hw/scsi/esp.c

   1 /*
   2  * QEMU ESP/NCR53C9x emulation
   3  *
   4  * Copyright (c) 2005-2006 Fabrice Bellard
   5  * Copyright (c) 2012 Herve Poussineau
   6  * Copyright (c) 2023 Mark Cave-Ayland
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  24  * THE SOFTWARE.
  25  */
  26
  27 #include "qemu/osdep.h"
  28 #include "hw/sysbus.h"
  29 #include "migration/vmstate.h"
  30 #include "hw/irq.h"
  31 #include "hw/scsi/esp.h"
  32 #include "trace.h"
  33 #include "qemu/log.h"
  34 #include "qemu/module.h"
  35
  36 /*
  37  * On Sparc32, this is the ESP (NCR53C90) part of chip STP2000 (Master I/O),
  38  * also produced as NCR89C100. See
  39  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR89C100.txt
  40  * and
  41  * http://www.ibiblio.org/pub/historic-linux/early-ports/Sparc/NCR/NCR53C9X.txt
  42  *
  43  * On Macintosh Quadra it is a NCR53C96.
  44  */
  45
  46 static void esp_raise_irq(ESPState *s)
  47 {
  48     if (!(s->rregs[ESP_RSTAT] & STAT_INT)) {
  49         s->rregs[ESP_RSTAT] |= STAT_INT;
  50         qemu_irq_raise(s->irq);
  51         trace_esp_raise_irq();
  52     }
  53 }
  54
  55 static void esp_lower_irq(ESPState *s)
  56 {
  57     if (s->rregs[ESP_RSTAT] & STAT_INT) {
  58         s->rregs[ESP_RSTAT] &= ~STAT_INT;
  59         qemu_irq_lower(s->irq);
  60         trace_esp_lower_irq();
  61     }
  62 }
  63
  64 static void esp_raise_drq(ESPState *s)
  65 {
  66     if (!(s->drq_state)) {
  67         qemu_irq_raise(s->drq_irq);
  68         trace_esp_raise_drq();
  69         s->drq_state = true;
  70     }
  71 }
  72
  73 static void esp_lower_drq(ESPState *s)
  74 {
  75     if (s->drq_state) {
  76         qemu_irq_lower(s->drq_irq);
  77         trace_esp_lower_drq();
  78         s->drq_state = false;
  79     }
  80 }
  81
  82 static const char *esp_phase_names[8] = {
  83     "DATA OUT", "DATA IN", "COMMAND", "STATUS",
  84     "(reserved)", "(reserved)", "MESSAGE OUT", "MESSAGE IN"
  85 };
  86
  87 static void esp_set_phase(ESPState *s, uint8_t phase)
  88 {
  89     s->rregs[ESP_RSTAT] &= ~7;
  90     s->rregs[ESP_RSTAT] |= phase;
  91
  92     trace_esp_set_phase(esp_phase_names[phase]);
  93 }
  94
  95 static uint8_t esp_get_phase(ESPState *s)
  96 {
  97     return s->rregs[ESP_RSTAT] & 7;
  98 }
  99
 100 void esp_dma_enable(ESPState *s, int irq, int level)
 101 {
 102     if (level) {
 103         s->dma_enabled = 1;
 104         trace_esp_dma_enable();
 105         if (s->dma_cb) {
 106             s->dma_cb(s);
 107             s->dma_cb = NULL;
 108         }
 109     } else {
 110         trace_esp_dma_disable();
 111         s->dma_enabled = 0;
 112     }
 113 }
 114
 115 void esp_request_cancelled(SCSIRequest *req)
 116 {
 117     ESPState *s = req->hba_private;
 118
 119     if (req == s->current_req) {
 120         scsi_req_unref(s->current_req);
 121         s->current_req = NULL;
 122         s->current_dev = NULL;
 123         s->async_len = 0;
 124     }
 125 }
 126
 127 static void esp_update_drq(ESPState *s)
 128 {
 129     bool to_device;
 130
 131     switch (esp_get_phase(s)) {
 132     case STAT_MO:
 133     case STAT_CD:
 134     case STAT_DO:
 135         to_device = true;
 136         break;
 137
 138     case STAT_DI:
 139     case STAT_ST:
 140     case STAT_MI:
 141         to_device = false;
 142         break;
 143
 144     default:
 145         return;
 146     }
 147
 148     if (s->dma) {
 149         /* DMA request so update DRQ according to transfer direction */
 150         if (to_device) {
 151             if (fifo8_num_free(&s->fifo) < 2) {
 152                 esp_lower_drq(s);
 153             } else {
 154                 esp_raise_drq(s);
 155             }
 156         } else {
 157             if (fifo8_num_used(&s->fifo) < 2) {
 158                 esp_lower_drq(s);
 159             } else {
 160                 esp_raise_drq(s);
 161             }
 162         }
 163     } else {
 164         /* Not a DMA request */
 165         esp_lower_drq(s);
 166     }
 167 }
 168
 169 static void esp_fifo_push(ESPState *s, uint8_t val)
 170 {
 171     if (fifo8_num_used(&s->fifo) == s->fifo.capacity) {
 172         trace_esp_error_fifo_overrun();
 173     } else {
 174         fifo8_push(&s->fifo, val);
 175     }
 176
 177     esp_update_drq(s);
 178 }
 179
 180 static void esp_fifo_push_buf(ESPState *s, uint8_t *buf, int len)
 181 {
 182     fifo8_push_all(&s->fifo, buf, len);
 183     esp_update_drq(s);
 184 }
 185
 186 static uint8_t esp_fifo_pop(ESPState *s)
 187 {
 188     uint8_t val;
 189
 190     if (fifo8_is_empty(&s->fifo)) {
 191         val = 0;
 192     } else {
 193         val = fifo8_pop(&s->fifo);
 194     }
 195
 196     esp_update_drq(s);
 197     return val;
 198 }
 199
 200 static uint32_t esp_fifo_pop_buf(ESPState *s, uint8_t *dest, int maxlen)
 201 {
 202     uint32_t len = fifo8_pop_buf(&s->fifo, dest, maxlen);
 203
 204     esp_update_drq(s);
 205     return len;
 206 }
 207
 208 static uint32_t esp_get_tc(ESPState *s)
 209 {
 210     uint32_t dmalen;
 211
 212     dmalen = s->rregs[ESP_TCLO];
 213     dmalen |= s->rregs[ESP_TCMID] << 8;
 214     dmalen |= s->rregs[ESP_TCHI] << 16;
 215
 216     return dmalen;
 217 }
 218
 219 static void esp_set_tc(ESPState *s, uint32_t dmalen)
 220 {
 221     uint32_t old_tc = esp_get_tc(s);
 222
 223     s->rregs[ESP_TCLO] = dmalen;
 224     s->rregs[ESP_TCMID] = dmalen >> 8;
 225     s->rregs[ESP_TCHI] = dmalen >> 16;
 226
 227     if (old_tc && dmalen == 0) {
 228         s->rregs[ESP_RSTAT] |= STAT_TC;
 229     }
 230 }
 231
 232 static uint32_t esp_get_stc(ESPState *s)
 233 {
 234     uint32_t dmalen;
 235
 236     dmalen = s->wregs[ESP_TCLO];
 237     dmalen |= s->wregs[ESP_TCMID] << 8;
 238     dmalen |= s->wregs[ESP_TCHI] << 16;
 239
 240     return dmalen;
 241 }
 242
 243 static uint8_t esp_pdma_read(ESPState *s)
 244 {
 245     uint8_t val;
 246
 247     val = esp_fifo_pop(s);
 248     return val;
 249 }
 250
 251 static void esp_pdma_write(ESPState *s, uint8_t val)
 252 {
 253     uint32_t dmalen = esp_get_tc(s);
 254
 255     esp_fifo_push(s, val);
 256
 257     if (dmalen && s->drq_state) {
 258         dmalen--;
 259         esp_set_tc(s, dmalen);
