Statistics
| Branch: | Revision:

root / hw / ide / core.c @ 1bdaa28d

History | View | Annotate | Download (84.7 kB)

1
/*
2
 * QEMU IDE disk and CD/DVD-ROM Emulator
3
 *
4
 * Copyright (c) 2003 Fabrice Bellard
5
 * Copyright (c) 2006 Openedhand Ltd.
6
 *
7
 * Permission is hereby granted, free of charge, to any person obtaining a copy
8
 * of this software and associated documentation files (the "Software"), to deal
9
 * in the Software without restriction, including without limitation the rights
10
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11
 * copies of the Software, and to permit persons to whom the Software is
12
 * furnished to do so, subject to the following conditions:
13
 *
14
 * The above copyright notice and this permission notice shall be included in
15
 * all copies or substantial portions of the Software.
16
 *
17
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23
 * THE SOFTWARE.
24
 */
25
#include <hw/hw.h>
26
#include <hw/pc.h>
27
#include <hw/pci.h>
28
#include <hw/scsi.h>
29
#include "qemu-error.h"
30
#include "qemu-timer.h"
31
#include "sysemu.h"
32
#include "dma.h"
33
#include "blockdev.h"
34

    
35
#include <hw/ide/internal.h>
36

    
37
static const int smart_attributes[][5] = {
38
    /* id,  flags, val, wrst, thrsh */
39
    { 0x01, 0x03, 0x64, 0x64, 0x06}, /* raw read */
40
    { 0x03, 0x03, 0x64, 0x64, 0x46}, /* spin up */
41
    { 0x04, 0x02, 0x64, 0x64, 0x14}, /* start stop count */
42
    { 0x05, 0x03, 0x64, 0x64, 0x36}, /* remapped sectors */
43
    { 0x00, 0x00, 0x00, 0x00, 0x00}
44
};
45

    
46
/* XXX: DVDs that could fit on a CD will be reported as a CD */
47
static inline int media_present(IDEState *s)
48
{
49
    return (s->nb_sectors > 0);
50
}
51

    
52
static inline int media_is_dvd(IDEState *s)
53
{
54
    return (media_present(s) && s->nb_sectors > CD_MAX_SECTORS);
55
}
56

    
57
static inline int media_is_cd(IDEState *s)
58
{
59
    return (media_present(s) && s->nb_sectors <= CD_MAX_SECTORS);
60
}
61

    
62
static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret);
63
static int ide_handle_rw_error(IDEState *s, int error, int op);
64

    
65
static void padstr(char *str, const char *src, int len)
66
{
67
    int i, v;
68
    for(i = 0; i < len; i++) {
69
        if (*src)
70
            v = *src++;
71
        else
72
            v = ' ';
73
        str[i^1] = v;
74
    }
75
}
76

    
77
static void padstr8(uint8_t *buf, int buf_size, const char *src)
78
{
79
    int i;
80
    for(i = 0; i < buf_size; i++) {
81
        if (*src)
82
            buf[i] = *src++;
83
        else
84
            buf[i] = ' ';
85
    }
86
}
87

    
88
static void put_le16(uint16_t *p, unsigned int v)
89
{
90
    *p = cpu_to_le16(v);
91
}
92

    
93
static void ide_identify(IDEState *s)
94
{
95
    uint16_t *p;
96
    unsigned int oldsize;
97
    IDEDevice *dev;
98

    
99
    if (s->identify_set) {
100
        memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
101
        return;
102
    }
103

    
104
    memset(s->io_buffer, 0, 512);
105
    p = (uint16_t *)s->io_buffer;
106
    put_le16(p + 0, 0x0040);
107
    put_le16(p + 1, s->cylinders);
108
    put_le16(p + 3, s->heads);
109
    put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
110
    put_le16(p + 5, 512); /* XXX: retired, remove ? */
111
    put_le16(p + 6, s->sectors);
112
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
113
    put_le16(p + 20, 3); /* XXX: retired, remove ? */
114
    put_le16(p + 21, 512); /* cache size in sectors */
115
    put_le16(p + 22, 4); /* ecc bytes */
116
    padstr((char *)(p + 23), s->version, 8); /* firmware version */
117
    padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
118
#if MAX_MULT_SECTORS > 1
119
    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
120
#endif
121
    put_le16(p + 48, 1); /* dword I/O */
122
    put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
123
    put_le16(p + 51, 0x200); /* PIO transfer cycle */
124
    put_le16(p + 52, 0x200); /* DMA transfer cycle */
125
    put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
126
    put_le16(p + 54, s->cylinders);
127
    put_le16(p + 55, s->heads);
128
    put_le16(p + 56, s->sectors);
129
    oldsize = s->cylinders * s->heads * s->sectors;
130
    put_le16(p + 57, oldsize);
131
    put_le16(p + 58, oldsize >> 16);
132
    if (s->mult_sectors)
133
        put_le16(p + 59, 0x100 | s->mult_sectors);
134
    put_le16(p + 60, s->nb_sectors);
135
    put_le16(p + 61, s->nb_sectors >> 16);
136
    put_le16(p + 62, 0x07); /* single word dma0-2 supported */
137
    put_le16(p + 63, 0x07); /* mdma0-2 supported */
138
    put_le16(p + 64, 0x03); /* pio3-4 supported */
139
    put_le16(p + 65, 120);
140
    put_le16(p + 66, 120);
141
    put_le16(p + 67, 120);
142
    put_le16(p + 68, 120);
143

    
144
    if (s->ncq_queues) {
145
        put_le16(p + 75, s->ncq_queues - 1);
146
        /* NCQ supported */
147
        put_le16(p + 76, (1 << 8));
148
    }
149

    
150
    put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
151
    put_le16(p + 81, 0x16); /* conforms to ata5 */
152
    /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */
153
    put_le16(p + 82, (1 << 14) | (1 << 5) | 1);
154
    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
155
    put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
156
    /* 14=set to 1, 1=SMART self test, 0=SMART error logging */
157
    put_le16(p + 84, (1 << 14) | 0);
158
    /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */
159
    if (bdrv_enable_write_cache(s->bs))
160
         put_le16(p + 85, (1 << 14) | (1 << 5) | 1);
161
    else
162
         put_le16(p + 85, (1 << 14) | 1);
163
    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
164
    put_le16(p + 86, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
165
    /* 14=set to 1, 1=smart self test, 0=smart error logging */
166
    put_le16(p + 87, (1 << 14) | 0);
167
    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
168
    put_le16(p + 93, 1 | (1 << 14) | 0x2000);
169
    put_le16(p + 100, s->nb_sectors);
170
    put_le16(p + 101, s->nb_sectors >> 16);
171
    put_le16(p + 102, s->nb_sectors >> 32);
172
    put_le16(p + 103, s->nb_sectors >> 48);
173
    dev = s->unit ? s->bus->slave : s->bus->master;
174
    if (dev && dev->conf.physical_block_size)
175
        put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));
176

    
177
    memcpy(s->identify_data, p, sizeof(s->identify_data));
178
    s->identify_set = 1;
179
}
180

    
181
static void ide_atapi_identify(IDEState *s)
182
{
183
    uint16_t *p;
184

    
185
    if (s->identify_set) {
186
        memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
187
        return;
188
    }
189

    
190
    memset(s->io_buffer, 0, 512);
191
    p = (uint16_t *)s->io_buffer;
192
    /* Removable CDROM, 50us response, 12 byte packets */
193
    put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
194
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
195
    put_le16(p + 20, 3); /* buffer type */
196
    put_le16(p + 21, 512); /* cache size in sectors */
197
    put_le16(p + 22, 4); /* ecc bytes */
198
    padstr((char *)(p + 23), s->version, 8); /* firmware version */
199
    padstr((char *)(p + 27), "QEMU DVD-ROM", 40); /* model */
200
    put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
201
#ifdef USE_DMA_CDROM
202
    put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
203
    put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
204
    put_le16(p + 62, 7);  /* single word dma0-2 supported */
205
    put_le16(p + 63, 7);  /* mdma0-2 supported */
206
#else
207
    put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
208
    put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
209
    put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
210
#endif
211
    put_le16(p + 64, 3); /* pio3-4 supported */
212
    put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
213
    put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
214
    put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
215
    put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
216

    
217
    put_le16(p + 71, 30); /* in ns */
218
    put_le16(p + 72, 30); /* in ns */
219

    
220
    if (s->ncq_queues) {
221
        put_le16(p + 75, s->ncq_queues - 1);
222
        /* NCQ supported */
223
        put_le16(p + 76, (1 << 8));
224
    }
225

    
226
    put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
227
#ifdef USE_DMA_CDROM
228
    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
229
#endif
230
    memcpy(s->identify_data, p, sizeof(s->identify_data));
231
    s->identify_set = 1;
232
}
233

    
234
static void ide_cfata_identify(IDEState *s)
235
{
236
    uint16_t *p;
237
    uint32_t cur_sec;
238

    
239
    p = (uint16_t *) s->identify_data;
240
    if (s->identify_set)
241
        goto fill_buffer;
242

    
243
    memset(p, 0, sizeof(s->identify_data));
244

    
245
    cur_sec = s->cylinders * s->heads * s->sectors;
246

    
247
    put_le16(p + 0, 0x848a);                        /* CF Storage Card signature */
248
    put_le16(p + 1, s->cylinders);                /* Default cylinders */
249
    put_le16(p + 3, s->heads);                        /* Default heads */
250
    put_le16(p + 6, s->sectors);                /* Default sectors per track */
251
    put_le16(p + 7, s->nb_sectors >> 16);        /* Sectors per card */
252
    put_le16(p + 8, s->nb_sectors);                /* Sectors per card */
253
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
254
    put_le16(p + 22, 0x0004);                        /* ECC bytes */
255
    padstr((char *) (p + 23), s->version, 8);        /* Firmware Revision */
256
    padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
257
#if MAX_MULT_SECTORS > 1
258
    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
259
#else
260
    put_le16(p + 47, 0x0000);
261
#endif
262
    put_le16(p + 49, 0x0f00);                        /* Capabilities */
263
    put_le16(p + 51, 0x0002);                        /* PIO cycle timing mode */
264
    put_le16(p + 52, 0x0001);                        /* DMA cycle timing mode */
265
    put_le16(p + 53, 0x0003);                        /* Translation params valid */
266
    put_le16(p + 54, s->cylinders);                /* Current cylinders */
267
    put_le16(p + 55, s->heads);                        /* Current heads */
268
    put_le16(p + 56, s->sectors);                /* Current sectors */
269
    put_le16(p + 57, cur_sec);                        /* Current capacity */
270
    put_le16(p + 58, cur_sec >> 16);                /* Current capacity */
271
    if (s->mult_sectors)                        /* Multiple sector setting */
272
        put_le16(p + 59, 0x100 | s->mult_sectors);
273
    put_le16(p + 60, s->nb_sectors);                /* Total LBA sectors */
274
    put_le16(p + 61, s->nb_sectors >> 16);        /* Total LBA sectors */
275
    put_le16(p + 63, 0x0203);                        /* Multiword DMA capability */
276
    put_le16(p + 64, 0x0001);                        /* Flow Control PIO support */
277
    put_le16(p + 65, 0x0096);                        /* Min. Multiword DMA cycle */
278
    put_le16(p + 66, 0x0096);                        /* Rec. Multiword DMA cycle */
279
    put_le16(p + 68, 0x00b4);                        /* Min. PIO cycle time */
280
    put_le16(p + 82, 0x400c);                        /* Command Set supported */
281
    put_le16(p + 83, 0x7068);                        /* Command Set supported */
282
    put_le16(p + 84, 0x4000);                        /* Features supported */
283
    put_le16(p + 85, 0x000c);                        /* Command Set enabled */
284
    put_le16(p + 86, 0x7044);                        /* Command Set enabled */
285
    put_le16(p + 87, 0x4000);                        /* Features enabled */
286
    put_le16(p + 91, 0x4060);                        /* Current APM level */
287
    put_le16(p + 129, 0x0002);                        /* Current features option */
288
    put_le16(p + 130, 0x0005);                        /* Reassigned sectors */
289
    put_le16(p + 131, 0x0001);                        /* Initial power mode */
290
    put_le16(p + 132, 0x0000);                        /* User signature */
291
    put_le16(p + 160, 0x8100);                        /* Power requirement */
292
    put_le16(p + 161, 0x8001);                        /* CF command set */
293

    
294
    s->identify_set = 1;
295

    
296
fill_buffer:
297
    memcpy(s->io_buffer, p, sizeof(s->identify_data));
298
}
299

    
300
static void ide_set_signature(IDEState *s)
301
{
302
    s->select &= 0xf0; /* clear head */
303
    /* put signature */
304
    s->nsector = 1;
305
    s->sector = 1;
306
    if (s->drive_kind == IDE_CD) {
307
        s->lcyl = 0x14;
308
        s->hcyl = 0xeb;
309
    } else if (s->bs) {
310
        s->lcyl = 0;
311
        s->hcyl = 0;
312
    } else {
313
        s->lcyl = 0xff;
314
        s->hcyl = 0xff;
315
    }
316
}
317

    
318
static inline void ide_abort_command(IDEState *s)
319
{
320
    s->status = READY_STAT | ERR_STAT;
321
    s->error = ABRT_ERR;
322
}
323

    
324
static inline void ide_dma_submit_check(IDEState *s,
325
          BlockDriverCompletionFunc *dma_cb)
326
{
327
    if (s->bus->dma->aiocb)
328
        return;
329
    dma_cb(s, -1);
330
}
331

    
332
/* prepare data transfer and tell what to do after */
333
static void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
334
                               EndTransferFunc *end_transfer_func)
335
{
336
    s->end_transfer_func = end_transfer_func;
337
    s->data_ptr = buf;
338
    s->data_end = buf + size;
339
    if (!(s->status & ERR_STAT)) {
340
        s->status |= DRQ_STAT;
341
    }
342
    s->bus->dma->ops->start_transfer(s->bus->dma);
343
}
344

