@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 3,135 lines 90.5 KB
Raw
1 /*
2 * QEMU IDE disk and CD/DVD-ROM Emulator
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 * Copyright (c) 2006 Openedhand Ltd.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu/osdep.h"
27 #include "hw/core/irq.h"
28 #include "hw/isa/isa.h"
29 #include "migration/vmstate.h"
30 #include "qemu/error-report.h"
31 #include "qemu/main-loop.h"
32 #include "qemu/timer.h"
33 #include "qemu/hw-version.h"
34 #include "qemu/memalign.h"
35 #include "system/system.h"
36 #include "system/blockdev.h"
37 #include "system/dma.h"
38 #include "hw/block/block.h"
39 #include "system/block-backend.h"
40 #include "qapi/error.h"
41 #include "qemu/cutils.h"
42 #include "system/replay.h"
43 #include "system/runstate.h"
44 #include "ide-internal.h"
45 #include "trace.h"
46
47 /* These values were based on a Seagate ST3500418AS but have been modified
48 to make more sense in QEMU */
49 static const int smart_attributes[][12] = {
50 /* id, flags, hflags, val, wrst, raw (6 bytes), threshold */
51 /* raw read error rate*/
52 { 0x01, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06},
53 /* spin up */
54 { 0x03, 0x03, 0x00, 0x64, 0x64, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
55 /* start stop count */
56 { 0x04, 0x02, 0x00, 0x64, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14},
57 /* remapped sectors */
58 { 0x05, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24},
59 /* power on hours */
60 { 0x09, 0x03, 0x00, 0x64, 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
61 /* power cycle count */
62 { 0x0c, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
63 /* airflow-temperature-celsius */
64 { 190, 0x03, 0x00, 0x45, 0x45, 0x1f, 0x00, 0x1f, 0x1f, 0x00, 0x00, 0x32},
65 };
66
67 const char *IDE_DMA_CMD_lookup[IDE_DMA__COUNT] = {
68 [IDE_DMA_READ] = "DMA READ",
69 [IDE_DMA_WRITE] = "DMA WRITE",
70 [IDE_DMA_TRIM] = "DMA TRIM",
71 [IDE_DMA_ATAPI] = "DMA ATAPI"
72 };
73
74 static const char *IDE_DMA_CMD_str(enum ide_dma_cmd enval)
75 {
76 if ((unsigned)enval < IDE_DMA__COUNT) {
77 return IDE_DMA_CMD_lookup[enval];
78 }
79 return "DMA UNKNOWN CMD";
80 }
81
82 static void ide_dummy_transfer_stop(IDEState *s);
83 static void ide_transfer_halt(IDEState *s);
84
85 const MemoryRegionPortio ide_portio_list[] = {
86 { 0, 8, 1, .read = ide_ioport_read, .write = ide_ioport_write },
87 { 0, 1, 2, .read = ide_data_readw, .write = ide_data_writew },
88 { 0, 1, 4, .read = ide_data_readl, .write = ide_data_writel },
89 PORTIO_END_OF_LIST(),
90 };
91
92 const MemoryRegionPortio ide_portio2_list[] = {
93 { 0, 1, 1, .read = ide_status_read, .write = ide_ctrl_write },
94 PORTIO_END_OF_LIST(),
95 };
96
97 static void padstr(char *str, const char *src, int len)
98 {
99 int i, v;
100 for(i = 0; i < len; i++) {
101 if (*src)
102 v = *src++;
103 else
104 v = ' ';
105 str[i^1] = v;
106 }
107 }
108
109 static void put_le16(uint16_t *p, unsigned int v)
110 {
111 *p = cpu_to_le16(v);
112 }
113
114 static void ide_identify_chs(IDEState *s)
115 {
116 uint16_t *p = (uint16_t *)s->identify_data;
117 unsigned int cur_sec = s->cylinders * s->heads * s->sectors;
118
119 put_le16(p + 54, s->cylinders);
120 put_le16(p + 55, s->heads);
121 put_le16(p + 56, s->sectors);
122 put_le16(p + 57, cur_sec);
123 put_le16(p + 58, cur_sec >> 16);
124 }
125
126 static void ide_identify_size(IDEState *s)
127 {
128 uint16_t *p = (uint16_t *)s->identify_data;
129 int64_t nb_sectors_lba28 = s->nb_sectors;
130 if (nb_sectors_lba28 >= 1 << 28) {
131 nb_sectors_lba28 = (1 << 28) - 1;
132 }
133 put_le16(p + 60, nb_sectors_lba28);
134 put_le16(p + 61, nb_sectors_lba28 >> 16);
135 put_le16(p + 100, s->nb_sectors);
136 put_le16(p + 101, s->nb_sectors >> 16);
137 put_le16(p + 102, s->nb_sectors >> 32);
138 put_le16(p + 103, s->nb_sectors >> 48);
139 }
140
141 static void ide_identify(IDEState *s)
142 {
143 uint16_t *p;
144 IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
145
146 p = (uint16_t *)s->identify_data;
147 if (s->identify_set) {
148 goto fill_buffer;
149 }
150 memset(p, 0, sizeof(s->identify_data));
151
152 put_le16(p + 0, 0x0040);
153 /* Words 1, 3 and 6 describe the default translation (ATA-5 8.16.8) */
154 put_le16(p + 1, s->cylinders);
155 put_le16(p + 3, s->drive_heads);
156 put_le16(p + 4, 512 * s->drive_sectors); /* ATA-1 unformatted bytes/trk */
157 put_le16(p + 5, 512); /* ATA-1 unformatted bytes per sector */
158 put_le16(p + 6, s->drive_sectors);
159 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
160 put_le16(p + 20, 3); /* ATA-1 buffer type: dual ported, read caching */
161 put_le16(p + 21, 512); /* ATA-1 buffer size in 512 byte increments */
162 put_le16(p + 22, 4); /* ecc bytes */
163 padstr((char *)(p + 23), s->version, 8); /* firmware version */
164 padstr((char *)(p + 27), s->drive_model_str, 40); /* model */
165 #if MAX_MULT_SECTORS > 1
166 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
167 #endif
168 put_le16(p + 48, 1); /* dword I/O */
169 put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
170 put_le16(p + 51, 0x200); /* PIO transfer cycle */
171 put_le16(p + 52, 0x200); /* DMA transfer cycle */
172 put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
173 ide_identify_chs(s);
174 if (s->mult_sectors)
175 put_le16(p + 59, 0x100 | s->mult_sectors);
176 /* *(p + 60) := nb_sectors -- see ide_identify_size */
177 /* *(p + 61) := nb_sectors >> 16 -- see ide_identify_size */
178 put_le16(p + 62, 0x07); /* single word dma0-2 supported */
179 put_le16(p + 63, 0x07); /* mdma0-2 supported */
180 put_le16(p + 64, 0x03); /* pio3-4 supported */
181 put_le16(p + 65, 120);
182 put_le16(p + 66, 120);
183 put_le16(p + 67, 120);
184 put_le16(p + 68, 120);
185 if (dev && dev->conf.discard_granularity) {
186 put_le16(p + 69, (1 << 14)); /* determinate TRIM behavior */
187 }
188
189 if (s->ncq_queues) {
190 put_le16(p + 75, s->ncq_queues - 1);
191 /* NCQ supported */
192 put_le16(p + 76, (1 << 8));
193 }
194
195 put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
196 put_le16(p + 81, 0x16); /* conforms to ata5 */
197 /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */
198 put_le16(p + 82, (1 << 14) | (1 << 5) | 1);
199 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
200 put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
201 /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */
202 if (s->wwn) {
203 put_le16(p + 84, (1 << 14) | (1 << 8) | 0);
204 } else {
205 put_le16(p + 84, (1 << 14) | 0);
206 }
207 /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */
208 if (blk_enable_write_cache(s->blk)) {
209 put_le16(p + 85, (1 << 14) | (1 << 5) | 1);
210 } else {
211 put_le16(p + 85, (1 << 14) | 1);
212 }
213 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
214 put_le16(p + 86, (1 << 13) | (1 <<12) | (1 << 10));
215 /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */
216 if (s->wwn) {
217 put_le16(p + 87, (1 << 14) | (1 << 8) | 0);
218 } else {
219 put_le16(p + 87, (1 << 14) | 0);
220 }
221 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
222 put_le16(p + 93, 1 | (1 << 14) | 0x2000);
223 /* *(p + 100) := nb_sectors -- see ide_identify_size */
224 /* *(p + 101) := nb_sectors >> 16 -- see ide_identify_size */
225 /* *(p + 102) := nb_sectors >> 32 -- see ide_identify_size */
226 /* *(p + 103) := nb_sectors >> 48 -- see ide_identify_size */
227
228 if (dev && dev->conf.physical_block_size)
229 put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));
230 if (s->wwn) {
231 /* LE 16-bit words 111-108 contain 64-bit World Wide Name */
232 put_le16(p + 108, s->wwn >> 48);
233 put_le16(p + 109, s->wwn >> 32);
234 put_le16(p + 110, s->wwn >> 16);
235 put_le16(p + 111, s->wwn);
236 }
237 if (dev && dev->conf.discard_granularity) {
238 put_le16(p + 169, 1); /* TRIM support */
239 }
240 if (dev) {
241 put_le16(p + 217, dev->rotation_rate); /* Nominal media rotation rate */
242 }
243
244 ide_identify_size(s);
245 s->identify_set = 1;
246
247 fill_buffer:
248 memcpy(s->io_buffer, p, sizeof(s->identify_data));
249 }
250
251 static void ide_atapi_identify(IDEState *s)
252 {
253 uint16_t *p;
254
255 p = (uint16_t *)s->identify_data;
256 if (s->identify_set) {
257 goto fill_buffer;
258 }
259 memset(p, 0, sizeof(s->identify_data));
260
261 /* Removable CDROM, 50us response, 12 byte packets */
262 put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
263 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
264 put_le16(p + 20, 3); /* buffer type */
265 put_le16(p + 21, 512); /* cache size in sectors */
266 put_le16(p + 22, 4); /* ecc bytes */
267 padstr((char *)(p + 23), s->version, 8); /* firmware version */
268 padstr((char *)(p + 27), s->drive_model_str, 40); /* model */
269 put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
270 #ifdef USE_DMA_CDROM
271 put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
272 put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
273 put_le16(p + 62, 7); /* single word dma0-2 supported */
274 put_le16(p + 63, 7); /* mdma0-2 supported */
275 #else
276 put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
277 put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
278 put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
279 #endif
280 put_le16(p + 64, 3); /* pio3-4 supported */
281 put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
282 put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
283 put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
284 put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
285
286 put_le16(p + 71, 30); /* in ns */
287 put_le16(p + 72, 30); /* in ns */
288
289 if (s->ncq_queues) {
290 put_le16(p + 75, s->ncq_queues - 1);
291 /* NCQ supported */
292 put_le16(p + 76, (1 << 8));
293 }
294
295 put_le16(p + 80, 0x70); /* support up to ATA/ATAPI-6 */
296 if (s->wwn) {
297 put_le16(p + 84, (1 << 8)); /* supports WWN for words 108-111 */
298 put_le16(p + 87, (1 << 8)); /* WWN enabled */
299 }
300
301 #ifdef USE_DMA_CDROM
302 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
303 if (!s->ncq_queues) {
304 /* word 93 is parallel ATA only, a SATA device reports zero */
305 put_le16(p + 93, 0x600f);
306 }
307 #endif
308
309 if (s->wwn) {
310 /* LE 16-bit words 111-108 contain 64-bit World Wide Name */
311 put_le16(p + 108, s->wwn >> 48);
312 put_le16(p + 109, s->wwn >> 32);
313 put_le16(p + 110, s->wwn >> 16);
314 put_le16(p + 111, s->wwn);
315 }
316
317 s->identify_set = 1;
318
319 fill_buffer:
320 memcpy(s->io_buffer, p, sizeof(s->identify_data));
321 }
322
323 static void ide_cfata_identify_size(IDEState *s)
324 {
325 uint16_t *p = (uint16_t *)s->identify_data;
326 put_le16(p + 7, s->nb_sectors >> 16); /* Sectors per card */
327 put_le16(p + 8, s->nb_sectors); /* Sectors per card */
328 put_le16(p + 60, s->nb_sectors); /* Total LBA sectors */
329 put_le16(p + 61, s->nb_sectors >> 16); /* Total LBA sectors */
330 }
331
332 static void ide_cfata_identify(IDEState *s)
333 {
334 uint16_t *p;
335
336 p = (uint16_t *)s->identify_data;
337 if (s->identify_set) {
338 goto fill_buffer;
339 }
340 memset(p, 0, sizeof(s->identify_data));
341
342 put_le16(p + 0, 0x848a); /* CF Storage Card signature */
343 put_le16(p + 1, s->cylinders); /* Default cylinders */
344 put_le16(p + 3, s->drive_heads); /* Default heads */
345 put_le16(p + 6, s->drive_sectors); /* Default sectors per track */
346 /* *(p + 7) := nb_sectors >> 16 -- see ide_cfata_identify_size */
347 /* *(p + 8) := nb_sectors -- see ide_cfata_identify_size */
348 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
349 put_le16(p + 22, 0x0004); /* ECC bytes */
350 padstr((char *) (p + 23), s->version, 8); /* Firmware Revision */
351 padstr((char *) (p + 27), s->drive_model_str, 40);/* Model number */
352 #if MAX_MULT_SECTORS > 1
