Statistics
| Branch: | Revision:

root / hw / ide / core.c @ 6bcb1a79

History | View | Annotate | Download (89.5 kB)

1
/*
2
 * QEMU IDE disk and CD/DVD-ROM Emulator
3
 *
4
 * Copyright (c) 2003 Fabrice Bellard
5
 * Copyright (c) 2006 Openedhand Ltd.
6
 *
7
 * Permission is hereby granted, free of charge, to any person obtaining a copy
8
 * of this software and associated documentation files (the "Software"), to deal
9
 * in the Software without restriction, including without limitation the rights
10
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11
 * copies of the Software, and to permit persons to whom the Software is
12
 * furnished to do so, subject to the following conditions:
13
 *
14
 * The above copyright notice and this permission notice shall be included in
15
 * all copies or substantial portions of the Software.
16
 *
17
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23
 * THE SOFTWARE.
24
 */
25
#include <hw/hw.h>
26
#include <hw/pc.h>
27
#include <hw/pci.h>
28
#include <hw/scsi.h>
29
#include "qemu-error.h"
30
#include "qemu-timer.h"
31
#include "sysemu.h"
32
#include "dma.h"
33
#include "blockdev.h"
34

    
35
#include <hw/ide/internal.h>
36

    
37
#define IDE_PAGE_SIZE 4096
38

    
39
static const int smart_attributes[][5] = {
40
    /* id,  flags, val, wrst, thrsh */
41
    { 0x01, 0x03, 0x64, 0x64, 0x06}, /* raw read */
42
    { 0x03, 0x03, 0x64, 0x64, 0x46}, /* spin up */
43
    { 0x04, 0x02, 0x64, 0x64, 0x14}, /* start stop count */
44
    { 0x05, 0x03, 0x64, 0x64, 0x36}, /* remapped sectors */
45
    { 0x00, 0x00, 0x00, 0x00, 0x00}
46
};
47

    
48
/* XXX: DVDs that could fit on a CD will be reported as a CD */
49
static inline int media_present(IDEState *s)
50
{
51
    return (s->nb_sectors > 0);
52
}
53

    
54
static inline int media_is_dvd(IDEState *s)
55
{
56
    return (media_present(s) && s->nb_sectors > CD_MAX_SECTORS);
57
}
58

    
59
static inline int media_is_cd(IDEState *s)
60
{
61
    return (media_present(s) && s->nb_sectors <= CD_MAX_SECTORS);
62
}
63

    
64
static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb);
65
static void ide_dma_restart(IDEState *s, int is_read);
66
static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret);
67
static int ide_handle_rw_error(IDEState *s, int error, int op);
68

    
69
static void padstr(char *str, const char *src, int len)
70
{
71
    int i, v;
72
    for(i = 0; i < len; i++) {
73
        if (*src)
74
            v = *src++;
75
        else
76
            v = ' ';
77
        str[i^1] = v;
78
    }
79
}
80

    
81
static void padstr8(uint8_t *buf, int buf_size, const char *src)
82
{
83
    int i;
84
    for(i = 0; i < buf_size; i++) {
85
        if (*src)
86
            buf[i] = *src++;
87
        else
88
            buf[i] = ' ';
89
    }
90
}
91

    
92
static void put_le16(uint16_t *p, unsigned int v)
93
{
94
    *p = cpu_to_le16(v);
95
}
96

    
97
static void ide_identify(IDEState *s)
98
{
99
    uint16_t *p;
100
    unsigned int oldsize;
101
    IDEDevice *dev;
102

    
103
    if (s->identify_set) {
104
        memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
105
        return;
106
    }
107

    
108
    memset(s->io_buffer, 0, 512);
109
    p = (uint16_t *)s->io_buffer;
110
    put_le16(p + 0, 0x0040);
111
    put_le16(p + 1, s->cylinders);
112
    put_le16(p + 3, s->heads);
113
    put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
114
    put_le16(p + 5, 512); /* XXX: retired, remove ? */
115
    put_le16(p + 6, s->sectors);
116
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
117
    put_le16(p + 20, 3); /* XXX: retired, remove ? */
118
    put_le16(p + 21, 512); /* cache size in sectors */
119
    put_le16(p + 22, 4); /* ecc bytes */
120
    padstr((char *)(p + 23), s->version, 8); /* firmware version */
121
    padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
122
#if MAX_MULT_SECTORS > 1
123
    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
124
#endif
125
    put_le16(p + 48, 1); /* dword I/O */
126
    put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
127
    put_le16(p + 51, 0x200); /* PIO transfer cycle */
128
    put_le16(p + 52, 0x200); /* DMA transfer cycle */
129
    put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
130
    put_le16(p + 54, s->cylinders);
131
    put_le16(p + 55, s->heads);
132
    put_le16(p + 56, s->sectors);
133
    oldsize = s->cylinders * s->heads * s->sectors;
134
    put_le16(p + 57, oldsize);
135
    put_le16(p + 58, oldsize >> 16);
136
    if (s->mult_sectors)
137
        put_le16(p + 59, 0x100 | s->mult_sectors);
138
    put_le16(p + 60, s->nb_sectors);
139
    put_le16(p + 61, s->nb_sectors >> 16);
140
    put_le16(p + 62, 0x07); /* single word dma0-2 supported */
141
    put_le16(p + 63, 0x07); /* mdma0-2 supported */
142
    put_le16(p + 64, 0x03); /* pio3-4 supported */
143
    put_le16(p + 65, 120);
144
    put_le16(p + 66, 120);
145
    put_le16(p + 67, 120);
146
    put_le16(p + 68, 120);
147
    put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
148
    put_le16(p + 81, 0x16); /* conforms to ata5 */
149
    /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */
150
    put_le16(p + 82, (1 << 14) | (1 << 5) | 1);
151
    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
152
    put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
153
    /* 14=set to 1, 1=SMART self test, 0=SMART error logging */
154
    put_le16(p + 84, (1 << 14) | 0);
155
    /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */
156
    if (bdrv_enable_write_cache(s->bs))
157
         put_le16(p + 85, (1 << 14) | (1 << 5) | 1);
158
    else
159
         put_le16(p + 85, (1 << 14) | 1);
160
    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
161
    put_le16(p + 86, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
162
    /* 14=set to 1, 1=smart self test, 0=smart error logging */
163
    put_le16(p + 87, (1 << 14) | 0);
164
    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
165
    put_le16(p + 93, 1 | (1 << 14) | 0x2000);
166
    put_le16(p + 100, s->nb_sectors);
167
    put_le16(p + 101, s->nb_sectors >> 16);
168
    put_le16(p + 102, s->nb_sectors >> 32);
169
    put_le16(p + 103, s->nb_sectors >> 48);
170
    dev = s->unit ? s->bus->slave : s->bus->master;
171
    if (dev && dev->conf.physical_block_size)
172
        put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));
173

    
174
    memcpy(s->identify_data, p, sizeof(s->identify_data));
175
    s->identify_set = 1;
176
}
177

    
178
static void ide_atapi_identify(IDEState *s)
179
{
180
    uint16_t *p;
181

    
182
    if (s->identify_set) {
183
        memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
184
        return;
185
    }
186

    
187
    memset(s->io_buffer, 0, 512);
188
    p = (uint16_t *)s->io_buffer;
189
    /* Removable CDROM, 50us response, 12 byte packets */
190
    put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
191
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
192
    put_le16(p + 20, 3); /* buffer type */
193
    put_le16(p + 21, 512); /* cache size in sectors */
194
    put_le16(p + 22, 4); /* ecc bytes */
195
    padstr((char *)(p + 23), s->version, 8); /* firmware version */
196
    padstr((char *)(p + 27), "QEMU DVD-ROM", 40); /* model */
197
    put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
198
#ifdef USE_DMA_CDROM
199
    put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
200
    put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
201
    put_le16(p + 62, 7);  /* single word dma0-2 supported */
202
    put_le16(p + 63, 7);  /* mdma0-2 supported */
203
#else
204
    put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
205
    put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
206
    put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
207
#endif
208
    put_le16(p + 64, 3); /* pio3-4 supported */
209
    put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
210
    put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
211
    put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
212
    put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
213

    
214
    put_le16(p + 71, 30); /* in ns */
215
    put_le16(p + 72, 30); /* in ns */
216

    
217
    put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
218
#ifdef USE_DMA_CDROM
219
    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
220
#endif
221
    memcpy(s->identify_data, p, sizeof(s->identify_data));
222
    s->identify_set = 1;
223
}
224

    
225
static void ide_cfata_identify(IDEState *s)
226
{
227
    uint16_t *p;
228
    uint32_t cur_sec;
229

    
230
    p = (uint16_t *) s->identify_data;
231
    if (s->identify_set)
232
        goto fill_buffer;
233

    
234
    memset(p, 0, sizeof(s->identify_data));
235

    
236
    cur_sec = s->cylinders * s->heads * s->sectors;
237

    
238
    put_le16(p + 0, 0x848a);                        /* CF Storage Card signature */
239
    put_le16(p + 1, s->cylinders);                /* Default cylinders */
240
    put_le16(p + 3, s->heads);                        /* Default heads */
241
    put_le16(p + 6, s->sectors);                /* Default sectors per track */
242
    put_le16(p + 7, s->nb_sectors >> 16);        /* Sectors per card */
243
    put_le16(p + 8, s->nb_sectors);                /* Sectors per card */
244
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
245
    put_le16(p + 22, 0x0004);                        /* ECC bytes */
246
    padstr((char *) (p + 23), s->version, 8);        /* Firmware Revision */
247
    padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
248
#if MAX_MULT_SECTORS > 1
249
    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
250
#else
251
    put_le16(p + 47, 0x0000);
252
#endif
253
    put_le16(p + 49, 0x0f00);                        /* Capabilities */
254
    put_le16(p + 51, 0x0002);                        /* PIO cycle timing mode */
255
    put_le16(p + 52, 0x0001);                        /* DMA cycle timing mode */
256
    put_le16(p + 53, 0x0003);                        /* Translation params valid */
257
    put_le16(p + 54, s->cylinders);                /* Current cylinders */
258
    put_le16(p + 55, s->heads);                        /* Current heads */
259
    put_le16(p + 56, s->sectors);                /* Current sectors */
260
    put_le16(p + 57, cur_sec);                        /* Current capacity */
261
    put_le16(p + 58, cur_sec >> 16);                /* Current capacity */
262
    if (s->mult_sectors)                        /* Multiple sector setting */
263
        put_le16(p + 59, 0x100 | s->mult_sectors);
264
    put_le16(p + 60, s->nb_sectors);                /* Total LBA sectors */
265
    put_le16(p + 61, s->nb_sectors >> 16);        /* Total LBA sectors */
266
    put_le16(p + 63, 0x0203);                        /* Multiword DMA capability */
267
    put_le16(p + 64, 0x0001);                        /* Flow Control PIO support */
268
    put_le16(p + 65, 0x0096);                        /* Min. Multiword DMA cycle */
269
    put_le16(p + 66, 0x0096);                        /* Rec. Multiword DMA cycle */
270
    put_le16(p + 68, 0x00b4);                        /* Min. PIO cycle time */
271
    put_le16(p + 82, 0x400c);                        /* Command Set supported */
272
    put_le16(p + 83, 0x7068);                        /* Command Set supported */
273
    put_le16(p + 84, 0x4000);                        /* Features supported */
274
    put_le16(p + 85, 0x000c);                        /* Command Set enabled */
275
    put_le16(p + 86, 0x7044);                        /* Command Set enabled */
276
    put_le16(p + 87, 0x4000);                        /* Features enabled */
277
    put_le16(p + 91, 0x4060);                        /* Current APM level */
278
    put_le16(p + 129, 0x0002);                        /* Current features option */
279
    put_le16(p + 130, 0x0005);                        /* Reassigned sectors */
280
    put_le16(p + 131, 0x0001);                        /* Initial power mode */
281
    put_le16(p + 132, 0x0000);                        /* User signature */
282
    put_le16(p + 160, 0x8100);                        /* Power requirement */
283
    put_le16(p + 161, 0x8001);                        /* CF command set */
284

    
285
    s->identify_set = 1;
286

    
287
fill_buffer:
288
    memcpy(s->io_buffer, p, sizeof(s->identify_data));
289
}
290

    
291
static void ide_set_signature(IDEState *s)
292
{
293
    s->select &= 0xf0; /* clear head */
294
    /* put signature */
295
    s->nsector = 1;
296
    s->sector = 1;
297
    if (s->drive_kind == IDE_CD) {
298
        s->lcyl = 0x14;
299
        s->hcyl = 0xeb;
300
    } else if (s->bs) {
301
        s->lcyl = 0;
302
        s->hcyl = 0;
303
    } else {
304
        s->lcyl = 0xff;
305
        s->hcyl = 0xff;
306
    }
307
}
308

    
309
static inline void ide_abort_command(IDEState *s)
310
{
311
    s->status = READY_STAT | ERR_STAT;
312
    s->error = ABRT_ERR;
313
}
314

    
315
static inline void ide_dma_submit_check(IDEState *s,
316
          BlockDriverCompletionFunc *dma_cb, BMDMAState *bm)
317
{
318
    if (bm->aiocb)
319
        return;
320
    dma_cb(bm, -1);
321
}
322

    
323
/* prepare data transfer and tell what to do after */
324
static void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
325
                               EndTransferFunc *end_transfer_func)
326
{
327
    s->end_transfer_func = end_transfer_func;
328
    s->data_ptr = buf;
329
    s->data_end = buf + size;
330
    if (!(s->status & ERR_STAT))
331
        s->status |= DRQ_STAT;
332
}
333

    
334
static void ide_transfer_stop(IDEState *s)
335
{
336
    s->end_transfer_func = ide_transfer_stop;
337
    s->data_ptr = s->io_buffer;
338
    s->data_end = s->io_buffer;
339
    s->status &= ~DRQ_STAT;
340
}
341

    
342
int64_t ide_get_sector(IDEState *s)
343
{
344
    int64_t sector_num;
345
    if (s->select & 0x40) {
346
        /* lba */
347
        if (!s->lba48) {
348
            sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
349
                (s->lcyl << 8) | s->sector;
350
        } else {
351
            sector_num = ((int64_t)s->hob_hcyl << 40) |
352
                ((int64_t) s->hob_lcyl << 32) |
353
                ((int64_t) s->hob_sector << 24) |
354
                ((int64_t) s->hcyl << 16) |
355
                ((int64_t) s->lcyl << 8) | s->sector;
356
        }
357
    } else {
358
        sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
359
            (s->select & 0x0f) * s->sectors + (s->sector - 1);
360
    }
361
    return sector_num;
362
}
363

