?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix 32-bit overflow in parallels image support
[qemu-kvm/fedora.git] / hw / ide.c
blob1e38ae3eac7ea855b65e7502cb839e67f38e6a4e
1 /*
2 * QEMU IDE disk and CD/DVD-ROM Emulator
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 * Copyright (c) 2006 Openedhand Ltd.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25 #include "hw.h"
26 #include "pc.h"
27 #include "pci.h"
28 #include "scsi-disk.h"
29 #include "pcmcia.h"
30 #include "block.h"
31 #include "block_int.h"
32 #include "qemu-timer.h"
33 #include "sysemu.h"
34 #include "ppc_mac.h"
35 #include "mac_dbdma.h"
36 #include "sh.h"
37 #include "dma.h"
38
39 /* debug IDE devices */
40 //#define DEBUG_IDE
41 //#define DEBUG_IDE_ATAPI
42 //#define DEBUG_AIO
43 #define USE_DMA_CDROM
44
45 /* Bits of HD_STATUS */
46 #define ERR_STAT 0x01
47 #define INDEX_STAT 0x02
48 #define ECC_STAT 0x04 /* Corrected error */
49 #define DRQ_STAT 0x08
50 #define SEEK_STAT 0x10
51 #define SRV_STAT 0x10
52 #define WRERR_STAT 0x20
53 #define READY_STAT 0x40
54 #define BUSY_STAT 0x80
55
56 /* Bits for HD_ERROR */
57 #define MARK_ERR 0x01 /* Bad address mark */
58 #define TRK0_ERR 0x02 /* couldn't find track 0 */
59 #define ABRT_ERR 0x04 /* Command aborted */
60 #define MCR_ERR 0x08 /* media change request */
61 #define ID_ERR 0x10 /* ID field not found */
62 #define MC_ERR 0x20 /* media changed */
63 #define ECC_ERR 0x40 /* Uncorrectable ECC error */
64 #define BBD_ERR 0x80 /* pre-EIDE meaning: block marked bad */
65 #define ICRC_ERR 0x80 /* new meaning: CRC error during transfer */
66
67 /* Bits of HD_NSECTOR */
68 #define CD 0x01
69 #define IO 0x02
70 #define REL 0x04
71 #define TAG_MASK 0xf8
72
73 #define IDE_CMD_RESET 0x04
74 #define IDE_CMD_DISABLE_IRQ 0x02
75
76 /* ATA/ATAPI Commands pre T13 Spec */
77 #define WIN_NOP 0x00
78 /*
79 * 0x01->0x02 Reserved
80 */
81 #define CFA_REQ_EXT_ERROR_CODE 0x03 /* CFA Request Extended Error Code */
82 /*
83 * 0x04->0x07 Reserved
84 */
85 #define WIN_SRST 0x08 /* ATAPI soft reset command */
86 #define WIN_DEVICE_RESET 0x08
87 /*
88 * 0x09->0x0F Reserved
89 */
90 #define WIN_RECAL 0x10
91 #define WIN_RESTORE WIN_RECAL
92 /*
93 * 0x10->0x1F Reserved
94 */
95 #define WIN_READ 0x20 /* 28-Bit */
96 #define WIN_READ_ONCE 0x21 /* 28-Bit without retries */
97 #define WIN_READ_LONG 0x22 /* 28-Bit */
98 #define WIN_READ_LONG_ONCE 0x23 /* 28-Bit without retries */
99 #define WIN_READ_EXT 0x24 /* 48-Bit */
100 #define WIN_READDMA_EXT 0x25 /* 48-Bit */
101 #define WIN_READDMA_QUEUED_EXT 0x26 /* 48-Bit */
102 #define WIN_READ_NATIVE_MAX_EXT 0x27 /* 48-Bit */
103 /*
104 * 0x28
105 */
106 #define WIN_MULTREAD_EXT 0x29 /* 48-Bit */
107 /*
108 * 0x2A->0x2F Reserved
109 */
110 #define WIN_WRITE 0x30 /* 28-Bit */
111 #define WIN_WRITE_ONCE 0x31 /* 28-Bit without retries */
112 #define WIN_WRITE_LONG 0x32 /* 28-Bit */
113 #define WIN_WRITE_LONG_ONCE 0x33 /* 28-Bit without retries */
114 #define WIN_WRITE_EXT 0x34 /* 48-Bit */
115 #define WIN_WRITEDMA_EXT 0x35 /* 48-Bit */
116 #define WIN_WRITEDMA_QUEUED_EXT 0x36 /* 48-Bit */
117 #define WIN_SET_MAX_EXT 0x37 /* 48-Bit */
118 #define CFA_WRITE_SECT_WO_ERASE 0x38 /* CFA Write Sectors without erase */
119 #define WIN_MULTWRITE_EXT 0x39 /* 48-Bit */
120 /*
121 * 0x3A->0x3B Reserved
122 */
123 #define WIN_WRITE_VERIFY 0x3C /* 28-Bit */
124 /*
125 * 0x3D->0x3F Reserved
126 */
127 #define WIN_VERIFY 0x40 /* 28-Bit - Read Verify Sectors */
128 #define WIN_VERIFY_ONCE 0x41 /* 28-Bit - without retries */
129 #define WIN_VERIFY_EXT 0x42 /* 48-Bit */
130 /*
131 * 0x43->0x4F Reserved
132 */
133 #define WIN_FORMAT 0x50
134 /*
135 * 0x51->0x5F Reserved
136 */
137 #define WIN_INIT 0x60
138 /*
139 * 0x61->0x5F Reserved
140 */
141 #define WIN_SEEK 0x70 /* 0x70-0x7F Reserved */
142 #define CFA_TRANSLATE_SECTOR 0x87 /* CFA Translate Sector */
143 #define WIN_DIAGNOSE 0x90
144 #define WIN_SPECIFY 0x91 /* set drive geometry translation */
145 #define WIN_DOWNLOAD_MICROCODE 0x92
146 #define WIN_STANDBYNOW2 0x94
147 #define CFA_IDLEIMMEDIATE 0x95 /* force drive to become "ready" */
148 #define WIN_STANDBY2 0x96
149 #define WIN_SETIDLE2 0x97
150 #define WIN_CHECKPOWERMODE2 0x98
151 #define WIN_SLEEPNOW2 0x99
152 /*
153 * 0x9A VENDOR
154 */
155 #define WIN_PACKETCMD 0xA0 /* Send a packet command. */
156 #define WIN_PIDENTIFY 0xA1 /* identify ATAPI device */
157 #define WIN_QUEUED_SERVICE 0xA2
158 #define WIN_SMART 0xB0 /* self-monitoring and reporting */
159 #define CFA_ACCESS_METADATA_STORAGE 0xB8
160 #define CFA_ERASE_SECTORS 0xC0 /* microdrives implement as NOP */
161 #define WIN_MULTREAD 0xC4 /* read sectors using multiple mode*/
162 #define WIN_MULTWRITE 0xC5 /* write sectors using multiple mode */
163 #define WIN_SETMULT 0xC6 /* enable/disable multiple mode */
164 #define WIN_READDMA_QUEUED 0xC7 /* read sectors using Queued DMA transfers */
165 #define WIN_READDMA 0xC8 /* read sectors using DMA transfers */
166 #define WIN_READDMA_ONCE 0xC9 /* 28-Bit - without retries */
167 #define WIN_WRITEDMA 0xCA /* write sectors using DMA transfers */
168 #define WIN_WRITEDMA_ONCE 0xCB /* 28-Bit - without retries */
169 #define WIN_WRITEDMA_QUEUED 0xCC /* write sectors using Queued DMA transfers */
170 #define CFA_WRITE_MULTI_WO_ERASE 0xCD /* CFA Write multiple without erase */
171 #define WIN_GETMEDIASTATUS 0xDA
172 #define WIN_ACKMEDIACHANGE 0xDB /* ATA-1, ATA-2 vendor */
173 #define WIN_POSTBOOT 0xDC
174 #define WIN_PREBOOT 0xDD
175 #define WIN_DOORLOCK 0xDE /* lock door on removable drives */
176 #define WIN_DOORUNLOCK 0xDF /* unlock door on removable drives */
177 #define WIN_STANDBYNOW1 0xE0
178 #define WIN_IDLEIMMEDIATE 0xE1 /* force drive to become "ready" */
179 #define WIN_STANDBY 0xE2 /* Set device in Standby Mode */
180 #define WIN_SETIDLE1 0xE3
181 #define WIN_READ_BUFFER 0xE4 /* force read only 1 sector */
182 #define WIN_CHECKPOWERMODE1 0xE5
183 #define WIN_SLEEPNOW1 0xE6
184 #define WIN_FLUSH_CACHE 0xE7
185 #define WIN_WRITE_BUFFER 0xE8 /* force write only 1 sector */
186 #define WIN_WRITE_SAME 0xE9 /* read ata-2 to use */
187 /* SET_FEATURES 0x22 or 0xDD */
188 #define WIN_FLUSH_CACHE_EXT 0xEA /* 48-Bit */
189 #define WIN_IDENTIFY 0xEC /* ask drive to identify itself */
190 #define WIN_MEDIAEJECT 0xED
191 #define WIN_IDENTIFY_DMA 0xEE /* same as WIN_IDENTIFY, but DMA */
192 #define WIN_SETFEATURES 0xEF /* set special drive features */
193 #define EXABYTE_ENABLE_NEST 0xF0
194 #define IBM_SENSE_CONDITION 0xF0 /* measure disk temperature */
195 #define WIN_SECURITY_SET_PASS 0xF1
196 #define WIN_SECURITY_UNLOCK 0xF2
197 #define WIN_SECURITY_ERASE_PREPARE 0xF3
198 #define WIN_SECURITY_ERASE_UNIT 0xF4
199 #define WIN_SECURITY_FREEZE_LOCK 0xF5
200 #define CFA_WEAR_LEVEL 0xF5 /* microdrives implement as NOP */
201 #define WIN_SECURITY_DISABLE 0xF6
202 #define WIN_READ_NATIVE_MAX 0xF8 /* return the native maximum address */
203 #define WIN_SET_MAX 0xF9
204 #define DISABLE_SEAGATE 0xFB
205
206 /* set to 1 set disable mult support */
207 #define MAX_MULT_SECTORS 16
208
209 #define IDE_DMA_BUF_SECTORS 256
210
211 #if (IDE_DMA_BUF_SECTORS < MAX_MULT_SECTORS)
212 #error "IDE_DMA_BUF_SECTORS must be bigger or equal to MAX_MULT_SECTORS"
213 #endif
214
215 /* ATAPI defines */
216
217 #define ATAPI_PACKET_SIZE 12
218
219 /* The generic packet command opcodes for CD/DVD Logical Units,
220 * From Table 57 of the SFF8090 Ver. 3 (Mt. Fuji) draft standard. */
221 #define GPCMD_BLANK 0xa1
222 #define GPCMD_CLOSE_TRACK 0x5b
223 #define GPCMD_FLUSH_CACHE 0x35
224 #define GPCMD_FORMAT_UNIT 0x04
225 #define GPCMD_GET_CONFIGURATION 0x46
226 #define GPCMD_GET_EVENT_STATUS_NOTIFICATION 0x4a
227 #define GPCMD_GET_PERFORMANCE 0xac
228 #define GPCMD_INQUIRY 0x12
229 #define GPCMD_LOAD_UNLOAD 0xa6
230 #define GPCMD_MECHANISM_STATUS 0xbd
231 #define GPCMD_MODE_SELECT_10 0x55
232 #define GPCMD_MODE_SENSE_10 0x5a
233 #define GPCMD_PAUSE_RESUME 0x4b
234 #define GPCMD_PLAY_AUDIO_10 0x45
235 #define GPCMD_PLAY_AUDIO_MSF 0x47
236 #define GPCMD_PLAY_AUDIO_TI 0x48
237 #define GPCMD_PLAY_CD 0xbc
238 #define GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL 0x1e
239 #define GPCMD_READ_10 0x28
240 #define GPCMD_READ_12 0xa8
241 #define GPCMD_READ_CDVD_CAPACITY 0x25
242 #define GPCMD_READ_CD 0xbe
243 #define GPCMD_READ_CD_MSF 0xb9
244 #define GPCMD_READ_DISC_INFO 0x51
245 #define GPCMD_READ_DVD_STRUCTURE 0xad
246 #define GPCMD_READ_FORMAT_CAPACITIES 0x23
247 #define GPCMD_READ_HEADER 0x44
248 #define GPCMD_READ_TRACK_RZONE_INFO 0x52
249 #define GPCMD_READ_SUBCHANNEL 0x42
250 #define GPCMD_READ_TOC_PMA_ATIP 0x43
251 #define GPCMD_REPAIR_RZONE_TRACK 0x58
252 #define GPCMD_REPORT_KEY 0xa4
253 #define GPCMD_REQUEST_SENSE 0x03
254 #define GPCMD_RESERVE_RZONE_TRACK 0x53
255 #define GPCMD_SCAN 0xba
256 #define GPCMD_SEEK 0x2b
257 #define GPCMD_SEND_DVD_STRUCTURE 0xad
258 #define GPCMD_SEND_EVENT 0xa2
259 #define GPCMD_SEND_KEY 0xa3
260 #define GPCMD_SEND_OPC 0x54
261 #define GPCMD_SET_READ_AHEAD 0xa7
262 #define GPCMD_SET_STREAMING 0xb6
263 #define GPCMD_START_STOP_UNIT 0x1b
264 #define GPCMD_STOP_PLAY_SCAN 0x4e
265 #define GPCMD_TEST_UNIT_READY 0x00
266 #define GPCMD_VERIFY_10 0x2f
267 #define GPCMD_WRITE_10 0x2a
268 #define GPCMD_WRITE_AND_VERIFY_10 0x2e
269 /* This is listed as optional in ATAPI 2.6, but is (curiously)
270 * missing from Mt. Fuji, Table 57. It _is_ mentioned in Mt. Fuji
271 * Table 377 as an MMC command for SCSi devices though... Most ATAPI
272 * drives support it. */
273 #define GPCMD_SET_SPEED 0xbb
274 /* This seems to be a SCSI specific CD-ROM opcode
275 * to play data at track/index */
276 #define GPCMD_PLAYAUDIO_TI 0x48
277 /*
278 * From MS Media Status Notification Support Specification. For
279 * older drives only.
280 */
281 #define GPCMD_GET_MEDIA_STATUS 0xda
282 #define GPCMD_MODE_SENSE_6 0x1a
283
284 /* Mode page codes for mode sense/set */
285 #define GPMODE_R_W_ERROR_PAGE 0x01
286 #define GPMODE_WRITE_PARMS_PAGE 0x05
287 #define GPMODE_AUDIO_CTL_PAGE 0x0e
288 #define GPMODE_POWER_PAGE 0x1a
289 #define GPMODE_FAULT_FAIL_PAGE 0x1c
290 #define GPMODE_TO_PROTECT_PAGE 0x1d
291 #define GPMODE_CAPABILITIES_PAGE 0x2a
292 #define GPMODE_ALL_PAGES 0x3f
293 /* Not in Mt. Fuji, but in ATAPI 2.6 -- depricated now in favor
294 * of MODE_SENSE_POWER_PAGE */
295 #define GPMODE_CDROM_PAGE 0x0d
296
297 /*
298 * Based on values from <linux/cdrom.h> but extending CD_MINS
299 * to the maximum common size allowed by the Orange's Book ATIP
300 *
301 * 90 and 99 min CDs are also available but using them as the
302 * upper limit reduces the effectiveness of the heuristic to
303 * detect DVDs burned to less than 25% of their maximum capacity
304 */
305
306 /* Some generally useful CD-ROM information */
307 #define CD_MINS 80 /* max. minutes per CD */
308 #define CD_SECS 60 /* seconds per minute */
309 #define CD_FRAMES 75 /* frames per second */
310 #define CD_FRAMESIZE 2048 /* bytes per frame, "cooked" mode */
311 #define CD_MAX_BYTES (CD_MINS * CD_SECS * CD_FRAMES * CD_FRAMESIZE)
312 #define CD_MAX_SECTORS (CD_MAX_BYTES / 512)
313
314 /*
315 * The MMC values are not IDE specific and might need to be moved
316 * to a common header if they are also needed for the SCSI emulation
317 */
318
319 /* Profile list from MMC-6 revision 1 table 91 */
320 #define MMC_PROFILE_NONE 0x0000
321 #define MMC_PROFILE_CD_ROM 0x0008
322 #define MMC_PROFILE_CD_R 0x0009
323 #define MMC_PROFILE_CD_RW 0x000A
324 #define MMC_PROFILE_DVD_ROM 0x0010
325 #define MMC_PROFILE_DVD_R_SR 0x0011
326 #define MMC_PROFILE_DVD_RAM 0x0012
327 #define MMC_PROFILE_DVD_RW_RO 0x0013
328 #define MMC_PROFILE_DVD_RW_SR 0x0014
329 #define MMC_PROFILE_DVD_R_DL_SR 0x0015
330 #define MMC_PROFILE_DVD_R_DL_JR 0x0016
331 #define MMC_PROFILE_DVD_RW_DL 0x0017
332 #define MMC_PROFILE_DVD_DDR 0x0018
333 #define MMC_PROFILE_DVD_PLUS_RW 0x001A
334 #define MMC_PROFILE_DVD_PLUS_R 0x001B
335 #define MMC_PROFILE_DVD_PLUS_RW_DL 0x002A
336 #define MMC_PROFILE_DVD_PLUS_R_DL 0x002B
337 #define MMC_PROFILE_BD_ROM 0x0040
338 #define MMC_PROFILE_BD_R_SRM 0x0041
339 #define MMC_PROFILE_BD_R_RRM 0x0042
340 #define MMC_PROFILE_BD_RE 0x0043
341 #define MMC_PROFILE_HDDVD_ROM 0x0050
342 #define MMC_PROFILE_HDDVD_R 0x0051
343 #define MMC_PROFILE_HDDVD_RAM 0x0052
344 #define MMC_PROFILE_HDDVD_RW 0x0053
345 #define MMC_PROFILE_HDDVD_R_DL 0x0058
346 #define MMC_PROFILE_HDDVD_RW_DL 0x005A
347 #define MMC_PROFILE_INVALID 0xFFFF
348
349 #define ATAPI_INT_REASON_CD 0x01 /* 0 = data transfer */
350 #define ATAPI_INT_REASON_IO 0x02 /* 1 = transfer to the host */
351 #define ATAPI_INT_REASON_REL 0x04
352 #define ATAPI_INT_REASON_TAG 0xf8
353
354 /* same constants as bochs */
355 #define ASC_ILLEGAL_OPCODE 0x20
356 #define ASC_LOGICAL_BLOCK_OOR 0x21
357 #define ASC_INV_FIELD_IN_CMD_PACKET 0x24
358 #define ASC_MEDIUM_MAY_HAVE_CHANGED 0x28
359 #define ASC_INCOMPATIBLE_FORMAT 0x30
360 #define ASC_MEDIUM_NOT_PRESENT 0x3a
361 #define ASC_SAVING_PARAMETERS_NOT_SUPPORTED 0x39
362 #define ASC_MEDIA_REMOVAL_PREVENTED 0x53
363
364 #define CFA_NO_ERROR 0x00
365 #define CFA_MISC_ERROR 0x09
366 #define CFA_INVALID_COMMAND 0x20
367 #define CFA_INVALID_ADDRESS 0x21
368 #define CFA_ADDRESS_OVERFLOW 0x2f
369
370 #define SENSE_NONE 0
371 #define SENSE_NOT_READY 2
372 #define SENSE_ILLEGAL_REQUEST 5
373 #define SENSE_UNIT_ATTENTION 6
374
375 struct IDEState;
376
377 typedef void EndTransferFunc(struct IDEState *);
378
379 /* NOTE: IDEState represents in fact one drive */
380 typedef struct IDEState {
381 /* ide config */
382 int is_cdrom;
383 int is_cf;
384 int cylinders, heads, sectors;
385 int64_t nb_sectors;
386 int mult_sectors;
387 int identify_set;
388 uint16_t identify_data[256];
389 qemu_irq irq;
390 PCIDevice *pci_dev;
391 struct BMDMAState *bmdma;
392 int drive_serial;
393 char drive_serial_str[21];
394 /* ide regs */
395 uint8_t feature;
396 uint8_t error;
397 uint32_t nsector;
398 uint8_t sector;
399 uint8_t lcyl;
400 uint8_t hcyl;
401 /* other part of tf for lba48 support */
402 uint8_t hob_feature;
403 uint8_t hob_nsector;
404 uint8_t hob_sector;
405 uint8_t hob_lcyl;
406 uint8_t hob_hcyl;
407
408 uint8_t select;
409 uint8_t status;
410
411 /* 0x3f6 command, only meaningful for drive 0 */
412 uint8_t cmd;
413 /* set for lba48 access */
414 uint8_t lba48;
415 /* depends on bit 4 in select, only meaningful for drive 0 */
416 struct IDEState *cur_drive;
417 BlockDriverState *bs;
418 /* ATAPI specific */
419 uint8_t sense_key;
420 uint8_t asc;
421 uint8_t cdrom_changed;
422 int packet_transfer_size;
423 int elementary_transfer_size;
424 int io_buffer_index;
425 int lba;
426 int cd_sector_size;
427 int atapi_dma; /* true if dma is requested for the packet cmd */
428 /* ATA DMA state */
429 int io_buffer_size;
430 QEMUSGList sg;
431 /* PIO transfer handling */
432 int req_nb_sectors; /* number of sectors per interrupt */
433 EndTransferFunc *end_transfer_func;
434 uint8_t *data_ptr;
435 uint8_t *data_end;
436 uint8_t *io_buffer;
437 QEMUTimer *sector_write_timer; /* only used for win2k install hack */
438 uint32_t irq_count; /* counts IRQs when using win2k install hack */
439 /* CF-ATA extended error */
440 uint8_t ext_error;
441 /* CF-ATA metadata storage */
442 uint32_t mdata_size;
443 uint8_t *mdata_storage;
444 int media_changed;
445 /* for pmac */
446 int is_read;
447 } IDEState;
448
449 /* XXX: DVDs that could fit on a CD will be reported as a CD */
450 static inline int media_present(IDEState *s)
451 {
452 return (s->nb_sectors > 0);
453 }
454
455 static inline int media_is_dvd(IDEState *s)
456 {
457 return (media_present(s) && s->nb_sectors > CD_MAX_SECTORS);
458 }
459
460 static inline int media_is_cd(IDEState *s)
461 {
462 return (media_present(s) && s->nb_sectors <= CD_MAX_SECTORS);
463 }
464
465 #define BM_STATUS_DMAING 0x01
466 #define BM_STATUS_ERROR 0x02
467 #define BM_STATUS_INT 0x04
468 #define BM_STATUS_DMA_RETRY 0x08
469 #define BM_STATUS_PIO_RETRY 0x10
470
471 #define BM_CMD_START 0x01
472 #define BM_CMD_READ 0x08
473
474 #define IDE_TYPE_PIIX3 0
475 #define IDE_TYPE_CMD646 1
476 #define IDE_TYPE_PIIX4 2
477
478 /* CMD646 specific */
479 #define MRDMODE 0x71
480 #define MRDMODE_INTR_CH0 0x04
481 #define MRDMODE_INTR_CH1 0x08
482 #define MRDMODE_BLK_CH0 0x10
483 #define MRDMODE_BLK_CH1 0x20
484 #define UDIDETCR0 0x73
485 #define UDIDETCR1 0x7B
486
487 typedef struct BMDMAState {
488 uint8_t cmd;
489 uint8_t status;
490 uint32_t addr;
491