353 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
354 #else
355 put_le16(p + 47, 0x0000);
356 #endif
357 put_le16(p + 49, 0x0f00); /* Capabilities */
358 put_le16(p + 51, 0x0002); /* PIO cycle timing mode */
359 put_le16(p + 52, 0x0001); /* DMA cycle timing mode */
360 put_le16(p + 53, 0x0003); /* Translation params valid */
361 ide_identify_chs(s); /* Current C/H/S and capacity */
362 if (s->mult_sectors) /* Multiple sector setting */
363 put_le16(p + 59, 0x100 | s->mult_sectors);
364 /* *(p + 60) := nb_sectors -- see ide_cfata_identify_size */
365 /* *(p + 61) := nb_sectors >> 16 -- see ide_cfata_identify_size */
366 put_le16(p + 63, 0x0203); /* Multiword DMA capability */
367 put_le16(p + 64, 0x0001); /* Flow Control PIO support */
368 put_le16(p + 65, 0x0096); /* Min. Multiword DMA cycle */
369 put_le16(p + 66, 0x0096); /* Rec. Multiword DMA cycle */
370 put_le16(p + 68, 0x00b4); /* Min. PIO cycle time */
371 put_le16(p + 82, 0x400c); /* Command Set supported */
372 put_le16(p + 83, 0x7068); /* Command Set supported */
373 put_le16(p + 84, 0x4000); /* Features supported */
374 put_le16(p + 85, 0x000c); /* Command Set enabled */
375 put_le16(p + 86, 0x7044); /* Command Set enabled */
376 put_le16(p + 87, 0x4000); /* Features enabled */
377 put_le16(p + 91, 0x4060); /* Current APM level */
378 put_le16(p + 129, 0x0002); /* Current features option */
379 put_le16(p + 130, 0x0005); /* Reassigned sectors */
380 put_le16(p + 131, 0x0001); /* Initial power mode */
381 put_le16(p + 132, 0x0000); /* User signature */
382 put_le16(p + 160, 0x8100); /* Power requirement */
383 put_le16(p + 161, 0x8001); /* CF command set */
384
385 ide_cfata_identify_size(s);
386 s->identify_set = 1;
387
388 fill_buffer:
389 memcpy(s->io_buffer, p, sizeof(s->identify_data));
390 }
391
392 static void ide_set_signature(IDEState *s)
393 {
394 s->select &= ~(ATA_DEV_HS); /* clear head */
395 /* put signature */
396 s->nsector = 1;
397 s->sector = 1;
398 if (s->drive_kind == IDE_CD) {
399 s->lcyl = 0x14;
400 s->hcyl = 0xeb;
401 } else if (s->blk) {
402 s->lcyl = 0;
403 s->hcyl = 0;
404 } else {
405 s->lcyl = 0xff;
406 s->hcyl = 0xff;
407 }
408 }
409
410 static bool ide_sect_range_ok(IDEState *s,
411 uint64_t sector, uint64_t nb_sectors)
412 {
413 uint64_t total_sectors;
414
415 blk_get_geometry(s->blk, &total_sectors);
416 if (sector > total_sectors || nb_sectors > total_sectors - sector) {
417 return false;
418 }
419 return true;
420 }
421
422 typedef struct TrimAIOCB {
423 BlockAIOCB common;
424 IDEState *s;
425 QEMUBH *bh;
426 int ret;
427 QEMUIOVector *qiov;
428 bool canceled;
429 } TrimAIOCB;
430
431 static void trim_aio_cancel(BlockAIOCB *acb)
432 {
433 TrimAIOCB *iocb = container_of(acb, TrimAIOCB, common);
434
435 /* Exit the loop so ide_trim_co_entry will not continue */
436 iocb->canceled = true;
437 }
438
439 static const AIOCBInfo trim_aiocb_info = {
440 .aiocb_size = sizeof(TrimAIOCB),
441 .cancel_async = trim_aio_cancel,
442 };
443
444 static void ide_trim_bh_cb(void *opaque)
445 {
446 TrimAIOCB *iocb = opaque;
447 BlockBackend *blk = iocb->s->blk;
448
449 iocb->common.cb(iocb->common.opaque, iocb->ret);
450
451 qemu_bh_delete(iocb->bh);
452 iocb->bh = NULL;
453 qemu_aio_unref(iocb);
454
455 /* Paired with blk_co_start_request in ide_trim_co_entry() */
456 blk_end_request(blk);
457 }
458
459 static void coroutine_fn ide_trim_co_entry(void *opaque)
460 {
461 TrimAIOCB *iocb = opaque;
462 IDEState *s = iocb->s;
463 int i, j;
464 int ret;
465
466 /* Paired with blk_end_request in ide_trim_bh_cb() */
467 blk_co_start_request(s->blk);
468
469 for (j = 0; j < iocb->qiov->niov; j++) {
470 for (i = 0; i < iocb->qiov->iov[j].iov_len / 8; i++) {
471 uint64_t *buffer = iocb->qiov->iov[j].iov_base;
472
473 /* 6-byte LBA + 2-byte range per entry */
474 uint64_t entry = le64_to_cpu(buffer[i]);
475 uint64_t sector = entry & 0x0000ffffffffffffULL;
476 uint16_t count = entry >> 48;
477
478 if (count == 0) {
479 continue;
480 }
481
482 if (iocb->canceled) {
483 iocb->ret = -ECANCELED;
484 goto done;
485 }
486
487 if (!ide_sect_range_ok(s, sector, count)) {
488 block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_UNMAP);
489 iocb->ret = -EINVAL;
490 goto done;
491 }
492
493 block_acct_start(blk_get_stats(s->blk), &s->acct,
494 count << BDRV_SECTOR_BITS, BLOCK_ACCT_UNMAP);
495
496 /* Got an entry! Submit and exit. */
497 ret = blk_co_pdiscard(s->blk,
498 sector << BDRV_SECTOR_BITS,
499 count << BDRV_SECTOR_BITS,
500 BDRV_REQ_NO_QUEUE);
501 if (ret >= 0) {
502 block_acct_done(blk_get_stats(s->blk), &s->acct);
503 } else {
504 iocb->ret = ret;
505 block_acct_failed(blk_get_stats(s->blk), &s->acct);
506 goto done;
507 }
508 }
509 }
510
511 iocb->ret = 0;
512 done:
513 if (iocb->bh) {
514 replay_bh_schedule_event(iocb->bh);
515 }
516 }
517
518 BlockAIOCB *ide_issue_trim(
519 int64_t offset, QEMUIOVector *qiov,
520 BlockCompletionFunc *cb, void *cb_opaque, void *opaque)
521 {
522 IDEState *s = opaque;
523 IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
524 TrimAIOCB *iocb;
525 Coroutine *co;
526
527 iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque);
528 iocb->s = s;
529 iocb->bh = qemu_bh_new_guarded(ide_trim_bh_cb, iocb,
530 &DEVICE(dev)->mem_reentrancy_guard);
531 iocb->ret = 0;
532 iocb->qiov = qiov;
533 iocb->canceled = false;
534
535 co = qemu_coroutine_create(ide_trim_co_entry, iocb);
536 aio_co_enter(qemu_get_current_aio_context(), co);
537
538 return &iocb->common;
539 }
540
541 void ide_abort_command(IDEState *s)
542 {
543 s->status = READY_STAT | ERR_STAT;
544 s->error = ABRT_ERR;
545 ide_transfer_stop(s);
546 }
547
548 static void ide_set_retry(IDEState *s)
549 {
550 s->bus->retry_unit = s->unit;
551 s->bus->retry_sector_num = ide_get_sector(s);
552 s->bus->retry_nsector = s->nsector;
553 }
554
555 static void ide_clear_retry(IDEState *s)
556 {
557 s->bus->retry_unit = -1;
558 s->bus->retry_sector_num = 0;
559 s->bus->retry_nsector = 0;
560 }
561
562 /* prepare data transfer and tell what to do after */
563 bool ide_transfer_start_norecurse(IDEState *s, uint8_t *buf, int size,
564 EndTransferFunc *end_transfer_func)
565 {
566 s->data_ptr = buf;
567 s->data_end = buf + size;
568 ide_set_retry(s);
569 if (!(s->status & ERR_STAT)) {
570 s->status |= DRQ_STAT;
571 }
572 if (!s->bus->dma->ops->pio_transfer) {
573 s->end_transfer_func = end_transfer_func;
574 return false;
575 }
576 if (!s->bus->dma->ops->pio_transfer(s->bus->dma)) {
577 /*
578 * No data reached the buffer, so the caller must not act on it. A
579 * write would otherwise commit whatever the previous phase left
580 * there to the next sector.
581 */
582 ide_transfer_halt(s);
583 return false;
584 }
585 return true;
586 }
587
588 void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
589 EndTransferFunc *end_transfer_func)
590 {
591 if (ide_transfer_start_norecurse(s, buf, size, end_transfer_func)) {
592 end_transfer_func(s);
593 }
594 }
595
596 static void ide_cmd_done(IDEState *s)
597 {
598 if (s->bus->dma->ops->cmd_done) {
599 s->bus->dma->ops->cmd_done(s->bus->dma);
600 }
601 }
602
603 static void ide_transfer_halt(IDEState *s)
604 {
605 s->end_transfer_func = ide_transfer_stop;
606 s->data_ptr = s->io_buffer;
607 s->data_end = s->io_buffer;
608 s->status &= ~DRQ_STAT;
609 }
610
611 void ide_transfer_stop(IDEState *s)
612 {
613 ide_transfer_halt(s);
614 ide_cmd_done(s);
615 }
616
617 int64_t ide_get_sector(IDEState *s)
618 {
619 int64_t sector_num;
620 if (s->select & (ATA_DEV_LBA)) {
621 if (s->lba48) {
622 sector_num = ((int64_t)s->hob_hcyl << 40) |
623 ((int64_t) s->hob_lcyl << 32) |
624 ((int64_t) s->hob_sector << 24) |
625 ((int64_t) s->hcyl << 16) |
626 ((int64_t) s->lcyl << 8) | s->sector;
627 } else {
628 /* LBA28 */
629 sector_num = ((s->select & (ATA_DEV_LBA_MSB)) << 24) |
630 (s->hcyl << 16) | (s->lcyl << 8) | s->sector;
631 }
632 } else {
633 /* CHS */
634 sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
635 (s->select & (ATA_DEV_HS)) * s->sectors + (s->sector - 1);
636 }
637
638 return sector_num;
639 }
640
641 void ide_set_sector(IDEState *s, int64_t sector_num)
642 {
643 unsigned int cyl, r;
644 if (s->select & (ATA_DEV_LBA)) {
645 if (s->lba48) {
646 s->sector = sector_num;
647 s->lcyl = sector_num >> 8;
648 s->hcyl = sector_num >> 16;
649 s->hob_sector = sector_num >> 24;
650 s->hob_lcyl = sector_num >> 32;
651 s->hob_hcyl = sector_num >> 40;
652 } else {
653 /* LBA28 */
654 s->select = (s->select & ~(ATA_DEV_LBA_MSB)) |
655 ((sector_num >> 24) & (ATA_DEV_LBA_MSB));
656 s->hcyl = (sector_num >> 16);
657 s->lcyl = (sector_num >> 8);
658 s->sector = (sector_num);
659 }
660 } else {
661 /* CHS */
662 cyl = sector_num / (s->heads * s->sectors);
663 r = sector_num % (s->heads * s->sectors);
664 s->hcyl = cyl >> 8;
665 s->lcyl = cyl;
666 s->select = (s->select & ~(ATA_DEV_HS)) |
667 ((r / s->sectors) & (ATA_DEV_HS));
668 s->sector = (r % s->sectors) + 1;
669 }
670 }
671
672 static void ide_rw_error(IDEState *s) {
673 ide_abort_command(s);
674 ide_bus_set_irq(s->bus);
675 }
676
677 static void ide_buffered_readv_cb(void *opaque, int ret)
678 {
679 IDEBufferedRequest *req = opaque;
680 if (!req->orphaned) {
681 if (!ret) {
682 assert(req->qiov.size == req->original_qiov->size);
683 qemu_iovec_from_buf(req->original_qiov, 0,
684 req->qiov.local_iov.iov_base,
685 req->original_qiov->size);
686 }
687 req->original_cb(req->original_opaque, ret);
688 }
689 QLIST_REMOVE(req, list);
690 qemu_vfree(qemu_iovec_buf(&req->qiov));
691 g_free(req);
692 }
693
694 #define MAX_BUFFERED_REQS 16
695
696 BlockAIOCB *ide_buffered_readv(IDEState *s, int64_t sector_num,
697 QEMUIOVector *iov, int nb_sectors,
698 BlockCompletionFunc *cb, void *opaque)
699 {
700 BlockAIOCB *aioreq;
701 IDEBufferedRequest *req;
702 int c = 0;
703
704 QLIST_FOREACH(req, &s->buffered_requests, list) {
705 c++;
706 }
707 if (c > MAX_BUFFERED_REQS) {
708 return blk_abort_aio_request(s->blk, cb, opaque, -EIO);
709 }
710
711 req = g_new0(IDEBufferedRequest, 1);
712 req->original_qiov = iov;
713 req->original_cb = cb;
714 req->original_opaque = opaque;
715 qemu_iovec_init_buf(&req->qiov, blk_blockalign(s->blk, iov->size),
716 iov->size);
717
718 aioreq = blk_aio_preadv(s->blk, sector_num << BDRV_SECTOR_BITS,
719 &req->qiov, 0, ide_buffered_readv_cb, req);
720
721 QLIST_INSERT_HEAD(&s->buffered_requests, req, list);
722 return aioreq;
723 }
724
725 /**
726 * Cancel all pending DMA requests.
727 * Any buffered DMA requests are instantly canceled,
728 * but any pending unbuffered DMA requests must be waited on.
729 */
730 void ide_cancel_dma_sync(IDEState *s)
731 {
732 IDEBufferedRequest *req;
733
734 /* First invoke the callbacks of all buffered requests
735 * and flag those requests as orphaned. Ideally there
736 * are no unbuffered (Scatter Gather DMA Requests or
737 * write requests) pending and we can avoid to drain. */
738 QLIST_FOREACH(req, &s->buffered_requests, list) {
739 if (!req->orphaned) {
740 trace_ide_cancel_dma_sync_buffered(req->original_cb, req);
741 req->original_cb(req->original_opaque, -ECANCELED);
742 }
743 req->orphaned = true;
744 }
745
746 /*
747 * We can't cancel Scatter Gather DMA in the middle of the
748 * operation or a partial (not full) DMA transfer would reach
749 * the storage so we wait for completion instead (we behave
750 * like if the DMA was completed by the time the guest trying
751 * to cancel dma with bmdma_cmd_writeb with BM_CMD_START not
752 * set).
753 *
754 * In the future we'll be able to safely cancel the I/O if the
755 * whole DMA operation will be submitted to disk with a single
756 * aio operation with preadv/pwritev.
757 *
758 * Note: s->bus->dma->aiocb might belong to the adjacent IDEState,
759 * so we have to drain both drives to get it cleared.