    
364
void ide_set_sector(IDEState *s, int64_t sector_num)
365
{
366
    unsigned int cyl, r;
367
    if (s->select & 0x40) {
368
        if (!s->lba48) {
369
            s->select = (s->select & 0xf0) | (sector_num >> 24);
370
            s->hcyl = (sector_num >> 16);
371
            s->lcyl = (sector_num >> 8);
372
            s->sector = (sector_num);
373
        } else {
374
            s->sector = sector_num;
375
            s->lcyl = sector_num >> 8;
376
            s->hcyl = sector_num >> 16;
377
            s->hob_sector = sector_num >> 24;
378
            s->hob_lcyl = sector_num >> 32;
379
            s->hob_hcyl = sector_num >> 40;
380
        }
381
    } else {
382
        cyl = sector_num / (s->heads * s->sectors);
383
        r = sector_num % (s->heads * s->sectors);
384
        s->hcyl = cyl >> 8;
385
        s->lcyl = cyl;
386
        s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
387
        s->sector = (r % s->sectors) + 1;
388
    }
389
}
390

    
391
static void ide_rw_error(IDEState *s) {
392
    ide_abort_command(s);
393
    ide_set_irq(s->bus);
394
}
395

    
396
static void ide_sector_read(IDEState *s)
397
{
398
    int64_t sector_num;
399
    int ret, n;
400

    
401
    s->status = READY_STAT | SEEK_STAT;
402
    s->error = 0; /* not needed by IDE spec, but needed by Windows */
403
    sector_num = ide_get_sector(s);
404
    n = s->nsector;
405
    if (n == 0) {
406
        /* no more sector to read from disk */
407
        ide_transfer_stop(s);
408
    } else {
409
#if defined(DEBUG_IDE)
410
        printf("read sector=%" PRId64 "\n", sector_num);
411
#endif
412
        if (n > s->req_nb_sectors)
413
            n = s->req_nb_sectors;
414
        ret = bdrv_read(s->bs, sector_num, s->io_buffer, n);
415
        if (ret != 0) {
416
            if (ide_handle_rw_error(s, -ret,
417
                BM_STATUS_PIO_RETRY | BM_STATUS_RETRY_READ))
418
            {
419
                return;
420
            }
421
        }
422
        ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read);
423
        ide_set_irq(s->bus);
424
        ide_set_sector(s, sector_num + n);
425
        s->nsector -= n;
426
    }
427
}
428

    
429

    
430
/* return 0 if buffer completed */
431
static int dma_buf_prepare(BMDMAState *bm, int is_write)
432
{
433
    IDEState *s = bmdma_active_if(bm);
434
    struct {
435
        uint32_t addr;
436
        uint32_t size;
437
    } prd;
438
    int l, len;
439

    
440
    qemu_sglist_init(&s->sg, s->nsector / (IDE_PAGE_SIZE / 512) + 1);
441
    s->io_buffer_size = 0;
442
    for(;;) {
443
        if (bm->cur_prd_len == 0) {
444
            /* end of table (with a fail safe of one page) */
445
            if (bm->cur_prd_last ||
446
                (bm->cur_addr - bm->addr) >= IDE_PAGE_SIZE)
447
                return s->io_buffer_size != 0;
448
            cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
449
            bm->cur_addr += 8;
450
            prd.addr = le32_to_cpu(prd.addr);
451
            prd.size = le32_to_cpu(prd.size);
452
            len = prd.size & 0xfffe;
453
            if (len == 0)
454
                len = 0x10000;
455
            bm->cur_prd_len = len;
456
            bm->cur_prd_addr = prd.addr;
457
            bm->cur_prd_last = (prd.size & 0x80000000);
458
        }
459
        l = bm->cur_prd_len;
460
        if (l > 0) {
461
            qemu_sglist_add(&s->sg, bm->cur_prd_addr, l);
462
            bm->cur_prd_addr += l;
463
            bm->cur_prd_len -= l;
464
            s->io_buffer_size += l;
465
        }
466
    }
467
    return 1;
468
}
469

    
470
static void dma_buf_commit(IDEState *s, int is_write)
471
{
472
    qemu_sglist_destroy(&s->sg);
473
}
474

    
475
void ide_dma_error(IDEState *s)
476
{
477
    ide_transfer_stop(s);
478
    s->error = ABRT_ERR;
479
    s->status = READY_STAT | ERR_STAT;
480
    ide_set_irq(s->bus);
481
}
482

    
483
static int ide_handle_rw_error(IDEState *s, int error, int op)
484
{
485
    int is_read = (op & BM_STATUS_RETRY_READ);
486
    BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);
487

    
488
    if (action == BLOCK_ERR_IGNORE) {
489
        bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);
490
        return 0;
491
    }
492

    
493
    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
494
            || action == BLOCK_ERR_STOP_ANY) {
495
        s->bus->bmdma->unit = s->unit;
496
        s->bus->bmdma->status |= op;
497
        bdrv_mon_event(s->bs, BDRV_ACTION_STOP, is_read);
498
        vm_stop(0);
499
    } else {
500
        if (op & BM_STATUS_DMA_RETRY) {
501
            dma_buf_commit(s, 0);
502
            ide_dma_error(s);
503
        } else {
504
            ide_rw_error(s);
505
        }
506
        bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read);
507
    }
508

    
509
    return 1;
510
}
511

    
512
/* return 0 if buffer completed */
513
static int dma_buf_rw(BMDMAState *bm, int is_write)
514
{
515
    IDEState *s = bmdma_active_if(bm);
516
    struct {
517
        uint32_t addr;
518
        uint32_t size;
519
    } prd;
520
    int l, len;
521

    
522
    for(;;) {
523
        l = s->io_buffer_size - s->io_buffer_index;
524
        if (l <= 0)
525
            break;
526
        if (bm->cur_prd_len == 0) {
527
            /* end of table (with a fail safe of one page) */
528
            if (bm->cur_prd_last ||
529
                (bm->cur_addr - bm->addr) >= IDE_PAGE_SIZE)
530
                return 0;
531
            cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
532
            bm->cur_addr += 8;
533
            prd.addr = le32_to_cpu(prd.addr);
534
            prd.size = le32_to_cpu(prd.size);
535
            len = prd.size & 0xfffe;
536
            if (len == 0)
537
                len = 0x10000;
538
            bm->cur_prd_len = len;
539
            bm->cur_prd_addr = prd.addr;
540
            bm->cur_prd_last = (prd.size & 0x80000000);
541
        }
542
        if (l > bm->cur_prd_len)
543
            l = bm->cur_prd_len;
544
        if (l > 0) {
545
            if (is_write) {
546
                cpu_physical_memory_write(bm->cur_prd_addr,
547
                                          s->io_buffer + s->io_buffer_index, l);
548
            } else {
549
                cpu_physical_memory_read(bm->cur_prd_addr,
550
                                          s->io_buffer + s->io_buffer_index, l);
551
            }
552
            bm->cur_prd_addr += l;
553
            bm->cur_prd_len -= l;
554
            s->io_buffer_index += l;
555
        }
556
    }
557
    return 1;
558
}
559

    
560
static void ide_read_dma_cb(void *opaque, int ret)
561
{
562
    BMDMAState *bm = opaque;
563
    IDEState *s = bmdma_active_if(bm);
564
    int n;
565
    int64_t sector_num;
566

    
567
    if (ret < 0) {
568
        if (ide_handle_rw_error(s, -ret,
569
            BM_STATUS_DMA_RETRY | BM_STATUS_RETRY_READ))
570
        {
571
            return;
572
        }
573
    }
574

    
575
    n = s->io_buffer_size >> 9;
576
    sector_num = ide_get_sector(s);
577
    if (n > 0) {
578
        dma_buf_commit(s, 1);
579
        sector_num += n;
580
        ide_set_sector(s, sector_num);
581
        s->nsector -= n;
582
    }
583

    
584
    /* end of transfer ? */
585
    if (s->nsector == 0) {
586
        s->status = READY_STAT | SEEK_STAT;
587
        ide_set_irq(s->bus);
588
    eot:
589
        bm->status &= ~BM_STATUS_DMAING;
590
        bm->status |= BM_STATUS_INT;
591
        bm->dma_cb = NULL;
592
        bm->unit = -1;
593
        bm->aiocb = NULL;
594
        return;
595
    }
596

    
597
    /* launch next transfer */
598
    n = s->nsector;
599
    s->io_buffer_index = 0;
600
    s->io_buffer_size = n * 512;
601
    if (dma_buf_prepare(bm, 1) == 0)
602
        goto eot;
603
#ifdef DEBUG_AIO
604
    printf("aio_read: sector_num=%" PRId64 " n=%d\n", sector_num, n);
605
#endif
606
    bm->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num, ide_read_dma_cb, bm);
607
    ide_dma_submit_check(s, ide_read_dma_cb, bm);
608
}
609

    
610
static void ide_sector_read_dma(IDEState *s)
611
{
612
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
613
    s->io_buffer_index = 0;
614
    s->io_buffer_size = 0;
615
    s->is_read = 1;
616
    ide_dma_start(s, ide_read_dma_cb);
617
}
618

    
619
static void ide_sector_write_timer_cb(void *opaque)
620
{
621
    IDEState *s = opaque;
622
    ide_set_irq(s->bus);
623
}
624

    
625
static void ide_sector_write(IDEState *s)
626
{
627
    int64_t sector_num;
628
    int ret, n, n1;
629

    
630
    s->status = READY_STAT | SEEK_STAT;
631
    sector_num = ide_get_sector(s);
632
#if defined(DEBUG_IDE)
633
    printf("write sector=%" PRId64 "\n", sector_num);
634
#endif
635
    n = s->nsector;
636
    if (n > s->req_nb_sectors)
637
        n = s->req_nb_sectors;
638
    ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
639

    
640
    if (ret != 0) {
641
        if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY))
642
            return;
643
    }
644

    
645
    s->nsector -= n;
646
    if (s->nsector == 0) {
647
        /* no more sectors to write */
648
        ide_transfer_stop(s);
649
    } else {
650
        n1 = s->nsector;
651
        if (n1 > s->req_nb_sectors)
652
            n1 = s->req_nb_sectors;
653
        ide_transfer_start(s, s->io_buffer, 512 * n1, ide_sector_write);
654
    }
655
    ide_set_sector(s, sector_num + n);
656

    
657
    if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
658
        /* It seems there is a bug in the Windows 2000 installer HDD
659
           IDE driver which fills the disk with empty logs when the
660
           IDE write IRQ comes too early. This hack tries to correct
661
           that at the expense of slower write performances. Use this
662
           option _only_ to install Windows 2000. You must disable it
663
           for normal use. */
664
        qemu_mod_timer(s->sector_write_timer,
665
                       qemu_get_clock(vm_clock) + (get_ticks_per_sec() / 1000));
666
    } else {
667
        ide_set_irq(s->bus);
668
    }
669
}
670

    
671
static void ide_dma_restart_bh(void *opaque)
672
{
673
    BMDMAState *bm = opaque;
674
    int is_read;
675

    
676
    qemu_bh_delete(bm->bh);
677
    bm->bh = NULL;
678

    
679
    is_read = !!(bm->status & BM_STATUS_RETRY_READ);
680

    
681
    if (bm->status & BM_STATUS_DMA_RETRY) {
682
        bm->status &= ~(BM_STATUS_DMA_RETRY | BM_STATUS_RETRY_READ);
683
        ide_dma_restart(bmdma_active_if(bm), is_read);
684
    } else if (bm->status & BM_STATUS_PIO_RETRY) {
685
        bm->status &= ~(BM_STATUS_PIO_RETRY | BM_STATUS_RETRY_READ);
686
        if (is_read) {
687
            ide_sector_read(bmdma_active_if(bm));
688
        } else {
689
            ide_sector_write(bmdma_active_if(bm));
690
        }
691
    }
692
}
693

    
694
void ide_dma_restart_cb(void *opaque, int running, int reason)
695
{
696
    BMDMAState *bm = opaque;
697

    
698
    if (!running)
699
        return;
700

    
701
    if (!bm->bh) {
702
        bm->bh = qemu_bh_new(ide_dma_restart_bh, bm);
703
        qemu_bh_schedule(bm->bh);
704
    }
705
}
706

    
707
static void ide_write_dma_cb(void *opaque, int ret)
708
{
709
    BMDMAState *bm = opaque;
710
    IDEState *s = bmdma_active_if(bm);
711
    int n;
712
    int64_t sector_num;
713

    
714
    if (ret < 0) {
715
        if (ide_handle_rw_error(s, -ret,  BM_STATUS_DMA_RETRY))
716
            return;
717
    }
718

    
719
    n = s->io_buffer_size >> 9;
720
    sector_num = ide_get_sector(s);
721
    if (n > 0) {
722
        dma_buf_commit(s, 0);
723
        sector_num += n;
724
        ide_set_sector(s, sector_num);
725
        s->nsector -= n;
726
    }
727

    
728
    /* end of transfer ? */
729
    if (s->nsector == 0) {
730
        s->status = READY_STAT | SEEK_STAT;
731
        ide_set_irq(s->bus);
732
    eot:
733
        bm->status &= ~BM_STATUS_DMAING;
734
        bm->status |= BM_STATUS_INT;
735
        bm->dma_cb = NULL;
736
        bm->unit = -1;
737
        bm->aiocb = NULL;
738
        return;
739
    }
740

    
741
    n = s->nsector;
742
    s->io_buffer_size = n * 512;
743
    /* launch next transfer */
744
    if (dma_buf_prepare(bm, 0) == 0)
745
        goto eot;
746
#ifdef DEBUG_AIO
747
    printf("aio_write: sector_num=%" PRId64 " n=%d\n", sector_num, n);
748
#endif
749
    bm->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num, ide_write_dma_cb, bm);
750
    ide_dma_submit_check(s, ide_write_dma_cb, bm);
751
}
752

    
753
static void ide_sector_write_dma(IDEState *s)
754
{
755
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
756
    s->io_buffer_index = 0;
757
    s->io_buffer_size = 0;
758
    s->is_read = 0;
759
    ide_dma_start(s, ide_write_dma_cb);
760
}
761

    
762
void ide_atapi_cmd_ok(IDEState *s)
763
{
764
    s->error = 0;
765
    s->status = READY_STAT | SEEK_STAT;
766
    s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
767
    ide_set_irq(s->bus);
768
}
769