    
345
static void ide_transfer_stop(IDEState *s)
346
{
347
    s->end_transfer_func = ide_transfer_stop;
348
    s->data_ptr = s->io_buffer;
349
    s->data_end = s->io_buffer;
350
    s->status &= ~DRQ_STAT;
351
}
352

    
353
int64_t ide_get_sector(IDEState *s)
354
{
355
    int64_t sector_num;
356
    if (s->select & 0x40) {
357
        /* lba */
358
        if (!s->lba48) {
359
            sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
360
                (s->lcyl << 8) | s->sector;
361
        } else {
362
            sector_num = ((int64_t)s->hob_hcyl << 40) |
363
                ((int64_t) s->hob_lcyl << 32) |
364
                ((int64_t) s->hob_sector << 24) |
365
                ((int64_t) s->hcyl << 16) |
366
                ((int64_t) s->lcyl << 8) | s->sector;
367
        }
368
    } else {
369
        sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
370
            (s->select & 0x0f) * s->sectors + (s->sector - 1);
371
    }
372
    return sector_num;
373
}
374

    
375
void ide_set_sector(IDEState *s, int64_t sector_num)
376
{
377
    unsigned int cyl, r;
378
    if (s->select & 0x40) {
379
        if (!s->lba48) {
380
            s->select = (s->select & 0xf0) | (sector_num >> 24);
381
            s->hcyl = (sector_num >> 16);
382
            s->lcyl = (sector_num >> 8);
383
            s->sector = (sector_num);
384
        } else {
385
            s->sector = sector_num;
386
            s->lcyl = sector_num >> 8;
387
            s->hcyl = sector_num >> 16;
388
            s->hob_sector = sector_num >> 24;
389
            s->hob_lcyl = sector_num >> 32;
390
            s->hob_hcyl = sector_num >> 40;
391
        }
392
    } else {
393
        cyl = sector_num / (s->heads * s->sectors);
394
        r = sector_num % (s->heads * s->sectors);
395
        s->hcyl = cyl >> 8;
396
        s->lcyl = cyl;
397
        s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
398
        s->sector = (r % s->sectors) + 1;
399
    }
400
}
401

    
402
static void ide_rw_error(IDEState *s) {
403
    ide_abort_command(s);
404
    ide_set_irq(s->bus);
405
}
406

    
407
void ide_sector_read(IDEState *s)
408
{
409
    int64_t sector_num;
410
    int ret, n;
411

    
412
    s->status = READY_STAT | SEEK_STAT;
413
    s->error = 0; /* not needed by IDE spec, but needed by Windows */
414
    sector_num = ide_get_sector(s);
415
    n = s->nsector;
416
    if (n == 0) {
417
        /* no more sector to read from disk */
418
        ide_transfer_stop(s);
419
    } else {
420
#if defined(DEBUG_IDE)
421
        printf("read sector=%" PRId64 "\n", sector_num);
422
#endif
423
        if (n > s->req_nb_sectors)
424
            n = s->req_nb_sectors;
425
        ret = bdrv_read(s->bs, sector_num, s->io_buffer, n);
426
        if (ret != 0) {
427
            if (ide_handle_rw_error(s, -ret,
428
                BM_STATUS_PIO_RETRY | BM_STATUS_RETRY_READ))
429
            {
430
                return;
431
            }
432
        }
433
        ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read);
434
        ide_set_irq(s->bus);
435
        ide_set_sector(s, sector_num + n);
436
        s->nsector -= n;
437
    }
438
}
439

    
440
static void dma_buf_commit(IDEState *s, int is_write)
441
{
442
    qemu_sglist_destroy(&s->sg);
443
}
444

    
445
static void ide_set_inactive(IDEState *s)
446
{
447
    s->bus->dma->aiocb = NULL;
448
    s->bus->dma->ops->set_inactive(s->bus->dma);
449
}
450

    
451
void ide_dma_error(IDEState *s)
452
{
453
    ide_transfer_stop(s);
454
    s->error = ABRT_ERR;
455
    s->status = READY_STAT | ERR_STAT;
456
    ide_set_inactive(s);
457
    s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_INT);
458
    ide_set_irq(s->bus);
459
}
460

    
461
static int ide_handle_rw_error(IDEState *s, int error, int op)
462
{
463
    int is_read = (op & BM_STATUS_RETRY_READ);
464
    BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);
465

    
466
    if (action == BLOCK_ERR_IGNORE) {
467
        bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);
468
        return 0;
469
    }
470

    
471
    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
472
            || action == BLOCK_ERR_STOP_ANY) {
473
        s->bus->dma->ops->set_unit(s->bus->dma, s->unit);
474
        s->bus->dma->ops->add_status(s->bus->dma, op);
475
        bdrv_mon_event(s->bs, BDRV_ACTION_STOP, is_read);
476
        vm_stop(0);
477
    } else {
478
        if (op & BM_STATUS_DMA_RETRY) {
479
            dma_buf_commit(s, 0);
480
            ide_dma_error(s);
481
        } else {
482
            ide_rw_error(s);
483
        }
484
        bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read);
485
    }
486

    
487
    return 1;
488
}
489

    
490
void ide_read_dma_cb(void *opaque, int ret)
491
{
492
    IDEState *s = opaque;
493
    int n;
494
    int64_t sector_num;
495

    
496
    if (ret < 0) {
497
        if (ide_handle_rw_error(s, -ret,
498
            BM_STATUS_DMA_RETRY | BM_STATUS_RETRY_READ))
499
        {
500
            return;
501
        }
502
    }
503

    
504
    n = s->io_buffer_size >> 9;
505
    sector_num = ide_get_sector(s);
506
    if (n > 0) {
507
        dma_buf_commit(s, 1);
508
        sector_num += n;
509
        ide_set_sector(s, sector_num);
510
        s->nsector -= n;
511
    }
512

    
513
    /* end of transfer ? */
514
    if (s->nsector == 0) {
515
        s->status = READY_STAT | SEEK_STAT;
516
        ide_set_irq(s->bus);
517
    eot:
518
        s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_INT);
519
        ide_set_inactive(s);
520
        return;
521
    }
522

    
523
    /* launch next transfer */
524
    n = s->nsector;
525
    s->io_buffer_index = 0;
526
    s->io_buffer_size = n * 512;
527
    if (s->bus->dma->ops->prepare_buf(s->bus->dma, 1) == 0)
528
        goto eot;
529
#ifdef DEBUG_AIO
530
    printf("aio_read: sector_num=%" PRId64 " n=%d\n", sector_num, n);
531
#endif
532
    s->bus->dma->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num, ide_read_dma_cb, s);
533
    ide_dma_submit_check(s, ide_read_dma_cb);
534
}
535

    
536
static void ide_sector_read_dma(IDEState *s)
537
{
538
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
539
    s->io_buffer_index = 0;
540
    s->io_buffer_size = 0;
541
    s->is_read = 1;
542
    s->bus->dma->ops->start_dma(s->bus->dma, s, ide_read_dma_cb);
543
}
544

    
545
static void ide_sector_write_timer_cb(void *opaque)
546
{
547
    IDEState *s = opaque;
548
    ide_set_irq(s->bus);
549
}
550

    
551
void ide_sector_write(IDEState *s)
552
{
553
    int64_t sector_num;
554
    int ret, n, n1;
555

    
556
    s->status = READY_STAT | SEEK_STAT;
557
    sector_num = ide_get_sector(s);
558
#if defined(DEBUG_IDE)
559
    printf("write sector=%" PRId64 "\n", sector_num);
560
#endif
561
    n = s->nsector;
562
    if (n > s->req_nb_sectors)
563
        n = s->req_nb_sectors;
564
    ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
565

    
566
    if (ret != 0) {
567
        if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY))
568
            return;
569
    }
570

    
571
    s->nsector -= n;
572
    if (s->nsector == 0) {
573
        /* no more sectors to write */
574
        ide_transfer_stop(s);
575
    } else {
576
        n1 = s->nsector;
577
        if (n1 > s->req_nb_sectors)
578
            n1 = s->req_nb_sectors;
579
        ide_transfer_start(s, s->io_buffer, 512 * n1, ide_sector_write);
580
    }
581
    ide_set_sector(s, sector_num + n);
582

    
583
    if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
584
        /* It seems there is a bug in the Windows 2000 installer HDD
585
           IDE driver which fills the disk with empty logs when the
586
           IDE write IRQ comes too early. This hack tries to correct
587
           that at the expense of slower write performances. Use this
588
           option _only_ to install Windows 2000. You must disable it
589
           for normal use. */
590
        qemu_mod_timer(s->sector_write_timer,
591
                       qemu_get_clock(vm_clock) + (get_ticks_per_sec() / 1000));
592
    } else {
593
        ide_set_irq(s->bus);
594
    }
595
}
596

    
597
void ide_write_dma_cb(void *opaque, int ret)
598
{
599
    IDEState *s = opaque;
600
    int n;
601
    int64_t sector_num;
602

    
603
    if (ret < 0) {
604
        if (ide_handle_rw_error(s, -ret,  BM_STATUS_DMA_RETRY))
605
            return;
606
    }
607

    
608
    n = s->io_buffer_size >> 9;
609
    sector_num = ide_get_sector(s);
610
    if (n > 0) {
611
        dma_buf_commit(s, 0);
612
        sector_num += n;
613
        ide_set_sector(s, sector_num);
614
        s->nsector -= n;
615
    }
616

    
617
    /* end of transfer ? */
618
    if (s->nsector == 0) {
619
        s->status = READY_STAT | SEEK_STAT;
620
        ide_set_irq(s->bus);
621
    eot:
622
        s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_INT);
623
        ide_set_inactive(s);
624
        return;
625
    }
626

    
627
    n = s->nsector;
628
    s->io_buffer_size = n * 512;
629
    /* launch next transfer */
630
    if (s->bus->dma->ops->prepare_buf(s->bus->dma, 0) == 0)
631
        goto eot;
632
#ifdef DEBUG_AIO
633
    printf("aio_write: sector_num=%" PRId64 " n=%d\n", sector_num, n);
634
#endif
635
    s->bus->dma->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num, ide_write_dma_cb, s);
636
    ide_dma_submit_check(s, ide_write_dma_cb);
637
}
638

    
639
static void ide_sector_write_dma(IDEState *s)
640
{
641
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
642
    s->io_buffer_index = 0;
643
    s->io_buffer_size = 0;
644
    s->is_read = 0;
645
    s->bus->dma->ops->start_dma(s->bus->dma, s, ide_write_dma_cb);
646
}
647

    
648
void ide_atapi_cmd_ok(IDEState *s)
649
{
650
    s->error = 0;
651
    s->status = READY_STAT | SEEK_STAT;
652
    s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
653
    ide_set_irq(s->bus);
654
}
655

    
656
void ide_atapi_cmd_error(IDEState *s, int sense_key, int asc)
657
{
658
#ifdef DEBUG_IDE_ATAPI
659
    printf("atapi_cmd_error: sense=0x%x asc=0x%x\n", sense_key, asc);
660
#endif
661
    s->error = sense_key << 4;
662
    s->status = READY_STAT | ERR_STAT;
663
    s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
664
    s->sense_key = sense_key;
665
    s->asc = asc;
666
    ide_set_irq(s->bus);
667
}
668

    
669
static void ide_atapi_cmd_check_status(IDEState *s)
670
{
671
#ifdef DEBUG_IDE_ATAPI
672
    printf("atapi_cmd_check_status\n");
673
#endif
674
    s->error = MC_ERR | (SENSE_UNIT_ATTENTION << 4);
675
    s->status = ERR_STAT;
676
    s->nsector = 0;
677
    ide_set_irq(s->bus);
678
}
679

    
680
static void ide_flush_cb(void *opaque, int ret)
681
{
682
    IDEState *s = opaque;
683

    
684
    if (ret < 0) {
685
        /* XXX: What sector number to set here? */
686
        if (ide_handle_rw_error(s, -ret, BM_STATUS_RETRY_FLUSH)) {
687
            return;
688
        }
689
    }
690

    
691
    s->status = READY_STAT | SEEK_STAT;
692
    ide_set_irq(s->bus);
693
}
694

    
695
void ide_flush_cache(IDEState *s)
696
{
697
    BlockDriverAIOCB *acb;
698

    
699
    if (s->bs == NULL) {
700
        ide_flush_cb(s, 0);
701
        return;
702
    }
703

    
704
    acb = bdrv_aio_flush(s->bs, ide_flush_cb, s);
705
    if (acb == NULL) {
706
        ide_flush_cb(s, -EIO);
707
    }
708
}
709

    
710
static inline void cpu_to_ube16(uint8_t *buf, int val)
711
{
712
    buf[0] = val >> 8;
713
    buf[1] = val & 0xff;
714
}
715

    
716
static inline void cpu_to_ube32(uint8_t *buf, unsigned int val)
717
{
718
    buf[0] = val >> 24;
719
    buf[1] = val >> 16;
720
    buf[2] = val >> 8;
721
    buf[3] = val & 0xff;
722
}
723

    
724
static inline int ube16_to_cpu(const uint8_t *buf)
725
{
726
    return (buf[0] << 8) | buf[1];
727
}
728

    
729
static inline int ube32_to_cpu(const uint8_t *buf)
730
{
731
    return (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
732
}
733

    
734
static void lba_to_msf(uint8_t *buf, int lba)
735
{
736
    lba += 150;
737
    buf[0] = (lba / 75) / 60;
738
    buf[1] = (lba / 75) % 60;
739
    buf[2] = lba % 75;
740
}
741

    
742
static void cd_data_to_raw(uint8_t *buf, int lba)
743
{
744
    /* sync bytes */
745
    buf[0] = 0x00;
746
    memset(buf + 1, 0xff, 10);
747
    buf[11] = 0x00;
748
    buf += 12;
749
    /* MSF */
750
    lba_to_msf(buf, lba);
751
    buf[3] = 0x01; /* mode 1 data */
752
    buf += 4;
753
    /* data */
754
    buf += 2048;
755
    /* XXX: ECC not computed */
756
    memset(buf, 0, 288);
757
}
758