760 */
761 if (s->bus->dma->aiocb) {
762 trace_ide_cancel_dma_sync_remaining();
763 for (int i = 0; i < 2; i++) {
764 if (s->bus->ifs[i].blk) {
765 blk_drain(s->bus->ifs[i].blk);
766 }
767 }
768 assert(s->bus->dma->aiocb == NULL);
769 }
770 }
771
772 static void ide_sector_read(IDEState *s);
773
774 static void ide_sector_read_cb(void *opaque, int ret)
775 {
776 IDEState *s = opaque;
777 int n;
778
779 s->pio_aiocb = NULL;
780 s->status &= ~BUSY_STAT;
781
782 if (ret != 0) {
783 if (ide_handle_rw_error(s, -ret, IDE_RETRY_PIO |
784 IDE_RETRY_READ)) {
785 return;
786 }
787 }
788
789 block_acct_done(blk_get_stats(s->blk), &s->acct);
790
791 n = s->nsector;
792 if (n > s->req_nb_sectors) {
793 n = s->req_nb_sectors;
794 }
795
796 ide_set_sector(s, ide_get_sector(s) + n);
797 s->nsector -= n;
798 /* Allow the guest to read the io_buffer */
799 ide_transfer_start(s, s->io_buffer, n * BDRV_SECTOR_SIZE, ide_sector_read);
800 ide_bus_set_irq(s->bus);
801 }
802
803 static void ide_sector_read(IDEState *s)
804 {
805 int64_t sector_num;
806 int n;
807
808 s->status = READY_STAT | SEEK_STAT;
809 s->error = 0; /* not needed by IDE spec, but needed by Windows */
810 sector_num = ide_get_sector(s);
811 n = s->nsector;
812 ide_set_retry(s);
813
814 if (n == 0) {
815 ide_transfer_stop(s);
816 return;
817 }
818
819 s->status |= BUSY_STAT;
820
821 if (n > s->req_nb_sectors) {
822 n = s->req_nb_sectors;
823 }
824
825 trace_ide_sector_read(sector_num, n);
826
827 if (!ide_sect_range_ok(s, sector_num, n)) {
828 ide_rw_error(s);
829 block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_READ);
830 return;
831 }
832
833 qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
834
835 block_acct_start(blk_get_stats(s->blk), &s->acct,
836 n * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);
837 s->pio_aiocb = ide_buffered_readv(s, sector_num, &s->qiov, n,
838 ide_sector_read_cb, s);
839 }
840
841 void ide_dma_buf_commit(IDEState *s, uint32_t tx_bytes)
842 {
843 if (s->bus->dma->ops->commit_buf) {
844 s->bus->dma->ops->commit_buf(s->bus->dma, tx_bytes);
845 }
846 s->io_buffer_offset += tx_bytes;
847 qemu_sglist_destroy(&s->sg);
848 }
849
850 void ide_set_inactive(IDEState *s, bool more)
851 {
852 s->bus->dma->aiocb = NULL;
853 ide_clear_retry(s);
854 if (s->bus->dma->ops->set_inactive) {
855 s->bus->dma->ops->set_inactive(s->bus->dma, more);
856 }
857 ide_cmd_done(s);
858 }
859
860 void ide_dma_error(IDEState *s)
861 {
862 ide_dma_buf_commit(s, 0);
863 ide_abort_command(s);
864 ide_set_inactive(s, false);
865 ide_bus_set_irq(s->bus);
866 }
867
868 int ide_handle_rw_error(IDEState *s, int error, int op)
869 {
870 bool is_read = (op & IDE_RETRY_READ) != 0;
871 BlockErrorAction action = blk_get_error_action(s->blk, is_read, error);
872
873 if (action == BLOCK_ERROR_ACTION_STOP) {
874 assert(s->bus->retry_unit == s->unit);
875 s->bus->error_status = op;
876 } else if (action == BLOCK_ERROR_ACTION_REPORT) {
877 block_acct_failed(blk_get_stats(s->blk), &s->acct);
878 if (IS_IDE_RETRY_DMA(op)) {
879 ide_dma_error(s);
880 } else if (IS_IDE_RETRY_ATAPI(op)) {
881 ide_atapi_io_error(s, -error);
882 } else {
883 ide_rw_error(s);
884 }
885 }
886 blk_error_action(s->blk, action, is_read, error);
887 return action != BLOCK_ERROR_ACTION_IGNORE;
888 }
889
890 static void ide_dma_cb(void *opaque, int ret)
891 {
892 IDEState *s = opaque;
893 int n;
894 int64_t sector_num;
895 uint64_t offset;
896 bool stay_active = false;
897 int32_t prep_size = 0;
898
899 if (ret == -EINVAL) {
900 ide_dma_error(s);
901 return;
902 }
903
904 if (ret < 0) {
905 if (ide_handle_rw_error(s, -ret, ide_dma_cmd_to_retry(s->dma_cmd))) {
906 s->bus->dma->aiocb = NULL;
907 ide_dma_buf_commit(s, 0);
908 return;
909 }
910 }
911
912 if (s->io_buffer_size > s->nsector * 512) {
913 /*
914 * The PRDs were longer than needed for this request.
915 * The Active bit must remain set after the request completes.
916 */
917 n = s->nsector;
918 stay_active = true;
919 } else {
920 n = s->io_buffer_size >> 9;
921 }
922
923 sector_num = ide_get_sector(s);
924 if (n > 0) {
925 assert(n * 512 == s->sg.size);
926 ide_dma_buf_commit(s, s->sg.size);
927 sector_num += n;
928 ide_set_sector(s, sector_num);
929 s->nsector -= n;
930 }
931
932 /* end of transfer ? */
933 if (s->nsector == 0) {
934 s->status = READY_STAT | SEEK_STAT;
935 ide_bus_set_irq(s->bus);
936 goto eot;
937 }
938
939 /* launch next transfer */
940 n = s->nsector;
941 s->io_buffer_index = 0;
942 s->io_buffer_size = n * 512;
943 prep_size = s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_size);
944 if (prep_size < 0) {
945 ide_dma_error(s);
946 return;
947 }
948 /* If prepare_buf() succeeds, it must respect the limit. */
949 assert(prep_size <= n * 512);
950
951 /*
952 * Now prep_size stores the number of bytes in the sglist, and
953 * s->io_buffer_size stores the number of bytes described by the PRDs.
954 */
955
956 if (prep_size < n * 512) {
957 /*
958 * The PRDs are too short for this request. Error condition!
959 * Reset the Active bit and don't raise the interrupt.
960 */
961 s->status = READY_STAT | SEEK_STAT;
962 ide_dma_buf_commit(s, 0);
963 goto eot;
964 }
965
966 trace_ide_dma_cb(s, sector_num, n, IDE_DMA_CMD_str(s->dma_cmd));
967
968 if ((s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) &&
969 !ide_sect_range_ok(s, sector_num, n)) {
970 ide_dma_error(s);
971 block_acct_invalid(blk_get_stats(s->blk), s->acct.type);
972 return;
973 }
974
975 offset = sector_num << BDRV_SECTOR_BITS;
976 switch (s->dma_cmd) {
977 case IDE_DMA_READ:
978 s->bus->dma->aiocb = dma_blk_read(s->blk, &s->sg, offset,
979 BDRV_SECTOR_SIZE, ide_dma_cb, s);
980 break;
981 case IDE_DMA_WRITE:
982 s->bus->dma->aiocb = dma_blk_write(s->blk, &s->sg, offset,
983 BDRV_SECTOR_SIZE, ide_dma_cb, s);
984 break;
985 case IDE_DMA_TRIM:
986 s->bus->dma->aiocb = dma_blk_io(&s->sg, offset, BDRV_SECTOR_SIZE,
987 ide_issue_trim, s, ide_dma_cb, s,
988 DMA_DIRECTION_TO_DEVICE);
989 break;
990 default:
991 abort();
992 }
993 return;
994
995 eot:
996 if (s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) {
997 block_acct_done(blk_get_stats(s->blk), &s->acct);
998 }
999 ide_set_inactive(s, stay_active);
1000 }
1001
1002 static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
1003 {
1004 s->status = READY_STAT | SEEK_STAT | DRQ_STAT;
1005 s->io_buffer_size = 0;
1006 s->dma_cmd = dma_cmd;
1007
1008 switch (dma_cmd) {
1009 case IDE_DMA_READ:
1010 block_acct_start(blk_get_stats(s->blk), &s->acct,
1011 s->nsector * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);
1012 break;
1013 case IDE_DMA_WRITE:
1014 block_acct_start(blk_get_stats(s->blk), &s->acct,
1015 s->nsector * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE);
1016 break;
1017 default:
1018 break;
1019 }
1020
1021 ide_start_dma(s, ide_dma_cb);
1022 }
1023
1024 void ide_start_dma(IDEState *s, BlockCompletionFunc *cb)
1025 {
1026 s->io_buffer_index = 0;
1027 ide_set_retry(s);
1028 if (s->bus->dma->ops->start_dma) {
1029 s->bus->dma->ops->start_dma(s->bus->dma, s, cb);
1030 }
1031 }
1032
1033 static void ide_sector_write(IDEState *s);
1034
1035 static void ide_sector_write_timer_cb(void *opaque)
1036 {
1037 IDEState *s = opaque;
1038 ide_bus_set_irq(s->bus);
1039 }
1040
1041 static void ide_sector_write_cb(void *opaque, int ret)
1042 {
1043 IDEState *s = opaque;
1044 int n;
1045
1046 s->pio_aiocb = NULL;
1047 s->status &= ~BUSY_STAT;
1048
1049 if (ret != 0) {
1050 if (ide_handle_rw_error(s, -ret, IDE_RETRY_PIO)) {
1051 return;
1052 }
1053 }
1054
1055 block_acct_done(blk_get_stats(s->blk), &s->acct);
1056
1057 n = s->nsector;
1058 if (n > s->req_nb_sectors) {
1059 n = s->req_nb_sectors;
1060 }
1061 s->nsector -= n;
1062
1063 ide_set_sector(s, ide_get_sector(s) + n);
1064 if (s->nsector == 0) {
1065 /* no more sectors to write */
1066 ide_transfer_stop(s);
1067 } else {
1068 int n1 = s->nsector;
1069 if (n1 > s->req_nb_sectors) {
1070 n1 = s->req_nb_sectors;
1071 }
1072 ide_transfer_start(s, s->io_buffer, n1 * BDRV_SECTOR_SIZE,
1073 ide_sector_write);
1074 }
1075
1076 if (s->win2k_install_hack && ((++s->irq_count % 16) == 0)) {
1077 /* It seems there is a bug in the Windows 2000 installer HDD
1078 IDE driver which fills the disk with empty logs when the
1079 IDE write IRQ comes too early. This hack tries to correct
1080 that at the expense of slower write performances. Use this
1081 option _only_ to install Windows 2000. You must disable it
1082 for normal use. */
1083 timer_mod(s->sector_write_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1084 (NANOSECONDS_PER_SECOND / 1000));
1085 } else {
1086 ide_bus_set_irq(s->bus);
1087 }
1088 }
1089
1090 static void ide_sector_write(IDEState *s)
1091 {
1092 int64_t sector_num;
1093 int n;
1094
1095 s->status = READY_STAT | SEEK_STAT | BUSY_STAT;
1096 sector_num = ide_get_sector(s);
1097
1098 n = s->nsector;
1099 if (n > s->req_nb_sectors) {
1100 n = s->req_nb_sectors;
1101 }
1102
1103 trace_ide_sector_write(sector_num, n);
1104
1105 if (!ide_sect_range_ok(s, sector_num, n)) {
1106 ide_rw_error(s);
1107 block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_WRITE);
1108 return;
1109 }
1110
1111 qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
1112
1113 block_acct_start(blk_get_stats(s->blk), &s->acct,
1114 n * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE);
1115 s->pio_aiocb = blk_aio_pwritev(s->blk, sector_num << BDRV_SECTOR_BITS,
1116 &s->qiov, 0, ide_sector_write_cb, s);
1117 }
1118
1119 static void ide_flush_cb(void *opaque, int ret)
1120 {
1121 IDEState *s = opaque;
1122
1123 s->pio_aiocb = NULL;
1124
1125 if (ret < 0) {
1126 /* XXX: What sector number to set here? */
1127 if (ide_handle_rw_error(s, -ret, IDE_RETRY_FLUSH)) {
1128 return;
1129 }
1130 }
1131
1132 if (s->blk) {
1133 block_acct_done(blk_get_stats(s->blk), &s->acct);
1134 }
1135 s->status = READY_STAT | SEEK_STAT;
1136 ide_cmd_done(s);
1137 ide_bus_set_irq(s->bus);
1138 }
1139
1140 static void ide_flush_cache(IDEState *s)
1141 {
1142 if (s->blk == NULL) {
1143 ide_flush_cb(s, 0);
1144 return;
1145 }
1146
1147 s->status |= BUSY_STAT;
1148 ide_set_retry(s);
1149 block_acct_start(blk_get_stats(s->blk), &s->acct, 0, BLOCK_ACCT_FLUSH);
1150 s->pio_aiocb = blk_aio_flush(s->blk, ide_flush_cb, s);
1151 }
1152
1153 static void ide_cfata_metadata_inquiry(IDEState *s)
1154 {
1155 uint16_t *p;
1156 uint32_t spd;
1157
1158 p = (uint16_t *) s->io_buffer;
1159 memset(p, 0, 0x200);
1160 spd = ((s->mdata_size - 1) >> 9) + 1;
1161
1162 put_le16(p + 0, 0x0001); /* Data format revision */
1163 put_le16(p + 1, 0x0000); /* Media property: silicon */
1164 put_le16(p + 2, s->media_changed); /* Media status */
1165 put_le16(p + 3, s->mdata_size & 0xffff); /* Capacity in bytes (low) */
1166 put_le16(p + 4, s->mdata_size >> 16); /* Capacity in bytes (high) */
1167 put_le16(p + 5, spd & 0xffff); /* Sectors per device (low) */
1168 put_le16(p + 6, spd >> 16); /* Sectors per device (high) */
1169 }
1170
1171 static void ide_cfata_metadata_read(IDEState *s)
1172 {
1173 uint16_t *p;
1174
1175 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1176 s->status = ERR_STAT;
1177 s->error = ABRT_ERR;
1178 return;
1179 }
1180
1181 p = (uint16_t *) s->io_buffer;
1182 memset(p, 0, 0x200);
1183
1184 put_le16(p + 0, s->media_changed); /* Media status */
1185 memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1186 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1187 s->nsector << 9), 0x200 - 2));
1188 }
1189
1190 static void ide_cfata_metadata_write(IDEState *s)
1191 {
1192 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1193 s->status = ERR_STAT;
1194 s->error = ABRT_ERR;
1195 return;
1196 }
1197
1198 s->media_changed = 0;
1199
1200 memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1201 s->io_buffer + 2,
1202 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1203 s->nsector << 9), 0x200 - 2));
1204 }
1205
1206 /* called when the inserted state of the media has changed */
1207 static void ide_cd_change_cb(void *opaque, bool load, Error **errp)
1208 {
1209 IDEState *s = opaque;
1210 uint64_t nb_sectors;
1211
1212 s->tray_open = !load;
1213 blk_get_geometry(s->blk, &nb_sectors);
1214 s->nb_sectors = nb_sectors;
1215
1216 /*
1217 * First indicate to the guest that a CD has been removed. That's
1218 * done on the next command the guest sends us.
