Archipelago » qemu

/*

 * QEMU IDE disk and CD/DVD-ROM Emulator

 *

 * Copyright (c) 2003 Fabrice Bellard

 * Copyright (c) 2006 Openedhand Ltd.

 *

 * Permission is hereby granted, free of charge, to any person obtaining a copy

 * of this software and associated documentation files (the "Software"), to deal

 * in the Software without restriction, including without limitation the rights

 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

 * copies of the Software, and to permit persons to whom the Software is

 * furnished to do so, subject to the following conditions:

 *

 * The above copyright notice and this permission notice shall be included in

 * all copies or substantial portions of the Software.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

 * THE SOFTWARE.

 */

#include <hw/hw.h>

#include <hw/pc.h>

#include <hw/pci.h>

#include <hw/isa.h>

#include "qemu-error.h"

#include "qemu-timer.h"

#include "sysemu.h"

#include "dma.h"

#include "hw/block-common.h"

#include "blockdev.h"

#include <hw/ide/internal.h>

/* These values were based on a Seagate ST3500418AS but have been modified

   to make more sense in QEMU */

static const int smart_attributes[][12] = {

    /* id,  flags, hflags, val, wrst, raw (6 bytes), threshold */

    /* raw read error rate*/

    { 0x01, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06},

    /* spin up */

    { 0x03, 0x03, 0x00, 0x64, 0x64, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},

    /* start stop count */

    { 0x04, 0x02, 0x00, 0x64, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14},

    /* remapped sectors */

    { 0x05, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24},

    /* power on hours */

    { 0x09, 0x03, 0x00, 0x64, 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},

    /* power cycle count */

    { 0x0c, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},

    /* airflow-temperature-celsius */

    { 190,  0x03, 0x00, 0x45, 0x45, 0x1f, 0x00, 0x1f, 0x1f, 0x00, 0x00, 0x32},

    /* end of list */

    { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}

};

static int ide_handle_rw_error(IDEState *s, int error, int op);

static void ide_dummy_transfer_stop(IDEState *s);

static void padstr(char *str, const char *src, int len)

{

    int i, v;

    for(i = 0; i < len; i++) {

        if (*src)

            v = *src++;

        else

            v = ' ';

        str[i^1] = v;

    }

}

static void put_le16(uint16_t *p, unsigned int v)

{

    *p = cpu_to_le16(v);

}

static void ide_identify(IDEState *s)

{

    uint16_t *p;

    unsigned int oldsize;

    IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;

    if (s->identify_set) {

        memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));

        return;

    }

    memset(s->io_buffer, 0, 512);

    p = (uint16_t *)s->io_buffer;

    put_le16(p + 0, 0x0040);

    put_le16(p + 1, s->cylinders);

    put_le16(p + 3, s->heads);

    put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */

    put_le16(p + 5, 512); /* XXX: retired, remove ? */

    put_le16(p + 6, s->sectors);

    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */

    put_le16(p + 20, 3); /* XXX: retired, remove ? */

    put_le16(p + 21, 512); /* cache size in sectors */

    put_le16(p + 22, 4); /* ecc bytes */

    padstr((char *)(p + 23), s->version, 8); /* firmware version */

    padstr((char *)(p + 27), s->drive_model_str, 40); /* model */

#if MAX_MULT_SECTORS > 1

    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);

#endif

    put_le16(p + 48, 1); /* dword I/O */

    put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */

    put_le16(p + 51, 0x200); /* PIO transfer cycle */

    put_le16(p + 52, 0x200); /* DMA transfer cycle */

    put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */

    put_le16(p + 54, s->cylinders);

    put_le16(p + 55, s->heads);

    put_le16(p + 56, s->sectors);

    oldsize = s->cylinders * s->heads * s->sectors;

    put_le16(p + 57, oldsize);

    put_le16(p + 58, oldsize >> 16);

    if (s->mult_sectors)

        put_le16(p + 59, 0x100 | s->mult_sectors);

    put_le16(p + 60, s->nb_sectors);

    put_le16(p + 61, s->nb_sectors >> 16);