    
759
static int cd_read_sector(BlockDriverState *bs, int lba, uint8_t *buf,
760
                           int sector_size)
761
{
762
    int ret;
763

    
764
    switch(sector_size) {
765
    case 2048:
766
        ret = bdrv_read(bs, (int64_t)lba << 2, buf, 4);
767
        break;
768
    case 2352:
769
        ret = bdrv_read(bs, (int64_t)lba << 2, buf + 16, 4);
770
        if (ret < 0)
771
            return ret;
772
        cd_data_to_raw(buf, lba);
773
        break;
774
    default:
775
        ret = -EIO;
776
        break;
777
    }
778
    return ret;
779
}
780

    
781
void ide_atapi_io_error(IDEState *s, int ret)
782
{
783
    /* XXX: handle more errors */
784
    if (ret == -ENOMEDIUM) {
785
        ide_atapi_cmd_error(s, SENSE_NOT_READY,
786
                            ASC_MEDIUM_NOT_PRESENT);
787
    } else {
788
        ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
789
                            ASC_LOGICAL_BLOCK_OOR);
790
    }
791
}
792

    
793
/* The whole ATAPI transfer logic is handled in this function */
794
static void ide_atapi_cmd_reply_end(IDEState *s)
795
{
796
    int byte_count_limit, size, ret;
797
#ifdef DEBUG_IDE_ATAPI
798
    printf("reply: tx_size=%d elem_tx_size=%d index=%d\n",
799
           s->packet_transfer_size,
800
           s->elementary_transfer_size,
801
           s->io_buffer_index);
802
#endif
803
    if (s->packet_transfer_size <= 0) {
804
        /* end of transfer */
805
        ide_transfer_stop(s);
806
        s->status = READY_STAT | SEEK_STAT;
807
        s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
808
        ide_set_irq(s->bus);
809
#ifdef DEBUG_IDE_ATAPI
810
        printf("status=0x%x\n", s->status);
811
#endif
812
    } else {
813
        /* see if a new sector must be read */
814
        if (s->lba != -1 && s->io_buffer_index >= s->cd_sector_size) {
815
            ret = cd_read_sector(s->bs, s->lba, s->io_buffer, s->cd_sector_size);
816
            if (ret < 0) {
817
                ide_transfer_stop(s);
818
                ide_atapi_io_error(s, ret);
819
                return;
820
            }
821
            s->lba++;
822
            s->io_buffer_index = 0;
823
        }
824
        if (s->elementary_transfer_size > 0) {
825
            /* there are some data left to transmit in this elementary
826
               transfer */
827
            size = s->cd_sector_size - s->io_buffer_index;
828
            if (size > s->elementary_transfer_size)
829
                size = s->elementary_transfer_size;
830
            s->packet_transfer_size -= size;
831
            s->elementary_transfer_size -= size;
832
            s->io_buffer_index += size;
833
            ide_transfer_start(s, s->io_buffer + s->io_buffer_index - size,
834
                               size, ide_atapi_cmd_reply_end);
835
        } else {
836
            /* a new transfer is needed */
837
            s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO;
838
            byte_count_limit = s->lcyl | (s->hcyl << 8);
839
#ifdef DEBUG_IDE_ATAPI
840
            printf("byte_count_limit=%d\n", byte_count_limit);
841
#endif
842
            if (byte_count_limit == 0xffff)
843
                byte_count_limit--;
844
            size = s->packet_transfer_size;
845
            if (size > byte_count_limit) {
846
                /* byte count limit must be even if this case */
847
                if (byte_count_limit & 1)
848
                    byte_count_limit--;
849
                size = byte_count_limit;
850
            }
851
            s->lcyl = size;
852
            s->hcyl = size >> 8;
853
            s->elementary_transfer_size = size;
854
            /* we cannot transmit more than one sector at a time */
855
            if (s->lba != -1) {
856
                if (size > (s->cd_sector_size - s->io_buffer_index))
857
                    size = (s->cd_sector_size - s->io_buffer_index);
858
            }
859
            s->packet_transfer_size -= size;
860
            s->elementary_transfer_size -= size;
861
            s->io_buffer_index += size;
862
            ide_transfer_start(s, s->io_buffer + s->io_buffer_index - size,
863
                               size, ide_atapi_cmd_reply_end);
864
            ide_set_irq(s->bus);
865
#ifdef DEBUG_IDE_ATAPI
866
            printf("status=0x%x\n", s->status);
867
#endif
868
        }
869
    }
870
}
871

    
872
/* send a reply of 'size' bytes in s->io_buffer to an ATAPI command */
873
static void ide_atapi_cmd_reply(IDEState *s, int size, int max_size)
874
{
875
    if (size > max_size)
876
        size = max_size;
877
    s->lba = -1; /* no sector read */
878
    s->packet_transfer_size = size;
879
    s->io_buffer_size = size;    /* dma: send the reply data as one chunk */
880
    s->elementary_transfer_size = 0;
881
    s->io_buffer_index = 0;
882

    
883
    if (s->atapi_dma) {
884
            s->status = READY_STAT | SEEK_STAT | DRQ_STAT;
885
        s->bus->dma->ops->start_dma(s->bus->dma, s,
886
                                   ide_atapi_cmd_read_dma_cb);
887
    } else {
888
            s->status = READY_STAT | SEEK_STAT;
889
            ide_atapi_cmd_reply_end(s);
890
    }
891
}
892

    
893
/* start a CD-CDROM read command */
894
static void ide_atapi_cmd_read_pio(IDEState *s, int lba, int nb_sectors,
895
                                   int sector_size)
896
{
897
    s->lba = lba;
898
    s->packet_transfer_size = nb_sectors * sector_size;
899
    s->elementary_transfer_size = 0;
900
    s->io_buffer_index = sector_size;
901
    s->cd_sector_size = sector_size;
902

    
903
    s->status = READY_STAT | SEEK_STAT;
904
    ide_atapi_cmd_reply_end(s);
905
}
906

    
907
/* ATAPI DMA support */
908

    
909
/* XXX: handle read errors */
910
static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
911
{
912
    IDEState *s = opaque;
913
    int data_offset, n;
914

    
915
    if (ret < 0) {
916
        ide_atapi_io_error(s, ret);
917
        goto eot;
918
    }
919

    
920
    if (s->io_buffer_size > 0) {
921
        /*
922
         * For a cdrom read sector command (s->lba != -1),
923
         * adjust the lba for the next s->io_buffer_size chunk
924
         * and dma the current chunk.
925
         * For a command != read (s->lba == -1), just transfer
926
         * the reply data.
927
         */
928
        if (s->lba != -1) {
929
            if (s->cd_sector_size == 2352) {
930
                n = 1;
931
                cd_data_to_raw(s->io_buffer, s->lba);
932
            } else {
933
                n = s->io_buffer_size >> 11;
934
            }
935
            s->lba += n;
936
        }
937
        s->packet_transfer_size -= s->io_buffer_size;
938
        if (s->bus->dma->ops->rw_buf(s->bus->dma, 1) == 0)
939
            goto eot;
940
    }
941

    
942
    if (s->packet_transfer_size <= 0) {
943
        s->status = READY_STAT | SEEK_STAT;
944
        s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
945
        ide_set_irq(s->bus);
946
    eot:
947
        s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_INT);
948
        ide_set_inactive(s);
949
        return;
950
    }
951

    
952
    s->io_buffer_index = 0;
953
    if (s->cd_sector_size == 2352) {
954
        n = 1;
955
        s->io_buffer_size = s->cd_sector_size;
956
        data_offset = 16;
957
    } else {
958
        n = s->packet_transfer_size >> 11;
959
        if (n > (IDE_DMA_BUF_SECTORS / 4))
960
            n = (IDE_DMA_BUF_SECTORS / 4);
961
        s->io_buffer_size = n * 2048;
962
        data_offset = 0;
963
    }
964
#ifdef DEBUG_AIO
965
    printf("aio_read_cd: lba=%u n=%d\n", s->lba, n);
966
#endif
967
    s->bus->dma->iov.iov_base = (void *)(s->io_buffer + data_offset);
968
    s->bus->dma->iov.iov_len = n * 4 * 512;
969
    qemu_iovec_init_external(&s->bus->dma->qiov, &s->bus->dma->iov, 1);
970
    s->bus->dma->aiocb = bdrv_aio_readv(s->bs, (int64_t)s->lba << 2,
971
                                       &s->bus->dma->qiov, n * 4,
972
                                       ide_atapi_cmd_read_dma_cb, s);
973
    if (!s->bus->dma->aiocb) {
974
        /* Note: media not present is the most likely case */
975
        ide_atapi_cmd_error(s, SENSE_NOT_READY,
976
                            ASC_MEDIUM_NOT_PRESENT);
977
        goto eot;
978
    }
979
}
980

    
981
/* start a CD-CDROM read command with DMA */
982
/* XXX: test if DMA is available */
983
static void ide_atapi_cmd_read_dma(IDEState *s, int lba, int nb_sectors,
984
                                   int sector_size)
985
{
986
    s->lba = lba;
987
    s->packet_transfer_size = nb_sectors * sector_size;
988
    s->io_buffer_index = 0;
989
    s->io_buffer_size = 0;
990
    s->cd_sector_size = sector_size;
991

    
992
    /* XXX: check if BUSY_STAT should be set */
993
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
994
    s->bus->dma->ops->start_dma(s->bus->dma, s,
995
                               ide_atapi_cmd_read_dma_cb);
996
}
997

    
998
static void ide_atapi_cmd_read(IDEState *s, int lba, int nb_sectors,
999
                               int sector_size)
1000
{
1001
#ifdef DEBUG_IDE_ATAPI
1002
    printf("read %s: LBA=%d nb_sectors=%d\n", s->atapi_dma ? "dma" : "pio",
1003
        lba, nb_sectors);
1004
#endif
1005
    if (s->atapi_dma) {
1006
        ide_atapi_cmd_read_dma(s, lba, nb_sectors, sector_size);
1007
    } else {
1008
        ide_atapi_cmd_read_pio(s, lba, nb_sectors, sector_size);
1009
    }
1010
}
1011

    
1012
static inline uint8_t ide_atapi_set_profile(uint8_t *buf, uint8_t *index,
1013
                                            uint16_t profile)
1014
{
1015
    uint8_t *buf_profile = buf + 12; /* start of profiles */
1016

    
1017
    buf_profile += ((*index) * 4); /* start of indexed profile */
1018
    cpu_to_ube16 (buf_profile, profile);
1019
    buf_profile[2] = ((buf_profile[0] == buf[6]) && (buf_profile[1] == buf[7]));
1020

    
1021
    /* each profile adds 4 bytes to the response */
1022
    (*index)++;
1023
    buf[11] += 4; /* Additional Length */
1024

    
1025
    return 4;
1026
}
1027

    
1028
static int ide_dvd_read_structure(IDEState *s, int format,
1029
                                  const uint8_t *packet, uint8_t *buf)
1030
{
1031
    switch (format) {
1032
        case 0x0: /* Physical format information */
1033
            {
1034
                int layer = packet[6];
1035
                uint64_t total_sectors;
1036

    
1037
                if (layer != 0)
1038
                    return -ASC_INV_FIELD_IN_CMD_PACKET;
1039

    
1040
                bdrv_get_geometry(s->bs, &total_sectors);
1041
                total_sectors >>= 2;
1042
                if (total_sectors == 0)
1043
                    return -ASC_MEDIUM_NOT_PRESENT;
1044

    
1045
                buf[4] = 1;   /* DVD-ROM, part version 1 */
1046
                buf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
1047
                buf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */
1048
                buf[7] = 0;   /* default densities */
1049

    
1050
                /* FIXME: 0x30000 per spec? */
1051
                cpu_to_ube32(buf + 8, 0); /* start sector */
1052
                cpu_to_ube32(buf + 12, total_sectors - 1); /* end sector */
1053
                cpu_to_ube32(buf + 16, total_sectors - 1); /* l0 end sector */
1054

    
1055
                /* Size of buffer, not including 2 byte size field */
1056
                cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1057

    
1058
                /* 2k data + 4 byte header */
1059
                return (2048 + 4);
1060
            }
1061

    
1062
        case 0x01: /* DVD copyright information */
1063
            buf[4] = 0; /* no copyright data */
1064
            buf[5] = 0; /* no region restrictions */
1065

    
1066
            /* Size of buffer, not including 2 byte size field */
1067
            cpu_to_be16wu((uint16_t *)buf, 4 + 2);
1068

    
1069
            /* 4 byte header + 4 byte data */
1070
            return (4 + 4);
1071

    
1072
        case 0x03: /* BCA information - invalid field for no BCA info */
1073
            return -ASC_INV_FIELD_IN_CMD_PACKET;
1074

    
1075
        case 0x04: /* DVD disc manufacturing information */
1076
            /* Size of buffer, not including 2 byte size field */
1077
            cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1078

    
1079
            /* 2k data + 4 byte header */
1080
            return (2048 + 4);
1081

    
1082
        case 0xff:
1083
            /*
1084
             * This lists all the command capabilities above.  Add new ones
1085
             * in order and update the length and buffer return values.
1086
             */
1087

    
1088
            buf[4] = 0x00; /* Physical format */
1089
            buf[5] = 0x40; /* Not writable, is readable */
1090
            cpu_to_be16wu((uint16_t *)(buf + 6), 2048 + 4);
1091

    
1092
            buf[8] = 0x01; /* Copyright info */
1093
            buf[9] = 0x40; /* Not writable, is readable */
1094
            cpu_to_be16wu((uint16_t *)(buf + 10), 4 + 4);
1095