1219 *
1220 * Then we set UNIT_ATTENTION, by which the guest will
1221 * detect a new CD in the drive. See ide_atapi_cmd() for details.
1222 */
1223 s->cdrom_changed = 1;
1224 s->events.new_media = true;
1225 s->events.eject_request = false;
1226 ide_bus_set_irq(s->bus);
1227 }
1228
1229 static void ide_cd_eject_request_cb(void *opaque, bool force)
1230 {
1231 IDEState *s = opaque;
1232
1233 s->events.eject_request = true;
1234 if (force) {
1235 s->tray_locked = false;
1236 }
1237 ide_bus_set_irq(s->bus);
1238 }
1239
1240 static void ide_cmd_lba48_transform(IDEState *s, int lba48)
1241 {
1242 s->lba48 = lba48;
1243
1244 /* handle the 'magic' 0 nsector count conversion here. to avoid
1245 * fiddling with the rest of the read logic, we just store the
1246 * full sector count in ->nsector and ignore ->hob_nsector from now
1247 */
1248 if (!s->lba48) {
1249 if (!s->nsector)
1250 s->nsector = 256;
1251 } else {
1252 if (!s->nsector && !s->hob_nsector)
1253 s->nsector = 65536;
1254 else {
1255 int lo = s->nsector;
1256 int hi = s->hob_nsector;
1257
1258 s->nsector = (hi << 8) | lo;
1259 }
1260 }
1261 }
1262
1263 static void ide_clear_hob(IDEBus *bus)
1264 {
1265 /* any write clears HOB high bit of device control register */
1266 bus->cmd &= ~(IDE_CTRL_HOB);
1267 }
1268
1269 /* IOport [W]rite [R]egisters */
1270 enum ATA_IOPORT_WR {
1271 ATA_IOPORT_WR_DATA = 0,
1272 ATA_IOPORT_WR_FEATURES = 1,
1273 ATA_IOPORT_WR_SECTOR_COUNT = 2,
1274 ATA_IOPORT_WR_SECTOR_NUMBER = 3,
1275 ATA_IOPORT_WR_CYLINDER_LOW = 4,
1276 ATA_IOPORT_WR_CYLINDER_HIGH = 5,
1277 ATA_IOPORT_WR_DEVICE_HEAD = 6,
1278 ATA_IOPORT_WR_COMMAND = 7,
1279 ATA_IOPORT_WR_NUM_REGISTERS,
1280 };
1281
1282 const char *ATA_IOPORT_WR_lookup[ATA_IOPORT_WR_NUM_REGISTERS] = {
1283 [ATA_IOPORT_WR_DATA] = "Data",
1284 [ATA_IOPORT_WR_FEATURES] = "Features",
1285 [ATA_IOPORT_WR_SECTOR_COUNT] = "Sector Count",
1286 [ATA_IOPORT_WR_SECTOR_NUMBER] = "Sector Number",
1287 [ATA_IOPORT_WR_CYLINDER_LOW] = "Cylinder Low",
1288 [ATA_IOPORT_WR_CYLINDER_HIGH] = "Cylinder High",
1289 [ATA_IOPORT_WR_DEVICE_HEAD] = "Device/Head",
1290 [ATA_IOPORT_WR_COMMAND] = "Command"
1291 };
1292
1293 void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1294 {
1295 IDEBus *bus = opaque;
1296 IDEState *s = ide_bus_active_if(bus);
1297 int reg_num = addr & 7;
1298
1299 trace_ide_ioport_write(addr, ATA_IOPORT_WR_lookup[reg_num], val, bus, s);
1300
1301 /* ignore writes to command block while busy with previous command */
1302 if (reg_num != 7 && (s->status & (BUSY_STAT|DRQ_STAT))) {
1303 return;
1304 }
1305
1306 /* NOTE: Device0 and Device1 both receive incoming register writes.
1307 * (They're on the same bus! They have to!) */
1308
1309 switch (reg_num) {
1310 case 0:
1311 break;
1312 case ATA_IOPORT_WR_FEATURES:
1313 ide_clear_hob(bus);
1314 bus->ifs[0].hob_feature = bus->ifs[0].feature;
1315 bus->ifs[1].hob_feature = bus->ifs[1].feature;
1316 bus->ifs[0].feature = val;
1317 bus->ifs[1].feature = val;
1318 break;
1319 case ATA_IOPORT_WR_SECTOR_COUNT:
1320 ide_clear_hob(bus);
1321 bus->ifs[0].hob_nsector = bus->ifs[0].nsector;
1322 bus->ifs[1].hob_nsector = bus->ifs[1].nsector;
1323 bus->ifs[0].nsector = val;
1324 bus->ifs[1].nsector = val;
1325 break;
1326 case ATA_IOPORT_WR_SECTOR_NUMBER:
1327 ide_clear_hob(bus);
1328 bus->ifs[0].hob_sector = bus->ifs[0].sector;
1329 bus->ifs[1].hob_sector = bus->ifs[1].sector;
1330 bus->ifs[0].sector = val;
1331 bus->ifs[1].sector = val;
1332 break;
1333 case ATA_IOPORT_WR_CYLINDER_LOW:
1334 ide_clear_hob(bus);
1335 bus->ifs[0].hob_lcyl = bus->ifs[0].lcyl;
1336 bus->ifs[1].hob_lcyl = bus->ifs[1].lcyl;
1337 bus->ifs[0].lcyl = val;
1338 bus->ifs[1].lcyl = val;
1339 break;
1340 case ATA_IOPORT_WR_CYLINDER_HIGH:
1341 ide_clear_hob(bus);
1342 bus->ifs[0].hob_hcyl = bus->ifs[0].hcyl;
1343 bus->ifs[1].hob_hcyl = bus->ifs[1].hcyl;
1344 bus->ifs[0].hcyl = val;
1345 bus->ifs[1].hcyl = val;
1346 break;
1347 case ATA_IOPORT_WR_DEVICE_HEAD:
1348 ide_clear_hob(bus);
1349 bus->ifs[0].select = val | (ATA_DEV_ALWAYS_ON);
1350 bus->ifs[1].select = val | (ATA_DEV_ALWAYS_ON);
1351 /* select drive */
1352 bus->unit = (val & (ATA_DEV_SELECT)) ? 1 : 0;
1353 break;
1354 default:
1355 case ATA_IOPORT_WR_COMMAND:
1356 ide_clear_hob(bus);
1357 qemu_irq_lower(bus->irq);
1358 ide_bus_exec_cmd(bus, val);
1359 break;
1360 }
1361 }
1362
1363 static void ide_reset(IDEState *s, IDEResetKind kind)
1364 {
1365 trace_ide_reset(s);
1366
1367 if (s->pio_aiocb) {
1368 blk_aio_cancel(s->pio_aiocb);
1369 s->pio_aiocb = NULL;
1370 }
1371
1372 if (kind == IDE_RESET_HARDWARE || s->reset_reverts) {
1373 s->reset_reverts = false;
1374 s->heads = s->drive_heads;
1375 s->sectors = s->drive_sectors;
1376 /* An ATAPI device takes SET FEATURES 0xCC but has no translation */
1377 if (s->identify_set && s->drive_kind != IDE_CD) {
1378 ide_identify_chs(s);
1379 }
1380 }
1381 if (s->drive_kind == IDE_CFATA)
1382 s->mult_sectors = 0;
1383 else
1384 s->mult_sectors = MAX_MULT_SECTORS;
1385 /* ide regs */
1386 s->feature = 0;
1387 s->error = 0;
1388 s->nsector = 0;
1389 s->sector = 0;
1390 s->lcyl = 0;
1391 s->hcyl = 0;
1392
1393 /* lba48 */
1394 s->hob_feature = 0;
1395 s->hob_sector = 0;
1396 s->hob_nsector = 0;
1397 s->hob_lcyl = 0;
1398 s->hob_hcyl = 0;
1399
1400 s->select = (ATA_DEV_ALWAYS_ON);
1401 s->status = READY_STAT | SEEK_STAT;
1402
1403 s->lba48 = 0;
1404
1405 /* ATAPI specific */
1406 s->sense_key = 0;
1407 s->asc = 0;
1408 s->cdrom_changed = 0;
1409 s->packet_transfer_size = 0;
1410 s->elementary_transfer_size = 0;
1411 s->io_buffer_index = 0;
1412 s->cd_sector_size = 0;
1413 s->atapi_dma = 0;
1414 s->tray_locked = 0;
1415 s->tray_open = 0;
1416 /* ATA DMA state */
1417 s->io_buffer_size = 0;
1418 s->req_nb_sectors = 0;
1419
1420 ide_set_signature(s);
1421 /* init the transfer handler so that 0xffff is returned on data
1422 accesses */
1423 s->end_transfer_func = ide_dummy_transfer_stop;
1424 ide_dummy_transfer_stop(s);
1425 s->media_changed = 0;
1426 }
1427
1428 static bool cmd_nop(IDEState *s, uint8_t cmd)
1429 {
1430 return true;
1431 }
1432
1433 static bool cmd_device_reset(IDEState *s, uint8_t cmd)
1434 {
1435 /* Halt PIO (in the DRQ phase), then DMA */
1436 ide_transfer_halt(s);
1437 ide_cancel_dma_sync(s);
1438
1439 /* Reset any PIO commands, reset signature, etc */
1440 ide_reset(s, IDE_RESET_SOFTWARE);
1441
1442 /* RESET: ATA8-ACS3 7.10.4 "Normal Outputs";
1443 * ATA8-ACS3 Table 184 "Device Signatures for Normal Output" */
1444 s->status = 0x00;
1445
1446 /* Do not overwrite status register */
1447 return false;
1448 }
1449
1450 static bool cmd_data_set_management(IDEState *s, uint8_t cmd)
1451 {
1452 switch (s->feature) {
1453 case DSM_TRIM:
1454 if (s->blk) {
1455 ide_sector_start_dma(s, IDE_DMA_TRIM);
1456 return false;
1457 }
1458 break;
1459 }
1460
1461 ide_abort_command(s);
1462 return true;
1463 }
1464
1465 static bool cmd_identify(IDEState *s, uint8_t cmd)
1466 {
1467 if (s->blk && s->drive_kind != IDE_CD) {
1468 if (s->drive_kind != IDE_CFATA) {
1469 ide_identify(s);
1470 } else {
1471 ide_cfata_identify(s);
1472 }
1473 s->status = READY_STAT | SEEK_STAT;
1474 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1475 ide_bus_set_irq(s->bus);
1476 return false;
1477 } else {
1478 if (s->drive_kind == IDE_CD) {
1479 ide_set_signature(s);
1480 }
1481 ide_abort_command(s);
1482 }
1483
1484 return true;
1485 }
1486
1487 static bool cmd_verify(IDEState *s, uint8_t cmd)
1488 {
1489 bool lba48 = (cmd == WIN_VERIFY_EXT);
1490
1491 /* do sector number check ? */
1492 ide_cmd_lba48_transform(s, lba48);
1493
1494 return true;
1495 }
1496
1497 static bool cmd_set_multiple_mode(IDEState *s, uint8_t cmd)
1498 {
1499 if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
1500 /* Disable Read and Write Multiple */
1501 s->mult_sectors = 0;
1502 } else if ((s->nsector & 0xff) != 0 &&
1503 ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
1504 (s->nsector & (s->nsector - 1)) != 0)) {
1505 ide_abort_command(s);
1506 } else {
1507 s->mult_sectors = s->nsector & 0xff;
1508 }
1509
1510 return true;
1511 }
1512
1513 static bool cmd_read_multiple(IDEState *s, uint8_t cmd)
1514 {
1515 bool lba48 = (cmd == WIN_MULTREAD_EXT);
1516
1517 if (!s->blk || !s->mult_sectors) {
1518 ide_abort_command(s);
1519 return true;
1520 }
1521
1522 ide_cmd_lba48_transform(s, lba48);
1523 s->req_nb_sectors = s->mult_sectors;
1524 ide_sector_read(s);
1525 return false;
1526 }
1527
1528 static bool cmd_write_multiple(IDEState *s, uint8_t cmd)
1529 {
1530 bool lba48 = (cmd == WIN_MULTWRITE_EXT);
1531 int n;
1532
1533 if (!s->blk || !s->mult_sectors) {
1534 ide_abort_command(s);
1535 return true;
1536 }
1537
1538 ide_cmd_lba48_transform(s, lba48);
1539
1540 s->req_nb_sectors = s->mult_sectors;
1541 n = MIN(s->nsector, s->req_nb_sectors);
1542
1543 s->status = SEEK_STAT | READY_STAT;
1544 ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
1545
1546 s->media_changed = 1;
1547
1548 return false;
1549 }
1550
1551 static bool cmd_read_pio(IDEState *s, uint8_t cmd)
1552 {
1553 bool lba48 = (cmd == WIN_READ_EXT);
1554
1555 if (s->drive_kind == IDE_CD) {
1556 ide_set_signature(s); /* odd, but ATA4 8.27.5.2 requires it */
1557 ide_abort_command(s);
1558 return true;
1559 }
1560
1561 if (!s->blk) {
1562 ide_abort_command(s);
1563 return true;
1564 }
1565
1566 ide_cmd_lba48_transform(s, lba48);
1567 s->req_nb_sectors = 1;
1568 ide_sector_read(s);
1569
1570 return false;
1571 }
1572
1573 static bool cmd_write_pio(IDEState *s, uint8_t cmd)
1574 {
1575 bool lba48 = (cmd == WIN_WRITE_EXT);
1576
1577 if (!s->blk) {
1578 ide_abort_command(s);
1579 return true;
1580 }
1581
1582 ide_cmd_lba48_transform(s, lba48);
1583
1584 s->req_nb_sectors = 1;
1585 s->status = SEEK_STAT | READY_STAT;
1586 ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
1587
1588 s->media_changed = 1;
1589
1590 return false;
1591 }
1592
1593 static bool cmd_read_dma(IDEState *s, uint8_t cmd)
1594 {
1595 bool lba48 = (cmd == WIN_READDMA_EXT);
1596
1597 if (!s->blk) {
1598 ide_abort_command(s);
1599 return true;
1600 }
1601
1602 ide_cmd_lba48_transform(s, lba48);
1603 ide_sector_start_dma(s, IDE_DMA_READ);
1604
1605 return false;
1606 }
1607
1608 static bool cmd_write_dma(IDEState *s, uint8_t cmd)
1609 {
1610 bool lba48 = (cmd == WIN_WRITEDMA_EXT);
1611
1612 if (!s->blk) {
1613 ide_abort_command(s);
1614 return true;
1615 }
1616
1617 ide_cmd_lba48_transform(s, lba48);
1618 ide_sector_start_dma(s, IDE_DMA_WRITE);
1619
1620 s->media_changed = 1;
1621
1622 return false;
1623 }
1624
1625 static bool cmd_flush_cache(IDEState *s, uint8_t cmd)
1626 {
1627 ide_flush_cache(s);
1628 return false;
1629 }
1630
1631 static bool cmd_seek(IDEState *s, uint8_t cmd)
1632 {
1633 /* XXX: Check that seek is within bounds */
1634 return true;
1635 }
1636
1637 static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
1638 {
1639 bool lba48 = (cmd == WIN_READ_NATIVE_MAX_EXT);
1640
1641 /* Refuse if no sectors are addressable (e.g. medium not inserted) */
1642 if (s->nb_sectors == 0) {
1643 ide_abort_command(s);
1644 } else {
1645 /*
1646 * Save the active drive parameters, which may have been
1647 * limited from their native counterparts by, e.g., INITIALIZE
1648 * DEVICE PARAMETERS or SET MAX ADDRESS.