 260     }
 261 }
 262
 263 static int esp_select(ESPState *s)
 264 {
 265     int target;
 266
 267     target = s->wregs[ESP_WBUSID] & BUSID_DID;
 268
 269     s->ti_size = 0;
 270     s->rregs[ESP_RSEQ] = SEQ_0;
 271
 272     if (s->current_req) {
 273         /* Started a new command before the old one finished. Cancel it. */
 274         scsi_req_cancel(s->current_req);
 275     }
 276
 277     s->current_dev = scsi_device_find(&s->bus, 0, target, 0);
 278     if (!s->current_dev) {
 279         /* No such drive */
 280         s->rregs[ESP_RSTAT] = 0;
 281         s->rregs[ESP_RINTR] = INTR_DC;
 282         esp_raise_irq(s);
 283         return -1;
 284     }
 285
 286     /*
 287      * Note that we deliberately don't raise the IRQ here: this will be done
 288      * either in esp_transfer_data() or esp_command_complete()
 289      */
 290     return 0;
 291 }
 292
 293 static void esp_do_dma(ESPState *s);
 294 static void esp_do_nodma(ESPState *s);
 295
 296 static void do_command_phase(ESPState *s)
 297 {
 298     uint32_t cmdlen;
 299     int32_t datalen;
 300     SCSIDevice *current_lun;
 301     uint8_t buf[ESP_CMDFIFO_SZ];
 302
 303     trace_esp_do_command_phase(s->lun);
 304     cmdlen = fifo8_num_used(&s->cmdfifo);
 305     if (!cmdlen || !s->current_dev) {
 306         return;
 307     }
 308     fifo8_pop_buf(&s->cmdfifo, buf, cmdlen);
 309
 310     current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun);
 311     if (!current_lun) {
 312         /* No such drive */
 313         s->rregs[ESP_RSTAT] = 0;
 314         s->rregs[ESP_RINTR] = INTR_DC;
 315         s->rregs[ESP_RSEQ] = SEQ_0;
 316         esp_raise_irq(s);
 317         return;
 318     }
 319
 320     s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s);
 321     datalen = scsi_req_enqueue(s->current_req);
 322     s->ti_size = datalen;
 323     fifo8_reset(&s->cmdfifo);
 324     s->data_ready = false;
 325     if (datalen != 0) {
 326         /*
 327          * Switch to DATA phase but wait until initial data xfer is
 328          * complete before raising the command completion interrupt
 329          */
 330         if (datalen > 0) {
 331             esp_set_phase(s, STAT_DI);
 332         } else {
 333             esp_set_phase(s, STAT_DO);
 334         }
 335         scsi_req_continue(s->current_req);
 336         return;
 337     }
 338 }
 339
 340 static void do_message_phase(ESPState *s)
 341 {
 342     if (s->cmdfifo_cdb_offset) {
 343         uint8_t message = fifo8_is_empty(&s->cmdfifo) ? 0 :
 344                           fifo8_pop(&s->cmdfifo);
 345
 346         trace_esp_do_identify(message);
 347         s->lun = message & 7;
 348         s->cmdfifo_cdb_offset--;
 349     }
 350
 351     /* Ignore extended messages for now */
 352     if (s->cmdfifo_cdb_offset) {
 353         int len = MIN(s->cmdfifo_cdb_offset, fifo8_num_used(&s->cmdfifo));
 354         fifo8_drop(&s->cmdfifo, len);
 355         s->cmdfifo_cdb_offset = 0;
 356     }
 357 }
 358
 359 static void do_cmd(ESPState *s)
 360 {
 361     do_message_phase(s);
 362     assert(s->cmdfifo_cdb_offset == 0);
 363     do_command_phase(s);
 364 }
 365
 366 static void handle_satn(ESPState *s)
 367 {
 368     if (s->dma && !s->dma_enabled) {
 369         s->dma_cb = handle_satn;
 370         return;
 371     }
 372
 373     if (esp_select(s) < 0) {
 374         return;
 375     }
 376
 377     esp_set_phase(s, STAT_MO);
 378
 379     if (s->dma) {
 380         esp_do_dma(s);
 381     } else {
 382         esp_do_nodma(s);
 383     }
 384 }
 385
 386 static void handle_s_without_atn(ESPState *s)
 387 {
 388     if (s->dma && !s->dma_enabled) {
 389         s->dma_cb = handle_s_without_atn;
 390         return;
 391     }
 392
 393     if (esp_select(s) < 0) {
 394         return;
 395     }
 396
 397     esp_set_phase(s, STAT_CD);
 398     s->cmdfifo_cdb_offset = 0;
 399
 400     if (s->dma) {
 401         esp_do_dma(s);
 402     } else {
 403         esp_do_nodma(s);
 404     }
 405 }
 406
 407 static void handle_satn_stop(ESPState *s)
 408 {
 409     if (s->dma && !s->dma_enabled) {
 410         s->dma_cb = handle_satn_stop;
 411         return;
 412     }
 413
 414     if (esp_select(s) < 0) {
 415         return;
 416     }
 417
 418     esp_set_phase(s, STAT_MO);
 419     s->cmdfifo_cdb_offset = 0;
 420
 421     if (s->dma) {
 422         esp_do_dma(s);
 423     } else {
 424         esp_do_nodma(s);
 425     }
 426 }
 427
 428 static void handle_pad(ESPState *s)
 429 {
 430     if (s->dma) {
 431         esp_do_dma(s);
 432     } else {
 433         esp_do_nodma(s);
 434     }
 435 }
 436
 437 static void write_response(ESPState *s)
 438 {
 439     trace_esp_write_response(s->status);
 440
 441     if (s->dma) {
 442         esp_do_dma(s);
 443     } else {
 444         esp_do_nodma(s);
 445     }
 446 }
 447
 448 static bool esp_cdb_ready(ESPState *s)
 449 {
 450     int len = fifo8_num_used(&s->cmdfifo) - s->cmdfifo_cdb_offset;
 451     const uint8_t *pbuf;
 452     uint32_t n;
 453     int cdblen;
 454
 455     if (len <= 0) {
 456         return false;
 457     }
 458
 459     pbuf = fifo8_peek_bufptr(&s->cmdfifo, len, &n);
 460     if (n < len) {
 461         /*
 462          * In normal use the cmdfifo should never wrap, but include this check
 463          * to prevent a malicious guest from reading past the end of the
 464          * cmdfifo data buffer below
 465          */
 466         return false;
 467     }
 468
 469     cdblen = scsi_cdb_length((uint8_t *)&pbuf[s->cmdfifo_cdb_offset]);
 470
 471     return cdblen < 0 ? false : (len >= cdblen);
 472 }
 473
 474 static void esp_dma_ti_check(ESPState *s)
 475 {
 476     if (esp_get_tc(s) == 0 && fifo8_num_used(&s->fifo) < 2) {
 477         s->rregs[ESP_RINTR] |= INTR_BS;
 478         esp_raise_irq(s);
 479     }
 480 }
 481
 482 static void esp_do_dma(ESPState *s)
 483 {
 484     uint32_t len, cmdlen;
 485     uint8_t buf[ESP_CMDFIFO_SZ];
 486
 487     len = esp_get_tc(s);
 488
 489     switch (esp_get_phase(s)) {
 490     case STAT_MO:
 491         if (s->dma_memory_read) {
 492             len = MIN(len, fifo8_num_free(&s->cmdfifo));
 493             s->dma_memory_read(s->dma_opaque, buf, len);
