esp_pdma_needed,
 865     .fields = (VMStateField[]) {
 866         VMSTATE_INT32(pdma_origin, ESPState),
 867         VMSTATE_END_OF_LIST()
 868     }
 869 };
 870
 871 static bool esp_is_before_version_5(void *opaque, int version_id)
 872 {
 873     ESPState *s = ESP(opaque);
 874
 875     version_id = MIN(version_id, s->mig_version_id);
 876     return version_id < 5;
 877 }
 878
 879 static int esp_pre_save(void *opaque)
 880 {
 881     ESPState *s = ESP(opaque);
 882
 883     s->mig_version_id = vmstate_esp.version_id;
 884     return 0;
 885 }
 886
 887 static int esp_post_load(void *opaque, int version_id)
 888 {
 889     ESPState *s = ESP(opaque);
 890
 891     version_id = MIN(version_id, s->mig_version_id);
 892
 893     if (version_id < 5) {
 894         esp_set_tc(s, s->mig_dma_left);
 895     }
 896
 897     s->mig_version_id = vmstate_esp.version_id;
 898     return 0;
 899 }
 900
 901 const VMStateDescription vmstate_esp = {
 902     .name = "esp",
 903     .version_id = 5,
 904     .minimum_version_id = 3,
 905     .pre_save = esp_pre_save,
 906     .post_load = esp_post_load,
 907     .fields = (VMStateField[]) {
 908         VMSTATE_BUFFER(rregs, ESPState),
 909         VMSTATE_BUFFER(wregs, ESPState),
 910         VMSTATE_INT32(ti_size, ESPState),
 911         VMSTATE_UINT32(ti_rptr, ESPState),
 912         VMSTATE_UINT32(ti_wptr, ESPState),
 913         VMSTATE_BUFFER(ti_buf, ESPState),
 914         VMSTATE_UINT32(status, ESPState),
 915         VMSTATE_UINT32(deferred_status, ESPState),
 916         VMSTATE_BOOL(deferred_complete, ESPState),
 917         VMSTATE_UINT32(dma, ESPState),
 918         VMSTATE_PARTIAL_BUFFER(cmdbuf, ESPState, 16),
 919         VMSTATE_BUFFER_START_MIDDLE_V(cmdbuf, ESPState, 16, 4),
 920         VMSTATE_UINT32(cmdlen, ESPState),
 921         VMSTATE_UINT32(do_cmd, ESPState),
 922         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
 923         VMSTATE_END_OF_LIST()
 924     },
 925     .subsections = (const VMStateDescription * []) {
 926         &vmstate_esp_pdma,
 927         NULL
 928     }
 929 };
 930
 931 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
 932                                  uint64_t val, unsigned int size)
 933 {
 934     SysBusESPState *sysbus = opaque;
 935     ESPState *s = ESP(&sysbus->esp);
 936     uint32_t saddr;
 937
 938     saddr = addr >> sysbus->it_shift;
 939     esp_reg_write(s, saddr, val);
 940 }
 941
 942 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
 943                                     unsigned int size)
 944 {
 945     SysBusESPState *sysbus = opaque;
 946     ESPState *s = ESP(&sysbus->esp);
 947     uint32_t saddr;
 948
 949     saddr = addr >> sysbus->it_shift;
 950     return esp_reg_read(s, saddr);
 951 }
 952
 953 static const MemoryRegionOps sysbus_esp_mem_ops = {
 954     .read = sysbus_esp_mem_read,
 955     .write = sysbus_esp_mem_write,
 956     .endianness = DEVICE_NATIVE_ENDIAN,
 957     .valid.accepts = esp_mem_accepts,
 958 };
 959
 960 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
 961                                   uint64_t val, unsigned int size)
 962 {
 963     SysBusESPState *sysbus = opaque;
 964     ESPState *s = ESP(&sysbus->esp);
 965     uint32_t dmalen;
 966
 967     trace_esp_pdma_write(size);
 968
 969     switch (size) {
 970     case 1:
 971         esp_pdma_write(s, val);
 972         break;
 973     case 2:
 974         esp_pdma_write(s, val >> 8);
 975         esp_pdma_write(s, val);
 976         break;
 977     }
 978     dmalen = esp_get_tc(s);
 979     if (dmalen == 0 && s->pdma_cb) {
 980         esp_lower_drq(s);
 981         s->pdma_cb(s);
 982         s->pdma_cb = NULL;
 983     }
 984 }
 985
 986 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
 987                                      unsigned int size)
 988 {
 989     SysBusESPState *sysbus = opaque;
 990     ESPState *s = ESP(&sysbus->esp);
 991     uint32_t dmalen = esp_get_tc(s);
 992     uint64_t val = 0;
 993
 994     trace_esp_pdma_read(size);
 995
 996     if (dmalen == 0) {
 997         return 0;
 998     }
 999     switch (size) {
1000     case 1:
1001         val = esp_pdma_read(s);
1002         break;
1003     case 2:
1004         val = esp_pdma_read(s);
1005         val = (val << 8) | esp_pdma_read(s);