1649 */
1650 const int aheads = s->heads;
1651 const int asectors = s->sectors;
1652
1653 s->heads = s->drive_heads;
1654 s->sectors = s->drive_sectors;
1655
1656 ide_cmd_lba48_transform(s, lba48);
1657 ide_set_sector(s, s->nb_sectors - 1);
1658
1659 s->heads = aheads;
1660 s->sectors = asectors;
1661 }
1662
1663 return true;
1664 }
1665
1666 static bool cmd_check_power_mode(IDEState *s, uint8_t cmd)
1667 {
1668 s->nsector = 0xff; /* device active or idle */
1669 return true;
1670 }
1671
1672 /* INITIALIZE DEVICE PARAMETERS */
1673 static bool cmd_specify(IDEState *s, uint8_t cmd)
1674 {
1675 if (!s->blk || s->drive_kind == IDE_CD) {
1676 ide_abort_command(s);
1677 return true;
1678 }
1679
1680 /* ATA-2 D.2.8 limits IDENTIFY DEVICE word 56, and the count, to 1..255 */
1681 if (s->nsector == 0 || s->nsector > 255) {
1682 ide_abort_command(s);
1683 return true;
1684 }
1685
1686 s->heads = (s->select & (ATA_DEV_HS)) + 1;
1687 s->sectors = s->nsector;
1688 if (s->identify_set) {
1689 ide_identify_chs(s);
1690 }
1691
1692 return true;
1693 }
1694
1695 static bool cmd_set_features(IDEState *s, uint8_t cmd)
1696 {
1697 uint16_t *identify_data;
1698
1699 if (!s->blk) {
1700 ide_abort_command(s);
1701 return true;
1702 }
1703
1704 /* XXX: valid for CDROM ? */
1705 switch (s->feature) {
1706 case 0x01: /* 8-bit I/O enable (CompactFlash) */
1707 case 0x81: /* 8-bit I/O disable (CompactFlash) */
1708 if (s->drive_kind != IDE_CFATA) {
1709 goto abort_cmd;
1710 }
1711 s->io8 = !(s->feature & 0x80);
1712 return true;
1713 case 0x02: /* write cache enable */
1714 blk_set_enable_write_cache(s->blk, true);
1715 identify_data = (uint16_t *)s->identify_data;
1716 put_le16(identify_data + 85, (1 << 14) | (1 << 5) | 1);
1717 return true;
1718 case 0x82: /* write cache disable */
1719 blk_set_enable_write_cache(s->blk, false);
1720 identify_data = (uint16_t *)s->identify_data;
1721 put_le16(identify_data + 85, (1 << 14) | 1);
1722 ide_flush_cache(s);
1723 return false;
1724 case 0xcc: /* reverting to power-on defaults enable */
1725 s->reset_reverts = true;
1726 return true;
1727 case 0x66: /* reverting to power-on defaults disable */
1728 s->reset_reverts = false;
1729 return true;
1730 case 0xaa: /* read look-ahead enable */
1731 case 0x55: /* read look-ahead disable */
1732 case 0x05: /* set advanced power management mode */
1733 case 0x85: /* disable advanced power management mode */
1734 case 0x69: /* NOP */
1735 case 0x67: /* NOP */
1736 case 0x96: /* NOP */
1737 case 0x9a: /* NOP */
1738 case 0x42: /* enable Automatic Acoustic Mode */
1739 case 0xc2: /* disable Automatic Acoustic Mode */
1740 return true;
1741 case 0x03: /* set transfer mode */
1742 {
1743 uint8_t val = s->nsector & 0x07;
1744 identify_data = (uint16_t *)s->identify_data;
1745
1746 switch (s->nsector >> 3) {
1747 case 0x00: /* pio default */
1748 case 0x01: /* pio mode */
1749 put_le16(identify_data + 62, 0x07);
1750 put_le16(identify_data + 63, 0x07);
1751 put_le16(identify_data + 88, 0x3f);
1752 break;
1753 case 0x02: /* single word dma mode */
1754 put_le16(identify_data + 62, 0x07 | (1 << (val + 8)));
1755 put_le16(identify_data + 63, 0x07);
1756 put_le16(identify_data + 88, 0x3f);
1757 break;
1758 case 0x04: /* mdma mode */
1759 put_le16(identify_data + 62, 0x07);
1760 put_le16(identify_data + 63, 0x07 | (1 << (val + 8)));
1761 put_le16(identify_data + 88, 0x3f);
1762 break;
1763 case 0x08: /* udma mode */
1764 put_le16(identify_data + 62, 0x07);
1765 put_le16(identify_data + 63, 0x07);
1766 put_le16(identify_data + 88, 0x3f | (1 << (val + 8)));
1767 break;
1768 default:
1769 goto abort_cmd;
1770 }
1771 return true;
1772 }
1773 }
1774
1775 abort_cmd:
1776 ide_abort_command(s);
1777 return true;
1778 }
1779
1780
1781 /*** ATAPI commands ***/
1782
1783 static bool cmd_identify_packet(IDEState *s, uint8_t cmd)
1784 {
1785 ide_atapi_identify(s);
1786 s->status = READY_STAT | SEEK_STAT;
1787 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1788 ide_bus_set_irq(s->bus);
1789 return false;
1790 }
1791
1792 /* EXECUTE DEVICE DIAGNOSTIC */
1793 static bool cmd_exec_dev_diagnostic(IDEState *s, uint8_t cmd)
1794 {
1795 /*
1796 * Clear the device register per the ATA (v6) specification,
1797 * because ide_set_signature does not clear LBA or drive bits.
1798 */
1799 s->select = (ATA_DEV_ALWAYS_ON);
1800 ide_set_signature(s);
1801
1802 if (s->drive_kind == IDE_CD) {
1803 s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
1804 * devices to return a clear status register
1805 * with READY_STAT *not* set. */
1806 s->error = 0x01;
1807 } else {
1808 s->status = READY_STAT | SEEK_STAT;
1809 /* The bits of the error register are not as usual for this command!
1810 * They are part of the regular output (this is why ERR_STAT isn't set)
1811 * Device 0 passed, Device 1 passed or not present. */
1812 s->error = 0x01;
1813 ide_bus_set_irq(s->bus);
1814 }
1815
1816 return false;
1817 }
1818
1819 static bool cmd_packet(IDEState *s, uint8_t cmd)
1820 {
1821 /* overlapping commands not supported */
1822 if (s->feature & 0x02) {
1823 ide_abort_command(s);
1824 return true;
1825 }
1826
1827 s->status = READY_STAT | SEEK_STAT;
1828 s->atapi_dma = s->feature & 1;
1829 if (s->atapi_dma) {
1830 s->dma_cmd = IDE_DMA_ATAPI;
1831 }
1832 s->nsector = 1;
1833 ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
1834 ide_atapi_cmd);
1835 return false;
1836 }
1837
1838
1839 /*** CF-ATA commands ***/
1840
1841 static bool cmd_cfa_req_ext_error_code(IDEState *s, uint8_t cmd)
1842 {
1843 s->error = 0x09; /* miscellaneous error */
1844 s->status = READY_STAT | SEEK_STAT;
1845 ide_bus_set_irq(s->bus);
1846
1847 return false;
1848 }
1849
1850 static bool cmd_cfa_erase_sectors(IDEState *s, uint8_t cmd)
1851 {
1852 /* WIN_SECURITY_FREEZE_LOCK has the same ID as CFA_WEAR_LEVEL and is
1853 * required for Windows 8 to work with AHCI */
1854
1855 if (cmd == CFA_WEAR_LEVEL) {
1856 s->nsector = 0;
1857 }
1858
1859 if (cmd == CFA_ERASE_SECTORS) {
1860 s->media_changed = 1;
1861 }
1862
1863 return true;
1864 }
1865
1866 static bool cmd_cfa_translate_sector(IDEState *s, uint8_t cmd)
1867 {
1868 s->status = READY_STAT | SEEK_STAT;
1869
1870 memset(s->io_buffer, 0, 0x200);
1871 s->io_buffer[0x00] = s->hcyl; /* Cyl MSB */
1872 s->io_buffer[0x01] = s->lcyl; /* Cyl LSB */
1873 s->io_buffer[0x02] = s->select; /* Head */
1874 s->io_buffer[0x03] = s->sector; /* Sector */
1875 s->io_buffer[0x04] = ide_get_sector(s) >> 16; /* LBA MSB */
1876 s->io_buffer[0x05] = ide_get_sector(s) >> 8; /* LBA */
1877 s->io_buffer[0x06] = ide_get_sector(s) >> 0; /* LBA LSB */
1878 s->io_buffer[0x13] = 0x00; /* Erase flag */
1879 s->io_buffer[0x18] = 0x00; /* Hot count */
1880 s->io_buffer[0x19] = 0x00; /* Hot count */
1881 s->io_buffer[0x1a] = 0x01; /* Hot count */
1882
1883 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1884 ide_bus_set_irq(s->bus);
1885
1886 return false;
1887 }
1888
1889 static bool cmd_cfa_access_metadata_storage(IDEState *s, uint8_t cmd)
1890 {
1891 switch (s->feature) {
1892 case 0x02: /* Inquiry Metadata Storage */
1893 ide_cfata_metadata_inquiry(s);
1894 break;
1895 case 0x03: /* Read Metadata Storage */
1896 ide_cfata_metadata_read(s);
1897 break;
1898 case 0x04: /* Write Metadata Storage */
1899 ide_cfata_metadata_write(s);
1900 break;
1901 default:
1902 ide_abort_command(s);
1903 return true;
1904 }
1905
1906 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1907 s->status = 0x00; /* NOTE: READY is _not_ set */
1908 ide_bus_set_irq(s->bus);
1909
1910 return false;
1911 }
1912
1913 static bool cmd_ibm_sense_condition(IDEState *s, uint8_t cmd)
1914 {
1915 switch (s->feature) {
1916 case 0x01: /* sense temperature in device */
1917 s->nsector = 0x50; /* +20 C */
1918 break;
1919 default:
1920 ide_abort_command(s);
1921 return true;
1922 }
1923
1924 return true;
1925 }
1926
1927
1928 /*** SMART commands ***/
1929
1930 static bool cmd_smart(IDEState *s, uint8_t cmd)
1931 {
1932 int n;
1933
1934 if (s->hcyl != 0xc2 || s->lcyl != 0x4f) {
1935 goto abort_cmd;
1936 }
1937
1938 if (!s->smart_enabled && s->feature != SMART_ENABLE) {
1939 goto abort_cmd;
1940 }
1941
1942 switch (s->feature) {
1943 case SMART_DISABLE:
1944 s->smart_enabled = 0;
1945 return true;
1946
1947 case SMART_ENABLE:
1948 s->smart_enabled = 1;
1949 return true;
1950
1951 case SMART_ATTR_AUTOSAVE:
1952 switch (s->sector) {
1953 case 0x00:
1954 s->smart_autosave = 0;
1955 break;
1956 case 0xf1:
1957 s->smart_autosave = 1;
1958 break;
1959 default:
1960 goto abort_cmd;
1961 }
1962 return true;
1963
1964 case SMART_STATUS:
1965 if (!s->smart_errors) {
1966 s->hcyl = 0xc2;
1967 s->lcyl = 0x4f;
1968 } else {
1969 s->hcyl = 0x2c;
1970 s->lcyl = 0xf4;
1971 }
1972 return true;
1973
1974 case SMART_READ_THRESH:
1975 memset(s->io_buffer, 0, 0x200);
1976 s->io_buffer[0] = 0x01; /* smart struct version */
1977
1978 for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
1979 s->io_buffer[2 + 0 + (n * 12)] = smart_attributes[n][0];
1980 s->io_buffer[2 + 1 + (n * 12)] = smart_attributes[n][11];
1981 }
1982
1983 /* checksum */
1984 for (n = 0; n < 511; n++) {
1985 s->io_buffer[511] += s->io_buffer[n];
1986 }
1987 s->io_buffer[511] = 0x100 - s->io_buffer[511];
1988
1989 s->status = READY_STAT | SEEK_STAT;
1990 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1991 ide_bus_set_irq(s->bus);
1992 return false;
1993
1994 case SMART_READ_DATA:
1995 memset(s->io_buffer, 0, 0x200);
1996 s->io_buffer[0] = 0x01; /* smart struct version */
1997
