?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Relax qemu_ld/st constraints for !SOFTMMU case
[qemu/mini2440/sniper_sniper_test.git] / hw / ide.c
blob6b14e8f961d451e442c1b692c02899067a2a7a73
1 /*
2 * QEMU IDE disk and CD/DVD-ROM Emulator
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 * Copyright (c) 2006 Openedhand Ltd.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25 #include "hw.h"
26 #include "pc.h"
27 #include "pci.h"
28 #include "scsi-disk.h"
29 #include "pcmcia.h"
30 #include "block.h"
31 #include "qemu-timer.h"
32 #include "sysemu.h"
33 #include "ppc_mac.h"
34
35 /* debug IDE devices */
36 //#define DEBUG_IDE
37 //#define DEBUG_IDE_ATAPI
38 //#define DEBUG_AIO
39 #define USE_DMA_CDROM
40
41 /* Bits of HD_STATUS */
42 #define ERR_STAT 0x01
43 #define INDEX_STAT 0x02
44 #define ECC_STAT 0x04 /* Corrected error */
45 #define DRQ_STAT 0x08
46 #define SEEK_STAT 0x10
47 #define SRV_STAT 0x10
48 #define WRERR_STAT 0x20
49 #define READY_STAT 0x40
50 #define BUSY_STAT 0x80
51
52 /* Bits for HD_ERROR */
53 #define MARK_ERR 0x01 /* Bad address mark */
54 #define TRK0_ERR 0x02 /* couldn't find track 0 */
55 #define ABRT_ERR 0x04 /* Command aborted */
56 #define MCR_ERR 0x08 /* media change request */
57 #define ID_ERR 0x10 /* ID field not found */
58 #define MC_ERR 0x20 /* media changed */
59 #define ECC_ERR 0x40 /* Uncorrectable ECC error */
60 #define BBD_ERR 0x80 /* pre-EIDE meaning: block marked bad */
61 #define ICRC_ERR 0x80 /* new meaning: CRC error during transfer */
62
63 /* Bits of HD_NSECTOR */
64 #define CD 0x01
65 #define IO 0x02
66 #define REL 0x04
67 #define TAG_MASK 0xf8
68
69 #define IDE_CMD_RESET 0x04
70 #define IDE_CMD_DISABLE_IRQ 0x02
71
72 /* ATA/ATAPI Commands pre T13 Spec */
73 #define WIN_NOP 0x00
74 /*
75 * 0x01->0x02 Reserved
76 */
77 #define CFA_REQ_EXT_ERROR_CODE 0x03 /* CFA Request Extended Error Code */
78 /*
79 * 0x04->0x07 Reserved
80 */
81 #define WIN_SRST 0x08 /* ATAPI soft reset command */
82 #define WIN_DEVICE_RESET 0x08
83 /*
84 * 0x09->0x0F Reserved
85 */
86 #define WIN_RECAL 0x10
87 #define WIN_RESTORE WIN_RECAL
88 /*
89 * 0x10->0x1F Reserved
90 */
91 #define WIN_READ 0x20 /* 28-Bit */
92 #define WIN_READ_ONCE 0x21 /* 28-Bit without retries */
93 #define WIN_READ_LONG 0x22 /* 28-Bit */
94 #define WIN_READ_LONG_ONCE 0x23 /* 28-Bit without retries */
95 #define WIN_READ_EXT 0x24 /* 48-Bit */
96 #define WIN_READDMA_EXT 0x25 /* 48-Bit */
97 #define WIN_READDMA_QUEUED_EXT 0x26 /* 48-Bit */
98 #define WIN_READ_NATIVE_MAX_EXT 0x27 /* 48-Bit */
99 /*
100 * 0x28
101 */
102 #define WIN_MULTREAD_EXT 0x29 /* 48-Bit */
103 /*
104 * 0x2A->0x2F Reserved
105 */
106 #define WIN_WRITE 0x30 /* 28-Bit */
107 #define WIN_WRITE_ONCE 0x31 /* 28-Bit without retries */
108 #define WIN_WRITE_LONG 0x32 /* 28-Bit */
109 #define WIN_WRITE_LONG_ONCE 0x33 /* 28-Bit without retries */
110 #define WIN_WRITE_EXT 0x34 /* 48-Bit */
111 #define WIN_WRITEDMA_EXT 0x35 /* 48-Bit */
112 #define WIN_WRITEDMA_QUEUED_EXT 0x36 /* 48-Bit */
113 #define WIN_SET_MAX_EXT 0x37 /* 48-Bit */
114 #define CFA_WRITE_SECT_WO_ERASE 0x38 /* CFA Write Sectors without erase */
115 #define WIN_MULTWRITE_EXT 0x39 /* 48-Bit */
116 /*
117 * 0x3A->0x3B Reserved
118 */
119 #define WIN_WRITE_VERIFY 0x3C /* 28-Bit */
120 /*
121 * 0x3D->0x3F Reserved
122 */
123 #define WIN_VERIFY 0x40 /* 28-Bit - Read Verify Sectors */
124 #define WIN_VERIFY_ONCE 0x41 /* 28-Bit - without retries */
125 #define WIN_VERIFY_EXT 0x42 /* 48-Bit */
126 /*
127 * 0x43->0x4F Reserved
128 */
129 #define WIN_FORMAT 0x50
130 /*
131 * 0x51->0x5F Reserved
132 */
133 #define WIN_INIT 0x60
134 /*
135 * 0x61->0x5F Reserved
136 */
137 #define WIN_SEEK 0x70 /* 0x70-0x7F Reserved */
138 #define CFA_TRANSLATE_SECTOR 0x87 /* CFA Translate Sector */
139 #define WIN_DIAGNOSE 0x90
140 #define WIN_SPECIFY 0x91 /* set drive geometry translation */
141 #define WIN_DOWNLOAD_MICROCODE 0x92
142 #define WIN_STANDBYNOW2 0x94
143 #define CFA_IDLEIMMEDIATE 0x95 /* force drive to become "ready" */
144 #define WIN_STANDBY2 0x96
145 #define WIN_SETIDLE2 0x97
146 #define WIN_CHECKPOWERMODE2 0x98
147 #define WIN_SLEEPNOW2 0x99
148 /*
149 * 0x9A VENDOR
150 */
151 #define WIN_PACKETCMD 0xA0 /* Send a packet command. */
152 #define WIN_PIDENTIFY 0xA1 /* identify ATAPI device */
153 #define WIN_QUEUED_SERVICE 0xA2
154 #define WIN_SMART 0xB0 /* self-monitoring and reporting */
155 #define CFA_ACCESS_METADATA_STORAGE 0xB8
156 #define CFA_ERASE_SECTORS 0xC0 /* microdrives implement as NOP */
157 #define WIN_MULTREAD 0xC4 /* read sectors using multiple mode*/
158 #define WIN_MULTWRITE 0xC5 /* write sectors using multiple mode */
159 #define WIN_SETMULT 0xC6 /* enable/disable multiple mode */
160 #define WIN_READDMA_QUEUED 0xC7 /* read sectors using Queued DMA transfers */
161 #define WIN_READDMA 0xC8 /* read sectors using DMA transfers */
162 #define WIN_READDMA_ONCE 0xC9 /* 28-Bit - without retries */
163 #define WIN_WRITEDMA 0xCA /* write sectors using DMA transfers */
164 #define WIN_WRITEDMA_ONCE 0xCB /* 28-Bit - without retries */
165 #define WIN_WRITEDMA_QUEUED 0xCC /* write sectors using Queued DMA transfers */
166 #define CFA_WRITE_MULTI_WO_ERASE 0xCD /* CFA Write multiple without erase */
167 #define WIN_GETMEDIASTATUS 0xDA
168 #define WIN_ACKMEDIACHANGE 0xDB /* ATA-1, ATA-2 vendor */
169 #define WIN_POSTBOOT 0xDC
170 #define WIN_PREBOOT 0xDD
171 #define WIN_DOORLOCK 0xDE /* lock door on removable drives */
172 #define WIN_DOORUNLOCK 0xDF /* unlock door on removable drives */
173 #define WIN_STANDBYNOW1 0xE0
174 #define WIN_IDLEIMMEDIATE 0xE1 /* force drive to become "ready" */
175 #define WIN_STANDBY 0xE2 /* Set device in Standby Mode */
176 #define WIN_SETIDLE1 0xE3
177 #define WIN_READ_BUFFER 0xE4 /* force read only 1 sector */
178 #define WIN_CHECKPOWERMODE1 0xE5
179 #define WIN_SLEEPNOW1 0xE6
180 #define WIN_FLUSH_CACHE 0xE7
181 #define WIN_WRITE_BUFFER 0xE8 /* force write only 1 sector */
182 #define WIN_WRITE_SAME 0xE9 /* read ata-2 to use */
183 /* SET_FEATURES 0x22 or 0xDD */
184 #define WIN_FLUSH_CACHE_EXT 0xEA /* 48-Bit */
185 #define WIN_IDENTIFY 0xEC /* ask drive to identify itself */
186 #define WIN_MEDIAEJECT 0xED
187 #define WIN_IDENTIFY_DMA 0xEE /* same as WIN_IDENTIFY, but DMA */
188 #define WIN_SETFEATURES 0xEF /* set special drive features */
189 #define EXABYTE_ENABLE_NEST 0xF0
190 #define IBM_SENSE_CONDITION 0xF0 /* measure disk temperature */
191 #define WIN_SECURITY_SET_PASS 0xF1
192 #define WIN_SECURITY_UNLOCK 0xF2
193 #define WIN_SECURITY_ERASE_PREPARE 0xF3
194 #define WIN_SECURITY_ERASE_UNIT 0xF4
195 #define WIN_SECURITY_FREEZE_LOCK 0xF5
196 #define CFA_WEAR_LEVEL 0xF5 /* microdrives implement as NOP */
197 #define WIN_SECURITY_DISABLE 0xF6
198 #define WIN_READ_NATIVE_MAX 0xF8 /* return the native maximum address */
199 #define WIN_SET_MAX 0xF9
200 #define DISABLE_SEAGATE 0xFB
201
202 /* set to 1 set disable mult support */
203 #define MAX_MULT_SECTORS 16
204
205 #define IDE_DMA_BUF_SECTORS 256
206
207 #if (IDE_DMA_BUF_SECTORS < MAX_MULT_SECTORS)
208 #error "IDE_DMA_BUF_SECTORS must be bigger or equal to MAX_MULT_SECTORS"
209 #endif
210
211 /* ATAPI defines */
212
213 #define ATAPI_PACKET_SIZE 12
214
215 /* The generic packet command opcodes for CD/DVD Logical Units,
216 * From Table 57 of the SFF8090 Ver. 3 (Mt. Fuji) draft standard. */
217 #define GPCMD_BLANK 0xa1
218 #define GPCMD_CLOSE_TRACK 0x5b
219 #define GPCMD_FLUSH_CACHE 0x35
220 #define GPCMD_FORMAT_UNIT 0x04
221 #define GPCMD_GET_CONFIGURATION 0x46
222 #define GPCMD_GET_EVENT_STATUS_NOTIFICATION 0x4a
223 #define GPCMD_GET_PERFORMANCE 0xac
224 #define GPCMD_INQUIRY 0x12
225 #define GPCMD_LOAD_UNLOAD 0xa6
226 #define GPCMD_MECHANISM_STATUS 0xbd
227 #define GPCMD_MODE_SELECT_10 0x55
228 #define GPCMD_MODE_SENSE_10 0x5a
229 #define GPCMD_PAUSE_RESUME 0x4b
230 #define GPCMD_PLAY_AUDIO_10 0x45
231 #define GPCMD_PLAY_AUDIO_MSF 0x47
232 #define GPCMD_PLAY_AUDIO_TI 0x48
233 #define GPCMD_PLAY_CD 0xbc
234 #define GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL 0x1e
235 #define GPCMD_READ_10 0x28
236 #define GPCMD_READ_12 0xa8
237 #define GPCMD_READ_CDVD_CAPACITY 0x25
238 #define GPCMD_READ_CD 0xbe
239 #define GPCMD_READ_CD_MSF 0xb9
240 #define GPCMD_READ_DISC_INFO 0x51
241 #define GPCMD_READ_DVD_STRUCTURE 0xad
242 #define GPCMD_READ_FORMAT_CAPACITIES 0x23
243 #define GPCMD_READ_HEADER 0x44
244 #define GPCMD_READ_TRACK_RZONE_INFO 0x52
245 #define GPCMD_READ_SUBCHANNEL 0x42
246 #define GPCMD_READ_TOC_PMA_ATIP 0x43
247 #define GPCMD_REPAIR_RZONE_TRACK 0x58
248 #define GPCMD_REPORT_KEY 0xa4
249 #define GPCMD_REQUEST_SENSE 0x03
250 #define GPCMD_RESERVE_RZONE_TRACK 0x53
251 #define GPCMD_SCAN 0xba
252 #define GPCMD_SEEK 0x2b
253 #define GPCMD_SEND_DVD_STRUCTURE 0xad
254 #define GPCMD_SEND_EVENT 0xa2
255 #define GPCMD_SEND_KEY 0xa3
256 #define GPCMD_SEND_OPC 0x54
257 #define GPCMD_SET_READ_AHEAD 0xa7
258 #define GPCMD_SET_STREAMING 0xb6
259 #define GPCMD_START_STOP_UNIT 0x1b
260 #define GPCMD_STOP_PLAY_SCAN 0x4e
261 #define GPCMD_TEST_UNIT_READY 0x00
262 #define GPCMD_VERIFY_10 0x2f
263 #define GPCMD_WRITE_10 0x2a
264 #define GPCMD_WRITE_AND_VERIFY_10 0x2e
265 /* This is listed as optional in ATAPI 2.6, but is (curiously)
266 * missing from Mt. Fuji, Table 57. It _is_ mentioned in Mt. Fuji
267 * Table 377 as an MMC command for SCSi devices though... Most ATAPI
268 * drives support it. */
269 #define GPCMD_SET_SPEED 0xbb
270 /* This seems to be a SCSI specific CD-ROM opcode
271 * to play data at track/index */
272 #define GPCMD_PLAYAUDIO_TI 0x48
273 /*
274 * From MS Media Status Notification Support Specification. For
275 * older drives only.