492 struct PCIIDEState *pci_dev;
493 /* current transfer state */
494 uint32_t cur_addr;
495 uint32_t cur_prd_last;
496 uint32_t cur_prd_addr;
497 uint32_t cur_prd_len;
498 IDEState *ide_if;
499 BlockDriverCompletionFunc *dma_cb;
500 BlockDriverAIOCB *aiocb;
501 struct iovec iov;
502 QEMUIOVector qiov;
503 int64_t sector_num;
504 uint32_t nsector;
505 QEMUBH *bh;
506 } BMDMAState;
507
508 typedef struct PCIIDEState {
509 PCIDevice dev;
510 IDEState ide_if[4];
511 BMDMAState bmdma[2];
512 int type; /* see IDE_TYPE_xxx */
513 } PCIIDEState;
514
515 static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb);
516 static void ide_dma_restart(IDEState *s);
517 static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret);
518
519 static void padstr(char *str, const char *src, int len)
520 {
521 int i, v;
522 for(i = 0; i < len; i++) {
523 if (*src)
524 v = *src++;
525 else
526 v = ' ';
527 str[i^1] = v;
528 }
529 }
530
531 static void padstr8(uint8_t *buf, int buf_size, const char *src)
532 {
533 int i;
534 for(i = 0; i < buf_size; i++) {
535 if (*src)
536 buf[i] = *src++;
537 else
538 buf[i] = ' ';
539 }
540 }
541
542 static void put_le16(uint16_t *p, unsigned int v)
543 {
544 *p = cpu_to_le16(v);
545 }
546
547 static void ide_identify(IDEState *s)
548 {
549 uint16_t *p;
550 unsigned int oldsize;
551
552 if (s->identify_set) {
553 memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
554 return;
555 }
556
557 memset(s->io_buffer, 0, 512);
558 p = (uint16_t *)s->io_buffer;
559 put_le16(p + 0, 0x0040);
560 put_le16(p + 1, s->cylinders);
561 put_le16(p + 3, s->heads);
562 put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
563 put_le16(p + 5, 512); /* XXX: retired, remove ? */
564 put_le16(p + 6, s->sectors);
565 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
566 put_le16(p + 20, 3); /* XXX: retired, remove ? */
567 put_le16(p + 21, 512); /* cache size in sectors */
568 put_le16(p + 22, 4); /* ecc bytes */
569 padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
570 padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
571 #if MAX_MULT_SECTORS > 1
572 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
573 #endif
574 put_le16(p + 48, 1); /* dword I/O */
575 put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
576 put_le16(p + 51, 0x200); /* PIO transfer cycle */
577 put_le16(p + 52, 0x200); /* DMA transfer cycle */
578 put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
579 put_le16(p + 54, s->cylinders);
580 put_le16(p + 55, s->heads);
581 put_le16(p + 56, s->sectors);
582 oldsize = s->cylinders * s->heads * s->sectors;
583 put_le16(p + 57, oldsize);
584 put_le16(p + 58, oldsize >> 16);
585 if (s->mult_sectors)
586 put_le16(p + 59, 0x100 | s->mult_sectors);
587 put_le16(p + 60, s->nb_sectors);
588 put_le16(p + 61, s->nb_sectors >> 16);
589 put_le16(p + 62, 0x07); /* single word dma0-2 supported */
590 put_le16(p + 63, 0x07); /* mdma0-2 supported */
591 put_le16(p + 65, 120);
592 put_le16(p + 66, 120);
593 put_le16(p + 67, 120);
594 put_le16(p + 68, 120);
595 put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
596 put_le16(p + 81, 0x16); /* conforms to ata5 */
597 put_le16(p + 82, (1 << 14));
598 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
599 put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
600 put_le16(p + 84, (1 << 14));
601 put_le16(p + 85, (1 << 14));
602 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
603 put_le16(p + 86, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
604 put_le16(p + 87, (1 << 14));
605 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
606 put_le16(p + 93, 1 | (1 << 14) | 0x2000);
607 put_le16(p + 100, s->nb_sectors);
608 put_le16(p + 101, s->nb_sectors >> 16);
609 put_le16(p + 102, s->nb_sectors >> 32);
610 put_le16(p + 103, s->nb_sectors >> 48);
611
612 memcpy(s->identify_data, p, sizeof(s->identify_data));
613 s->identify_set = 1;
614 }
615
616 static void ide_atapi_identify(IDEState *s)
617 {
618 uint16_t *p;
619
620 if (s->identify_set) {
621 memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
622 return;
623 }
624
625 memset(s->io_buffer, 0, 512);
626 p = (uint16_t *)s->io_buffer;
627 /* Removable CDROM, 50us response, 12 byte packets */
628 put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
629 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
630 put_le16(p + 20, 3); /* buffer type */
631 put_le16(p + 21, 512); /* cache size in sectors */
632 put_le16(p + 22, 4); /* ecc bytes */
633 padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
634 padstr((char *)(p + 27), "QEMU DVD-ROM", 40); /* model */
635 put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
636 #ifdef USE_DMA_CDROM
637 put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
638 put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
639 put_le16(p + 62, 7); /* single word dma0-2 supported */
640 put_le16(p + 63, 7); /* mdma0-2 supported */
641 put_le16(p + 64, 0x3f); /* PIO modes supported */
642 #else
643 put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
644 put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
645 put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
646 put_le16(p + 64, 1); /* PIO modes */
647 #endif
648 put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
649 put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
650 put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
651 put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
652
653 put_le16(p + 71, 30); /* in ns */
654 put_le16(p + 72, 30); /* in ns */
655
656 put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
657 #ifdef USE_DMA_CDROM
658 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
659 #endif
660 memcpy(s->identify_data, p, sizeof(s->identify_data));
661 s->identify_set = 1;
662 }
663
664 static void ide_cfata_identify(IDEState *s)
665 {
666 uint16_t *p;
667 uint32_t cur_sec;
668
669 p = (uint16_t *) s->identify_data;
670 if (s->identify_set)
671 goto fill_buffer;
672
673 memset(p, 0, sizeof(s->identify_data));
674
675 cur_sec = s->cylinders * s->heads * s->sectors;
676
677 put_le16(p + 0, 0x848a); /* CF Storage Card signature */
678 put_le16(p + 1, s->cylinders); /* Default cylinders */
679 put_le16(p + 3, s->heads); /* Default heads */
680 put_le16(p + 6, s->sectors); /* Default sectors per track */
681 put_le16(p + 7, s->nb_sectors >> 16); /* Sectors per card */
682 put_le16(p + 8, s->nb_sectors); /* Sectors per card */
683 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
684 put_le16(p + 22, 0x0004); /* ECC bytes */
685 padstr((char *) (p + 23), QEMU_VERSION, 8); /* Firmware Revision */
686 padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
687 #if MAX_MULT_SECTORS > 1
688 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
689 #else
690 put_le16(p + 47, 0x0000);
691 #endif
692 put_le16(p + 49, 0x0f00); /* Capabilities */
693 put_le16(p + 51, 0x0002); /* PIO cycle timing mode */
694 put_le16(p + 52, 0x0001); /* DMA cycle timing mode */
695 put_le16(p + 53, 0x0003); /* Translation params valid */
696 put_le16(p + 54, s->cylinders); /* Current cylinders */
697 put_le16(p + 55, s->heads); /* Current heads */
698 put_le16(p + 56, s->sectors); /* Current sectors */
699 put_le16(p + 57, cur_sec); /* Current capacity */
700 put_le16(p + 58, cur_sec >> 16); /* Current capacity */
701 if (s->mult_sectors) /* Multiple sector setting */
702 put_le16(p + 59, 0x100 | s->mult_sectors);
703 put_le16(p + 60, s->nb_sectors); /* Total LBA sectors */
704 put_le16(p + 61, s->nb_sectors >> 16); /* Total LBA sectors */
705 put_le16(p + 63, 0x0203); /* Multiword DMA capability */
706 put_le16(p + 64, 0x0001); /* Flow Control PIO support */
707 put_le16(p + 65, 0x0096); /* Min. Multiword DMA cycle */
708 put_le16(p + 66, 0x0096); /* Rec. Multiword DMA cycle */
709 put_le16(p + 68, 0x00b4); /* Min. PIO cycle time */
710 put_le16(p + 82, 0x400c); /* Command Set supported */
711 put_le16(p + 83, 0x7068); /* Command Set supported */
712 put_le16(p + 84, 0x4000); /* Features supported */
713 put_le16(p + 85, 0x000c); /* Command Set enabled */
714 put_le16(p + 86, 0x7044); /* Command Set enabled */
715 put_le16(p + 87, 0x4000); /* Features enabled */
716 put_le16(p + 91, 0x4060); /* Current APM level */
717 put_le16(p + 129, 0x0002); /* Current features option */
718 put_le16(p + 130, 0x0005); /* Reassigned sectors */
719 put_le16(p + 131, 0x0001); /* Initial power mode */
720 put_le16(p + 132, 0x0000); /* User signature */
721 put_le16(p + 160, 0x8100); /* Power requirement */
722 put_le16(p + 161, 0x8001); /* CF command set */
723
724 s->identify_set = 1;
725
726 fill_buffer:
727 memcpy(s->io_buffer, p, sizeof(s->identify_data));
728 }
729
730 static void ide_set_signature(IDEState *s)
731 {
732 s->select &= 0xf0; /* clear head */
733 /* put signature */
734 s->nsector = 1;
735 s->sector = 1;
736 if (s->is_cdrom) {
737 s->lcyl = 0x14;
738 s->hcyl = 0xeb;
739 } else if (s->bs) {
740 s->lcyl = 0;
741 s->hcyl = 0;
742 } else {
743 s->lcyl = 0xff;
744 s->hcyl = 0xff;
745 }
746 }
747
748 static inline void ide_abort_command(IDEState *s)
749 {
750 s->status = READY_STAT | ERR_STAT;
751 s->error = ABRT_ERR;
752 }
753
754 static inline void ide_dma_submit_check(IDEState *s,
755 BlockDriverCompletionFunc *dma_cb, BMDMAState *bm)
756 {
757 if (bm->aiocb)
758 return;
759 dma_cb(bm, -1);
760 }
761
762 static inline void ide_set_irq(IDEState *s)
763 {
764 BMDMAState *bm = s->bmdma;
765 if (!(s->cmd & IDE_CMD_DISABLE_IRQ)) {
766 if (bm) {
767 bm->status |= BM_STATUS_INT;
768 }
769 qemu_irq_raise(s->irq);
770 }
771 }
772
773 /* prepare data transfer and tell what to do after */
774 static void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
775 EndTransferFunc *end_transfer_func)
776 {
777 s->end_transfer_func = end_transfer_func;
778 s->data_ptr = buf;
779 s->data_end = buf + size;
780 if (!(s->status & ERR_STAT))
781 s->status |= DRQ_STAT;
782 }
783
784 static void ide_transfer_stop(IDEState *s)
785 {
786 s->end_transfer_func = ide_transfer_stop;
787 s->data_ptr = s->io_buffer;
788 s->data_end = s->io_buffer;
789 s->status &= ~DRQ_STAT;
790 }
791
792 static int64_t ide_get_sector(IDEState *s)
793 {
794 int64_t sector_num;
795 if (s->select & 0x40) {
796 /* lba */
797 if (!s->lba48) {
798 sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
799 (s->lcyl << 8) | s->sector;
800 } else {
801 sector_num = ((int64_t)s->hob_hcyl << 40) |
802 ((int64_t) s->hob_lcyl << 32) |
803 ((int64_t) s->hob_sector << 24) |
804 ((int64_t) s->hcyl << 16) |
805 ((int64_t) s->lcyl << 8) | s->sector;
806 }
807 } else {
808 sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
809 (s->select & 0x0f) * s->sectors + (s->sector - 1);
810 }
811 return sector_num;
812 }
813
814 static void ide_set_sector(IDEState *s, int64_t sector_num)
815 {
816 unsigned int cyl, r;
817 if (s->select & 0x40) {
818 if (!s->lba48) {
819 s->select = (s->select & 0xf0) | (sector_num >> 24);
820 s->hcyl = (sector_num >> 16);
821 s->lcyl = (sector_num >> 8);
822 s->sector = (sector_num);
823 } else {
824 s->sector = sector_num;
825 s->lcyl = sector_num >> 8;
826 s->hcyl = sector_num >> 16;
827 s->hob_sector = sector_num >> 24;
828 s->hob_lcyl = sector_num >> 32;
829 s->hob_hcyl = sector_num >> 40;
830 }
831 } else {
832 cyl = sector_num / (s->heads * s->sectors);
833 r = sector_num % (s->heads * s->sectors);
834 s->hcyl = cyl >> 8;
835 s->lcyl = cyl;
836 s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
837 s->sector = (r % s->sectors) + 1;
838 }
839 }
840
841 static void ide_rw_error(IDEState *s) {
842 ide_abort_command(s);
843 ide_set_irq(s);
844 }
845
846 static void ide_sector_read(IDEState *s)
847 {
848 int64_t sector_num;
849 int ret, n;
850
851 s->status = READY_STAT | SEEK_STAT;
852 s->error = 0; /* not needed by IDE spec, but needed by Windows */
853 sector_num = ide_get_sector(s);
854 n = s->nsector;
855 if (n == 0) {
856 /* no more sector to read from disk */
857 ide_transfer_stop(s);
858 } else {
859 #if defined(DEBUG_IDE)
860 printf("read sector=%" PRId64 "\n", sector_num);
861 #endif
862 if (n > s->req_nb_sectors)
863 n = s->req_nb_sectors;
864 ret = bdrv_read(s->bs, sector_num, s->io_buffer, n);
865 if (ret != 0) {
866 ide_rw_error(s);
867 return;
868 }
869 ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read);
870 ide_set_irq(s);
871 ide_set_sector(s, sector_num + n);
872 s->nsector -= n;
873 }
874 }
875
876
877 /* return 0 if buffer completed */
878 static int dma_buf_prepare(BMDMAState *bm, int is_write)
879 {
880 IDEState *s = bm->ide_if;
881 struct {
882 uint32_t addr;
883 uint32_t size;
884 } prd;
885 int l, len;
886
887 qemu_sglist_init(&s->sg, s->nsector / (TARGET_PAGE_SIZE/512) + 1);
888 s->io_buffer_size = 0;
889 for(;;) {
890 if (bm->cur_prd_len == 0) {
891 /* end of table (with a fail safe of one page) */
892 if (bm->cur_prd_last ||
893 (bm->cur_addr - bm->addr) >= 4096)
894 return s->io_buffer_size != 0;
895 cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
896 bm->cur_addr += 8;
897 prd.addr = le32_to_cpu(prd.addr);
898 prd.size = le32_to_cpu(prd.size);
899 len = prd.size & 0xfffe;
900 if (len == 0)
901 len = 0x10000;
902 bm->cur_prd_len = len;
903 bm->cur_prd_addr = prd.addr;
904 bm->cur_prd_last = (prd.size & 0x80000000);
905 }
906 l = bm->cur_prd_len;
907 if (l > 0) {
908 qemu_sglist_add(&s->sg, bm->cur_prd_addr, l);
909 bm->cur_prd_addr += l;
910 bm->cur_prd_len -= l;
911 s->io_buffer_size += l;
912 }
913 }
914 return 1;
915 }
916
917 static void dma_buf_commit(IDEState *s, int is_write)
918 {
919 qemu_sglist_destroy(&s->sg);
920 }
921
922 static void ide_dma_error(IDEState *s)
923 {
924 ide_transfer_stop(s);
925 s->error = ABRT_ERR;
926 s->status = READY_STAT | ERR_STAT;
927 ide_set_irq(s);
928 }
929
930 static int ide_handle_write_error(IDEState *s, int error, int op)
931 {
932 BlockInterfaceErrorAction action = drive_get_onerror(s->bs);
933
934 if (action == BLOCK_ERR_IGNORE)
935 return 0;
936
937 if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
938 || action == BLOCK_ERR_STOP_ANY) {
939 s->bmdma->ide_if = s;
940 s->bmdma->status |= op;
941 vm_stop(0);
942 } else {
943 if (op == BM_STATUS_DMA_RETRY) {
944 dma_buf_commit(s, 0);
945 ide_dma_error(s);
946 } else {
947 ide_rw_error(s);
948 }
949 }
950
951 return 1;
952 }
953
954 /* return 0 if buffer completed */
955 static int dma_buf_rw(BMDMAState *bm, int is_write)
956 {
957 IDEState *s = bm->ide_if;
958 struct {
959 uint32_t addr;
960 uint32_t size;
961 } prd;
962 int l, len;
963
964 for(;;) {
965 l = s->io_buffer_size - s->io_buffer_index;
966 if (l <= 0)
967 break;
968 if (bm->cur_prd_len == 0) {
969 /* end of table (with a fail safe of one page) */
970 if (bm->cur_prd_last ||
971 (bm->cur_addr - bm->addr) >= 4096)
972 return 0;
973 cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
974 bm->cur_addr += 8;
975 prd.addr = le32_to_cpu(prd.addr);
976 prd.size = le32_to_cpu(prd.size);
977 len = prd.size & 0xfffe;
978 if (len == 0)
979 len = 0x10000;
980 bm->cur_prd_len = len;
981 bm->cur_prd_addr = prd.addr;
982 bm->cur_prd_last = (prd.size & 0x80000000);
983 }
984 if (l > bm->cur_prd_len)
985 l = bm->cur_prd_len;
986 if (l > 0) {
987 if (is_write) {
988 cpu_physical_memory_write(bm->cur_prd_addr,
989 s->io_buffer + s->io_buffer_index, l);
990 } else {
991 cpu_physical_memory_read(bm->cur_prd_addr,
992 s->io_buffer + s->io_buffer_index, l);
993 }
994 bm->cur_prd_addr += l;
995 bm->cur_prd_len -= l;
996 s->io_buffer_index += l;
997 }
998 }
999 return 1;
1000 }
1001
1002 static void ide_read_dma_cb(void *opaque, int ret)
1003 {
1004 BMDMAState *bm = opaque;
1005 IDEState *s = bm->ide_if;
1006 int n;
1007 int64_t sector_num;
1008
1009 if (ret < 0) {
1010 dma_buf_commit(s, 1);
1011 ide_dma_error(s);
1012 return;
1013 }
1014
1015 n = s->io_buffer_size >> 9;
1016 sector_num = ide_get_sector(s);
1017 if (n > 0) {
1018 dma_buf_commit(s, 1);
1019 sector_num += n;
1020 ide_set_sector(s, sector_num);
1021 s->nsector -= n;
1022 }
1023
1024 /* end of transfer ? */
1025 if (s->nsector == 0) {
1026 s->status = READY_STAT | SEEK_STAT;
1027 ide_set_irq(s);
1028 eot:
1029 bm->status &= ~BM_STATUS_DMAING;
1030 bm->status |= BM_STATUS_INT;
1031 bm->dma_cb = NULL;
1032 bm->ide_if = NULL;
1033 bm->aiocb = NULL;
1034 return;
1035 }
1036
1037 /* launch next transfer */
1038 n = s->nsector;
1039 s->io_buffer_index = 0;
1040 s->io_buffer_size = n * 512;