1998 for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
1999 int i;
2000 for (i = 0; i < 11; i++) {
2001 s->io_buffer[2 + i + (n * 12)] = smart_attributes[n][i];
2002 }
2003 }
2004
2005 s->io_buffer[362] = 0x02 | (s->smart_autosave ? 0x80 : 0x00);
2006 if (s->smart_selftest_count == 0) {
2007 s->io_buffer[363] = 0;
2008 } else {
2009 s->io_buffer[363] =
2010 s->smart_selftest_data[3 +
2011 (s->smart_selftest_count - 1) *
2012 24];
2013 }
2014 s->io_buffer[364] = 0x20;
2015 s->io_buffer[365] = 0x01;
2016 /* offline data collection capacity: execute + self-test*/
2017 s->io_buffer[367] = (1 << 4 | 1 << 3 | 1);
2018 s->io_buffer[368] = 0x03; /* smart capability (1) */
2019 s->io_buffer[369] = 0x00; /* smart capability (2) */
2020 s->io_buffer[370] = 0x01; /* error logging supported */
2021 s->io_buffer[372] = 0x02; /* minutes for poll short test */
2022 s->io_buffer[373] = 0x36; /* minutes for poll ext test */
2023 s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
2024
2025 for (n = 0; n < 511; n++) {
2026 s->io_buffer[511] += s->io_buffer[n];
2027 }
2028 s->io_buffer[511] = 0x100 - s->io_buffer[511];
2029
2030 s->status = READY_STAT | SEEK_STAT;
2031 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2032 ide_bus_set_irq(s->bus);
2033 return false;
2034
2035 case SMART_READ_LOG:
2036 switch (s->sector) {
2037 case 0x01: /* summary smart error log */
2038 memset(s->io_buffer, 0, 0x200);
2039 s->io_buffer[0] = 0x01;
2040 s->io_buffer[1] = 0x00; /* no error entries */
2041 s->io_buffer[452] = s->smart_errors & 0xff;
2042 s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
2043
2044 for (n = 0; n < 511; n++) {
2045 s->io_buffer[511] += s->io_buffer[n];
2046 }
2047 s->io_buffer[511] = 0x100 - s->io_buffer[511];
2048 break;
2049 case 0x06: /* smart self test log */
2050 memset(s->io_buffer, 0, 0x200);
2051 s->io_buffer[0] = 0x01;
2052 if (s->smart_selftest_count == 0) {
2053 s->io_buffer[508] = 0;
2054 } else {
2055 s->io_buffer[508] = s->smart_selftest_count;
2056 for (n = 2; n < 506; n++) {
2057 s->io_buffer[n] = s->smart_selftest_data[n];
2058 }
2059 }
2060
2061 for (n = 0; n < 511; n++) {
2062 s->io_buffer[511] += s->io_buffer[n];
2063 }
2064 s->io_buffer[511] = 0x100 - s->io_buffer[511];
2065 break;
2066 default:
2067 goto abort_cmd;
2068 }
2069 s->status = READY_STAT | SEEK_STAT;
2070 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2071 ide_bus_set_irq(s->bus);
2072 return false;
2073
2074 case SMART_EXECUTE_OFFLINE:
2075 switch (s->sector) {
2076 case 0: /* off-line routine */
2077 case 1: /* short self test */
2078 case 2: /* extended self test */
2079 s->smart_selftest_count++;
2080 if (s->smart_selftest_count > 21) {
2081 s->smart_selftest_count = 1;
2082 }
2083 n = 2 + (s->smart_selftest_count - 1) * 24;
2084 s->smart_selftest_data[n] = s->sector;
2085 s->smart_selftest_data[n + 1] = 0x00; /* OK and finished */
2086 s->smart_selftest_data[n + 2] = 0x34; /* hour count lsb */
2087 s->smart_selftest_data[n + 3] = 0x12; /* hour count msb */
2088 break;
2089 default:
2090 goto abort_cmd;
2091 }
2092 return true;
2093 }
2094
2095 abort_cmd:
2096 ide_abort_command(s);
2097 return true;
2098 }
2099
2100 #define HD_OK (1u << IDE_HD)
2101 #define CD_OK (1u << IDE_CD)
2102 #define CFA_OK (1u << IDE_CFATA)
2103 #define HD_CFA_OK (HD_OK | CFA_OK)
2104 #define ALL_OK (HD_OK | CD_OK | CFA_OK)
2105
2106 /* Set the Disk Seek Completed status bit during completion */
2107 #define SET_DSC (1u << 8)
2108
2109 /* See ACS-2 T13/2015-D Table B.2 Command codes */
2110 static const struct {
2111 /* Returns true if the completion code should be run */
2112 bool (*handler)(IDEState *s, uint8_t cmd);
2113 int flags;
2114 } ide_cmd_table[0x100] = {
2115 /* NOP not implemented, mandatory for CD */
2116 [CFA_REQ_EXT_ERROR_CODE] = { cmd_cfa_req_ext_error_code, CFA_OK },
2117 [WIN_DSM] = { cmd_data_set_management, HD_CFA_OK },
2118 [WIN_DEVICE_RESET] = { cmd_device_reset, CD_OK },
2119 [WIN_RECAL] = { cmd_nop, HD_CFA_OK | SET_DSC},
2120 [WIN_READ] = { cmd_read_pio, ALL_OK },
2121 [WIN_READ_ONCE] = { cmd_read_pio, HD_CFA_OK },
2122 [WIN_READ_EXT] = { cmd_read_pio, HD_CFA_OK },
2123 [WIN_READDMA_EXT] = { cmd_read_dma, HD_CFA_OK },
2124 [WIN_READ_NATIVE_MAX_EXT] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
2125 [WIN_MULTREAD_EXT] = { cmd_read_multiple, HD_CFA_OK },
2126 [WIN_WRITE] = { cmd_write_pio, HD_CFA_OK },
2127 [WIN_WRITE_ONCE] = { cmd_write_pio, HD_CFA_OK },
2128 [WIN_WRITE_EXT] = { cmd_write_pio, HD_CFA_OK },
2129 [WIN_WRITEDMA_EXT] = { cmd_write_dma, HD_CFA_OK },
2130 [CFA_WRITE_SECT_WO_ERASE] = { cmd_write_pio, CFA_OK },
2131 [WIN_MULTWRITE_EXT] = { cmd_write_multiple, HD_CFA_OK },
2132 [WIN_WRITE_VERIFY] = { cmd_write_pio, HD_CFA_OK },
2133 [WIN_VERIFY] = { cmd_verify, HD_CFA_OK | SET_DSC },
2134 [WIN_VERIFY_ONCE] = { cmd_verify, HD_CFA_OK | SET_DSC },
2135 [WIN_VERIFY_EXT] = { cmd_verify, HD_CFA_OK | SET_DSC },
2136 [WIN_SEEK] = { cmd_seek, HD_CFA_OK | SET_DSC },
2137 [CFA_TRANSLATE_SECTOR] = { cmd_cfa_translate_sector, CFA_OK },
2138 [WIN_DIAGNOSE] = { cmd_exec_dev_diagnostic, ALL_OK },
2139 [WIN_SPECIFY] = { cmd_specify, HD_CFA_OK | SET_DSC },
2140 [WIN_STANDBYNOW2] = { cmd_nop, HD_CFA_OK },
2141 [WIN_IDLEIMMEDIATE2] = { cmd_nop, HD_CFA_OK },
2142 [WIN_STANDBY2] = { cmd_nop, HD_CFA_OK },
2143 [WIN_SETIDLE2] = { cmd_nop, HD_CFA_OK },
2144 [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
2145 [WIN_SLEEPNOW2] = { cmd_nop, HD_CFA_OK },
2146 [WIN_PACKETCMD] = { cmd_packet, CD_OK },
2147 [WIN_PIDENTIFY] = { cmd_identify_packet, CD_OK },
2148 [WIN_SMART] = { cmd_smart, HD_CFA_OK | SET_DSC },
2149 [CFA_ACCESS_METADATA_STORAGE] = { cmd_cfa_access_metadata_storage, CFA_OK },
2150 [CFA_ERASE_SECTORS] = { cmd_cfa_erase_sectors, CFA_OK | SET_DSC },
2151 [WIN_MULTREAD] = { cmd_read_multiple, HD_CFA_OK },
2152 [WIN_MULTWRITE] = { cmd_write_multiple, HD_CFA_OK },
2153 [WIN_SETMULT] = { cmd_set_multiple_mode, HD_CFA_OK | SET_DSC },
2154 [WIN_READDMA] = { cmd_read_dma, HD_CFA_OK },
2155 [WIN_READDMA_ONCE] = { cmd_read_dma, HD_CFA_OK },
2156 [WIN_WRITEDMA] = { cmd_write_dma, HD_CFA_OK },
2157 [WIN_WRITEDMA_ONCE] = { cmd_write_dma, HD_CFA_OK },
2158 [CFA_WRITE_MULTI_WO_ERASE] = { cmd_write_multiple, CFA_OK },
2159 [WIN_STANDBYNOW1] = { cmd_nop, HD_CFA_OK },
2160 [WIN_IDLEIMMEDIATE] = { cmd_nop, HD_CFA_OK },
2161 [WIN_STANDBY] = { cmd_nop, HD_CFA_OK },
2162 [WIN_SETIDLE1] = { cmd_nop, HD_CFA_OK },
2163 [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
2164 [WIN_SLEEPNOW1] = { cmd_nop, HD_CFA_OK },
2165 [WIN_FLUSH_CACHE] = { cmd_flush_cache, ALL_OK },
2166 [WIN_FLUSH_CACHE_EXT] = { cmd_flush_cache, HD_CFA_OK },
2167 [WIN_IDENTIFY] = { cmd_identify, ALL_OK },
2168 [WIN_SETFEATURES] = { cmd_set_features, ALL_OK | SET_DSC },
2169 [IBM_SENSE_CONDITION] = { cmd_ibm_sense_condition, CFA_OK | SET_DSC },
2170 [CFA_WEAR_LEVEL] = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC },
2171 [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
2172 };
2173
2174 static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
2175 {
2176 return cmd < ARRAY_SIZE(ide_cmd_table)
2177 && (ide_cmd_table[cmd].flags & (1u << s->drive_kind));
2178 }
2179
2180 void ide_bus_exec_cmd(IDEBus *bus, uint32_t val)
2181 {
2182 IDEState *s;
2183 bool complete;
2184
2185 s = ide_bus_active_if(bus);
2186 trace_ide_bus_exec_cmd(bus, s, val);
2187
2188 /* ignore commands to non existent slave */
2189 if (s != bus->ifs && !s->blk) {
2190 return;
2191 }
2192
2193 /* Only RESET is allowed while BSY and/or DRQ are set,
2194 * and only to ATAPI devices. */
2195 if (s->status & (BUSY_STAT|DRQ_STAT)) {
2196 if (val != WIN_DEVICE_RESET || s->drive_kind != IDE_CD) {
2197 return;
2198 }
2199 }
2200
2201 if (!ide_cmd_permitted(s, val)) {
2202 ide_abort_command(s);
2203 ide_bus_set_irq(s->bus);
2204 return;
2205 }
2206
2207 s->status = READY_STAT | BUSY_STAT;
2208 s->error = 0;
2209 s->io_buffer_offset = 0;
2210
2211 complete = ide_cmd_table[val].handler(s, val);
2212 if (complete) {
2213 s->status &= ~BUSY_STAT;
2214 assert(!!s->error == !!(s->status & ERR_STAT));
2215
2216 if ((ide_cmd_table[val].flags & SET_DSC) && !s->error) {
2217 s->status |= SEEK_STAT;
2218 }
2219
2220 ide_cmd_done(s);
2221 ide_bus_set_irq(s->bus);
2222 }
2223 }
2224
2225 /* IOport [R]ead [R]egisters */
2226 enum ATA_IOPORT_RR {
2227 ATA_IOPORT_RR_DATA = 0,
2228 ATA_IOPORT_RR_ERROR = 1,
2229 ATA_IOPORT_RR_SECTOR_COUNT = 2,
2230 ATA_IOPORT_RR_SECTOR_NUMBER = 3,
2231 ATA_IOPORT_RR_CYLINDER_LOW = 4,
2232 ATA_IOPORT_RR_CYLINDER_HIGH = 5,
2233 ATA_IOPORT_RR_DEVICE_HEAD = 6,
2234 ATA_IOPORT_RR_STATUS = 7,
2235 ATA_IOPORT_RR_NUM_REGISTERS,
2236 };
2237
2238 const char *ATA_IOPORT_RR_lookup[ATA_IOPORT_RR_NUM_REGISTERS] = {
2239 [ATA_IOPORT_RR_DATA] = "Data",
2240 [ATA_IOPORT_RR_ERROR] = "Error",
2241 [ATA_IOPORT_RR_SECTOR_COUNT] = "Sector Count",
2242 [ATA_IOPORT_RR_SECTOR_NUMBER] = "Sector Number",
2243 [ATA_IOPORT_RR_CYLINDER_LOW] = "Cylinder Low",
2244 [ATA_IOPORT_RR_CYLINDER_HIGH] = "Cylinder High",
2245 [ATA_IOPORT_RR_DEVICE_HEAD] = "Device/Head",
2246 [ATA_IOPORT_RR_STATUS] = "Status"
2247 };
2248
2249 uint32_t ide_ioport_read(void *opaque, uint32_t addr)
2250 {
2251 IDEBus *bus = opaque;
2252 IDEState *s = ide_bus_active_if(bus);
2253 uint32_t reg_num;
2254 int ret, hob;
2255
2256 reg_num = addr & 7;
2257 hob = bus->cmd & (IDE_CTRL_HOB);
2258 switch (reg_num) {
2259 case ATA_IOPORT_RR_DATA:
2260 /*
2261 * The pre-GRUB Solaris x86 bootloader relies upon inb
2262 * consuming a word from the drive's sector buffer.