    
770
void ide_atapi_cmd_error(IDEState *s, int sense_key, int asc)
771
{
772
#ifdef DEBUG_IDE_ATAPI
773
    printf("atapi_cmd_error: sense=0x%x asc=0x%x\n", sense_key, asc);
774
#endif
775
    s->error = sense_key << 4;
776
    s->status = READY_STAT | ERR_STAT;
777
    s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
778
    s->sense_key = sense_key;
779
    s->asc = asc;
780
    ide_set_irq(s->bus);
781
}
782

    
783
static void ide_atapi_cmd_check_status(IDEState *s)
784
{
785
#ifdef DEBUG_IDE_ATAPI
786
    printf("atapi_cmd_check_status\n");
787
#endif
788
    s->error = MC_ERR | (SENSE_UNIT_ATTENTION << 4);
789
    s->status = ERR_STAT;
790
    s->nsector = 0;
791
    ide_set_irq(s->bus);
792
}
793

    
794
static void ide_flush_cb(void *opaque, int ret)
795
{
796
    IDEState *s = opaque;
797

    
798
    /* XXX: how do we signal I/O errors here? */
799

    
800
    s->status = READY_STAT | SEEK_STAT;
801
    ide_set_irq(s->bus);
802
}
803

    
804
static void ide_flush_cache(IDEState *s)
805
{
806
    if (s->bs) {
807
        bdrv_aio_flush(s->bs, ide_flush_cb, s);
808
    } else {
809
        ide_flush_cb(s, 0);
810
    }
811
}
812

    
813
static inline void cpu_to_ube16(uint8_t *buf, int val)
814
{
815
    buf[0] = val >> 8;
816
    buf[1] = val & 0xff;
817
}
818

    
819
static inline void cpu_to_ube32(uint8_t *buf, unsigned int val)
820
{
821
    buf[0] = val >> 24;
822
    buf[1] = val >> 16;
823
    buf[2] = val >> 8;
824
    buf[3] = val & 0xff;
825
}
826

    
827
static inline int ube16_to_cpu(const uint8_t *buf)
828
{
829
    return (buf[0] << 8) | buf[1];
830
}
831

    
832
static inline int ube32_to_cpu(const uint8_t *buf)
833
{
834
    return (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
835
}
836

    
837
static void lba_to_msf(uint8_t *buf, int lba)
838
{
839
    lba += 150;
840
    buf[0] = (lba / 75) / 60;
841
    buf[1] = (lba / 75) % 60;
842
    buf[2] = lba % 75;
843
}
844

    
845
static void cd_data_to_raw(uint8_t *buf, int lba)
846
{
847
    /* sync bytes */
848
    buf[0] = 0x00;
849
    memset(buf + 1, 0xff, 10);
850
    buf[11] = 0x00;
851
    buf += 12;
852
    /* MSF */
853
    lba_to_msf(buf, lba);
854
    buf[3] = 0x01; /* mode 1 data */
855
    buf += 4;
856
    /* data */
857
    buf += 2048;
858
    /* XXX: ECC not computed */
859
    memset(buf, 0, 288);
860
}
861

    
862
static int cd_read_sector(BlockDriverState *bs, int lba, uint8_t *buf,
863
                           int sector_size)
864
{
865
    int ret;
866

    
867
    switch(sector_size) {
868
    case 2048:
869
        ret = bdrv_read(bs, (int64_t)lba << 2, buf, 4);
870
        break;
871
    case 2352:
872
        ret = bdrv_read(bs, (int64_t)lba << 2, buf + 16, 4);
873
        if (ret < 0)
874
            return ret;
875
        cd_data_to_raw(buf, lba);
876
        break;
877
    default:
878
        ret = -EIO;
879
        break;
880
    }
881
    return ret;
882
}
883

    
884
void ide_atapi_io_error(IDEState *s, int ret)
885
{
886
    /* XXX: handle more errors */
887
    if (ret == -ENOMEDIUM) {
888
        ide_atapi_cmd_error(s, SENSE_NOT_READY,
889
                            ASC_MEDIUM_NOT_PRESENT);
890
    } else {
891
        ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
892
                            ASC_LOGICAL_BLOCK_OOR);
893
    }
894
}
895

    
896
/* The whole ATAPI transfer logic is handled in this function */
897
static void ide_atapi_cmd_reply_end(IDEState *s)
898
{
899
    int byte_count_limit, size, ret;
900
#ifdef DEBUG_IDE_ATAPI
901
    printf("reply: tx_size=%d elem_tx_size=%d index=%d\n",
902
           s->packet_transfer_size,
903
           s->elementary_transfer_size,
904
           s->io_buffer_index);
905
#endif
906
    if (s->packet_transfer_size <= 0) {
907
        /* end of transfer */
908
        ide_transfer_stop(s);
909
        s->status = READY_STAT | SEEK_STAT;
910
        s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
911
        ide_set_irq(s->bus);
912
#ifdef DEBUG_IDE_ATAPI
913
        printf("status=0x%x\n", s->status);
914
#endif
915
    } else {
916
        /* see if a new sector must be read */
917
        if (s->lba != -1 && s->io_buffer_index >= s->cd_sector_size) {
918
            ret = cd_read_sector(s->bs, s->lba, s->io_buffer, s->cd_sector_size);
919
            if (ret < 0) {
920
                ide_transfer_stop(s);
921
                ide_atapi_io_error(s, ret);
922
                return;
923
            }
924
            s->lba++;
925
            s->io_buffer_index = 0;
926
        }
927
        if (s->elementary_transfer_size > 0) {
928
            /* there are some data left to transmit in this elementary
929
               transfer */
930
            size = s->cd_sector_size - s->io_buffer_index;
931
            if (size > s->elementary_transfer_size)
932
                size = s->elementary_transfer_size;
933
            ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
934
                               size, ide_atapi_cmd_reply_end);
935
            s->packet_transfer_size -= size;
936
            s->elementary_transfer_size -= size;
937
            s->io_buffer_index += size;
938
        } else {
939
            /* a new transfer is needed */
940
            s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO;
941
            byte_count_limit = s->lcyl | (s->hcyl << 8);
942
#ifdef DEBUG_IDE_ATAPI
943
            printf("byte_count_limit=%d\n", byte_count_limit);
944
#endif
945
            if (byte_count_limit == 0xffff)
946
                byte_count_limit--;
947
            size = s->packet_transfer_size;
948
            if (size > byte_count_limit) {
949
                /* byte count limit must be even if this case */
950
                if (byte_count_limit & 1)
951
                    byte_count_limit--;
952
                size = byte_count_limit;
953
            }
954
            s->lcyl = size;
955
            s->hcyl = size >> 8;
956
            s->elementary_transfer_size = size;
957
            /* we cannot transmit more than one sector at a time */
958
            if (s->lba != -1) {
959
                if (size > (s->cd_sector_size - s->io_buffer_index))
960
                    size = (s->cd_sector_size - s->io_buffer_index);
961
            }
962
            ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
963
                               size, ide_atapi_cmd_reply_end);
964
            s->packet_transfer_size -= size;
965
            s->elementary_transfer_size -= size;
966
            s->io_buffer_index += size;
967
            ide_set_irq(s->bus);
968
#ifdef DEBUG_IDE_ATAPI
969
            printf("status=0x%x\n", s->status);
970
#endif
971
        }
972
    }
973
}
974

    
975
/* send a reply of 'size' bytes in s->io_buffer to an ATAPI command */
976
static void ide_atapi_cmd_reply(IDEState *s, int size, int max_size)
977
{
978
    if (size > max_size)
979
        size = max_size;
980
    s->lba = -1; /* no sector read */
981
    s->packet_transfer_size = size;
982
    s->io_buffer_size = size;    /* dma: send the reply data as one chunk */
983
    s->elementary_transfer_size = 0;
984
    s->io_buffer_index = 0;
985

    
986
    if (s->atapi_dma) {
987
            s->status = READY_STAT | SEEK_STAT | DRQ_STAT;
988
        ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
989
    } else {
990
            s->status = READY_STAT | SEEK_STAT;
991
            ide_atapi_cmd_reply_end(s);
992
    }
993
}
994

    
995
/* start a CD-CDROM read command */
996
static void ide_atapi_cmd_read_pio(IDEState *s, int lba, int nb_sectors,
997
                                   int sector_size)
998
{
999
    s->lba = lba;
1000
    s->packet_transfer_size = nb_sectors * sector_size;
1001
    s->elementary_transfer_size = 0;
1002
    s->io_buffer_index = sector_size;
1003
    s->cd_sector_size = sector_size;
1004

    
1005
    s->status = READY_STAT | SEEK_STAT;
1006
    ide_atapi_cmd_reply_end(s);
1007
}
1008

    
1009
/* ATAPI DMA support */
1010

    
1011
/* XXX: handle read errors */
1012
static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
1013
{
1014
    BMDMAState *bm = opaque;
1015
    IDEState *s = bmdma_active_if(bm);
1016
    int data_offset, n;
1017

    
1018
    if (ret < 0) {
1019
        ide_atapi_io_error(s, ret);
1020
        goto eot;
1021
    }
1022

    
1023
    if (s->io_buffer_size > 0) {
1024
        /*
1025
         * For a cdrom read sector command (s->lba != -1),
1026
         * adjust the lba for the next s->io_buffer_size chunk
1027
         * and dma the current chunk.
1028
         * For a command != read (s->lba == -1), just transfer
1029
         * the reply data.
1030
         */
1031
        if (s->lba != -1) {
1032
            if (s->cd_sector_size == 2352) {
1033
                n = 1;
1034
                cd_data_to_raw(s->io_buffer, s->lba);
1035
            } else {
1036
                n = s->io_buffer_size >> 11;
1037
            }
1038
            s->lba += n;
1039
        }
1040
        s->packet_transfer_size -= s->io_buffer_size;
1041
        if (dma_buf_rw(bm, 1) == 0)
1042
            goto eot;
1043
    }
1044

    
1045
    if (s->packet_transfer_size <= 0) {
1046
        s->status = READY_STAT | SEEK_STAT;
1047
        s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1048
        ide_set_irq(s->bus);
1049
    eot:
1050
        bm->status &= ~BM_STATUS_DMAING;
1051
        bm->status |= BM_STATUS_INT;
1052
        bm->dma_cb = NULL;
1053
        bm->unit = -1;
1054
        bm->aiocb = NULL;
1055
        return;
1056
    }
1057

    
1058
    s->io_buffer_index = 0;
1059
    if (s->cd_sector_size == 2352) {
1060
        n = 1;
1061
        s->io_buffer_size = s->cd_sector_size;
1062
        data_offset = 16;
1063
    } else {
1064
        n = s->packet_transfer_size >> 11;
1065
        if (n > (IDE_DMA_BUF_SECTORS / 4))
1066
            n = (IDE_DMA_BUF_SECTORS / 4);
1067
        s->io_buffer_size = n * 2048;
1068
        data_offset = 0;
1069
    }
1070
#ifdef DEBUG_AIO
1071
    printf("aio_read_cd: lba=%u n=%d\n", s->lba, n);
1072
#endif
1073
    bm->iov.iov_base = (void *)(s->io_buffer + data_offset);
1074
    bm->iov.iov_len = n * 4 * 512;
1075
    qemu_iovec_init_external(&bm->qiov, &bm->iov, 1);
1076
    bm->aiocb = bdrv_aio_readv(s->bs, (int64_t)s->lba << 2, &bm->qiov,
1077
                               n * 4, ide_atapi_cmd_read_dma_cb, bm);
1078
    if (!bm->aiocb) {
1079
        /* Note: media not present is the most likely case */
1080
        ide_atapi_cmd_error(s, SENSE_NOT_READY,
1081
                            ASC_MEDIUM_NOT_PRESENT);
1082
        goto eot;
1083
    }
1084
}
1085

    
1086
/* start a CD-CDROM read command with DMA */
1087
/* XXX: test if DMA is available */
1088
static void ide_atapi_cmd_read_dma(IDEState *s, int lba, int nb_sectors,
1089
                                   int sector_size)
1090
{
1091
    s->lba = lba;
1092
    s->packet_transfer_size = nb_sectors * sector_size;
1093
    s->io_buffer_index = 0;
1094
    s->io_buffer_size = 0;
1095
    s->cd_sector_size = sector_size;
1096

    
1097
    /* XXX: check if BUSY_STAT should be set */
1098
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
1099
    ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
1100
}
1101

    
1102
static void ide_atapi_cmd_read(IDEState *s, int lba, int nb_sectors,
1103
                               int sector_size)
1104
{
1105
#ifdef DEBUG_IDE_ATAPI
1106
    printf("read %s: LBA=%d nb_sectors=%d\n", s->atapi_dma ? "dma" : "pio",
1107
        lba, nb_sectors);
1108
#endif
1109
    if (s->atapi_dma) {
1110
        ide_atapi_cmd_read_dma(s, lba, nb_sectors, sector_size);
1111
    } else {
1112
        ide_atapi_cmd_read_pio(s, lba, nb_sectors, sector_size);
1113
    }
1114
}
1115

    
1116
static inline uint8_t ide_atapi_set_profile(uint8_t *buf, uint8_t *index,
1117
                                            uint16_t profile)
1118
{
1119
    uint8_t *buf_profile = buf + 12; /* start of profiles */
1120

    
1121
    buf_profile += ((*index) * 4); /* start of indexed profile */
1122
    cpu_to_ube16 (buf_profile, profile);
1123
    buf_profile[2] = ((buf_profile[0] == buf[6]) && (buf_profile[1] == buf[7]));
1124

    
1125
    /* each profile adds 4 bytes to the response */
1126
    (*index)++;
1127
    buf[11] += 4; /* Additional Length */
1128

    
1129
    return 4;
1130
}
1131

    
1132
static int ide_dvd_read_structure(IDEState *s, int format,
1133
                                  const uint8_t *packet, uint8_t *buf)
1134
{
1135
    switch (format) {
1136
        case 0x0: /* Physical format information */
1137
            {
1138
                int layer = packet[6];
1139
                uint64_t total_sectors;
1140

    
1141
                if (layer != 0)
1142
                    return -ASC_INV_FIELD_IN_CMD_PACKET;
1143

    
1144
                bdrv_get_geometry(s->bs, &total_sectors);
1145
                total_sectors >>= 2;
1146
                if (total_sectors == 0)
1147
                    return -ASC_MEDIUM_NOT_PRESENT;
1148

    
1149
                buf[4] = 1;   /* DVD-ROM, part version 1 */
1150
                buf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
1151
                buf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */
1152
                buf[7] = 0;   /* default densities */
1153