    put_le16(p + 62, 0x07); /* single word dma0-2 supported */

    put_le16(p + 63, 0x07); /* mdma0-2 supported */

    put_le16(p + 64, 0x03); /* pio3-4 supported */

    put_le16(p + 65, 120);

    put_le16(p + 66, 120);

    put_le16(p + 67, 120);

    put_le16(p + 68, 120);

    if (dev && dev->conf.discard_granularity) {

        put_le16(p + 69, (1 << 14)); /* determinate TRIM behavior */

    }

    if (s->ncq_queues) {

        put_le16(p + 75, s->ncq_queues - 1);

        /* NCQ supported */

        put_le16(p + 76, (1 << 8));

    }

    put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */

    put_le16(p + 81, 0x16); /* conforms to ata5 */

    /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */

    put_le16(p + 82, (1 << 14) | (1 << 5) | 1);

    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */

    put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));

    /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */

    if (s->wwn) {

        put_le16(p + 84, (1 << 14) | (1 << 8) | 0);

    } else {

        put_le16(p + 84, (1 << 14) | 0);

    }

    /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */

    if (bdrv_enable_write_cache(s->bs))

         put_le16(p + 85, (1 << 14) | (1 << 5) | 1);

    else

         put_le16(p + 85, (1 << 14) | 1);

    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */

    put_le16(p + 86, (1 << 13) | (1 <<12) | (1 << 10));

    /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */

    if (s->wwn) {

        put_le16(p + 87, (1 << 14) | (1 << 8) | 0);

    } else {

        put_le16(p + 87, (1 << 14) | 0);

    }

    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */

    put_le16(p + 93, 1 | (1 << 14) | 0x2000);

    put_le16(p + 100, s->nb_sectors);

    put_le16(p + 101, s->nb_sectors >> 16);

    put_le16(p + 102, s->nb_sectors >> 32);

    put_le16(p + 103, s->nb_sectors >> 48);

    if (dev && dev->conf.physical_block_size)

        put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));

    if (s->wwn) {

        /* LE 16-bit words 111-108 contain 64-bit World Wide Name */

        put_le16(p + 108, s->wwn >> 48);

        put_le16(p + 109, s->wwn >> 32);

        put_le16(p + 110, s->wwn >> 16);

        put_le16(p + 111, s->wwn);

    }

    if (dev && dev->conf.discard_granularity) {

        put_le16(p + 169, 1); /* TRIM support */

    }

    memcpy(s->identify_data, p, sizeof(s->identify_data));

    s->identify_set = 1;

}

static void ide_atapi_identify(IDEState *s)

{

    uint16_t *p;

    if (s->identify_set) {

        memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));

        return;

    }

    memset(s->io_buffer, 0, 512);

    p = (uint16_t *)s->io_buffer;

    /* Removable CDROM, 50us response, 12 byte packets */

    put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));

    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */

    put_le16(p + 20, 3); /* buffer type */

    put_le16(p + 21, 512); /* cache size in sectors */

    put_le16(p + 22, 4); /* ecc bytes */

    padstr((char *)(p + 23), s->version, 8); /* firmware version */

    padstr((char *)(p + 27), s->drive_model_str, 40); /* model */

    put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */

#ifdef USE_DMA_CDROM

    put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */

    put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */

    put_le16(p + 62, 7);  /* single word dma0-2 supported */

    put_le16(p + 63, 7);  /* mdma0-2 supported */

#else

    put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */

    put_le16(p + 53, 3); /* words 64-70, 54-58 valid */

    put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */

#endif

    put_le16(p + 64, 3); /* pio3-4 supported */

    put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */

    put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */

    put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */

    put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */

    put_le16(p + 71, 30); /* in ns */

    put_le16(p + 72, 30); /* in ns */

    if (s->ncq_queues) {

        put_le16(p + 75, s->ncq_queues - 1);

        /* NCQ supported */

        put_le16(p + 76, (1 << 8));