 494             esp_set_tc(s, esp_get_tc(s) - len);
 495         } else {
 496             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 497             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 498         }
 499
 500         fifo8_push_all(&s->cmdfifo, buf, len);
 501         s->cmdfifo_cdb_offset += len;
 502
 503         switch (s->rregs[ESP_CMD]) {
 504         case CMD_SELATN | CMD_DMA:
 505             if (fifo8_num_used(&s->cmdfifo) >= 1) {
 506                 /* First byte received, switch to command phase */
 507                 esp_set_phase(s, STAT_CD);
 508                 s->rregs[ESP_RSEQ] = SEQ_CD;
 509                 s->cmdfifo_cdb_offset = 1;
 510
 511                 if (fifo8_num_used(&s->cmdfifo) > 1) {
 512                     /* Process any additional command phase data */
 513                     esp_do_dma(s);
 514                 }
 515             }
 516             break;
 517
 518         case CMD_SELATNS | CMD_DMA:
 519             if (fifo8_num_used(&s->cmdfifo) == 1) {
 520                 /* First byte received, stop in message out phase */
 521                 s->rregs[ESP_RSEQ] = SEQ_MO;
 522                 s->cmdfifo_cdb_offset = 1;
 523
 524                 /* Raise command completion interrupt */
 525                 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 526                 esp_raise_irq(s);
 527             }
 528             break;
 529
 530         case CMD_TI | CMD_DMA:
 531             /* ATN remains asserted until TC == 0 */
 532             if (esp_get_tc(s) == 0) {
 533                 esp_set_phase(s, STAT_CD);
 534                 s->rregs[ESP_CMD] = 0;
 535                 s->rregs[ESP_RINTR] |= INTR_BS;
 536                 esp_raise_irq(s);
 537             }
 538             break;
 539         }
 540         break;
 541
 542     case STAT_CD:
 543         cmdlen = fifo8_num_used(&s->cmdfifo);
 544         trace_esp_do_dma(cmdlen, len);
 545         if (s->dma_memory_read) {
 546             len = MIN(len, fifo8_num_free(&s->cmdfifo));
 547             s->dma_memory_read(s->dma_opaque, buf, len);
 548             fifo8_push_all(&s->cmdfifo, buf, len);
 549             esp_set_tc(s, esp_get_tc(s) - len);
 550         } else {
 551             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 552             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 553             fifo8_push_all(&s->cmdfifo, buf, len);
 554         }
 555         trace_esp_handle_ti_cmd(cmdlen);
 556         s->ti_size = 0;
 557         if (esp_get_tc(s) == 0) {
 558             /* Command has been received */
 559             do_cmd(s);
 560         }
 561         break;
 562
 563     case STAT_DO:
 564         if (!s->current_req) {
 565             return;
 566         }
 567         if (s->async_len == 0 && esp_get_tc(s)) {
 568             /* Defer until data is available.  */
 569             return;
 570         }
 571         if (len > s->async_len) {
 572             len = s->async_len;
 573         }
 574
 575         switch (s->rregs[ESP_CMD]) {
 576         case CMD_TI | CMD_DMA:
 577             if (s->dma_memory_read) {
 578                 s->dma_memory_read(s->dma_opaque, s->async_buf, len);
 579                 esp_set_tc(s, esp_get_tc(s) - len);
 580             } else {
 581                 /* Copy FIFO data to device */
 582                 len = MIN(s->async_len, ESP_FIFO_SZ);
 583                 len = MIN(len, fifo8_num_used(&s->fifo));
 584                 len = esp_fifo_pop_buf(s, s->async_buf, len);
 585             }
 586
 587             s->async_buf += len;
 588             s->async_len -= len;
 589             s->ti_size += len;
 590             break;
 591
 592         case CMD_PAD | CMD_DMA:
 593             /* Copy TC zero bytes into the incoming stream */
 594             if (!s->dma_memory_read) {
 595                 len = MIN(s->async_len, ESP_FIFO_SZ);
 596                 len = MIN(len, fifo8_num_free(&s->fifo));
 597             }
 598
 599             memset(s->async_buf, 0, len);
 600
 601             s->async_buf += len;
 602             s->async_len -= len;
 603             s->ti_size += len;
 604             break;
 605         }
 606
 607         if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) {
 608             /* Defer until the scsi layer has completed */
 609             scsi_req_continue(s->current_req);
 610             return;
 611         }
 612
 613         esp_dma_ti_check(s);
 614         break;
 615
 616     case STAT_DI:
 617         if (!s->current_req) {
 618             return;
 619         }
 620         if (s->async_len == 0 && esp_get_tc(s)) {
 621             /* Defer until data is available.  */
 622             return;
 623         }
 624         if (len > s->async_len) {
 625             len = s->async_len;
 626         }
 627
 628         switch (s->rregs[ESP_CMD]) {
 629         case CMD_TI | CMD_DMA:
 630             if (s->dma_memory_write) {
 631                 s->dma_memory_write(s->dma_opaque, s->async_buf, len);
 632             } else {
 633                 /* Copy device data to FIFO */
 634                 len = MIN(len, fifo8_num_free(&s->fifo));
 635                 esp_fifo_push_buf(s, s->async_buf, len);
 636             }
 637
 638             s->async_buf += len;
 639             s->async_len -= len;
 640             s->ti_size -= len;
 641             esp_set_tc(s, esp_get_tc(s) - len);
 642             break;
 643
 644         case CMD_PAD | CMD_DMA:
 645             /* Drop TC bytes from the incoming stream */
 646             if (!s->dma_memory_write) {
 647                 len = MIN(len, fifo8_num_free(&s->fifo));
 648             }
 649
 650             s->async_buf += len;
 651             s->async_len -= len;
 652             s->ti_size -= len;
 653             esp_set_tc(s, esp_get_tc(s) - len);
 654             break;
 655         }
 656
 657         if (s->async_len == 0 && s->ti_size == 0 && esp_get_tc(s)) {
 658             /* If the guest underflows TC then terminate SCSI request */
 659             scsi_req_continue(s->current_req);
 660             return;
 661         }
 662