2263 */
2264 ret = ide_data_readw(bus, addr) & 0xff;
2265 break;
2266 case ATA_IOPORT_RR_ERROR:
2267 if ((!bus->ifs[0].blk && !bus->ifs[1].blk) ||
2268 (s != bus->ifs && !s->blk)) {
2269 ret = 0;
2270 } else if (!hob) {
2271 ret = s->error;
2272 } else {
2273 ret = s->hob_feature;
2274 }
2275 break;
2276 case ATA_IOPORT_RR_SECTOR_COUNT:
2277 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2278 ret = 0;
2279 } else if (!hob) {
2280 ret = s->nsector & 0xff;
2281 } else {
2282 ret = s->hob_nsector;
2283 }
2284 break;
2285 case ATA_IOPORT_RR_SECTOR_NUMBER:
2286 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2287 ret = 0;
2288 } else if (!hob) {
2289 ret = s->sector;
2290 } else {
2291 ret = s->hob_sector;
2292 }
2293 break;
2294 case ATA_IOPORT_RR_CYLINDER_LOW:
2295 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2296 ret = 0;
2297 } else if (!hob) {
2298 ret = s->lcyl;
2299 } else {
2300 ret = s->hob_lcyl;
2301 }
2302 break;
2303 case ATA_IOPORT_RR_CYLINDER_HIGH:
2304 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2305 ret = 0;
2306 } else if (!hob) {
2307 ret = s->hcyl;
2308 } else {
2309 ret = s->hob_hcyl;
2310 }
2311 break;
2312 case ATA_IOPORT_RR_DEVICE_HEAD:
2313 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2314 ret = 0;
2315 } else {
2316 ret = s->select;
2317 }
2318 break;
2319 default:
2320 case ATA_IOPORT_RR_STATUS:
2321 if ((!bus->ifs[0].blk && !bus->ifs[1].blk) ||
2322 (s != bus->ifs && !s->blk)) {
2323 ret = 0;
2324 } else {
2325 ret = s->status;
2326 }
2327 qemu_irq_lower(bus->irq);
2328 break;
2329 }
2330
2331 trace_ide_ioport_read(addr, ATA_IOPORT_RR_lookup[reg_num], ret, bus, s);
2332 return ret;
2333 }
2334
2335 uint32_t ide_status_read(void *opaque, uint32_t addr)
2336 {
2337 IDEBus *bus = opaque;
2338 IDEState *s = ide_bus_active_if(bus);
2339 int ret;
2340
2341 if ((!bus->ifs[0].blk && !bus->ifs[1].blk) ||
2342 (s != bus->ifs && !s->blk)) {
2343 ret = 0;
2344 } else {
2345 ret = s->status;
2346 }
2347
2348 trace_ide_status_read(addr, ret, bus, s);
2349 return ret;
2350 }
2351
2352 static void ide_perform_srst(IDEState *s)
2353 {
2354 s->status |= BUSY_STAT;
2355
2356 /* Halt PIO (Via register state); PIO BH remains scheduled. */
2357 ide_transfer_halt(s);
2358
2359 /* Cancel DMA -- may drain block device and invoke callbacks */
2360 ide_cancel_dma_sync(s);
2361
2362 /* Cancel PIO callback, reset registers/signature, etc */
2363 ide_reset(s, IDE_RESET_SOFTWARE);
2364
2365 /* perform diagnostic */
2366 cmd_exec_dev_diagnostic(s, WIN_DIAGNOSE);
2367 }
2368
2369 static void ide_bus_perform_srst(void *opaque)
2370 {
2371 IDEBus *bus = opaque;
2372 IDEState *s;
2373 int i;
2374
2375 for (i = 0; i < 2; i++) {
2376 s = &bus->ifs[i];
2377 ide_perform_srst(s);
2378 }
2379
2380 bus->cmd &= ~IDE_CTRL_RESET;
2381 }
2382
2383 void ide_ctrl_write(void *opaque, uint32_t addr, uint32_t val)
2384 {
2385 IDEBus *bus = opaque;
2386 IDEState *s;
2387 int i;
2388
2389 trace_ide_ctrl_write(addr, val, bus);
2390
2391 /* Device0 and Device1 each have their own control register,
2392 * but QEMU models it as just one register in the controller. */
2393 if (!(bus->cmd & IDE_CTRL_RESET) && (val & IDE_CTRL_RESET)) {
2394 for (i = 0; i < 2; i++) {
2395 s = &bus->ifs[i];
2396 s->status |= BUSY_STAT;
2397 }
2398 replay_bh_schedule_oneshot_event(qemu_get_aio_context(),
2399 ide_bus_perform_srst, bus);
2400 }
2401
2402 bus->cmd = val;
2403 }
2404
2405 /*
2406 * Returns true if the running PIO transfer is a PIO out (i.e. data is
2407 * transferred from the device to the guest), false if it's a PIO in
2408 */
2409 static bool ide_is_pio_out(IDEState *s)
2410 {
2411 if (s->end_transfer_func == ide_sector_write ||
2412 s->end_transfer_func == ide_atapi_cmd) {
2413 return false;
2414 } else if (s->end_transfer_func == ide_sector_read ||
2415 s->end_transfer_func == ide_transfer_stop ||
2416 s->end_transfer_func == ide_atapi_cmd_reply_end ||
2417 s->end_transfer_func == ide_dummy_transfer_stop) {
2418 return true;
2419 }
2420
2421 abort();
2422 }
2423
2424 void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
2425 {
2426 IDEBus *bus = opaque;
2427 IDEState *s = ide_bus_active_if(bus);
2428 uint8_t *p;
2429
2430 trace_ide_data_writew(addr, val, bus, s);
2431
2432 /* PIO data access allowed only when DRQ bit is set. The result of a write
2433 * during PIO out is indeterminate, just ignore it. */
2434 if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
2435 return;
2436 }
2437
2438 p = s->data_ptr;
2439 if (s->io8) {
2440 if (p + 1 > s->data_end) {
2441 return;
2442 }
2443
2444 *p++ = val;
2445 } else {
2446 if (p + 2 > s->data_end) {
2447 return;
2448 }
2449
2450 *(uint16_t *)p = le16_to_cpu(val);
2451 p += 2;
2452 }
2453 s->data_ptr = p;
2454 if (p >= s->data_end) {
2455 s->status &= ~DRQ_STAT;
2456 s->end_transfer_func(s);
2457 }
2458 }
2459
2460 uint32_t ide_data_readw(void *opaque, uint32_t addr)
2461 {
2462 IDEBus *bus = opaque;
2463 IDEState *s = ide_bus_active_if(bus);
2464 uint8_t *p;
2465 int ret;
2466
2467 /* PIO data access allowed only when DRQ bit is set. The result of a read
2468 * during PIO in is indeterminate, return 0 and don't move forward. */
2469 if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
2470 return 0;
2471 }
2472
2473 p = s->data_ptr;
2474 if (s->io8) {
2475 if (p + 1 > s->data_end) {
2476 return 0;
2477 }
2478
2479 ret = *p++;
2480 } else {
2481 if (p + 2 > s->data_end) {
2482 return 0;
2483 }
2484
2485 ret = cpu_to_le16(*(uint16_t *)p);
2486 p += 2;
2487 }
2488 s->data_ptr = p;
2489 if (p >= s->data_end) {
2490 s->status &= ~DRQ_STAT;
2491 s->end_transfer_func(s);
2492 }
2493
2494 trace_ide_data_readw(addr, ret, bus, s);
2495 return ret;
2496 }
2497
2498 void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
2499 {
2500 IDEBus *bus = opaque;
2501 IDEState *s = ide_bus_active_if(bus);
2502 uint8_t *p;
2503
2504 trace_ide_data_writel(addr, val, bus, s);
2505
2506 /* PIO data access allowed only when DRQ bit is set. The result of a write
2507 * during PIO out is indeterminate, just ignore it. */
2508 if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
2509 return;
2510 }
2511
2512 p = s->data_ptr;
2513 if (p + 4 > s->data_end) {
2514 return;
2515 }
2516
2517 *(uint32_t *)p = le32_to_cpu(val);
2518 p += 4;
2519 s->data_ptr = p;
2520 if (p >= s->data_end) {
2521 s->status &= ~DRQ_STAT;
2522 s->end_transfer_func(s);
2523 }
2524 }
2525
2526 uint32_t ide_data_readl(void *opaque, uint32_t addr)
2527 {
2528 IDEBus *bus = opaque;
2529 IDEState *s = ide_bus_active_if(bus);
2530 uint8_t *p;
2531 int ret;
2532
2533 /* PIO data access allowed only when DRQ bit is set. The result of a read
2534 * during PIO in is indeterminate, return 0 and don't move forward. */
2535 if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
2536 ret = 0;
2537 goto out;
2538 }
2539
2540 p = s->data_ptr;
2541 if (p + 4 > s->data_end) {
2542 return 0;
2543 }
2544
2545 ret = cpu_to_le32(*(uint32_t *)p);
2546 p += 4;
2547 s->data_ptr = p;
2548 if (p >= s->data_end) {
2549 s->status &= ~DRQ_STAT;
2550 s->end_transfer_func(s);
2551 }
2552
2553 out:
2554 trace_ide_data_readl(addr, ret, bus, s);
2555 return ret;
2556 }
2557
2558 static void ide_dummy_transfer_stop(IDEState *s)
2559 {
2560 s->data_ptr = s->io_buffer;
2561 s->data_end = s->io_buffer;
2562 s->io_buffer[0] = 0xff;
2563 s->io_buffer[1] = 0xff;
2564 s->io_buffer[2] = 0xff;
2565 s->io_buffer[3] = 0xff;
2566 }
2567
2568 void ide_bus_reset(IDEBus *bus, IDEResetKind kind)
2569 {
2570 /* pending async DMA - needs the IDEState before it is reset */
2571 if (bus->dma->aiocb) {
2572 trace_ide_bus_reset_aio();
2573 blk_aio_cancel(bus->dma->aiocb);
2574 bus->dma->aiocb = NULL;
2575 }
2576
2577 bus->unit = 0;
2578 bus->cmd = 0;
2579 ide_reset(&bus->ifs[0], kind);
2580 ide_reset(&bus->ifs[1], kind);
2581 ide_clear_hob(bus);
2582
2583 /* reset dma provider too */
2584 if (bus->dma->ops->reset) {
2585 bus->dma->ops->reset(bus->dma);
2586 }
2587 }
2588
2589 static bool ide_cd_is_tray_open(void *opaque)
2590 {
2591 return ((IDEState *)opaque)->tray_open;
2592 }
2593
2594 static bool ide_cd_is_medium_locked(void *opaque)
2595 {
2596 return ((IDEState *)opaque)->tray_locked;
2597 }
2598
2599 static void ide_resize_cb(void *opaque)
2600 {
2601 IDEState *s = opaque;
2602 uint64_t nb_sectors;
2603
2604 if (!s->identify_set) {
2605 return;
2606 }
2607
2608 blk_get_geometry(s->blk, &nb_sectors);
2609 s->nb_sectors = nb_sectors;
2610
2611 /* Update the identify data buffer. */
2612 if (s->drive_kind == IDE_CFATA) {
2613 ide_cfata_identify_size(s);
2614 } else {
2615 /* IDE_CD uses a different set of callbacks entirely. */
2616 assert(s->drive_kind != IDE_CD);
2617 ide_identify_size(s);
2618 }
2619 }
2620
2621 static const BlockDevOps ide_cd_block_ops = {
2622 .change_media_cb = ide_cd_change_cb,
2623 .eject_request_cb = ide_cd_eject_request_cb,
2624 .is_tray_open = ide_cd_is_tray_open,
2625 .is_medium_locked = ide_cd_is_medium_locked,
2626 };
2627
2628 static const BlockDevOps ide_hd_block_ops = {
2629 .resize_cb = ide_resize_cb,
2630 };
2631
2632 int ide_init_drive(IDEState *s, IDEDevice *dev, IDEDriveKind kind, Error **errp)
2633 {
2634 uint64_t nb_sectors;
2635
2636 s->blk = dev->conf.blk;
2637 s->drive_kind = kind;
2638
2639 blk_get_geometry(s->blk, &nb_sectors);
2640 s->win2k_install_hack = dev->win2k_install_hack;
2641 s->cylinders = dev->conf.cyls;
2642 s->heads = s->drive_heads = dev->conf.heads;
2643 s->sectors = s->drive_sectors = dev->conf.secs;
2644 s->chs_trans = dev->chs_trans;
2645 s->nb_sectors = nb_sectors;
2646 s->wwn = dev->wwn;
2647 /* The SMART values should be preserved across power cycles
2648 but they aren't. */
2649 s->smart_enabled = 1;
2650 s->smart_autosave = 1;
2651 s->smart_errors = 0;
2652 s->smart_selftest_count = 0;
2653 if (kind == IDE_CD) {
2654 blk_set_dev_ops(s->blk, &ide_cd_block_ops, s);
2655 } else {
2656 if (!blk_is_inserted(s->blk)) {
2657 error_setg(errp, "Device needs media, but drive is empty");
2658 return -1;
2659 }
2660 if (!blk_is_writable(s->blk)) {
2661 error_setg(errp, "Can't use a read-only drive");
2662 return -1;
2663 }
2664 blk_set_dev_ops(s->blk, &ide_hd_block_ops, s);
2665 }
2666 if (dev->serial) {
2667 pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), dev->serial);
2668 } else {
2669 snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
2670 "QM%05d", s->drive_serial);
2671 }
2672 if (dev->model) {
2673 pstrcpy(s->drive_model_str, sizeof(s->drive_model_str), dev->model);
2674 } else {
2675 switch (kind) {
2676 case IDE_CD:
2677 strcpy(s->drive_model_str, "QEMU DVD-ROM");
2678 break;
2679 case IDE_CFATA:
2680 strcpy(s->drive_model_str, "QEMU MICRODRIVE");
2681 break;
2682 default:
2683 strcpy(s->drive_model_str, "QEMU HARDDISK");
2684 break;
2685 }
2686 }
2687
2688 if (dev->version) {
2689 pstrcpy(s->version, sizeof(s->version), dev->version);
2690 } else {
2691 pstrcpy(s->version, sizeof(s->version), QEMU_HW_VERSION);
2692 }
2693
2694 ide_reset(s, IDE_RESET_HARDWARE);
2695 blk_iostatus_enable(s->blk);
2696 return 0;
2697 }
2698
2699 static void ide_init1(IDEBus *bus, int unit)
2700 {
2701 static int drive_serial = 1;
2702 IDEState *s = &bus->ifs[unit];
2703
2704 s->bus = bus;
2705 s->unit = unit;
2706 s->drive_serial = drive_serial++;
2707 /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */
2708 s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;
2709 s->io_buffer = qemu_memalign(2048, s->io_buffer_total_len);
2710 memset(s->io_buffer, 0, s->io_buffer_total_len);
2711
2712 s->smart_selftest_data = blk_blockalign(s->blk, 512);
2713 memset(s->smart_selftest_data, 0, 512);
2714
2715 s->sector_write_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
2716 ide_sector_write_timer_cb, s);
2717 }