276 */
277 #define GPCMD_GET_MEDIA_STATUS 0xda
278 #define GPCMD_MODE_SENSE_6 0x1a
279
280 /* Mode page codes for mode sense/set */
281 #define GPMODE_R_W_ERROR_PAGE 0x01
282 #define GPMODE_WRITE_PARMS_PAGE 0x05
283 #define GPMODE_AUDIO_CTL_PAGE 0x0e
284 #define GPMODE_POWER_PAGE 0x1a
285 #define GPMODE_FAULT_FAIL_PAGE 0x1c
286 #define GPMODE_TO_PROTECT_PAGE 0x1d
287 #define GPMODE_CAPABILITIES_PAGE 0x2a
288 #define GPMODE_ALL_PAGES 0x3f
289 /* Not in Mt. Fuji, but in ATAPI 2.6 -- depricated now in favor
290 * of MODE_SENSE_POWER_PAGE */
291 #define GPMODE_CDROM_PAGE 0x0d
292
293 /*
294 * Based on values from <linux/cdrom.h> but extending CD_MINS
295 * to the maximum common size allowed by the Orange's Book ATIP
296 *
297 * 90 and 99 min CDs are also available but using them as the
298 * upper limit reduces the effectiveness of the heuristic to
299 * detect DVDs burned to less than 25% of their maximum capacity
300 */
301
302 /* Some generally useful CD-ROM information */
303 #define CD_MINS 80 /* max. minutes per CD */
304 #define CD_SECS 60 /* seconds per minute */
305 #define CD_FRAMES 75 /* frames per second */
306 #define CD_FRAMESIZE 2048 /* bytes per frame, "cooked" mode */
307 #define CD_MAX_BYTES (CD_MINS * CD_SECS * CD_FRAMES * CD_FRAMESIZE)
308 #define CD_MAX_SECTORS (CD_MAX_BYTES / 512)
309
310 /*
311 * The MMC values are not IDE specific and might need to be moved
312 * to a common header if they are also needed for the SCSI emulation
313 */
314
315 /* Profile list from MMC-6 revision 1 table 91 */
316 #define MMC_PROFILE_NONE 0x0000
317 #define MMC_PROFILE_CD_ROM 0x0008
318 #define MMC_PROFILE_CD_R 0x0009
319 #define MMC_PROFILE_CD_RW 0x000A
320 #define MMC_PROFILE_DVD_ROM 0x0010
321 #define MMC_PROFILE_DVD_R_SR 0x0011
322 #define MMC_PROFILE_DVD_RAM 0x0012
323 #define MMC_PROFILE_DVD_RW_RO 0x0013
324 #define MMC_PROFILE_DVD_RW_SR 0x0014
325 #define MMC_PROFILE_DVD_R_DL_SR 0x0015
326 #define MMC_PROFILE_DVD_R_DL_JR 0x0016
327 #define MMC_PROFILE_DVD_RW_DL 0x0017
328 #define MMC_PROFILE_DVD_DDR 0x0018
329 #define MMC_PROFILE_DVD_PLUS_RW 0x001A
330 #define MMC_PROFILE_DVD_PLUS_R 0x001B
331 #define MMC_PROFILE_DVD_PLUS_RW_DL 0x002A
332 #define MMC_PROFILE_DVD_PLUS_R_DL 0x002B
333 #define MMC_PROFILE_BD_ROM 0x0040
334 #define MMC_PROFILE_BD_R_SRM 0x0041
335 #define MMC_PROFILE_BD_R_RRM 0x0042
336 #define MMC_PROFILE_BD_RE 0x0043
337 #define MMC_PROFILE_HDDVD_ROM 0x0050
338 #define MMC_PROFILE_HDDVD_R 0x0051
339 #define MMC_PROFILE_HDDVD_RAM 0x0052
340 #define MMC_PROFILE_HDDVD_RW 0x0053
341 #define MMC_PROFILE_HDDVD_R_DL 0x0058
342 #define MMC_PROFILE_HDDVD_RW_DL 0x005A
343 #define MMC_PROFILE_INVALID 0xFFFF
344
345 #define ATAPI_INT_REASON_CD 0x01 /* 0 = data transfer */
346 #define ATAPI_INT_REASON_IO 0x02 /* 1 = transfer to the host */
347 #define ATAPI_INT_REASON_REL 0x04
348 #define ATAPI_INT_REASON_TAG 0xf8
349
350 /* same constants as bochs */
351 #define ASC_ILLEGAL_OPCODE 0x20
352 #define ASC_LOGICAL_BLOCK_OOR 0x21
353 #define ASC_INV_FIELD_IN_CMD_PACKET 0x24
354 #define ASC_INCOMPATIBLE_FORMAT 0x30
355 #define ASC_MEDIUM_NOT_PRESENT 0x3a
356 #define ASC_SAVING_PARAMETERS_NOT_SUPPORTED 0x39
357
358 #define CFA_NO_ERROR 0x00
359 #define CFA_MISC_ERROR 0x09
360 #define CFA_INVALID_COMMAND 0x20
361 #define CFA_INVALID_ADDRESS 0x21
362 #define CFA_ADDRESS_OVERFLOW 0x2f
363
364 #define SENSE_NONE 0
365 #define SENSE_NOT_READY 2
366 #define SENSE_ILLEGAL_REQUEST 5
367 #define SENSE_UNIT_ATTENTION 6
368
369 struct IDEState;
370
371 typedef void EndTransferFunc(struct IDEState *);
372
373 /* NOTE: IDEState represents in fact one drive */
374 typedef struct IDEState {
375 /* ide config */
376 int is_cdrom;
377 int is_cf;
378 int cylinders, heads, sectors;
379 int64_t nb_sectors;
380 int mult_sectors;
381 int identify_set;
382 uint16_t identify_data[256];
383 qemu_irq irq;
384 PCIDevice *pci_dev;
385 struct BMDMAState *bmdma;
386 int drive_serial;
387 /* ide regs */
388 uint8_t feature;
389 uint8_t error;
390 uint32_t nsector;
391 uint8_t sector;
392 uint8_t lcyl;
393 uint8_t hcyl;
394 /* other part of tf for lba48 support */
395 uint8_t hob_feature;
396 uint8_t hob_nsector;
397 uint8_t hob_sector;
398 uint8_t hob_lcyl;
399 uint8_t hob_hcyl;
400
401 uint8_t select;
402 uint8_t status;
403
404 /* 0x3f6 command, only meaningful for drive 0 */
405 uint8_t cmd;
406 /* set for lba48 access */
407 uint8_t lba48;
408 /* depends on bit 4 in select, only meaningful for drive 0 */
409 struct IDEState *cur_drive;
410 BlockDriverState *bs;
411 /* ATAPI specific */
412 uint8_t sense_key;
413 uint8_t asc;
414 int packet_transfer_size;
415 int elementary_transfer_size;
416 int io_buffer_index;
417 int lba;
418 int cd_sector_size;
419 int atapi_dma; /* true if dma is requested for the packet cmd */
420 /* ATA DMA state */
421 int io_buffer_size;
422 /* PIO transfer handling */
423 int req_nb_sectors; /* number of sectors per interrupt */
424 EndTransferFunc *end_transfer_func;
425 uint8_t *data_ptr;
426 uint8_t *data_end;
427 uint8_t *io_buffer;
428 QEMUTimer *sector_write_timer; /* only used for win2k install hack */
429 uint32_t irq_count; /* counts IRQs when using win2k install hack */
430 /* CF-ATA extended error */
431 uint8_t ext_error;
432 /* CF-ATA metadata storage */
433 uint32_t mdata_size;
434 uint8_t *mdata_storage;
435 int media_changed;
436 } IDEState;
437
438 /* XXX: DVDs that could fit on a CD will be reported as a CD */
439 static inline int media_present(IDEState *s)
440 {
441 return (s->nb_sectors > 0);
442 }
443
444 static inline int media_is_dvd(IDEState *s)
445 {
446 return (media_present(s) && s->nb_sectors > CD_MAX_SECTORS);
447 }
448
449 static inline int media_is_cd(IDEState *s)
450 {
451 return (media_present(s) && s->nb_sectors <= CD_MAX_SECTORS);
452 }
453
454 #define BM_STATUS_DMAING 0x01
455 #define BM_STATUS_ERROR 0x02
456 #define BM_STATUS_INT 0x04
457
458 #define BM_CMD_START 0x01
459 #define BM_CMD_READ 0x08
460
461 #define IDE_TYPE_PIIX3 0
462 #define IDE_TYPE_CMD646 1
463 #define IDE_TYPE_PIIX4 2
464
465 /* CMD646 specific */
466 #define MRDMODE 0x71
467 #define MRDMODE_INTR_CH0 0x04
468 #define MRDMODE_INTR_CH1 0x08
469 #define MRDMODE_BLK_CH0 0x10
470 #define MRDMODE_BLK_CH1 0x20
471 #define UDIDETCR0 0x73
472 #define UDIDETCR1 0x7B
473
474 typedef struct BMDMAState {
475 uint8_t cmd;
476 uint8_t status;
477 uint32_t addr;
478
479 struct PCIIDEState *pci_dev;
480 /* current transfer state */
481 uint32_t cur_addr;
482 uint32_t cur_prd_last;
483 uint32_t cur_prd_addr;
484 uint32_t cur_prd_len;
485 IDEState *ide_if;
486 BlockDriverCompletionFunc *dma_cb;
487 BlockDriverAIOCB *aiocb;
488 } BMDMAState;
489
490 typedef struct PCIIDEState {
491 PCIDevice dev;
492 IDEState ide_if[4];
493 BMDMAState bmdma[2];
494 int type; /* see IDE_TYPE_xxx */
495 } PCIIDEState;
496
497 static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb);
498 static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret);
499
500 static void padstr(char *str, const char *src, int len)
501 {
502 int i, v;
503 for(i = 0; i < len; i++) {
504 if (*src)
505 v = *src++;
506 else
507 v = ' ';
508 str[i^1] = v;
509 }
510 }
511
512 static void padstr8(uint8_t *buf, int buf_size, const char *src)
513 {
514 int i;
515 for(i = 0; i < buf_size; i++) {
516 if (*src)
517 buf[i] = *src++;
518 else
519 buf[i] = ' ';
520 }
521 }
522
523 static void put_le16(uint16_t *p, unsigned int v)
524 {
525 *p = cpu_to_le16(v);
526 }
527
528 static void ide_identify(IDEState *s)
529 {
530 uint16_t *p;
531 unsigned int oldsize;
532 char buf[20];
533
534 if (s->identify_set) {
535 memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
536 return;
537 }
538
539 memset(s->io_buffer, 0, 512);
540 p = (uint16_t *)s->io_buffer;
541 put_le16(p + 0, 0x0040);
542 put_le16(p + 1, s->cylinders);
543 put_le16(p + 3, s->heads);
544 put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
545 put_le16(p + 5, 512); /* XXX: retired, remove ? */
546 put_le16(p + 6, s->sectors);
547 snprintf(buf, sizeof(buf), "QM%05d", s->drive_serial);
548 padstr((char *)(p + 10), buf, 20); /* serial number */
549 put_le16(p + 20, 3); /* XXX: retired, remove ? */
550 put_le16(p + 21, 512); /* cache size in sectors */
551 put_le16(p + 22, 4); /* ecc bytes */
552 padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
553 padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
554 #if MAX_MULT_SECTORS > 1
555 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
556 #endif
557 put_le16(p + 48, 1); /* dword I/O */
558 put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
559 put_le16(p + 51, 0x200); /* PIO transfer cycle */
560 put_le16(p + 52, 0x200); /* DMA transfer cycle */
561 put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
562 put_le16(p + 54, s->cylinders);
563 put_le16(p + 55, s->heads);
564 put_le16(p + 56, s->sectors);
565 oldsize = s->cylinders * s->heads * s->sectors;
566 put_le16(p + 57, oldsize);
567 put_le16(p + 58, oldsize >> 16);
568 if (s->mult_sectors)
569 put_le16(p + 59, 0x100 | s->mult_sectors);
570 put_le16(p + 60, s->nb_sectors);
571 put_le16(p + 61, s->nb_sectors >> 16);
572 put_le16(p + 62, 0x07); /* single word dma0-2 supported */
573 put_le16(p + 63, 0x07); /* mdma0-2 supported */
574 put_le16(p + 65, 120);
575 put_le16(p + 66, 120);
576 put_le16(p + 67, 120);
577 put_le16(p + 68, 120);
578 put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
579 put_le16(p + 81, 0x16); /* conforms to ata5 */
580 put_le16(p + 82, (1 << 14));
581 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
582 put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
583 put_le16(p + 84, (1 << 14));
584 put_le16(p + 85, (1 << 14));
585 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
586 put_le16(p + 86, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
587 put_le16(p + 87, (1 << 14));
588 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
589 put_le16(p + 93, 1 | (1 << 14) | 0x2000);
590 put_le16(p + 100, s->nb_sectors);
591 put_le16(p + 101, s->nb_sectors >> 16);
592 put_le16(p + 102, s->nb_sectors >> 32);
593 put_le16(p + 103, s->nb_sectors >> 48);
594
595 memcpy(s->identify_data, p, sizeof(s->identify_data));
596 s->identify_set = 1;
597 }
598
599 static void ide_atapi_identify(IDEState *s)
600 {
601 uint16_t *p;
602 char buf[20];
603
604 if (s->identify_set) {
605 memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
606 return;
607 }
608
609 memset(s->io_buffer, 0, 512);
610 p = (uint16_t *)s->io_buffer;
611 /* Removable CDROM, 50us response, 12 byte packets */
612 put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
613 snprintf(buf, sizeof(buf), "QM%05d", s->drive_serial);
614 padstr((char *)(p + 10), buf, 20); /* serial number */
615 put_le16(p + 20, 3); /* buffer type */
616 put_le16(p + 21, 512); /* cache size in sectors */
617 put_le16(p + 22, 4); /* ecc bytes */
618 padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
619 padstr((char *)(p + 27), "QEMU DVD-ROM", 40); /* model */
620 put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
621 #ifdef USE_DMA_CDROM
622 put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
623 put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
624 put_le16(p + 62, 7); /* single word dma0-2 supported */
625 put_le16(p + 63, 7); /* mdma0-2 supported */
626 put_le16(p + 64, 0x3f); /* PIO modes supported */
627 #else
628 put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
629 put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
630 put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
631 put_le16(p + 64, 1); /* PIO modes */
632 #endif
633 put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
634 put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
635 put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
636 put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
637
638 put_le16(p + 71, 30); /* in ns */
639 put_le16(p + 72, 30); /* in ns */
640
641 put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
642 #ifdef USE_DMA_CDROM
643 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
644 #endif
645 memcpy(s->identify_data, p, sizeof(s->identify_data));
646 s->identify_set = 1;
647 }
648
649 static void ide_cfata_identify(IDEState *s)
650 {
651 uint16_t *p;
652 uint32_t cur_sec;
653 char buf[20];
654
655 p = (uint16_t *) s->identify_data;
656 if (s->identify_set)
657 goto fill_buffer;
658
659 memset(p, 0, sizeof(s->identify_data));
660
661 cur_sec = s->cylinders * s->heads * s->sectors;
662
663 put_le16(p + 0, 0x848a); /* CF Storage Card signature */
664 put_le16(p + 1, s->cylinders); /* Default cylinders */
665 put_le16(p + 3, s->heads); /* Default heads */
666 put_le16(p + 6, s->sectors); /* Default sectors per track */
667 put_le16(p + 7, s->nb_sectors >> 16); /* Sectors per card */
668 put_le16(p + 8, s->nb_sectors); /* Sectors per card */
669 snprintf(buf, sizeof(buf), "QM%05d", s->drive_serial);
670 padstr((char *)(p + 10), buf, 20); /* Serial number in ASCII */
671 put_le16(p + 22, 0x0004); /* ECC bytes */
672 padstr((char *) (p + 23), QEMU_VERSION, 8); /* Firmware Revision */
673 padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
674 #if MAX_MULT_SECTORS > 1
675 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
676 #else
677 put_le16(p + 47, 0x0000);
678 #endif
679 put_le16(p + 49, 0x0f00); /* Capabilities */
680 put_le16(p + 51, 0x0002); /* PIO cycle timing mode */
681 put_le16(p + 52, 0x0001); /* DMA cycle timing mode */
682 put_le16(p + 53, 0x0003); /* Translation params valid */
683 put_le16(p + 54, s->cylinders); /* Current cylinders */
684 put_le16(p + 55, s->heads); /* Current heads */
685 put_le16(p + 56, s->sectors); /* Current sectors */
686 put_le16(p + 57, cur_sec); /* Current capacity */
687 put_le16(p + 58, cur_sec >> 16); /* Current capacity */
688 if (s->mult_sectors) /* Multiple sector setting */
689 put_le16(p + 59, 0x100 | s->mult_sectors);
690 put_le16(p + 60, s->nb_sectors); /* Total LBA sectors */
691 put_le16(p + 61, s->nb_sectors >> 16); /* Total LBA sectors */
692 put_le16(p + 63, 0x0203); /* Multiword DMA capability */
693 put_le16(p + 64, 0x0001); /* Flow Control PIO support */
694 put_le16(p + 65, 0x0096); /* Min. Multiword DMA cycle */
695 put_le16(p + 66, 0x0096); /* Rec. Multiword DMA cycle */
696 put_le16(p + 68, 0x00b4); /* Min. PIO cycle time */
697 put_le16(p + 82, 0x400c); /* Command Set supported */
698 put_le16(p + 83, 0x7068); /* Command Set supported */
699 put_le16(p + 84, 0x4000); /* Features supported */
700 put_le16(p + 85, 0x000c); /* Command Set enabled */
701 put_le16(p + 86, 0x7044); /* Command Set enabled */
702 put_le16(p + 87, 0x4000); /* Features enabled */
703 put_le16(p + 91, 0x4060); /* Current APM level */
704 put_le16(p + 129, 0x0002); /* Current features option */
705 put_le16(p + 130, 0x0005); /* Reassigned sectors */
706 put_le16(p + 131, 0x0001); /* Initial power mode */
707 put_le16(p + 132, 0x0000); /* User signature */
708 put_le16(p + 160, 0x8100); /* Power requirement */
709 put_le16(p + 161, 0x8001); /* CF command set */
710
711 s->identify_set = 1;
712
713 fill_buffer:
714 memcpy(s->io_buffer, p, sizeof(s->identify_data));
715 }
716
717 static void ide_set_signature(IDEState *s)
718 {
719 s->select &= 0xf0; /* clear head */
720 /* put signature */