1041 if (dma_buf_prepare(bm, 1) == 0)
1042 goto eot;
1043 #ifdef DEBUG_AIO
1044 printf("aio_read: sector_num=%" PRId64 " n=%d\n", sector_num, n);
1045 #endif
1046 bm->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num, ide_read_dma_cb, bm);
1047 ide_dma_submit_check(s, ide_read_dma_cb, bm);
1048 }
1049
1050 static void ide_sector_read_dma(IDEState *s)
1051 {
1052 s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
1053 s->io_buffer_index = 0;
1054 s->io_buffer_size = 0;
1055 s->is_read = 1;
1056 ide_dma_start(s, ide_read_dma_cb);
1057 }
1058
1059 static void ide_sector_write_timer_cb(void *opaque)
1060 {
1061 IDEState *s = opaque;
1062 ide_set_irq(s);
1063 }
1064
1065 static void ide_sector_write(IDEState *s)
1066 {
1067 int64_t sector_num;
1068 int ret, n, n1;
1069
1070 s->status = READY_STAT | SEEK_STAT;
1071 sector_num = ide_get_sector(s);
1072 #if defined(DEBUG_IDE)
1073 printf("write sector=%" PRId64 "\n", sector_num);
1074 #endif
1075 n = s->nsector;
1076 if (n > s->req_nb_sectors)
1077 n = s->req_nb_sectors;
1078 ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
1079
1080 if (ret != 0) {
1081 if (ide_handle_write_error(s, -ret, BM_STATUS_PIO_RETRY))
1082 return;
1083 }
1084
1085 s->nsector -= n;
1086 if (s->nsector == 0) {
1087 /* no more sectors to write */
1088 ide_transfer_stop(s);
1089 } else {
1090 n1 = s->nsector;
1091 if (n1 > s->req_nb_sectors)
1092 n1 = s->req_nb_sectors;
1093 ide_transfer_start(s, s->io_buffer, 512 * n1, ide_sector_write);
1094 }
1095 ide_set_sector(s, sector_num + n);
1096
1097 #ifdef TARGET_I386
1098 if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
1099 /* It seems there is a bug in the Windows 2000 installer HDD
1100 IDE driver which fills the disk with empty logs when the
1101 IDE write IRQ comes too early. This hack tries to correct
1102 that at the expense of slower write performances. Use this
1103 option _only_ to install Windows 2000. You must disable it
1104 for normal use. */
1105 qemu_mod_timer(s->sector_write_timer,
1106 qemu_get_clock(vm_clock) + (ticks_per_sec / 1000));
1107 } else
1108 #endif
1109 {
1110 ide_set_irq(s);
1111 }
1112 }
1113
1114 static void ide_dma_restart_bh(void *opaque)
1115 {
1116 BMDMAState *bm = opaque;
1117
1118 qemu_bh_delete(bm->bh);
1119 bm->bh = NULL;
1120
1121 if (bm->status & BM_STATUS_DMA_RETRY) {
1122 bm->status &= ~BM_STATUS_DMA_RETRY;
1123 ide_dma_restart(bm->ide_if);
1124 } else if (bm->status & BM_STATUS_PIO_RETRY) {
1125 bm->status &= ~BM_STATUS_PIO_RETRY;
1126 ide_sector_write(bm->ide_if);
1127 }
1128 }
1129
1130 static void ide_dma_restart_cb(void *opaque, int running, int reason)
1131 {
1132 BMDMAState *bm = opaque;
1133
1134 if (!running)
1135 return;
1136
1137 if (!bm->bh) {
1138 bm->bh = qemu_bh_new(ide_dma_restart_bh, bm);
1139 qemu_bh_schedule(bm->bh);
1140 }
1141 }
1142
1143 static void ide_write_dma_cb(void *opaque, int ret)
1144 {
1145 BMDMAState *bm = opaque;
1146 IDEState *s = bm->ide_if;
1147 int n;
1148 int64_t sector_num;
1149
1150 if (ret < 0) {
1151 if (ide_handle_write_error(s, -ret, BM_STATUS_DMA_RETRY))
1152 return;
1153 }
1154
1155 n = s->io_buffer_size >> 9;
1156 sector_num = ide_get_sector(s);
1157 if (n > 0) {
1158 dma_buf_commit(s, 0);
1159 sector_num += n;
1160 ide_set_sector(s, sector_num);
1161 s->nsector -= n;
1162 }
1163
1164 /* end of transfer ? */
1165 if (s->nsector == 0) {
1166 s->status = READY_STAT | SEEK_STAT;
1167 ide_set_irq(s);
1168 eot:
1169 bm->status &= ~BM_STATUS_DMAING;
1170 bm->status |= BM_STATUS_INT;
1171 bm->dma_cb = NULL;
1172 bm->ide_if = NULL;
1173 bm->aiocb = NULL;
1174 return;
1175 }
1176
1177 n = s->nsector;
1178 s->io_buffer_size = n * 512;
1179 /* launch next transfer */
1180 if (dma_buf_prepare(bm, 0) == 0)
1181 goto eot;
1182 #ifdef DEBUG_AIO
1183 printf("aio_write: sector_num=%" PRId64 " n=%d\n", sector_num, n);
1184 #endif
1185 bm->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num, ide_write_dma_cb, bm);
1186 ide_dma_submit_check(s, ide_write_dma_cb, bm);
1187 }
1188
1189 static void ide_sector_write_dma(IDEState *s)
1190 {
1191 s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
1192 s->io_buffer_index = 0;
1193 s->io_buffer_size = 0;
1194 s->is_read = 0;
1195 ide_dma_start(s, ide_write_dma_cb);
1196 }
1197
1198 static void ide_atapi_cmd_ok(IDEState *s)
1199 {
1200 s->error = 0;
1201 s->status = READY_STAT | SEEK_STAT;
1202 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1203 ide_set_irq(s);
1204 }
1205
1206 static void ide_atapi_cmd_error(IDEState *s, int sense_key, int asc)
1207 {
1208 #ifdef DEBUG_IDE_ATAPI
1209 printf("atapi_cmd_error: sense=0x%x asc=0x%x\n", sense_key, asc);
1210 #endif
1211 s->error = sense_key << 4;
1212 s->status = READY_STAT | ERR_STAT;
1213 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1214 s->sense_key = sense_key;
1215 s->asc = asc;
1216 ide_set_irq(s);
1217 }
1218
1219 static void ide_atapi_cmd_check_status(IDEState *s)
1220 {
1221 #ifdef DEBUG_IDE_ATAPI
1222 printf("atapi_cmd_check_status\n");
1223 #endif
1224 s->error = MC_ERR | (SENSE_UNIT_ATTENTION << 4);
1225 s->status = ERR_STAT;
1226 s->nsector = 0;
1227 ide_set_irq(s);
1228 }
1229
1230 static inline void cpu_to_ube16(uint8_t *buf, int val)
1231 {
1232 buf[0] = val >> 8;
1233 buf[1] = val & 0xff;
1234 }
1235
1236 static inline void cpu_to_ube32(uint8_t *buf, unsigned int val)
1237 {
1238 buf[0] = val >> 24;
1239 buf[1] = val >> 16;
1240 buf[2] = val >> 8;
1241 buf[3] = val & 0xff;
1242 }
1243
1244 static inline int ube16_to_cpu(const uint8_t *buf)
1245 {
1246 return (buf[0] << 8) | buf[1];
1247 }
1248
1249 static inline int ube32_to_cpu(const uint8_t *buf)
1250 {
1251 return (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
1252 }
1253
1254 static void lba_to_msf(uint8_t *buf, int lba)
1255 {
1256 lba += 150;
1257 buf[0] = (lba / 75) / 60;
1258 buf[1] = (lba / 75) % 60;
1259 buf[2] = lba % 75;
1260 }
1261
1262 static void cd_data_to_raw(uint8_t *buf, int lba)
1263 {
1264 /* sync bytes */
1265 buf[0] = 0x00;
1266 memset(buf + 1, 0xff, 10);
1267 buf[11] = 0x00;
1268 buf += 12;
1269 /* MSF */
1270 lba_to_msf(buf, lba);
1271 buf[3] = 0x01; /* mode 1 data */
1272 buf += 4;
1273 /* data */
1274 buf += 2048;
1275 /* XXX: ECC not computed */
1276 memset(buf, 0, 288);
1277 }
1278
1279 static int cd_read_sector(BlockDriverState *bs, int lba, uint8_t *buf,
1280 int sector_size)
1281 {
1282 int ret;
1283
1284 switch(sector_size) {
1285 case 2048:
1286 ret = bdrv_read(bs, (int64_t)lba << 2, buf, 4);
1287 break;
1288 case 2352:
1289 ret = bdrv_read(bs, (int64_t)lba << 2, buf + 16, 4);
1290 if (ret < 0)
1291 return ret;
1292 cd_data_to_raw(buf, lba);
1293 break;
1294 default:
1295 ret = -EIO;
1296 break;
1297 }
1298 return ret;
1299 }
1300
1301 static void ide_atapi_io_error(IDEState *s, int ret)
1302 {
1303 /* XXX: handle more errors */
1304 if (ret == -ENOMEDIUM) {
1305 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1306 ASC_MEDIUM_NOT_PRESENT);
1307 } else {
1308 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1309 ASC_LOGICAL_BLOCK_OOR);
1310 }
1311 }
1312
1313 /* The whole ATAPI transfer logic is handled in this function */
1314 static void ide_atapi_cmd_reply_end(IDEState *s)
1315 {
1316 int byte_count_limit, size, ret;
1317 #ifdef DEBUG_IDE_ATAPI
1318 printf("reply: tx_size=%d elem_tx_size=%d index=%d\n",
1319 s->packet_transfer_size,
1320 s->elementary_transfer_size,
1321 s->io_buffer_index);
1322 #endif
1323 if (s->packet_transfer_size <= 0) {
1324 /* end of transfer */
1325 ide_transfer_stop(s);
1326 s->status = READY_STAT | SEEK_STAT;
1327 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1328 ide_set_irq(s);
1329 #ifdef DEBUG_IDE_ATAPI
1330 printf("status=0x%x\n", s->status);
1331 #endif
1332 } else {
1333 /* see if a new sector must be read */
1334 if (s->lba != -1 && s->io_buffer_index >= s->cd_sector_size) {
1335 ret = cd_read_sector(s->bs, s->lba, s->io_buffer, s->cd_sector_size);
1336 if (ret < 0) {
1337 ide_transfer_stop(s);
1338 ide_atapi_io_error(s, ret);
1339 return;
1340 }
1341 s->lba++;
1342 s->io_buffer_index = 0;
1343 }
1344 if (s->elementary_transfer_size > 0) {
1345 /* there are some data left to transmit in this elementary
1346 transfer */
1347 size = s->cd_sector_size - s->io_buffer_index;
1348 if (size > s->elementary_transfer_size)
1349 size = s->elementary_transfer_size;
1350 ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
1351 size, ide_atapi_cmd_reply_end);
1352 s->packet_transfer_size -= size;
1353 s->elementary_transfer_size -= size;
1354 s->io_buffer_index += size;
1355 } else {
1356 /* a new transfer is needed */
1357 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO;
1358 byte_count_limit = s->lcyl | (s->hcyl << 8);
1359 #ifdef DEBUG_IDE_ATAPI
1360 printf("byte_count_limit=%d\n", byte_count_limit);
1361 #endif
1362 if (byte_count_limit == 0xffff)
1363 byte_count_limit--;
1364 size = s->packet_transfer_size;
1365 if (size > byte_count_limit) {
1366 /* byte count limit must be even if this case */
1367 if (byte_count_limit & 1)
1368 byte_count_limit--;
1369 size = byte_count_limit;
1370 }
1371 s->lcyl = size;
1372 s->hcyl = size >> 8;
1373 s->elementary_transfer_size = size;
1374 /* we cannot transmit more than one sector at a time */
1375 if (s->lba != -1) {
1376 if (size > (s->cd_sector_size - s->io_buffer_index))
1377 size = (s->cd_sector_size - s->io_buffer_index);
1378 }
1379 ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
1380 size, ide_atapi_cmd_reply_end);
1381 s->packet_transfer_size -= size;
1382 s->elementary_transfer_size -= size;
1383 s->io_buffer_index += size;
1384 ide_set_irq(s);
1385 #ifdef DEBUG_IDE_ATAPI
1386 printf("status=0x%x\n", s->status);
1387 #endif
1388 }
1389 }
1390 }
1391
1392 /* send a reply of 'size' bytes in s->io_buffer to an ATAPI command */
1393 static void ide_atapi_cmd_reply(IDEState *s, int size, int max_size)
1394 {
1395 if (size > max_size)
1396 size = max_size;
1397 s->lba = -1; /* no sector read */
1398 s->packet_transfer_size = size;
1399 s->io_buffer_size = size; /* dma: send the reply data as one chunk */
1400 s->elementary_transfer_size = 0;
1401 s->io_buffer_index = 0;
1402
1403 if (s->atapi_dma) {
1404 s->status = READY_STAT | SEEK_STAT | DRQ_STAT;
1405 ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
1406 } else {
1407 s->status = READY_STAT | SEEK_STAT;
1408 ide_atapi_cmd_reply_end(s);
1409 }
1410 }
1411
1412 /* start a CD-CDROM read command */
1413 static void ide_atapi_cmd_read_pio(IDEState *s, int lba, int nb_sectors,
1414 int sector_size)
1415 {
1416 s->lba = lba;
1417 s->packet_transfer_size = nb_sectors * sector_size;
1418 s->elementary_transfer_size = 0;
1419 s->io_buffer_index = sector_size;
1420 s->cd_sector_size = sector_size;
1421
1422 s->status = READY_STAT | SEEK_STAT;
1423 ide_atapi_cmd_reply_end(s);
1424 }
1425
1426 /* ATAPI DMA support */
1427
1428 /* XXX: handle read errors */
1429 static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
1430 {
1431 BMDMAState *bm = opaque;
1432 IDEState *s = bm->ide_if;
1433 int data_offset, n;
1434
1435 if (ret < 0) {
1436 ide_atapi_io_error(s, ret);
1437 goto eot;
1438 }
1439
1440 if (s->io_buffer_size > 0) {
1441 /*
1442 * For a cdrom read sector command (s->lba != -1),
1443 * adjust the lba for the next s->io_buffer_size chunk
1444 * and dma the current chunk.
1445 * For a command != read (s->lba == -1), just transfer
1446 * the reply data.
1447 */
1448 if (s->lba != -1) {
1449 if (s->cd_sector_size == 2352) {
1450 n = 1;
1451 cd_data_to_raw(s->io_buffer, s->lba);
1452 } else {
1453 n = s->io_buffer_size >> 11;
1454 }
1455 s->lba += n;
1456 }
1457 s->packet_transfer_size -= s->io_buffer_size;
1458 if (dma_buf_rw(bm, 1) == 0)
1459 goto eot;
1460 }
1461
1462 if (s->packet_transfer_size <= 0) {
1463 s->status = READY_STAT | SEEK_STAT;
1464 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1465 ide_set_irq(s);
1466 eot:
1467 bm->status &= ~BM_STATUS_DMAING;
1468 bm->status |= BM_STATUS_INT;
1469 bm->dma_cb = NULL;
1470 bm->ide_if = NULL;
1471 bm->aiocb = NULL;
1472 return;
1473 }
1474
1475 s->io_buffer_index = 0;
1476 if (s->cd_sector_size == 2352) {
1477 n = 1;
1478 s->io_buffer_size = s->cd_sector_size;
1479 data_offset = 16;
1480 } else {
1481 n = s->packet_transfer_size >> 11;
1482 if (n > (IDE_DMA_BUF_SECTORS / 4))
1483 n = (IDE_DMA_BUF_SECTORS / 4);
1484 s->io_buffer_size = n * 2048;
1485 data_offset = 0;
1486 }
1487 #ifdef DEBUG_AIO
1488 printf("aio_read_cd: lba=%u n=%d\n", s->lba, n);
1489 #endif
1490 bm->iov.iov_base = (void *)(s->io_buffer + data_offset);
1491 bm->iov.iov_len = n * 4 * 512;
1492 qemu_iovec_init_external(&bm->qiov, &bm->iov, 1);
1493 bm->aiocb = bdrv_aio_readv(s->bs, (int64_t)s->lba << 2, &bm->qiov,
1494 n * 4, ide_atapi_cmd_read_dma_cb, bm);
1495 if (!bm->aiocb) {
1496 /* Note: media not present is the most likely case */
1497 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1498 ASC_MEDIUM_NOT_PRESENT);
1499 goto eot;
1500 }
1501 }
1502
1503 /* start a CD-CDROM read command with DMA */
1504 /* XXX: test if DMA is available */
1505 static void ide_atapi_cmd_read_dma(IDEState *s, int lba, int nb_sectors,
1506 int sector_size)
1507 {
1508 s->lba = lba;
1509 s->packet_transfer_size = nb_sectors * sector_size;
1510 s->io_buffer_index = 0;
1511 s->io_buffer_size = 0;
1512 s->cd_sector_size = sector_size;
1513
1514 /* XXX: check if BUSY_STAT should be set */
1515 s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
1516 ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
1517 }
1518
1519 static void ide_atapi_cmd_read(IDEState *s, int lba, int nb_sectors,
1520 int sector_size)
1521 {
1522 #ifdef DEBUG_IDE_ATAPI
1523 printf("read %s: LBA=%d nb_sectors=%d\n", s->atapi_dma ? "dma" : "pio",
1524 lba, nb_sectors);
1525 #endif
1526 if (s->atapi_dma) {
1527 ide_atapi_cmd_read_dma(s, lba, nb_sectors, sector_size);
1528 } else {
1529 ide_atapi_cmd_read_pio(s, lba, nb_sectors, sector_size);
1530 }
1531 }
1532
1533 static inline uint8_t ide_atapi_set_profile(uint8_t *buf, uint8_t *index,
1534 uint16_t profile)
1535 {
1536 uint8_t *buf_profile = buf + 12; /* start of profiles */
1537
1538 buf_profile += ((*index) * 4); /* start of indexed profile */
1539 cpu_to_ube16 (buf_profile, profile);
1540 buf_profile[2] = ((buf_profile[0] == buf[6]) && (buf_profile[1] == buf[7]));
1541
1542 /* each profile adds 4 bytes to the response */
1543 (*index)++;
1544 buf[11] += 4; /* Additional Length */
1545
1546 return 4;
1547 }
1548
1549 static int ide_dvd_read_structure(IDEState *s, int format,
1550 const uint8_t *packet, uint8_t *buf)
1551 {
1552 switch (format) {
1553 case 0x0: /* Physical format information */
1554 {
1555 int layer = packet[6];
1556 uint64_t total_sectors;
1557
1558 if (layer != 0)
1559 return -ASC_INV_FIELD_IN_CMD_PACKET;
1560
1561 bdrv_get_geometry(s->bs, &total_sectors);
1562 total_sectors >>= 2;
1563 if (total_sectors == 0)
1564 return -ASC_MEDIUM_NOT_PRESENT;
1565
1566 buf[4] = 1; /* DVD-ROM, part version 1 */
1567 buf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
1568 buf[6] = 1; /* one layer, read-only (per MMC-2 spec) */
1569 buf[7] = 0; /* default densities */
1570
1571 /* FIXME: 0x30000 per spec? */
1572 cpu_to_ube32(buf + 8, 0); /* start sector */
1573 cpu_to_ube32(buf + 12, total_sectors - 1); /* end sector */
1574 cpu_to_ube32(buf + 16, total_sectors - 1); /* l0 end sector */
1575
1576 /* Size of buffer, not including 2 byte size field */
1577 cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1578
1579 /* 2k data + 4 byte header */
1580 return (2048 + 4);
1581 }
1582
1583 case 0x01: /* DVD copyright information */
1584 buf[4] = 0; /* no copyright data */
1585 buf[5] = 0; /* no region restrictions */
1586
1587 /* Size of buffer, not including 2 byte size field */
1588 cpu_to_be16wu((uint16_t *)buf, 4 + 2);
1589
1590 /* 4 byte header + 4 byte data */
1591 return (4 + 4);
1592
1593 case 0x03: /* BCA information - invalid field for no BCA info */
1594 return -ASC_INV_FIELD_IN_CMD_PACKET;
1595
1596 case 0x04: /* DVD disc manufacturing information */
1597 /* Size of buffer, not including 2 byte size field */
1598 cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1599
1600 /* 2k data + 4 byte header */
1601 return (2048 + 4);
1602
1603 case 0xff:
1604 /*
1605 * This lists all the command capabilities above. Add new ones
1606 * in order and update the length and buffer return values.