    
1096
            buf[12] = 0x03; /* BCA info */
1097
            buf[13] = 0x40; /* Not writable, is readable */
1098
            cpu_to_be16wu((uint16_t *)(buf + 14), 188 + 4);
1099

    
1100
            buf[16] = 0x04; /* Manufacturing info */
1101
            buf[17] = 0x40; /* Not writable, is readable */
1102
            cpu_to_be16wu((uint16_t *)(buf + 18), 2048 + 4);
1103

    
1104
            /* Size of buffer, not including 2 byte size field */
1105
            cpu_to_be16wu((uint16_t *)buf, 16 + 2);
1106

    
1107
            /* data written + 4 byte header */
1108
            return (16 + 4);
1109

    
1110
        default: /* TODO: formats beyond DVD-ROM requires */
1111
            return -ASC_INV_FIELD_IN_CMD_PACKET;
1112
    }
1113
}
1114

    
1115
static void ide_atapi_cmd(IDEState *s)
1116
{
1117
    const uint8_t *packet;
1118
    uint8_t *buf;
1119
    int max_len;
1120

    
1121
    packet = s->io_buffer;
1122
    buf = s->io_buffer;
1123
#ifdef DEBUG_IDE_ATAPI
1124
    {
1125
        int i;
1126
        printf("ATAPI limit=0x%x packet:", s->lcyl | (s->hcyl << 8));
1127
        for(i = 0; i < ATAPI_PACKET_SIZE; i++) {
1128
            printf(" %02x", packet[i]);
1129
        }
1130
        printf("\n");
1131
    }
1132
#endif
1133
    /* If there's a UNIT_ATTENTION condition pending, only
1134
       REQUEST_SENSE and INQUIRY commands are allowed to complete. */
1135
    if (s->sense_key == SENSE_UNIT_ATTENTION &&
1136
        s->io_buffer[0] != GPCMD_REQUEST_SENSE &&
1137
        s->io_buffer[0] != GPCMD_INQUIRY) {
1138
        ide_atapi_cmd_check_status(s);
1139
        return;
1140
    }
1141
    switch(s->io_buffer[0]) {
1142
    case GPCMD_TEST_UNIT_READY:
1143
        if (bdrv_is_inserted(s->bs) && !s->cdrom_changed) {
1144
            ide_atapi_cmd_ok(s);
1145
        } else {
1146
            s->cdrom_changed = 0;
1147
            ide_atapi_cmd_error(s, SENSE_NOT_READY,
1148
                                ASC_MEDIUM_NOT_PRESENT);
1149
        }
1150
        break;
1151
    case GPCMD_MODE_SENSE_6:
1152
    case GPCMD_MODE_SENSE_10:
1153
        {
1154
            int action, code;
1155
            if (packet[0] == GPCMD_MODE_SENSE_10)
1156
                max_len = ube16_to_cpu(packet + 7);
1157
            else
1158
                max_len = packet[4];
1159
            action = packet[2] >> 6;
1160
            code = packet[2] & 0x3f;
1161
            switch(action) {
1162
            case 0: /* current values */
1163
                switch(code) {
1164
                case GPMODE_R_W_ERROR_PAGE: /* error recovery */
1165
                    cpu_to_ube16(&buf[0], 16 + 6);
1166
                    buf[2] = 0x70;
1167
                    buf[3] = 0;
1168
                    buf[4] = 0;
1169
                    buf[5] = 0;
1170
                    buf[6] = 0;
1171
                    buf[7] = 0;
1172

    
1173
                    buf[8] = 0x01;
1174
                    buf[9] = 0x06;
1175
                    buf[10] = 0x00;
1176
                    buf[11] = 0x05;
1177
                    buf[12] = 0x00;
1178
                    buf[13] = 0x00;
1179
                    buf[14] = 0x00;
1180
                    buf[15] = 0x00;
1181
                    ide_atapi_cmd_reply(s, 16, max_len);
1182
                    break;
1183
                case GPMODE_AUDIO_CTL_PAGE:
1184
                    cpu_to_ube16(&buf[0], 24 + 6);
1185
                    buf[2] = 0x70;
1186
                    buf[3] = 0;
1187
                    buf[4] = 0;
1188
                    buf[5] = 0;
1189
                    buf[6] = 0;
1190
                    buf[7] = 0;
1191

    
1192
                    /* Fill with CDROM audio volume */
1193
                    buf[17] = 0;
1194
                    buf[19] = 0;
1195
                    buf[21] = 0;
1196
                    buf[23] = 0;
1197

    
1198
                    ide_atapi_cmd_reply(s, 24, max_len);
1199
                    break;
1200
                case GPMODE_CAPABILITIES_PAGE:
1201
                    cpu_to_ube16(&buf[0], 28 + 6);
1202
                    buf[2] = 0x70;
1203
                    buf[3] = 0;
1204
                    buf[4] = 0;
1205
                    buf[5] = 0;
1206
                    buf[6] = 0;
1207
                    buf[7] = 0;
1208

    
1209
                    buf[8] = 0x2a;
1210
                    buf[9] = 0x12;
1211
                    buf[10] = 0x00;
1212
                    buf[11] = 0x00;
1213

    
1214
                    /* Claim PLAY_AUDIO capability (0x01) since some Linux
1215
                       code checks for this to automount media. */
1216
                    buf[12] = 0x71;
1217
                    buf[13] = 3 << 5;
1218
                    buf[14] = (1 << 0) | (1 << 3) | (1 << 5);
1219
                    if (bdrv_is_locked(s->bs))
1220
                        buf[6] |= 1 << 1;
1221
                    buf[15] = 0x00;
1222
                    cpu_to_ube16(&buf[16], 706);
1223
                    buf[18] = 0;
1224
                    buf[19] = 2;
1225
                    cpu_to_ube16(&buf[20], 512);
1226
                    cpu_to_ube16(&buf[22], 706);
1227
                    buf[24] = 0;
1228
                    buf[25] = 0;
1229
                    buf[26] = 0;
1230
                    buf[27] = 0;
1231
                    ide_atapi_cmd_reply(s, 28, max_len);
1232
                    break;
1233
                default:
1234
                    goto error_cmd;
1235
                }
1236
                break;
1237
            case 1: /* changeable values */
1238
                goto error_cmd;
1239
            case 2: /* default values */
1240
                goto error_cmd;
1241
            default:
1242
            case 3: /* saved values */
1243
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1244
                                    ASC_SAVING_PARAMETERS_NOT_SUPPORTED);
1245
                break;
1246
            }
1247
        }
1248
        break;
1249
    case GPCMD_REQUEST_SENSE:
1250
        max_len = packet[4];
1251
        memset(buf, 0, 18);
1252
        buf[0] = 0x70 | (1 << 7);
1253
        buf[2] = s->sense_key;
1254
        buf[7] = 10;
1255
        buf[12] = s->asc;
1256
        if (s->sense_key == SENSE_UNIT_ATTENTION)
1257
            s->sense_key = SENSE_NONE;
1258
        ide_atapi_cmd_reply(s, 18, max_len);
1259
        break;
1260
    case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
1261
        if (bdrv_is_inserted(s->bs)) {
1262
            bdrv_set_locked(s->bs, packet[4] & 1);
1263
            ide_atapi_cmd_ok(s);
1264
        } else {
1265
            ide_atapi_cmd_error(s, SENSE_NOT_READY,
1266
                                ASC_MEDIUM_NOT_PRESENT);
1267
        }
1268
        break;
1269
    case GPCMD_READ_10:
1270
    case GPCMD_READ_12:
1271
        {
1272
            int nb_sectors, lba;
1273

    
1274
            if (packet[0] == GPCMD_READ_10)
1275
                nb_sectors = ube16_to_cpu(packet + 7);
1276
            else
1277
                nb_sectors = ube32_to_cpu(packet + 6);
1278
            lba = ube32_to_cpu(packet + 2);
1279
            if (nb_sectors == 0) {
1280
                ide_atapi_cmd_ok(s);
1281
                break;
1282
            }
1283
            ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1284
        }
1285
        break;
1286
    case GPCMD_READ_CD:
1287
        {
1288
            int nb_sectors, lba, transfer_request;
1289

    
1290
            nb_sectors = (packet[6] << 16) | (packet[7] << 8) | packet[8];
1291
            lba = ube32_to_cpu(packet + 2);
1292
            if (nb_sectors == 0) {
1293
                ide_atapi_cmd_ok(s);
1294
                break;
1295
            }
1296
            transfer_request = packet[9];
1297
            switch(transfer_request & 0xf8) {
1298
            case 0x00:
1299
                /* nothing */
1300
                ide_atapi_cmd_ok(s);
1301
                break;
1302
            case 0x10:
1303
                /* normal read */
1304
                ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1305
                break;
1306
            case 0xf8:
1307
                /* read all data */
1308
                ide_atapi_cmd_read(s, lba, nb_sectors, 2352);
1309
                break;
1310
            default:
1311
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1312
                                    ASC_INV_FIELD_IN_CMD_PACKET);
1313
                break;
1314
            }
1315
        }
1316
        break;
1317
    case GPCMD_SEEK:
1318
        {
1319
            unsigned int lba;
1320
            uint64_t total_sectors;
1321

    
1322
            bdrv_get_geometry(s->bs, &total_sectors);
1323
            total_sectors >>= 2;
1324
            if (total_sectors == 0) {
1325
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1326
                                    ASC_MEDIUM_NOT_PRESENT);
1327
                break;
1328
            }
1329
            lba = ube32_to_cpu(packet + 2);
1330
            if (lba >= total_sectors) {
1331
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1332
                                    ASC_LOGICAL_BLOCK_OOR);
1333
                break;
1334
            }
1335
            ide_atapi_cmd_ok(s);
1336
        }
1337
        break;
1338
    case GPCMD_START_STOP_UNIT:
1339
        {
1340
            int start, eject, err = 0;
1341
            start = packet[4] & 1;
1342
            eject = (packet[4] >> 1) & 1;
1343

    
1344
            if (eject) {
1345
                err = bdrv_eject(s->bs, !start);
1346
            }
1347

    
1348
            switch (err) {
1349
            case 0:
1350
                ide_atapi_cmd_ok(s);
1351
                break;
1352
            case -EBUSY:
1353
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1354
                                    ASC_MEDIA_REMOVAL_PREVENTED);
1355
                break;
1356
            default:
1357
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1358
                                    ASC_MEDIUM_NOT_PRESENT);
1359
                break;
1360
            }
1361
        }
1362
        break;
1363
    case GPCMD_MECHANISM_STATUS:
1364
        {
1365
            max_len = ube16_to_cpu(packet + 8);
1366
            cpu_to_ube16(buf, 0);
1367
            /* no current LBA */
1368
            buf[2] = 0;
1369
            buf[3] = 0;
1370
            buf[4] = 0;
1371
            buf[5] = 1;
1372
            cpu_to_ube16(buf + 6, 0);
1373
            ide_atapi_cmd_reply(s, 8, max_len);
1374
        }
1375
        break;
1376
    case GPCMD_READ_TOC_PMA_ATIP:
1377
        {
1378
            int format, msf, start_track, len;
1379
            uint64_t total_sectors;
1380

    
1381
            bdrv_get_geometry(s->bs, &total_sectors);
1382
            total_sectors >>= 2;
1383
            if (total_sectors == 0) {
1384
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1385
                                    ASC_MEDIUM_NOT_PRESENT);
1386
                break;
1387
            }
1388
            max_len = ube16_to_cpu(packet + 7);
1389
            format = packet[9] >> 6;
1390
            msf = (packet[1] >> 1) & 1;
1391
            start_track = packet[6];
1392
            switch(format) {
1393
            case 0:
1394
                len = cdrom_read_toc(total_sectors, buf, msf, start_track);
1395
                if (len < 0)
1396
                    goto error_cmd;
1397
                ide_atapi_cmd_reply(s, len, max_len);
1398
                break;
1399
            case 1:
1400
                /* multi session : only a single session defined */
1401
                memset(buf, 0, 12);
1402
                buf[1] = 0x0a;
1403
                buf[2] = 0x01;
1404
                buf[3] = 0x01;
1405
                ide_atapi_cmd_reply(s, 12, max_len);
1406
                break;
1407
            case 2:
1408
                len = cdrom_read_toc_raw(total_sectors, buf, msf, start_track);
1409
                if (len < 0)
1410
                    goto error_cmd;
1411
                ide_atapi_cmd_reply(s, len, max_len);
1412
                break;
1413
            default:
1414
            error_cmd:
1415
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1416
                                    ASC_INV_FIELD_IN_CMD_PACKET);
1417
                break;
1418
            }
1419
        }
1420
        break;
1421
    case GPCMD_READ_CDVD_CAPACITY:
1422
        {
1423
            uint64_t total_sectors;
1424

    
1425
            bdrv_get_geometry(s->bs, &total_sectors);
1426
            total_sectors >>= 2;
1427
            if (total_sectors == 0) {
1428
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1429
                                    ASC_MEDIUM_NOT_PRESENT);
1430
                break;
1431
            }
1432
            /* NOTE: it is really the number of sectors minus 1 */
1433
            cpu_to_ube32(buf, total_sectors - 1);
1434
            cpu_to_ube32(buf + 4, 2048);
1435
            ide_atapi_cmd_reply(s, 8, 8);
1436
        }
1437
        break;
1438
    case GPCMD_READ_DVD_STRUCTURE:
1439
        {
1440
            int media = packet[1];
1441
            int format = packet[7];
1442
            int ret;
1443

    
1444
            max_len = ube16_to_cpu(packet + 8);
1445

    
1446
            if (format < 0xff) {
1447
                if (media_is_cd(s)) {
1448
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1449
                                        ASC_INCOMPATIBLE_FORMAT);
1450
                    break;
1451
                } else if (!media_present(s)) {
1452
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1453
                                        ASC_INV_FIELD_IN_CMD_PACKET);
1454
                    break;
1455
                }
1456
            }
1457