721 s->nsector = 1;
722 s->sector = 1;
723 if (s->is_cdrom) {
724 s->lcyl = 0x14;
725 s->hcyl = 0xeb;
726 } else if (s->bs) {
727 s->lcyl = 0;
728 s->hcyl = 0;
729 } else {
730 s->lcyl = 0xff;
731 s->hcyl = 0xff;
732 }
733 }
734
735 static inline void ide_abort_command(IDEState *s)
736 {
737 s->status = READY_STAT | ERR_STAT;
738 s->error = ABRT_ERR;
739 }
740
741 static inline void ide_set_irq(IDEState *s)
742 {
743 BMDMAState *bm = s->bmdma;
744 if (!(s->cmd & IDE_CMD_DISABLE_IRQ)) {
745 if (bm) {
746 bm->status |= BM_STATUS_INT;
747 }
748 qemu_irq_raise(s->irq);
749 }
750 }
751
752 /* prepare data transfer and tell what to do after */
753 static void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
754 EndTransferFunc *end_transfer_func)
755 {
756 s->end_transfer_func = end_transfer_func;
757 s->data_ptr = buf;
758 s->data_end = buf + size;
759 if (!(s->status & ERR_STAT))
760 s->status |= DRQ_STAT;
761 }
762
763 static void ide_transfer_stop(IDEState *s)
764 {
765 s->end_transfer_func = ide_transfer_stop;
766 s->data_ptr = s->io_buffer;
767 s->data_end = s->io_buffer;
768 s->status &= ~DRQ_STAT;
769 }
770
771 static int64_t ide_get_sector(IDEState *s)
772 {
773 int64_t sector_num;
774 if (s->select & 0x40) {
775 /* lba */
776 if (!s->lba48) {
777 sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
778 (s->lcyl << 8) | s->sector;
779 } else {
780 sector_num = ((int64_t)s->hob_hcyl << 40) |
781 ((int64_t) s->hob_lcyl << 32) |
782 ((int64_t) s->hob_sector << 24) |
783 ((int64_t) s->hcyl << 16) |
784 ((int64_t) s->lcyl << 8) | s->sector;
785 }
786 } else {
787 sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
788 (s->select & 0x0f) * s->sectors + (s->sector - 1);
789 }
790 return sector_num;
791 }
792
793 static void ide_set_sector(IDEState *s, int64_t sector_num)
794 {
795 unsigned int cyl, r;
796 if (s->select & 0x40) {
797 if (!s->lba48) {
798 s->select = (s->select & 0xf0) | (sector_num >> 24);
799 s->hcyl = (sector_num >> 16);
800 s->lcyl = (sector_num >> 8);
801 s->sector = (sector_num);
802 } else {
803 s->sector = sector_num;
804 s->lcyl = sector_num >> 8;
805 s->hcyl = sector_num >> 16;
806 s->hob_sector = sector_num >> 24;
807 s->hob_lcyl = sector_num >> 32;
808 s->hob_hcyl = sector_num >> 40;
809 }
810 } else {
811 cyl = sector_num / (s->heads * s->sectors);
812 r = sector_num % (s->heads * s->sectors);
813 s->hcyl = cyl >> 8;
814 s->lcyl = cyl;
815 s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
816 s->sector = (r % s->sectors) + 1;
817 }
818 }
819
820 static void ide_sector_read(IDEState *s)
821 {
822 int64_t sector_num;
823 int ret, n;
824
825 s->status = READY_STAT | SEEK_STAT;
826 s->error = 0; /* not needed by IDE spec, but needed by Windows */
827 sector_num = ide_get_sector(s);
828 n = s->nsector;
829 if (n == 0) {
830 /* no more sector to read from disk */
831 ide_transfer_stop(s);
832 } else {
833 #if defined(DEBUG_IDE)
834 printf("read sector=%Ld\n", sector_num);
835 #endif
836 if (n > s->req_nb_sectors)
837 n = s->req_nb_sectors;
838 ret = bdrv_read(s->bs, sector_num, s->io_buffer, n);
839 ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read);
840 ide_set_irq(s);
841 ide_set_sector(s, sector_num + n);
842 s->nsector -= n;
843 }
844 }
845
846 /* return 0 if buffer completed */
847 static int dma_buf_rw(BMDMAState *bm, int is_write)
848 {
849 IDEState *s = bm->ide_if;
850 struct {
851 uint32_t addr;
852 uint32_t size;
853 } prd;
854 int l, len;
855
856 for(;;) {
857 l = s->io_buffer_size - s->io_buffer_index;
858 if (l <= 0)
859 break;
860 if (bm->cur_prd_len == 0) {
861 /* end of table (with a fail safe of one page) */
862 if (bm->cur_prd_last ||
863 (bm->cur_addr - bm->addr) >= 4096)
864 return 0;
865 cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
866 bm->cur_addr += 8;
867 prd.addr = le32_to_cpu(prd.addr);
868 prd.size = le32_to_cpu(prd.size);
869 len = prd.size & 0xfffe;
870 if (len == 0)
871 len = 0x10000;
872 bm->cur_prd_len = len;
873 bm->cur_prd_addr = prd.addr;
874 bm->cur_prd_last = (prd.size & 0x80000000);
875 }
876 if (l > bm->cur_prd_len)
877 l = bm->cur_prd_len;
878 if (l > 0) {
879 if (is_write) {
880 cpu_physical_memory_write(bm->cur_prd_addr,
881 s->io_buffer + s->io_buffer_index, l);
882 } else {
883 cpu_physical_memory_read(bm->cur_prd_addr,
884 s->io_buffer + s->io_buffer_index, l);
885 }
886 bm->cur_prd_addr += l;
887 bm->cur_prd_len -= l;
888 s->io_buffer_index += l;
889 }
890 }
891 return 1;
892 }
893
894 /* XXX: handle errors */
895 static void ide_read_dma_cb(void *opaque, int ret)
896 {
897 BMDMAState *bm = opaque;
898 IDEState *s = bm->ide_if;
899 int n;
900 int64_t sector_num;
901
902 n = s->io_buffer_size >> 9;
903 sector_num = ide_get_sector(s);
904 if (n > 0) {
905 sector_num += n;
906 ide_set_sector(s, sector_num);
907 s->nsector -= n;
908 if (dma_buf_rw(bm, 1) == 0)
909 goto eot;
910 }
911
912 /* end of transfer ? */
913 if (s->nsector == 0) {
914 s->status = READY_STAT | SEEK_STAT;
915 ide_set_irq(s);
916 eot:
917 bm->status &= ~BM_STATUS_DMAING;
918 bm->status |= BM_STATUS_INT;
919 bm->dma_cb = NULL;
920 bm->ide_if = NULL;
921 bm->aiocb = NULL;
922 return;
923 }
924
925 /* launch next transfer */
926 n = s->nsector;
927 if (n > IDE_DMA_BUF_SECTORS)
928 n = IDE_DMA_BUF_SECTORS;
929 s->io_buffer_index = 0;
930 s->io_buffer_size = n * 512;
931 #ifdef DEBUG_AIO
932 printf("aio_read: sector_num=%lld n=%d\n", sector_num, n);
933 #endif
934 bm->aiocb = bdrv_aio_read(s->bs, sector_num, s->io_buffer, n,
935 ide_read_dma_cb, bm);
936 }
937
938 static void ide_sector_read_dma(IDEState *s)
939 {
940 s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
941 s->io_buffer_index = 0;
942 s->io_buffer_size = 0;
943 ide_dma_start(s, ide_read_dma_cb);
944 }
945
946 static void ide_sector_write_timer_cb(void *opaque)
947 {
948 IDEState *s = opaque;
949 ide_set_irq(s);
950 }
951
952 static void ide_sector_write(IDEState *s)
953 {
954 int64_t sector_num;
955 int ret, n, n1;
956
957 s->status = READY_STAT | SEEK_STAT;
958 sector_num = ide_get_sector(s);
959 #if defined(DEBUG_IDE)
960 printf("write sector=%Ld\n", sector_num);
961 #endif
962 n = s->nsector;
963 if (n > s->req_nb_sectors)
964 n = s->req_nb_sectors;
965 ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
966 s->nsector -= n;
967 if (s->nsector == 0) {
968 /* no more sectors to write */
969 ide_transfer_stop(s);
970 } else {
971 n1 = s->nsector;
972 if (n1 > s->req_nb_sectors)
973 n1 = s->req_nb_sectors;
974 ide_transfer_start(s, s->io_buffer, 512 * n1, ide_sector_write);
975 }
976 ide_set_sector(s, sector_num + n);
977
978 #ifdef TARGET_I386
979 if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
980 /* It seems there is a bug in the Windows 2000 installer HDD
981 IDE driver which fills the disk with empty logs when the
982 IDE write IRQ comes too early. This hack tries to correct
983 that at the expense of slower write performances. Use this
984 option _only_ to install Windows 2000. You must disable it
985 for normal use. */
986 qemu_mod_timer(s->sector_write_timer,
987 qemu_get_clock(vm_clock) + (ticks_per_sec / 1000));
988 } else
989 #endif
990 {
991 ide_set_irq(s);
992 }
993 }
994
995 /* XXX: handle errors */
996 static void ide_write_dma_cb(void *opaque, int ret)
997 {
998 BMDMAState *bm = opaque;
999 IDEState *s = bm->ide_if;
1000 int n;
1001 int64_t sector_num;
1002
1003 n = s->io_buffer_size >> 9;
1004 sector_num = ide_get_sector(s);
1005 if (n > 0) {
1006 sector_num += n;
1007 ide_set_sector(s, sector_num);
1008 s->nsector -= n;
1009 }
1010
1011 /* end of transfer ? */
1012 if (s->nsector == 0) {
1013 s->status = READY_STAT | SEEK_STAT;
1014 ide_set_irq(s);
1015 eot:
1016 bm->status &= ~BM_STATUS_DMAING;
1017 bm->status |= BM_STATUS_INT;
1018 bm->dma_cb = NULL;
1019 bm->ide_if = NULL;
1020 bm->aiocb = NULL;
1021 return;
1022 }
1023
1024 /* launch next transfer */
1025 n = s->nsector;
1026 if (n > IDE_DMA_BUF_SECTORS)
1027 n = IDE_DMA_BUF_SECTORS;
1028 s->io_buffer_index = 0;
1029 s->io_buffer_size = n * 512;
1030
1031 if (dma_buf_rw(bm, 0) == 0)
1032 goto eot;
1033 #ifdef DEBUG_AIO
1034 printf("aio_write: sector_num=%lld n=%d\n", sector_num, n);
1035 #endif
1036 bm->aiocb = bdrv_aio_write(s->bs, sector_num, s->io_buffer, n,
1037 ide_write_dma_cb, bm);
1038 }
1039
1040 static void ide_sector_write_dma(IDEState *s)
1041 {
1042 s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
1043 s->io_buffer_index = 0;
1044 s->io_buffer_size = 0;
1045 ide_dma_start(s, ide_write_dma_cb);
1046 }
1047
1048 static void ide_atapi_cmd_ok(IDEState *s)
1049 {
1050 s->error = 0;
1051 s->status = READY_STAT | SEEK_STAT;
1052 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1053 ide_set_irq(s);
1054 }
1055
1056 static void ide_atapi_cmd_error(IDEState *s, int sense_key, int asc)
1057 {
1058 #ifdef DEBUG_IDE_ATAPI
1059 printf("atapi_cmd_error: sense=0x%x asc=0x%x\n", sense_key, asc);
1060 #endif
1061 s->error = sense_key << 4;
1062 s->status = READY_STAT | ERR_STAT;
1063 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1064 s->sense_key = sense_key;
1065 s->asc = asc;
1066 ide_set_irq(s);
1067 }
1068
1069 static inline void cpu_to_ube16(uint8_t *buf, int val)
1070 {
1071 buf[0] = val >> 8;
1072 buf[1] = val;
1073 }
1074
1075 static inline void cpu_to_ube32(uint8_t *buf, unsigned int val)
1076 {
1077 buf[0] = val >> 24;
1078 buf[1] = val >> 16;
1079 buf[2] = val >> 8;
1080 buf[3] = val;
1081 }
1082
1083 static inline int ube16_to_cpu(const uint8_t *buf)
1084 {
1085 return (buf[0] << 8) | buf[1];
1086 }
1087
1088 static inline int ube32_to_cpu(const uint8_t *buf)
1089 {
1090 return (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
1091 }
1092
1093 static void lba_to_msf(uint8_t *buf, int lba)
1094 {
1095 lba += 150;
1096 buf[0] = (lba / 75) / 60;
1097 buf[1] = (lba / 75) % 60;
1098 buf[2] = lba % 75;
1099 }
1100
1101 static void cd_data_to_raw(uint8_t *buf, int lba)
1102 {
1103 /* sync bytes */
1104 buf[0] = 0x00;
1105 memset(buf + 1, 0xff, 10);
1106 buf[11] = 0x00;
1107 buf += 12;
1108 /* MSF */
1109 lba_to_msf(buf, lba);
1110 buf[3] = 0x01; /* mode 1 data */
1111 buf += 4;
1112 /* data */
1113 buf += 2048;
1114 /* XXX: ECC not computed */
1115 memset(buf, 0, 288);
1116 }
1117
1118 static int cd_read_sector(BlockDriverState *bs, int lba, uint8_t *buf,
1119 int sector_size)
1120 {
1121 int ret;
1122
1123 switch(sector_size) {
1124 case 2048:
1125 ret = bdrv_read(bs, (int64_t)lba << 2, buf, 4);
1126 break;
1127 case 2352:
1128 ret = bdrv_read(bs, (int64_t)lba << 2, buf + 16, 4);
1129 if (ret < 0)
1130 return ret;
1131 cd_data_to_raw(buf, lba);
1132 break;
1133 default:
1134 ret = -EIO;
1135 break;
1136 }
1137 return ret;
1138 }
1139
1140 static void ide_atapi_io_error(IDEState *s, int ret)
1141 {
1142 /* XXX: handle more errors */
1143 if (ret == -ENOMEDIUM) {
1144 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1145 ASC_MEDIUM_NOT_PRESENT);
1146 } else {
1147 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1148 ASC_LOGICAL_BLOCK_OOR);
1149 }
1150 }
1151
1152 /* The whole ATAPI transfer logic is handled in this function */
1153 static void ide_atapi_cmd_reply_end(IDEState *s)
1154 {
1155 int byte_count_limit, size, ret;
1156 #ifdef DEBUG_IDE_ATAPI
1157 printf("reply: tx_size=%d elem_tx_size=%d index=%d\n",
1158 s->packet_transfer_size,
1159 s->elementary_transfer_size,
1160 s->io_buffer_index);
1161 #endif
1162 if (s->packet_transfer_size <= 0) {
1163 /* end of transfer */
1164 ide_transfer_stop(s);
1165 s->status = READY_STAT | SEEK_STAT;
1166 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1167 ide_set_irq(s);
1168 #ifdef DEBUG_IDE_ATAPI
1169 printf("status=0x%x\n", s->status);
1170 #endif
1171 } else {
1172 /* see if a new sector must be read */
1173 if (s->lba != -1 && s->io_buffer_index >= s->cd_sector_size) {
1174 ret = cd_read_sector(s->bs, s->lba, s->io_buffer, s->cd_sector_size);
1175 if (ret < 0) {
1176 ide_transfer_stop(s);
1177 ide_atapi_io_error(s, ret);
1178 return;
1179 }
1180 s->lba++;
1181 s->io_buffer_index = 0;
1182 }
1183 if (s->elementary_transfer_size > 0) {
1184 /* there are some data left to transmit in this elementary
1185 transfer */
1186 size = s->cd_sector_size - s->io_buffer_index;
1187 if (size > s->elementary_transfer_size)
1188 size = s->elementary_transfer_size;
1189 ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
1190 size, ide_atapi_cmd_reply_end);
1191 s->packet_transfer_size -= size;
1192 s->elementary_transfer_size -= size;
1193 s->io_buffer_index += size;
1194 } else {
1195 /* a new transfer is needed */
1196 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO;
1197 byte_count_limit = s->lcyl | (s->hcyl << 8);
1198 #ifdef DEBUG_IDE_ATAPI
1199 printf("byte_count_limit=%d\n", byte_count_limit);
1200 #endif
1201 if (byte_count_limit == 0xffff)
1202 byte_count_limit--;
1203 size = s->packet_transfer_size;
1204 if (size > byte_count_limit) {
1205 /* byte count limit must be even if this case */
1206 if (byte_count_limit & 1)
1207 byte_count_limit--;
1208 size = byte_count_limit;
1209 }
1210 s->lcyl = size;
1211 s->hcyl = size >> 8;
1212 s->elementary_transfer_size = size;
1213 /* we cannot transmit more than one sector at a time */
1214 if (s->lba != -1) {
1215 if (size > (s->cd_sector_size - s->io_buffer_index))
1216 size = (s->cd_sector_size - s->io_buffer_index);
1217 }
1218 ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
1219 size, ide_atapi_cmd_reply_end);
1220 s->packet_transfer_size -= size;
1221 s->elementary_transfer_size -= size;
1222 s->io_buffer_index += size;
1223 ide_set_irq(s);
1224 #ifdef DEBUG_IDE_ATAPI
1225 printf("status=0x%x\n", s->status);
1226 #endif
1227 }
1228 }
1229 }
1230
1231 /* send a reply of 'size' bytes in s->io_buffer to an ATAPI command */
1232 static void ide_atapi_cmd_reply(IDEState *s, int size, int max_size)
1233 {
1234 if (size > max_size)
1235 size = max_size;
1236 s->lba = -1; /* no sector read */
1237 s->packet_transfer_size = size;
1238 s->io_buffer_size = size; /* dma: send the reply data as one chunk */
1239 s->elementary_transfer_size = 0;
1240 s->io_buffer_index = 0;
1241
1242 if (s->atapi_dma) {
1243 s->status = READY_STAT | SEEK_STAT | DRQ_STAT;
1244 ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
1245 } else {
1246 s->status = READY_STAT | SEEK_STAT;
1247 ide_atapi_cmd_reply_end(s);
1248 }
1249 }
1250
1251 /* start a CD-CDROM read command */
1252 static void ide_atapi_cmd_read_pio(IDEState *s, int lba, int nb_sectors,
1253 int sector_size)
1254 {
1255 s->lba = lba;
1256 s->packet_transfer_size = nb_sectors * sector_size;
1257 s->elementary_transfer_size = 0;
1258 s->io_buffer_index = sector_size;
1259 s->cd_sector_size = sector_size;
1260
1261 s->status = READY_STAT | SEEK_STAT;
1262 ide_atapi_cmd_reply_end(s);
1263 }
1264
1265 /* ATAPI DMA support */
1266
1267 /* XXX: handle read errors */
1268 static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
1269 {
1270 BMDMAState *bm = opaque;
1271 IDEState *s = bm->ide_if;
1272 int data_offset, n;
1273
1274 if (ret < 0) {
1275 ide_atapi_io_error(s, ret);
1276 goto eot;
1277 }
1278
1279 if (s->io_buffer_size > 0) {
1280 /*
1281 * For a cdrom read sector command (s->lba != -1),
1282 * adjust the lba for the next s->io_buffer_size chunk
1283 * and dma the current chunk.