1607 */
1608
1609 buf[4] = 0x00; /* Physical format */
1610 buf[5] = 0x40; /* Not writable, is readable */
1611 cpu_to_be16wu((uint16_t *)(buf + 6), 2048 + 4);
1612
1613 buf[8] = 0x01; /* Copyright info */
1614 buf[9] = 0x40; /* Not writable, is readable */
1615 cpu_to_be16wu((uint16_t *)(buf + 10), 4 + 4);
1616
1617 buf[12] = 0x03; /* BCA info */
1618 buf[13] = 0x40; /* Not writable, is readable */
1619 cpu_to_be16wu((uint16_t *)(buf + 14), 188 + 4);
1620
1621 buf[16] = 0x04; /* Manufacturing info */
1622 buf[17] = 0x40; /* Not writable, is readable */
1623 cpu_to_be16wu((uint16_t *)(buf + 18), 2048 + 4);
1624
1625 /* Size of buffer, not including 2 byte size field */
1626 cpu_to_be16wu((uint16_t *)buf, 16 + 2);
1627
1628 /* data written + 4 byte header */
1629 return (16 + 4);
1630
1631 default: /* TODO: formats beyond DVD-ROM requires */
1632 return -ASC_INV_FIELD_IN_CMD_PACKET;
1633 }
1634 }
1635
1636 static void ide_atapi_cmd(IDEState *s)
1637 {
1638 const uint8_t *packet;
1639 uint8_t *buf;
1640 int max_len;
1641
1642 packet = s->io_buffer;
1643 buf = s->io_buffer;
1644 #ifdef DEBUG_IDE_ATAPI
1645 {
1646 int i;
1647 printf("ATAPI limit=0x%x packet:", s->lcyl | (s->hcyl << 8));
1648 for(i = 0; i < ATAPI_PACKET_SIZE; i++) {
1649 printf(" %02x", packet[i]);
1650 }
1651 printf("\n");
1652 }
1653 #endif
1654 /* If there's a UNIT_ATTENTION condition pending, only
1655 REQUEST_SENSE and INQUIRY commands are allowed to complete. */
1656 if (s->sense_key == SENSE_UNIT_ATTENTION &&
1657 s->io_buffer[0] != GPCMD_REQUEST_SENSE &&
1658 s->io_buffer[0] != GPCMD_INQUIRY) {
1659 ide_atapi_cmd_check_status(s);
1660 return;
1661 }
1662 switch(s->io_buffer[0]) {
1663 case GPCMD_TEST_UNIT_READY:
1664 if (bdrv_is_inserted(s->bs) && !s->cdrom_changed) {
1665 ide_atapi_cmd_ok(s);
1666 } else {
1667 s->cdrom_changed = 0;
1668 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1669 ASC_MEDIUM_NOT_PRESENT);
1670 }
1671 break;
1672 case GPCMD_MODE_SENSE_6:
1673 case GPCMD_MODE_SENSE_10:
1674 {
1675 int action, code;
1676 if (packet[0] == GPCMD_MODE_SENSE_10)
1677 max_len = ube16_to_cpu(packet + 7);
1678 else
1679 max_len = packet[4];
1680 action = packet[2] >> 6;
1681 code = packet[2] & 0x3f;
1682 switch(action) {
1683 case 0: /* current values */
1684 switch(code) {
1685 case 0x01: /* error recovery */
1686 cpu_to_ube16(&buf[0], 16 + 6);
1687 buf[2] = 0x70;
1688 buf[3] = 0;
1689 buf[4] = 0;
1690 buf[5] = 0;
1691 buf[6] = 0;
1692 buf[7] = 0;
1693
1694 buf[8] = 0x01;
1695 buf[9] = 0x06;
1696 buf[10] = 0x00;
1697 buf[11] = 0x05;
1698 buf[12] = 0x00;
1699 buf[13] = 0x00;
1700 buf[14] = 0x00;
1701 buf[15] = 0x00;
1702 ide_atapi_cmd_reply(s, 16, max_len);
1703 break;
1704 case 0x2a:
1705 cpu_to_ube16(&buf[0], 28 + 6);
1706 buf[2] = 0x70;
1707 buf[3] = 0;
1708 buf[4] = 0;
1709 buf[5] = 0;
1710 buf[6] = 0;
1711 buf[7] = 0;
1712
1713 buf[8] = 0x2a;
1714 buf[9] = 0x12;
1715 buf[10] = 0x00;
1716 buf[11] = 0x00;
1717
1718 /* Claim PLAY_AUDIO capability (0x01) since some Linux
1719 code checks for this to automount media. */
1720 buf[12] = 0x71;
1721 buf[13] = 3 << 5;
1722 buf[14] = (1 << 0) | (1 << 3) | (1 << 5);
1723 if (bdrv_is_locked(s->bs))
1724 buf[6] |= 1 << 1;
1725 buf[15] = 0x00;
1726 cpu_to_ube16(&buf[16], 706);
1727 buf[18] = 0;
1728 buf[19] = 2;
1729 cpu_to_ube16(&buf[20], 512);
1730 cpu_to_ube16(&buf[22], 706);
1731 buf[24] = 0;
1732 buf[25] = 0;
1733 buf[26] = 0;
1734 buf[27] = 0;
1735 ide_atapi_cmd_reply(s, 28, max_len);
1736 break;
1737 default:
1738 goto error_cmd;
1739 }
1740 break;
1741 case 1: /* changeable values */
1742 goto error_cmd;
1743 case 2: /* default values */
1744 goto error_cmd;
1745 default:
1746 case 3: /* saved values */
1747 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1748 ASC_SAVING_PARAMETERS_NOT_SUPPORTED);
1749 break;
1750 }
1751 }
1752 break;
1753 case GPCMD_REQUEST_SENSE:
1754 max_len = packet[4];
1755 memset(buf, 0, 18);
1756 buf[0] = 0x70 | (1 << 7);
1757 buf[2] = s->sense_key;
1758 buf[7] = 10;
1759 buf[12] = s->asc;
1760 if (s->sense_key == SENSE_UNIT_ATTENTION)
1761 s->sense_key = SENSE_NONE;
1762 ide_atapi_cmd_reply(s, 18, max_len);
1763 break;
1764 case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
1765 if (bdrv_is_inserted(s->bs)) {
1766 bdrv_set_locked(s->bs, packet[4] & 1);
1767 ide_atapi_cmd_ok(s);
1768 } else {
1769 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1770 ASC_MEDIUM_NOT_PRESENT);
1771 }
1772 break;
1773 case GPCMD_READ_10:
1774 case GPCMD_READ_12:
1775 {
1776 int nb_sectors, lba;
1777
1778 if (packet[0] == GPCMD_READ_10)
1779 nb_sectors = ube16_to_cpu(packet + 7);
1780 else
1781 nb_sectors = ube32_to_cpu(packet + 6);
1782 lba = ube32_to_cpu(packet + 2);
1783 if (nb_sectors == 0) {
1784 ide_atapi_cmd_ok(s);
1785 break;
1786 }
1787 ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1788 }
1789 break;
1790 case GPCMD_READ_CD:
1791 {
1792 int nb_sectors, lba, transfer_request;
1793
1794 nb_sectors = (packet[6] << 16) | (packet[7] << 8) | packet[8];
1795 lba = ube32_to_cpu(packet + 2);
1796 if (nb_sectors == 0) {
1797 ide_atapi_cmd_ok(s);
1798 break;
1799 }
1800 transfer_request = packet[9];
1801 switch(transfer_request & 0xf8) {
1802 case 0x00:
1803 /* nothing */
1804 ide_atapi_cmd_ok(s);
1805 break;
1806 case 0x10:
1807 /* normal read */
1808 ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1809 break;
1810 case 0xf8:
1811 /* read all data */
1812 ide_atapi_cmd_read(s, lba, nb_sectors, 2352);
1813 break;
1814 default:
1815 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1816 ASC_INV_FIELD_IN_CMD_PACKET);
1817 break;
1818 }
1819 }
1820 break;
1821 case GPCMD_SEEK:
1822 {
1823 unsigned int lba;
1824 uint64_t total_sectors;
1825
1826 bdrv_get_geometry(s->bs, &total_sectors);
1827 total_sectors >>= 2;
1828 if (total_sectors == 0) {
1829 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1830 ASC_MEDIUM_NOT_PRESENT);
1831 break;
1832 }
1833 lba = ube32_to_cpu(packet + 2);
1834 if (lba >= total_sectors) {
1835 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1836 ASC_LOGICAL_BLOCK_OOR);
1837 break;
1838 }
1839 ide_atapi_cmd_ok(s);
1840 }
1841 break;
1842 case GPCMD_START_STOP_UNIT:
1843 {
1844 int start, eject, err = 0;
1845 start = packet[4] & 1;
1846 eject = (packet[4] >> 1) & 1;
1847
1848 if (eject) {
1849 err = bdrv_eject(s->bs, !start);
1850 }
1851
1852 switch (err) {
1853 case 0:
1854 ide_atapi_cmd_ok(s);
1855 break;
1856 case -EBUSY:
1857 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1858 ASC_MEDIA_REMOVAL_PREVENTED);
1859 break;
1860 default:
1861 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1862 ASC_MEDIUM_NOT_PRESENT);
1863 break;
1864 }
1865 }
1866 break;
1867 case GPCMD_MECHANISM_STATUS:
1868 {
1869 max_len = ube16_to_cpu(packet + 8);
1870 cpu_to_ube16(buf, 0);
1871 /* no current LBA */
1872 buf[2] = 0;
1873 buf[3] = 0;
1874 buf[4] = 0;
1875 buf[5] = 1;
1876 cpu_to_ube16(buf + 6, 0);
1877 ide_atapi_cmd_reply(s, 8, max_len);
1878 }
1879 break;
1880 case GPCMD_READ_TOC_PMA_ATIP:
1881 {
1882 int format, msf, start_track, len;
1883 uint64_t total_sectors;
1884
1885 bdrv_get_geometry(s->bs, &total_sectors);
1886 total_sectors >>= 2;
1887 if (total_sectors == 0) {
1888 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1889 ASC_MEDIUM_NOT_PRESENT);
1890 break;
1891 }
1892 max_len = ube16_to_cpu(packet + 7);
1893 format = packet[9] >> 6;
1894 msf = (packet[1] >> 1) & 1;
1895 start_track = packet[6];
1896 switch(format) {
1897 case 0:
1898 len = cdrom_read_toc(total_sectors, buf, msf, start_track);
1899 if (len < 0)
1900 goto error_cmd;
1901 ide_atapi_cmd_reply(s, len, max_len);
1902 break;
1903 case 1:
1904 /* multi session : only a single session defined */
1905 memset(buf, 0, 12);
1906 buf[1] = 0x0a;
1907 buf[2] = 0x01;
1908 buf[3] = 0x01;
1909 ide_atapi_cmd_reply(s, 12, max_len);
1910 break;
1911 case 2:
1912 len = cdrom_read_toc_raw(total_sectors, buf, msf, start_track);
1913 if (len < 0)
1914 goto error_cmd;
1915 ide_atapi_cmd_reply(s, len, max_len);
1916 break;
1917 default:
1918 error_cmd:
1919 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1920 ASC_INV_FIELD_IN_CMD_PACKET);
1921 break;
1922 }
1923 }
1924 break;
1925 case GPCMD_READ_CDVD_CAPACITY:
1926 {
1927 uint64_t total_sectors;
1928
1929 bdrv_get_geometry(s->bs, &total_sectors);
1930 total_sectors >>= 2;
1931 if (total_sectors == 0) {
1932 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1933 ASC_MEDIUM_NOT_PRESENT);
1934 break;
1935 }
1936 /* NOTE: it is really the number of sectors minus 1 */
1937 cpu_to_ube32(buf, total_sectors - 1);
1938 cpu_to_ube32(buf + 4, 2048);
1939 ide_atapi_cmd_reply(s, 8, 8);
1940 }
1941 break;
1942 case GPCMD_READ_DVD_STRUCTURE:
1943 {
1944 int media = packet[1];
1945 int format = packet[7];
1946 int ret;
1947
1948 max_len = ube16_to_cpu(packet + 8);
1949
1950 if (format < 0xff) {
1951 if (media_is_cd(s)) {
1952 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1953 ASC_INCOMPATIBLE_FORMAT);
1954 break;
1955 } else if (!media_present(s)) {
1956 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1957 ASC_INV_FIELD_IN_CMD_PACKET);
1958 break;
1959 }
1960 }
1961
1962 memset(buf, 0, max_len > IDE_DMA_BUF_SECTORS * 512 + 4 ?
1963 IDE_DMA_BUF_SECTORS * 512 + 4 : max_len);
1964
1965 switch (format) {
1966 case 0x00 ... 0x7f:
1967 case 0xff:
1968 if (media == 0) {
1969 ret = ide_dvd_read_structure(s, format, packet, buf);
1970
1971 if (ret < 0)
1972 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST, -ret);
1973 else
1974 ide_atapi_cmd_reply(s, ret, max_len);
1975
1976 break;
1977 }
1978 /* TODO: BD support, fall through for now */
1979
1980 /* Generic disk structures */
1981 case 0x80: /* TODO: AACS volume identifier */
1982 case 0x81: /* TODO: AACS media serial number */
1983 case 0x82: /* TODO: AACS media identifier */
1984 case 0x83: /* TODO: AACS media key block */
1985 case 0x90: /* TODO: List of recognized format layers */
1986 case 0xc0: /* TODO: Write protection status */
1987 default:
1988 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1989 ASC_INV_FIELD_IN_CMD_PACKET);
1990 break;
1991 }
1992 }
1993 break;
1994 case GPCMD_SET_SPEED:
1995 ide_atapi_cmd_ok(s);
1996 break;
1997 case GPCMD_INQUIRY:
1998 max_len = packet[4];
1999 buf[0] = 0x05; /* CD-ROM */
2000 buf[1] = 0x80; /* removable */
2001 buf[2] = 0x00; /* ISO */
2002 buf[3] = 0x21; /* ATAPI-2 (XXX: put ATAPI-4 ?) */
2003 buf[4] = 31; /* additional length */
2004 buf[5] = 0; /* reserved */
2005 buf[6] = 0; /* reserved */
2006 buf[7] = 0; /* reserved */
2007 padstr8(buf + 8, 8, "QEMU");
2008 padstr8(buf + 16, 16, "QEMU DVD-ROM");
2009 padstr8(buf + 32, 4, QEMU_VERSION);
2010 ide_atapi_cmd_reply(s, 36, max_len);
2011 break;
2012 case GPCMD_GET_CONFIGURATION:
2013 {
2014 uint32_t len;
2015 uint8_t index = 0;
2016
2017 /* only feature 0 is supported */
2018 if (packet[2] != 0 || packet[3] != 0) {
2019 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
2020 ASC_INV_FIELD_IN_CMD_PACKET);
2021 break;
2022 }
2023
2024 /* XXX: could result in alignment problems in some architectures */
2025 max_len = ube16_to_cpu(packet + 7);
2026
2027 /*
2028 * XXX: avoid overflow for io_buffer if max_len is bigger than
2029 * the size of that buffer (dimensioned to max number of
2030 * sectors to transfer at once)
2031 *
2032 * Only a problem if the feature/profiles grow.
2033 */
2034 if (max_len > 512) /* XXX: assume 1 sector */
2035 max_len = 512;
2036
2037 memset(buf, 0, max_len);
2038 /*
2039 * the number of sectors from the media tells us which profile
2040 * to use as current. 0 means there is no media
2041 */
2042 if (media_is_dvd(s))
2043 cpu_to_ube16(buf + 6, MMC_PROFILE_DVD_ROM);
2044 else if (media_is_cd(s))
2045 cpu_to_ube16(buf + 6, MMC_PROFILE_CD_ROM);
2046
2047 buf[10] = 0x02 | 0x01; /* persistent and current */
2048 len = 12; /* headers: 8 + 4 */
2049 len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_DVD_ROM);
2050 len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_CD_ROM);
2051 cpu_to_ube32(buf, len - 4); /* data length */
2052
2053 ide_atapi_cmd_reply(s, len, max_len);
2054 break;
2055 }
2056 default:
2057 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
2058 ASC_ILLEGAL_OPCODE);
2059 break;
2060 }
2061 }
2062
2063 static void ide_cfata_metadata_inquiry(IDEState *s)
2064 {
2065 uint16_t *p;
2066 uint32_t spd;
2067
2068 p = (uint16_t *) s->io_buffer;
2069 memset(p, 0, 0x200);
2070 spd = ((s->mdata_size - 1) >> 9) + 1;
2071
2072 put_le16(p + 0, 0x0001); /* Data format revision */
2073 put_le16(p + 1, 0x0000); /* Media property: silicon */
2074 put_le16(p + 2, s->media_changed); /* Media status */
2075 put_le16(p + 3, s->mdata_size & 0xffff); /* Capacity in bytes (low) */
2076 put_le16(p + 4, s->mdata_size >> 16); /* Capacity in bytes (high) */
2077 put_le16(p + 5, spd & 0xffff); /* Sectors per device (low) */
2078 put_le16(p + 6, spd >> 16); /* Sectors per device (high) */
2079 }
2080
2081 static void ide_cfata_metadata_read(IDEState *s)
2082 {
2083 uint16_t *p;
2084
2085 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
2086 s->status = ERR_STAT;
2087 s->error = ABRT_ERR;
2088 return;
2089 }
2090
2091 p = (uint16_t *) s->io_buffer;
2092 memset(p, 0, 0x200);
2093
2094 put_le16(p + 0, s->media_changed); /* Media status */
2095 memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
2096 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
2097 s->nsector << 9), 0x200 - 2));
2098 }
2099
2100 static void ide_cfata_metadata_write(IDEState *s)
2101 {
2102 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
2103 s->status = ERR_STAT;
2104 s->error = ABRT_ERR;
2105 return;
2106 }
2107
2108 s->media_changed = 0;
2109
2110 memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
2111 s->io_buffer + 2,
2112 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
2113 s->nsector << 9), 0x200 - 2));
2114 }
2115
2116 /* called when the inserted state of the media has changed */
2117 static void cdrom_change_cb(void *opaque)
2118 {
2119 IDEState *s = opaque;
2120 uint64_t nb_sectors;
2121
2122 bdrv_get_geometry(s->bs, &nb_sectors);
2123 s->nb_sectors = nb_sectors;
2124
2125 s->sense_key = SENSE_UNIT_ATTENTION;
2126 s->asc = ASC_MEDIUM_MAY_HAVE_CHANGED;
2127 s->cdrom_changed = 1;
2128 ide_set_irq(s);
2129 }
2130
2131 static void ide_cmd_lba48_transform(IDEState *s, int lba48)
2132 {
2133 s->lba48 = lba48;
2134
2135 /* handle the 'magic' 0 nsector count conversion here. to avoid
2136 * fiddling with the rest of the read logic, we just store the
2137 * full sector count in ->nsector and ignore ->hob_nsector from now
2138 */
2139 if (!s->lba48) {
2140 if (!s->nsector)
2141 s->nsector = 256;
2142 } else {
2143 if (!s->nsector && !s->hob_nsector)
2144 s->nsector = 65536;
2145 else {
2146 int lo = s->nsector;
2147 int hi = s->hob_nsector;
2148
2149 s->nsector = (hi << 8) | lo;
2150 }
2151 }
2152 }
2153
2154 static void ide_clear_hob(IDEState *ide_if)
2155 {
2156 /* any write clears HOB high bit of device control register */
2157 ide_if[0].select &= ~(1 << 7);
2158 ide_if[1].select &= ~(1 << 7);
2159 }
2160
2161 static void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