 663         if (s->async_len == 0 && fifo8_num_used(&s->fifo) < 2) {
 664             /* Defer until the scsi layer has completed */
 665             scsi_req_continue(s->current_req);
 666             return;
 667         }
 668
 669         esp_dma_ti_check(s);
 670         break;
 671
 672     case STAT_ST:
 673         switch (s->rregs[ESP_CMD]) {
 674         case CMD_ICCS | CMD_DMA:
 675             len = MIN(len, 1);
 676
 677             if (len) {
 678                 buf[0] = s->status;
 679
 680                 if (s->dma_memory_write) {
 681                     s->dma_memory_write(s->dma_opaque, buf, len);
 682                 } else {
 683                     esp_fifo_push_buf(s, buf, len);
 684                 }
 685
 686                 esp_set_tc(s, esp_get_tc(s) - len);
 687                 esp_set_phase(s, STAT_MI);
 688
 689                 if (esp_get_tc(s) > 0) {
 690                     /* Process any message in phase data */
 691                     esp_do_dma(s);
 692                 }
 693             }
 694             break;
 695
 696         default:
 697             /* Consume remaining data if the guest underflows TC */
 698             if (fifo8_num_used(&s->fifo) < 2) {
 699                 s->rregs[ESP_RINTR] |= INTR_BS;
 700                 esp_raise_irq(s);
 701             }
 702             break;
 703         }
 704         break;
 705
 706     case STAT_MI:
 707         switch (s->rregs[ESP_CMD]) {
 708         case CMD_ICCS | CMD_DMA:
 709             len = MIN(len, 1);
 710
 711             if (len) {
 712                 buf[0] = 0;
 713
 714                 if (s->dma_memory_write) {
 715                     s->dma_memory_write(s->dma_opaque, buf, len);
 716                 } else {
 717                     esp_fifo_push_buf(s, buf, len);
 718                 }
 719
 720                 esp_set_tc(s, esp_get_tc(s) - len);
 721
 722                 /* Raise end of command interrupt */
 723                 s->rregs[ESP_RINTR] |= INTR_FC;
 724                 esp_raise_irq(s);
 725             }
 726             break;
 727         }
 728         break;
 729     }
 730 }
 731
 732 static void esp_nodma_ti_dataout(ESPState *s)
 733 {
 734     int len;
 735
 736     if (!s->current_req) {
 737         return;
 738     }
 739     if (s->async_len == 0) {
 740         /* Defer until data is available.  */
 741         return;
 742     }
 743     len = MIN(s->async_len, ESP_FIFO_SZ);
 744     len = MIN(len, fifo8_num_used(&s->fifo));
 745     esp_fifo_pop_buf(s, s->async_buf, len);
 746     s->async_buf += len;
 747     s->async_len -= len;
 748     s->ti_size += len;
 749
 750     if (s->async_len == 0) {
 751         scsi_req_continue(s->current_req);
 752         return;
 753     }
 754
 755     s->rregs[ESP_RINTR] |= INTR_BS;
 756     esp_raise_irq(s);
 757 }
 758
 759 static void esp_do_nodma(ESPState *s)
 760 {
 761     uint8_t buf[ESP_FIFO_SZ];
 762     uint32_t cmdlen;
 763     int len;
 764
 765     switch (esp_get_phase(s)) {
 766     case STAT_MO:
 767         switch (s->rregs[ESP_CMD]) {
 768         case CMD_SELATN:
 769             /* Copy FIFO into cmdfifo */
 770             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 771             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 772             fifo8_push_all(&s->cmdfifo, buf, len);
 773
 774             if (fifo8_num_used(&s->cmdfifo) >= 1) {
 775                 /* First byte received, switch to command phase */
 776                 esp_set_phase(s, STAT_CD);
 777                 s->rregs[ESP_RSEQ] = SEQ_CD;
 778                 s->cmdfifo_cdb_offset = 1;
 779
 780                 if (fifo8_num_used(&s->cmdfifo) > 1) {
 781                     /* Process any additional command phase data */
 782                     esp_do_nodma(s);
 783                 }
 784             }
 785             break;
 786
 787         case CMD_SELATNS:
 788             /* Copy one byte from FIFO into cmdfifo */
 789             len = esp_fifo_pop_buf(s, buf,
 790                                    MIN(fifo8_num_used(&s->fifo), 1));
 791             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 792             fifo8_push_all(&s->cmdfifo, buf, len);
 793
 794             if (fifo8_num_used(&s->cmdfifo) >= 1) {
 795                 /* First byte received, stop in message out phase */
 796                 s->rregs[ESP_RSEQ] = SEQ_MO;
 797                 s->cmdfifo_cdb_offset = 1;
 798
 799                 /* Raise command completion interrupt */
 800                 s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 801                 esp_raise_irq(s);
 802             }
 803             break;
 804
 805         case CMD_TI:
 806             /* Copy FIFO into cmdfifo */
 807             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 808             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 809             fifo8_push_all(&s->cmdfifo, buf, len);
 810
 811             /* ATN remains asserted until FIFO empty */
 812             s->cmdfifo_cdb_offset = fifo8_num_used(&s->cmdfifo);
 813             esp_set_phase(s, STAT_CD);
 814             s->rregs[ESP_CMD] = 0;
 815             s->rregs[ESP_RINTR] |= INTR_BS;
 816             esp_raise_irq(s);
 817             break;
 818         }
 819         break;
 820
 821     case STAT_CD:
 822         switch (s->rregs[ESP_CMD]) {
 823         case CMD_TI:
 824             /* Copy FIFO into cmdfifo */
 825             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 826             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 827             fifo8_push_all(&s->cmdfifo, buf, len);
 828
 829             cmdlen = fifo8_num_used(&s->cmdfifo);
 830             trace_esp_handle_ti_cmd(cmdlen);
 831
 832             /* CDB may be transferred in one or more TI commands */
 833             if (esp_cdb_ready(s)) {
 834                 /* Command has been received */
 835                 do_cmd(s);
 836             } else {
 837                 /*
 838                  * If data was transferred from the FIFO then raise bus
 839                  * service interrupt to indicate transfer complete. Otherwise
 840                  * defer until the next FIFO write.