1284 * For a command != read (s->lba == -1), just transfer
1285 * the reply data.
1286 */
1287 if (s->lba != -1) {
1288 if (s->cd_sector_size == 2352) {
1289 n = 1;
1290 cd_data_to_raw(s->io_buffer, s->lba);
1291 } else {
1292 n = s->io_buffer_size >> 11;
1293 }
1294 s->lba += n;
1295 }
1296 s->packet_transfer_size -= s->io_buffer_size;
1297 if (dma_buf_rw(bm, 1) == 0)
1298 goto eot;
1299 }
1300
1301 if (s->packet_transfer_size <= 0) {
1302 s->status = READY_STAT | SEEK_STAT;
1303 s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
1304 ide_set_irq(s);
1305 eot:
1306 bm->status &= ~BM_STATUS_DMAING;
1307 bm->status |= BM_STATUS_INT;
1308 bm->dma_cb = NULL;
1309 bm->ide_if = NULL;
1310 bm->aiocb = NULL;
1311 return;
1312 }
1313
1314 s->io_buffer_index = 0;
1315 if (s->cd_sector_size == 2352) {
1316 n = 1;
1317 s->io_buffer_size = s->cd_sector_size;
1318 data_offset = 16;
1319 } else {
1320 n = s->packet_transfer_size >> 11;
1321 if (n > (IDE_DMA_BUF_SECTORS / 4))
1322 n = (IDE_DMA_BUF_SECTORS / 4);
1323 s->io_buffer_size = n * 2048;
1324 data_offset = 0;
1325 }
1326 #ifdef DEBUG_AIO
1327 printf("aio_read_cd: lba=%u n=%d\n", s->lba, n);
1328 #endif
1329 bm->aiocb = bdrv_aio_read(s->bs, (int64_t)s->lba << 2,
1330 s->io_buffer + data_offset, n * 4,
1331 ide_atapi_cmd_read_dma_cb, bm);
1332 if (!bm->aiocb) {
1333 /* Note: media not present is the most likely case */
1334 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1335 ASC_MEDIUM_NOT_PRESENT);
1336 goto eot;
1337 }
1338 }
1339
1340 /* start a CD-CDROM read command with DMA */
1341 /* XXX: test if DMA is available */
1342 static void ide_atapi_cmd_read_dma(IDEState *s, int lba, int nb_sectors,
1343 int sector_size)
1344 {
1345 s->lba = lba;
1346 s->packet_transfer_size = nb_sectors * sector_size;
1347 s->io_buffer_index = 0;
1348 s->io_buffer_size = 0;
1349 s->cd_sector_size = sector_size;
1350
1351 /* XXX: check if BUSY_STAT should be set */
1352 s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
1353 ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
1354 }
1355
1356 static void ide_atapi_cmd_read(IDEState *s, int lba, int nb_sectors,
1357 int sector_size)
1358 {
1359 #ifdef DEBUG_IDE_ATAPI
1360 printf("read %s: LBA=%d nb_sectors=%d\n", s->atapi_dma ? "dma" : "pio",
1361 lba, nb_sectors);
1362 #endif
1363 if (s->atapi_dma) {
1364 ide_atapi_cmd_read_dma(s, lba, nb_sectors, sector_size);
1365 } else {
1366 ide_atapi_cmd_read_pio(s, lba, nb_sectors, sector_size);
1367 }
1368 }
1369
1370 static inline uint8_t ide_atapi_set_profile(uint8_t *buf, uint8_t *index,
1371 uint16_t profile)
1372 {
1373 uint8_t *buf_profile = buf + 12; /* start of profiles */
1374
1375 buf_profile += ((*index) * 4); /* start of indexed profile */
1376 cpu_to_ube16 (buf_profile, profile);
1377 buf_profile[2] = ((buf_profile[0] == buf[6]) && (buf_profile[1] == buf[7]));
1378
1379 /* each profile adds 4 bytes to the response */
1380 (*index)++;
1381 buf[11] += 4; /* Additional Length */
1382
1383 return 4;
1384 }
1385
1386 static int ide_dvd_read_structure(IDEState *s, int format,
1387 const uint8_t *packet, uint8_t *buf)
1388 {
1389 switch (format) {
1390 case 0x0: /* Physical format information */
1391 {
1392 int layer = packet[6];
1393 uint64_t total_sectors;
1394
1395 if (layer != 0)
1396 return -ASC_INV_FIELD_IN_CMD_PACKET;
1397
1398 bdrv_get_geometry(s->bs, &total_sectors);
1399 total_sectors >>= 2;
1400 if (total_sectors == 0)
1401 return -ASC_MEDIUM_NOT_PRESENT;
1402
1403 buf[4] = 1; /* DVD-ROM, part version 1 */
1404 buf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
1405 buf[6] = 1; /* one layer, read-only (per MMC-2 spec) */
1406 buf[7] = 0; /* default densities */
1407
1408 /* FIXME: 0x30000 per spec? */
1409 cpu_to_ube32(buf + 8, 0); /* start sector */
1410 cpu_to_ube32(buf + 12, total_sectors - 1); /* end sector */
1411 cpu_to_ube32(buf + 16, total_sectors - 1); /* l0 end sector */
1412
1413 /* Size of buffer, not including 2 byte size field */
1414 cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1415
1416 /* 2k data + 4 byte header */
1417 return (2048 + 4);
1418 }
1419
1420 case 0x01: /* DVD copyright information */
1421 buf[4] = 0; /* no copyright data */
1422 buf[5] = 0; /* no region restrictions */
1423
1424 /* Size of buffer, not including 2 byte size field */
1425 cpu_to_be16wu((uint16_t *)buf, 4 + 2);
1426
1427 /* 4 byte header + 4 byte data */
1428 return (4 + 4);
1429
1430 case 0x03: /* BCA information - invalid field for no BCA info */
1431 return -ASC_INV_FIELD_IN_CMD_PACKET;
1432
1433 case 0x04: /* DVD disc manufacturing information */
1434 /* Size of buffer, not including 2 byte size field */
1435 cpu_to_be16wu((uint16_t *)buf, 2048 + 2);
1436
1437 /* 2k data + 4 byte header */
1438 return (2048 + 4);
1439
1440 case 0xff:
1441 /*
1442 * This lists all the command capabilities above. Add new ones
1443 * in order and update the length and buffer return values.
1444 */
1445
1446 buf[4] = 0x00; /* Physical format */
1447 buf[5] = 0x40; /* Not writable, is readable */
1448 cpu_to_be16wu((uint16_t *)(buf + 6), 2048 + 4);
1449
1450 buf[8] = 0x01; /* Copyright info */
1451 buf[9] = 0x40; /* Not writable, is readable */
1452 cpu_to_be16wu((uint16_t *)(buf + 10), 4 + 4);
1453
1454 buf[12] = 0x03; /* BCA info */
1455 buf[13] = 0x40; /* Not writable, is readable */
1456 cpu_to_be16wu((uint16_t *)(buf + 14), 188 + 4);
1457
1458 buf[16] = 0x04; /* Manufacturing info */
1459 buf[17] = 0x40; /* Not writable, is readable */
1460 cpu_to_be16wu((uint16_t *)(buf + 18), 2048 + 4);
1461
1462 /* Size of buffer, not including 2 byte size field */
1463 cpu_to_be16wu((uint16_t *)buf, 16 + 2);
1464
1465 /* data written + 4 byte header */
1466 return (16 + 4);
1467
1468 default: /* TODO: formats beyond DVD-ROM requires */
1469 return -ASC_INV_FIELD_IN_CMD_PACKET;
1470 }
1471 }
1472
1473 static void ide_atapi_cmd(IDEState *s)
1474 {
1475 const uint8_t *packet;
1476 uint8_t *buf;
1477 int max_len;
1478
1479 packet = s->io_buffer;
1480 buf = s->io_buffer;
1481 #ifdef DEBUG_IDE_ATAPI
1482 {
1483 int i;
1484 printf("ATAPI limit=0x%x packet:", s->lcyl | (s->hcyl << 8));
1485 for(i = 0; i < ATAPI_PACKET_SIZE; i++) {
1486 printf(" %02x", packet[i]);
1487 }
1488 printf("\n");
1489 }
1490 #endif
1491 switch(s->io_buffer[0]) {
1492 case GPCMD_TEST_UNIT_READY:
1493 if (bdrv_is_inserted(s->bs)) {
1494 ide_atapi_cmd_ok(s);
1495 } else {
1496 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1497 ASC_MEDIUM_NOT_PRESENT);
1498 }
1499 break;
1500 case GPCMD_MODE_SENSE_6:
1501 case GPCMD_MODE_SENSE_10:
1502 {
1503 int action, code;
1504 if (packet[0] == GPCMD_MODE_SENSE_10)
1505 max_len = ube16_to_cpu(packet + 7);
1506 else
1507 max_len = packet[4];
1508 action = packet[2] >> 6;
1509 code = packet[2] & 0x3f;
1510 switch(action) {
1511 case 0: /* current values */
1512 switch(code) {
1513 case 0x01: /* error recovery */
1514 cpu_to_ube16(&buf[0], 16 + 6);
1515 buf[2] = 0x70;
1516 buf[3] = 0;
1517 buf[4] = 0;
1518 buf[5] = 0;
1519 buf[6] = 0;
1520 buf[7] = 0;
1521
1522 buf[8] = 0x01;
1523 buf[9] = 0x06;
1524 buf[10] = 0x00;
1525 buf[11] = 0x05;
1526 buf[12] = 0x00;
1527 buf[13] = 0x00;
1528 buf[14] = 0x00;
1529 buf[15] = 0x00;
1530 ide_atapi_cmd_reply(s, 16, max_len);
1531 break;
1532 case 0x2a:
1533 cpu_to_ube16(&buf[0], 28 + 6);
1534 buf[2] = 0x70;
1535 buf[3] = 0;
1536 buf[4] = 0;
1537 buf[5] = 0;
1538 buf[6] = 0;
1539 buf[7] = 0;
1540
1541 buf[8] = 0x2a;
1542 buf[9] = 0x12;
1543 buf[10] = 0x00;
1544 buf[11] = 0x00;
1545
1546 buf[12] = 0x70;
1547 buf[13] = 3 << 5;
1548 buf[14] = (1 << 0) | (1 << 3) | (1 << 5);
1549 if (bdrv_is_locked(s->bs))
1550 buf[6] |= 1 << 1;
1551 buf[15] = 0x00;
1552 cpu_to_ube16(&buf[16], 706);
1553 buf[18] = 0;
1554 buf[19] = 2;
1555 cpu_to_ube16(&buf[20], 512);
1556 cpu_to_ube16(&buf[22], 706);
1557 buf[24] = 0;
1558 buf[25] = 0;
1559 buf[26] = 0;
1560 buf[27] = 0;
1561 ide_atapi_cmd_reply(s, 28, max_len);
1562 break;
1563 default:
1564 goto error_cmd;
1565 }
1566 break;
1567 case 1: /* changeable values */
1568 goto error_cmd;
1569 case 2: /* default values */
1570 goto error_cmd;
1571 default:
1572 case 3: /* saved values */
1573 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1574 ASC_SAVING_PARAMETERS_NOT_SUPPORTED);
1575 break;
1576 }
1577 }
1578 break;
1579 case GPCMD_REQUEST_SENSE:
1580 max_len = packet[4];
1581 memset(buf, 0, 18);
1582 buf[0] = 0x70 | (1 << 7);
1583 buf[2] = s->sense_key;
1584 buf[7] = 10;
1585 buf[12] = s->asc;
1586 ide_atapi_cmd_reply(s, 18, max_len);
1587 break;
1588 case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
1589 if (bdrv_is_inserted(s->bs)) {
1590 bdrv_set_locked(s->bs, packet[4] & 1);
1591 ide_atapi_cmd_ok(s);
1592 } else {
1593 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1594 ASC_MEDIUM_NOT_PRESENT);
1595 }
1596 break;
1597 case GPCMD_READ_10:
1598 case GPCMD_READ_12:
1599 {
1600 int nb_sectors, lba;
1601
1602 if (packet[0] == GPCMD_READ_10)
1603 nb_sectors = ube16_to_cpu(packet + 7);
1604 else
1605 nb_sectors = ube32_to_cpu(packet + 6);
1606 lba = ube32_to_cpu(packet + 2);
1607 if (nb_sectors == 0) {
1608 ide_atapi_cmd_ok(s);
1609 break;
1610 }
1611 ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1612 }
1613 break;
1614 case GPCMD_READ_CD:
1615 {
1616 int nb_sectors, lba, transfer_request;
1617
1618 nb_sectors = (packet[6] << 16) | (packet[7] << 8) | packet[8];
1619 lba = ube32_to_cpu(packet + 2);
1620 if (nb_sectors == 0) {
1621 ide_atapi_cmd_ok(s);
1622 break;
1623 }
1624 transfer_request = packet[9];
1625 switch(transfer_request & 0xf8) {
1626 case 0x00:
1627 /* nothing */
1628 ide_atapi_cmd_ok(s);
1629 break;
1630 case 0x10:
1631 /* normal read */
1632 ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
1633 break;
1634 case 0xf8:
1635 /* read all data */
1636 ide_atapi_cmd_read(s, lba, nb_sectors, 2352);
1637 break;
1638 default:
1639 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1640 ASC_INV_FIELD_IN_CMD_PACKET);
1641 break;
1642 }
1643 }
1644 break;
1645 case GPCMD_SEEK:
1646 {
1647 unsigned int lba;
1648 uint64_t total_sectors;
1649
1650 bdrv_get_geometry(s->bs, &total_sectors);
1651 total_sectors >>= 2;
1652 if (total_sectors == 0) {
1653 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1654 ASC_MEDIUM_NOT_PRESENT);
1655 break;
1656 }
1657 lba = ube32_to_cpu(packet + 2);
1658 if (lba >= total_sectors) {
1659 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1660 ASC_LOGICAL_BLOCK_OOR);
1661 break;
1662 }
1663 ide_atapi_cmd_ok(s);
1664 }
1665 break;
1666 case GPCMD_START_STOP_UNIT:
1667 {
1668 int start, eject;
1669 start = packet[4] & 1;
1670 eject = (packet[4] >> 1) & 1;
1671
1672 if (eject && !start) {
1673 /* eject the disk */
1674 bdrv_eject(s->bs, 1);
1675 } else if (eject && start) {
1676 /* close the tray */
1677 bdrv_eject(s->bs, 0);
1678 }
1679 ide_atapi_cmd_ok(s);
1680 }
1681 break;
1682 case GPCMD_MECHANISM_STATUS:
1683 {
1684 max_len = ube16_to_cpu(packet + 8);
1685 cpu_to_ube16(buf, 0);
1686 /* no current LBA */
1687 buf[2] = 0;
1688 buf[3] = 0;
1689 buf[4] = 0;
1690 buf[5] = 1;
1691 cpu_to_ube16(buf + 6, 0);
1692 ide_atapi_cmd_reply(s, 8, max_len);
1693 }
1694 break;
1695 case GPCMD_READ_TOC_PMA_ATIP:
1696 {
1697 int format, msf, start_track, len;
1698 uint64_t total_sectors;
1699
1700 bdrv_get_geometry(s->bs, &total_sectors);
1701 total_sectors >>= 2;
1702 if (total_sectors == 0) {
1703 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1704 ASC_MEDIUM_NOT_PRESENT);
1705 break;
1706 }
1707 max_len = ube16_to_cpu(packet + 7);
1708 format = packet[9] >> 6;
1709 msf = (packet[1] >> 1) & 1;
1710 start_track = packet[6];
1711 switch(format) {
1712 case 0:
1713 len = cdrom_read_toc(total_sectors, buf, msf, start_track);
1714 if (len < 0)
1715 goto error_cmd;
1716 ide_atapi_cmd_reply(s, len, max_len);
1717 break;
1718 case 1:
1719 /* multi session : only a single session defined */
1720 memset(buf, 0, 12);
1721 buf[1] = 0x0a;
1722 buf[2] = 0x01;
1723 buf[3] = 0x01;
1724 ide_atapi_cmd_reply(s, 12, max_len);
1725 break;
1726 case 2:
1727 len = cdrom_read_toc_raw(total_sectors, buf, msf, start_track);
1728 if (len < 0)
1729 goto error_cmd;
1730 ide_atapi_cmd_reply(s, len, max_len);
1731 break;
1732 default:
1733 error_cmd:
1734 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1735 ASC_INV_FIELD_IN_CMD_PACKET);
1736 break;
1737 }
1738 }
1739 break;
1740 case GPCMD_READ_CDVD_CAPACITY:
1741 {
1742 uint64_t total_sectors;
1743
1744 bdrv_get_geometry(s->bs, &total_sectors);
1745 total_sectors >>= 2;
1746 if (total_sectors == 0) {
1747 ide_atapi_cmd_error(s, SENSE_NOT_READY,
1748 ASC_MEDIUM_NOT_PRESENT);
1749 break;
1750 }
1751 /* NOTE: it is really the number of sectors minus 1 */
1752 cpu_to_ube32(buf, total_sectors - 1);
1753 cpu_to_ube32(buf + 4, 2048);
1754 ide_atapi_cmd_reply(s, 8, 8);
1755 }
1756 break;
1757 case GPCMD_READ_DVD_STRUCTURE:
1758 {
1759 int media = packet[1];
1760 int format = packet[7];
1761 int ret;
1762
1763 max_len = ube16_to_cpu(packet + 8);
1764
1765 if (format < 0xff) {
1766 if (media_is_cd(s)) {
1767 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1768 ASC_INCOMPATIBLE_FORMAT);
1769 break;
1770 } else if (!media_present(s)) {
1771 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1772 ASC_INV_FIELD_IN_CMD_PACKET);
1773 break;
1774 }
1775 }
1776
1777 memset(buf, 0, max_len > IDE_DMA_BUF_SECTORS * 512 + 4 ?