2162 {
2163 IDEState *ide_if = opaque;
2164 IDEState *s;
2165 int unit, n;
2166 int lba48 = 0;
2167
2168 #ifdef DEBUG_IDE
2169 printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
2170 #endif
2171
2172 addr &= 7;
2173
2174 /* ignore writes to command block while busy with previous command */
2175 if (addr != 7 && (ide_if->cur_drive->status & (BUSY_STAT|DRQ_STAT)))
2176 return;
2177
2178 switch(addr) {
2179 case 0:
2180 break;
2181 case 1:
2182 ide_clear_hob(ide_if);
2183 /* NOTE: data is written to the two drives */
2184 ide_if[0].hob_feature = ide_if[0].feature;
2185 ide_if[1].hob_feature = ide_if[1].feature;
2186 ide_if[0].feature = val;
2187 ide_if[1].feature = val;
2188 break;
2189 case 2:
2190 ide_clear_hob(ide_if);
2191 ide_if[0].hob_nsector = ide_if[0].nsector;
2192 ide_if[1].hob_nsector = ide_if[1].nsector;
2193 ide_if[0].nsector = val;
2194 ide_if[1].nsector = val;
2195 break;
2196 case 3:
2197 ide_clear_hob(ide_if);
2198 ide_if[0].hob_sector = ide_if[0].sector;
2199 ide_if[1].hob_sector = ide_if[1].sector;
2200 ide_if[0].sector = val;
2201 ide_if[1].sector = val;
2202 break;
2203 case 4:
2204 ide_clear_hob(ide_if);
2205 ide_if[0].hob_lcyl = ide_if[0].lcyl;
2206 ide_if[1].hob_lcyl = ide_if[1].lcyl;
2207 ide_if[0].lcyl = val;
2208 ide_if[1].lcyl = val;
2209 break;
2210 case 5:
2211 ide_clear_hob(ide_if);
2212 ide_if[0].hob_hcyl = ide_if[0].hcyl;
2213 ide_if[1].hob_hcyl = ide_if[1].hcyl;
2214 ide_if[0].hcyl = val;
2215 ide_if[1].hcyl = val;
2216 break;
2217 case 6:
2218 /* FIXME: HOB readback uses bit 7 */
2219 ide_if[0].select = (val & ~0x10) | 0xa0;
2220 ide_if[1].select = (val | 0x10) | 0xa0;
2221 /* select drive */
2222 unit = (val >> 4) & 1;
2223 s = ide_if + unit;
2224 ide_if->cur_drive = s;
2225 break;
2226 default:
2227 case 7:
2228 /* command */
2229 #if defined(DEBUG_IDE)
2230 printf("ide: CMD=%02x\n", val);
2231 #endif
2232 s = ide_if->cur_drive;
2233 /* ignore commands to non existant slave */
2234 if (s != ide_if && !s->bs)
2235 break;
2236
2237 /* Only DEVICE RESET is allowed while BSY or/and DRQ are set */
2238 if ((s->status & (BUSY_STAT|DRQ_STAT)) && val != WIN_DEVICE_RESET)
2239 break;
2240
2241 switch(val) {
2242 case WIN_IDENTIFY:
2243 if (s->bs && !s->is_cdrom) {
2244 if (!s->is_cf)
2245 ide_identify(s);
2246 else
2247 ide_cfata_identify(s);
2248 s->status = READY_STAT | SEEK_STAT;
2249 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
2250 } else {
2251 if (s->is_cdrom) {
2252 ide_set_signature(s);
2253 }
2254 ide_abort_command(s);
2255 }
2256 ide_set_irq(s);
2257 break;
2258 case WIN_SPECIFY:
2259 case WIN_RECAL:
2260 s->error = 0;
2261 s->status = READY_STAT | SEEK_STAT;
2262 ide_set_irq(s);
2263 break;
2264 case WIN_SETMULT:
2265 if (s->is_cf && s->nsector == 0) {
2266 /* Disable Read and Write Multiple */
2267 s->mult_sectors = 0;
2268 s->status = READY_STAT | SEEK_STAT;
2269 } else if ((s->nsector & 0xff) != 0 &&
2270 ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
2271 (s->nsector & (s->nsector - 1)) != 0)) {
2272 ide_abort_command(s);
2273 } else {
2274 s->mult_sectors = s->nsector & 0xff;
2275 s->status = READY_STAT | SEEK_STAT;
2276 }
2277 ide_set_irq(s);
2278 break;
2279 case WIN_VERIFY_EXT:
2280 lba48 = 1;
2281 case WIN_VERIFY:
2282 case WIN_VERIFY_ONCE:
2283 /* do sector number check ? */
2284 ide_cmd_lba48_transform(s, lba48);
2285 s->status = READY_STAT | SEEK_STAT;
2286 ide_set_irq(s);
2287 break;
2288 case WIN_READ_EXT:
2289 lba48 = 1;
2290 case WIN_READ:
2291 case WIN_READ_ONCE:
2292 if (!s->bs)
2293 goto abort_cmd;
2294 ide_cmd_lba48_transform(s, lba48);
2295 s->req_nb_sectors = 1;
2296 ide_sector_read(s);
2297 break;
2298 case WIN_WRITE_EXT:
2299 lba48 = 1;
2300 case WIN_WRITE:
2301 case WIN_WRITE_ONCE:
2302 case CFA_WRITE_SECT_WO_ERASE:
2303 case WIN_WRITE_VERIFY:
2304 ide_cmd_lba48_transform(s, lba48);
2305 s->error = 0;
2306 s->status = SEEK_STAT | READY_STAT;
2307 s->req_nb_sectors = 1;
2308 ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
2309 s->media_changed = 1;
2310 break;
2311 case WIN_MULTREAD_EXT:
2312 lba48 = 1;
2313 case WIN_MULTREAD:
2314 if (!s->mult_sectors)
2315 goto abort_cmd;
2316 ide_cmd_lba48_transform(s, lba48);
2317 s->req_nb_sectors = s->mult_sectors;
2318 ide_sector_read(s);
2319 break;
2320 case WIN_MULTWRITE_EXT:
2321 lba48 = 1;
2322 case WIN_MULTWRITE:
2323 case CFA_WRITE_MULTI_WO_ERASE:
2324 if (!s->mult_sectors)
2325 goto abort_cmd;
2326 ide_cmd_lba48_transform(s, lba48);
2327 s->error = 0;
2328 s->status = SEEK_STAT | READY_STAT;
2329 s->req_nb_sectors = s->mult_sectors;
2330 n = s->nsector;
2331 if (n > s->req_nb_sectors)
2332 n = s->req_nb_sectors;
2333 ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
2334 s->media_changed = 1;
2335 break;
2336 case WIN_READDMA_EXT:
2337 lba48 = 1;
2338 case WIN_READDMA:
2339 case WIN_READDMA_ONCE:
2340 if (!s->bs)
2341 goto abort_cmd;
2342 ide_cmd_lba48_transform(s, lba48);
2343 ide_sector_read_dma(s);
2344 break;
2345 case WIN_WRITEDMA_EXT:
2346 lba48 = 1;
2347 case WIN_WRITEDMA:
2348 case WIN_WRITEDMA_ONCE:
2349 if (!s->bs)
2350 goto abort_cmd;
2351 ide_cmd_lba48_transform(s, lba48);
2352 ide_sector_write_dma(s);
2353 s->media_changed = 1;
2354 break;
2355 case WIN_READ_NATIVE_MAX_EXT:
2356 lba48 = 1;
2357 case WIN_READ_NATIVE_MAX:
2358 ide_cmd_lba48_transform(s, lba48);
2359 ide_set_sector(s, s->nb_sectors - 1);
2360 s->status = READY_STAT | SEEK_STAT;
2361 ide_set_irq(s);
2362 break;
2363 case WIN_CHECKPOWERMODE1:
2364 case WIN_CHECKPOWERMODE2:
2365 s->nsector = 0xff; /* device active or idle */
2366 s->status = READY_STAT | SEEK_STAT;
2367 ide_set_irq(s);
2368 break;
2369 case WIN_SETFEATURES:
2370 if (!s->bs)
2371 goto abort_cmd;
2372 /* XXX: valid for CDROM ? */
2373 switch(s->feature) {
2374 case 0xcc: /* reverting to power-on defaults enable */
2375 case 0x66: /* reverting to power-on defaults disable */
2376 case 0x02: /* write cache enable */
2377 case 0x82: /* write cache disable */
2378 case 0xaa: /* read look-ahead enable */
2379 case 0x55: /* read look-ahead disable */
2380 case 0x05: /* set advanced power management mode */
2381 case 0x85: /* disable advanced power management mode */
2382 case 0x69: /* NOP */
2383 case 0x67: /* NOP */
2384 case 0x96: /* NOP */
2385 case 0x9a: /* NOP */
2386 case 0x42: /* enable Automatic Acoustic Mode */
2387 case 0xc2: /* disable Automatic Acoustic Mode */
2388 s->status = READY_STAT | SEEK_STAT;
2389 ide_set_irq(s);
2390 break;
2391 case 0x03: { /* set transfer mode */
2392 uint8_t val = s->nsector & 0x07;
2393
2394 switch (s->nsector >> 3) {
2395 case 0x00: /* pio default */
2396 case 0x01: /* pio mode */
2397 put_le16(s->identify_data + 62,0x07);
2398 put_le16(s->identify_data + 63,0x07);
2399 put_le16(s->identify_data + 88,0x3f);
2400 break;
2401 case 0x02: /* sigle word dma mode*/
2402 put_le16(s->identify_data + 62,0x07 | (1 << (val + 8)));
2403 put_le16(s->identify_data + 63,0x07);
2404 put_le16(s->identify_data + 88,0x3f);
2405 break;
2406 case 0x04: /* mdma mode */
2407 put_le16(s->identify_data + 62,0x07);
2408 put_le16(s->identify_data + 63,0x07 | (1 << (val + 8)));
2409 put_le16(s->identify_data + 88,0x3f);
2410 break;
2411 case 0x08: /* udma mode */
2412 put_le16(s->identify_data + 62,0x07);
2413 put_le16(s->identify_data + 63,0x07);
2414 put_le16(s->identify_data + 88,0x3f | (1 << (val + 8)));
2415 break;
2416 default:
2417 goto abort_cmd;
2418 }
2419 s->status = READY_STAT | SEEK_STAT;
2420 ide_set_irq(s);
2421 break;
2422 }
2423 default:
2424 goto abort_cmd;
2425 }
2426 break;
2427 case WIN_FLUSH_CACHE:
2428 case WIN_FLUSH_CACHE_EXT:
2429 if (s->bs)
2430 bdrv_flush(s->bs);
2431 s->status = READY_STAT | SEEK_STAT;
2432 ide_set_irq(s);
2433 break;
2434 case WIN_STANDBY:
2435 case WIN_STANDBY2:
2436 case WIN_STANDBYNOW1:
2437 case WIN_STANDBYNOW2:
2438 case WIN_IDLEIMMEDIATE:
2439 case CFA_IDLEIMMEDIATE:
2440 case WIN_SETIDLE1:
2441 case WIN_SETIDLE2:
2442 case WIN_SLEEPNOW1:
2443 case WIN_SLEEPNOW2:
2444 s->status = READY_STAT;
2445 ide_set_irq(s);
2446 break;
2447 case WIN_SEEK:
2448 if(s->is_cdrom)
2449 goto abort_cmd;
2450 /* XXX: Check that seek is within bounds */
2451 s->status = READY_STAT | SEEK_STAT;
2452 ide_set_irq(s);
2453 break;
2454 /* ATAPI commands */
2455 case WIN_PIDENTIFY:
2456 if (s->is_cdrom) {
2457 ide_atapi_identify(s);
2458 s->status = READY_STAT | SEEK_STAT;
2459 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
2460 } else {
2461 ide_abort_command(s);
2462 }
2463 ide_set_irq(s);
2464 break;
2465 case WIN_DIAGNOSE:
2466 ide_set_signature(s);
2467 if (s->is_cdrom)
2468 s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
2469 * devices to return a clear status register
2470 * with READY_STAT *not* set. */
2471 else
2472 s->status = READY_STAT | SEEK_STAT;
2473 s->error = 0x01; /* Device 0 passed, Device 1 passed or not
2474 * present.
2475 */
2476 ide_set_irq(s);
2477 break;
2478 case WIN_SRST:
2479 if (!s->is_cdrom)
2480 goto abort_cmd;
2481 ide_set_signature(s);
2482 s->status = 0x00; /* NOTE: READY is _not_ set */
2483 s->error = 0x01;
2484 break;
2485 case WIN_PACKETCMD:
2486 if (!s->is_cdrom)
2487 goto abort_cmd;
2488 /* overlapping commands not supported */
2489 if (s->feature & 0x02)
2490 goto abort_cmd;
2491 s->status = READY_STAT | SEEK_STAT;
2492 s->atapi_dma = s->feature & 1;
2493 s->nsector = 1;
2494 ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
2495 ide_atapi_cmd);
2496 break;
2497 /* CF-ATA commands */
2498 case CFA_REQ_EXT_ERROR_CODE:
2499 if (!s->is_cf)
2500 goto abort_cmd;
2501 s->error = 0x09; /* miscellaneous error */
2502 s->status = READY_STAT | SEEK_STAT;
2503 ide_set_irq(s);
2504 break;
2505 case CFA_ERASE_SECTORS:
2506 case CFA_WEAR_LEVEL:
2507 if (!s->is_cf)
2508 goto abort_cmd;
2509 if (val == CFA_WEAR_LEVEL)
2510 s->nsector = 0;
2511 if (val == CFA_ERASE_SECTORS)
2512 s->media_changed = 1;
2513 s->error = 0x00;
2514 s->status = READY_STAT | SEEK_STAT;
2515 ide_set_irq(s);
2516 break;
2517 case CFA_TRANSLATE_SECTOR:
2518 if (!s->is_cf)
2519 goto abort_cmd;
2520 s->error = 0x00;
2521 s->status = READY_STAT | SEEK_STAT;
2522 memset(s->io_buffer, 0, 0x200);
2523 s->io_buffer[0x00] = s->hcyl; /* Cyl MSB */
2524 s->io_buffer[0x01] = s->lcyl; /* Cyl LSB */
2525 s->io_buffer[0x02] = s->select; /* Head */
2526 s->io_buffer[0x03] = s->sector; /* Sector */
2527 s->io_buffer[0x04] = ide_get_sector(s) >> 16; /* LBA MSB */
2528 s->io_buffer[0x05] = ide_get_sector(s) >> 8; /* LBA */
2529 s->io_buffer[0x06] = ide_get_sector(s) >> 0; /* LBA LSB */
2530 s->io_buffer[0x13] = 0x00; /* Erase flag */
2531 s->io_buffer[0x18] = 0x00; /* Hot count */
2532 s->io_buffer[0x19] = 0x00; /* Hot count */
2533 s->io_buffer[0x1a] = 0x01; /* Hot count */
2534 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2535 ide_set_irq(s);
2536 break;
2537 case CFA_ACCESS_METADATA_STORAGE:
2538 if (!s->is_cf)
2539 goto abort_cmd;
2540 switch (s->feature) {
2541 case 0x02: /* Inquiry Metadata Storage */
2542 ide_cfata_metadata_inquiry(s);
2543 break;
2544 case 0x03: /* Read Metadata Storage */
2545 ide_cfata_metadata_read(s);
2546 break;
2547 case 0x04: /* Write Metadata Storage */
2548 ide_cfata_metadata_write(s);
2549 break;
2550 default:
2551 goto abort_cmd;
2552 }
2553 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2554 s->status = 0x00; /* NOTE: READY is _not_ set */
2555 ide_set_irq(s);
2556 break;
2557 case IBM_SENSE_CONDITION:
2558 if (!s->is_cf)
2559 goto abort_cmd;
2560 switch (s->feature) {
2561 case 0x01: /* sense temperature in device */
2562 s->nsector = 0x50; /* +20 C */
2563 break;
2564 default:
2565 goto abort_cmd;
2566 }
2567 s->status = READY_STAT | SEEK_STAT;
2568 ide_set_irq(s);
2569 break;
2570 default:
2571 abort_cmd:
2572 ide_abort_command(s);
2573 ide_set_irq(s);
2574 break;
2575 }
2576 }
2577 }
2578
2579 static uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
2580 {
2581 IDEState *ide_if = opaque;
2582 IDEState *s = ide_if->cur_drive;
2583 uint32_t addr;
2584 int ret, hob;
2585
2586 addr = addr1 & 7;
2587 /* FIXME: HOB readback uses bit 7, but it's always set right now */
2588 //hob = s->select & (1 << 7);
2589 hob = 0;
2590 switch(addr) {
2591 case 0:
2592 ret = 0xff;
2593 break;
2594 case 1:
2595 if ((!ide_if[0].bs && !ide_if[1].bs) ||
2596 (s != ide_if && !s->bs))
2597 ret = 0;
2598 else if (!hob)
2599 ret = s->error;
2600 else
2601 ret = s->hob_feature;
2602 break;
2603 case 2:
2604 if (!ide_if[0].bs && !ide_if[1].bs)
2605 ret = 0;
2606 else if (!hob)
2607 ret = s->nsector & 0xff;
2608 else
2609 ret = s->hob_nsector;
2610 break;
2611 case 3:
2612 if (!ide_if[0].bs && !ide_if[1].bs)
2613 ret = 0;
2614 else if (!hob)
2615 ret = s->sector;
2616 else
2617 ret = s->hob_sector;
2618 break;
2619 case 4:
2620 if (!ide_if[0].bs && !ide_if[1].bs)
2621 ret = 0;
2622 else if (!hob)
2623 ret = s->lcyl;
2624 else
2625 ret = s->hob_lcyl;
2626 break;
2627 case 5:
2628 if (!ide_if[0].bs && !ide_if[1].bs)
2629 ret = 0;
2630 else if (!hob)
2631 ret = s->hcyl;
2632 else
2633 ret = s->hob_hcyl;
2634 break;
2635 case 6:
2636 if (!ide_if[0].bs && !ide_if[1].bs)
2637 ret = 0;
2638 else
2639 ret = s->select;
2640 break;
2641 default:
2642 case 7:
2643 if ((!ide_if[0].bs && !ide_if[1].bs) ||
2644 (s != ide_if && !s->bs))
2645 ret = 0;
2646 else
2647 ret = s->status;
2648 qemu_irq_lower(s->irq);
2649 break;
2650 }
2651 #ifdef DEBUG_IDE
2652 printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
2653 #endif
2654 return ret;
2655 }
2656
2657 static uint32_t ide_status_read(void *opaque, uint32_t addr)
2658 {
2659 IDEState *ide_if = opaque;
2660 IDEState *s = ide_if->cur_drive;
2661 int ret;
2662
2663 if ((!ide_if[0].bs && !ide_if[1].bs) ||
2664 (s != ide_if && !s->bs))
2665 ret = 0;
2666 else
2667 ret = s->status;
2668 #ifdef DEBUG_IDE
2669 printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
2670 #endif
2671 return ret;
2672 }
2673
2674 static void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
2675 {
2676 IDEState *ide_if = opaque;
2677 IDEState *s;
2678 int i;
2679
2680 #ifdef DEBUG_IDE
2681 printf("ide: write control addr=0x%x val=%02x\n", addr, val);
2682 #endif
2683 /* common for both drives */
2684 if (!(ide_if[0].cmd & IDE_CMD_RESET) &&
2685 (val & IDE_CMD_RESET)) {
2686 /* reset low to high */
2687 for(i = 0;i < 2; i++) {
2688 s = &ide_if[i];
2689 s->status = BUSY_STAT | SEEK_STAT;
2690 s->error = 0x01;
2691 }
2692 } else if ((ide_if[0].cmd & IDE_CMD_RESET) &&
2693 !(val & IDE_CMD_RESET)) {
2694 /* high to low */
2695 for(i = 0;i < 2; i++) {
2696 s = &ide_if[i];
2697 if (s->is_cdrom)
2698 s->status = 0x00; /* NOTE: READY is _not_ set */
2699 else
2700 s->status = READY_STAT | SEEK_STAT;
2701 ide_set_signature(s);
2702 }
2703 }
2704
2705 ide_if[0].cmd = val;
2706 ide_if[1].cmd = val;
2707 }
2708
2709 static void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
2710 {
2711 IDEState *s = ((IDEState *)opaque)->cur_drive;
2712 uint8_t *p;
2713
2714 /* PIO data access allowed only when DRQ bit is set */
2715 if (!(s->status & DRQ_STAT))
2716 return;
2717
2718 p = s->data_ptr;
2719 *(uint16_t *)p = le16_to_cpu(val);
2720 p += 2;
2721 s->data_ptr = p;