 841                  */
 842                 if (len) {
 843                     /* Raise interrupt to indicate transfer complete */
 844                     s->rregs[ESP_RINTR] |= INTR_BS;
 845                     esp_raise_irq(s);
 846                 }
 847             }
 848             break;
 849
 850         case CMD_SEL | CMD_DMA:
 851         case CMD_SELATN | CMD_DMA:
 852             /* Copy FIFO into cmdfifo */
 853             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 854             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 855             fifo8_push_all(&s->cmdfifo, buf, len);
 856
 857             /* Handle when DMA transfer is terminated by non-DMA FIFO write */
 858             if (esp_cdb_ready(s)) {
 859                 /* Command has been received */
 860                 do_cmd(s);
 861             }
 862             break;
 863
 864         case CMD_SEL:
 865         case CMD_SELATN:
 866             /* FIFO already contain entire CDB: copy to cmdfifo and execute */
 867             len = esp_fifo_pop_buf(s, buf, fifo8_num_used(&s->fifo));
 868             len = MIN(fifo8_num_free(&s->cmdfifo), len);
 869             fifo8_push_all(&s->cmdfifo, buf, len);
 870
 871             do_cmd(s);
 872             break;
 873         }
 874         break;
 875
 876     case STAT_DO:
 877         /* Accumulate data in FIFO until non-DMA TI is executed */
 878         break;
 879
 880     case STAT_DI:
 881         if (!s->current_req) {
 882             return;
 883         }
 884         if (s->async_len == 0) {
 885             /* Defer until data is available.  */
 886             return;
 887         }
 888         if (fifo8_is_empty(&s->fifo)) {
 889             esp_fifo_push(s, s->async_buf[0]);
 890             s->async_buf++;
 891             s->async_len--;
 892             s->ti_size--;
 893         }
 894
 895         if (s->async_len == 0) {
 896             scsi_req_continue(s->current_req);
 897             return;
 898         }
 899
 900         /* If preloading the FIFO, defer until TI command issued */
 901         if (s->rregs[ESP_CMD] != CMD_TI) {
 902             return;
 903         }
 904
 905         s->rregs[ESP_RINTR] |= INTR_BS;
 906         esp_raise_irq(s);
 907         break;
 908
 909     case STAT_ST:
 910         switch (s->rregs[ESP_CMD]) {
 911         case CMD_ICCS:
 912             esp_fifo_push(s, s->status);
 913             esp_set_phase(s, STAT_MI);
 914
 915             /* Process any message in phase data */
 916             esp_do_nodma(s);
 917             break;
 918         }
 919         break;
 920
 921     case STAT_MI:
 922         switch (s->rregs[ESP_CMD]) {
 923         case CMD_ICCS:
 924             esp_fifo_push(s, 0);
 925
 926             /* Raise end of command interrupt */
 927             s->rregs[ESP_RINTR] |= INTR_FC;
 928             esp_raise_irq(s);
 929             break;
 930         }
 931         break;
 932     }
 933 }
 934
 935 void esp_command_complete(SCSIRequest *req, size_t resid)
 936 {
 937     ESPState *s = req->hba_private;
 938     int to_device = (esp_get_phase(s) == STAT_DO);
 939
 940     trace_esp_command_complete();
 941
 942     /*
 943      * Non-DMA transfers from the target will leave the last byte in
 944      * the FIFO so don't reset ti_size in this case
 945      */
 946     if (s->dma || to_device) {
 947         if (s->ti_size != 0) {
 948             trace_esp_command_complete_unexpected();
 949         }
 950     }
 951
 952     s->async_len = 0;
 953     if (req->status) {
 954         trace_esp_command_complete_fail();
 955     }
 956     s->status = req->status;
 957
 958     /*
 959      * Switch to status phase. For non-DMA transfers from the target the last
 960      * byte is still in the FIFO
 961      */
 962     s->ti_size = 0;
 963
 964     switch (s->rregs[ESP_CMD]) {
 965     case CMD_SEL | CMD_DMA:
 966     case CMD_SEL:
 967     case CMD_SELATN | CMD_DMA:
 968     case CMD_SELATN:
 969         /*
 970          * No data phase for sequencer command so raise deferred bus service
 971          * and function complete interrupt
 972          */
 973         s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
 974         s->rregs[ESP_RSEQ] = SEQ_CD;
 975         break;
 976
 977     case CMD_TI | CMD_DMA:
 978     case CMD_TI:
 979         s->rregs[ESP_CMD] = 0;
 980         break;
 981     }
 982
 983     /* Raise bus service interrupt to indicate change to STATUS phase */
 984     esp_set_phase(s, STAT_ST);
 985     s->rregs[ESP_RINTR] |= INTR_BS;
 986     esp_raise_irq(s);
 987
 988     if (s->current_req) {
 989         scsi_req_unref(s->current_req);
 990         s->current_req = NULL;
 991         s->current_dev = NULL;
 992     }
 993 }
 994
 995 void esp_transfer_data(SCSIRequest *req, uint32_t len)
 996 {
 997     ESPState *s = req->hba_private;
 998     uint32_t dmalen = esp_get_tc(s);
 999
1000     trace_esp_transfer_data(dmalen, s->ti_size);
1001     s->async_len = len;
1002     s->async_buf = scsi_req_get_buf(req);
1003
1004     if (!s->data_ready) {
1005         s->data_ready = true;
1006
1007         switch (s->rregs[ESP_CMD]) {
1008         case CMD_SEL | CMD_DMA:
1009         case CMD_SEL:
1010         case CMD_SELATN | CMD_DMA:
1011         case CMD_SELATN:
1012             /*
1013              * Initial incoming data xfer is complete for sequencer command
1014              * so raise deferred bus service and function complete interrupt
1015              */
1016              s->rregs[ESP_RINTR] |= INTR_BS | INTR_FC;
1017              s->rregs[ESP_RSEQ] = SEQ_CD;
1018              break;
1019
1020         case CMD_SELATNS | CMD_DMA:
1021         case CMD_SELATNS:
1022             /*
1023              * Initial incoming data xfer is complete so raise command
1024              * completion interrupt
1025              */
1026              s->rregs[ESP_RINTR] |= INTR_BS;
1027              s->rregs[ESP_RSEQ] = SEQ_MO;
1028              break;
1029
1030         case CMD_TI | CMD_DMA:
1031         case CMD_TI:
1032             /*
1033              * Bus service interrupt raised because of initial change to
1034              * DATA phase
1035              */
1036             s->rregs[ESP_CMD] = 0;
1037             s->rregs[ESP_RINTR] |= INTR_BS;
1038             break;
1039         }
1040
1041         esp_raise_irq(s);
1042     }
1043
1044     /*
1045      * Always perform the initial transfer upon reception of the next TI
1046      * command to ensure the DMA/non-DMA status of the command is correct.
1047      * It is not possible to use s->dma directly in the section below as
1048      * some OSs send non-DMA NOP commands after a DMA transfer. Hence if the
1049      * async data transfer is delayed then s->dma is set incorrectly.