1778 IDE_DMA_BUF_SECTORS * 512 + 4 : max_len);
1779
1780 switch (format) {
1781 case 0x00 ... 0x7f:
1782 case 0xff:
1783 if (media == 0) {
1784 ret = ide_dvd_read_structure(s, format, packet, buf);
1785
1786 if (ret < 0)
1787 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST, -ret);
1788 else
1789 ide_atapi_cmd_reply(s, ret, max_len);
1790
1791 break;
1792 }
1793 /* TODO: BD support, fall through for now */
1794
1795 /* Generic disk structures */
1796 case 0x80: /* TODO: AACS volume identifier */
1797 case 0x81: /* TODO: AACS media serial number */
1798 case 0x82: /* TODO: AACS media identifier */
1799 case 0x83: /* TODO: AACS media key block */
1800 case 0x90: /* TODO: List of recognized format layers */
1801 case 0xc0: /* TODO: Write protection status */
1802 default:
1803 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1804 ASC_INV_FIELD_IN_CMD_PACKET);
1805 break;
1806 }
1807 }
1808 break;
1809 case GPCMD_SET_SPEED:
1810 ide_atapi_cmd_ok(s);
1811 break;
1812 case GPCMD_INQUIRY:
1813 max_len = packet[4];
1814 buf[0] = 0x05; /* CD-ROM */
1815 buf[1] = 0x80; /* removable */
1816 buf[2] = 0x00; /* ISO */
1817 buf[3] = 0x21; /* ATAPI-2 (XXX: put ATAPI-4 ?) */
1818 buf[4] = 31; /* additional length */
1819 buf[5] = 0; /* reserved */
1820 buf[6] = 0; /* reserved */
1821 buf[7] = 0; /* reserved */
1822 padstr8(buf + 8, 8, "QEMU");
1823 padstr8(buf + 16, 16, "QEMU DVD-ROM");
1824 padstr8(buf + 32, 4, QEMU_VERSION);
1825 ide_atapi_cmd_reply(s, 36, max_len);
1826 break;
1827 case GPCMD_GET_CONFIGURATION:
1828 {
1829 uint32_t len;
1830 uint8_t index = 0;
1831
1832 /* only feature 0 is supported */
1833 if (packet[2] != 0 || packet[3] != 0) {
1834 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1835 ASC_INV_FIELD_IN_CMD_PACKET);
1836 break;
1837 }
1838
1839 /* XXX: could result in alignment problems in some architectures */
1840 max_len = ube16_to_cpu(packet + 7);
1841
1842 /*
1843 * XXX: avoid overflow for io_buffer if max_len is bigger than
1844 * the size of that buffer (dimensioned to max number of
1845 * sectors to transfer at once)
1846 *
1847 * Only a problem if the feature/profiles grow.
1848 */
1849 if (max_len > 512) /* XXX: assume 1 sector */
1850 max_len = 512;
1851
1852 memset(buf, 0, max_len);
1853 /*
1854 * the number of sectors from the media tells us which profile
1855 * to use as current. 0 means there is no media
1856 */
1857 if (media_is_dvd(s))
1858 cpu_to_ube16(buf + 6, MMC_PROFILE_DVD_ROM);
1859 else if (media_is_cd(s))
1860 cpu_to_ube16(buf + 6, MMC_PROFILE_CD_ROM);
1861
1862 buf[10] = 0x02 | 0x01; /* persistent and current */
1863 len = 12; /* headers: 8 + 4 */
1864 len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_DVD_ROM);
1865 len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_CD_ROM);
1866 cpu_to_ube32(buf, len - 4); /* data length */
1867
1868 ide_atapi_cmd_reply(s, len, max_len);
1869 break;
1870 }
1871 default:
1872 ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1873 ASC_ILLEGAL_OPCODE);
1874 break;
1875 }
1876 }
1877
1878 static void ide_cfata_metadata_inquiry(IDEState *s)
1879 {
1880 uint16_t *p;
1881 uint32_t spd;
1882
1883 p = (uint16_t *) s->io_buffer;
1884 memset(p, 0, 0x200);
1885 spd = ((s->mdata_size - 1) >> 9) + 1;
1886
1887 put_le16(p + 0, 0x0001); /* Data format revision */
1888 put_le16(p + 1, 0x0000); /* Media property: silicon */
1889 put_le16(p + 2, s->media_changed); /* Media status */
1890 put_le16(p + 3, s->mdata_size & 0xffff); /* Capacity in bytes (low) */
1891 put_le16(p + 4, s->mdata_size >> 16); /* Capacity in bytes (high) */
1892 put_le16(p + 5, spd & 0xffff); /* Sectors per device (low) */
1893 put_le16(p + 6, spd >> 16); /* Sectors per device (high) */
1894 }
1895
1896 static void ide_cfata_metadata_read(IDEState *s)
1897 {
1898 uint16_t *p;
1899
1900 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1901 s->status = ERR_STAT;
1902 s->error = ABRT_ERR;
1903 return;
1904 }
1905
1906 p = (uint16_t *) s->io_buffer;
1907 memset(p, 0, 0x200);
1908
1909 put_le16(p + 0, s->media_changed); /* Media status */
1910 memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1911 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1912 s->nsector << 9), 0x200 - 2));
1913 }
1914
1915 static void ide_cfata_metadata_write(IDEState *s)
1916 {
1917 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1918 s->status = ERR_STAT;
1919 s->error = ABRT_ERR;
1920 return;
1921 }
1922
1923 s->media_changed = 0;
1924
1925 memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1926 s->io_buffer + 2,
1927 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1928 s->nsector << 9), 0x200 - 2));
1929 }
1930
1931 /* called when the inserted state of the media has changed */
1932 static void cdrom_change_cb(void *opaque)
1933 {
1934 IDEState *s = opaque;
1935 uint64_t nb_sectors;
1936
1937 /* XXX: send interrupt too */
1938 bdrv_get_geometry(s->bs, &nb_sectors);
1939 s->nb_sectors = nb_sectors;
1940 }
1941
1942 static void ide_cmd_lba48_transform(IDEState *s, int lba48)
1943 {
1944 s->lba48 = lba48;
1945
1946 /* handle the 'magic' 0 nsector count conversion here. to avoid
1947 * fiddling with the rest of the read logic, we just store the
1948 * full sector count in ->nsector and ignore ->hob_nsector from now
1949 */
1950 if (!s->lba48) {
1951 if (!s->nsector)
1952 s->nsector = 256;
1953 } else {
1954 if (!s->nsector && !s->hob_nsector)
1955 s->nsector = 65536;
1956 else {
1957 int lo = s->nsector;
1958 int hi = s->hob_nsector;
1959
1960 s->nsector = (hi << 8) | lo;
1961 }
1962 }
1963 }
1964
1965 static void ide_clear_hob(IDEState *ide_if)
1966 {
1967 /* any write clears HOB high bit of device control register */
1968 ide_if[0].select &= ~(1 << 7);
1969 ide_if[1].select &= ~(1 << 7);
1970 }
1971
1972 static void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1973 {
1974 IDEState *ide_if = opaque;
1975 IDEState *s;
1976 int unit, n;
1977 int lba48 = 0;
1978
1979 #ifdef DEBUG_IDE
1980 printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
1981 #endif
1982
1983 addr &= 7;
1984 switch(addr) {
1985 case 0:
1986 break;
1987 case 1:
1988 ide_clear_hob(ide_if);
1989 /* NOTE: data is written to the two drives */
1990 ide_if[0].hob_feature = ide_if[0].feature;
1991 ide_if[1].hob_feature = ide_if[1].feature;
1992 ide_if[0].feature = val;
1993 ide_if[1].feature = val;
1994 break;
1995 case 2:
1996 ide_clear_hob(ide_if);
1997 ide_if[0].hob_nsector = ide_if[0].nsector;
1998 ide_if[1].hob_nsector = ide_if[1].nsector;
1999 ide_if[0].nsector = val;
2000 ide_if[1].nsector = val;
2001 break;
2002 case 3:
2003 ide_clear_hob(ide_if);
2004 ide_if[0].hob_sector = ide_if[0].sector;
2005 ide_if[1].hob_sector = ide_if[1].sector;
2006 ide_if[0].sector = val;
2007 ide_if[1].sector = val;
2008 break;
2009 case 4:
2010 ide_clear_hob(ide_if);
2011 ide_if[0].hob_lcyl = ide_if[0].lcyl;
2012 ide_if[1].hob_lcyl = ide_if[1].lcyl;
2013 ide_if[0].lcyl = val;
2014 ide_if[1].lcyl = val;
2015 break;
2016 case 5:
2017 ide_clear_hob(ide_if);
2018 ide_if[0].hob_hcyl = ide_if[0].hcyl;
2019 ide_if[1].hob_hcyl = ide_if[1].hcyl;
2020 ide_if[0].hcyl = val;
2021 ide_if[1].hcyl = val;
2022 break;
2023 case 6:
2024 /* FIXME: HOB readback uses bit 7 */
2025 ide_if[0].select = (val & ~0x10) | 0xa0;
2026 ide_if[1].select = (val | 0x10) | 0xa0;
2027 /* select drive */
2028 unit = (val >> 4) & 1;
2029 s = ide_if + unit;
2030 ide_if->cur_drive = s;
2031 break;
2032 default:
2033 case 7:
2034 /* command */
2035 #if defined(DEBUG_IDE)
2036 printf("ide: CMD=%02x\n", val);
2037 #endif
2038 s = ide_if->cur_drive;
2039 /* ignore commands to non existant slave */
2040 if (s != ide_if && !s->bs)
2041 break;
2042
2043 switch(val) {
2044 case WIN_IDENTIFY:
2045 if (s->bs && !s->is_cdrom) {
2046 if (!s->is_cf)
2047 ide_identify(s);
2048 else
2049 ide_cfata_identify(s);
2050 s->status = READY_STAT | SEEK_STAT;
2051 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
2052 } else {
2053 if (s->is_cdrom) {
2054 ide_set_signature(s);
2055 }
2056 ide_abort_command(s);
2057 }
2058 ide_set_irq(s);
2059 break;
2060 case WIN_SPECIFY:
2061 case WIN_RECAL:
2062 s->error = 0;
2063 s->status = READY_STAT | SEEK_STAT;
2064 ide_set_irq(s);
2065 break;
2066 case WIN_SETMULT:
2067 if (s->is_cf && s->nsector == 0) {
2068 /* Disable Read and Write Multiple */
2069 s->mult_sectors = 0;
2070 s->status = READY_STAT | SEEK_STAT;
2071 } else if ((s->nsector & 0xff) != 0 &&
2072 ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
2073 (s->nsector & (s->nsector - 1)) != 0)) {
2074 ide_abort_command(s);
2075 } else {
2076 s->mult_sectors = s->nsector & 0xff;
2077 s->status = READY_STAT | SEEK_STAT;
2078 }
2079 ide_set_irq(s);
2080 break;
2081 case WIN_VERIFY_EXT:
2082 lba48 = 1;
2083 case WIN_VERIFY:
2084 case WIN_VERIFY_ONCE:
2085 /* do sector number check ? */
2086 ide_cmd_lba48_transform(s, lba48);
2087 s->status = READY_STAT | SEEK_STAT;
2088 ide_set_irq(s);
2089 break;
2090 case WIN_READ_EXT:
2091 lba48 = 1;
2092 case WIN_READ:
2093 case WIN_READ_ONCE:
2094 if (!s->bs)
2095 goto abort_cmd;
2096 ide_cmd_lba48_transform(s, lba48);
2097 s->req_nb_sectors = 1;
2098 ide_sector_read(s);
2099 break;
2100 case WIN_WRITE_EXT:
2101 lba48 = 1;
2102 case WIN_WRITE:
2103 case WIN_WRITE_ONCE:
2104 case CFA_WRITE_SECT_WO_ERASE:
2105 case WIN_WRITE_VERIFY:
2106 ide_cmd_lba48_transform(s, lba48);
2107 s->error = 0;
2108 s->status = SEEK_STAT | READY_STAT;
2109 s->req_nb_sectors = 1;
2110 ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
2111 s->media_changed = 1;
2112 break;
2113 case WIN_MULTREAD_EXT:
2114 lba48 = 1;
2115 case WIN_MULTREAD:
2116 if (!s->mult_sectors)
2117 goto abort_cmd;
2118 ide_cmd_lba48_transform(s, lba48);
2119 s->req_nb_sectors = s->mult_sectors;
2120 ide_sector_read(s);
2121 break;
2122 case WIN_MULTWRITE_EXT:
2123 lba48 = 1;
2124 case WIN_MULTWRITE:
2125 case CFA_WRITE_MULTI_WO_ERASE:
2126 if (!s->mult_sectors)
2127 goto abort_cmd;
2128 ide_cmd_lba48_transform(s, lba48);
2129 s->error = 0;
2130 s->status = SEEK_STAT | READY_STAT;
2131 s->req_nb_sectors = s->mult_sectors;
2132 n = s->nsector;
2133 if (n > s->req_nb_sectors)
2134 n = s->req_nb_sectors;
2135 ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
2136 s->media_changed = 1;
2137 break;
2138 case WIN_READDMA_EXT:
2139 lba48 = 1;
2140 case WIN_READDMA:
2141 case WIN_READDMA_ONCE:
2142 if (!s->bs)
2143 goto abort_cmd;
2144 ide_cmd_lba48_transform(s, lba48);
2145 ide_sector_read_dma(s);
2146 break;
2147 case WIN_WRITEDMA_EXT:
2148 lba48 = 1;
2149 case WIN_WRITEDMA:
2150 case WIN_WRITEDMA_ONCE:
2151 if (!s->bs)
2152 goto abort_cmd;
2153 ide_cmd_lba48_transform(s, lba48);
2154 ide_sector_write_dma(s);
2155 s->media_changed = 1;
2156 break;
2157 case WIN_READ_NATIVE_MAX_EXT:
2158 lba48 = 1;
2159 case WIN_READ_NATIVE_MAX:
2160 ide_cmd_lba48_transform(s, lba48);
2161 ide_set_sector(s, s->nb_sectors - 1);
2162 s->status = READY_STAT | SEEK_STAT;
2163 ide_set_irq(s);
2164 break;
2165 case WIN_CHECKPOWERMODE1:
2166 case WIN_CHECKPOWERMODE2:
2167 s->nsector = 0xff; /* device active or idle */
2168 s->status = READY_STAT | SEEK_STAT;
2169 ide_set_irq(s);
2170 break;
2171 case WIN_SETFEATURES:
2172 if (!s->bs)
2173 goto abort_cmd;
2174 /* XXX: valid for CDROM ? */
2175 switch(s->feature) {
2176 case 0xcc: /* reverting to power-on defaults enable */
2177 case 0x66: /* reverting to power-on defaults disable */
2178 case 0x02: /* write cache enable */
2179 case 0x82: /* write cache disable */
2180 case 0xaa: /* read look-ahead enable */
2181 case 0x55: /* read look-ahead disable */
2182 case 0x05: /* set advanced power management mode */
2183 case 0x85: /* disable advanced power management mode */
2184 case 0x69: /* NOP */
2185 case 0x67: /* NOP */
2186 case 0x96: /* NOP */
2187 case 0x9a: /* NOP */
2188 case 0x42: /* enable Automatic Acoustic Mode */
2189 case 0xc2: /* disable Automatic Acoustic Mode */
2190 s->status = READY_STAT | SEEK_STAT;
2191 ide_set_irq(s);
2192 break;
2193 case 0x03: { /* set transfer mode */
2194 uint8_t val = s->nsector & 0x07;
2195
2196 switch (s->nsector >> 3) {
2197 case 0x00: /* pio default */
2198 case 0x01: /* pio mode */
2199 put_le16(s->identify_data + 62,0x07);
2200 put_le16(s->identify_data + 63,0x07);
2201 put_le16(s->identify_data + 88,0x3f);
2202 break;
2203 case 0x02: /* sigle word dma mode*/
2204 put_le16(s->identify_data + 62,0x07 | (1 << (val + 8)));
2205 put_le16(s->identify_data + 63,0x07);
2206 put_le16(s->identify_data + 88,0x3f);
2207 break;
2208 case 0x04: /* mdma mode */
2209 put_le16(s->identify_data + 62,0x07);
2210 put_le16(s->identify_data + 63,0x07 | (1 << (val + 8)));