2718
2719 static int ide_nop_int(const IDEDMA *dma, bool is_write)
2720 {
2721 return 0;
2722 }
2723
2724 static void ide_nop(const IDEDMA *dma)
2725 {
2726 }
2727
2728 static int32_t ide_nop_int32(const IDEDMA *dma, int32_t l)
2729 {
2730 return 0;
2731 }
2732
2733 static const IDEDMAOps ide_dma_nop_ops = {
2734 .prepare_buf = ide_nop_int32,
2735 .restart_dma = ide_nop,
2736 .rw_buf = ide_nop_int,
2737 };
2738
2739 static void ide_restart_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
2740 {
2741 s->unit = s->bus->retry_unit;
2742 ide_set_sector(s, s->bus->retry_sector_num);
2743 s->nsector = s->bus->retry_nsector;
2744 s->bus->dma->ops->restart_dma(s->bus->dma);
2745 s->io_buffer_size = 0;
2746 s->dma_cmd = dma_cmd;
2747 ide_start_dma(s, ide_dma_cb);
2748 }
2749
2750 static void ide_restart_bh(void *opaque)
2751 {
2752 IDEBus *bus = opaque;
2753 IDEState *s;
2754 bool is_read;
2755 int error_status;
2756
2757 qemu_bh_delete(bus->bh);
2758 bus->bh = NULL;
2759
2760 error_status = bus->error_status;
2761 if (bus->error_status == 0) {
2762 return;
2763 }
2764
2765 s = ide_bus_active_if(bus);
2766 is_read = (bus->error_status & IDE_RETRY_READ) != 0;
2767
2768 /* The error status must be cleared before resubmitting the request: The
2769 * request may fail again, and this case can only be distinguished if the
2770 * called function can set a new error status. */
2771 bus->error_status = 0;
2772
2773 /* The HBA has generically asked to be kicked on retry */
2774 if (error_status & IDE_RETRY_HBA) {
2775 if (s->bus->dma->ops->restart) {
2776 s->bus->dma->ops->restart(s->bus->dma);
2777 }
2778 } else if (IS_IDE_RETRY_DMA(error_status)) {
2779 if (error_status & IDE_RETRY_TRIM) {
2780 ide_restart_dma(s, IDE_DMA_TRIM);
2781 } else {
2782 ide_restart_dma(s, is_read ? IDE_DMA_READ : IDE_DMA_WRITE);
2783 }
2784 } else if (IS_IDE_RETRY_PIO(error_status)) {
2785 if (is_read) {
2786 ide_sector_read(s);
2787 } else {
2788 ide_sector_write(s);
2789 }
2790 } else if (error_status & IDE_RETRY_FLUSH) {
2791 ide_flush_cache(s);
2792 } else if (IS_IDE_RETRY_ATAPI(error_status)) {
2793 assert(s->end_transfer_func == ide_atapi_cmd);
2794 ide_atapi_dma_restart(s);
2795 } else {
2796 abort();
2797 }
2798 }
2799
2800 static void ide_restart_cb(void *opaque, bool running, RunState state)
2801 {
2802 IDEBus *bus = opaque;
2803
2804 if (!running)
2805 return;
2806
2807 if (!bus->bh) {
2808 bus->bh = qemu_bh_new(ide_restart_bh, bus);
2809 qemu_bh_schedule(bus->bh);
2810 }
2811 }
2812
2813 void ide_bus_register_restart_cb(IDEBus *bus)
2814 {
2815 if (bus->dma->ops->restart_dma) {
2816 bus->vmstate = qemu_add_vm_change_state_handler(ide_restart_cb, bus);
2817 }
2818 }
2819
2820 static IDEDMA ide_dma_nop = {
2821 .ops = &ide_dma_nop_ops,
2822 .aiocb = NULL,
2823 };
2824
2825 void ide_bus_init_output_irq(IDEBus *bus, qemu_irq irq_out)
2826 {
2827 int i;
2828
2829 for(i = 0; i < 2; i++) {
2830 ide_init1(bus, i);
2831 ide_reset(&bus->ifs[i], IDE_RESET_HARDWARE);
2832 }
2833 bus->irq = irq_out;
2834 bus->dma = &ide_dma_nop;
2835 }
2836
2837 void ide_bus_set_irq(IDEBus *bus)
2838 {
2839 if (!(bus->cmd & IDE_CTRL_DISABLE_IRQ)) {
2840 qemu_irq_raise(bus->irq);
2841 }
2842 }
2843
2844 void ide_exit(IDEState *s)
2845 {
2846 timer_free(s->sector_write_timer);
2847 qemu_vfree(s->smart_selftest_data);
2848 qemu_vfree(s->io_buffer);
2849 }
2850
2851 static bool is_identify_set(void *opaque, int version_id)
2852 {
2853 IDEState *s = opaque;
2854
2855 return s->identify_set != 0;
2856 }
2857
2858 static EndTransferFunc* transfer_end_table[] = {
2859 ide_sector_read,
2860 ide_sector_write,
2861 ide_transfer_stop,
2862 ide_atapi_cmd_reply_end,
2863 ide_atapi_cmd,
2864 ide_dummy_transfer_stop,
2865 };
2866
2867 static int transfer_end_table_idx(EndTransferFunc *fn)
2868 {
2869 int i;
2870
2871 for (i = 0; i < ARRAY_SIZE(transfer_end_table); i++)
2872 if (transfer_end_table[i] == fn)
2873 return i;
2874
2875 return -1;
2876 }
2877
2878 static int ide_drive_pre_load(void *opaque)
2879 {
2880 IDEState *s = opaque;
2881
2882 /* The subsections below are sent only where the guest replaced these */
2883 s->heads = s->drive_heads;
2884 s->sectors = s->drive_sectors;
2885 s->reset_reverts = false;
2886
2887 return 0;
2888 }
2889
2890 static int ide_drive_post_load(void *opaque, int version_id)
2891 {
2892 IDEState *s = opaque;
2893
2894 /* Only a disk has a translation; an empty slot and ATAPI keep these zero */
2895 if (s->blk && s->drive_kind != IDE_CD &&
2896 (s->heads < 1 || s->heads > 16 ||
2897 s->sectors < 1 || s->sectors > 255)) {
2898 return -EINVAL;
2899 }
2900
2901 if (s->blk && s->identify_set) {
2902 blk_set_enable_write_cache(s->blk, !!(s->identify_data[85] & (1 << 5)));
2903 }
2904 return 0;
2905 }
2906
2907 static int ide_drive_pio_post_load(void *opaque, int version_id)
2908 {
2909 IDEState *s = opaque;
2910
2911 if (s->end_transfer_fn_idx >= ARRAY_SIZE(transfer_end_table)) {
2912 return -EINVAL;
2913 }
2914 if (s->cur_io_buffer_offset < 0 || s->cur_io_buffer_len < 0 ||
2915 s->cur_io_buffer_offset > s->io_buffer_total_len ||
2916 s->cur_io_buffer_len >
2917 s->io_buffer_total_len - s->cur_io_buffer_offset) {
2918 return -EINVAL;
2919 }
2920 s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
2921 s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
2922 s->data_end = s->data_ptr + s->cur_io_buffer_len;
2923 s->atapi_dma = s->feature & 1; /* as per cmd_packet */
2924
2925 return 0;
2926 }
2927
2928 static int ide_drive_pio_pre_save(void *opaque)
2929 {
2930 IDEState *s = opaque;
2931 int idx;
2932
2933 s->cur_io_buffer_offset = s->data_ptr - s->io_buffer;
2934 s->cur_io_buffer_len = s->data_end - s->data_ptr;
2935
2936 idx = transfer_end_table_idx(s->end_transfer_func);
2937 if (idx == -1) {
2938 fprintf(stderr, "%s: invalid end_transfer_func for DRQ_STAT\n",
2939 __func__);
2940 s->end_transfer_fn_idx = 2;
2941 } else {
2942 s->end_transfer_fn_idx = idx;
2943 }
2944
2945 return 0;
2946 }
2947
2948 static bool ide_drive_pio_state_needed(void *opaque)
2949 {
2950 IDEState *s = opaque;
2951
2952 return ((s->status & DRQ_STAT) != 0)
2953 || (s->bus->error_status & IDE_RETRY_PIO);
2954 }
2955
2956 static bool ide_tray_state_needed(void *opaque)
2957 {
2958 IDEState *s = opaque;
2959
2960 return s->tray_open || s->tray_locked;
2961 }
2962
2963 static bool ide_atapi_gesn_needed(void *opaque)
2964 {
2965 IDEState *s = opaque;
2966
2967 return s->events.new_media || s->events.eject_request;
2968 }
2969
2970 static bool ide_error_needed(void *opaque)
2971 {
2972 IDEBus *bus = opaque;
2973
2974 return (bus->error_status != 0);
2975 }
2976
2977 /* Fields for GET_EVENT_STATUS_NOTIFICATION ATAPI command */
2978 static const VMStateDescription vmstate_ide_atapi_gesn_state = {
2979 .name ="ide_drive/atapi/gesn_state",
2980 .version_id = 1,
2981 .minimum_version_id = 1,
2982 .needed = ide_atapi_gesn_needed,
2983 .fields = (const VMStateField[]) {
2984 VMSTATE_BOOL(events.new_media, IDEState),
2985 VMSTATE_BOOL(events.eject_request, IDEState),
2986 VMSTATE_END_OF_LIST()
2987 }
2988 };
2989
2990 static bool ide_chs_translation_needed(void *opaque)
2991 {
2992 IDEState *s = opaque;
2993
2994 return s->heads != s->drive_heads || s->sectors != s->drive_sectors;
2995 }
2996
2997 static const VMStateDescription vmstate_ide_drive_chs_translation = {
2998 .name = "ide_drive/chs_translation",
2999 .version_id = 1,
3000 .minimum_version_id = 1,
3001 .needed = ide_chs_translation_needed,
3002 .fields = (const VMStateField[]) {
3003 VMSTATE_INT32(heads, IDEState),
3004 VMSTATE_INT32(sectors, IDEState),
3005 VMSTATE_END_OF_LIST()
3006 }
3007 };
3008
3009 static bool ide_reset_reverts_needed(void *opaque)
3010 {
3011 IDEState *s = opaque;
3012
3013 return s->reset_reverts && ide_chs_translation_needed(opaque);
3014 }
3015
3016 /* The flag decides nothing on the default geometry, so it travels with one */
3017 static const VMStateDescription vmstate_ide_drive_reset_reverts = {
3018 .name = "ide_drive/reset_reverts",
3019 .version_id = 1,
3020 .minimum_version_id = 1,
3021 .needed = ide_reset_reverts_needed,
3022 .fields = (const VMStateField[]) {
3023 VMSTATE_BOOL(reset_reverts, IDEState),
3024 VMSTATE_END_OF_LIST()
3025 }
3026 };
3027
3028 static const VMStateDescription vmstate_ide_tray_state = {
3029 .name = "ide_drive/tray_state",
3030 .version_id = 1,
3031 .minimum_version_id = 1,
3032 .needed = ide_tray_state_needed,
3033 .fields = (const VMStateField[]) {
3034 VMSTATE_BOOL(tray_open, IDEState),
3035 VMSTATE_BOOL(tray_locked, IDEState),
3036 VMSTATE_END_OF_LIST()
3037 }
3038 };
3039
3040 static const VMStateDescription vmstate_ide_drive_pio_state = {
3041 .name = "ide_drive/pio_state",
3042 .version_id = 1,
3043 .minimum_version_id = 1,
3044 .pre_save = ide_drive_pio_pre_save,
3045 .post_load = ide_drive_pio_post_load,
3046 .needed = ide_drive_pio_state_needed,
3047 .fields = (const VMStateField[]) {
3048 VMSTATE_INT32(req_nb_sectors, IDEState),
3049 VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1,
3050 vmstate_info_uint8, uint8_t),
3051 VMSTATE_INT32(cur_io_buffer_offset, IDEState),
3052 VMSTATE_INT32(cur_io_buffer_len, IDEState),
3053 VMSTATE_UINT8(end_transfer_fn_idx, IDEState),
3054 VMSTATE_INT32(elementary_transfer_size, IDEState),
3055 VMSTATE_INT32(packet_transfer_size, IDEState),
3056 VMSTATE_END_OF_LIST()
3057 }
3058 };
3059
3060 const VMStateDescription vmstate_ide_drive = {
3061 .name = "ide_drive",
3062 .version_id = 3,
3063 .minimum_version_id = 0,
3064 .pre_load = ide_drive_pre_load,
3065 .post_load = ide_drive_post_load,
3066 .fields = (const VMStateField[]) {
3067 VMSTATE_INT32(mult_sectors, IDEState),
3068 VMSTATE_INT32(identify_set, IDEState),
3069 VMSTATE_BUFFER_TEST(identify_data, IDEState, is_identify_set),
3070 VMSTATE_UINT8(feature, IDEState),
3071 VMSTATE_UINT8(error, IDEState),
3072 VMSTATE_UINT32(nsector, IDEState),
3073 VMSTATE_UINT8(sector, IDEState),
3074 VMSTATE_UINT8(lcyl, IDEState),
3075 VMSTATE_UINT8(hcyl, IDEState),
3076 VMSTATE_UINT8(hob_feature, IDEState),
3077 VMSTATE_UINT8(hob_sector, IDEState),
3078 VMSTATE_UINT8(hob_nsector, IDEState),
3079 VMSTATE_UINT8(hob_lcyl, IDEState),
3080 VMSTATE_UINT8(hob_hcyl, IDEState),
3081 VMSTATE_UINT8(select, IDEState),
3082 VMSTATE_UINT8(status, IDEState),
3083 VMSTATE_UINT8(lba48, IDEState),
3084 VMSTATE_UINT8(sense_key, IDEState),
3085 VMSTATE_UINT8(asc, IDEState),
3086 VMSTATE_UINT8_V(cdrom_changed, IDEState, 3),
3087 VMSTATE_END_OF_LIST()
3088 },
3089 .subsections = (const VMStateDescription * const []) {
3090 &vmstate_ide_drive_pio_state,
3091 &vmstate_ide_drive_chs_translation,
3092 &vmstate_ide_drive_reset_reverts,
3093 &vmstate_ide_tray_state,
3094 &vmstate_ide_atapi_gesn_state,
3095 NULL
3096 }
3097 };
3098
3099 static const VMStateDescription vmstate_ide_error_status = {
3100 .name ="ide_bus/error",
3101 .version_id = 2,
3102 .minimum_version_id = 1,
3103 .needed = ide_error_needed,
3104 .fields = (const VMStateField[]) {
3105 VMSTATE_INT32(error_status, IDEBus),
3106 VMSTATE_INT64_V(retry_sector_num, IDEBus, 2),
3107 VMSTATE_UINT32_V(retry_nsector, IDEBus, 2),
3108 VMSTATE_UINT8_V(retry_unit, IDEBus, 2),
3109 VMSTATE_END_OF_LIST()
3110 }
3111 };
3112
3113 const VMStateDescription vmstate_ide_bus = {
3114 .name = "ide_bus",
3115 .version_id = 1,
3116 .minimum_version_id = 1,
3117 .fields = (const VMStateField[]) {
3118 VMSTATE_UINT8(cmd, IDEBus),
3119 VMSTATE_UINT8(unit, IDEBus),
3120 VMSTATE_END_OF_LIST()
3121 },
3122 .subsections = (const VMStateDescription * const []) {
3123 &vmstate_ide_error_status,
3124 NULL
3125 }
3126 };
3127
3128 void ide_drive_get(DriveInfo **hd, int n)
3129 {
3130 int i;
3131
3132 for (i = 0; i < n; i++) {
3133 hd[i] = drive_get_by_index(IF_IDE, i);
3134 }
3135 }