2722 if (p >= s->data_end)
2723 s->end_transfer_func(s);
2724 }
2725
2726 static uint32_t ide_data_readw(void *opaque, uint32_t addr)
2727 {
2728 IDEState *s = ((IDEState *)opaque)->cur_drive;
2729 uint8_t *p;
2730 int ret;
2731
2732 /* PIO data access allowed only when DRQ bit is set */
2733 if (!(s->status & DRQ_STAT))
2734 return 0;
2735
2736 p = s->data_ptr;
2737 ret = cpu_to_le16(*(uint16_t *)p);
2738 p += 2;
2739 s->data_ptr = p;
2740 if (p >= s->data_end)
2741 s->end_transfer_func(s);
2742 return ret;
2743 }
2744
2745 static void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
2746 {
2747 IDEState *s = ((IDEState *)opaque)->cur_drive;
2748 uint8_t *p;
2749
2750 /* PIO data access allowed only when DRQ bit is set */
2751 if (!(s->status & DRQ_STAT))
2752 return;
2753
2754 p = s->data_ptr;
2755 *(uint32_t *)p = le32_to_cpu(val);
2756 p += 4;
2757 s->data_ptr = p;
2758 if (p >= s->data_end)
2759 s->end_transfer_func(s);
2760 }
2761
2762 static uint32_t ide_data_readl(void *opaque, uint32_t addr)
2763 {
2764 IDEState *s = ((IDEState *)opaque)->cur_drive;
2765 uint8_t *p;
2766 int ret;
2767
2768 /* PIO data access allowed only when DRQ bit is set */
2769 if (!(s->status & DRQ_STAT))
2770 return 0;
2771
2772 p = s->data_ptr;
2773 ret = cpu_to_le32(*(uint32_t *)p);
2774 p += 4;
2775 s->data_ptr = p;
2776 if (p >= s->data_end)
2777 s->end_transfer_func(s);
2778 return ret;
2779 }
2780
2781 static void ide_dummy_transfer_stop(IDEState *s)
2782 {
2783 s->data_ptr = s->io_buffer;
2784 s->data_end = s->io_buffer;
2785 s->io_buffer[0] = 0xff;
2786 s->io_buffer[1] = 0xff;
2787 s->io_buffer[2] = 0xff;
2788 s->io_buffer[3] = 0xff;
2789 }
2790
2791 static void ide_reset(IDEState *s)
2792 {
2793 if (s->is_cf)
2794 s->mult_sectors = 0;
2795 else
2796 s->mult_sectors = MAX_MULT_SECTORS;
2797 s->cur_drive = s;
2798 s->select = 0xa0;
2799 s->status = READY_STAT | SEEK_STAT;
2800 ide_set_signature(s);
2801 /* init the transfer handler so that 0xffff is returned on data
2802 accesses */
2803 s->end_transfer_func = ide_dummy_transfer_stop;
2804 ide_dummy_transfer_stop(s);
2805 s->media_changed = 0;
2806 }
2807
2808 static void ide_init2(IDEState *ide_state,
2809 BlockDriverState *hd0, BlockDriverState *hd1,
2810 qemu_irq irq)
2811 {
2812 IDEState *s;
2813 static int drive_serial = 1;
2814 int i, cylinders, heads, secs;
2815 uint64_t nb_sectors;
2816
2817 for(i = 0; i < 2; i++) {
2818 s = ide_state + i;
2819 if (i == 0)
2820 s->bs = hd0;
2821 else
2822 s->bs = hd1;
2823 s->io_buffer = qemu_blockalign(s->bs, IDE_DMA_BUF_SECTORS*512 + 4);
2824 if (s->bs) {
2825 bdrv_get_geometry(s->bs, &nb_sectors);
2826 bdrv_guess_geometry(s->bs, &cylinders, &heads, &secs);
2827 s->cylinders = cylinders;
2828 s->heads = heads;
2829 s->sectors = secs;
2830 s->nb_sectors = nb_sectors;
2831
2832 if (bdrv_get_type_hint(s->bs) == BDRV_TYPE_CDROM) {
2833 s->is_cdrom = 1;
2834 bdrv_set_change_cb(s->bs, cdrom_change_cb, s);
2835 }
2836 }
2837 s->drive_serial = drive_serial++;
2838 strncpy(s->drive_serial_str, drive_get_serial(s->bs),
2839 sizeof(s->drive_serial_str));
2840 if (strlen(s->drive_serial_str) == 0)
2841 snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
2842 "QM%05d", s->drive_serial);
2843 s->irq = irq;
2844 s->sector_write_timer = qemu_new_timer(vm_clock,
2845 ide_sector_write_timer_cb, s);
2846 ide_reset(s);
2847 }
2848 }
2849
2850 static void ide_init_ioport(IDEState *ide_state, int iobase, int iobase2)
2851 {
2852 register_ioport_write(iobase, 8, 1, ide_ioport_write, ide_state);
2853 register_ioport_read(iobase, 8, 1, ide_ioport_read, ide_state);
2854 if (iobase2) {
2855 register_ioport_read(iobase2, 1, 1, ide_status_read, ide_state);
2856 register_ioport_write(iobase2, 1, 1, ide_cmd_write, ide_state);
2857 }
2858
2859 /* data ports */
2860 register_ioport_write(iobase, 2, 2, ide_data_writew, ide_state);
2861 register_ioport_read(iobase, 2, 2, ide_data_readw, ide_state);
2862 register_ioport_write(iobase, 4, 4, ide_data_writel, ide_state);
2863 register_ioport_read(iobase, 4, 4, ide_data_readl, ide_state);
2864 }
2865
2866 /* save per IDE drive data */
2867 static void ide_save(QEMUFile* f, IDEState *s)
2868 {
2869 qemu_put_be32(f, s->mult_sectors);
2870 qemu_put_be32(f, s->identify_set);
2871 if (s->identify_set) {
2872 qemu_put_buffer(f, (const uint8_t *)s->identify_data, 512);
2873 }
2874 qemu_put_8s(f, &s->feature);
2875 qemu_put_8s(f, &s->error);
2876 qemu_put_be32s(f, &s->nsector);
2877 qemu_put_8s(f, &s->sector);
2878 qemu_put_8s(f, &s->lcyl);
2879 qemu_put_8s(f, &s->hcyl);
2880 qemu_put_8s(f, &s->hob_feature);
2881 qemu_put_8s(f, &s->hob_nsector);
2882 qemu_put_8s(f, &s->hob_sector);
2883 qemu_put_8s(f, &s->hob_lcyl);
2884 qemu_put_8s(f, &s->hob_hcyl);
2885 qemu_put_8s(f, &s->select);
2886 qemu_put_8s(f, &s->status);
2887 qemu_put_8s(f, &s->lba48);
2888
2889 qemu_put_8s(f, &s->sense_key);
2890 qemu_put_8s(f, &s->asc);
2891 qemu_put_8s(f, &s->cdrom_changed);
2892 /* XXX: if a transfer is pending, we do not save it yet */
2893 }
2894
2895 /* load per IDE drive data */
2896 static void ide_load(QEMUFile* f, IDEState *s, int version_id)
2897 {
2898 s->mult_sectors=qemu_get_be32(f);
2899 s->identify_set=qemu_get_be32(f);
2900 if (s->identify_set) {
2901 qemu_get_buffer(f, (uint8_t *)s->identify_data, 512);
2902 }
2903 qemu_get_8s(f, &s->feature);
2904 qemu_get_8s(f, &s->error);
2905 qemu_get_be32s(f, &s->nsector);
2906 qemu_get_8s(f, &s->sector);
2907 qemu_get_8s(f, &s->lcyl);
2908 qemu_get_8s(f, &s->hcyl);
2909 qemu_get_8s(f, &s->hob_feature);
2910 qemu_get_8s(f, &s->hob_nsector);
2911 qemu_get_8s(f, &s->hob_sector);
2912 qemu_get_8s(f, &s->hob_lcyl);
2913 qemu_get_8s(f, &s->hob_hcyl);
2914 qemu_get_8s(f, &s->select);
2915 qemu_get_8s(f, &s->status);
2916 qemu_get_8s(f, &s->lba48);
2917
2918 qemu_get_8s(f, &s->sense_key);
2919 qemu_get_8s(f, &s->asc);
2920 if (version_id == 3) {
2921 qemu_get_8s(f, &s->cdrom_changed);
2922 } else {
2923 if (s->sense_key == SENSE_UNIT_ATTENTION &&
2924 s->asc == ASC_MEDIUM_MAY_HAVE_CHANGED)
2925 s->cdrom_changed = 1;
2926 }
2927 /* XXX: if a transfer is pending, we do not save it yet */
2928 }
2929
2930 /***********************************************************/
2931 /* ISA IDE definitions */
2932
2933 void isa_ide_init(int iobase, int iobase2, qemu_irq irq,
2934 BlockDriverState *hd0, BlockDriverState *hd1)
2935 {
2936 IDEState *ide_state;
2937
2938 ide_state = qemu_mallocz(sizeof(IDEState) * 2);
2939
2940 ide_init2(ide_state, hd0, hd1, irq);
2941 ide_init_ioport(ide_state, iobase, iobase2);
2942 }
2943
2944 /***********************************************************/
2945 /* PCI IDE definitions */
2946
2947 static void cmd646_update_irq(PCIIDEState *d);
2948
2949 static void ide_map(PCIDevice *pci_dev, int region_num,
2950 uint32_t addr, uint32_t size, int type)
2951 {
2952 PCIIDEState *d = (PCIIDEState *)pci_dev;
2953 IDEState *ide_state;
2954
2955 if (region_num <= 3) {
2956 ide_state = &d->ide_if[(region_num >> 1) * 2];
2957 if (region_num & 1) {
2958 register_ioport_read(addr + 2, 1, 1, ide_status_read, ide_state);
2959 register_ioport_write(addr + 2, 1, 1, ide_cmd_write, ide_state);
2960 } else {
2961 register_ioport_write(addr, 8, 1, ide_ioport_write, ide_state);
2962 register_ioport_read(addr, 8, 1, ide_ioport_read, ide_state);
2963
2964 /* data ports */
2965 register_ioport_write(addr, 2, 2, ide_data_writew, ide_state);
2966 register_ioport_read(addr, 2, 2, ide_data_readw, ide_state);
2967 register_ioport_write(addr, 4, 4, ide_data_writel, ide_state);
2968 register_ioport_read(addr, 4, 4, ide_data_readl, ide_state);
2969 }
2970 }
2971 }
2972
2973 static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb)
2974 {
2975 BMDMAState *bm = s->bmdma;
2976 if(!bm)
2977 return;
2978 bm->ide_if = s;
2979 bm->dma_cb = dma_cb;
2980 bm->cur_prd_last = 0;
2981 bm->cur_prd_addr = 0;
2982 bm->cur_prd_len = 0;
2983 bm->sector_num = ide_get_sector(s);
2984 bm->nsector = s->nsector;
2985 if (bm->status & BM_STATUS_DMAING) {
2986 bm->dma_cb(bm, 0);
2987 }
2988 }
2989
2990 static void ide_dma_restart(IDEState *s)
2991 {
2992 BMDMAState *bm = s->bmdma;
2993 ide_set_sector(s, bm->sector_num);
2994 s->io_buffer_index = 0;
2995 s->io_buffer_size = 0;
2996 s->nsector = bm->nsector;
2997 bm->cur_addr = bm->addr;
2998 bm->dma_cb = ide_write_dma_cb;
2999 ide_dma_start(s, bm->dma_cb);
3000 }
3001
3002 static void ide_dma_cancel(BMDMAState *bm)
3003 {
3004 if (bm->status & BM_STATUS_DMAING) {
3005 bm->status &= ~BM_STATUS_DMAING;
3006 /* cancel DMA request */
3007 bm->ide_if = NULL;
3008 bm->dma_cb = NULL;
3009 if (bm->aiocb) {
3010 #ifdef DEBUG_AIO
3011 printf("aio_cancel\n");
3012 #endif
3013 bdrv_aio_cancel(bm->aiocb);
3014 bm->aiocb = NULL;
3015 }
3016 }
3017 }
3018
3019 static void bmdma_cmd_writeb(void *opaque, uint32_t addr, uint32_t val)
3020 {
3021 BMDMAState *bm = opaque;
3022 #ifdef DEBUG_IDE
3023 printf("%s: 0x%08x\n", __func__, val);
3024 #endif
3025 if (!(val & BM_CMD_START)) {
3026 /* XXX: do it better */
3027 ide_dma_cancel(bm);
3028 bm->cmd = val & 0x09;
3029 } else {
3030 if (!(bm->status & BM_STATUS_DMAING)) {
3031 bm->status |= BM_STATUS_DMAING;
3032 /* start dma transfer if possible */
3033 if (bm->dma_cb)
3034 bm->dma_cb(bm, 0);
3035 }
3036 bm->cmd = val & 0x09;
3037 }
3038 }
3039
3040 static uint32_t bmdma_readb(void *opaque, uint32_t addr)
3041 {
3042 BMDMAState *bm = opaque;
3043 PCIIDEState *pci_dev;
3044 uint32_t val;
3045
3046 switch(addr & 3) {
3047 case 0:
3048 val = bm->cmd;
3049 break;
3050 case 1:
3051 pci_dev = bm->pci_dev;
3052 if (pci_dev->type == IDE_TYPE_CMD646) {
3053 val = pci_dev->dev.config[MRDMODE];
3054 } else {
3055 val = 0xff;
3056 }
3057 break;
3058 case 2:
3059 val = bm->status;
3060 break;
3061 case 3:
3062 pci_dev = bm->pci_dev;
3063 if (pci_dev->type == IDE_TYPE_CMD646) {
3064 if (bm == &pci_dev->bmdma[0])
3065 val = pci_dev->dev.config[UDIDETCR0];
3066 else
3067 val = pci_dev->dev.config[UDIDETCR1];
3068 } else {
3069 val = 0xff;
3070 }
3071 break;
3072 default:
3073 val = 0xff;
3074 break;
3075 }
3076 #ifdef DEBUG_IDE
3077 printf("bmdma: readb 0x%02x : 0x%02x\n", addr, val);
3078 #endif
3079 return val;
3080 }
3081
3082 static void bmdma_writeb(void *opaque, uint32_t addr, uint32_t val)
3083 {
3084 BMDMAState *bm = opaque;
3085 PCIIDEState *pci_dev;
3086 #ifdef DEBUG_IDE
3087 printf("bmdma: writeb 0x%02x : 0x%02x\n", addr, val);
3088 #endif
3089 switch(addr & 3) {
3090 case 1:
3091 pci_dev = bm->pci_dev;
3092 if (pci_dev->type == IDE_TYPE_CMD646) {
3093 pci_dev->dev.config[MRDMODE] =
3094 (pci_dev->dev.config[MRDMODE] & ~0x30) | (val & 0x30);
3095 cmd646_update_irq(pci_dev);
3096 }
3097 break;
3098 case 2:
3099 bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
3100 break;
3101 case 3:
3102 pci_dev = bm->pci_dev;
3103 if (pci_dev->type == IDE_TYPE_CMD646) {
3104 if (bm == &pci_dev->bmdma[0])
3105 pci_dev->dev.config[UDIDETCR0] = val;
3106 else
3107 pci_dev->dev.config[UDIDETCR1] = val;
3108 }
3109 break;
3110 }
3111 }
3112
3113 static uint32_t bmdma_addr_readb(void *opaque, uint32_t addr)
3114 {
3115 BMDMAState *bm = opaque;
3116 uint32_t val;
3117 val = (bm->addr >> ((addr & 3) * 8)) & 0xff;
3118 #ifdef DEBUG_IDE
3119 printf("%s: 0x%08x\n", __func__, val);
3120 #endif
3121 return val;
3122 }
3123
3124 static void bmdma_addr_writeb(void *opaque, uint32_t addr, uint32_t val)
3125 {
3126 BMDMAState *bm = opaque;
3127 int shift = (addr & 3) * 8;
3128 #ifdef DEBUG_IDE
3129 printf("%s: 0x%08x\n", __func__, val);
3130 #endif
3131 bm->addr &= ~(0xFF << shift);
3132 bm->addr |= ((val & 0xFF) << shift) & ~3;
3133 bm->cur_addr = bm->addr;
3134 }
3135
3136 static uint32_t bmdma_addr_readw(void *opaque, uint32_t addr)
3137 {
3138 BMDMAState *bm = opaque;
3139 uint32_t val;
3140 val = (bm->addr >> ((addr & 3) * 8)) & 0xffff;
3141 #ifdef DEBUG_IDE
3142 printf("%s: 0x%08x\n", __func__, val);
3143 #endif
3144 return val;
3145 }
3146
3147 static void bmdma_addr_writew(void *opaque, uint32_t addr, uint32_t val)
3148 {
3149 BMDMAState *bm = opaque;
3150 int shift = (addr & 3) * 8;
3151 #ifdef DEBUG_IDE
3152 printf("%s: 0x%08x\n", __func__, val);
3153 #endif
3154 bm->addr &= ~(0xFFFF << shift);
3155 bm->addr |= ((val & 0xFFFF) << shift) & ~3;
3156 bm->cur_addr = bm->addr;
3157 }
3158
3159 static uint32_t bmdma_addr_readl(void *opaque, uint32_t addr)
3160 {
3161 BMDMAState *bm = opaque;
3162 uint32_t val;
3163 val = bm->addr;
3164 #ifdef DEBUG_IDE
3165 printf("%s: 0x%08x\n", __func__, val);
3166 #endif
3167 return val;
3168 }
3169
3170 static void bmdma_addr_writel(void *opaque, uint32_t addr, uint32_t val)
3171 {
3172 BMDMAState *bm = opaque;
3173 #ifdef DEBUG_IDE
3174 printf("%s: 0x%08x\n", __func__, val);
3175 #endif
3176 bm->addr = val & ~3;
3177 bm->cur_addr = bm->addr;
3178 }
3179
3180 static void bmdma_map(PCIDevice *pci_dev, int region_num,
3181 uint32_t addr, uint32_t size, int type)
3182 {
3183 PCIIDEState *d = (PCIIDEState *)pci_dev;
3184 int i;
3185
3186 for(i = 0;i < 2; i++) {
3187 BMDMAState *bm = &d->bmdma[i];
3188 d->ide_if[2 * i].bmdma = bm;
3189 d->ide_if[2 * i + 1].bmdma = bm;
3190 bm->pci_dev = (PCIIDEState *)pci_dev;
3191 qemu_add_vm_change_state_handler(ide_dma_restart_cb, bm);
3192
3193 register_ioport_write(addr, 1, 1, bmdma_cmd_writeb, bm);
3194
3195 register_ioport_write(addr + 1, 3, 1, bmdma_writeb, bm);
3196 register_ioport_read(addr, 4, 1, bmdma_readb, bm);
3197
3198 register_ioport_write(addr + 4, 4, 1, bmdma_addr_writeb, bm);
3199 register_ioport_read(addr + 4, 4, 1, bmdma_addr_readb, bm);
3200 register_ioport_write(addr + 4, 4, 2, bmdma_addr_writew, bm);
3201 register_ioport_read(addr + 4, 4, 2, bmdma_addr_readw, bm);
3202 register_ioport_write(addr + 4, 4, 4, bmdma_addr_writel, bm);
3203 register_ioport_read(addr + 4, 4, 4, bmdma_addr_readl, bm);
3204 addr += 8;
3205 }
3206 }
3207
3208 static void pci_ide_save(QEMUFile* f, void *opaque)
3209 {
3210 PCIIDEState *d = opaque;
3211 int i;
3212
3213 pci_device_save(&d->dev, f);
3214
3215 for(i = 0; i < 2; i++) {
3216 BMDMAState *bm = &d->bmdma[i];
3217 uint8_t ifidx;
3218 qemu_put_8s(f, &bm->cmd);
3219 qemu_put_8s(f, &bm->status);
3220 qemu_put_be32s(f, &bm->addr);
3221 qemu_put_sbe64s(f, &bm->sector_num);
3222 qemu_put_be32s(f, &bm->nsector);
3223 ifidx = bm->ide_if ? bm->ide_if - d->ide_if : 0;
3224 qemu_put_8s(f, &ifidx);
3225 /* XXX: if a transfer is pending, we do not save it yet */
3226 }
3227
3228 /* per IDE interface data */
3229 for(i = 0; i < 2; i++) {
3230 IDEState *s = &d->ide_if[i * 2];
3231 uint8_t drive1_selected;
3232 qemu_put_8s(f, &s->cmd);
3233 drive1_selected = (s->cur_drive != s);
3234 qemu_put_8s(f, &drive1_selected);
3235 }
3236
3237 /* per IDE drive data */
3238 for(i = 0; i < 4; i++) {
3239 ide_save(f, &d->ide_if[i]);
3240 }
3241 }
3242
3243 static int pci_ide_load(QEMUFile* f, void *opaque, int version_id)
3244 {
3245 PCIIDEState *d = opaque;
3246 int ret, i;
3247
3248 if (version_id != 2 && version_id != 3)
3249 return -EINVAL;
3250 ret = pci_device_load(&d->dev, f);
3251 if (ret < 0)
3252 return ret;
3253
3254 for(i = 0; i < 2; i++) {
3255 BMDMAState *bm = &d->bmdma[i];