2211 put_le16(s->identify_data + 88,0x3f);
2212 break;
2213 case 0x08: /* udma mode */
2214 put_le16(s->identify_data + 62,0x07);
2215 put_le16(s->identify_data + 63,0x07);
2216 put_le16(s->identify_data + 88,0x3f | (1 << (val + 8)));
2217 break;
2218 default:
2219 goto abort_cmd;
2220 }
2221 s->status = READY_STAT | SEEK_STAT;
2222 ide_set_irq(s);
2223 break;
2224 }
2225 default:
2226 goto abort_cmd;
2227 }
2228 break;
2229 case WIN_FLUSH_CACHE:
2230 case WIN_FLUSH_CACHE_EXT:
2231 if (s->bs)
2232 bdrv_flush(s->bs);
2233 s->status = READY_STAT | SEEK_STAT;
2234 ide_set_irq(s);
2235 break;
2236 case WIN_STANDBY:
2237 case WIN_STANDBY2:
2238 case WIN_STANDBYNOW1:
2239 case WIN_STANDBYNOW2:
2240 case WIN_IDLEIMMEDIATE:
2241 case CFA_IDLEIMMEDIATE:
2242 case WIN_SETIDLE1:
2243 case WIN_SETIDLE2:
2244 case WIN_SLEEPNOW1:
2245 case WIN_SLEEPNOW2:
2246 s->status = READY_STAT;
2247 ide_set_irq(s);
2248 break;
2249 /* ATAPI commands */
2250 case WIN_PIDENTIFY:
2251 if (s->is_cdrom) {
2252 ide_atapi_identify(s);
2253 s->status = READY_STAT | SEEK_STAT;
2254 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
2255 } else {
2256 ide_abort_command(s);
2257 }
2258 ide_set_irq(s);
2259 break;
2260 case WIN_DIAGNOSE:
2261 ide_set_signature(s);
2262 s->status = READY_STAT | SEEK_STAT;
2263 s->error = 0x01;
2264 ide_set_irq(s);
2265 break;
2266 case WIN_SRST:
2267 if (!s->is_cdrom)
2268 goto abort_cmd;
2269 ide_set_signature(s);
2270 s->status = 0x00; /* NOTE: READY is _not_ set */
2271 s->error = 0x01;
2272 break;
2273 case WIN_PACKETCMD:
2274 if (!s->is_cdrom)
2275 goto abort_cmd;
2276 /* overlapping commands not supported */
2277 if (s->feature & 0x02)
2278 goto abort_cmd;
2279 s->status = READY_STAT | SEEK_STAT;
2280 s->atapi_dma = s->feature & 1;
2281 s->nsector = 1;
2282 ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
2283 ide_atapi_cmd);
2284 break;
2285 /* CF-ATA commands */
2286 case CFA_REQ_EXT_ERROR_CODE:
2287 if (!s->is_cf)
2288 goto abort_cmd;
2289 s->error = 0x09; /* miscellaneous error */
2290 s->status = READY_STAT | SEEK_STAT;
2291 ide_set_irq(s);
2292 break;
2293 case CFA_ERASE_SECTORS:
2294 case CFA_WEAR_LEVEL:
2295 if (!s->is_cf)
2296 goto abort_cmd;
2297 if (val == CFA_WEAR_LEVEL)
2298 s->nsector = 0;
2299 if (val == CFA_ERASE_SECTORS)
2300 s->media_changed = 1;
2301 s->error = 0x00;
2302 s->status = READY_STAT | SEEK_STAT;
2303 ide_set_irq(s);
2304 break;
2305 case CFA_TRANSLATE_SECTOR:
2306 if (!s->is_cf)
2307 goto abort_cmd;
2308 s->error = 0x00;
2309 s->status = READY_STAT | SEEK_STAT;
2310 memset(s->io_buffer, 0, 0x200);
2311 s->io_buffer[0x00] = s->hcyl; /* Cyl MSB */
2312 s->io_buffer[0x01] = s->lcyl; /* Cyl LSB */
2313 s->io_buffer[0x02] = s->select; /* Head */
2314 s->io_buffer[0x03] = s->sector; /* Sector */
2315 s->io_buffer[0x04] = ide_get_sector(s) >> 16; /* LBA MSB */
2316 s->io_buffer[0x05] = ide_get_sector(s) >> 8; /* LBA */
2317 s->io_buffer[0x06] = ide_get_sector(s) >> 0; /* LBA LSB */
2318 s->io_buffer[0x13] = 0x00; /* Erase flag */
2319 s->io_buffer[0x18] = 0x00; /* Hot count */
2320 s->io_buffer[0x19] = 0x00; /* Hot count */
2321 s->io_buffer[0x1a] = 0x01; /* Hot count */
2322 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2323 ide_set_irq(s);
2324 break;
2325 case CFA_ACCESS_METADATA_STORAGE:
2326 if (!s->is_cf)
2327 goto abort_cmd;
2328 switch (s->feature) {
2329 case 0x02: /* Inquiry Metadata Storage */
2330 ide_cfata_metadata_inquiry(s);
2331 break;
2332 case 0x03: /* Read Metadata Storage */
2333 ide_cfata_metadata_read(s);
2334 break;
2335 case 0x04: /* Write Metadata Storage */
2336 ide_cfata_metadata_write(s);
2337 break;
2338 default:
2339 goto abort_cmd;
2340 }
2341 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2342 s->status = 0x00; /* NOTE: READY is _not_ set */
2343 ide_set_irq(s);
2344 break;
2345 case IBM_SENSE_CONDITION:
2346 if (!s->is_cf)
2347 goto abort_cmd;
2348 switch (s->feature) {
2349 case 0x01: /* sense temperature in device */
2350 s->nsector = 0x50; /* +20 C */
2351 break;
2352 default:
2353 goto abort_cmd;
2354 }
2355 s->status = READY_STAT | SEEK_STAT;
2356 ide_set_irq(s);
2357 break;
2358 default:
2359 abort_cmd:
2360 ide_abort_command(s);
2361 ide_set_irq(s);
2362 break;
2363 }
2364 }
2365 }
2366
2367 static uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
2368 {
2369 IDEState *ide_if = opaque;
2370 IDEState *s = ide_if->cur_drive;
2371 uint32_t addr;
2372 int ret, hob;
2373
2374 addr = addr1 & 7;
2375 /* FIXME: HOB readback uses bit 7, but it's always set right now */
2376 //hob = s->select & (1 << 7);
2377 hob = 0;
2378 switch(addr) {
2379 case 0:
2380 ret = 0xff;
2381 break;
2382 case 1:
2383 if (!ide_if[0].bs && !ide_if[1].bs)
2384 ret = 0;
2385 else if (!hob)
2386 ret = s->error;
2387 else
2388 ret = s->hob_feature;
2389 break;
2390 case 2:
2391 if (!ide_if[0].bs && !ide_if[1].bs)
2392 ret = 0;
2393 else if (!hob)
2394 ret = s->nsector & 0xff;
2395 else
2396 ret = s->hob_nsector;
2397 break;
2398 case 3:
2399 if (!ide_if[0].bs && !ide_if[1].bs)
2400 ret = 0;
2401 else if (!hob)
2402 ret = s->sector;
2403 else
2404 ret = s->hob_sector;
2405 break;
2406 case 4:
2407 if (!ide_if[0].bs && !ide_if[1].bs)
2408 ret = 0;
2409 else if (!hob)
2410 ret = s->lcyl;
2411 else
2412 ret = s->hob_lcyl;
2413 break;
2414 case 5:
2415 if (!ide_if[0].bs && !ide_if[1].bs)
2416 ret = 0;
2417 else if (!hob)
2418 ret = s->hcyl;
2419 else
2420 ret = s->hob_hcyl;
2421 break;
2422 case 6:
2423 if (!ide_if[0].bs && !ide_if[1].bs)
2424 ret = 0;
2425 else
2426 ret = s->select;
2427 break;
2428 default:
2429 case 7:
2430 if ((!ide_if[0].bs && !ide_if[1].bs) ||
2431 (s != ide_if && !s->bs))
2432 ret = 0;
2433 else
2434 ret = s->status;
2435 qemu_irq_lower(s->irq);
2436 break;
2437 }
2438 #ifdef DEBUG_IDE
2439 printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
2440 #endif
2441 return ret;
2442 }
2443
2444 static uint32_t ide_status_read(void *opaque, uint32_t addr)
2445 {
2446 IDEState *ide_if = opaque;
2447 IDEState *s = ide_if->cur_drive;
2448 int ret;
2449
2450 if ((!ide_if[0].bs && !ide_if[1].bs) ||
2451 (s != ide_if && !s->bs))
2452 ret = 0;
2453 else
2454 ret = s->status;
2455 #ifdef DEBUG_IDE
2456 printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
2457 #endif
2458 return ret;
2459 }
2460
2461 static void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
2462 {
2463 IDEState *ide_if = opaque;
2464 IDEState *s;
2465 int i;
2466
2467 #ifdef DEBUG_IDE
2468 printf("ide: write control addr=0x%x val=%02x\n", addr, val);
2469 #endif
2470 /* common for both drives */
2471 if (!(ide_if[0].cmd & IDE_CMD_RESET) &&
2472 (val & IDE_CMD_RESET)) {
2473 /* reset low to high */
2474 for(i = 0;i < 2; i++) {
2475 s = &ide_if[i];
2476 s->status = BUSY_STAT | SEEK_STAT;
2477 s->error = 0x01;
2478 }
2479 } else if ((ide_if[0].cmd & IDE_CMD_RESET) &&
2480 !(val & IDE_CMD_RESET)) {
2481 /* high to low */
2482 for(i = 0;i < 2; i++) {
2483 s = &ide_if[i];
2484 if (s->is_cdrom)
2485 s->status = 0x00; /* NOTE: READY is _not_ set */
2486 else
2487 s->status = READY_STAT | SEEK_STAT;
2488 ide_set_signature(s);
2489 }
2490 }
2491
2492 ide_if[0].cmd = val;
2493 ide_if[1].cmd = val;
2494 }
2495
2496 static void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
2497 {
2498 IDEState *s = ((IDEState *)opaque)->cur_drive;
2499 uint8_t *p;
2500
2501 p = s->data_ptr;
2502 *(uint16_t *)p = le16_to_cpu(val);
2503 p += 2;
2504 s->data_ptr = p;
2505 if (p >= s->data_end)
2506 s->end_transfer_func(s);
2507 }
2508
2509 static uint32_t ide_data_readw(void *opaque, uint32_t addr)
2510 {
2511 IDEState *s = ((IDEState *)opaque)->cur_drive;
2512 uint8_t *p;
2513 int ret;
2514 p = s->data_ptr;
2515 ret = cpu_to_le16(*(uint16_t *)p);
2516 p += 2;
2517 s->data_ptr = p;
2518 if (p >= s->data_end)
2519 s->end_transfer_func(s);
2520 return ret;
2521 }
2522
2523 static void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
2524 {
2525 IDEState *s = ((IDEState *)opaque)->cur_drive;
2526 uint8_t *p;
2527
2528 p = s->data_ptr;
2529 *(uint32_t *)p = le32_to_cpu(val);
2530 p += 4;
2531 s->data_ptr = p;
2532 if (p >= s->data_end)
2533 s->end_transfer_func(s);
2534 }
2535
2536 static uint32_t ide_data_readl(void *opaque, uint32_t addr)
2537 {
2538 IDEState *s = ((IDEState *)opaque)->cur_drive;
2539 uint8_t *p;
2540 int ret;
2541
2542 p = s->data_ptr;
2543 ret = cpu_to_le32(*(uint32_t *)p);
2544 p += 4;
2545 s->data_ptr = p;
2546 if (p >= s->data_end)
2547 s->end_transfer_func(s);
2548 return ret;
2549 }
2550
2551 static void ide_dummy_transfer_stop(IDEState *s)
2552 {
2553 s->data_ptr = s->io_buffer;
2554 s->data_end = s->io_buffer;
2555 s->io_buffer[0] = 0xff;
2556 s->io_buffer[1] = 0xff;
2557 s->io_buffer[2] = 0xff;
2558 s->io_buffer[3] = 0xff;
2559 }
2560
2561 static void ide_reset(IDEState *s)
2562 {
2563 if (s->is_cf)
2564 s->mult_sectors = 0;
2565 else
2566 s->mult_sectors = MAX_MULT_SECTORS;
2567 s->cur_drive = s;
2568 s->select = 0xa0;
2569 s->status = READY_STAT | SEEK_STAT;
2570 ide_set_signature(s);
2571 /* init the transfer handler so that 0xffff is returned on data
2572 accesses */
2573 s->end_transfer_func = ide_dummy_transfer_stop;
2574 ide_dummy_transfer_stop(s);
2575 s->media_changed = 0;
2576 }
2577
2578 struct partition {
2579 uint8_t boot_ind; /* 0x80 - active */
2580 uint8_t head; /* starting head */
2581 uint8_t sector; /* starting sector */
2582 uint8_t cyl; /* starting cylinder */
2583 uint8_t sys_ind; /* What partition type */
2584 uint8_t end_head; /* end head */
2585 uint8_t end_sector; /* end sector */
2586 uint8_t end_cyl; /* end cylinder */
2587 uint32_t start_sect; /* starting sector counting from 0 */
2588 uint32_t nr_sects; /* nr of sectors in partition */
2589 } __attribute__((packed));
2590
2591 /* try to guess the disk logical geometry from the MSDOS partition table. Return 0 if OK, -1 if could not guess */
2592 static int guess_disk_lchs(IDEState *s,
2593 int *pcylinders, int *pheads, int *psectors)
2594 {
2595 uint8_t *buf = s->io_buffer;
2596 int ret, i, heads, sectors, cylinders;
2597 struct partition *p;
2598 uint32_t nr_sects;
2599
2600 ret = bdrv_read(s->bs, 0, buf, 1);
2601 if (ret < 0) {
2602 return -1;
2603 }
2604 /* test msdos magic */
2605 if (buf[510] != 0x55 || buf[511] != 0xaa) {
2606 return -1;
2607 }
2608 for(i = 0; i < 4; i++) {
2609 p = ((struct partition *)(buf + 0x1be)) + i;
2610 nr_sects = le32_to_cpu(p->nr_sects);
2611 if (nr_sects && p->end_head) {
2612 /* We make the assumption that the partition terminates on
2613 a cylinder boundary */
2614 heads = p->end_head + 1;
2615 sectors = p->end_sector & 63;
2616 if (sectors == 0)
2617 continue;
2618 cylinders = s->nb_sectors / (heads * sectors);
2619 if (cylinders < 1 || cylinders > 16383)
2620 continue;
2621 *pheads = heads;
2622 *psectors = sectors;
2623 *pcylinders = cylinders;
2624 #if 0
2625 printf("guessed geometry: LCHS=%d %d %d\n",
2626 cylinders, heads, sectors);
2627 #endif
2628 return 0;
2629 }
2630 }
2631 return -1;
2632 }
2633
2634 static void ide_init2(IDEState *ide_state,
2635 BlockDriverState *hd0, BlockDriverState *hd1,
2636 qemu_irq irq)
2637 {
2638 IDEState *s;
2639 static int drive_serial = 1;
2640 int i, cylinders, heads, secs, translation, lba_detected = 0;
2641 uint64_t nb_sectors;
2642
2643 for(i = 0; i < 2; i++) {
2644 s = ide_state + i;
2645 s->io_buffer = qemu_memalign(512, IDE_DMA_BUF_SECTORS*512 + 4);
2646 if (i == 0)
2647 s->bs = hd0;
2648 else
2649 s->bs = hd1;
2650 if (s->bs) {
2651 bdrv_get_geometry(s->bs, &nb_sectors);
2652 s->nb_sectors = nb_sectors;
2653 /* if a geometry hint is available, use it */
2654 bdrv_get_geometry_hint(s->bs, &cylinders, &heads, &secs);
2655 translation = bdrv_get_translation_hint(s->bs);
2656 if (cylinders != 0) {
2657 s->cylinders = cylinders;
2658 s->heads = heads;
2659 s->sectors = secs;
2660 } else {
2661 if (guess_disk_lchs(s, &cylinders, &heads, &secs) == 0) {
2662 if (heads > 16) {
2663 /* if heads > 16, it means that a BIOS LBA
2664 translation was active, so the default
2665 hardware geometry is OK */
2666 lba_detected = 1;
2667 goto default_geometry;
2668 } else {
2669 s->cylinders = cylinders;
2670 s->heads = heads;
2671 s->sectors = secs;
2672 /* disable any translation to be in sync with
2673 the logical geometry */
2674 if (translation == BIOS_ATA_TRANSLATION_AUTO) {
2675 bdrv_set_translation_hint(s->bs,
2676 BIOS_ATA_TRANSLATION_NONE);
2677 }
2678 }
2679 } else {
2680 default_geometry:
2681 /* if no geometry, use a standard physical disk geometry */
2682 cylinders = nb_sectors / (16 * 63);
2683 if (cylinders > 16383)