1050      */
1051
1052     if (s->rregs[ESP_CMD] == (CMD_TI | CMD_DMA)) {
1053         /* When the SCSI layer returns more data, raise deferred INTR_BS */
1054         esp_dma_ti_check(s);
1055
1056         esp_do_dma(s);
1057     } else if (s->rregs[ESP_CMD] == CMD_TI) {
1058         esp_do_nodma(s);
1059     }
1060 }
1061
1062 static void handle_ti(ESPState *s)
1063 {
1064     uint32_t dmalen;
1065
1066     if (s->dma && !s->dma_enabled) {
1067         s->dma_cb = handle_ti;
1068         return;
1069     }
1070
1071     if (s->dma) {
1072         dmalen = esp_get_tc(s);
1073         trace_esp_handle_ti(dmalen);
1074         esp_do_dma(s);
1075     } else {
1076         trace_esp_handle_ti(s->ti_size);
1077         esp_do_nodma(s);
1078
1079         if (esp_get_phase(s) == STAT_DO) {
1080             esp_nodma_ti_dataout(s);
1081         }
1082     }
1083 }
1084
1085 void esp_hard_reset(ESPState *s)
1086 {
1087     memset(s->rregs, 0, ESP_REGS);
1088     memset(s->wregs, 0, ESP_REGS);
1089     s->tchi_written = 0;
1090     s->ti_size = 0;
1091     s->async_len = 0;
1092     fifo8_reset(&s->fifo);
1093     fifo8_reset(&s->cmdfifo);
1094     s->dma = 0;
1095     s->dma_cb = NULL;
1096
1097     s->rregs[ESP_CFG1] = 7;
1098 }
1099
1100 static void esp_soft_reset(ESPState *s)
1101 {
1102     qemu_irq_lower(s->irq);
1103     qemu_irq_lower(s->drq_irq);
1104     esp_hard_reset(s);
1105 }
1106
1107 static void esp_bus_reset(ESPState *s)
1108 {
1109     bus_cold_reset(BUS(&s->bus));
1110 }
1111
1112 static void parent_esp_reset(ESPState *s, int irq, int level)
1113 {
1114     if (level) {
1115         esp_soft_reset(s);
1116     }
1117 }
1118
1119 static void esp_run_cmd(ESPState *s)
1120 {
1121     uint8_t cmd = s->rregs[ESP_CMD];
1122
1123     if (cmd & CMD_DMA) {
1124         s->dma = 1;
1125         /* Reload DMA counter.  */
1126         if (esp_get_stc(s) == 0) {
1127             esp_set_tc(s, 0x10000);
1128         } else {
1129             esp_set_tc(s, esp_get_stc(s));
1130         }
1131     } else {
1132         s->dma = 0;
1133     }
1134     switch (cmd & CMD_CMD) {
1135     case CMD_NOP:
1136         trace_esp_mem_writeb_cmd_nop(cmd);
1137         break;
1138     case CMD_FLUSH:
1139         trace_esp_mem_writeb_cmd_flush(cmd);
1140         fifo8_reset(&s->fifo);
1141         break;
1142     case CMD_RESET:
1143         trace_esp_mem_writeb_cmd_reset(cmd);
1144         esp_soft_reset(s);
1145         break;
1146     case CMD_BUSRESET:
1147         trace_esp_mem_writeb_cmd_bus_reset(cmd);
1148         esp_bus_reset(s);
1149         if (!(s->wregs[ESP_CFG1] & CFG1_RESREPT)) {
1150             s->rregs[ESP_RINTR] |= INTR_RST;
1151             esp_raise_irq(s);
1152         }
1153         break;
1154     case CMD_TI:
1155         trace_esp_mem_writeb_cmd_ti(cmd);
1156         handle_ti(s);
1157         break;
1158     case CMD_ICCS:
1159         trace_esp_mem_writeb_cmd_iccs(cmd);
1160         write_response(s);
1161         break;
1162     case CMD_MSGACC:
1163         trace_esp_mem_writeb_cmd_msgacc(cmd);
1164         s->rregs[ESP_RINTR] |= INTR_DC;
1165         s->rregs[ESP_RSEQ] = 0;
1166         s->rregs[ESP_RFLAGS] = 0;
1167         esp_raise_irq(s);
1168         break;
1169     case CMD_PAD:
1170         trace_esp_mem_writeb_cmd_pad(cmd);
1171         handle_pad(s);
1172         break;
1173     case CMD_SATN:
1174         trace_esp_mem_writeb_cmd_satn(cmd);
1175         break;
1176     case CMD_RSTATN:
1177         trace_esp_mem_writeb_cmd_rstatn(cmd);
1178         break;
1179     case CMD_SEL:
1180         trace_esp_mem_writeb_cmd_sel(cmd);
1181         handle_s_without_atn(s);
1182         break;
1183     case CMD_SELATN:
1184         trace_esp_mem_writeb_cmd_selatn(cmd);
1185         handle_satn(s);
1186         break;
1187     case CMD_SELATNS:
1188         trace_esp_mem_writeb_cmd_selatns(cmd);
1189         handle_satn_stop(s);
1190         break;
1191     case CMD_ENSEL:
1192         trace_esp_mem_writeb_cmd_ensel(cmd);
1193         s->rregs[ESP_RINTR] = 0;
1194         break;
1195     case CMD_DISSEL:
1196         trace_esp_mem_writeb_cmd_dissel(cmd);
1197         s->rregs[ESP_RINTR] = 0;
1198         esp_raise_irq(s);
1199         break;
1200     default:
1201         trace_esp_error_unhandled_command(cmd);
1202         break;
1203     }
1204 }
1205
1206 uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
1207 {
1208     uint32_t val;
1209
1210     switch (saddr) {
1211     case ESP_FIFO:
1212         s->rregs[ESP_FIFO] = esp_fifo_pop(s);
1213         val = s->rregs[ESP_FIFO];
1214         break;
1215     case ESP_RINTR:
1216         /*
1217          * Clear sequence step, interrupt register and all status bits
1218          * except TC
1219          */
1220         val = s->rregs[ESP_RINTR];
1221         s->rregs[ESP_RINTR] = 0;
1222         esp_lower_irq(s);
1223         s->rregs[ESP_RSTAT] &= STAT_TC | 7;
1224         /*
1225          * According to the datasheet ESP_RSEQ should be cleared, but as the
1226          * emulation currently defers information transfers to the next TI
1227          * command leave it for now so that pedantic guests such as the old
1228          * Linux 2.6 driver see the correct flags before the next SCSI phase
1229          * transition.