3256 uint8_t ifidx;
3257 qemu_get_8s(f, &bm->cmd);
3258 qemu_get_8s(f, &bm->status);
3259 qemu_get_be32s(f, &bm->addr);
3260 qemu_get_sbe64s(f, &bm->sector_num);
3261 qemu_get_be32s(f, &bm->nsector);
3262 qemu_get_8s(f, &ifidx);
3263 bm->ide_if = &d->ide_if[ifidx];
3264 /* XXX: if a transfer is pending, we do not save it yet */
3265 }
3266
3267 /* per IDE interface data */
3268 for(i = 0; i < 2; i++) {
3269 IDEState *s = &d->ide_if[i * 2];
3270 uint8_t drive1_selected;
3271 qemu_get_8s(f, &s->cmd);
3272 qemu_get_8s(f, &drive1_selected);
3273 s->cur_drive = &d->ide_if[i * 2 + (drive1_selected != 0)];
3274 }
3275
3276 /* per IDE drive data */
3277 for(i = 0; i < 4; i++) {
3278 ide_load(f, &d->ide_if[i], version_id);
3279 }
3280 return 0;
3281 }
3282
3283 /* XXX: call it also when the MRDMODE is changed from the PCI config
3284 registers */
3285 static void cmd646_update_irq(PCIIDEState *d)
3286 {
3287 int pci_level;
3288 pci_level = ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH0) &&
3289 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH0)) ||
3290 ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH1) &&
3291 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH1));
3292 qemu_set_irq(d->dev.irq[0], pci_level);
3293 }
3294
3295 /* the PCI irq level is the logical OR of the two channels */
3296 static void cmd646_set_irq(void *opaque, int channel, int level)
3297 {
3298 PCIIDEState *d = opaque;
3299 int irq_mask;
3300
3301 irq_mask = MRDMODE_INTR_CH0 << channel;
3302 if (level)
3303 d->dev.config[MRDMODE] |= irq_mask;
3304 else
3305 d->dev.config[MRDMODE] &= ~irq_mask;
3306 cmd646_update_irq(d);
3307 }
3308
3309 static void cmd646_reset(void *opaque)
3310 {
3311 PCIIDEState *d = opaque;
3312 unsigned int i;
3313
3314 for (i = 0; i < 2; i++)
3315 ide_dma_cancel(&d->bmdma[i]);
3316 }
3317
3318 /* CMD646 PCI IDE controller */
3319 void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
3320 int secondary_ide_enabled)
3321 {
3322 PCIIDEState *d;
3323 uint8_t *pci_conf;
3324 int i;
3325 qemu_irq *irq;
3326
3327 d = (PCIIDEState *)pci_register_device(bus, "CMD646 IDE",
3328 sizeof(PCIIDEState),
3329 -1,
3330 NULL, NULL);
3331 d->type = IDE_TYPE_CMD646;
3332 pci_conf = d->dev.config;
3333 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_CMD);
3334 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_CMD_646);
3335
3336 pci_conf[0x08] = 0x07; // IDE controller revision
3337 pci_conf[0x09] = 0x8f;
3338
3339 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_IDE);
3340 pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
3341
3342 pci_conf[0x51] = 0x04; // enable IDE0
3343 if (secondary_ide_enabled) {
3344 /* XXX: if not enabled, really disable the seconday IDE controller */
3345 pci_conf[0x51] |= 0x08; /* enable IDE1 */
3346 }
3347
3348 pci_register_bar((PCIDevice *)d, 0, 0x8,
3349 PCI_ADDRESS_SPACE_IO, ide_map);
3350 pci_register_bar((PCIDevice *)d, 1, 0x4,
3351 PCI_ADDRESS_SPACE_IO, ide_map);
3352 pci_register_bar((PCIDevice *)d, 2, 0x8,
3353 PCI_ADDRESS_SPACE_IO, ide_map);
3354 pci_register_bar((PCIDevice *)d, 3, 0x4,
3355 PCI_ADDRESS_SPACE_IO, ide_map);
3356 pci_register_bar((PCIDevice *)d, 4, 0x10,
3357 PCI_ADDRESS_SPACE_IO, bmdma_map);
3358
3359 pci_conf[0x3d] = 0x01; // interrupt on pin 1
3360
3361 for(i = 0; i < 4; i++)
3362 d->ide_if[i].pci_dev = (PCIDevice *)d;
3363
3364 irq = qemu_allocate_irqs(cmd646_set_irq, d, 2);
3365 ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], irq[0]);
3366 ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], irq[1]);
3367
3368 register_savevm("ide", 0, 3, pci_ide_save, pci_ide_load, d);
3369 qemu_register_reset(cmd646_reset, d);
3370 cmd646_reset(d);
3371 }
3372
3373 static void piix3_reset(void *opaque)
3374 {
3375 PCIIDEState *d = opaque;
3376 uint8_t *pci_conf = d->dev.config;
3377 int i;
3378
3379 for (i = 0; i < 2; i++)
3380 ide_dma_cancel(&d->bmdma[i]);
3381
3382 pci_conf[0x04] = 0x00;
3383 pci_conf[0x05] = 0x00;
3384 pci_conf[0x06] = 0x80; /* FBC */
3385 pci_conf[0x07] = 0x02; // PCI_status_devsel_medium
3386 pci_conf[0x20] = 0x01; /* BMIBA: 20-23h */
3387 }
3388
3389 /* hd_table must contain 4 block drivers */
3390 /* NOTE: for the PIIX3, the IRQs and IOports are hardcoded */
3391 void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
3392 qemu_irq *pic)
3393 {
3394 PCIIDEState *d;
3395 uint8_t *pci_conf;
3396 int i;
3397
3398 /* register a function 1 of PIIX3 */
3399 d = (PCIIDEState *)pci_register_device(bus, "PIIX3 IDE",
3400 sizeof(PCIIDEState),
3401 devfn,
3402 NULL, NULL);
3403 d->type = IDE_TYPE_PIIX3;
3404
3405 pci_conf = d->dev.config;
3406 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
3407 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_1);
3408 pci_conf[0x09] = 0x80; // legacy ATA mode
3409 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_IDE);
3410 pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
3411
3412 qemu_register_reset(piix3_reset, d);
3413 piix3_reset(d);
3414
3415 pci_register_bar((PCIDevice *)d, 4, 0x10,
3416 PCI_ADDRESS_SPACE_IO, bmdma_map);
3417
3418 ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], pic[14]);
3419 ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], pic[15]);
3420 ide_init_ioport(&d->ide_if[0], 0x1f0, 0x3f6);
3421 ide_init_ioport(&d->ide_if[2], 0x170, 0x376);
3422
3423 for (i = 0; i < 4; i++)
3424 if (hd_table[i])
3425 hd_table[i]->private = &d->dev;
3426
3427 register_savevm("ide", 0, 3, pci_ide_save, pci_ide_load, d);
3428 }
3429
3430 /* hd_table must contain 4 block drivers */
3431 /* NOTE: for the PIIX4, the IRQs and IOports are hardcoded */
3432 void pci_piix4_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
3433 qemu_irq *pic)
3434 {
3435 PCIIDEState *d;
3436 uint8_t *pci_conf;
3437
3438 /* register a function 1 of PIIX4 */
3439 d = (PCIIDEState *)pci_register_device(bus, "PIIX4 IDE",
3440 sizeof(PCIIDEState),
3441 devfn,
3442 NULL, NULL);
3443 d->type = IDE_TYPE_PIIX4;
3444
3445 pci_conf = d->dev.config;
3446 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
3447 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB);
3448 pci_conf[0x09] = 0x80; // legacy ATA mode
3449 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_IDE);
3450 pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; // header_type
3451
3452 qemu_register_reset(piix3_reset, d);
3453 piix3_reset(d);
3454
3455 pci_register_bar((PCIDevice *)d, 4, 0x10,
3456 PCI_ADDRESS_SPACE_IO, bmdma_map);
3457
3458 ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], pic[14]);
3459 ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], pic[15]);
3460 ide_init_ioport(&d->ide_if[0], 0x1f0, 0x3f6);
3461 ide_init_ioport(&d->ide_if[2], 0x170, 0x376);
3462
3463 register_savevm("ide", 0, 3, pci_ide_save, pci_ide_load, d);
3464 }
3465
3466 #if defined(TARGET_PPC)
3467 /***********************************************************/
3468 /* MacIO based PowerPC IDE */
3469
3470 typedef struct MACIOIDEState {
3471 IDEState ide_if[2];
3472 BlockDriverAIOCB *aiocb;
3473 } MACIOIDEState;
3474
3475 static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
3476 {
3477 DBDMA_io *io = opaque;
3478 MACIOIDEState *m = io->opaque;
3479 IDEState *s = m->ide_if->cur_drive;
3480
3481 if (ret < 0) {
3482 m->aiocb = NULL;
3483 qemu_sglist_destroy(&s->sg);
3484 ide_atapi_io_error(s, ret);
3485 io->dma_end(opaque);
3486 return;
3487 }
3488
3489 if (s->io_buffer_size > 0) {
3490 m->aiocb = NULL;
3491 qemu_sglist_destroy(&s->sg);
3492
3493 s->packet_transfer_size -= s->io_buffer_size;
3494
3495 s->io_buffer_index += s->io_buffer_size;
3496 s->lba += s->io_buffer_index >> 11;
3497 s->io_buffer_index &= 0x7ff;
3498 }
3499
3500 if (s->packet_transfer_size <= 0)
3501 ide_atapi_cmd_ok(s);
3502
3503 if (io->len == 0) {
3504 io->dma_end(opaque);
3505 return;
3506 }
3507
3508 /* launch next transfer */
3509
3510 s->io_buffer_size = io->len;
3511
3512 qemu_sglist_init(&s->sg, io->len / TARGET_PAGE_SIZE + 1);
3513 qemu_sglist_add(&s->sg, io->addr, io->len);
3514 io->addr += io->len;
3515 io->len = 0;
3516
3517 m->aiocb = dma_bdrv_read(s->bs, &s->sg,
3518 (int64_t)(s->lba << 2) + (s->io_buffer_index >> 9),
3519 pmac_ide_atapi_transfer_cb, io);
3520 if (!m->aiocb) {
3521 qemu_sglist_destroy(&s->sg);
3522 /* Note: media not present is the most likely case */
3523 ide_atapi_cmd_error(s, SENSE_NOT_READY,
3524 ASC_MEDIUM_NOT_PRESENT);
3525 io->dma_end(opaque);
3526 return;
3527 }
3528 }
3529
3530 static void pmac_ide_transfer_cb(void *opaque, int ret)
3531 {
3532 DBDMA_io *io = opaque;
3533 MACIOIDEState *m = io->opaque;
3534 IDEState *s = m->ide_if->cur_drive;
3535 int n;
3536 int64_t sector_num;
3537
3538 if (ret < 0) {
3539 m->aiocb = NULL;
3540 qemu_sglist_destroy(&s->sg);
3541 ide_dma_error(s);
3542 io->dma_end(io);
3543 return;
3544 }
3545
3546 sector_num = ide_get_sector(s);
3547 if (s->io_buffer_size > 0) {
3548 m->aiocb = NULL;
3549 qemu_sglist_destroy(&s->sg);
3550 n = (s->io_buffer_size + 0x1ff) >> 9;
3551 sector_num += n;
3552 ide_set_sector(s, sector_num);
3553 s->nsector -= n;
3554 }
3555
3556 /* end of transfer ? */
3557 if (s->nsector == 0) {
3558 s->status = READY_STAT | SEEK_STAT;
3559 ide_set_irq(s);
3560 }
3561
3562 /* end of DMA ? */
3563
3564 if (io->len == 0) {
3565 io->dma_end(io);
3566 return;
3567 }
3568
3569 /* launch next transfer */
3570
3571 s->io_buffer_index = 0;
3572 s->io_buffer_size = io->len;
3573
3574 qemu_sglist_init(&s->sg, io->len / TARGET_PAGE_SIZE + 1);
3575 qemu_sglist_add(&s->sg, io->addr, io->len);
3576 io->addr += io->len;
3577 io->len = 0;
3578
3579 if (s->is_read)
3580 m->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
3581 pmac_ide_transfer_cb, io);
3582 else
3583 m->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num,
3584 pmac_ide_transfer_cb, io);
3585 if (!m->aiocb)
3586 pmac_ide_transfer_cb(io, -1);
3587 }
3588
3589 static void pmac_ide_transfer(DBDMA_io *io)
3590 {
3591 MACIOIDEState *m = io->opaque;
3592 IDEState *s = m->ide_if->cur_drive;
3593
3594 s->io_buffer_size = 0;
3595 if (s->is_cdrom) {
3596 pmac_ide_atapi_transfer_cb(io, 0);
3597 return;
3598 }
3599
3600 pmac_ide_transfer_cb(io, 0);
3601 }
3602
3603 static void pmac_ide_flush(DBDMA_io *io)
3604 {
3605 MACIOIDEState *m = io->opaque;
3606
3607 if (m->aiocb)
3608 qemu_aio_flush();
3609 }
3610
3611 /* PowerMac IDE memory IO */
3612 static void pmac_ide_writeb (void *opaque,
3613 target_phys_addr_t addr, uint32_t val)
3614 {
3615 MACIOIDEState *d = opaque;
3616
3617 addr = (addr & 0xFFF) >> 4;
3618 switch (addr) {
3619 case 1 ... 7:
3620 ide_ioport_write(d->ide_if, addr, val);
3621 break;
3622 case 8:
3623 case 22:
3624 ide_cmd_write(d->ide_if, 0, val);
3625 break;
3626 default:
3627 break;
3628 }
3629 }
3630
3631 static uint32_t pmac_ide_readb (void *opaque,target_phys_addr_t addr)
3632 {
3633 uint8_t retval;
3634 MACIOIDEState *d = opaque;
3635
3636 addr = (addr & 0xFFF) >> 4;
3637 switch (addr) {
3638 case 1 ... 7:
3639 retval = ide_ioport_read(d->ide_if, addr);
3640 break;
3641 case 8:
3642 case 22:
3643 retval = ide_status_read(d->ide_if, 0);
3644 break;
3645 default:
3646 retval = 0xFF;
3647 break;
3648 }
3649 return retval;
3650 }
3651
3652 static void pmac_ide_writew (void *opaque,
3653 target_phys_addr_t addr, uint32_t val)
3654 {
3655 MACIOIDEState *d = opaque;
3656
3657 addr = (addr & 0xFFF) >> 4;
3658 #ifdef TARGET_WORDS_BIGENDIAN
3659 val = bswap16(val);
3660 #endif
3661 if (addr == 0) {
3662 ide_data_writew(d->ide_if, 0, val);
3663 }
3664 }
3665
3666 static uint32_t pmac_ide_readw (void *opaque,target_phys_addr_t addr)
3667 {
3668 uint16_t retval;
3669 MACIOIDEState *d = opaque;
3670
3671 addr = (addr & 0xFFF) >> 4;
3672 if (addr == 0) {
3673 retval = ide_data_readw(d->ide_if, 0);
3674 } else {
3675 retval = 0xFFFF;
3676 }
3677 #ifdef TARGET_WORDS_BIGENDIAN
3678 retval = bswap16(retval);
3679 #endif
3680 return retval;
3681 }
3682
3683 static void pmac_ide_writel (void *opaque,
3684 target_phys_addr_t addr, uint32_t val)
3685 {
3686 MACIOIDEState *d = opaque;
3687
3688 addr = (addr & 0xFFF) >> 4;
3689 #ifdef TARGET_WORDS_BIGENDIAN
3690 val = bswap32(val);
3691 #endif
3692 if (addr == 0) {
3693 ide_data_writel(d->ide_if, 0, val);
3694 }
3695 }
3696
3697 static uint32_t pmac_ide_readl (void *opaque,target_phys_addr_t addr)
3698 {
3699 uint32_t retval;
3700 MACIOIDEState *d = opaque;
3701
3702 addr = (addr & 0xFFF) >> 4;
3703 if (addr == 0) {
3704 retval = ide_data_readl(d->ide_if, 0);
3705 } else {
3706 retval = 0xFFFFFFFF;
3707 }
3708 #ifdef TARGET_WORDS_BIGENDIAN
3709 retval = bswap32(retval);
3710 #endif
3711 return retval;
3712 }
3713
3714 static CPUWriteMemoryFunc *pmac_ide_write[] = {
3715 pmac_ide_writeb,
3716 pmac_ide_writew,
3717 pmac_ide_writel,
3718 };
3719
3720 static CPUReadMemoryFunc *pmac_ide_read[] = {
3721 pmac_ide_readb,
3722 pmac_ide_readw,
3723 pmac_ide_readl,
3724 };
3725
3726 static void pmac_ide_save(QEMUFile *f, void *opaque)
3727 {
3728 MACIOIDEState *d = opaque;
3729 IDEState *s = d->ide_if;
3730 uint8_t drive1_selected;
3731 unsigned int i;
3732
3733 /* per IDE interface data */
3734 qemu_put_8s(f, &s->cmd);
3735 drive1_selected = (s->cur_drive != s);
3736 qemu_put_8s(f, &drive1_selected);
3737
3738 /* per IDE drive data */
3739 for(i = 0; i < 2; i++) {
3740 ide_save(f, &s[i]);
3741 }
3742 }
3743
3744 static int pmac_ide_load(QEMUFile *f, void *opaque, int version_id)
3745 {
3746 MACIOIDEState *d = opaque;
3747 IDEState *s = d->ide_if;
3748 uint8_t drive1_selected;
3749 unsigned int i;
3750
3751 if (version_id != 1 && version_id != 3)
3752 return -EINVAL;
3753
3754 /* per IDE interface data */
3755 qemu_get_8s(f, &s->cmd);
3756 qemu_get_8s(f, &drive1_selected);
3757 s->cur_drive = &s[(drive1_selected != 0)];
3758
3759 /* per IDE drive data */
3760 for(i = 0; i < 2; i++) {
3761 ide_load(f, &s[i], version_id);
3762 }
3763 return 0;
3764 }
3765
3766 static void pmac_ide_reset(void *opaque)
3767 {
3768 MACIOIDEState *d = opaque;
3769 IDEState *s = d->ide_if;
3770
3771 ide_reset(&s[0]);
3772 ide_reset(&s[1]);
3773 }
3774
3775 /* hd_table must contain 4 block drivers */
3776 /* PowerMac uses memory mapped registers, not I/O. Return the memory
3777 I/O index to access the ide. */
3778 int pmac_ide_init (BlockDriverState **hd_table, qemu_irq irq,
3779 void *dbdma, int channel, qemu_irq dma_irq)
3780 {
3781 MACIOIDEState *d;
3782 int pmac_ide_memory;
3783
3784 d = qemu_mallocz(sizeof(MACIOIDEState));
3785 ide_init2(d->ide_if, hd_table[0], hd_table[1], irq);
3786
3787 if (dbdma)
3788 DBDMA_register_channel(dbdma, channel, dma_irq, pmac_ide_transfer, pmac_ide_flush, d);
3789
3790 pmac_ide_memory = cpu_register_io_memory(pmac_ide_read,
3791 pmac_ide_write, d);
3792 register_savevm("ide", 0, 3, pmac_ide_save, pmac_ide_load, d);
3793 qemu_register_reset(pmac_ide_reset, d);
3794 pmac_ide_reset(d);
3795
3796 return pmac_ide_memory;
3797 }
3798 #endif /* TARGET_PPC */
3799
3800 /***********************************************************/
3801 /* MMIO based ide port
3802 * This emulates IDE device connected directly to the CPU bus without
3803 * dedicated ide controller, which is often seen on embedded boards.