    }

    put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */

#ifdef USE_DMA_CDROM

    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */

#endif

    memcpy(s->identify_data, p, sizeof(s->identify_data));

    s->identify_set = 1;

}

static void ide_cfata_identify(IDEState *s)

{

    uint16_t *p;

    uint32_t cur_sec;

    p = (uint16_t *) s->identify_data;

    if (s->identify_set)

        goto fill_buffer;

    memset(p, 0, sizeof(s->identify_data));

    cur_sec = s->cylinders * s->heads * s->sectors;

    put_le16(p + 0, 0x848a);                        /* CF Storage Card signature */

    put_le16(p + 1, s->cylinders);                /* Default cylinders */

    put_le16(p + 3, s->heads);                        /* Default heads */

    put_le16(p + 6, s->sectors);                /* Default sectors per track */

    put_le16(p + 7, s->nb_sectors >> 16);        /* Sectors per card */

    put_le16(p + 8, s->nb_sectors);                /* Sectors per card */

    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */

    put_le16(p + 22, 0x0004);                        /* ECC bytes */

    padstr((char *) (p + 23), s->version, 8);        /* Firmware Revision */

    padstr((char *) (p + 27), s->drive_model_str, 40);/* Model number */

#if MAX_MULT_SECTORS > 1

    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);

#else

    put_le16(p + 47, 0x0000);

#endif

    put_le16(p + 49, 0x0f00);                        /* Capabilities */

    put_le16(p + 51, 0x0002);                        /* PIO cycle timing mode */

    put_le16(p + 52, 0x0001);                        /* DMA cycle timing mode */

    put_le16(p + 53, 0x0003);                        /* Translation params valid */

    put_le16(p + 54, s->cylinders);                /* Current cylinders */

    put_le16(p + 55, s->heads);                        /* Current heads */

    put_le16(p + 56, s->sectors);                /* Current sectors */

    put_le16(p + 57, cur_sec);                        /* Current capacity */

    put_le16(p + 58, cur_sec >> 16);                /* Current capacity */

    if (s->mult_sectors)                        /* Multiple sector setting */

        put_le16(p + 59, 0x100 | s->mult_sectors);

    put_le16(p + 60, s->nb_sectors);                /* Total LBA sectors */

    put_le16(p + 61, s->nb_sectors >> 16);        /* Total LBA sectors */

    put_le16(p + 63, 0x0203);                        /* Multiword DMA capability */

    put_le16(p + 64, 0x0001);                        /* Flow Control PIO support */

    put_le16(p + 65, 0x0096);                        /* Min. Multiword DMA cycle */

    put_le16(p + 66, 0x0096);                        /* Rec. Multiword DMA cycle */

    put_le16(p + 68, 0x00b4);                        /* Min. PIO cycle time */

    put_le16(p + 82, 0x400c);                        /* Command Set supported */

    put_le16(p + 83, 0x7068);                        /* Command Set supported */

    put_le16(p + 84, 0x4000);                        /* Features supported */

    put_le16(p + 85, 0x000c);                        /* Command Set enabled */

    put_le16(p + 86, 0x7044);                        /* Command Set enabled */

    put_le16(p + 87, 0x4000);                        /* Features enabled */

    put_le16(p + 91, 0x4060);                        /* Current APM level */

    put_le16(p + 129, 0x0002);                        /* Current features option */

    put_le16(p + 130, 0x0005);                        /* Reassigned sectors */

    put_le16(p + 131, 0x0001);                        /* Initial power mode */

    put_le16(p + 132, 0x0000);                        /* User signature */

    put_le16(p + 160, 0x8100);                        /* Power requirement */

    put_le16(p + 161, 0x8001);                        /* CF command set */

    s->identify_set = 1;

fill_buffer:

    memcpy(s->io_buffer, p, sizeof(s->identify_data));

}

static void ide_set_signature(IDEState *s)

{

    s->select &= 0xf0; /* clear head */

    /* put signature */

    s->nsector = 1;

    s->sector = 1;

    if (s->drive_kind == IDE_CD) {

        s->lcyl = 0x14;

        s->hcyl = 0xeb;