2684 cylinders = 16383;
2685 else if (cylinders < 2)
2686 cylinders = 2;
2687 s->cylinders = cylinders;
2688 s->heads = 16;
2689 s->sectors = 63;
2690 if ((lba_detected == 1) && (translation == BIOS_ATA_TRANSLATION_AUTO)) {
2691 if ((s->cylinders * s->heads) <= 131072) {
2692 bdrv_set_translation_hint(s->bs,
2693 BIOS_ATA_TRANSLATION_LARGE);
2694 } else {
2695 bdrv_set_translation_hint(s->bs,
2696 BIOS_ATA_TRANSLATION_LBA);
2697 }
2698 }
2699 }
2700 bdrv_set_geometry_hint(s->bs, s->cylinders, s->heads, s->sectors);
2701 }
2702 if (bdrv_get_type_hint(s->bs) == BDRV_TYPE_CDROM) {
2703 s->is_cdrom = 1;
2704 bdrv_set_change_cb(s->bs, cdrom_change_cb, s);
2705 }
2706 }
2707 s->drive_serial = drive_serial++;
2708 s->irq = irq;
2709 s->sector_write_timer = qemu_new_timer(vm_clock,
2710 ide_sector_write_timer_cb, s);
2711 ide_reset(s);
2712 }
2713 }
2714
2715 static void ide_init_ioport(IDEState *ide_state, int iobase, int iobase2)
2716 {
2717 register_ioport_write(iobase, 8, 1, ide_ioport_write, ide_state);
2718 register_ioport_read(iobase, 8, 1, ide_ioport_read, ide_state);
2719 if (iobase2) {
2720 register_ioport_read(iobase2, 1, 1, ide_status_read, ide_state);
2721 register_ioport_write(iobase2, 1, 1, ide_cmd_write, ide_state);
2722 }
2723
2724 /* data ports */
2725 register_ioport_write(iobase, 2, 2, ide_data_writew, ide_state);
2726 register_ioport_read(iobase, 2, 2, ide_data_readw, ide_state);
2727 register_ioport_write(iobase, 4, 4, ide_data_writel, ide_state);
2728 register_ioport_read(iobase, 4, 4, ide_data_readl, ide_state);
2729 }
2730
2731 /* save per IDE drive data */
2732 static void ide_save(QEMUFile* f, IDEState *s)
2733 {
2734 qemu_put_be32(f, s->mult_sectors);
2735 qemu_put_be32(f, s->identify_set);
2736 if (s->identify_set) {
2737 qemu_put_buffer(f, (const uint8_t *)s->identify_data, 512);
2738 }
2739 qemu_put_8s(f, &s->feature);
2740 qemu_put_8s(f, &s->error);
2741 qemu_put_be32s(f, &s->nsector);
2742 qemu_put_8s(f, &s->sector);
2743 qemu_put_8s(f, &s->lcyl);
2744 qemu_put_8s(f, &s->hcyl);
2745 qemu_put_8s(f, &s->hob_feature);
2746 qemu_put_8s(f, &s->hob_nsector);
2747 qemu_put_8s(f, &s->hob_sector);
2748 qemu_put_8s(f, &s->hob_lcyl);
2749 qemu_put_8s(f, &s->hob_hcyl);
2750 qemu_put_8s(f, &s->select);
2751 qemu_put_8s(f, &s->status);
2752 qemu_put_8s(f, &s->lba48);
2753
2754 qemu_put_8s(f, &s->sense_key);
2755 qemu_put_8s(f, &s->asc);
2756 /* XXX: if a transfer is pending, we do not save it yet */
2757 }
2758
2759 /* load per IDE drive data */
2760 static void ide_load(QEMUFile* f, IDEState *s)
2761 {
2762 s->mult_sectors=qemu_get_be32(f);
2763 s->identify_set=qemu_get_be32(f);
2764 if (s->identify_set) {
2765 qemu_get_buffer(f, (uint8_t *)s->identify_data, 512);
2766 }
2767 qemu_get_8s(f, &s->feature);
2768 qemu_get_8s(f, &s->error);
2769 qemu_get_be32s(f, &s->nsector);
2770 qemu_get_8s(f, &s->sector);
2771 qemu_get_8s(f, &s->lcyl);
2772 qemu_get_8s(f, &s->hcyl);
2773 qemu_get_8s(f, &s->hob_feature);
2774 qemu_get_8s(f, &s->hob_nsector);
2775 qemu_get_8s(f, &s->hob_sector);
2776 qemu_get_8s(f, &s->hob_lcyl);
2777 qemu_get_8s(f, &s->hob_hcyl);
2778 qemu_get_8s(f, &s->select);
2779 qemu_get_8s(f, &s->status);
2780 qemu_get_8s(f, &s->lba48);
2781
2782 qemu_get_8s(f, &s->sense_key);
2783 qemu_get_8s(f, &s->asc);
2784 /* XXX: if a transfer is pending, we do not save it yet */
2785 }
2786
2787 /***********************************************************/
2788 /* ISA IDE definitions */
2789
2790 void isa_ide_init(int iobase, int iobase2, qemu_irq irq,
2791 BlockDriverState *hd0, BlockDriverState *hd1)
2792 {
2793 IDEState *ide_state;
2794
2795 ide_state = qemu_mallocz(sizeof(IDEState) * 2);
2796 if (!ide_state)
2797 return;
2798
2799 ide_init2(ide_state, hd0, hd1, irq);
2800 ide_init_ioport(ide_state, iobase, iobase2);
2801 }
2802
2803 /***********************************************************/
2804 /* PCI IDE definitions */
2805
2806 static void cmd646_update_irq(PCIIDEState *d);
2807
2808 static void ide_map(PCIDevice *pci_dev, int region_num,
2809 uint32_t addr, uint32_t size, int type)
2810 {
2811 PCIIDEState *d = (PCIIDEState *)pci_dev;
2812 IDEState *ide_state;
2813
2814 if (region_num <= 3) {
2815 ide_state = &d->ide_if[(region_num >> 1) * 2];
2816 if (region_num & 1) {
2817 register_ioport_read(addr + 2, 1, 1, ide_status_read, ide_state);
2818 register_ioport_write(addr + 2, 1, 1, ide_cmd_write, ide_state);
2819 } else {
2820 register_ioport_write(addr, 8, 1, ide_ioport_write, ide_state);
2821 register_ioport_read(addr, 8, 1, ide_ioport_read, ide_state);
2822
2823 /* data ports */
2824 register_ioport_write(addr, 2, 2, ide_data_writew, ide_state);
2825 register_ioport_read(addr, 2, 2, ide_data_readw, ide_state);
2826 register_ioport_write(addr, 4, 4, ide_data_writel, ide_state);
2827 register_ioport_read(addr, 4, 4, ide_data_readl, ide_state);
2828 }
2829 }
2830 }
2831
2832 static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb)
2833 {
2834 BMDMAState *bm = s->bmdma;
2835 if(!bm)
2836 return;
2837 bm->ide_if = s;
2838 bm->dma_cb = dma_cb;
2839 bm->cur_prd_last = 0;
2840 bm->cur_prd_addr = 0;
2841 bm->cur_prd_len = 0;
2842 if (bm->status & BM_STATUS_DMAING) {
2843 bm->dma_cb(bm, 0);
2844 }
2845 }
2846
2847 static void ide_dma_cancel(BMDMAState *bm)
2848 {
2849 if (bm->status & BM_STATUS_DMAING) {
2850 bm->status &= ~BM_STATUS_DMAING;
2851 /* cancel DMA request */
2852 bm->ide_if = NULL;
2853 bm->dma_cb = NULL;
2854 if (bm->aiocb) {
2855 #ifdef DEBUG_AIO
2856 printf("aio_cancel\n");
2857 #endif
2858 bdrv_aio_cancel(bm->aiocb);
2859 bm->aiocb = NULL;
2860 }
2861 }
2862 }
2863
2864 static void bmdma_cmd_writeb(void *opaque, uint32_t addr, uint32_t val)
2865 {
2866 BMDMAState *bm = opaque;
2867 #ifdef DEBUG_IDE
2868 printf("%s: 0x%08x\n", __func__, val);
2869 #endif
2870 if (!(val & BM_CMD_START)) {
2871 /* XXX: do it better */
2872 ide_dma_cancel(bm);
2873 bm->cmd = val & 0x09;
2874 } else {
2875 if (!(bm->status & BM_STATUS_DMAING)) {
2876 bm->status |= BM_STATUS_DMAING;
2877 /* start dma transfer if possible */
2878 if (bm->dma_cb)
2879 bm->dma_cb(bm, 0);
2880 }
2881 bm->cmd = val & 0x09;
2882 }
2883 }
2884
2885 static uint32_t bmdma_readb(void *opaque, uint32_t addr)
2886 {
2887 BMDMAState *bm = opaque;
2888 PCIIDEState *pci_dev;
2889 uint32_t val;
2890
2891 switch(addr & 3) {
2892 case 0:
2893 val = bm->cmd;
2894 break;
2895 case 1:
2896 pci_dev = bm->pci_dev;
2897 if (pci_dev->type == IDE_TYPE_CMD646) {
2898 val = pci_dev->dev.config[MRDMODE];
2899 } else {
2900 val = 0xff;
2901 }
2902 break;
2903 case 2:
2904 val = bm->status;
2905 break;
2906 case 3:
2907 pci_dev = bm->pci_dev;
2908 if (pci_dev->type == IDE_TYPE_CMD646) {
2909 if (bm == &pci_dev->bmdma[0])
2910 val = pci_dev->dev.config[UDIDETCR0];
2911 else
2912 val = pci_dev->dev.config[UDIDETCR1];
2913 } else {
2914 val = 0xff;
2915 }
2916 break;
2917 default:
2918 val = 0xff;
2919 break;
2920 }
2921 #ifdef DEBUG_IDE
2922 printf("bmdma: readb 0x%02x : 0x%02x\n", addr, val);
2923 #endif
2924 return val;
2925 }
2926
2927 static void bmdma_writeb(void *opaque, uint32_t addr, uint32_t val)
2928 {
2929 BMDMAState *bm = opaque;
2930 PCIIDEState *pci_dev;
2931 #ifdef DEBUG_IDE
2932 printf("bmdma: writeb 0x%02x : 0x%02x\n", addr, val);
2933 #endif
2934 switch(addr & 3) {
2935 case 1:
2936 pci_dev = bm->pci_dev;
2937 if (pci_dev->type == IDE_TYPE_CMD646) {
2938 pci_dev->dev.config[MRDMODE] =
2939 (pci_dev->dev.config[MRDMODE] & ~0x30) | (val & 0x30);
2940 cmd646_update_irq(pci_dev);
2941 }
2942 break;
2943 case 2:
2944 bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
2945 break;
2946 case 3:
2947 pci_dev = bm->pci_dev;
2948 if (pci_dev->type == IDE_TYPE_CMD646) {
2949 if (bm == &pci_dev->bmdma[0])
2950 pci_dev->dev.config[UDIDETCR0] = val;
2951 else
2952 pci_dev->dev.config[UDIDETCR1] = val;
2953 }
2954 break;
2955 }
2956 }
2957
2958 static uint32_t bmdma_addr_readb(void *opaque, uint32_t addr)
2959 {
2960 BMDMAState *bm = opaque;
2961 uint32_t val;
2962 val = (bm->addr >> ((addr & 3) * 8)) & 0xff;
2963 #ifdef DEBUG_IDE
2964 printf("%s: 0x%08x\n", __func__, val);
2965 #endif
2966 return val;
2967 }
2968
2969 static void bmdma_addr_writeb(void *opaque, uint32_t addr, uint32_t val)
2970 {
2971 BMDMAState *bm = opaque;
2972 int shift = (addr & 3) * 8;
2973 #ifdef DEBUG_IDE
2974 printf("%s: 0x%08x\n", __func__, val);
2975 #endif
2976 bm->addr &= ~(0xFF << shift);
2977 bm->addr |= ((val & 0xFF) << shift) & ~3;
2978 bm->cur_addr = bm->addr;
2979 }
2980
2981 static uint32_t bmdma_addr_readw(void *opaque, uint32_t addr)
2982 {
2983 BMDMAState *bm = opaque;
2984 uint32_t val;
2985 val = (bm->addr >> ((addr & 3) * 8)) & 0xffff;
2986 #ifdef DEBUG_IDE
2987 printf("%s: 0x%08x\n", __func__, val);
2988 #endif
2989 return val;
2990 }
2991
2992 static void bmdma_addr_writew(void *opaque, uint32_t addr, uint32_t val)
2993 {
2994 BMDMAState *bm = opaque;
2995 int shift = (addr & 3) * 8;
2996 #ifdef DEBUG_IDE
2997 printf("%s: 0x%08x\n", __func__, val);
2998 #endif
2999 bm->addr &= ~(0xFFFF << shift);
3000 bm->addr |= ((val & 0xFFFF) << shift) & ~3;
3001 bm->cur_addr = bm->addr;
3002 }
3003
3004 static uint32_t bmdma_addr_readl(void *opaque, uint32_t addr)
3005 {
3006 BMDMAState *bm = opaque;
3007 uint32_t val;
3008 val = bm->addr;
3009 #ifdef DEBUG_IDE
3010 printf("%s: 0x%08x\n", __func__, val);
3011 #endif
3012 return val;
3013 }
3014
3015 static void bmdma_addr_writel(void *opaque, uint32_t addr, uint32_t val)
3016 {
3017 BMDMAState *bm = opaque;
3018 #ifdef DEBUG_IDE
3019 printf("%s: 0x%08x\n", __func__, val);
3020 #endif
3021 bm->addr = val & ~3;
3022 bm->cur_addr = bm->addr;
3023 }
3024
3025 static void bmdma_map(PCIDevice *pci_dev, int region_num,
3026 uint32_t addr, uint32_t size, int type)
3027 {
3028 PCIIDEState *d = (PCIIDEState *)pci_dev;
3029 int i;
3030
3031 for(i = 0;i < 2; i++) {
3032 BMDMAState *bm = &d->bmdma[i];
3033 d->ide_if[2 * i].bmdma = bm;
3034 d->ide_if[2 * i + 1].bmdma = bm;
3035 bm->pci_dev = (PCIIDEState *)pci_dev;
3036
3037 register_ioport_write(addr, 1, 1, bmdma_cmd_writeb, bm);
3038
3039 register_ioport_write(addr + 1, 3, 1, bmdma_writeb, bm);
3040 register_ioport_read(addr, 4, 1, bmdma_readb, bm);
3041
3042 register_ioport_write(addr + 4, 4, 1, bmdma_addr_writeb, bm);
3043 register_ioport_read(addr + 4, 4, 1, bmdma_addr_readb, bm);
3044 register_ioport_write(addr + 4, 4, 2, bmdma_addr_writew, bm);
3045 register_ioport_read(addr + 4, 4, 2, bmdma_addr_readw, bm);
3046 register_ioport_write(addr + 4, 4, 4, bmdma_addr_writel, bm);
3047 register_ioport_read(addr + 4, 4, 4, bmdma_addr_readl, bm);
3048 addr += 8;
3049 }
3050 }
3051
3052 /* XXX: call it also when the MRDMODE is changed from the PCI config
3053 registers */
3054 static void cmd646_update_irq(PCIIDEState *d)
3055 {
3056 int pci_level;
3057 pci_level = ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH0) &&
3058 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH0)) ||
3059 ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH1) &&
3060 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH1));
3061 qemu_set_irq(d->dev.irq[0], pci_level);
3062 }
3063
3064 /* the PCI irq level is the logical OR of the two channels */
3065 static void cmd646_set_irq(void *opaque, int channel, int level)
3066 {
3067 PCIIDEState *d = opaque;
3068 int irq_mask;
3069
3070 irq_mask = MRDMODE_INTR_CH0 << channel;
3071 if (level)
3072 d->dev.config[MRDMODE] |= irq_mask;
3073 else
3074 d->dev.config[MRDMODE] &= ~irq_mask;
3075 cmd646_update_irq(d);
3076 }
3077
3078 /* CMD646 PCI IDE controller */
3079 void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
3080 int secondary_ide_enabled)
3081 {
3082 PCIIDEState *d;
3083 uint8_t *pci_conf;
3084 int i;
3085 qemu_irq *irq;
3086
3087 d = (PCIIDEState *)pci_register_device(bus, "CMD646 IDE",
3088 sizeof(PCIIDEState),
3089 -1,
3090 NULL, NULL);
3091 d->type = IDE_TYPE_CMD646;
3092 pci_conf = d->dev.config;
3093 pci_conf[0x00] = 0x95; // CMD646
3094 pci_conf[0x01] = 0x10;
3095 pci_conf[0x02] = 0x46;
3096 pci_conf[0x03] = 0x06;
3097
3098 pci_conf[0x08] = 0x07; // IDE controller revision
3099 pci_conf[0x09] = 0x8f;
3100
3101 pci_conf[0x0a] = 0x01; // class_sub = PCI_IDE
3102 pci_conf[0x0b] = 0x01; // class_base = PCI_mass_storage
3103 pci_conf[0x0e] = 0x00; // header_type
3104
3105 if (secondary_ide_enabled) {
3106 /* XXX: if not enabled, really disable the seconday IDE controller */
3107 pci_conf[0x51] = 0x80; /* enable IDE1 */
3108 }
3109
3110 pci_register_io_region((PCIDevice *)d, 0, 0x8,
3111 PCI_ADDRESS_SPACE_IO, ide_map);