1230          *
1231          * s->rregs[ESP_RSEQ] = SEQ_0;
1232          */
1233         break;
1234     case ESP_TCHI:
1235         /* Return the unique id if the value has never been written */
1236         if (!s->tchi_written) {
1237             val = s->chip_id;
1238         } else {
1239             val = s->rregs[saddr];
1240         }
1241         break;
1242      case ESP_RFLAGS:
1243         /* Bottom 5 bits indicate number of bytes in FIFO */
1244         val = fifo8_num_used(&s->fifo);
1245         break;
1246     default:
1247         val = s->rregs[saddr];
1248         break;
1249     }
1250
1251     trace_esp_mem_readb(saddr, val);
1252     return val;
1253 }
1254
1255 void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
1256 {
1257     trace_esp_mem_writeb(saddr, s->wregs[saddr], val);
1258     switch (saddr) {
1259     case ESP_TCHI:
1260         s->tchi_written = true;
1261         /* fall through */
1262     case ESP_TCLO:
1263     case ESP_TCMID:
1264         s->rregs[ESP_RSTAT] &= ~STAT_TC;
1265         break;
1266     case ESP_FIFO:
1267         if (!fifo8_is_full(&s->fifo)) {
1268             esp_fifo_push(s, val);
1269         }
1270         esp_do_nodma(s);
1271         break;
1272     case ESP_CMD:
1273         s->rregs[saddr] = val;
1274         esp_run_cmd(s);
1275         break;
1276     case ESP_WBUSID ... ESP_WSYNO:
1277         break;
1278     case ESP_CFG1:
1279     case ESP_CFG2: case ESP_CFG3:
1280     case ESP_RES3: case ESP_RES4:
1281         s->rregs[saddr] = val;
1282         break;
1283     case ESP_WCCF ... ESP_WTEST:
1284         break;
1285     default:
1286         trace_esp_error_invalid_write(val, saddr);
1287         return;
1288     }
1289     s->wregs[saddr] = val;
1290 }
1291
1292 static bool esp_mem_accepts(void *opaque, hwaddr addr,
1293                             unsigned size, bool is_write,
1294                             MemTxAttrs attrs)
1295 {
1296     return (size == 1) || (is_write && size == 4);
1297 }
1298
1299 static bool esp_is_before_version_5(void *opaque, int version_id)
1300 {
1301     ESPState *s = ESP(opaque);
1302
1303     version_id = MIN(version_id, s->mig_version_id);
1304     return version_id < 5;
1305 }
1306
1307 static bool esp_is_version_5(void *opaque, int version_id)
1308 {
1309     ESPState *s = ESP(opaque);
1310
1311     version_id = MIN(version_id, s->mig_version_id);
1312     return version_id >= 5;
1313 }
1314
1315 static bool esp_is_version_6(void *opaque, int version_id)
1316 {
1317     ESPState *s = ESP(opaque);
1318
1319     version_id = MIN(version_id, s->mig_version_id);
1320     return version_id >= 6;
1321 }
1322
1323 static bool esp_is_between_version_5_and_6(void *opaque, int version_id)
1324 {
1325     ESPState *s = ESP(opaque);
1326
1327     version_id = MIN(version_id, s->mig_version_id);
1328     return version_id >= 5 && version_id <= 6;
1329 }
1330
1331 int esp_pre_save(void *opaque)
1332 {
1333     ESPState *s = ESP(object_resolve_path_component(
1334                       OBJECT(opaque), "esp"));
1335
1336     s->mig_version_id = vmstate_esp.version_id;
1337     return 0;
1338 }
1339
1340 static int esp_post_load(void *opaque, int version_id)
1341 {
1342     ESPState *s = ESP(opaque);
1343     int len, i;
1344
1345     version_id = MIN(version_id, s->mig_version_id);
1346
1347     if (version_id < 5) {
1348         esp_set_tc(s, s->mig_dma_left);
1349
1350         /* Migrate ti_buf to fifo */
1351         len = s->mig_ti_wptr - s->mig_ti_rptr;
1352         for (i = 0; i < len; i++) {
1353             fifo8_push(&s->fifo, s->mig_ti_buf[i]);
1354         }
1355
1356         /* Migrate cmdbuf to cmdfifo */
1357         for (i = 0; i < s->mig_cmdlen; i++) {
1358             fifo8_push(&s->cmdfifo, s->mig_cmdbuf[i]);
1359         }
1360     }
1361
1362     s->mig_version_id = vmstate_esp.version_id;
1363     return 0;
1364 }
1365
1366 const VMStateDescription vmstate_esp = {
1367     .name = "esp",
1368     .version_id = 7,
1369     .minimum_version_id = 3,
1370     .post_load = esp_post_load,
1371     .fields = (const VMStateField[]) {
1372         VMSTATE_BUFFER(rregs, ESPState),
1373         VMSTATE_BUFFER(wregs, ESPState),
1374         VMSTATE_INT32(ti_size, ESPState),
1375         VMSTATE_UINT32_TEST(mig_ti_rptr, ESPState, esp_is_before_version_5),
1376         VMSTATE_UINT32_TEST(mig_ti_wptr, ESPState, esp_is_before_version_5),
1377         VMSTATE_BUFFER_TEST(mig_ti_buf, ESPState, esp_is_before_version_5),
1378         VMSTATE_UINT32(status, ESPState),
1379         VMSTATE_UINT32_TEST(mig_deferred_status, ESPState,
1380                             esp_is_before_version_5),
1381         VMSTATE_BOOL_TEST(mig_deferred_complete, ESPState,
1382                           esp_is_before_version_5),
1383         VMSTATE_UINT32(dma, ESPState),
1384         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 0,
1385                               esp_is_before_version_5, 0, 16),
1386         VMSTATE_STATIC_BUFFER(mig_cmdbuf, ESPState, 4,
1387                               esp_is_before_version_5, 16,
1388                               sizeof(typeof_field(ESPState, mig_cmdbuf))),
1389         VMSTATE_UINT32_TEST(mig_cmdlen, ESPState, esp_is_before_version_5),
1390         VMSTATE_UINT32(do_cmd, ESPState),
1391         VMSTATE_UINT32_TEST(mig_dma_left, ESPState, esp_is_before_version_5),
1392         VMSTATE_BOOL_TEST(data_ready, ESPState, esp_is_version_5),
1393         VMSTATE_UINT8_TEST(cmdfifo_cdb_offset, ESPState, esp_is_version_5),
1394         VMSTATE_FIFO8_TEST(fifo, ESPState, esp_is_version_5),
1395         VMSTATE_FIFO8_TEST(cmdfifo, ESPState, esp_is_version_5),
1396         VMSTATE_UINT8_TEST(mig_ti_cmd, ESPState,
1397                            esp_is_between_version_5_and_6),
1398         VMSTATE_UINT8_TEST(lun, ESPState, esp_is_version_6),
1399         VMSTATE_BOOL(drq_state, ESPState),
1400         VMSTATE_END_OF_LIST()
1401     },
1402 };
1403
1404 static void sysbus_esp_mem_write(void *opaque, hwaddr addr,
1405                                  uint64_t val, unsigned int size)
1406 {
1407     SysBusESPState *sysbus = opaque;
1408     ESPState *s = ESP(&sysbus->esp);
1409     uint32_t saddr;
1410
1411     saddr = addr >> sysbus->it_shift;
1412     esp_reg_write(s, saddr, val);
1413 }
1414
1415 static uint64_t sysbus_esp_mem_read(void *opaque, hwaddr addr,
1416                                     unsigned int size)