    } else if (s->bs) {

        s->lcyl = 0;

        s->hcyl = 0;

    } else {

        s->lcyl = 0xff;

        s->hcyl = 0xff;

    }

}

typedef struct TrimAIOCB {

    BlockDriverAIOCB common;

    QEMUBH *bh;

    int ret;

} TrimAIOCB;

static void trim_aio_cancel(BlockDriverAIOCB *acb)

{

    TrimAIOCB *iocb = container_of(acb, TrimAIOCB, common);

    qemu_bh_delete(iocb->bh);

    iocb->bh = NULL;

    qemu_aio_release(iocb);

}

static AIOPool trim_aio_pool = {

    .aiocb_size         = sizeof(TrimAIOCB),

    .cancel             = trim_aio_cancel,

};

static void ide_trim_bh_cb(void *opaque)

{

    TrimAIOCB *iocb = opaque;

    iocb->common.cb(iocb->common.opaque, iocb->ret);

    qemu_bh_delete(iocb->bh);

    iocb->bh = NULL;

    qemu_aio_release(iocb);

}

BlockDriverAIOCB *ide_issue_trim(BlockDriverState *bs,

        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,

        BlockDriverCompletionFunc *cb, void *opaque)

{

    TrimAIOCB *iocb;

    int i, j, ret;

    iocb = qemu_aio_get(&trim_aio_pool, bs, cb, opaque);

    iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);

    iocb->ret = 0;

    for (j = 0; j < qiov->niov; j++) {

        uint64_t *buffer = qiov->iov[j].iov_base;

        for (i = 0; i < qiov->iov[j].iov_len / 8; i++) {

            /* 6-byte LBA + 2-byte range per entry */

            uint64_t entry = le64_to_cpu(buffer[i]);

            uint64_t sector = entry & 0x0000ffffffffffffULL;

            uint16_t count = entry >> 48;

            if (count == 0) {

                break;

            }

            ret = bdrv_discard(bs, sector, count);

            if (!iocb->ret) {

                iocb->ret = ret;

            }

        }

    }

    qemu_bh_schedule(iocb->bh);

    return &iocb->common;

}

static inline void ide_abort_command(IDEState *s)

{

    s->status = READY_STAT | ERR_STAT;

    s->error = ABRT_ERR;

}

/* prepare data transfer and tell what to do after */

void ide_transfer_start(IDEState *s, uint8_t *buf, int size,

                        EndTransferFunc *end_transfer_func)

{

    s->end_transfer_func = end_transfer_func;

    s->data_ptr = buf;

    s->data_end = buf + size;

    if (!(s->status & ERR_STAT)) {

        s->status |= DRQ_STAT;

    }

    s->bus->dma->ops->start_transfer(s->bus->dma);

}

void ide_transfer_stop(IDEState *s)

{

    s->end_transfer_func = ide_transfer_stop;

    s->data_ptr = s->io_buffer;

    s->data_end = s->io_buffer;

    s->status &= ~DRQ_STAT;

}

int64_t ide_get_sector(IDEState *s)

{

    int64_t sector_num;

    if (s->select & 0x40) {

        /* lba */

        if (!s->lba48) {

            sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |

                (s->lcyl << 8) | s->sector;

        } else {

            sector_num = ((int64_t)s->hob_hcyl << 40) |

                ((int64_t) s->hob_lcyl << 32) |

                ((int64_t) s->hob_sector << 24) |

                ((int64_t) s->hcyl << 16) |

                ((int64_t) s->lcyl << 8) | s->sector;

        }

    } else {

        sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +

            (s->select & 0x0f) * s->sectors + (s->sector - 1);

    }

    return sector_num;

}

void ide_set_sector(IDEState *s, int64_t sector_num)

{

    unsigned int cyl, r;

    if (s->select & 0x40) {

        if (!s->lba48) {

            s->select = (s->select & 0xf0) | (sector_num >> 24);

            s->hcyl = (sector_num >> 16);

            s->lcyl = (sector_num >> 8);

            s->sector = (sector_num);