    
1458
            memset(buf, 0, max_len > IDE_DMA_BUF_SECTORS * 512 + 4 ?
1459
                   IDE_DMA_BUF_SECTORS * 512 + 4 : max_len);
1460

    
1461
            switch (format) {
1462
                case 0x00 ... 0x7f:
1463
                case 0xff:
1464
                    if (media == 0) {
1465
                        ret = ide_dvd_read_structure(s, format, packet, buf);
1466

    
1467
                        if (ret < 0)
1468
                            ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST, -ret);
1469
                        else
1470
                            ide_atapi_cmd_reply(s, ret, max_len);
1471

    
1472
                        break;
1473
                    }
1474
                    /* TODO: BD support, fall through for now */
1475

    
1476
                /* Generic disk structures */
1477
                case 0x80: /* TODO: AACS volume identifier */
1478
                case 0x81: /* TODO: AACS media serial number */
1479
                case 0x82: /* TODO: AACS media identifier */
1480
                case 0x83: /* TODO: AACS media key block */
1481
                case 0x90: /* TODO: List of recognized format layers */
1482
                case 0xc0: /* TODO: Write protection status */
1483
                default:
1484
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1485
                                        ASC_INV_FIELD_IN_CMD_PACKET);
1486
                    break;
1487
            }
1488
        }
1489
        break;
1490
    case GPCMD_SET_SPEED:
1491
        ide_atapi_cmd_ok(s);
1492
        break;
1493
    case GPCMD_INQUIRY:
1494
        max_len = packet[4];
1495
        buf[0] = 0x05; /* CD-ROM */
1496
        buf[1] = 0x80; /* removable */
1497
        buf[2] = 0x00; /* ISO */
1498
        buf[3] = 0x21; /* ATAPI-2 (XXX: put ATAPI-4 ?) */
1499
        buf[4] = 31; /* additional length */
1500
        buf[5] = 0; /* reserved */
1501
        buf[6] = 0; /* reserved */
1502
        buf[7] = 0; /* reserved */
1503
        padstr8(buf + 8, 8, "QEMU");
1504
        padstr8(buf + 16, 16, "QEMU DVD-ROM");
1505
        padstr8(buf + 32, 4, s->version);
1506
        ide_atapi_cmd_reply(s, 36, max_len);
1507
        break;
1508
    case GPCMD_GET_CONFIGURATION:
1509
        {
1510
            uint32_t len;
1511
            uint8_t index = 0;
1512

    
1513
            /* only feature 0 is supported */
1514
            if (packet[2] != 0 || packet[3] != 0) {
1515
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1516
                                    ASC_INV_FIELD_IN_CMD_PACKET);
1517
                break;
1518
            }
1519

    
1520
            /* XXX: could result in alignment problems in some architectures */
1521
            max_len = ube16_to_cpu(packet + 7);
1522

    
1523
            /*
1524
             * XXX: avoid overflow for io_buffer if max_len is bigger than
1525
             *      the size of that buffer (dimensioned to max number of
1526
             *      sectors to transfer at once)
1527
             *
1528
             *      Only a problem if the feature/profiles grow.
1529
             */
1530
            if (max_len > 512) /* XXX: assume 1 sector */
1531
                max_len = 512;
1532

    
1533
            memset(buf, 0, max_len);
1534
            /* 
1535
             * the number of sectors from the media tells us which profile
1536
             * to use as current.  0 means there is no media
1537
             */
1538
            if (media_is_dvd(s))
1539
                cpu_to_ube16(buf + 6, MMC_PROFILE_DVD_ROM);
1540
            else if (media_is_cd(s))
1541
                cpu_to_ube16(buf + 6, MMC_PROFILE_CD_ROM);
1542

    
1543
            buf[10] = 0x02 | 0x01; /* persistent and current */
1544
            len = 12; /* headers: 8 + 4 */
1545
            len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_DVD_ROM);
1546
            len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_CD_ROM);
1547
            cpu_to_ube32(buf, len - 4); /* data length */
1548

    
1549
            ide_atapi_cmd_reply(s, len, max_len);
1550
            break;
1551
        }
1552
    case GPCMD_GET_EVENT_STATUS_NOTIFICATION:
1553
        max_len = ube16_to_cpu(packet + 7);
1554

    
1555
        if (packet[1] & 0x01) { /* polling */
1556
            /* We don't support any event class (yet). */
1557
            cpu_to_ube16(buf, 0x00); /* No event descriptor returned */
1558
            buf[2] = 0x80;           /* No Event Available (NEA) */
1559
            buf[3] = 0x00;           /* Empty supported event classes */
1560
            ide_atapi_cmd_reply(s, 4, max_len);
1561
        } else { /* asynchronous mode */
1562
            /* Only polling is supported, asynchronous mode is not. */
1563
            ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1564
                                ASC_INV_FIELD_IN_CMD_PACKET);
1565
        }
1566
        break;
1567
    default:
1568
        ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1569
                            ASC_ILLEGAL_OPCODE);
1570
        break;
1571
    }
1572
}
1573

    
1574
static void ide_cfata_metadata_inquiry(IDEState *s)
1575
{
1576
    uint16_t *p;
1577
    uint32_t spd;
1578

    
1579
    p = (uint16_t *) s->io_buffer;
1580
    memset(p, 0, 0x200);
1581
    spd = ((s->mdata_size - 1) >> 9) + 1;
1582

    
1583
    put_le16(p + 0, 0x0001);                        /* Data format revision */
1584
    put_le16(p + 1, 0x0000);                        /* Media property: silicon */
1585
    put_le16(p + 2, s->media_changed);                /* Media status */
1586
    put_le16(p + 3, s->mdata_size & 0xffff);        /* Capacity in bytes (low) */
1587
    put_le16(p + 4, s->mdata_size >> 16);        /* Capacity in bytes (high) */
1588
    put_le16(p + 5, spd & 0xffff);                /* Sectors per device (low) */
1589
    put_le16(p + 6, spd >> 16);                        /* Sectors per device (high) */
1590
}
1591

    
1592
static void ide_cfata_metadata_read(IDEState *s)
1593
{
1594
    uint16_t *p;
1595

    
1596
    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1597
        s->status = ERR_STAT;
1598
        s->error = ABRT_ERR;
1599
        return;
1600
    }
1601

    
1602
    p = (uint16_t *) s->io_buffer;
1603
    memset(p, 0, 0x200);
1604

    
1605
    put_le16(p + 0, s->media_changed);                /* Media status */
1606
    memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1607
                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1608
                                    s->nsector << 9), 0x200 - 2));
1609
}
1610

    
1611
static void ide_cfata_metadata_write(IDEState *s)
1612
{
1613
    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1614
        s->status = ERR_STAT;
1615
        s->error = ABRT_ERR;
1616
        return;
1617
    }
1618

    
1619
    s->media_changed = 0;
1620

    
1621
    memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1622
                    s->io_buffer + 2,
1623
                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1624
                                    s->nsector << 9), 0x200 - 2));
1625
}
1626

    
1627
/* called when the inserted state of the media has changed */
1628
static void cdrom_change_cb(void *opaque)
1629
{
1630
    IDEState *s = opaque;
1631
    uint64_t nb_sectors;
1632

    
1633
    bdrv_get_geometry(s->bs, &nb_sectors);
1634
    s->nb_sectors = nb_sectors;
1635

    
1636
    s->sense_key = SENSE_UNIT_ATTENTION;
1637
    s->asc = ASC_MEDIUM_MAY_HAVE_CHANGED;
1638
    s->cdrom_changed = 1;
1639
    ide_set_irq(s->bus);
1640
}
1641

    
1642
static void ide_cmd_lba48_transform(IDEState *s, int lba48)
1643
{
1644
    s->lba48 = lba48;
1645

    
1646
    /* handle the 'magic' 0 nsector count conversion here. to avoid
1647
     * fiddling with the rest of the read logic, we just store the
1648
     * full sector count in ->nsector and ignore ->hob_nsector from now
1649
     */
1650
    if (!s->lba48) {
1651
        if (!s->nsector)
1652
            s->nsector = 256;
1653
    } else {
1654
        if (!s->nsector && !s->hob_nsector)
1655
            s->nsector = 65536;
1656
        else {
1657
            int lo = s->nsector;
1658
            int hi = s->hob_nsector;
1659

    
1660
            s->nsector = (hi << 8) | lo;
1661
        }
1662
    }
1663
}
1664

    
1665
static void ide_clear_hob(IDEBus *bus)
1666
{
1667
    /* any write clears HOB high bit of device control register */
1668
    bus->ifs[0].select &= ~(1 << 7);
1669
    bus->ifs[1].select &= ~(1 << 7);
1670
}
1671

    
1672
void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1673
{
1674
    IDEBus *bus = opaque;
1675

    
1676
#ifdef DEBUG_IDE
1677
    printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
1678
#endif
1679

    
1680
    addr &= 7;
1681

    
1682
    /* ignore writes to command block while busy with previous command */
1683
    if (addr != 7 && (idebus_active_if(bus)->status & (BUSY_STAT|DRQ_STAT)))
1684
        return;
1685

    
1686
    switch(addr) {
1687
    case 0:
1688
        break;
1689
    case 1:
1690
        ide_clear_hob(bus);
1691
        /* NOTE: data is written to the two drives */
1692
        bus->ifs[0].hob_feature = bus->ifs[0].feature;
1693
        bus->ifs[1].hob_feature = bus->ifs[1].feature;
1694
        bus->ifs[0].feature = val;
1695
        bus->ifs[1].feature = val;
1696
        break;
1697
    case 2:
1698
        ide_clear_hob(bus);
1699
        bus->ifs[0].hob_nsector = bus->ifs[0].nsector;
1700
        bus->ifs[1].hob_nsector = bus->ifs[1].nsector;
1701
        bus->ifs[0].nsector = val;
1702
        bus->ifs[1].nsector = val;
1703
        break;
1704
    case 3:
1705
        ide_clear_hob(bus);
1706
        bus->ifs[0].hob_sector = bus->ifs[0].sector;
1707
        bus->ifs[1].hob_sector = bus->ifs[1].sector;
1708
        bus->ifs[0].sector = val;
1709
        bus->ifs[1].sector = val;
1710
        break;
1711
    case 4:
1712
        ide_clear_hob(bus);
1713
        bus->ifs[0].hob_lcyl = bus->ifs[0].lcyl;
1714
        bus->ifs[1].hob_lcyl = bus->ifs[1].lcyl;
1715
        bus->ifs[0].lcyl = val;
1716
        bus->ifs[1].lcyl = val;
1717
        break;
1718
    case 5:
1719
        ide_clear_hob(bus);
1720
        bus->ifs[0].hob_hcyl = bus->ifs[0].hcyl;
1721
        bus->ifs[1].hob_hcyl = bus->ifs[1].hcyl;
1722
        bus->ifs[0].hcyl = val;
1723
        bus->ifs[1].hcyl = val;
1724
        break;
1725
    case 6:
1726
        /* FIXME: HOB readback uses bit 7 */
1727
        bus->ifs[0].select = (val & ~0x10) | 0xa0;
1728
        bus->ifs[1].select = (val | 0x10) | 0xa0;
1729
        /* select drive */
1730
        bus->unit = (val >> 4) & 1;
1731
        break;
1732
    default:
1733
    case 7:
1734
        /* command */
1735
        ide_exec_cmd(bus, val);
1736
        break;
1737
    }
1738
}
1739

    
1740

    
1741
void ide_exec_cmd(IDEBus *bus, uint32_t val)
1742
{
1743
    IDEState *s;
1744
    int n;
1745
    int lba48 = 0;
1746

    
1747
#if defined(DEBUG_IDE)
1748
    printf("ide: CMD=%02x\n", val);
1749
#endif
1750
    s = idebus_active_if(bus);
1751
    /* ignore commands to non existant slave */
1752
    if (s != bus->ifs && !s->bs)
1753
        return;
1754

    
1755
    /* Only DEVICE RESET is allowed while BSY or/and DRQ are set */
1756
    if ((s->status & (BUSY_STAT|DRQ_STAT)) && val != WIN_DEVICE_RESET)
1757
        return;
1758