    
1154
                /* FIXME: 0x30000 per spec? */
1155
                cpu_to_ube32(buf + 8, 0); /* start sector */
1156
                cpu_to_ube32(buf + 12, total_sectors - 1); /* end sector */
1157
                cpu_to_ube32(buf + 16, total_sectors - 1); /* l0 end sector */
1158

    
1159
                /* Size of buffer, not including 2 byte size field */
1160
                cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1161

    
1162
                /* 2k data + 4 byte header */
1163
                return (2048 + 4);
1164
            }
1165

    
1166
        case 0x01: /* DVD copyright information */
1167
            buf[4] = 0; /* no copyright data */
1168
            buf[5] = 0; /* no region restrictions */
1169

    
1170
            /* Size of buffer, not including 2 byte size field */
1171
            cpu_to_be16wu((uint16_t *)buf, 4 + 2);
1172

    
1173
            /* 4 byte header + 4 byte data */
1174
            return (4 + 4);
1175

    
1176
        case 0x03: /* BCA information - invalid field for no BCA info */
1177
            return -ASC_INV_FIELD_IN_CMD_PACKET;
1178

    
1179
        case 0x04: /* DVD disc manufacturing information */
1180
            /* Size of buffer, not including 2 byte size field */
1181
            cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1182

    
1183
            /* 2k data + 4 byte header */
1184
            return (2048 + 4);
1185

    
1186
        case 0xff:
1187
            /*
1188
             * This lists all the command capabilities above.  Add new ones
1189
             * in order and update the length and buffer return values.
1190
             */
1191

    
1192
            buf[4] = 0x00; /* Physical format */
1193
            buf[5] = 0x40; /* Not writable, is readable */
1194
            cpu_to_be16wu((uint16_t *)(buf + 6), 2048 + 4);
1195

    
1196
            buf[8] = 0x01; /* Copyright info */
1197
            buf[9] = 0x40; /* Not writable, is readable */
1198
            cpu_to_be16wu((uint16_t *)(buf + 10), 4 + 4);
1199

    
1200
            buf[12] = 0x03; /* BCA info */
1201
            buf[13] = 0x40; /* Not writable, is readable */
1202
            cpu_to_be16wu((uint16_t *)(buf + 14), 188 + 4);
1203

    
1204
            buf[16] = 0x04; /* Manufacturing info */
1205
            buf[17] = 0x40; /* Not writable, is readable */
1206
            cpu_to_be16wu((uint16_t *)(buf + 18), 2048 + 4);
1207

    
1208
            /* Size of buffer, not including 2 byte size field */
1209
            cpu_to_be16wu((uint16_t *)buf, 16 + 2);
1210

    
1211
            /* data written + 4 byte header */
1212
            return (16 + 4);
1213

    
1214
        default: /* TODO: formats beyond DVD-ROM requires */
1215
            return -ASC_INV_FIELD_IN_CMD_PACKET;
1216
    }
1217
}
1218

    
1219
static void ide_atapi_cmd(IDEState *s)
1220
{
1221
    const uint8_t *packet;
1222
    uint8_t *buf;
1223
    int max_len;
1224

    
1225
    packet = s->io_buffer;
1226
    buf = s->io_buffer;
1227
#ifdef DEBUG_IDE_ATAPI
1228
    {
1229
        int i;
1230
        printf("ATAPI limit=0x%x packet:", s->lcyl | (s->hcyl << 8));
1231
        for(i = 0; i < ATAPI_PACKET_SIZE; i++) {
1232
            printf(" %02x", packet[i]);
1233
        }
1234
        printf("\n");
1235
    }
1236
#endif
1237
    /* If there's a UNIT_ATTENTION condition pending, only
1238
       REQUEST_SENSE and INQUIRY commands are allowed to complete. */
1239
    if (s->sense_key == SENSE_UNIT_ATTENTION &&
1240
        s->io_buffer[0] != GPCMD_REQUEST_SENSE &&
1241
        s->io_buffer[0] != GPCMD_INQUIRY) {
1242
        ide_atapi_cmd_check_status(s);
1243
        return;
1244
    }
1245
    switch(s->io_buffer[0]) {
1246
    case GPCMD_TEST_UNIT_READY:
1247
        if (bdrv_is_inserted(s->bs) && !s->cdrom_changed) {
1248
            ide_atapi_cmd_ok(s);
1249
        } else {
1250
            s->cdrom_changed = 0;
1251
            ide_atapi_cmd_error(s, SENSE_NOT_READY,
1252
                                ASC_MEDIUM_NOT_PRESENT);
1253
        }
1254
        break;
1255
    case GPCMD_MODE_SENSE_6:
1256
    case GPCMD_MODE_SENSE_10:
1257
        {
1258
            int action, code;
1259
            if (packet[0] == GPCMD_MODE_SENSE_10)
1260
                max_len = ube16_to_cpu(packet + 7);
1261
            else
1262
                max_len = packet[4];
1263
            action = packet[2] >> 6;
1264
            code = packet[2] & 0x3f;
1265
            switch(action) {
1266
            case 0: /* current values */
1267
                switch(code) {
1268
                case GPMODE_R_W_ERROR_PAGE: /* error recovery */
1269
                    cpu_to_ube16(&buf[0], 16 + 6);
1270
                    buf[2] = 0x70;
1271
                    buf[3] = 0;
1272
                    buf[4] = 0;
1273
                    buf[5] = 0;
1274
                    buf[6] = 0;
1275
                    buf[7] = 0;
1276

    
1277
                    buf[8] = 0x01;
1278
                    buf[9] = 0x06;
1279
                    buf[10] = 0x00;
1280
                    buf[11] = 0x05;
1281
                    buf[12] = 0x00;
1282
                    buf[13] = 0x00;
1283
                    buf[14] = 0x00;
1284
                    buf[15] = 0x00;
1285
                    ide_atapi_cmd_reply(s, 16, max_len);
1286
                    break;
1287
                case GPMODE_AUDIO_CTL_PAGE:
1288
                    cpu_to_ube16(&buf[0], 24 + 6);
1289
                    buf[2] = 0x70;
1290
                    buf[3] = 0;
1291
                    buf[4] = 0;
1292
                    buf[5] = 0;
1293
                    buf[6] = 0;
1294
                    buf[7] = 0;
1295

    
1296
                    /* Fill with CDROM audio volume */
1297
                    buf[17] = 0;
1298
                    buf[19] = 0;
1299
                    buf[21] = 0;
1300
                    buf[23] = 0;
1301

    
1302
                    ide_atapi_cmd_reply(s, 24, max_len);
1303
                    break;
1304
                case GPMODE_CAPABILITIES_PAGE:
1305
                    cpu_to_ube16(&buf[0], 28 + 6);
1306
                    buf[2] = 0x70;
1307
                    buf[3] = 0;
1308
                    buf[4] = 0;
1309
                    buf[5] = 0;
1310
                    buf[6] = 0;
1311
                    buf[7] = 0;
1312

    
1313
                    buf[8] = 0x2a;
1314
                    buf[9] = 0x12;
1315
                    buf[10] = 0x00;
1316
                    buf[11] = 0x00;
1317

    
1318
                    /* Claim PLAY_AUDIO capability (0x01) since some Linux
1319
                       code checks for this to automount media. */
1320
                    buf[12] = 0x71;
1321
                    buf[13] = 3 << 5;
1322
                    buf[14] = (1 << 0) | (1 << 3) | (1 << 5);
1323
                    if (bdrv_is_locked(s->bs))
1324
                        buf[6] |= 1 << 1;
1325
                    buf[15] = 0x00;
1326
                    cpu_to_ube16(&buf[16], 706);
1327
                    buf[18] = 0;
1328
                    buf[19] = 2;
1329
                    cpu_to_ube16(&buf[20], 512);
1330
                    cpu_to_ube16(&buf[22], 706);
1331
                    buf[24] = 0;
1332
                    buf[25] = 0;
1333
                    buf[26] = 0;
1334
                    buf[27] = 0;
1335
                    ide_atapi_cmd_reply(s, 28, max_len);
1336
                    break;
1337
                default:
1338
                    goto error_cmd;
1339
                }
1340
                break;
1341
            case 1: /* changeable values */
1342
                goto error_cmd;
1343
            case 2: /* default values */
1344
                goto error_cmd;
1345
            default:
1346
            case 3: /* saved values */
1347
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1348
                                    ASC_SAVING_PARAMETERS_NOT_SUPPORTED);
1349
                break;
1350
            }
1351
        }
1352
        break;
1353
    case GPCMD_REQUEST_SENSE:
1354
        max_len = packet[4];
1355
        memset(buf, 0, 18);
1356
        buf[0] = 0x70 | (1 << 7);
1357
        buf[2] = s->sense_key;
1358
        buf[7] = 10;
1359
        buf[12] = s->asc;
1360
        if (s->sense_key == SENSE_UNIT_ATTENTION)
1361
            s->sense_key = SENSE_NONE;
1362
        ide_atapi_cmd_reply(s, 18, max_len);
1363
        break;
1364
    case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
1365
        if (bdrv_is_inserted(s->bs)) {
1366
            bdrv_set_locked(s->bs, packet[4] & 1);
1367
            ide_atapi_cmd_ok(s);
1368
        } else {
1369
            ide_atapi_cmd_error(s, SENSE_NOT_READY,
1370
                                ASC_MEDIUM_NOT_PRESENT);
1371
        }
1372
        break;
1373
    case GPCMD_READ_10:
1374
    case GPCMD_READ_12:
1375
        {
1376
            int nb_sectors, lba;
1377

    
1378
            if (packet[0] == GPCMD_READ_10)
1379
                nb_sectors = ube16_to_cpu(packet + 7);
1380
            else
1381
                nb_sectors = ube32_to_cpu(packet + 6);
1382
            lba = ube32_to_cpu(packet + 2);
1383
            if (nb_sectors == 0) {
1384
                ide_atapi_cmd_ok(s);
1385
                break;
1386
            }
1387
            ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1388
        }
1389
        break;
1390
    case GPCMD_READ_CD:
1391
        {
1392
            int nb_sectors, lba, transfer_request;
1393

    
1394
            nb_sectors = (packet[6] << 16) | (packet[7] << 8) | packet[8];
1395
            lba = ube32_to_cpu(packet + 2);
1396
            if (nb_sectors == 0) {
1397
                ide_atapi_cmd_ok(s);
1398
                break;
1399
            }
1400
            transfer_request = packet[9];
1401
            switch(transfer_request & 0xf8) {
1402
            case 0x00:
1403
                /* nothing */
1404
                ide_atapi_cmd_ok(s);
1405
                break;
1406
            case 0x10:
1407
                /* normal read */
1408
                ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1409
                break;
1410
            case 0xf8:
1411
                /* read all data */
1412
                ide_atapi_cmd_read(s, lba, nb_sectors, 2352);
1413
                break;
1414
            default:
1415
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1416
                                    ASC_INV_FIELD_IN_CMD_PACKET);
1417
                break;
1418
            }
1419
        }
1420
        break;
1421
    case GPCMD_SEEK:
1422
        {
1423
            unsigned int lba;
1424
            uint64_t total_sectors;
1425

    
1426
            bdrv_get_geometry(s->bs, &total_sectors);
1427
            total_sectors >>= 2;
1428
            if (total_sectors == 0) {
1429
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1430
                                    ASC_MEDIUM_NOT_PRESENT);
1431
                break;
1432
            }
1433
            lba = ube32_to_cpu(packet + 2);
1434
            if (lba >= total_sectors) {
1435
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1436
                                    ASC_LOGICAL_BLOCK_OOR);
1437
                break;
1438
            }
1439
            ide_atapi_cmd_ok(s);
1440
        }
1441
        break;
1442
    case GPCMD_START_STOP_UNIT:
1443
        {
1444
            int start, eject, err = 0;
1445
            start = packet[4] & 1;
1446
            eject = (packet[4] >> 1) & 1;
1447

    
1448
            if (eject) {
1449
                err = bdrv_eject(s->bs, !start);
1450
            }
1451

    
1452
            switch (err) {
1453
            case 0:
1454
                ide_atapi_cmd_ok(s);
1455
                break;
1456
            case -EBUSY:
1457
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1458
                                    ASC_MEDIA_REMOVAL_PREVENTED);
1459
                break;
1460
            default:
1461
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1462
                                    ASC_MEDIUM_NOT_PRESENT);
1463
                break;
1464
            }
1465
        }
1466
        break;
1467
    case GPCMD_MECHANISM_STATUS:
1468
        {
1469
            max_len = ube16_to_cpu(packet + 8);
1470
            cpu_to_ube16(buf, 0);
1471
            /* no current LBA */
1472
            buf[2] = 0;
1473
            buf[3] = 0;
1474
            buf[4] = 0;
1475
            buf[5] = 1;
1476
            cpu_to_ube16(buf + 6, 0);
1477
            ide_atapi_cmd_reply(s, 8, max_len);
1478
        }
1479
        break;
1480
    case GPCMD_READ_TOC_PMA_ATIP:
1481
        {
1482
            int format, msf, start_track, len;
1483
            uint64_t total_sectors;
1484

    
1485
            bdrv_get_geometry(s->bs, &total_sectors);
1486
            total_sectors >>= 2;
1487
            if (total_sectors == 0) {
1488
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1489
                                    ASC_MEDIUM_NOT_PRESENT);
1490
                break;
1491
            }
1492
            max_len = ube16_to_cpu(packet + 7);
1493
            format = packet[9] >> 6;
1494
            msf = (packet[1] >> 1) & 1;
1495
            start_track = packet[6];
1496
            switch(format) {
1497
            case 0:
1498
                len = cdrom_read_toc(total_sectors, buf, msf, start_track);
1499
                if (len < 0)
1500
                    goto error_cmd;
1501
                ide_atapi_cmd_reply(s, len, max_len);
1502
                break;
1503
            case 1:
1504
                /* multi session : only a single session defined */
1505
                memset(buf, 0, 12);
1506
                buf[1] = 0x0a;
1507
                buf[2] = 0x01;
1508
                buf[3] = 0x01;
1509
                ide_atapi_cmd_reply(s, 12, max_len);
1510
                break;
1511
            case 2:
1512
                len = cdrom_read_toc_raw(total_sectors, buf, msf, start_track);
1513
                if (len < 0)
1514
                    goto error_cmd;
1515
                ide_atapi_cmd_reply(s, len, max_len);
1516
                break;
1517
            default:
1518
            error_cmd:
1519
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1520
                                    ASC_INV_FIELD_IN_CMD_PACKET);
1521
                break;
1522
            }
1523
        }
1524
        break;
1525
    case GPCMD_READ_CDVD_CAPACITY:
1526
        {
1527
            uint64_t total_sectors;
1528