        } else {

            s->sector = sector_num;

            s->lcyl = sector_num >> 8;

            s->hcyl = sector_num >> 16;

            s->hob_sector = sector_num >> 24;

            s->hob_lcyl = sector_num >> 32;

            s->hob_hcyl = sector_num >> 40;

        }

    } else {

        cyl = sector_num / (s->heads * s->sectors);

        r = sector_num % (s->heads * s->sectors);

        s->hcyl = cyl >> 8;

        s->lcyl = cyl;

        s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);

        s->sector = (r % s->sectors) + 1;

    }

}

static void ide_rw_error(IDEState *s) {

    ide_abort_command(s);

    ide_set_irq(s->bus);

}

static void ide_sector_read_cb(void *opaque, int ret)

{

    IDEState *s = opaque;

    int n;

    s->pio_aiocb = NULL;

    s->status &= ~BUSY_STAT;

    bdrv_acct_done(s->bs, &s->acct);

    if (ret != 0) {

        if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY |

                                BM_STATUS_RETRY_READ)) {

            return;

        }

    }

    n = s->nsector;

    if (n > s->req_nb_sectors) {

        n = s->req_nb_sectors;

    }

    /* Allow the guest to read the io_buffer */

    ide_transfer_start(s, s->io_buffer, n * BDRV_SECTOR_SIZE, ide_sector_read);

    ide_set_irq(s->bus);

    ide_set_sector(s, ide_get_sector(s) + n);

    s->nsector -= n;

}

void ide_sector_read(IDEState *s)

{

    int64_t sector_num;

    int n;

    s->status = READY_STAT | SEEK_STAT;

    s->error = 0; /* not needed by IDE spec, but needed by Windows */

    sector_num = ide_get_sector(s);

    n = s->nsector;

    if (n == 0) {

        ide_transfer_stop(s);

        return;

    }

    s->status |= BUSY_STAT;

    if (n > s->req_nb_sectors) {

        n = s->req_nb_sectors;

    }

#if defined(DEBUG_IDE)

    printf("sector=%" PRId64 "\n", sector_num);

#endif

    s->iov.iov_base = s->io_buffer;

    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;

    qemu_iovec_init_external(&s->qiov, &s->iov, 1);

    bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);

    s->pio_aiocb = bdrv_aio_readv(s->bs, sector_num, &s->qiov, n,

                                  ide_sector_read_cb, s);

}

static void dma_buf_commit(IDEState *s)

{

    qemu_sglist_destroy(&s->sg);

}

void ide_set_inactive(IDEState *s)

{

    s->bus->dma->aiocb = NULL;

    s->bus->dma->ops->set_inactive(s->bus->dma);

}

void ide_dma_error(IDEState *s)

{

    ide_transfer_stop(s);

    s->error = ABRT_ERR;

    s->status = READY_STAT | ERR_STAT;

    ide_set_inactive(s);

    ide_set_irq(s->bus);

}

static int ide_handle_rw_error(IDEState *s, int error, int op)

{

    int is_read = (op & BM_STATUS_RETRY_READ);

    BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);

    if (action == BLOCK_ERR_IGNORE) {

        bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_IGNORE, is_read);

        return 0;

    }

    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)

            || action == BLOCK_ERR_STOP_ANY) {

        s->bus->dma->ops->set_unit(s->bus->dma, s->unit);

        s->bus->error_status = op;

        bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_STOP, is_read);

        vm_stop(RUN_STATE_IO_ERROR);

        bdrv_iostatus_set_err(s->bs, error);

    } else {

        if (op & BM_STATUS_DMA_RETRY) {

            dma_buf_commit(s);

            ide_dma_error(s);

        } else {

            ide_rw_error(s);

        }

        bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_REPORT, is_read);

    }

    return 1;

}

void ide_dma_cb(void *opaque, int ret)

{

    IDEState *s = opaque;

    int n;

    int64_t sector_num;

    if (ret < 0) {

        int op = BM_STATUS_DMA_RETRY;

        if (s->dma_cmd == IDE_DMA_READ)

            op |= BM_STATUS_RETRY_READ;

        else if (s->dma_cmd == IDE_DMA_TRIM)

            op |= BM_STATUS_RETRY_TRIM;

        if (ide_handle_rw_error(s, -ret, op)) {

            return;