    
1759
    switch(val) {
1760
    case WIN_IDENTIFY:
1761
        if (s->bs && s->drive_kind != IDE_CD) {
1762
            if (s->drive_kind != IDE_CFATA)
1763
                ide_identify(s);
1764
            else
1765
                ide_cfata_identify(s);
1766
            s->status = READY_STAT | SEEK_STAT;
1767
            ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1768
        } else {
1769
            if (s->drive_kind == IDE_CD) {
1770
                ide_set_signature(s);
1771
            }
1772
            ide_abort_command(s);
1773
        }
1774
        ide_set_irq(s->bus);
1775
        break;
1776
    case WIN_SPECIFY:
1777
    case WIN_RECAL:
1778
        s->error = 0;
1779
        s->status = READY_STAT | SEEK_STAT;
1780
        ide_set_irq(s->bus);
1781
        break;
1782
    case WIN_SETMULT:
1783
        if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
1784
            /* Disable Read and Write Multiple */
1785
            s->mult_sectors = 0;
1786
            s->status = READY_STAT | SEEK_STAT;
1787
        } else if ((s->nsector & 0xff) != 0 &&
1788
            ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
1789
             (s->nsector & (s->nsector - 1)) != 0)) {
1790
            ide_abort_command(s);
1791
        } else {
1792
            s->mult_sectors = s->nsector & 0xff;
1793
            s->status = READY_STAT | SEEK_STAT;
1794
        }
1795
        ide_set_irq(s->bus);
1796
        break;
1797
    case WIN_VERIFY_EXT:
1798
        lba48 = 1;
1799
    case WIN_VERIFY:
1800
    case WIN_VERIFY_ONCE:
1801
        /* do sector number check ? */
1802
        ide_cmd_lba48_transform(s, lba48);
1803
        s->status = READY_STAT | SEEK_STAT;
1804
        ide_set_irq(s->bus);
1805
        break;
1806
        case WIN_READ_EXT:
1807
        lba48 = 1;
1808
    case WIN_READ:
1809
    case WIN_READ_ONCE:
1810
        if (!s->bs)
1811
            goto abort_cmd;
1812
        ide_cmd_lba48_transform(s, lba48);
1813
        s->req_nb_sectors = 1;
1814
        ide_sector_read(s);
1815
        break;
1816
        case WIN_WRITE_EXT:
1817
        lba48 = 1;
1818
    case WIN_WRITE:
1819
    case WIN_WRITE_ONCE:
1820
    case CFA_WRITE_SECT_WO_ERASE:
1821
    case WIN_WRITE_VERIFY:
1822
        ide_cmd_lba48_transform(s, lba48);
1823
        s->error = 0;
1824
        s->status = SEEK_STAT | READY_STAT;
1825
        s->req_nb_sectors = 1;
1826
        ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
1827
        s->media_changed = 1;
1828
        break;
1829
        case WIN_MULTREAD_EXT:
1830
        lba48 = 1;
1831
    case WIN_MULTREAD:
1832
        if (!s->mult_sectors)
1833
            goto abort_cmd;
1834
        ide_cmd_lba48_transform(s, lba48);
1835
        s->req_nb_sectors = s->mult_sectors;
1836
        ide_sector_read(s);
1837
        break;
1838
    case WIN_MULTWRITE_EXT:
1839
        lba48 = 1;
1840
    case WIN_MULTWRITE:
1841
    case CFA_WRITE_MULTI_WO_ERASE:
1842
        if (!s->mult_sectors)
1843
            goto abort_cmd;
1844
        ide_cmd_lba48_transform(s, lba48);
1845
        s->error = 0;
1846
        s->status = SEEK_STAT | READY_STAT;
1847
        s->req_nb_sectors = s->mult_sectors;
1848
        n = s->nsector;
1849
        if (n > s->req_nb_sectors)
1850
            n = s->req_nb_sectors;
1851
        ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
1852
        s->media_changed = 1;
1853
        break;
1854
        case WIN_READDMA_EXT:
1855
        lba48 = 1;
1856
    case WIN_READDMA:
1857
    case WIN_READDMA_ONCE:
1858
        if (!s->bs)
1859
            goto abort_cmd;
1860
        ide_cmd_lba48_transform(s, lba48);
1861
        ide_sector_read_dma(s);
1862
        break;
1863
        case WIN_WRITEDMA_EXT:
1864
        lba48 = 1;
1865
    case WIN_WRITEDMA:
1866
    case WIN_WRITEDMA_ONCE:
1867
        if (!s->bs)
1868
            goto abort_cmd;
1869
        ide_cmd_lba48_transform(s, lba48);
1870
        ide_sector_write_dma(s);
1871
        s->media_changed = 1;
1872
        break;
1873
    case WIN_READ_NATIVE_MAX_EXT:
1874
        lba48 = 1;
1875
    case WIN_READ_NATIVE_MAX:
1876
        ide_cmd_lba48_transform(s, lba48);
1877
        ide_set_sector(s, s->nb_sectors - 1);
1878
        s->status = READY_STAT | SEEK_STAT;
1879
        ide_set_irq(s->bus);
1880
        break;
1881
    case WIN_CHECKPOWERMODE1:
1882
    case WIN_CHECKPOWERMODE2:
1883
        s->nsector = 0xff; /* device active or idle */
1884
        s->status = READY_STAT | SEEK_STAT;
1885
        ide_set_irq(s->bus);
1886
        break;
1887
    case WIN_SETFEATURES:
1888
        if (!s->bs)
1889
            goto abort_cmd;
1890
        /* XXX: valid for CDROM ? */
1891
        switch(s->feature) {
1892
        case 0xcc: /* reverting to power-on defaults enable */
1893
        case 0x66: /* reverting to power-on defaults disable */
1894
        case 0x02: /* write cache enable */
1895
        case 0x82: /* write cache disable */
1896
        case 0xaa: /* read look-ahead enable */
1897
        case 0x55: /* read look-ahead disable */
1898
        case 0x05: /* set advanced power management mode */
1899
        case 0x85: /* disable advanced power management mode */
1900
        case 0x69: /* NOP */
1901
        case 0x67: /* NOP */
1902
        case 0x96: /* NOP */
1903
        case 0x9a: /* NOP */
1904
        case 0x42: /* enable Automatic Acoustic Mode */
1905
        case 0xc2: /* disable Automatic Acoustic Mode */
1906
            s->status = READY_STAT | SEEK_STAT;
1907
            ide_set_irq(s->bus);
1908
            break;
1909
        case 0x03: { /* set transfer mode */
1910
                uint8_t val = s->nsector & 0x07;
1911
            uint16_t *identify_data = (uint16_t *)s->identify_data;
1912

    
1913
                switch (s->nsector >> 3) {
1914
                case 0x00: /* pio default */
1915
                case 0x01: /* pio mode */
1916
                        put_le16(identify_data + 62,0x07);
1917
                        put_le16(identify_data + 63,0x07);
1918
                        put_le16(identify_data + 88,0x3f);
1919
                        break;
1920
                case 0x02: /* sigle word dma mode*/
1921
                        put_le16(identify_data + 62,0x07 | (1 << (val + 8)));
1922
                        put_le16(identify_data + 63,0x07);
1923
                        put_le16(identify_data + 88,0x3f);
1924
                        break;
1925
                case 0x04: /* mdma mode */
1926
                        put_le16(identify_data + 62,0x07);
1927
                        put_le16(identify_data + 63,0x07 | (1 << (val + 8)));
1928
                        put_le16(identify_data + 88,0x3f);
1929
                        break;
1930
                case 0x08: /* udma mode */
1931
                        put_le16(identify_data + 62,0x07);
1932
                        put_le16(identify_data + 63,0x07);
1933
                        put_le16(identify_data + 88,0x3f | (1 << (val + 8)));
1934
                        break;
1935
                default:
1936
                        goto abort_cmd;
1937
                }
1938
            s->status = READY_STAT | SEEK_STAT;
1939
            ide_set_irq(s->bus);
1940
            break;
1941
        }
1942
        default:
1943
            goto abort_cmd;
1944
        }
1945
        break;
1946
    case WIN_FLUSH_CACHE:
1947
    case WIN_FLUSH_CACHE_EXT:
1948
        ide_flush_cache(s);
1949
        break;
1950
    case WIN_STANDBY:
1951
    case WIN_STANDBY2:
1952
    case WIN_STANDBYNOW1:
1953
    case WIN_STANDBYNOW2:
1954
    case WIN_IDLEIMMEDIATE:
1955
    case CFA_IDLEIMMEDIATE:
1956
    case WIN_SETIDLE1:
1957
    case WIN_SETIDLE2:
1958
    case WIN_SLEEPNOW1:
1959
    case WIN_SLEEPNOW2:
1960
        s->status = READY_STAT;
1961
        ide_set_irq(s->bus);
1962
        break;
1963
    case WIN_SEEK:
1964
        if(s->drive_kind == IDE_CD)
1965
            goto abort_cmd;
1966
        /* XXX: Check that seek is within bounds */
1967
        s->status = READY_STAT | SEEK_STAT;
1968
        ide_set_irq(s->bus);
1969
        break;
1970
        /* ATAPI commands */
1971
    case WIN_PIDENTIFY:
1972
        if (s->drive_kind == IDE_CD) {
1973
            ide_atapi_identify(s);
1974
            s->status = READY_STAT | SEEK_STAT;
1975
            ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1976
        } else {
1977
            ide_abort_command(s);
1978
        }
1979
        ide_set_irq(s->bus);
1980
        break;
1981
    case WIN_DIAGNOSE:
1982
        ide_set_signature(s);
1983
        if (s->drive_kind == IDE_CD)
1984
            s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
1985
                            * devices to return a clear status register
1986
                            * with READY_STAT *not* set. */
1987
        else
1988
            s->status = READY_STAT | SEEK_STAT;
1989
        s->error = 0x01; /* Device 0 passed, Device 1 passed or not
1990
                          * present.
1991
                          */
1992
        ide_set_irq(s->bus);
1993
        break;
1994
    case WIN_SRST:
1995
        if (s->drive_kind != IDE_CD)
1996
            goto abort_cmd;
1997
        ide_set_signature(s);
1998
        s->status = 0x00; /* NOTE: READY is _not_ set */
1999
        s->error = 0x01;
2000
        break;
2001
    case WIN_PACKETCMD:
2002
        if (s->drive_kind != IDE_CD)
2003
            goto abort_cmd;
2004
        /* overlapping commands not supported */
2005
        if (s->feature & 0x02)
2006
            goto abort_cmd;
2007
        s->status = READY_STAT | SEEK_STAT;
2008
        s->atapi_dma = s->feature & 1;
2009
        s->nsector = 1;
2010
        ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
2011
                           ide_atapi_cmd);
2012
        break;
2013
    /* CF-ATA commands */
2014
    case CFA_REQ_EXT_ERROR_CODE:
2015
        if (s->drive_kind != IDE_CFATA)
2016
            goto abort_cmd;
2017
        s->error = 0x09;    /* miscellaneous error */
2018
        s->status = READY_STAT | SEEK_STAT;
2019
        ide_set_irq(s->bus);
2020
        break;
2021
    case CFA_ERASE_SECTORS:
2022
    case CFA_WEAR_LEVEL:
2023
        if (s->drive_kind != IDE_CFATA)
2024
            goto abort_cmd;
2025
        if (val == CFA_WEAR_LEVEL)
2026
            s->nsector = 0;
2027
        if (val == CFA_ERASE_SECTORS)
2028
            s->media_changed = 1;
2029
        s->error = 0x00;
2030
        s->status = READY_STAT | SEEK_STAT;
2031
        ide_set_irq(s->bus);
2032
        break;
2033
    case CFA_TRANSLATE_SECTOR:
2034
        if (s->drive_kind != IDE_CFATA)
2035
            goto abort_cmd;
2036
        s->error = 0x00;
2037
        s->status = READY_STAT | SEEK_STAT;
2038
        memset(s->io_buffer, 0, 0x200);
2039
        s->io_buffer[0x00] = s->hcyl;                        /* Cyl MSB */
2040
        s->io_buffer[0x01] = s->lcyl;                        /* Cyl LSB */
2041
        s->io_buffer[0x02] = s->select;                        /* Head */
2042
        s->io_buffer[0x03] = s->sector;                        /* Sector */
2043
        s->io_buffer[0x04] = ide_get_sector(s) >> 16;        /* LBA MSB */
2044
        s->io_buffer[0x05] = ide_get_sector(s) >> 8;        /* LBA */
2045
        s->io_buffer[0x06] = ide_get_sector(s) >> 0;        /* LBA LSB */
2046
        s->io_buffer[0x13] = 0x00;                                /* Erase flag */
2047
        s->io_buffer[0x18] = 0x00;                                /* Hot count */
2048
        s->io_buffer[0x19] = 0x00;                                /* Hot count */
2049
        s->io_buffer[0x1a] = 0x01;                                /* Hot count */
2050
        ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2051
        ide_set_irq(s->bus);
2052
        break;
2053
    case CFA_ACCESS_METADATA_STORAGE:
2054
        if (s->drive_kind != IDE_CFATA)
2055
            goto abort_cmd;
2056
        switch (s->feature) {
2057
        case 0x02:        /* Inquiry Metadata Storage */
2058
            ide_cfata_metadata_inquiry(s);
2059
            break;
2060
        case 0x03:        /* Read Metadata Storage */
2061
            ide_cfata_metadata_read(s);
2062
            break;
2063
        case 0x04:        /* Write Metadata Storage */
2064
            ide_cfata_metadata_write(s);
2065
            break;
2066
        default:
2067
            goto abort_cmd;
2068
        }
2069
        ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2070
        s->status = 0x00; /* NOTE: READY is _not_ set */
2071
        ide_set_irq(s->bus);
2072
        break;
2073
    case IBM_SENSE_CONDITION:
2074
        if (s->drive_kind != IDE_CFATA)
2075
            goto abort_cmd;
2076
        switch (s->feature) {
2077
        case 0x01:  /* sense temperature in device */
2078
            s->nsector = 0x50;      /* +20 C */
2079
            break;
2080
        default:
2081
            goto abort_cmd;
2082
        }
2083
        s->status = READY_STAT | SEEK_STAT;
2084
        ide_set_irq(s->bus);
2085
        break;
2086