    
1529
            bdrv_get_geometry(s->bs, &total_sectors);
1530
            total_sectors >>= 2;
1531
            if (total_sectors == 0) {
1532
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1533
                                    ASC_MEDIUM_NOT_PRESENT);
1534
                break;
1535
            }
1536
            /* NOTE: it is really the number of sectors minus 1 */
1537
            cpu_to_ube32(buf, total_sectors - 1);
1538
            cpu_to_ube32(buf + 4, 2048);
1539
            ide_atapi_cmd_reply(s, 8, 8);
1540
        }
1541
        break;
1542
    case GPCMD_READ_DVD_STRUCTURE:
1543
        {
1544
            int media = packet[1];
1545
            int format = packet[7];
1546
            int ret;
1547

    
1548
            max_len = ube16_to_cpu(packet + 8);
1549

    
1550
            if (format < 0xff) {
1551
                if (media_is_cd(s)) {
1552
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1553
                                        ASC_INCOMPATIBLE_FORMAT);
1554
                    break;
1555
                } else if (!media_present(s)) {
1556
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1557
                                        ASC_INV_FIELD_IN_CMD_PACKET);
1558
                    break;
1559
                }
1560
            }
1561

    
1562
            memset(buf, 0, max_len > IDE_DMA_BUF_SECTORS * 512 + 4 ?
1563
                   IDE_DMA_BUF_SECTORS * 512 + 4 : max_len);
1564

    
1565
            switch (format) {
1566
                case 0x00 ... 0x7f:
1567
                case 0xff:
1568
                    if (media == 0) {
1569
                        ret = ide_dvd_read_structure(s, format, packet, buf);
1570

    
1571
                        if (ret < 0)
1572
                            ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST, -ret);
1573
                        else
1574
                            ide_atapi_cmd_reply(s, ret, max_len);
1575

    
1576
                        break;
1577
                    }
1578
                    /* TODO: BD support, fall through for now */
1579

    
1580
                /* Generic disk structures */
1581
                case 0x80: /* TODO: AACS volume identifier */
1582
                case 0x81: /* TODO: AACS media serial number */
1583
                case 0x82: /* TODO: AACS media identifier */
1584
                case 0x83: /* TODO: AACS media key block */
1585
                case 0x90: /* TODO: List of recognized format layers */
1586
                case 0xc0: /* TODO: Write protection status */
1587
                default:
1588
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1589
                                        ASC_INV_FIELD_IN_CMD_PACKET);
1590
                    break;
1591
            }
1592
        }
1593
        break;
1594
    case GPCMD_SET_SPEED:
1595
        ide_atapi_cmd_ok(s);
1596
        break;
1597
    case GPCMD_INQUIRY:
1598
        max_len = packet[4];
1599
        buf[0] = 0x05; /* CD-ROM */
1600
        buf[1] = 0x80; /* removable */
1601
        buf[2] = 0x00; /* ISO */
1602
        buf[3] = 0x21; /* ATAPI-2 (XXX: put ATAPI-4 ?) */
1603
        buf[4] = 31; /* additional length */
1604
        buf[5] = 0; /* reserved */
1605
        buf[6] = 0; /* reserved */
1606
        buf[7] = 0; /* reserved */
1607
        padstr8(buf + 8, 8, "QEMU");
1608
        padstr8(buf + 16, 16, "QEMU DVD-ROM");
1609
        padstr8(buf + 32, 4, s->version);
1610
        ide_atapi_cmd_reply(s, 36, max_len);
1611
        break;
1612
    case GPCMD_GET_CONFIGURATION:
1613
        {
1614
            uint32_t len;
1615
            uint8_t index = 0;
1616

    
1617
            /* only feature 0 is supported */
1618
            if (packet[2] != 0 || packet[3] != 0) {
1619
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1620
                                    ASC_INV_FIELD_IN_CMD_PACKET);
1621
                break;
1622
            }
1623

    
1624
            /* XXX: could result in alignment problems in some architectures */
1625
            max_len = ube16_to_cpu(packet + 7);
1626

    
1627
            /*
1628
             * XXX: avoid overflow for io_buffer if max_len is bigger than
1629
             *      the size of that buffer (dimensioned to max number of
1630
             *      sectors to transfer at once)
1631
             *
1632
             *      Only a problem if the feature/profiles grow.
1633
             */
1634
            if (max_len > 512) /* XXX: assume 1 sector */
1635
                max_len = 512;
1636

    
1637
            memset(buf, 0, max_len);
1638
            /* 
1639
             * the number of sectors from the media tells us which profile
1640
             * to use as current.  0 means there is no media
1641
             */
1642
            if (media_is_dvd(s))
1643
                cpu_to_ube16(buf + 6, MMC_PROFILE_DVD_ROM);
1644
            else if (media_is_cd(s))
1645
                cpu_to_ube16(buf + 6, MMC_PROFILE_CD_ROM);
1646

    
1647
            buf[10] = 0x02 | 0x01; /* persistent and current */
1648
            len = 12; /* headers: 8 + 4 */
1649
            len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_DVD_ROM);
1650
            len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_CD_ROM);
1651
            cpu_to_ube32(buf, len - 4); /* data length */
1652

    
1653
            ide_atapi_cmd_reply(s, len, max_len);
1654
            break;
1655
        }
1656
    case GPCMD_GET_EVENT_STATUS_NOTIFICATION:
1657
        max_len = ube16_to_cpu(packet + 7);
1658

    
1659
        if (packet[1] & 0x01) { /* polling */
1660
            /* We don't support any event class (yet). */
1661
            cpu_to_ube16(buf, 0x00); /* No event descriptor returned */
1662
            buf[2] = 0x80;           /* No Event Available (NEA) */
1663
            buf[3] = 0x00;           /* Empty supported event classes */
1664
            ide_atapi_cmd_reply(s, 4, max_len);
1665
        } else { /* asynchronous mode */
1666
            /* Only polling is supported, asynchronous mode is not. */
1667
            ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1668
                                ASC_INV_FIELD_IN_CMD_PACKET);
1669
        }
1670
        break;
1671
    default:
1672
        ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1673
                            ASC_ILLEGAL_OPCODE);
1674
        break;
1675
    }
1676
}
1677

    
1678
static void ide_cfata_metadata_inquiry(IDEState *s)
1679
{
1680
    uint16_t *p;
1681
    uint32_t spd;
1682

    
1683
    p = (uint16_t *) s->io_buffer;
1684
    memset(p, 0, 0x200);
1685
    spd = ((s->mdata_size - 1) >> 9) + 1;
1686

    
1687
    put_le16(p + 0, 0x0001);                        /* Data format revision */
1688
    put_le16(p + 1, 0x0000);                        /* Media property: silicon */
1689
    put_le16(p + 2, s->media_changed);                /* Media status */
1690
    put_le16(p + 3, s->mdata_size & 0xffff);        /* Capacity in bytes (low) */
1691
    put_le16(p + 4, s->mdata_size >> 16);        /* Capacity in bytes (high) */
1692
    put_le16(p + 5, spd & 0xffff);                /* Sectors per device (low) */
1693
    put_le16(p + 6, spd >> 16);                        /* Sectors per device (high) */
1694
}
1695

    
1696
static void ide_cfata_metadata_read(IDEState *s)
1697
{
1698
    uint16_t *p;
1699

    
1700
    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1701
        s->status = ERR_STAT;
1702
        s->error = ABRT_ERR;
1703
        return;
1704
    }
1705

    
1706
    p = (uint16_t *) s->io_buffer;
1707
    memset(p, 0, 0x200);
1708

    
1709
    put_le16(p + 0, s->media_changed);                /* Media status */
1710
    memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1711
                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1712
                                    s->nsector << 9), 0x200 - 2));
1713
}
1714

    
1715
static void ide_cfata_metadata_write(IDEState *s)
1716
{
1717
    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1718
        s->status = ERR_STAT;
1719
        s->error = ABRT_ERR;
1720
        return;
1721
    }
1722

    
1723
    s->media_changed = 0;
1724

    
1725
    memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1726
                    s->io_buffer + 2,
1727
                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1728
                                    s->nsector << 9), 0x200 - 2));
1729
}
1730

    
1731
/* called when the inserted state of the media has changed */
1732
static void cdrom_change_cb(void *opaque)
1733
{
1734
    IDEState *s = opaque;
1735
    uint64_t nb_sectors;
1736

    
1737
    bdrv_get_geometry(s->bs, &nb_sectors);
1738
    s->nb_sectors = nb_sectors;
1739

    
1740
    s->sense_key = SENSE_UNIT_ATTENTION;
1741
    s->asc = ASC_MEDIUM_MAY_HAVE_CHANGED;
1742
    s->cdrom_changed = 1;
1743
    ide_set_irq(s->bus);
1744
}
1745

    
1746
static void ide_cmd_lba48_transform(IDEState *s, int lba48)
1747
{
1748
    s->lba48 = lba48;
1749

    
1750
    /* handle the 'magic' 0 nsector count conversion here. to avoid
1751
     * fiddling with the rest of the read logic, we just store the
1752
     * full sector count in ->nsector and ignore ->hob_nsector from now
1753
     */
1754
    if (!s->lba48) {
1755
        if (!s->nsector)
1756
            s->nsector = 256;
1757
    } else {
1758
        if (!s->nsector && !s->hob_nsector)
1759
            s->nsector = 65536;
1760
        else {
1761
            int lo = s->nsector;
1762
            int hi = s->hob_nsector;
1763

    
1764
            s->nsector = (hi << 8) | lo;
1765
        }
1766
    }
1767
}
1768

    
1769
static void ide_clear_hob(IDEBus *bus)
1770
{
1771
    /* any write clears HOB high bit of device control register */
1772
    bus->ifs[0].select &= ~(1 << 7);
1773
    bus->ifs[1].select &= ~(1 << 7);
1774
}
1775

    
1776
void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1777
{
1778
    IDEBus *bus = opaque;
1779
    IDEState *s;
1780
    int n;
1781
    int lba48 = 0;
1782

    
1783
#ifdef DEBUG_IDE
1784
    printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
1785
#endif
1786

    
1787
    addr &= 7;
1788

    
1789
    /* ignore writes to command block while busy with previous command */
1790
    if (addr != 7 && (idebus_active_if(bus)->status & (BUSY_STAT|DRQ_STAT)))
1791
        return;
1792

    
1793
    switch(addr) {
1794
    case 0:
1795
        break;
1796
    case 1:
1797
        ide_clear_hob(bus);
1798
        /* NOTE: data is written to the two drives */
1799
        bus->ifs[0].hob_feature = bus->ifs[0].feature;
1800
        bus->ifs[1].hob_feature = bus->ifs[1].feature;
1801
        bus->ifs[0].feature = val;
1802
        bus->ifs[1].feature = val;
1803
        break;
1804
    case 2:
1805
        ide_clear_hob(bus);
1806
        bus->ifs[0].hob_nsector = bus->ifs[0].nsector;
1807
        bus->ifs[1].hob_nsector = bus->ifs[1].nsector;
1808
        bus->ifs[0].nsector = val;
1809
        bus->ifs[1].nsector = val;
1810
        break;
1811
    case 3:
1812
        ide_clear_hob(bus);
1813
        bus->ifs[0].hob_sector = bus->ifs[0].sector;
1814
        bus->ifs[1].hob_sector = bus->ifs[1].sector;
1815
        bus->ifs[0].sector = val;
1816
        bus->ifs[1].sector = val;
1817
        break;
1818
    case 4:
1819
        ide_clear_hob(bus);
1820
        bus->ifs[0].hob_lcyl = bus->ifs[0].lcyl;
1821
        bus->ifs[1].hob_lcyl = bus->ifs[1].lcyl;
1822
        bus->ifs[0].lcyl = val;
1823
        bus->ifs[1].lcyl = val;
1824
        break;
1825
    case 5:
1826
        ide_clear_hob(bus);
1827
        bus->ifs[0].hob_hcyl = bus->ifs[0].hcyl;
1828
        bus->ifs[1].hob_hcyl = bus->ifs[1].hcyl;
1829
        bus->ifs[0].hcyl = val;
1830
        bus->ifs[1].hcyl = val;
1831
        break;
1832
    case 6:
1833
        /* FIXME: HOB readback uses bit 7 */
1834
        bus->ifs[0].select = (val & ~0x10) | 0xa0;
1835
        bus->ifs[1].select = (val | 0x10) | 0xa0;
1836
        /* select drive */
1837
        bus->unit = (val >> 4) & 1;
1838
        break;
1839
    default:
1840
    case 7:
1841
        /* command */
1842
#if defined(DEBUG_IDE)
1843
        printf("ide: CMD=%02x\n", val);
1844
#endif
1845
        s = idebus_active_if(bus);
1846
        /* ignore commands to non existant slave */
1847
        if (s != bus->ifs && !s->bs)
1848
            break;
1849

    
1850
        /* Only DEVICE RESET is allowed while BSY or/and DRQ are set */
1851
        if ((s->status & (BUSY_STAT|DRQ_STAT)) && val != WIN_DEVICE_RESET)
1852
            break;
1853