        }

    }

    n = s->io_buffer_size >> 9;

    sector_num = ide_get_sector(s);

    if (n > 0) {

        dma_buf_commit(s);

        sector_num += n;

        ide_set_sector(s, sector_num);

        s->nsector -= n;

    }

    /* end of transfer ? */

    if (s->nsector == 0) {

        s->status = READY_STAT | SEEK_STAT;

        ide_set_irq(s->bus);

        goto eot;

    }

    /* launch next transfer */

    n = s->nsector;

    s->io_buffer_index = 0;

    s->io_buffer_size = n * 512;

    if (s->bus->dma->ops->prepare_buf(s->bus->dma, ide_cmd_is_read(s)) == 0) {

        /* The PRDs were too short. Reset the Active bit, but don't raise an

         * interrupt. */

        goto eot;

    }

#ifdef DEBUG_AIO

    printf("ide_dma_cb: sector_num=%" PRId64 " n=%d, cmd_cmd=%d\n",

           sector_num, n, s->dma_cmd);

#endif

    switch (s->dma_cmd) {

    case IDE_DMA_READ:

        s->bus->dma->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,

                                           ide_dma_cb, s);

        break;

    case IDE_DMA_WRITE:

        s->bus->dma->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num,

                                            ide_dma_cb, s);

        break;

    case IDE_DMA_TRIM:

        s->bus->dma->aiocb = dma_bdrv_io(s->bs, &s->sg, sector_num,

                                         ide_issue_trim, ide_dma_cb, s,

                                         DMA_DIRECTION_TO_DEVICE);

        break;

    }

    return;

eot:

    if (s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) {

        bdrv_acct_done(s->bs, &s->acct);

    }

    ide_set_inactive(s);

}

static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)

{

    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;

    s->io_buffer_index = 0;

    s->io_buffer_size = 0;

    s->dma_cmd = dma_cmd;

    switch (dma_cmd) {

    case IDE_DMA_READ:

        bdrv_acct_start(s->bs, &s->acct, s->nsector * BDRV_SECTOR_SIZE,

                        BDRV_ACCT_READ);

        break;

    case IDE_DMA_WRITE:

        bdrv_acct_start(s->bs, &s->acct, s->nsector * BDRV_SECTOR_SIZE,

                        BDRV_ACCT_WRITE);

        break;

    default:

        break;

    }

    s->bus->dma->ops->start_dma(s->bus->dma, s, ide_dma_cb);

}

static void ide_sector_write_timer_cb(void *opaque)

{

    IDEState *s = opaque;

    ide_set_irq(s->bus);

}

static void ide_sector_write_cb(void *opaque, int ret)

{

    IDEState *s = opaque;

    int n;

    bdrv_acct_done(s->bs, &s->acct);

    s->pio_aiocb = NULL;

    s->status &= ~BUSY_STAT;

    if (ret != 0) {

        if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY)) {

            return;

        }

    }

    n = s->nsector;

    if (n > s->req_nb_sectors) {

        n = s->req_nb_sectors;

    }

    s->nsector -= n;

    if (s->nsector == 0) {

        /* no more sectors to write */

        ide_transfer_stop(s);

    } else {

        int n1 = s->nsector;

        if (n1 > s->req_nb_sectors) {

            n1 = s->req_nb_sectors;

        }

        ide_transfer_start(s, s->io_buffer, n1 * BDRV_SECTOR_SIZE,

                           ide_sector_write);

    }

    ide_set_sector(s, ide_get_sector(s) + n);

    if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {

        /* It seems there is a bug in the Windows 2000 installer HDD

           IDE driver which fills the disk with empty logs when the

           IDE write IRQ comes too early. This hack tries to correct

           that at the expense of slower write performances. Use this

           option _only_ to install Windows 2000. You must disable it

           for normal use. */

        qemu_mod_timer(s->sector_write_timer,

                       qemu_get_clock_ns(vm_clock) + (get_ticks_per_sec() / 1000));