1006         break;
1007     }
1008     dmalen = esp_get_tc(s);
1009     if (dmalen == 0 && s->pdma_cb) {
1010         esp_lower_drq(s);
1011         s->pdma_cb(s);
1012         s->pdma_cb = NULL;
1013     }
1014     return val;
1015 }
1016
1017 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1018     .read = sysbus_esp_pdma_read,
1019     .write = sysbus_esp_pdma_write,
1020     .endianness = DEVICE_NATIVE_ENDIAN,
1021     .valid.min_access_size = 1,
1022     .valid.max_access_size = 2,
1023 };
1024
1025 static const struct SCSIBusInfo esp_scsi_info = {
1026     .tcq = false,
1027     .max_target = ESP_MAX_DEVS,
1028     .max_lun = 7,
1029
1030     .transfer_data = esp_transfer_data,
1031     .complete = esp_command_complete,
1032     .cancel = esp_request_cancelled
1033 };
1034
1035 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1036 {
1037     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1038     ESPState *s = ESP(&sysbus->esp);
1039
1040     switch (irq) {
1041     case 0:
1042         parent_esp_reset(s, irq, level);
1043         break;
1044     case 1:
1045         esp_dma_enable(opaque, irq, level);
1046         break;
1047     }
1048 }
1049
1050 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1051 {
1052     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1053     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1054     ESPState *s = ESP(&sysbus->esp);
1055
1056     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1057         return;
1058     }
1059
1060     sysbus_init_irq(sbd, &s->irq);
1061     sysbus_init_irq(sbd, &s->irq_data);
1062     assert(sysbus->it_shift != -1);
1063
1064     s->chip_id = TCHI_FAS100A;
1065     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1066                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1067     sysbus_init_mmio(sbd, &sysbus->iomem);
1068     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1069                           sysbus, "esp-pdma", 2);
1070     sysbus_init_mmio(sbd, &sysbus->pdma);
1071
1072     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1073
1074     scsi_bus_new(&s->bus, sizeof(s->bus), dev, &esp_scsi_info, NULL);
1075 }
1076
1077 static void sysbus_esp_hard_reset(DeviceState *dev)
1078 {
1079     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1080     ESPState *s = ESP(&sysbus->esp);
1081
1082     esp_hard_reset(s);
1083 }
1084
1085 static void sysbus_esp_init(Object *obj)
1086 {
1087     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1088
1089     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1090 }
1091
1092 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1093     .name = "sysbusespscsi",
1094     .version_id = 2,
1095     .minimum_version_id = 1,
1096     .fields = (VMStateField[]) {
1097         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1098         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1099         VMSTATE_END_OF_LIST()
1100     }
1101 };
1102
1103 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1104 {
1105     DeviceClass *dc = DEVICE_CLASS(klass);
1106
1107     dc->realize = sysbus_esp_realize;
1108     dc->reset = sysbus_esp_hard_reset;
1109     dc->vmsd = &vmstate_sysbus_esp_scsi;
1110     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1111 }
1112
1113 static const TypeInfo sysbus_esp_info = {
1114     .name          = TYPE_SYSBUS_ESP,
1115     .parent        = TYPE_SYS_BUS_DEVICE,
1116     .instance_init = sysbus_esp_init,
1117     .instance_size = sizeof(SysBusESPState),
1118     .class_init    = sysbus_esp_class_init,
1119 };
1120
1121 static void esp_class_init(ObjectClass *klass, void *data)
1122 {
1123     DeviceClass *dc = DEVICE_CLASS(klass);
1124
1125     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1126     dc->user_creatable = false;
1127     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1128 }
1129
1130 static const TypeInfo esp_info = {
1131     .name = TYPE_ESP,
1132     .parent = TYPE_DEVICE,
1133     .instance_size = sizeof(ESPState),
1134     .class_init = esp_class_init,
1135 };
1136
1137 static void esp_register_types(void)
1138 {
1139     type_register_static(&sysbus_esp_info);
1140     type_register_static(&esp_info);
1141 }
1142
1143 type_init(esp_register_types)