    
1854
        switch(val) {
1855
        case WIN_IDENTIFY:
1856
            if (s->bs && s->drive_kind != IDE_CD) {
1857
                if (s->drive_kind != IDE_CFATA)
1858
                    ide_identify(s);
1859
                else
1860
                    ide_cfata_identify(s);
1861
                s->status = READY_STAT | SEEK_STAT;
1862
                ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1863
            } else {
1864
                if (s->drive_kind == IDE_CD) {
1865
                    ide_set_signature(s);
1866
                }
1867
                ide_abort_command(s);
1868
            }
1869
            ide_set_irq(s->bus);
1870
            break;
1871
        case WIN_SPECIFY:
1872
        case WIN_RECAL:
1873
            s->error = 0;
1874
            s->status = READY_STAT | SEEK_STAT;
1875
            ide_set_irq(s->bus);
1876
            break;
1877
        case WIN_SETMULT:
1878
            if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
1879
                /* Disable Read and Write Multiple */
1880
                s->mult_sectors = 0;
1881
                s->status = READY_STAT | SEEK_STAT;
1882
            } else if ((s->nsector & 0xff) != 0 &&
1883
                ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
1884
                 (s->nsector & (s->nsector - 1)) != 0)) {
1885
                ide_abort_command(s);
1886
            } else {
1887
                s->mult_sectors = s->nsector & 0xff;
1888
                s->status = READY_STAT | SEEK_STAT;
1889
            }
1890
            ide_set_irq(s->bus);
1891
            break;
1892
        case WIN_VERIFY_EXT:
1893
            lba48 = 1;
1894
        case WIN_VERIFY:
1895
        case WIN_VERIFY_ONCE:
1896
            /* do sector number check ? */
1897
            ide_cmd_lba48_transform(s, lba48);
1898
            s->status = READY_STAT | SEEK_STAT;
1899
            ide_set_irq(s->bus);
1900
            break;
1901
        case WIN_READ_EXT:
1902
            lba48 = 1;
1903
        case WIN_READ:
1904
        case WIN_READ_ONCE:
1905
            if (!s->bs)
1906
                goto abort_cmd;
1907
            ide_cmd_lba48_transform(s, lba48);
1908
            s->req_nb_sectors = 1;
1909
            ide_sector_read(s);
1910
            break;
1911
        case WIN_WRITE_EXT:
1912
            lba48 = 1;
1913
        case WIN_WRITE:
1914
        case WIN_WRITE_ONCE:
1915
        case CFA_WRITE_SECT_WO_ERASE:
1916
        case WIN_WRITE_VERIFY:
1917
            ide_cmd_lba48_transform(s, lba48);
1918
            s->error = 0;
1919
            s->status = SEEK_STAT | READY_STAT;
1920
            s->req_nb_sectors = 1;
1921
            ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
1922
            s->media_changed = 1;
1923
            break;
1924
        case WIN_MULTREAD_EXT:
1925
            lba48 = 1;
1926
        case WIN_MULTREAD:
1927
            if (!s->mult_sectors)
1928
                goto abort_cmd;
1929
            ide_cmd_lba48_transform(s, lba48);
1930
            s->req_nb_sectors = s->mult_sectors;
1931
            ide_sector_read(s);
1932
            break;
1933
        case WIN_MULTWRITE_EXT:
1934
            lba48 = 1;
1935
        case WIN_MULTWRITE:
1936
        case CFA_WRITE_MULTI_WO_ERASE:
1937
            if (!s->mult_sectors)
1938
                goto abort_cmd;
1939
            ide_cmd_lba48_transform(s, lba48);
1940
            s->error = 0;
1941
            s->status = SEEK_STAT | READY_STAT;
1942
            s->req_nb_sectors = s->mult_sectors;
1943
            n = s->nsector;
1944
            if (n > s->req_nb_sectors)
1945
                n = s->req_nb_sectors;
1946
            ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
1947
            s->media_changed = 1;
1948
            break;
1949
        case WIN_READDMA_EXT:
1950
            lba48 = 1;
1951
        case WIN_READDMA:
1952
        case WIN_READDMA_ONCE:
1953
            if (!s->bs)
1954
                goto abort_cmd;
1955
            ide_cmd_lba48_transform(s, lba48);
1956
            ide_sector_read_dma(s);
1957
            break;
1958
        case WIN_WRITEDMA_EXT:
1959
            lba48 = 1;
1960
        case WIN_WRITEDMA:
1961
        case WIN_WRITEDMA_ONCE:
1962
            if (!s->bs)
1963
                goto abort_cmd;
1964
            ide_cmd_lba48_transform(s, lba48);
1965
            ide_sector_write_dma(s);
1966
            s->media_changed = 1;
1967
            break;
1968
        case WIN_READ_NATIVE_MAX_EXT:
1969
            lba48 = 1;
1970
        case WIN_READ_NATIVE_MAX:
1971
            ide_cmd_lba48_transform(s, lba48);
1972
            ide_set_sector(s, s->nb_sectors - 1);
1973
            s->status = READY_STAT | SEEK_STAT;
1974
            ide_set_irq(s->bus);
1975
            break;
1976
        case WIN_CHECKPOWERMODE1:
1977
        case WIN_CHECKPOWERMODE2:
1978
            s->nsector = 0xff; /* device active or idle */
1979
            s->status = READY_STAT | SEEK_STAT;
1980
            ide_set_irq(s->bus);
1981
            break;
1982
        case WIN_SETFEATURES:
1983
            if (!s->bs)
1984
                goto abort_cmd;
1985
            /* XXX: valid for CDROM ? */
1986
            switch(s->feature) {
1987
            case 0xcc: /* reverting to power-on defaults enable */
1988
            case 0x66: /* reverting to power-on defaults disable */
1989
            case 0x02: /* write cache enable */
1990
            case 0x82: /* write cache disable */
1991
            case 0xaa: /* read look-ahead enable */
1992
            case 0x55: /* read look-ahead disable */
1993
            case 0x05: /* set advanced power management mode */
1994
            case 0x85: /* disable advanced power management mode */
1995
            case 0x69: /* NOP */
1996
            case 0x67: /* NOP */
1997
            case 0x96: /* NOP */
1998
            case 0x9a: /* NOP */
1999
            case 0x42: /* enable Automatic Acoustic Mode */
2000
            case 0xc2: /* disable Automatic Acoustic Mode */
2001
                s->status = READY_STAT | SEEK_STAT;
2002
                ide_set_irq(s->bus);
2003
                break;
2004
            case 0x03: { /* set transfer mode */
2005
                uint8_t val = s->nsector & 0x07;
2006
                uint16_t *identify_data = (uint16_t *)s->identify_data;
2007

    
2008
                switch (s->nsector >> 3) {
2009
                    case 0x00: /* pio default */
2010
                    case 0x01: /* pio mode */
2011
                        put_le16(identify_data + 62,0x07);
2012
                        put_le16(identify_data + 63,0x07);
2013
                        put_le16(identify_data + 88,0x3f);
2014
                        break;
2015
                    case 0x02: /* sigle word dma mode*/
2016
                        put_le16(identify_data + 62,0x07 | (1 << (val + 8)));
2017
                        put_le16(identify_data + 63,0x07);
2018
                        put_le16(identify_data + 88,0x3f);
2019
                        break;
2020
                    case 0x04: /* mdma mode */
2021
                        put_le16(identify_data + 62,0x07);
2022
                        put_le16(identify_data + 63,0x07 | (1 << (val + 8)));
2023
                        put_le16(identify_data + 88,0x3f);
2024
                        break;
2025
                    case 0x08: /* udma mode */
2026
                        put_le16(identify_data + 62,0x07);
2027
                        put_le16(identify_data + 63,0x07);
2028
                        put_le16(identify_data + 88,0x3f | (1 << (val + 8)));
2029
                        break;
2030
                    default:
2031
                        goto abort_cmd;
2032
                }
2033
                s->status = READY_STAT | SEEK_STAT;
2034
                ide_set_irq(s->bus);
2035
                break;
2036
            }
2037
            default:
2038
                goto abort_cmd;
2039
            }
2040
            break;
2041
        case WIN_FLUSH_CACHE:
2042
        case WIN_FLUSH_CACHE_EXT:
2043
            ide_flush_cache(s);
2044
            break;
2045
        case WIN_STANDBY:
2046
        case WIN_STANDBY2:
2047
        case WIN_STANDBYNOW1:
2048
        case WIN_STANDBYNOW2:
2049
        case WIN_IDLEIMMEDIATE:
2050
        case CFA_IDLEIMMEDIATE:
2051
        case WIN_SETIDLE1:
2052
        case WIN_SETIDLE2:
2053
        case WIN_SLEEPNOW1:
2054
        case WIN_SLEEPNOW2:
2055
            s->status = READY_STAT;
2056
            ide_set_irq(s->bus);
2057
            break;
2058
        case WIN_SEEK:
2059
            if(s->drive_kind == IDE_CD)
2060
                goto abort_cmd;
2061
            /* XXX: Check that seek is within bounds */
2062
            s->status = READY_STAT | SEEK_STAT;
2063
            ide_set_irq(s->bus);
2064
            break;
2065
            /* ATAPI commands */
2066
        case WIN_PIDENTIFY:
2067
            if (s->drive_kind == IDE_CD) {
2068
                ide_atapi_identify(s);
2069
                s->status = READY_STAT | SEEK_STAT;
2070
                ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
2071
            } else {
2072
                ide_abort_command(s);
2073
            }
2074
            ide_set_irq(s->bus);
2075
            break;
2076
        case WIN_DIAGNOSE:
2077
            ide_set_signature(s);
2078
            if (s->drive_kind == IDE_CD)
2079
                s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
2080
                                * devices to return a clear status register
2081
                                * with READY_STAT *not* set. */
2082
            else
2083
                s->status = READY_STAT | SEEK_STAT;
2084
            s->error = 0x01; /* Device 0 passed, Device 1 passed or not
2085
                              * present. 
2086
                              */
2087
            ide_set_irq(s->bus);
2088
            break;
2089
        case WIN_SRST:
2090
            if (s->drive_kind != IDE_CD)
2091
                goto abort_cmd;
2092
            ide_set_signature(s);
2093
            s->status = 0x00; /* NOTE: READY is _not_ set */
2094
            s->error = 0x01;
2095
            break;
2096
        case WIN_PACKETCMD:
2097
            if (s->drive_kind != IDE_CD)
2098
                goto abort_cmd;
2099
            /* overlapping commands not supported */
2100
            if (s->feature & 0x02)
2101
                goto abort_cmd;
2102
            s->status = READY_STAT | SEEK_STAT;
2103
            s->atapi_dma = s->feature & 1;
2104
            s->nsector = 1;
2105
            ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
2106
                               ide_atapi_cmd);
2107
            break;
2108
        /* CF-ATA commands */
2109
        case CFA_REQ_EXT_ERROR_CODE:
2110
            if (s->drive_kind != IDE_CFATA)
2111
                goto abort_cmd;
2112
            s->error = 0x09;    /* miscellaneous error */
2113
            s->status = READY_STAT | SEEK_STAT;
2114
            ide_set_irq(s->bus);
2115
            break;
2116
        case CFA_ERASE_SECTORS:
2117
        case CFA_WEAR_LEVEL:
2118
            if (s->drive_kind != IDE_CFATA)
2119
                goto abort_cmd;
2120
            if (val == CFA_WEAR_LEVEL)
2121
                s->nsector = 0;
2122
            if (val == CFA_ERASE_SECTORS)
2123
                s->media_changed = 1;
2124
            s->error = 0x00;
2125
            s->status = READY_STAT | SEEK_STAT;
2126
            ide_set_irq(s->bus);
2127
            break;
2128
        case CFA_TRANSLATE_SECTOR:
2129
            if (s->drive_kind != IDE_CFATA)
2130
                goto abort_cmd;
2131
            s->error = 0x00;
2132
            s->status = READY_STAT | SEEK_STAT;
2133
            memset(s->io_buffer, 0, 0x200);
2134
            s->io_buffer[0x00] = s->hcyl;                        /* Cyl MSB */
2135
            s->io_buffer[0x01] = s->lcyl;                        /* Cyl LSB */
2136
            s->io_buffer[0x02] = s->select;                        /* Head */
2137
            s->io_buffer[0x03] = s->sector;                        /* Sector */
2138
            s->io_buffer[0x04] = ide_get_sector(s) >> 16;        /* LBA MSB */
2139
            s->io_buffer[0x05] = ide_get_sector(s) >> 8;        /* LBA */
2140
            s->io_buffer[0x06] = ide_get_sector(s) >> 0;        /* LBA LSB */
2141
            s->io_buffer[0x13] = 0x00;                                /* Erase flag */
2142
            s->io_buffer[0x18] = 0x00;                                /* Hot count */
2143
            s->io_buffer[0x19] = 0x00;                                /* Hot count */
2144
            s->io_buffer[0x1a] = 0x01;                                /* Hot count */
2145
            ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2146
            ide_set_irq(s->bus);
2147
            break;
2148
        case CFA_ACCESS_METADATA_STORAGE:
2149
            if (s->drive_kind != IDE_CFATA)
2150
                goto abort_cmd;
2151
            switch (s->feature) {
2152
            case 0x02:        /* Inquiry Metadata Storage */
2153
                ide_cfata_metadata_inquiry(s);
2154
                break;
2155
            case 0x03:        /* Read Metadata Storage */
2156
                ide_cfata_metadata_read(s);
2157
                break;
2158
            case 0x04:        /* Write Metadata Storage */
2159
                ide_cfata_metadata_write(s);
2160
                break;
2161
            default:
2162
                goto abort_cmd;
2163
            }
2164
            ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2165
            s->status = 0x00; /* NOTE: READY is _not_ set */
2166
            ide_set_irq(s->bus);
2167
            break;
2168
        case IBM_SENSE_CONDITION:
2169
            if (s->drive_kind != IDE_CFATA)
2170
                goto abort_cmd;
2171
            switch (s->feature) {
2172
            case 0x01:  /* sense temperature in device */
2173
                s->nsector = 0x50;      /* +20 C */
2174
                break;
2175
            default:
2176
                goto abort_cmd;
2177
            }
2178
            s->status = READY_STAT | SEEK_STAT;
2179
            ide_set_irq(s->bus);
2180
            break;
2181