    
2087
        case WIN_SMART:
2088
        if (s->drive_kind == IDE_CD)
2089
                goto abort_cmd;
2090
        if (s->hcyl != 0xc2 || s->lcyl != 0x4f)
2091
                goto abort_cmd;
2092
        if (!s->smart_enabled && s->feature != SMART_ENABLE)
2093
                goto abort_cmd;
2094
        switch (s->feature) {
2095
        case SMART_DISABLE:
2096
                s->smart_enabled = 0;
2097
                s->status = READY_STAT | SEEK_STAT;
2098
                ide_set_irq(s->bus);
2099
                break;
2100
        case SMART_ENABLE:
2101
                s->smart_enabled = 1;
2102
                s->status = READY_STAT | SEEK_STAT;
2103
                ide_set_irq(s->bus);
2104
                break;
2105
        case SMART_ATTR_AUTOSAVE:
2106
                switch (s->sector) {
2107
                case 0x00:
2108
                s->smart_autosave = 0;
2109
                break;
2110
                case 0xf1:
2111
                s->smart_autosave = 1;
2112
                break;
2113
                default:
2114
                goto abort_cmd;
2115
                }
2116
                s->status = READY_STAT | SEEK_STAT;
2117
                ide_set_irq(s->bus);
2118
                break;
2119
        case SMART_STATUS:
2120
                if (!s->smart_errors) {
2121
                s->hcyl = 0xc2;
2122
                s->lcyl = 0x4f;
2123
                } else {
2124
                s->hcyl = 0x2c;
2125
                s->lcyl = 0xf4;
2126
                }
2127
                s->status = READY_STAT | SEEK_STAT;
2128
                ide_set_irq(s->bus);
2129
                break;
2130
        case SMART_READ_THRESH:
2131
                memset(s->io_buffer, 0, 0x200);
2132
                s->io_buffer[0] = 0x01; /* smart struct version */
2133
                for (n=0; n<30; n++) {
2134
                if (smart_attributes[n][0] == 0)
2135
                        break;
2136
                s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
2137
                s->io_buffer[2+1+(n*12)] = smart_attributes[n][4];
2138
                }
2139
                for (n=0; n<511; n++) /* checksum */
2140
                s->io_buffer[511] += s->io_buffer[n];
2141
                s->io_buffer[511] = 0x100 - s->io_buffer[511];
2142
                s->status = READY_STAT | SEEK_STAT;
2143
                ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2144
                ide_set_irq(s->bus);
2145
                break;
2146
        case SMART_READ_DATA:
2147
                memset(s->io_buffer, 0, 0x200);
2148
                s->io_buffer[0] = 0x01; /* smart struct version */
2149
                for (n=0; n<30; n++) {
2150
                if (smart_attributes[n][0] == 0)
2151
                        break;
2152
                s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
2153
                s->io_buffer[2+1+(n*12)] = smart_attributes[n][1];
2154
                s->io_buffer[2+3+(n*12)] = smart_attributes[n][2];
2155
                s->io_buffer[2+4+(n*12)] = smart_attributes[n][3];
2156
                }
2157
                s->io_buffer[362] = 0x02 | (s->smart_autosave?0x80:0x00);
2158
                if (s->smart_selftest_count == 0) {
2159
                s->io_buffer[363] = 0;
2160
                } else {
2161
                s->io_buffer[363] =
2162
                        s->smart_selftest_data[3 + 
2163
                                           (s->smart_selftest_count - 1) *
2164
                                           24];
2165
                }
2166
                s->io_buffer[364] = 0x20; 
2167
                s->io_buffer[365] = 0x01; 
2168
                /* offline data collection capacity: execute + self-test*/
2169
                s->io_buffer[367] = (1<<4 | 1<<3 | 1); 
2170
                s->io_buffer[368] = 0x03; /* smart capability (1) */
2171
                s->io_buffer[369] = 0x00; /* smart capability (2) */
2172
                s->io_buffer[370] = 0x01; /* error logging supported */
2173
                s->io_buffer[372] = 0x02; /* minutes for poll short test */
2174
                s->io_buffer[373] = 0x36; /* minutes for poll ext test */
2175
                s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
2176

    
2177
                for (n=0; n<511; n++) 
2178
                s->io_buffer[511] += s->io_buffer[n];
2179
                s->io_buffer[511] = 0x100 - s->io_buffer[511];
2180
                s->status = READY_STAT | SEEK_STAT;
2181
                ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2182
                ide_set_irq(s->bus);
2183
                break;
2184
        case SMART_READ_LOG:
2185
                switch (s->sector) {
2186
                case 0x01: /* summary smart error log */
2187
                memset(s->io_buffer, 0, 0x200);
2188
                s->io_buffer[0] = 0x01;
2189
                s->io_buffer[1] = 0x00; /* no error entries */
2190
                s->io_buffer[452] = s->smart_errors & 0xff;
2191
                s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
2192

    
2193
                for (n=0; n<511; n++)
2194
                        s->io_buffer[511] += s->io_buffer[n];
2195
                s->io_buffer[511] = 0x100 - s->io_buffer[511];
2196
                break;
2197
                case 0x06: /* smart self test log */
2198
                memset(s->io_buffer, 0, 0x200);
2199
                s->io_buffer[0] = 0x01;
2200
                if (s->smart_selftest_count == 0) {
2201
                        s->io_buffer[508] = 0;
2202
                } else {
2203
                        s->io_buffer[508] = s->smart_selftest_count;
2204
                        for (n=2; n<506; n++) 
2205
                        s->io_buffer[n] = s->smart_selftest_data[n];
2206
                }
2207
                for (n=0; n<511; n++)
2208
                        s->io_buffer[511] += s->io_buffer[n];
2209
                s->io_buffer[511] = 0x100 - s->io_buffer[511];
2210
                break;
2211
                default:
2212
                goto abort_cmd;
2213
                }
2214
                s->status = READY_STAT | SEEK_STAT;
2215
                ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2216
                ide_set_irq(s->bus);
2217
                break;
2218
        case SMART_EXECUTE_OFFLINE:
2219
                switch (s->sector) {
2220
                case 0: /* off-line routine */
2221
                case 1: /* short self test */
2222
                case 2: /* extended self test */
2223
                s->smart_selftest_count++;
2224
                if(s->smart_selftest_count > 21)
2225
                        s->smart_selftest_count = 0;
2226
                n = 2 + (s->smart_selftest_count - 1) * 24;
2227
                s->smart_selftest_data[n] = s->sector;
2228
                s->smart_selftest_data[n+1] = 0x00; /* OK and finished */
2229
                s->smart_selftest_data[n+2] = 0x34; /* hour count lsb */
2230
                s->smart_selftest_data[n+3] = 0x12; /* hour count msb */
2231
                s->status = READY_STAT | SEEK_STAT;
2232
                ide_set_irq(s->bus);
2233
                break;
2234
                default:
2235
                goto abort_cmd;
2236
                }
2237
                break;
2238
        default:
2239
                goto abort_cmd;
2240
        }
2241
        break;
2242
    default:
2243
    abort_cmd:
2244
        ide_abort_command(s);
2245
        ide_set_irq(s->bus);
2246
        break;
2247
    }
2248
}
2249

    
2250
uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
2251
{
2252
    IDEBus *bus = opaque;
2253
    IDEState *s = idebus_active_if(bus);
2254
    uint32_t addr;
2255
    int ret, hob;
2256

    
2257
    addr = addr1 & 7;
2258
    /* FIXME: HOB readback uses bit 7, but it's always set right now */
2259
    //hob = s->select & (1 << 7);
2260
    hob = 0;
2261
    switch(addr) {
2262
    case 0:
2263
        ret = 0xff;
2264
        break;
2265
    case 1:
2266
        if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
2267
            (s != bus->ifs && !s->bs))
2268
            ret = 0;
2269
        else if (!hob)
2270
            ret = s->error;
2271
        else
2272
            ret = s->hob_feature;
2273
        break;
2274
    case 2:
2275
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2276
            ret = 0;
2277
        else if (!hob)
2278
            ret = s->nsector & 0xff;
2279
        else
2280
            ret = s->hob_nsector;
2281
        break;
2282
    case 3:
2283
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2284
            ret = 0;
2285
        else if (!hob)
2286
            ret = s->sector;
2287
        else
2288
            ret = s->hob_sector;
2289
        break;
2290
    case 4:
2291
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2292
            ret = 0;
2293
        else if (!hob)
2294
            ret = s->lcyl;
2295
        else
2296
            ret = s->hob_lcyl;
2297
        break;
2298
    case 5:
2299
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2300
            ret = 0;
2301
        else if (!hob)
2302
            ret = s->hcyl;
2303
        else
2304
            ret = s->hob_hcyl;
2305
        break;
2306
    case 6:
2307
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2308
            ret = 0;
2309
        else
2310
            ret = s->select;
2311
        break;
2312
    default:
2313
    case 7:
2314
        if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
2315
            (s != bus->ifs && !s->bs))
2316
            ret = 0;
2317
        else
2318
            ret = s->status;
2319
        qemu_irq_lower(bus->irq);
2320
        break;
2321
    }
2322
#ifdef DEBUG_IDE
2323
    printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
2324
#endif
2325
    return ret;
2326
}
2327

    
2328
uint32_t ide_status_read(void *opaque, uint32_t addr)
2329
{
2330
    IDEBus *bus = opaque;
2331
    IDEState *s = idebus_active_if(bus);
2332
    int ret;
2333

    
2334
    if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
2335
        (s != bus->ifs && !s->bs))
2336
        ret = 0;
2337
    else
2338
        ret = s->status;
2339
#ifdef DEBUG_IDE
2340
    printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
2341
#endif
2342
    return ret;
2343
}
2344

    
2345
void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
2346
{
2347
    IDEBus *bus = opaque;
2348
    IDEState *s;
2349
    int i;
2350

    
2351
#ifdef DEBUG_IDE
2352
    printf("ide: write control addr=0x%x val=%02x\n", addr, val);
2353
#endif
2354
    /* common for both drives */
2355
    if (!(bus->cmd & IDE_CMD_RESET) &&
2356
        (val & IDE_CMD_RESET)) {
2357
        /* reset low to high */
2358
        for(i = 0;i < 2; i++) {
2359
            s = &bus->ifs[i];
2360
            s->status = BUSY_STAT | SEEK_STAT;
2361
            s->error = 0x01;
2362
        }
2363
    } else if ((bus->cmd & IDE_CMD_RESET) &&
2364
               !(val & IDE_CMD_RESET)) {
2365
        /* high to low */
2366
        for(i = 0;i < 2; i++) {
2367
            s = &bus->ifs[i];
2368
            if (s->drive_kind == IDE_CD)
2369
                s->status = 0x00; /* NOTE: READY is _not_ set */
2370
            else
2371
                s->status = READY_STAT | SEEK_STAT;
2372
            ide_set_signature(s);
2373
        }
2374
    }
2375

    
2376
    bus->cmd = val;
2377
}
2378

    
2379
void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
2380
{
2381
    IDEBus *bus = opaque;
2382
    IDEState *s = idebus_active_if(bus);
2383
    uint8_t *p;
2384

    
2385
    /* PIO data access allowed only when DRQ bit is set */
2386
    if (!(s->status & DRQ_STAT))
2387
        return;
2388

    
2389
    p = s->data_ptr;
2390
    *(uint16_t *)p = le16_to_cpu(val);
2391
    p += 2;
2392
    s->data_ptr = p;
2393
    if (p >= s->data_end)
2394
        s->end_transfer_func(s);
2395
}
2396

    
2397
uint32_t ide_data_readw(void *opaque, uint32_t addr)
2398
{
2399
    IDEBus *bus = opaque;
2400
    IDEState *s = idebus_active_if(bus);
2401
    uint8_t *p;
2402
    int ret;
2403

    
2404
    /* PIO data access allowed only when DRQ bit is set */
2405
    if (!(s->status & DRQ_STAT))
2406
        return 0;
2407

    
2408
    p = s->data_ptr;
2409
    ret = cpu_to_le16(*(uint16_t *)p);
2410
    p += 2;
2411
    s->data_ptr = p;
2412
    if (p >= s->data_end)
2413
        s->end_transfer_func(s);
2414
    return ret;
2415
}
2416

    
2417
void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
2418
{
2419
    IDEBus *bus = opaque;
2420
    IDEState *s = idebus_active_if(bus);
2421
    uint8_t *p;
2422

    
2423
    /* PIO data access allowed only when DRQ bit is set */
2424
    if (!(s->status & DRQ_STAT))
2425
        return;
2426

    
2427
    p = s->data_ptr;
2428
    *(uint32_t *)p = le32_to_cpu(val);
2429
    p += 4;
2430
    s->data_ptr = p;
2431
    if (p >= s->data_end)
2432
        s->end_transfer_func(s);
2433
}
2434

    
2435
uint32_t ide_data_readl(void *opaque, uint32_t addr)
2436
{
2437
    IDEBus *bus = opaque;
2438
    IDEState *s = idebus_active_if(bus);
2439
    uint8_t *p;
2440
    int ret;
2441

    
2442
    /* PIO data access allowed only when DRQ bit is set */
2443
    if (!(s->status & DRQ_STAT))
2444
        return 0;
2445

    
2446
    p = s->data_ptr;
2447
    ret = cpu_to_le32(*(uint32_t *)p);
2448
    p += 4;
2449
    s->data_ptr = p;
2450
    if (p >= s->data_end)
2451
        s->end_transfer_func(s);
2452
    return ret;
2453
}
2454

    
2455
static void ide_dummy_transfer_stop(IDEState *s)
2456
{
2457
    s->data_ptr = s->io_buffer;
2458
    s->data_end = s->io_buffer;
2459
    s->io_buffer[0] = 0xff;
2460
    s->io_buffer[1] = 0xff;
2461
    s->io_buffer[2] = 0xff;
2462
    s->io_buffer[3] = 0xff;
2463
}
2464

    
2465
static void ide_reset(IDEState *s)
2466
{
2467
#ifdef DEBUG_IDE
2468
    printf("ide: reset\n");
2469
#endif
2470
    if (s->drive_kind == IDE_CFATA)
2471
        s->mult_sectors = 0;
2472
    else
2473
        s->mult_sectors = MAX_MULT_SECTORS;
2474
    /* ide regs */
2475
    s->feature = 0;
2476
    s->error = 0;
2477
    s->nsector = 0;
2478
    s->sector = 0;
2479
    s->lcyl = 0;
2480
    s->hcyl = 0;
2481

    
2482
    /* lba48 */
2483
    s->hob_feature = 0;
2484
    s->hob_sector = 0;
2485
    s->hob_nsector = 0;
2486
    s->hob_lcyl = 0;
2487
    s->hob_hcyl = 0;
2488

    
2489
    s->select = 0xa0;
2490
    s->status = READY_STAT | SEEK_STAT;
2491

    
2492
    s->lba48 = 0;
2493

    
2494
    /* ATAPI specific */
2495
    s->sense_key = 0;
2496
    s->asc = 0;
2497
    s->cdrom_changed = 0;
2498
    s->packet_transfer_size = 0;
2499
    s->elementary_transfer_size = 0;
2500
    s->io_buffer_index = 0;
2501
    s->cd_sector_size = 0;
2502
    s->atapi_dma = 0;
2503
    /* ATA DMA state */
2504
    s->io_buffer_size = 0;
2505
    s->req_nb_sectors = 0;
2506