1417 {
1418     SysBusESPState *sysbus = opaque;
1419     ESPState *s = ESP(&sysbus->esp);
1420     uint32_t saddr;
1421
1422     saddr = addr >> sysbus->it_shift;
1423     return esp_reg_read(s, saddr);
1424 }
1425
1426 static const MemoryRegionOps sysbus_esp_mem_ops = {
1427     .read = sysbus_esp_mem_read,
1428     .write = sysbus_esp_mem_write,
1429     .endianness = DEVICE_NATIVE_ENDIAN,
1430     .valid.accepts = esp_mem_accepts,
1431 };
1432
1433 static void sysbus_esp_pdma_write(void *opaque, hwaddr addr,
1434                                   uint64_t val, unsigned int size)
1435 {
1436     SysBusESPState *sysbus = opaque;
1437     ESPState *s = ESP(&sysbus->esp);
1438
1439     trace_esp_pdma_write(size);
1440
1441     switch (size) {
1442     case 1:
1443         esp_pdma_write(s, val);
1444         break;
1445     case 2:
1446         esp_pdma_write(s, val >> 8);
1447         esp_pdma_write(s, val);
1448         break;
1449     }
1450     esp_do_dma(s);
1451 }
1452
1453 static uint64_t sysbus_esp_pdma_read(void *opaque, hwaddr addr,
1454                                      unsigned int size)
1455 {
1456     SysBusESPState *sysbus = opaque;
1457     ESPState *s = ESP(&sysbus->esp);
1458     uint64_t val = 0;
1459
1460     trace_esp_pdma_read(size);
1461
1462     switch (size) {
1463     case 1:
1464         val = esp_pdma_read(s);
1465         break;
1466     case 2:
1467         val = esp_pdma_read(s);
1468         val = (val << 8) | esp_pdma_read(s);
1469         break;
1470     }
1471     esp_do_dma(s);
1472     return val;
1473 }
1474
1475 static void *esp_load_request(QEMUFile *f, SCSIRequest *req)
1476 {
1477     ESPState *s = container_of(req->bus, ESPState, bus);
1478
1479     scsi_req_ref(req);
1480     s->current_req = req;
1481     return s;
1482 }
1483
1484 static const MemoryRegionOps sysbus_esp_pdma_ops = {
1485     .read = sysbus_esp_pdma_read,
1486     .write = sysbus_esp_pdma_write,
1487     .endianness = DEVICE_NATIVE_ENDIAN,
1488     .valid.min_access_size = 1,
1489     .valid.max_access_size = 4,
1490     .impl.min_access_size = 1,
1491     .impl.max_access_size = 2,
1492 };
1493
1494 static const struct SCSIBusInfo esp_scsi_info = {
1495     .tcq = false,
1496     .max_target = ESP_MAX_DEVS,
1497     .max_lun = 7,
1498
1499     .load_request = esp_load_request,
1500     .transfer_data = esp_transfer_data,
1501     .complete = esp_command_complete,
1502     .cancel = esp_request_cancelled
1503 };
1504
1505 static void sysbus_esp_gpio_demux(void *opaque, int irq, int level)
1506 {
1507     SysBusESPState *sysbus = SYSBUS_ESP(opaque);
1508     ESPState *s = ESP(&sysbus->esp);
1509
1510     switch (irq) {
1511     case 0:
1512         parent_esp_reset(s, irq, level);
1513         break;
1514     case 1:
1515         esp_dma_enable(s, irq, level);
1516         break;
1517     }
1518 }
1519
1520 static void sysbus_esp_realize(DeviceState *dev, Error **errp)
1521 {
1522     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1523     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1524     ESPState *s = ESP(&sysbus->esp);
1525
1526     if (!qdev_realize(DEVICE(s), NULL, errp)) {
1527         return;
1528     }
1529
1530     sysbus_init_irq(sbd, &s->irq);
1531     sysbus_init_irq(sbd, &s->drq_irq);
1532     assert(sysbus->it_shift != -1);
1533
1534     s->chip_id = TCHI_FAS100A;
1535     memory_region_init_io(&sysbus->iomem, OBJECT(sysbus), &sysbus_esp_mem_ops,
1536                           sysbus, "esp-regs", ESP_REGS << sysbus->it_shift);
1537     sysbus_init_mmio(sbd, &sysbus->iomem);
1538     memory_region_init_io(&sysbus->pdma, OBJECT(sysbus), &sysbus_esp_pdma_ops,
1539                           sysbus, "esp-pdma", 4);
1540     sysbus_init_mmio(sbd, &sysbus->pdma);
1541
1542     qdev_init_gpio_in(dev, sysbus_esp_gpio_demux, 2);
1543
1544     scsi_bus_init(&s->bus, sizeof(s->bus), dev, &esp_scsi_info);
1545 }
1546
1547 static void sysbus_esp_hard_reset(DeviceState *dev)
1548 {
1549     SysBusESPState *sysbus = SYSBUS_ESP(dev);
1550     ESPState *s = ESP(&sysbus->esp);
1551
1552     esp_hard_reset(s);
1553 }
1554
1555 static void sysbus_esp_init(Object *obj)
1556 {
1557     SysBusESPState *sysbus = SYSBUS_ESP(obj);
1558
1559     object_initialize_child(obj, "esp", &sysbus->esp, TYPE_ESP);
1560 }
1561
1562 static const VMStateDescription vmstate_sysbus_esp_scsi = {
1563     .name = "sysbusespscsi",
1564     .version_id = 2,
1565     .minimum_version_id = 1,
1566     .pre_save = esp_pre_save,
1567     .fields = (const VMStateField[]) {
1568         VMSTATE_UINT8_V(esp.mig_version_id, SysBusESPState, 2),
1569         VMSTATE_STRUCT(esp, SysBusESPState, 0, vmstate_esp, ESPState),
1570         VMSTATE_END_OF_LIST()
1571     }
1572 };
1573
1574 static void sysbus_esp_class_init(ObjectClass *klass, void *data)
1575 {
1576     DeviceClass *dc = DEVICE_CLASS(klass);
1577
1578     dc->realize = sysbus_esp_realize;
1579     dc->reset = sysbus_esp_hard_reset;
1580     dc->vmsd = &vmstate_sysbus_esp_scsi;
1581     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1582 }
1583
1584 static void esp_finalize(Object *obj)
1585 {
1586     ESPState *s = ESP(obj);
1587
1588     fifo8_destroy(&s->fifo);
1589     fifo8_destroy(&s->cmdfifo);
1590 }
1591
1592 static void esp_init(Object *obj)
1593 {
1594     ESPState *s = ESP(obj);
1595
1596     fifo8_create(&s->fifo, ESP_FIFO_SZ);
1597     fifo8_create(&s->cmdfifo, ESP_CMDFIFO_SZ);
1598 }
1599
1600 static void esp_class_init(ObjectClass *klass, void *data)
1601 {
1602     DeviceClass *dc = DEVICE_CLASS(klass);
1603
1604     /* internal device for sysbusesp/pciespscsi, not user-creatable */
1605     dc->user_creatable = false;
1606     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1607 }
1608
1609 static const TypeInfo esp_info_types[] = {
1610     {
1611         .name          = TYPE_SYSBUS_ESP,
1612         .parent        = TYPE_SYS_BUS_DEVICE,
1613         .instance_init = sysbus_esp_init,
1614         .instance_size = sizeof(SysBusESPState),
1615         .class_init    = sysbus_esp_class_init,
1616     },
1617     {
1618         .name = TYPE_ESP,
1619         .parent = TYPE_DEVICE,
1620         .instance_init = esp_init,
1621         .instance_finalize = esp_finalize,
1622         .instance_size = sizeof(ESPState),
1623         .class_init = esp_class_init,
1624     },
1625 };
1626
1627 DEFINE_TYPES(esp_info_types)