    
2182
        case WIN_SMART:
2183
            if (s->drive_kind == IDE_CD)
2184
                goto abort_cmd;
2185
            if (s->hcyl != 0xc2 || s->lcyl != 0x4f)
2186
                goto abort_cmd;
2187
            if (!s->smart_enabled && s->feature != SMART_ENABLE)
2188
                goto abort_cmd;
2189
            switch (s->feature) {
2190
            case SMART_DISABLE:
2191
                s->smart_enabled = 0;
2192
                s->status = READY_STAT | SEEK_STAT;
2193
                ide_set_irq(s->bus);
2194
                break;
2195
            case SMART_ENABLE:
2196
                s->smart_enabled = 1;
2197
                s->status = READY_STAT | SEEK_STAT;
2198
                ide_set_irq(s->bus);
2199
                break;
2200
            case SMART_ATTR_AUTOSAVE:
2201
                switch (s->sector) {
2202
                case 0x00:
2203
                    s->smart_autosave = 0;
2204
                    break;
2205
                case 0xf1:
2206
                    s->smart_autosave = 1;
2207
                    break;
2208
                default:
2209
                    goto abort_cmd;
2210
                }
2211
                s->status = READY_STAT | SEEK_STAT;
2212
                ide_set_irq(s->bus);
2213
                break;
2214
            case SMART_STATUS:
2215
                if (!s->smart_errors) {
2216
                    s->hcyl = 0xc2;
2217
                    s->lcyl = 0x4f;
2218
                } else {
2219
                    s->hcyl = 0x2c;
2220
                    s->lcyl = 0xf4;
2221
                }
2222
                s->status = READY_STAT | SEEK_STAT;
2223
                ide_set_irq(s->bus);
2224
                break;
2225
            case SMART_READ_THRESH:
2226
                memset(s->io_buffer, 0, 0x200);
2227
                s->io_buffer[0] = 0x01; /* smart struct version */
2228
                for (n=0; n<30; n++) {
2229
                    if (smart_attributes[n][0] == 0)
2230
                        break;
2231
                    s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
2232
                    s->io_buffer[2+1+(n*12)] = smart_attributes[n][4];
2233
                }
2234
                for (n=0; n<511; n++) /* checksum */
2235
                    s->io_buffer[511] += s->io_buffer[n];
2236
                s->io_buffer[511] = 0x100 - s->io_buffer[511];
2237
                s->status = READY_STAT | SEEK_STAT;
2238
                ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2239
                ide_set_irq(s->bus);
2240
                break;
2241
            case SMART_READ_DATA:
2242
                memset(s->io_buffer, 0, 0x200);
2243
                s->io_buffer[0] = 0x01; /* smart struct version */
2244
                for (n=0; n<30; n++) {
2245
                    if (smart_attributes[n][0] == 0)
2246
                        break;
2247
                    s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
2248
                    s->io_buffer[2+1+(n*12)] = smart_attributes[n][1];
2249
                    s->io_buffer[2+3+(n*12)] = smart_attributes[n][2];
2250
                    s->io_buffer[2+4+(n*12)] = smart_attributes[n][3];
2251
                }
2252
                s->io_buffer[362] = 0x02 | (s->smart_autosave?0x80:0x00);
2253
                if (s->smart_selftest_count == 0) {
2254
                    s->io_buffer[363] = 0;
2255
                } else {
2256
                    s->io_buffer[363] = 
2257
                        s->smart_selftest_data[3 + 
2258
                                               (s->smart_selftest_count - 1) * 
2259
                                               24];
2260
                }
2261
                s->io_buffer[364] = 0x20; 
2262
                s->io_buffer[365] = 0x01; 
2263
                /* offline data collection capacity: execute + self-test*/
2264
                s->io_buffer[367] = (1<<4 | 1<<3 | 1); 
2265
                s->io_buffer[368] = 0x03; /* smart capability (1) */
2266
                s->io_buffer[369] = 0x00; /* smart capability (2) */
2267
                s->io_buffer[370] = 0x01; /* error logging supported */
2268
                s->io_buffer[372] = 0x02; /* minutes for poll short test */
2269
                s->io_buffer[373] = 0x36; /* minutes for poll ext test */
2270
                s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
2271

    
2272
                for (n=0; n<511; n++) 
2273
                    s->io_buffer[511] += s->io_buffer[n];
2274
                s->io_buffer[511] = 0x100 - s->io_buffer[511];
2275
                s->status = READY_STAT | SEEK_STAT;
2276
                ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2277
                ide_set_irq(s->bus);
2278
                break;
2279
            case SMART_READ_LOG:
2280
                switch (s->sector) {
2281
                case 0x01: /* summary smart error log */
2282
                    memset(s->io_buffer, 0, 0x200);
2283
                    s->io_buffer[0] = 0x01;
2284
                    s->io_buffer[1] = 0x00; /* no error entries */
2285
                    s->io_buffer[452] = s->smart_errors & 0xff;
2286
                    s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
2287

    
2288
                    for (n=0; n<511; n++)
2289
                        s->io_buffer[511] += s->io_buffer[n];
2290
                    s->io_buffer[511] = 0x100 - s->io_buffer[511];
2291
                    break;
2292
                case 0x06: /* smart self test log */
2293
                    memset(s->io_buffer, 0, 0x200);
2294
                    s->io_buffer[0] = 0x01; 
2295
                    if (s->smart_selftest_count == 0) {
2296
                        s->io_buffer[508] = 0;
2297
                    } else {
2298
                        s->io_buffer[508] = s->smart_selftest_count;
2299
                        for (n=2; n<506; n++) 
2300
                            s->io_buffer[n] = s->smart_selftest_data[n];
2301
                    }                    
2302
                    for (n=0; n<511; n++)
2303
                        s->io_buffer[511] += s->io_buffer[n];
2304
                    s->io_buffer[511] = 0x100 - s->io_buffer[511];
2305
                    break;
2306
                default:
2307
                    goto abort_cmd;
2308
                }
2309
                s->status = READY_STAT | SEEK_STAT;
2310
                ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2311
                ide_set_irq(s->bus);
2312
                break;
2313
            case SMART_EXECUTE_OFFLINE:
2314
                switch (s->sector) {
2315
                case 0: /* off-line routine */
2316
                case 1: /* short self test */
2317
                case 2: /* extended self test */
2318
                    s->smart_selftest_count++;
2319
                    if(s->smart_selftest_count > 21)
2320
                        s->smart_selftest_count = 0;
2321
                    n = 2 + (s->smart_selftest_count - 1) * 24;
2322
                    s->smart_selftest_data[n] = s->sector;
2323
                    s->smart_selftest_data[n+1] = 0x00; /* OK and finished */
2324
                    s->smart_selftest_data[n+2] = 0x34; /* hour count lsb */
2325
                    s->smart_selftest_data[n+3] = 0x12; /* hour count msb */
2326
                    s->status = READY_STAT | SEEK_STAT;
2327
                    ide_set_irq(s->bus);
2328
                    break;
2329
                default:
2330
                    goto abort_cmd;
2331
                }
2332
                break;
2333
            default:
2334
                goto abort_cmd;
2335
            }
2336
            break;
2337
        default:
2338
        abort_cmd:
2339
            ide_abort_command(s);
2340
            ide_set_irq(s->bus);
2341
            break;
2342
        }
2343
    }
2344
}
2345

    
2346
uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
2347
{
2348
    IDEBus *bus = opaque;
2349
    IDEState *s = idebus_active_if(bus);
2350
    uint32_t addr;
2351
    int ret, hob;
2352

    
2353
    addr = addr1 & 7;
2354
    /* FIXME: HOB readback uses bit 7, but it's always set right now */
2355
    //hob = s->select & (1 << 7);
2356
    hob = 0;
2357
    switch(addr) {
2358
    case 0:
2359
        ret = 0xff;
2360
        break;
2361
    case 1:
2362
        if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
2363
            (s != bus->ifs && !s->bs))
2364
            ret = 0;
2365
        else if (!hob)
2366
            ret = s->error;
2367
        else
2368
            ret = s->hob_feature;
2369
        break;
2370
    case 2:
2371
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2372
            ret = 0;
2373
        else if (!hob)
2374
            ret = s->nsector & 0xff;
2375
        else
2376
            ret = s->hob_nsector;
2377
        break;
2378
    case 3:
2379
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2380
            ret = 0;
2381
        else if (!hob)
2382
            ret = s->sector;
2383
        else
2384
            ret = s->hob_sector;
2385
        break;
2386
    case 4:
2387
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2388
            ret = 0;
2389
        else if (!hob)
2390
            ret = s->lcyl;
2391
        else
2392
            ret = s->hob_lcyl;
2393
        break;
2394
    case 5:
2395
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2396
            ret = 0;
2397
        else if (!hob)
2398
            ret = s->hcyl;
2399
        else
2400
            ret = s->hob_hcyl;
2401
        break;
2402
    case 6:
2403
        if (!bus->ifs[0].bs && !bus->ifs[1].bs)
2404
            ret = 0;
2405
        else
2406
            ret = s->select;
2407
        break;
2408
    default:
2409
    case 7:
2410
        if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
2411
            (s != bus->ifs && !s->bs))
2412
            ret = 0;
2413
        else
2414
            ret = s->status;
2415
        qemu_irq_lower(bus->irq);
2416
        break;
2417
    }
2418
#ifdef DEBUG_IDE
2419
    printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
2420
#endif
2421
    return ret;
2422
}
2423

    
2424
uint32_t ide_status_read(void *opaque, uint32_t addr)
2425
{
2426
    IDEBus *bus = opaque;
2427
    IDEState *s = idebus_active_if(bus);
2428
    int ret;
2429

    
2430
    if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
2431
        (s != bus->ifs && !s->bs))
2432
        ret = 0;
2433
    else
2434
        ret = s->status;
2435
#ifdef DEBUG_IDE
2436
    printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
2437
#endif
2438
    return ret;
2439
}
2440

    
2441
void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
2442
{
2443
    IDEBus *bus = opaque;
2444
    IDEState *s;
2445
    int i;
2446

    
2447
#ifdef DEBUG_IDE
2448
    printf("ide: write control addr=0x%x val=%02x\n", addr, val);
2449
#endif
2450
    /* common for both drives */
2451
    if (!(bus->cmd & IDE_CMD_RESET) &&
2452
        (val & IDE_CMD_RESET)) {
2453
        /* reset low to high */
2454
        for(i = 0;i < 2; i++) {
2455
            s = &bus->ifs[i];
2456
            s->status = BUSY_STAT | SEEK_STAT;
2457
            s->error = 0x01;
2458
        }
2459
    } else if ((bus->cmd & IDE_CMD_RESET) &&
2460
               !(val & IDE_CMD_RESET)) {
2461
        /* high to low */
2462
        for(i = 0;i < 2; i++) {
2463
            s = &bus->ifs[i];
2464
            if (s->drive_kind == IDE_CD)
2465
                s->status = 0x00; /* NOTE: READY is _not_ set */
2466
            else
2467
                s->status = READY_STAT | SEEK_STAT;
2468
            ide_set_signature(s);
2469
        }
2470
    }
2471

    
2472
    bus->cmd = val;
2473
}
2474

    
2475
void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
2476
{
2477
    IDEBus *bus = opaque;
2478
    IDEState *s = idebus_active_if(bus);
2479
    uint8_t *p;
2480

    
2481
    /* PIO data access allowed only when DRQ bit is set */
2482
    if (!(s->status & DRQ_STAT))
2483
        return;
2484

    
2485
    p = s->data_ptr;
2486
    *(uint16_t *)p = le16_to_cpu(val);
2487
    p += 2;
2488
    s->data_ptr = p;
2489
    if (p >= s->data_end)
2490
        s->end_transfer_func(s);
2491
}
2492

    
2493
uint32_t ide_data_readw(void *opaque, uint32_t addr)
2494
{
2495
    IDEBus *bus = opaque;
2496
    IDEState *s = idebus_active_if(bus);
2497
    uint8_t *p;
2498
    int ret;
2499

    
2500
    /* PIO data access allowed only when DRQ bit is set */
2501
    if (!(s->status & DRQ_STAT))
2502
        return 0;
2503

    
2504
    p = s->data_ptr;
2505
    ret = cpu_to_le16(*(uint16_t *)p);
2506
    p += 2;
2507
    s->data_ptr = p;
2508
    if (p >= s->data_end)
2509
        s->end_transfer_func(s);
2510
    return ret;
2511
}
2512

    
2513
void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
2514
{
2515
    IDEBus *bus = opaque;
2516
    IDEState *s = idebus_active_if(bus);
2517
    uint8_t *p;
2518

    
2519
    /* PIO data access allowed only when DRQ bit is set */
2520
    if (!(s->status & DRQ_STAT))
2521
        return;
2522

    
2523
    p = s->data_ptr;
2524
    *(uint32_t *)p = le32_to_cpu(val);
2525
    p += 4;
2526
    s->data_ptr = p;
2527
    if (p >= s->data_end)
2528
        s->end_transfer_func(s);
2529
}
2530

    
2531
uint32_t ide_data_readl(void *opaque, uint32_t addr)
2532
{
2533
    IDEBus *bus = opaque;
2534
    IDEState *s = idebus_active_if(bus);
2535
    uint8_t *p;
2536
    int ret;
2537

    
2538
    /* PIO data access allowed only when DRQ bit is set */
2539
    if (!(s->status & DRQ_STAT))
2540
        return 0;
2541

    
2542
    p = s->data_ptr;
2543
    ret = cpu_to_le32(*(uint32_t *)p);
2544
    p += 4;
2545
    s->data_ptr = p;
2546
    if (p >= s->data_end)
2547
        s->end_transfer_func(s);
2548
    return ret;
2549
}
2550

    
2551
static void ide_dummy_transfer_stop(IDEState *s)
2552
{
2553
    s->data_ptr = s->io_buffer;
2554
    s->data_end = s->io_buffer;
2555
    s->io_buffer[0] = 0xff;
2556
    s->io_buffer[1] = 0xff;
2557
    s->io_buffer[2] = 0xff;
2558
    s->io_buffer[3] = 0xff;
2559
}
2560

    
2561
static void ide_reset(IDEState *s)
2562
{
2563
#ifdef DEBUG_IDE
2564
    printf("ide: reset\n");
2565
#endif
2566
    if (s->drive_kind == IDE_CFATA)
2567
        s->mult_sectors = 0;
2568
    else
2569
        s->mult_sectors = MAX_MULT_SECTORS;
2570
    /* ide regs */
2571
    s->feature = 0;
2572
    s->error = 0;
2573
    s->nsector = 0;
2574
    s->sector = 0;
2575
    s->lcyl = 0;
2576
    s->hcyl = 0;
2577

    
2578
    /* lba48 */
2579
    s->hob_feature = 0;
2580
    s->hob_sector = 0;
2581
    s->hob_nsector = 0;
2582
    s->hob_lcyl = 0;
2583
    s->hob_hcyl = 0;
2584

    
2585
    s->select = 0xa0;
2586
    s->status = READY_STAT | SEEK_STAT;
2587

    
2588
    s->lba48 = 0;
2589

    
2590
    /* ATAPI specific */
2591
    s->sense_key = 0;
2592
    s->asc = 0;
2593
    s->cdrom_changed = 0;
2594
    s->packet_transfer_size = 0;
2595
    s->elementary_transfer_size = 0;
2596
    s->io_buffer_index = 0;
2597
    s->cd_sector_size = 0;
2598
    s->atapi_dma = 0;
2599
    /* ATA DMA state */
2600
    s->io_buffer_size = 0;
2601
    s->req_nb_sectors = 0;
2602

    
2603
    ide_set_signature(s);
2604
    /* init the transfer handler so that 0xffff is returned on data
2605
       accesses */
2606
    s->end_transfer_func = ide_dummy_transfer_stop;
2607
    ide_dummy_transfer_stop(s);
2608
    s->media_changed = 0;
2609
}
2610