    } else {

        ide_set_irq(s->bus);

    }

}

void ide_sector_write(IDEState *s)

{

    int64_t sector_num;

    int n;

    s->status = READY_STAT | SEEK_STAT | BUSY_STAT;

    sector_num = ide_get_sector(s);

#if defined(DEBUG_IDE)

    printf("sector=%" PRId64 "\n", sector_num);

#endif

    n = s->nsector;

    if (n > s->req_nb_sectors) {

        n = s->req_nb_sectors;

    }

    s->iov.iov_base = s->io_buffer;

    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;

    qemu_iovec_init_external(&s->qiov, &s->iov, 1);

    bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);

    s->pio_aiocb = bdrv_aio_writev(s->bs, sector_num, &s->qiov, n,

                                   ide_sector_write_cb, s);

}

static void ide_flush_cb(void *opaque, int ret)

{

    IDEState *s = opaque;

    if (ret < 0) {

        /* XXX: What sector number to set here? */

        if (ide_handle_rw_error(s, -ret, BM_STATUS_RETRY_FLUSH)) {

            return;

        }

    }

    bdrv_acct_done(s->bs, &s->acct);

    s->status = READY_STAT | SEEK_STAT;

    ide_set_irq(s->bus);

}

void ide_flush_cache(IDEState *s)

{

    if (s->bs == NULL) {

        ide_flush_cb(s, 0);

        return;

    }

    bdrv_acct_start(s->bs, &s->acct, 0, BDRV_ACCT_FLUSH);

    bdrv_aio_flush(s->bs, ide_flush_cb, s);

}

static void ide_cfata_metadata_inquiry(IDEState *s)

{

    uint16_t *p;

    uint32_t spd;

    p = (uint16_t *) s->io_buffer;

    memset(p, 0, 0x200);

    spd = ((s->mdata_size - 1) >> 9) + 1;

    put_le16(p + 0, 0x0001);                        /* Data format revision */

    put_le16(p + 1, 0x0000);                        /* Media property: silicon */

    put_le16(p + 2, s->media_changed);                /* Media status */

    put_le16(p + 3, s->mdata_size & 0xffff);        /* Capacity in bytes (low) */

    put_le16(p + 4, s->mdata_size >> 16);        /* Capacity in bytes (high) */

    put_le16(p + 5, spd & 0xffff);                /* Sectors per device (low) */

    put_le16(p + 6, spd >> 16);                        /* Sectors per device (high) */

}

static void ide_cfata_metadata_read(IDEState *s)

{

    uint16_t *p;

    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {

        s->status = ERR_STAT;

        s->error = ABRT_ERR;

        return;

    }

    p = (uint16_t *) s->io_buffer;

    memset(p, 0, 0x200);

    put_le16(p + 0, s->media_changed);                /* Media status */

    memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),

                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),

                                    s->nsector << 9), 0x200 - 2));

}

static void ide_cfata_metadata_write(IDEState *s)

{

    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {

        s->status = ERR_STAT;

        s->error = ABRT_ERR;

        return;

    }

    s->media_changed = 0;

    memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),

                    s->io_buffer + 2,

                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),

                                    s->nsector << 9), 0x200 - 2));

}

/* called when the inserted state of the media has changed */

static void ide_cd_change_cb(void *opaque, bool load)

{

    IDEState *s = opaque;

    uint64_t nb_sectors;

    s->tray_open = !load;

    bdrv_get_geometry(s->bs, &nb_sectors);

    s->nb_sectors = nb_sectors;

    /*

     * First indicate to the guest that a CD has been removed.  That's

     * done on the next command the guest sends us.

     *

     * Then we set UNIT_ATTENTION, by which the guest will

     * detect a new CD in the drive.  See ide_atapi_cmd() for details.

     */

    s->cdrom_changed = 1;

    s->events.new_media = true;

    s->events.eject_request = false;

    ide_set_irq(s->bus);

}

static void ide_cd_eject_request_cb(void *opaque, bool force)