3804 */
3805
3806 typedef struct {
3807 void *dev;
3808 int shift;
3809 } MMIOState;
3810
3811 static uint32_t mmio_ide_read (void *opaque, target_phys_addr_t addr)
3812 {
3813 MMIOState *s = (MMIOState*)opaque;
3814 IDEState *ide = (IDEState*)s->dev;
3815 addr >>= s->shift;
3816 if (addr & 7)
3817 return ide_ioport_read(ide, addr);
3818 else
3819 return ide_data_readw(ide, 0);
3820 }
3821
3822 static void mmio_ide_write (void *opaque, target_phys_addr_t addr,
3823 uint32_t val)
3824 {
3825 MMIOState *s = (MMIOState*)opaque;
3826 IDEState *ide = (IDEState*)s->dev;
3827 addr >>= s->shift;
3828 if (addr & 7)
3829 ide_ioport_write(ide, addr, val);
3830 else
3831 ide_data_writew(ide, 0, val);
3832 }
3833
3834 static CPUReadMemoryFunc *mmio_ide_reads[] = {
3835 mmio_ide_read,
3836 mmio_ide_read,
3837 mmio_ide_read,
3838 };
3839
3840 static CPUWriteMemoryFunc *mmio_ide_writes[] = {
3841 mmio_ide_write,
3842 mmio_ide_write,
3843 mmio_ide_write,
3844 };
3845
3846 static uint32_t mmio_ide_status_read (void *opaque, target_phys_addr_t addr)
3847 {
3848 MMIOState *s= (MMIOState*)opaque;
3849 IDEState *ide = (IDEState*)s->dev;
3850 return ide_status_read(ide, 0);
3851 }
3852
3853 static void mmio_ide_cmd_write (void *opaque, target_phys_addr_t addr,
3854 uint32_t val)
3855 {
3856 MMIOState *s = (MMIOState*)opaque;
3857 IDEState *ide = (IDEState*)s->dev;
3858 ide_cmd_write(ide, 0, val);
3859 }
3860
3861 static CPUReadMemoryFunc *mmio_ide_status[] = {
3862 mmio_ide_status_read,
3863 mmio_ide_status_read,
3864 mmio_ide_status_read,
3865 };
3866
3867 static CPUWriteMemoryFunc *mmio_ide_cmd[] = {
3868 mmio_ide_cmd_write,
3869 mmio_ide_cmd_write,
3870 mmio_ide_cmd_write,
3871 };
3872
3873 void mmio_ide_init (target_phys_addr_t membase, target_phys_addr_t membase2,
3874 qemu_irq irq, int shift,
3875 BlockDriverState *hd0, BlockDriverState *hd1)
3876 {
3877 MMIOState *s = qemu_mallocz(sizeof(MMIOState));
3878 IDEState *ide = qemu_mallocz(sizeof(IDEState) * 2);
3879 int mem1, mem2;
3880
3881 ide_init2(ide, hd0, hd1, irq);
3882
3883 s->dev = ide;
3884 s->shift = shift;
3885
3886 mem1 = cpu_register_io_memory(mmio_ide_reads, mmio_ide_writes, s);
3887 mem2 = cpu_register_io_memory(mmio_ide_status, mmio_ide_cmd, s);
3888 cpu_register_physical_memory(membase, 16 << shift, mem1);
3889 cpu_register_physical_memory(membase2, 2 << shift, mem2);
3890 }
3891
3892 /***********************************************************/
3893 /* CF-ATA Microdrive */
3894
3895 #define METADATA_SIZE 0x20
3896
3897 /* DSCM-1XXXX Microdrive hard disk with CF+ II / PCMCIA interface. */
3898 typedef struct {
3899 IDEState ide[2];
3900 PCMCIACardState card;
3901 uint32_t attr_base;
3902 uint32_t io_base;
3903
3904 /* Card state */
3905 uint8_t opt;
3906 uint8_t stat;
3907 uint8_t pins;
3908
3909 uint8_t ctrl;
3910 uint16_t io;
3911 int cycle;
3912 } MicroDriveState;
3913
3914 /* Register bitfields */
3915 enum md_opt {
3916 OPT_MODE_MMAP = 0,
3917 OPT_MODE_IOMAP16 = 1,
3918 OPT_MODE_IOMAP1 = 2,
3919 OPT_MODE_IOMAP2 = 3,
3920 OPT_MODE = 0x3f,
3921 OPT_LEVIREQ = 0x40,
3922 OPT_SRESET = 0x80,
3923 };
3924 enum md_cstat {
3925 STAT_INT = 0x02,
3926 STAT_PWRDWN = 0x04,
3927 STAT_XE = 0x10,
3928 STAT_IOIS8 = 0x20,
3929 STAT_SIGCHG = 0x40,
3930 STAT_CHANGED = 0x80,
3931 };
3932 enum md_pins {
3933 PINS_MRDY = 0x02,
3934 PINS_CRDY = 0x20,
3935 };
3936 enum md_ctrl {
3937 CTRL_IEN = 0x02,
3938 CTRL_SRST = 0x04,
3939 };
3940
3941 static inline void md_interrupt_update(MicroDriveState *s)
3942 {
3943 if (!s->card.slot)
3944 return;
3945
3946 qemu_set_irq(s->card.slot->irq,
3947 !(s->stat & STAT_INT) && /* Inverted */
3948 !(s->ctrl & (CTRL_IEN | CTRL_SRST)) &&
3949 !(s->opt & OPT_SRESET));
3950 }
3951
3952 static void md_set_irq(void *opaque, int irq, int level)
3953 {
3954 MicroDriveState *s = (MicroDriveState *) opaque;
3955 if (level)
3956 s->stat |= STAT_INT;
3957 else
3958 s->stat &= ~STAT_INT;
3959
3960 md_interrupt_update(s);
3961 }
3962
3963 static void md_reset(MicroDriveState *s)
3964 {
3965 s->opt = OPT_MODE_MMAP;
3966 s->stat = 0;
3967 s->pins = 0;
3968 s->cycle = 0;
3969 s->ctrl = 0;
3970 ide_reset(s->ide);
3971 }
3972
3973 static uint8_t md_attr_read(void *opaque, uint32_t at)
3974 {
3975 MicroDriveState *s = (MicroDriveState *) opaque;
3976 if (at < s->attr_base) {
3977 if (at < s->card.cis_len)
3978 return s->card.cis[at];
3979 else
3980 return 0x00;
3981 }
3982
3983 at -= s->attr_base;
3984
3985 switch (at) {
3986 case 0x00: /* Configuration Option Register */
3987 return s->opt;
3988 case 0x02: /* Card Configuration Status Register */
3989 if (s->ctrl & CTRL_IEN)
3990 return s->stat & ~STAT_INT;
3991 else
3992 return s->stat;
3993 case 0x04: /* Pin Replacement Register */
3994 return (s->pins & PINS_CRDY) | 0x0c;
3995 case 0x06: /* Socket and Copy Register */
3996 return 0x00;
3997 #ifdef VERBOSE
3998 default:
3999 printf("%s: Bad attribute space register %02x\n", __FUNCTION__, at);
4000 #endif
4001 }
4002
4003 return 0;
4004 }
4005
4006 static void md_attr_write(void *opaque, uint32_t at, uint8_t value)
4007 {
4008 MicroDriveState *s = (MicroDriveState *) opaque;
4009 at -= s->attr_base;
4010
4011 switch (at) {
4012 case 0x00: /* Configuration Option Register */
4013 s->opt = value & 0xcf;
4014 if (value & OPT_SRESET)
4015 md_reset(s);
4016 md_interrupt_update(s);
4017 break;
4018 case 0x02: /* Card Configuration Status Register */
4019 if ((s->stat ^ value) & STAT_PWRDWN)
4020 s->pins |= PINS_CRDY;
4021 s->stat &= 0x82;
4022 s->stat |= value & 0x74;
4023 md_interrupt_update(s);
4024 /* Word 170 in Identify Device must be equal to STAT_XE */
4025 break;
4026 case 0x04: /* Pin Replacement Register */
4027 s->pins &= PINS_CRDY;
4028 s->pins |= value & PINS_MRDY;
4029 break;
4030 case 0x06: /* Socket and Copy Register */
4031 break;
4032 default:
4033 printf("%s: Bad attribute space register %02x\n", __FUNCTION__, at);
4034 }
4035 }
4036
4037 static uint16_t md_common_read(void *opaque, uint32_t at)
4038 {
4039 MicroDriveState *s = (MicroDriveState *) opaque;
4040 uint16_t ret;
4041 at -= s->io_base;
4042
4043 switch (s->opt & OPT_MODE) {
4044 case OPT_MODE_MMAP:
4045 if ((at & ~0x3ff) == 0x400)
4046 at = 0;
4047 break;
4048 case OPT_MODE_IOMAP16:
4049 at &= 0xf;
4050 break;
4051 case OPT_MODE_IOMAP1:
4052 if ((at & ~0xf) == 0x3f0)
4053 at -= 0x3e8;
4054 else if ((at & ~0xf) == 0x1f0)
4055 at -= 0x1f0;
4056 break;
4057 case OPT_MODE_IOMAP2:
4058 if ((at & ~0xf) == 0x370)
4059 at -= 0x368;
4060 else if ((at & ~0xf) == 0x170)
4061 at -= 0x170;
4062 }
4063
4064 switch (at) {
4065 case 0x0: /* Even RD Data */
4066 case 0x8:
4067 return ide_data_readw(s->ide, 0);
4068
4069 /* TODO: 8-bit accesses */
4070 if (s->cycle)
4071 ret = s->io >> 8;
4072 else {
4073 s->io = ide_data_readw(s->ide, 0);
4074 ret = s->io & 0xff;
4075 }
4076 s->cycle = !s->cycle;
4077 return ret;
4078 case 0x9: /* Odd RD Data */
4079 return s->io >> 8;
4080 case 0xd: /* Error */
4081 return ide_ioport_read(s->ide, 0x1);
4082 case 0xe: /* Alternate Status */
4083 if (s->ide->cur_drive->bs)
4084 return s->ide->cur_drive->status;
4085 else
4086 return 0;
4087 case 0xf: /* Device Address */
4088 return 0xc2 | ((~s->ide->select << 2) & 0x3c);
4089 default:
4090 return ide_ioport_read(s->ide, at);
4091 }
4092
4093 return 0;
4094 }
4095
4096 static void md_common_write(void *opaque, uint32_t at, uint16_t value)
4097 {
4098 MicroDriveState *s = (MicroDriveState *) opaque;
4099 at -= s->io_base;
4100
4101 switch (s->opt & OPT_MODE) {
4102 case OPT_MODE_MMAP:
4103 if ((at & ~0x3ff) == 0x400)
4104 at = 0;
4105 break;
4106 case OPT_MODE_IOMAP16:
4107 at &= 0xf;
4108 break;
4109 case OPT_MODE_IOMAP1:
4110 if ((at & ~0xf) == 0x3f0)
4111 at -= 0x3e8;
4112 else if ((at & ~0xf) == 0x1f0)
4113 at -= 0x1f0;
4114 break;
4115 case OPT_MODE_IOMAP2:
4116 if ((at & ~0xf) == 0x370)
4117 at -= 0x368;
4118 else if ((at & ~0xf) == 0x170)
4119 at -= 0x170;
4120 }
4121
4122 switch (at) {
4123 case 0x0: /* Even WR Data */
4124 case 0x8:
4125 ide_data_writew(s->ide, 0, value);
4126 break;
4127
4128 /* TODO: 8-bit accesses */
4129 if (s->cycle)
4130 ide_data_writew(s->ide, 0, s->io | (value << 8));
4131 else
4132 s->io = value & 0xff;
4133 s->cycle = !s->cycle;
4134 break;
4135 case 0x9:
4136 s->io = value & 0xff;
4137 s->cycle = !s->cycle;
4138 break;
4139 case 0xd: /* Features */
4140 ide_ioport_write(s->ide, 0x1, value);
4141 break;
4142 case 0xe: /* Device Control */
4143 s->ctrl = value;
4144 if (value & CTRL_SRST)
4145 md_reset(s);
4146 md_interrupt_update(s);
4147 break;
4148 default:
4149 if (s->stat & STAT_PWRDWN) {
4150 s->pins |= PINS_CRDY;
4151 s->stat &= ~STAT_PWRDWN;
4152 }
4153 ide_ioport_write(s->ide, at, value);
4154 }
4155 }
4156
4157 static void md_save(QEMUFile *f, void *opaque)
4158 {
4159 MicroDriveState *s = (MicroDriveState *) opaque;
4160 int i;
4161 uint8_t drive1_selected;
4162
4163 qemu_put_8s(f, &s->opt);
4164 qemu_put_8s(f, &s->stat);
4165 qemu_put_8s(f, &s->pins);
4166
4167 qemu_put_8s(f, &s->ctrl);
4168 qemu_put_be16s(f, &s->io);
4169 qemu_put_byte(f, s->cycle);
4170
4171 drive1_selected = (s->ide->cur_drive != s->ide);
4172 qemu_put_8s(f, &s->ide->cmd);
4173 qemu_put_8s(f, &drive1_selected);
4174
4175 for (i = 0; i < 2; i ++)
4176 ide_save(f, &s->ide[i]);
4177 }
4178
4179 static int md_load(QEMUFile *f, void *opaque, int version_id)
4180 {
4181 MicroDriveState *s = (MicroDriveState *) opaque;
4182 int i;
4183 uint8_t drive1_selected;
4184
4185 if (version_id != 0 && version_id != 3)
4186 return -EINVAL;
4187
4188 qemu_get_8s(f, &s->opt);
4189 qemu_get_8s(f, &s->stat);
4190 qemu_get_8s(f, &s->pins);
4191
4192 qemu_get_8s(f, &s->ctrl);
4193 qemu_get_be16s(f, &s->io);
4194 s->cycle = qemu_get_byte(f);
4195
4196 qemu_get_8s(f, &s->ide->cmd);
4197 qemu_get_8s(f, &drive1_selected);
4198 s->ide->cur_drive = &s->ide[(drive1_selected != 0)];
4199
4200 for (i = 0; i < 2; i ++)
4201 ide_load(f, &s->ide[i], version_id);
4202
4203 return 0;
4204 }
4205
4206 static const uint8_t dscm1xxxx_cis[0x14a] = {
4207 [0x000] = CISTPL_DEVICE, /* 5V Device Information */
4208 [0x002] = 0x03, /* Tuple length = 4 bytes */
4209 [0x004] = 0xdb, /* ID: DTYPE_FUNCSPEC, non WP, DSPEED_150NS */
4210 [0x006] = 0x01, /* Size = 2K bytes */
4211 [0x008] = CISTPL_ENDMARK,
4212
4213 [0x00a] = CISTPL_DEVICE_OC, /* Additional Device Information */
4214 [0x00c] = 0x04, /* Tuple length = 4 byest */
4215 [0x00e] = 0x03, /* Conditions: Ext = 0, Vcc 3.3V, MWAIT = 1 */
4216 [0x010] = 0xdb, /* ID: DTYPE_FUNCSPEC, non WP, DSPEED_150NS */
4217 [0x012] = 0x01, /* Size = 2K bytes */
4218 [0x014] = CISTPL_ENDMARK,
4219
4220 [0x016] = CISTPL_JEDEC_C, /* JEDEC ID */
4221 [0x018] = 0x02, /* Tuple length = 2 bytes */
4222 [0x01a] = 0xdf, /* PC Card ATA with no Vpp required */
4223 [0x01c] = 0x01,
4224
4225 [0x01e] = CISTPL_MANFID, /* Manufacture ID */
4226 [0x020] = 0x04, /* Tuple length = 4 bytes */
4227 [0x022] = 0xa4, /* TPLMID_MANF = 00a4 (IBM) */
4228 [0x024] = 0x00,
4229 [0x026] = 0x00, /* PLMID_CARD = 0000 */
4230 [0x028] = 0x00,
4231
4232 [0x02a] = CISTPL_VERS_1, /* Level 1 Version */
4233 [0x02c] = 0x12, /* Tuple length = 23 bytes */
4234 [0x02e] = 0x04, /* Major Version = JEIDA 4.2 / PCMCIA 2.1 */
4235 [0x030] = 0x01, /* Minor Version = 1 */
4236 [0x032] = 'I',
4237 [0x034] = 'B',
4238 [0x036] = 'M',
4239 [0x038] = 0x00,
4240 [0x03a] = 'm',
4241 [0x03c] = 'i',
4242 [0x03e] = 'c',
4243 [0x040] = 'r',
4244 [0x042] = 'o',
4245 [0x044] = 'd',
4246 [0x046] = 'r',
4247 [0x048] = 'i',
4248 [0x04a] = 'v',
4249 [0x04c] = 'e',
4250 [0x04e] = 0x00,
4251 [0x050] = CISTPL_ENDMARK,
4252
4253 [0x052] = CISTPL_FUNCID, /* Function ID */
4254 [0x054] = 0x02, /* Tuple length = 2 bytes */
4255 [0x056] = 0x04, /* TPLFID_FUNCTION = Fixed Disk */
4256 [0x058] = 0x01, /* TPLFID_SYSINIT: POST = 1, ROM = 0 */
4257
4258 [0x05a] = CISTPL_FUNCE, /* Function Extension */
4259 [0x05c] = 0x02, /* Tuple length = 2 bytes */
4260 [0x05e] = 0x01, /* TPLFE_TYPE = Disk Device Interface */
4261 [0x060] = 0x01, /* TPLFE_DATA = PC Card ATA Interface */
4262
4263 [0x062] = CISTPL_FUNCE, /* Function Extension */
4264 [0x064] = 0x03, /* Tuple length = 3 bytes */
4265 [0x066] = 0x02, /* TPLFE_TYPE = Basic PC Card ATA Interface */
4266 [0x068] = 0x08, /* TPLFE_DATA: Rotating, Unique, Single */
4267 [0x06a] = 0x0f, /* TPLFE_DATA: Sleep, Standby, Idle, Auto */
4268
4269 [0x06c] = CISTPL_CONFIG, /* Configuration */
4270 [0x06e] = 0x05, /* Tuple length = 5 bytes */
4271 [0x070] = 0x01, /* TPCC_RASZ = 2 bytes, TPCC_RMSZ = 1 byte */
4272 [0x072] = 0x07, /* TPCC_LAST = 7 */
4273 [0x074] = 0x00, /* TPCC_RADR = 0200 */
4274 [0x076] = 0x02,
4275 [0x078] = 0x0f, /* TPCC_RMSK = 200, 202, 204, 206 */
4276
4277 [0x07a] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4278 [0x07c] = 0x0b, /* Tuple length = 11 bytes */
4279 [0x07e] = 0xc0, /* TPCE_INDX = Memory Mode, Default, Iface */
4280 [0x080] = 0xc0, /* TPCE_IF = Memory, no BVDs, no WP, READY */
4281 [0x082] = 0xa1, /* TPCE_FS = Vcc only, no I/O, Memory, Misc */
4282 [0x084] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
4283 [0x086] = 0x55, /* NomV: 5.0 V */
4284 [0x088] = 0x4d, /* MinV: 4.5 V */
4285 [0x08a] = 0x5d, /* MaxV: 5.5 V */
4286 [0x08c] = 0x4e, /* Peakl: 450 mA */
4287 [0x08e] = 0x08, /* TPCE_MS = 1 window, 1 byte, Host address */
4288 [0x090] = 0x00, /* Window descriptor: Window length = 0 */
4289 [0x092] = 0x20, /* TPCE_MI: support power down mode, RW */
4290
4291 [0x094] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4292 [0x096] = 0x06, /* Tuple length = 6 bytes */
4293 [0x098] = 0x00, /* TPCE_INDX = Memory Mode, no Default */
4294 [0x09a] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
4295 [0x09c] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
4296 [0x09e] = 0xb5, /* NomV: 3.3 V */
4297 [0x0a0] = 0x1e,
4298 [0x0a2] = 0x3e, /* Peakl: 350 mA */
4299
4300 [0x0a4] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4301 [0x0a6] = 0x0d, /* Tuple length = 13 bytes */
4302 [0x0a8] = 0xc1, /* TPCE_INDX = I/O and Memory Mode, Default */
4303 [0x0aa] = 0x41, /* TPCE_IF = I/O and Memory, no BVD, no WP */
4304 [0x0ac] = 0x99, /* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
4305 [0x0ae] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
4306 [0x0b0] = 0x55, /* NomV: 5.0 V */
4307 [0x0b2] = 0x4d, /* MinV: 4.5 V */
4308 [0x0b4] = 0x5d, /* MaxV: 5.5 V */
4309 [0x0b6] = 0x4e, /* Peakl: 450 mA */
4310 [0x0b8] = 0x64, /* TPCE_IO = 16-byte boundary, 16/8 accesses */
4311 [0x0ba] = 0xf0, /* TPCE_IR = MASK, Level, Pulse, Share */
4312 [0x0bc] = 0xff, /* IRQ0..IRQ7 supported */
4313 [0x0be] = 0xff, /* IRQ8..IRQ15 supported */
4314 [0x0c0] = 0x20, /* TPCE_MI = support power down mode */
4315
4316 [0x0c2] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4317 [0x0c4] = 0x06, /* Tuple length = 6 bytes */
4318 [0x0c6] = 0x01, /* TPCE_INDX = I/O and Memory Mode */
4319 [0x0c8] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
4320 [0x0ca] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
4321 [0x0cc] = 0xb5, /* NomV: 3.3 V */
4322 [0x0ce] = 0x1e,
4323 [0x0d0] = 0x3e, /* Peakl: 350 mA */
4324
4325 [0x0d2] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4326 [0x0d4] = 0x12, /* Tuple length = 18 bytes */
4327 [0x0d6] = 0xc2, /* TPCE_INDX = I/O Primary Mode */
4328 [0x0d8] = 0x41, /* TPCE_IF = I/O and Memory, no BVD, no WP */
4329 [0x0da] = 0x99, /* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
4330 [0x0dc] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
4331 [0x0de] = 0x55, /* NomV: 5.0 V */
4332 [0x0e0] = 0x4d, /* MinV: 4.5 V */
4333 [0x0e2] = 0x5d, /* MaxV: 5.5 V */
4334 [0x0e4] = 0x4e, /* Peakl: 450 mA */
4335 [0x0e6] = 0xea, /* TPCE_IO = 1K boundary, 16/8 access, Range */
4336 [0x0e8] = 0x61, /* Range: 2 fields, 2 bytes addr, 1 byte len */
4337 [0x0ea] = 0xf0, /* Field 1 address = 0x01f0 */
4338 [0x0ec] = 0x01,
4339 [0x0ee] = 0x07, /* Address block length = 8 */
4340 [0x0f0] = 0xf6, /* Field 2 address = 0x03f6 */
4341 [0x0f2] = 0x03,
4342 [0x0f4] = 0x01, /* Address block length = 2 */
4343 [0x0f6] = 0xee, /* TPCE_IR = IRQ E, Level, Pulse, Share */
4344 [0x0f8] = 0x20, /* TPCE_MI = support power down mode */
4345
4346 [0x0fa] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4347 [0x0fc] = 0x06, /* Tuple length = 6 bytes */
4348 [0x0fe] = 0x02, /* TPCE_INDX = I/O Primary Mode, no Default */
4349 [0x100] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
4350 [0x102] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
4351 [0x104] = 0xb5, /* NomV: 3.3 V */
4352 [0x106] = 0x1e,
4353 [0x108] = 0x3e, /* Peakl: 350 mA */
4354
4355 [0x10a] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4356 [0x10c] = 0x12, /* Tuple length = 18 bytes */
4357 [0x10e] = 0xc3, /* TPCE_INDX = I/O Secondary Mode, Default */
4358 [0x110] = 0x41, /* TPCE_IF = I/O and Memory, no BVD, no WP */
4359 [0x112] = 0x99, /* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
4360 [0x114] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
4361 [0x116] = 0x55, /* NomV: 5.0 V */
4362 [0x118] = 0x4d, /* MinV: 4.5 V */
4363 [0x11a] = 0x5d, /* MaxV: 5.5 V */
4364 [0x11c] = 0x4e, /* Peakl: 450 mA */
4365 [0x11e] = 0xea, /* TPCE_IO = 1K boundary, 16/8 access, Range */
4366 [0x120] = 0x61, /* Range: 2 fields, 2 byte addr, 1 byte len */
4367 [0x122] = 0x70, /* Field 1 address = 0x0170 */
4368 [0x124] = 0x01,
4369 [0x126] = 0x07, /* Address block length = 8 */
4370 [0x128] = 0x76, /* Field 2 address = 0x0376 */
4371 [0x12a] = 0x03,
4372 [0x12c] = 0x01, /* Address block length = 2 */
4373 [0x12e] = 0xee, /* TPCE_IR = IRQ E, Level, Pulse, Share */
4374 [0x130] = 0x20, /* TPCE_MI = support power down mode */
4375
4376 [0x132] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
4377 [0x134] = 0x06, /* Tuple length = 6 bytes */
4378 [0x136] = 0x03, /* TPCE_INDX = I/O Secondary Mode */
4379 [0x138] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
4380 [0x13a] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
4381 [0x13c] = 0xb5, /* NomV: 3.3 V */
4382 [0x13e] = 0x1e,
4383 [0x140] = 0x3e, /* Peakl: 350 mA */
4384
4385 [0x142] = CISTPL_NO_LINK, /* No Link */
4386 [0x144] = 0x00, /* Tuple length = 0 bytes */
4387
4388 [0x146] = CISTPL_END, /* Tuple End */
4389 };
4390
4391 static int dscm1xxxx_attach(void *opaque)
4392 {
4393 MicroDriveState *md = (MicroDriveState *) opaque;
4394 md->card.attr_read = md_attr_read;
4395 md->card.attr_write = md_attr_write;
4396 md->card.common_read = md_common_read;
4397 md->card.common_write = md_common_write;
4398 md->card.io_read = md_common_read;
4399 md->card.io_write = md_common_write;
4400
4401 md->attr_base = md->card.cis[0x74] | (md->card.cis[0x76] << 8);
4402 md->io_base = 0x0;
4403
4404 md_reset(md);
4405 md_interrupt_update(md);
4406
4407 md->card.slot->card_string = "DSCM-1xxxx Hitachi Microdrive";
4408 return 0;
4409 }
4410
4411 static int dscm1xxxx_detach(void *opaque)
4412 {
4413 MicroDriveState *md = (MicroDriveState *) opaque;
4414 md_reset(md);
4415 return 0;
4416 }
4417
4418 PCMCIACardState *dscm1xxxx_init(BlockDriverState *bdrv)
4419 {
4420 MicroDriveState *md = (MicroDriveState *) qemu_mallocz(sizeof(MicroDriveState));
4421 md->card.state = md;
4422 md->card.attach = dscm1xxxx_attach;
4423 md->card.detach = dscm1xxxx_detach;
4424 md->card.cis = dscm1xxxx_cis;
4425 md->card.cis_len = sizeof(dscm1xxxx_cis);
4426
4427 ide_init2(md->ide, bdrv, NULL, qemu_allocate_irqs(md_set_irq, md, 1)[0]);
4428 md->ide->is_cf = 1;
4429 md->ide->mdata_size = METADATA_SIZE;
4430 md->ide->mdata_storage = (uint8_t *) qemu_mallocz(METADATA_SIZE);
4431
4432 register_savevm("microdrive", -1, 3, md_save, md_load, md);
4433
4434 return &md->card;
4435 }
Patches shipped by Fedora