    
2611
void ide_bus_reset(IDEBus *bus)
2612
{
2613
    bus->unit = 0;
2614
    bus->cmd = 0;
2615
    ide_reset(&bus->ifs[0]);
2616
    ide_reset(&bus->ifs[1]);
2617
    ide_clear_hob(bus);
2618
}
2619

    
2620
int ide_init_drive(IDEState *s, BlockDriverState *bs,
2621
                   const char *version, const char *serial)
2622
{
2623
    int cylinders, heads, secs;
2624
    uint64_t nb_sectors;
2625

    
2626
    s->bs = bs;
2627
    bdrv_get_geometry(bs, &nb_sectors);
2628
    bdrv_guess_geometry(bs, &cylinders, &heads, &secs);
2629
    if (cylinders < 1 || cylinders > 16383) {
2630
        error_report("cyls must be between 1 and 16383");
2631
        return -1;
2632
    }
2633
    if (heads < 1 || heads > 16) {
2634
        error_report("heads must be between 1 and 16");
2635
        return -1;
2636
    }
2637
    if (secs < 1 || secs > 63) {
2638
        error_report("secs must be between 1 and 63");
2639
        return -1;
2640
    }
2641
    s->cylinders = cylinders;
2642
    s->heads = heads;
2643
    s->sectors = secs;
2644
    s->nb_sectors = nb_sectors;
2645
    /* The SMART values should be preserved across power cycles
2646
       but they aren't.  */
2647
    s->smart_enabled = 1;
2648
    s->smart_autosave = 1;
2649
    s->smart_errors = 0;
2650
    s->smart_selftest_count = 0;
2651
    if (bdrv_get_type_hint(bs) == BDRV_TYPE_CDROM) {
2652
        s->drive_kind = IDE_CD;
2653
        bdrv_set_change_cb(bs, cdrom_change_cb, s);
2654
        bs->buffer_alignment = 2048;
2655
    } else {
2656
        if (!bdrv_is_inserted(s->bs)) {
2657
            error_report("Device needs media, but drive is empty");
2658
            return -1;
2659
        }
2660
        if (bdrv_is_read_only(bs)) {
2661
            error_report("Can't use a read-only drive");
2662
            return -1;
2663
        }
2664
    }
2665
    if (serial) {
2666
        strncpy(s->drive_serial_str, serial, sizeof(s->drive_serial_str));
2667
    } else {
2668
        snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
2669
                 "QM%05d", s->drive_serial);
2670
    }
2671
    if (version) {
2672
        pstrcpy(s->version, sizeof(s->version), version);
2673
    } else {
2674
        pstrcpy(s->version, sizeof(s->version), QEMU_VERSION);
2675
    }
2676
    ide_reset(s);
2677
    bdrv_set_removable(bs, s->drive_kind == IDE_CD);
2678
    return 0;
2679
}
2680

    
2681
static void ide_init1(IDEBus *bus, int unit)
2682
{
2683
    static int drive_serial = 1;
2684
    IDEState *s = &bus->ifs[unit];
2685

    
2686
    s->bus = bus;
2687
    s->unit = unit;
2688
    s->drive_serial = drive_serial++;
2689
    /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */
2690
    s->io_buffer = qemu_memalign(2048, IDE_DMA_BUF_SECTORS*512 + 4);
2691
    s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;
2692
    s->smart_selftest_data = qemu_blockalign(s->bs, 512);
2693
    s->sector_write_timer = qemu_new_timer(vm_clock,
2694
                                           ide_sector_write_timer_cb, s);
2695
}
2696

    
2697
void ide_init2(IDEBus *bus, qemu_irq irq)
2698
{
2699
    int i;
2700

    
2701
    for(i = 0; i < 2; i++) {
2702
        ide_init1(bus, i);
2703
        ide_reset(&bus->ifs[i]);
2704
    }
2705
    bus->irq = irq;
2706
}
2707

    
2708
/* TODO convert users to qdev and remove */
2709
void ide_init2_with_non_qdev_drives(IDEBus *bus, DriveInfo *hd0,
2710
                                    DriveInfo *hd1, qemu_irq irq)
2711
{
2712
    int i;
2713
    DriveInfo *dinfo;
2714

    
2715
    for(i = 0; i < 2; i++) {
2716
        dinfo = i == 0 ? hd0 : hd1;
2717
        ide_init1(bus, i);
2718
        if (dinfo) {
2719
            if (ide_init_drive(&bus->ifs[i], dinfo->bdrv, NULL,
2720
                               *dinfo->serial ? dinfo->serial : NULL) < 0) {
2721
                error_report("Can't set up IDE drive %s", dinfo->id);
2722
                exit(1);
2723
            }
2724
        } else {
2725
            ide_reset(&bus->ifs[i]);
2726
        }
2727
    }
2728
    bus->irq = irq;
2729
}
2730

    
2731
void ide_init_ioport(IDEBus *bus, int iobase, int iobase2)
2732
{
2733
    register_ioport_write(iobase, 8, 1, ide_ioport_write, bus);
2734
    register_ioport_read(iobase, 8, 1, ide_ioport_read, bus);
2735
    if (iobase2) {
2736
        register_ioport_read(iobase2, 1, 1, ide_status_read, bus);
2737
        register_ioport_write(iobase2, 1, 1, ide_cmd_write, bus);
2738
    }
2739

    
2740
    /* data ports */
2741
    register_ioport_write(iobase, 2, 2, ide_data_writew, bus);
2742
    register_ioport_read(iobase, 2, 2, ide_data_readw, bus);
2743
    register_ioport_write(iobase, 4, 4, ide_data_writel, bus);
2744
    register_ioport_read(iobase, 4, 4, ide_data_readl, bus);
2745
}
2746

    
2747
static bool is_identify_set(void *opaque, int version_id)
2748
{
2749
    IDEState *s = opaque;
2750

    
2751
    return s->identify_set != 0;
2752
}
2753

    
2754
static EndTransferFunc* transfer_end_table[] = {
2755
        ide_sector_read,
2756
        ide_sector_write,
2757
        ide_transfer_stop,
2758
        ide_atapi_cmd_reply_end,
2759
        ide_atapi_cmd,
2760
        ide_dummy_transfer_stop,
2761
};
2762

    
2763
static int transfer_end_table_idx(EndTransferFunc *fn)
2764
{
2765
    int i;
2766

    
2767
    for (i = 0; i < ARRAY_SIZE(transfer_end_table); i++)
2768
        if (transfer_end_table[i] == fn)
2769
            return i;
2770

    
2771
    return -1;
2772
}
2773

    
2774
static int ide_drive_post_load(void *opaque, int version_id)
2775
{
2776
    IDEState *s = opaque;
2777

    
2778
    if (version_id < 3) {
2779
        if (s->sense_key == SENSE_UNIT_ATTENTION &&
2780
            s->asc == ASC_MEDIUM_MAY_HAVE_CHANGED) {
2781
            s->cdrom_changed = 1;
2782
        }
2783
    }
2784
    return 0;
2785
}
2786

    
2787
static int ide_drive_pio_post_load(void *opaque, int version_id)
2788
{
2789
    IDEState *s = opaque;
2790

    
2791
    if (s->end_transfer_fn_idx > ARRAY_SIZE(transfer_end_table)) {
2792
        return -EINVAL;
2793
    }
2794
    s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
2795
    s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
2796
    s->data_end = s->data_ptr + s->cur_io_buffer_len;
2797

    
2798
    return 0;
2799
}
2800

    
2801
static void ide_drive_pio_pre_save(void *opaque)
2802
{
2803
    IDEState *s = opaque;
2804
    int idx;
2805

    
2806
    s->cur_io_buffer_offset = s->data_ptr - s->io_buffer;
2807
    s->cur_io_buffer_len = s->data_end - s->data_ptr;
2808

    
2809
    idx = transfer_end_table_idx(s->end_transfer_func);
2810
    if (idx == -1) {
2811
        fprintf(stderr, "%s: invalid end_transfer_func for DRQ_STAT\n",
2812
                        __func__);
2813
        s->end_transfer_fn_idx = 2;
2814
    } else {
2815
        s->end_transfer_fn_idx = idx;
2816
    }
2817
}
2818

    
2819
static bool ide_drive_pio_state_needed(void *opaque)
2820
{
2821
    IDEState *s = opaque;
2822

    
2823
    return (s->status & DRQ_STAT) != 0;
2824
}
2825

    
2826
const VMStateDescription vmstate_ide_drive_pio_state = {
2827
    .name = "ide_drive/pio_state",
2828
    .version_id = 1,
2829
    .minimum_version_id = 1,
2830
    .minimum_version_id_old = 1,
2831
    .pre_save = ide_drive_pio_pre_save,
2832
    .post_load = ide_drive_pio_post_load,
2833
    .fields      = (VMStateField []) {
2834
        VMSTATE_INT32(req_nb_sectors, IDEState),
2835
        VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1,
2836
                             vmstate_info_uint8, uint8_t),
2837
        VMSTATE_INT32(cur_io_buffer_offset, IDEState),
2838
        VMSTATE_INT32(cur_io_buffer_len, IDEState),
2839
        VMSTATE_UINT8(end_transfer_fn_idx, IDEState),
2840
        VMSTATE_INT32(elementary_transfer_size, IDEState),
2841
        VMSTATE_INT32(packet_transfer_size, IDEState),
2842
        VMSTATE_END_OF_LIST()
2843
    }
2844
};
2845

    
2846
const VMStateDescription vmstate_ide_drive = {
2847
    .name = "ide_drive",
2848
    .version_id = 3,
2849
    .minimum_version_id = 0,
2850
    .minimum_version_id_old = 0,
2851
    .post_load = ide_drive_post_load,
2852
    .fields      = (VMStateField []) {
2853
        VMSTATE_INT32(mult_sectors, IDEState),
2854
        VMSTATE_INT32(identify_set, IDEState),
2855
        VMSTATE_BUFFER_TEST(identify_data, IDEState, is_identify_set),
2856
        VMSTATE_UINT8(feature, IDEState),
2857
        VMSTATE_UINT8(error, IDEState),
2858
        VMSTATE_UINT32(nsector, IDEState),
2859
        VMSTATE_UINT8(sector, IDEState),
2860
        VMSTATE_UINT8(lcyl, IDEState),
2861
        VMSTATE_UINT8(hcyl, IDEState),
2862
        VMSTATE_UINT8(hob_feature, IDEState),
2863
        VMSTATE_UINT8(hob_sector, IDEState),
2864
        VMSTATE_UINT8(hob_nsector, IDEState),
2865
        VMSTATE_UINT8(hob_lcyl, IDEState),
2866
        VMSTATE_UINT8(hob_hcyl, IDEState),
2867
        VMSTATE_UINT8(select, IDEState),
2868
        VMSTATE_UINT8(status, IDEState),
2869
        VMSTATE_UINT8(lba48, IDEState),
2870
        VMSTATE_UINT8(sense_key, IDEState),
2871
        VMSTATE_UINT8(asc, IDEState),
2872
        VMSTATE_UINT8_V(cdrom_changed, IDEState, 3),
2873
        VMSTATE_END_OF_LIST()
2874
    },
2875
    .subsections = (VMStateSubsection []) {
2876
        {
2877
            .vmsd = &vmstate_ide_drive_pio_state,
2878
            .needed = ide_drive_pio_state_needed,
2879
        }, {
2880
            /* empty */
2881
        }
2882
    }
2883
};
2884

    
2885
const VMStateDescription vmstate_ide_bus = {
2886
    .name = "ide_bus",
2887
    .version_id = 1,
2888
    .minimum_version_id = 1,
2889
    .minimum_version_id_old = 1,
2890
    .fields      = (VMStateField []) {
2891
        VMSTATE_UINT8(cmd, IDEBus),
2892
        VMSTATE_UINT8(unit, IDEBus),
2893
        VMSTATE_END_OF_LIST()
2894
    }
2895
};
2896

    
2897
/***********************************************************/
2898
/* PCI IDE definitions */
2899

    
2900
static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb)
2901
{
2902
    BMDMAState *bm = s->bus->bmdma;
2903
    if(!bm)
2904
        return;
2905
    bm->unit = s->unit;
2906
    bm->dma_cb = dma_cb;
2907
    bm->cur_prd_last = 0;
2908
    bm->cur_prd_addr = 0;
2909
    bm->cur_prd_len = 0;
2910
    bm->sector_num = ide_get_sector(s);
2911
    bm->nsector = s->nsector;
2912
    if (bm->status & BM_STATUS_DMAING) {
2913
        bm->dma_cb(bm, 0);
2914
    }
2915
}
2916

    
2917
static void ide_dma_restart(IDEState *s, int is_read)
2918
{
2919
    BMDMAState *bm = s->bus->bmdma;
2920
    ide_set_sector(s, bm->sector_num);
2921
    s->io_buffer_index = 0;
2922
    s->io_buffer_size = 0;
2923
    s->nsector = bm->nsector;
2924
    bm->cur_addr = bm->addr;
2925

    
2926
    if (is_read) {
2927
        bm->dma_cb = ide_read_dma_cb;
2928
    } else {
2929
        bm->dma_cb = ide_write_dma_cb;
2930
    }
2931

    
2932
    ide_dma_start(s, bm->dma_cb);
2933
}
2934

    
2935
void ide_dma_cancel(BMDMAState *bm)
2936
{
2937
    if (bm->status & BM_STATUS_DMAING) {
2938
        if (bm->aiocb) {
2939
#ifdef DEBUG_AIO
2940
            printf("aio_cancel\n");
2941
#endif
2942
            bdrv_aio_cancel(bm->aiocb);
2943
            bm->aiocb = NULL;
2944
        }
2945
        bm->status &= ~BM_STATUS_DMAING;
2946
        /* cancel DMA request */
2947
        bm->unit = -1;
2948
        bm->dma_cb = NULL;
2949
    }
2950
}
2951

    
2952
void ide_dma_reset(BMDMAState *bm)
2953
{
2954
#ifdef DEBUG_IDE
2955
    printf("ide: dma_reset\n");
2956
#endif
2957
    ide_dma_cancel(bm);
2958
    bm->cmd = 0;
2959
    bm->status = 0;
2960
    bm->addr = 0;
2961
    bm->cur_addr = 0;
2962
    bm->cur_prd_last = 0;
2963
    bm->cur_prd_addr = 0;
2964
    bm->cur_prd_len = 0;
2965
    bm->sector_num = 0;
2966
    bm->nsector = 0;
2967
}