    
2507
    ide_set_signature(s);
2508
    /* init the transfer handler so that 0xffff is returned on data
2509
       accesses */
2510
    s->end_transfer_func = ide_dummy_transfer_stop;
2511
    ide_dummy_transfer_stop(s);
2512
    s->media_changed = 0;
2513
}
2514

    
2515
void ide_bus_reset(IDEBus *bus)
2516
{
2517
    bus->unit = 0;
2518
    bus->cmd = 0;
2519
    ide_reset(&bus->ifs[0]);
2520
    ide_reset(&bus->ifs[1]);
2521
    ide_clear_hob(bus);
2522

    
2523
    /* pending async DMA */
2524
    if (bus->dma->aiocb) {
2525
#ifdef DEBUG_AIO
2526
        printf("aio_cancel\n");
2527
#endif
2528
        bdrv_aio_cancel(bus->dma->aiocb);
2529
        bus->dma->aiocb = NULL;
2530
    }
2531

    
2532
    /* reset dma provider too */
2533
    bus->dma->ops->reset(bus->dma);
2534
}
2535

    
2536
int ide_init_drive(IDEState *s, BlockDriverState *bs,
2537
                   const char *version, const char *serial)
2538
{
2539
    int cylinders, heads, secs;
2540
    uint64_t nb_sectors;
2541

    
2542
    s->bs = bs;
2543
    bdrv_get_geometry(bs, &nb_sectors);
2544
    bdrv_guess_geometry(bs, &cylinders, &heads, &secs);
2545
    if (cylinders < 1 || cylinders > 16383) {
2546
        error_report("cyls must be between 1 and 16383");
2547
        return -1;
2548
    }
2549
    if (heads < 1 || heads > 16) {
2550
        error_report("heads must be between 1 and 16");
2551
        return -1;
2552
    }
2553
    if (secs < 1 || secs > 63) {
2554
        error_report("secs must be between 1 and 63");
2555
        return -1;
2556
    }
2557
    s->cylinders = cylinders;
2558
    s->heads = heads;
2559
    s->sectors = secs;
2560
    s->nb_sectors = nb_sectors;
2561
    /* The SMART values should be preserved across power cycles
2562
       but they aren't.  */
2563
    s->smart_enabled = 1;
2564
    s->smart_autosave = 1;
2565
    s->smart_errors = 0;
2566
    s->smart_selftest_count = 0;
2567
    if (bdrv_get_type_hint(bs) == BDRV_TYPE_CDROM) {
2568
        s->drive_kind = IDE_CD;
2569
        bdrv_set_change_cb(bs, cdrom_change_cb, s);
2570
        bs->buffer_alignment = 2048;
2571
    } else {
2572
        if (!bdrv_is_inserted(s->bs)) {
2573
            error_report("Device needs media, but drive is empty");
2574
            return -1;
2575
        }
2576
        if (bdrv_is_read_only(bs)) {
2577
            error_report("Can't use a read-only drive");
2578
            return -1;
2579
        }
2580
    }
2581
    if (serial) {
2582
        strncpy(s->drive_serial_str, serial, sizeof(s->drive_serial_str));
2583
    } else {
2584
        snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
2585
                 "QM%05d", s->drive_serial);
2586
    }
2587
    if (version) {
2588
        pstrcpy(s->version, sizeof(s->version), version);
2589
    } else {
2590
        pstrcpy(s->version, sizeof(s->version), QEMU_VERSION);
2591
    }
2592

    
2593
    ide_reset(s);
2594
    bdrv_set_removable(bs, s->drive_kind == IDE_CD);
2595
    return 0;
2596
}
2597

    
2598
static void ide_init1(IDEBus *bus, int unit)
2599
{
2600
    static int drive_serial = 1;
2601
    IDEState *s = &bus->ifs[unit];
2602

    
2603
    s->bus = bus;
2604
    s->unit = unit;
2605
    s->drive_serial = drive_serial++;
2606
    /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */
2607
    s->io_buffer = qemu_memalign(2048, IDE_DMA_BUF_SECTORS*512 + 4);
2608
    s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;
2609
    s->smart_selftest_data = qemu_blockalign(s->bs, 512);
2610
    s->sector_write_timer = qemu_new_timer(vm_clock,
2611
                                           ide_sector_write_timer_cb, s);
2612
}
2613

    
2614
static void ide_nop_start(IDEDMA *dma, IDEState *s,
2615
                          BlockDriverCompletionFunc *cb)
2616
{
2617
}
2618

    
2619
static int ide_nop(IDEDMA *dma)
2620
{
2621
    return 0;
2622
}
2623

    
2624
static int ide_nop_int(IDEDMA *dma, int x)
2625
{
2626
    return 0;
2627
}
2628

    
2629
static void ide_nop_restart(void *opaque, int x, int y)
2630
{
2631
}
2632

    
2633
static const IDEDMAOps ide_dma_nop_ops = {
2634
    .start_dma      = ide_nop_start,
2635
    .start_transfer = ide_nop,
2636
    .prepare_buf    = ide_nop_int,
2637
    .rw_buf         = ide_nop_int,
2638
    .set_unit       = ide_nop_int,
2639
    .add_status     = ide_nop_int,
2640
    .set_inactive   = ide_nop,
2641
    .restart_cb     = ide_nop_restart,
2642
    .reset          = ide_nop,
2643
};
2644

    
2645
static IDEDMA ide_dma_nop = {
2646
    .ops = &ide_dma_nop_ops,
2647
    .aiocb = NULL,
2648
};
2649

    
2650
void ide_init2(IDEBus *bus, qemu_irq irq)
2651
{
2652
    int i;
2653

    
2654
    for(i = 0; i < 2; i++) {
2655
        ide_init1(bus, i);
2656
        ide_reset(&bus->ifs[i]);
2657
    }
2658
    bus->irq = irq;
2659
    bus->dma = &ide_dma_nop;
2660
}
2661

    
2662
/* TODO convert users to qdev and remove */
2663
void ide_init2_with_non_qdev_drives(IDEBus *bus, DriveInfo *hd0,
2664
                                    DriveInfo *hd1, qemu_irq irq)
2665
{
2666
    int i;
2667
    DriveInfo *dinfo;
2668

    
2669
    for(i = 0; i < 2; i++) {
2670
        dinfo = i == 0 ? hd0 : hd1;
2671
        ide_init1(bus, i);
2672
        if (dinfo) {
2673
            if (ide_init_drive(&bus->ifs[i], dinfo->bdrv, NULL,
2674
                               *dinfo->serial ? dinfo->serial : NULL) < 0) {
2675
                error_report("Can't set up IDE drive %s", dinfo->id);
2676
                exit(1);
2677
            }
2678
        } else {
2679
            ide_reset(&bus->ifs[i]);
2680
        }
2681
    }
2682
    bus->irq = irq;
2683
    bus->dma = &ide_dma_nop;
2684
}
2685

    
2686
void ide_init_ioport(IDEBus *bus, int iobase, int iobase2)
2687
{
2688
    register_ioport_write(iobase, 8, 1, ide_ioport_write, bus);
2689
    register_ioport_read(iobase, 8, 1, ide_ioport_read, bus);
2690
    if (iobase2) {
2691
        register_ioport_read(iobase2, 1, 1, ide_status_read, bus);
2692
        register_ioport_write(iobase2, 1, 1, ide_cmd_write, bus);
2693
    }
2694

    
2695
    /* data ports */
2696
    register_ioport_write(iobase, 2, 2, ide_data_writew, bus);
2697
    register_ioport_read(iobase, 2, 2, ide_data_readw, bus);
2698
    register_ioport_write(iobase, 4, 4, ide_data_writel, bus);
2699
    register_ioport_read(iobase, 4, 4, ide_data_readl, bus);
2700
}
2701

    
2702
static bool is_identify_set(void *opaque, int version_id)
2703
{
2704
    IDEState *s = opaque;
2705

    
2706
    return s->identify_set != 0;
2707
}
2708

    
2709
static EndTransferFunc* transfer_end_table[] = {
2710
        ide_sector_read,
2711
        ide_sector_write,
2712
        ide_transfer_stop,
2713
        ide_atapi_cmd_reply_end,
2714
        ide_atapi_cmd,
2715
        ide_dummy_transfer_stop,
2716
};
2717

    
2718
static int transfer_end_table_idx(EndTransferFunc *fn)
2719
{
2720
    int i;
2721

    
2722
    for (i = 0; i < ARRAY_SIZE(transfer_end_table); i++)
2723
        if (transfer_end_table[i] == fn)
2724
            return i;
2725

    
2726
    return -1;
2727
}
2728

    
2729
static int ide_drive_post_load(void *opaque, int version_id)
2730
{
2731
    IDEState *s = opaque;
2732

    
2733
    if (version_id < 3) {
2734
        if (s->sense_key == SENSE_UNIT_ATTENTION &&
2735
            s->asc == ASC_MEDIUM_MAY_HAVE_CHANGED) {
2736
            s->cdrom_changed = 1;
2737
        }
2738
    }
2739
    return 0;
2740
}
2741

    
2742
static int ide_drive_pio_post_load(void *opaque, int version_id)
2743
{
2744
    IDEState *s = opaque;
2745

    
2746
    if (s->end_transfer_fn_idx > ARRAY_SIZE(transfer_end_table)) {
2747
        return -EINVAL;
2748
    }
2749
    s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
2750
    s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
2751
    s->data_end = s->data_ptr + s->cur_io_buffer_len;
2752

    
2753
    return 0;
2754
}
2755

    
2756
static void ide_drive_pio_pre_save(void *opaque)
2757
{
2758
    IDEState *s = opaque;
2759
    int idx;
2760

    
2761
    s->cur_io_buffer_offset = s->data_ptr - s->io_buffer;
2762
    s->cur_io_buffer_len = s->data_end - s->data_ptr;
2763

    
2764
    idx = transfer_end_table_idx(s->end_transfer_func);
2765
    if (idx == -1) {
2766
        fprintf(stderr, "%s: invalid end_transfer_func for DRQ_STAT\n",
2767
                        __func__);
2768
        s->end_transfer_fn_idx = 2;
2769
    } else {
2770
        s->end_transfer_fn_idx = idx;
2771
    }
2772
}
2773

    
2774
static bool ide_drive_pio_state_needed(void *opaque)
2775
{
2776
    IDEState *s = opaque;
2777

    
2778
    return (s->status & DRQ_STAT) != 0;
2779
}
2780

    
2781
const VMStateDescription vmstate_ide_drive_pio_state = {
2782
    .name = "ide_drive/pio_state",
2783
    .version_id = 1,
2784
    .minimum_version_id = 1,
2785
    .minimum_version_id_old = 1,
2786
    .pre_save = ide_drive_pio_pre_save,
2787
    .post_load = ide_drive_pio_post_load,
2788
    .fields      = (VMStateField []) {
2789
        VMSTATE_INT32(req_nb_sectors, IDEState),
2790
        VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1,
2791
                             vmstate_info_uint8, uint8_t),
2792
        VMSTATE_INT32(cur_io_buffer_offset, IDEState),
2793
        VMSTATE_INT32(cur_io_buffer_len, IDEState),
2794
        VMSTATE_UINT8(end_transfer_fn_idx, IDEState),
2795
        VMSTATE_INT32(elementary_transfer_size, IDEState),
2796
        VMSTATE_INT32(packet_transfer_size, IDEState),
2797
        VMSTATE_END_OF_LIST()
2798
    }
2799
};
2800

    
2801
const VMStateDescription vmstate_ide_drive = {
2802
    .name = "ide_drive",
2803
    .version_id = 3,
2804
    .minimum_version_id = 0,
2805
    .minimum_version_id_old = 0,
2806
    .post_load = ide_drive_post_load,
2807
    .fields      = (VMStateField []) {
2808
        VMSTATE_INT32(mult_sectors, IDEState),
2809
        VMSTATE_INT32(identify_set, IDEState),
2810
        VMSTATE_BUFFER_TEST(identify_data, IDEState, is_identify_set),
2811
        VMSTATE_UINT8(feature, IDEState),
2812
        VMSTATE_UINT8(error, IDEState),
2813
        VMSTATE_UINT32(nsector, IDEState),
2814
        VMSTATE_UINT8(sector, IDEState),
2815
        VMSTATE_UINT8(lcyl, IDEState),
2816
        VMSTATE_UINT8(hcyl, IDEState),
2817
        VMSTATE_UINT8(hob_feature, IDEState),
2818
        VMSTATE_UINT8(hob_sector, IDEState),
2819
        VMSTATE_UINT8(hob_nsector, IDEState),
2820
        VMSTATE_UINT8(hob_lcyl, IDEState),
2821
        VMSTATE_UINT8(hob_hcyl, IDEState),
2822
        VMSTATE_UINT8(select, IDEState),
2823
        VMSTATE_UINT8(status, IDEState),
2824
        VMSTATE_UINT8(lba48, IDEState),
2825
        VMSTATE_UINT8(sense_key, IDEState),
2826
        VMSTATE_UINT8(asc, IDEState),
2827
        VMSTATE_UINT8_V(cdrom_changed, IDEState, 3),
2828
        VMSTATE_END_OF_LIST()
2829
    },
2830
    .subsections = (VMStateSubsection []) {
2831
        {
2832
            .vmsd = &vmstate_ide_drive_pio_state,
2833
            .needed = ide_drive_pio_state_needed,
2834
        }, {
2835
            /* empty */
2836
        }
2837
    }
2838
};
2839

    
2840
const VMStateDescription vmstate_ide_bus = {
2841
    .name = "ide_bus",
2842
    .version_id = 1,
2843
    .minimum_version_id = 1,
2844
    .minimum_version_id_old = 1,
2845
    .fields      = (VMStateField []) {
2846
        VMSTATE_UINT8(cmd, IDEBus),
2847
        VMSTATE_UINT8(unit, IDEBus),
2848
        VMSTATE_END_OF_LIST()
2849
    }
2850
};