3112 pci_register_io_region((PCIDevice *)d, 1, 0x4,
3113 PCI_ADDRESS_SPACE_IO, ide_map);
3114 pci_register_io_region((PCIDevice *)d, 2, 0x8,
3115 PCI_ADDRESS_SPACE_IO, ide_map);
3116 pci_register_io_region((PCIDevice *)d, 3, 0x4,
3117 PCI_ADDRESS_SPACE_IO, ide_map);
3118 pci_register_io_region((PCIDevice *)d, 4, 0x10,
3119 PCI_ADDRESS_SPACE_IO, bmdma_map);
3120
3121 pci_conf[0x3d] = 0x01; // interrupt on pin 1
3122
3123 for(i = 0; i < 4; i++)
3124 d->ide_if[i].pci_dev = (PCIDevice *)d;
3125
3126 irq = qemu_allocate_irqs(cmd646_set_irq, d, 2);
3127 ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], irq[0]);
3128 ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], irq[1]);
3129 }
3130
3131 static void pci_ide_save(QEMUFile* f, void *opaque)
3132 {
3133 PCIIDEState *d = opaque;
3134 int i;
3135
3136 pci_device_save(&d->dev, f);
3137
3138 for(i = 0; i < 2; i++) {
3139 BMDMAState *bm = &d->bmdma[i];
3140 qemu_put_8s(f, &bm->cmd);
3141 qemu_put_8s(f, &bm->status);
3142 qemu_put_be32s(f, &bm->addr);
3143 /* XXX: if a transfer is pending, we do not save it yet */
3144 }
3145
3146 /* per IDE interface data */
3147 for(i = 0; i < 2; i++) {
3148 IDEState *s = &d->ide_if[i * 2];
3149 uint8_t drive1_selected;
3150 qemu_put_8s(f, &s->cmd);
3151 drive1_selected = (s->cur_drive != s);
3152 qemu_put_8s(f, &drive1_selected);
3153 }
3154
3155 /* per IDE drive data */
3156 for(i = 0; i < 4; i++) {
3157 ide_save(f, &d->ide_if[i]);
3158 }
3159 }
3160
3161 static int pci_ide_load(QEMUFile* f, void *opaque, int version_id)
3162 {
3163 PCIIDEState *d = opaque;
3164 int ret, i;
3165
3166 if (version_id != 1)
3167 return -EINVAL;
3168 ret = pci_device_load(&d->dev, f);
3169 if (ret < 0)
3170 return ret;
3171
3172 for(i = 0; i < 2; i++) {
3173 BMDMAState *bm = &d->bmdma[i];
3174 qemu_get_8s(f, &bm->cmd);
3175 qemu_get_8s(f, &bm->status);
3176 qemu_get_be32s(f, &bm->addr);
3177 /* XXX: if a transfer is pending, we do not save it yet */
3178 }
3179
3180 /* per IDE interface data */
3181 for(i = 0; i < 2; i++) {
3182 IDEState *s = &d->ide_if[i * 2];
3183 uint8_t drive1_selected;
3184 qemu_get_8s(f, &s->cmd);
3185 qemu_get_8s(f, &drive1_selected);
3186 s->cur_drive = &d->ide_if[i * 2 + (drive1_selected != 0)];
3187 }
3188
3189 /* per IDE drive data */
3190 for(i = 0; i < 4; i++) {
3191 ide_load(f, &d->ide_if[i]);
3192 }
3193 return 0;
3194 }
3195
3196 static void piix3_reset(void *opaque)
3197 {
3198 PCIIDEState *d = opaque;
3199 uint8_t *pci_conf = d->dev.config;
3200 int i;
3201
3202 for (i = 0; i < 2; i++)
3203 ide_dma_cancel(&d->bmdma[i]);
3204
3205 pci_conf[0x04] = 0x00;
3206 pci_conf[0x05] = 0x00;
3207 pci_conf[0x06] = 0x80; /* FBC */
3208 pci_conf[0x07] = 0x02; // PCI_status_devsel_medium
3209 pci_conf[0x20] = 0x01; /* BMIBA: 20-23h */
3210 }
3211
3212 /* hd_table must contain 4 block drivers */
3213 /* NOTE: for the PIIX3, the IRQs and IOports are hardcoded */
3214 void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
3215 qemu_irq *pic)
3216 {
3217 PCIIDEState *d;
3218 uint8_t *pci_conf;
3219
3220 /* register a function 1 of PIIX3 */
3221 d = (PCIIDEState *)pci_register_device(bus, "PIIX3 IDE",
3222 sizeof(PCIIDEState),
3223 devfn,
3224 NULL, NULL);
3225 d->type = IDE_TYPE_PIIX3;
3226
3227 pci_conf = d->dev.config;
3228 pci_conf[0x00] = 0x86; // Intel
3229 pci_conf[0x01] = 0x80;
3230 pci_conf[0x02] = 0x10;
3231 pci_conf[0x03] = 0x70;
3232 pci_conf[0x09] = 0x80; // legacy ATA mode
3233 pci_conf[0x0a] = 0x01; // class_sub = PCI_IDE
3234 pci_conf[0x0b] = 0x01; // class_base = PCI_mass_storage
3235 pci_conf[0x0e] = 0x00; // header_type
3236
3237 qemu_register_reset(piix3_reset, d);
3238 piix3_reset(d);
3239
3240 pci_register_io_region((PCIDevice *)d, 4, 0x10,
3241 PCI_ADDRESS_SPACE_IO, bmdma_map);
3242
3243 ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], pic[14]);
3244 ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], pic[15]);
3245 ide_init_ioport(&d->ide_if[0], 0x1f0, 0x3f6);
3246 ide_init_ioport(&d->ide_if[2], 0x170, 0x376);
3247
3248 register_savevm("ide", 0, 1, pci_ide_save, pci_ide_load, d);
3249 }
3250
3251 /* hd_table must contain 4 block drivers */
3252 /* NOTE: for the PIIX4, the IRQs and IOports are hardcoded */
3253 void pci_piix4_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
3254 qemu_irq *pic)
3255 {
3256 PCIIDEState *d;
3257 uint8_t *pci_conf;
3258
3259 /* register a function 1 of PIIX4 */
3260 d = (PCIIDEState *)pci_register_device(bus, "PIIX4 IDE",
3261 sizeof(PCIIDEState),
3262 devfn,
3263 NULL, NULL);
3264 d->type = IDE_TYPE_PIIX4;
3265
3266 pci_conf = d->dev.config;
3267 pci_conf[0x00] = 0x86; // Intel
3268 pci_conf[0x01] = 0x80;
3269 pci_conf[0x02] = 0x11;
3270 pci_conf[0x03] = 0x71;
3271 pci_conf[0x09] = 0x80; // legacy ATA mode
3272 pci_conf[0x0a] = 0x01; // class_sub = PCI_IDE
3273 pci_conf[0x0b] = 0x01; // class_base = PCI_mass_storage
3274 pci_conf[0x0e] = 0x00; // header_type
3275
3276 qemu_register_reset(piix3_reset, d);
3277 piix3_reset(d);
3278
3279 pci_register_io_region((PCIDevice *)d, 4, 0x10,
3280 PCI_ADDRESS_SPACE_IO, bmdma_map);
3281
3282 ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], pic[14]);
3283 ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], pic[15]);
3284 ide_init_ioport(&d->ide_if[0], 0x1f0, 0x3f6);
3285 ide_init_ioport(&d->ide_if[2], 0x170, 0x376);
3286
3287 register_savevm("ide", 0, 1, pci_ide_save, pci_ide_load, d);
3288 }
3289
3290 /***********************************************************/
3291 /* MacIO based PowerPC IDE */
3292
3293 /* PowerMac IDE memory IO */
3294 static void pmac_ide_writeb (void *opaque,
3295 target_phys_addr_t addr, uint32_t val)
3296 {
3297 addr = (addr & 0xFFF) >> 4;
3298 switch (addr) {
3299 case 1 ... 7:
3300 ide_ioport_write(opaque, addr, val);
3301 break;
3302 case 8:
3303 case 22:
3304 ide_cmd_write(opaque, 0, val);
3305 break;
3306 default:
3307 break;
3308 }
3309 }
3310
3311 static uint32_t pmac_ide_readb (void *opaque,target_phys_addr_t addr)
3312 {
3313 uint8_t retval;
3314
3315 addr = (addr & 0xFFF) >> 4;
3316 switch (addr) {
3317 case 1 ... 7:
3318 retval = ide_ioport_read(opaque, addr);
3319 break;
3320 case 8:
3321 case 22:
3322 retval = ide_status_read(opaque, 0);
3323 break;
3324 default:
3325 retval = 0xFF;
3326 break;
3327 }
3328 return retval;
3329 }
3330
3331 static void pmac_ide_writew (void *opaque,
3332 target_phys_addr_t addr, uint32_t val)
3333 {
3334 addr = (addr & 0xFFF) >> 4;
3335 #ifdef TARGET_WORDS_BIGENDIAN
3336 val = bswap16(val);
3337 #endif
3338 if (addr == 0) {
3339 ide_data_writew(opaque, 0, val);
3340 }
3341 }
3342
3343 static uint32_t pmac_ide_readw (void *opaque,target_phys_addr_t addr)
3344 {
3345 uint16_t retval;
3346
3347 addr = (addr & 0xFFF) >> 4;
3348 if (addr == 0) {
3349 retval = ide_data_readw(opaque, 0);
3350 } else {
3351 retval = 0xFFFF;
3352 }
3353 #ifdef TARGET_WORDS_BIGENDIAN
3354 retval = bswap16(retval);
3355 #endif
3356 return retval;
3357 }
3358
3359 static void pmac_ide_writel (void *opaque,
3360 target_phys_addr_t addr, uint32_t val)
3361 {
3362 addr = (addr & 0xFFF) >> 4;
3363 #ifdef TARGET_WORDS_BIGENDIAN
3364 val = bswap32(val);
3365 #endif
3366 if (addr == 0) {
3367 ide_data_writel(opaque, 0, val);
3368 }
3369 }
3370
3371 static uint32_t pmac_ide_readl (void *opaque,target_phys_addr_t addr)
3372 {
3373 uint32_t retval;
3374
3375 addr = (addr & 0xFFF) >> 4;
3376 if (addr == 0) {
3377 retval = ide_data_readl(opaque, 0);
3378 } else {
3379 retval = 0xFFFFFFFF;
3380 }
3381 #ifdef TARGET_WORDS_BIGENDIAN
3382 retval = bswap32(retval);
3383 #endif
3384 return retval;
3385 }
3386
3387 static CPUWriteMemoryFunc *pmac_ide_write[] = {
3388 pmac_ide_writeb,
3389 pmac_ide_writew,
3390 pmac_ide_writel,
3391 };
3392
3393 static CPUReadMemoryFunc *pmac_ide_read[] = {
3394 pmac_ide_readb,
3395 pmac_ide_readw,
3396 pmac_ide_readl,
3397 };
3398
3399 /* hd_table must contain 4 block drivers */
3400 /* PowerMac uses memory mapped registers, not I/O. Return the memory
3401 I/O index to access the ide. */
3402 int pmac_ide_init (BlockDriverState **hd_table, qemu_irq irq)
3403 {
3404 IDEState *ide_if;
3405 int pmac_ide_memory;
3406
3407 ide_if = qemu_mallocz(sizeof(IDEState) * 2);
3408 ide_init2(&ide_if[0], hd_table[0], hd_table[1], irq);
3409
3410 pmac_ide_memory = cpu_register_io_memory(0, pmac_ide_read,
3411 pmac_ide_write, &ide_if[0]);
3412 return pmac_ide_memory;
3413 }
3414
3415 /***********************************************************/
3416 /* CF-ATA Microdrive */
3417
3418 #define METADATA_SIZE 0x20
3419
3420 /* DSCM-1XXXX Microdrive hard disk with CF+ II / PCMCIA interface. */
3421 struct md_s {
3422 IDEState ide[2];
3423 struct pcmcia_card_s card;
3424 uint32_t attr_base;
3425 uint32_t io_base;
3426
3427 /* Card state */
3428 uint8_t opt;
3429 uint8_t stat;
3430 uint8_t pins;
3431
3432 uint8_t ctrl;
3433 uint16_t io;
3434 int cycle;
3435 };
3436
3437 /* Register bitfields */
3438 enum md_opt {
3439 OPT_MODE_MMAP = 0,
3440 OPT_MODE_IOMAP16 = 1,
3441 OPT_MODE_IOMAP1 = 2,
3442 OPT_MODE_IOMAP2 = 3,
3443 OPT_MODE = 0x3f,
3444 OPT_LEVIREQ = 0x40,
3445 OPT_SRESET = 0x80,
3446 };
3447 enum md_cstat {
3448 STAT_INT = 0x02,
3449 STAT_PWRDWN = 0x04,
3450 STAT_XE = 0x10,
3451 STAT_IOIS8 = 0x20,
3452 STAT_SIGCHG = 0x40,
3453 STAT_CHANGED = 0x80,
3454 };
3455 enum md_pins {
3456 PINS_MRDY = 0x02,
3457 PINS_CRDY = 0x20,
3458 };
3459 enum md_ctrl {
3460 CTRL_IEN = 0x02,
3461 CTRL_SRST = 0x04,
3462 };
3463
3464 static inline void md_interrupt_update(struct md_s *s)
3465 {
3466 if (!s->card.slot)
3467 return;
3468
3469 qemu_set_irq(s->card.slot->irq,
3470 !(s->stat & STAT_INT) && /* Inverted */
3471 !(s->ctrl & (CTRL_IEN | CTRL_SRST)) &&
3472 !(s->opt & OPT_SRESET));
3473 }
3474
3475 static void md_set_irq(void *opaque, int irq, int level)
3476 {
3477 struct md_s *s = (struct md_s *) opaque;
3478 if (level)
3479 s->stat |= STAT_INT;
3480 else
3481 s->stat &= ~STAT_INT;
3482
3483 md_interrupt_update(s);
3484 }
3485
3486 static void md_reset(struct md_s *s)
3487 {
3488 s->opt = OPT_MODE_MMAP;
3489 s->stat = 0;
3490 s->pins = 0;
3491 s->cycle = 0;
3492 s->ctrl = 0;
3493 ide_reset(s->ide);
3494 }
3495
3496 static uint8_t md_attr_read(void *opaque, uint32_t at)
3497 {
3498 struct md_s *s = (struct md_s *) opaque;
3499 if (at < s->attr_base) {
3500 if (at < s->card.cis_len)
3501 return s->card.cis[at];
3502 else
3503 return 0x00;
3504 }
3505
3506 at -= s->attr_base;
3507
3508 switch (at) {
3509 case 0x00: /* Configuration Option Register */
3510 return s->opt;
3511 case 0x02: /* Card Configuration Status Register */
3512 if (s->ctrl & CTRL_IEN)
3513 return s->stat & ~STAT_INT;
3514 else
3515 return s->stat;
3516 case 0x04: /* Pin Replacement Register */
3517 return (s->pins & PINS_CRDY) | 0x0c;
3518 case 0x06: /* Socket and Copy Register */
3519 return 0x00;
3520 #ifdef VERBOSE
3521 default:
3522 printf("%s: Bad attribute space register %02x\n", __FUNCTION__, at);
3523 #endif
3524 }
3525
3526 return 0;
3527 }
3528
3529 static void md_attr_write(void *opaque, uint32_t at, uint8_t value)
3530 {
3531 struct md_s *s = (struct md_s *) opaque;
3532 at -= s->attr_base;
3533
3534 switch (at) {
3535 case 0x00: /* Configuration Option Register */
3536 s->opt = value & 0xcf;
3537 if (value & OPT_SRESET)
3538 md_reset(s);
3539 md_interrupt_update(s);
3540 break;
3541 case 0x02: /* Card Configuration Status Register */
3542 if ((s->stat ^ value) & STAT_PWRDWN)
3543 s->pins |= PINS_CRDY;
3544 s->stat &= 0x82;
3545 s->stat |= value & 0x74;
3546 md_interrupt_update(s);
3547 /* Word 170 in Identify Device must be equal to STAT_XE */
3548 break;
3549 case 0x04: /* Pin Replacement Register */
3550 s->pins &= PINS_CRDY;
3551 s->pins |= value & PINS_MRDY;
3552 break;
3553 case 0x06: /* Socket and Copy Register */
3554 break;
3555 default:
3556 printf("%s: Bad attribute space register %02x\n", __FUNCTION__, at);
3557 }
3558 }
3559
3560 static uint16_t md_common_read(void *opaque, uint32_t at)
3561 {
3562 struct md_s *s = (struct md_s *) opaque;
3563 uint16_t ret;
3564 at -= s->io_base;
3565
3566 switch (s->opt & OPT_MODE) {
3567 case OPT_MODE_MMAP:
3568 if ((at & ~0x3ff) == 0x400)
3569 at = 0;
3570 break;
3571 case OPT_MODE_IOMAP16:
3572 at &= 0xf;
3573 break;
3574 case OPT_MODE_IOMAP1:
3575 if ((at & ~0xf) == 0x3f0)
3576 at -= 0x3e8;
3577 else if ((at & ~0xf) == 0x1f0)
3578 at -= 0x1f0;
3579 break;
3580 case OPT_MODE_IOMAP2:
3581 if ((at & ~0xf) == 0x370)
3582 at -= 0x368;
3583 else if ((at & ~0xf) == 0x170)
3584 at -= 0x170;
3585 }
3586
3587 switch (at) {
3588 case 0x0: /* Even RD Data */
3589 case 0x8:
3590 return ide_data_readw(s->ide, 0);
3591
3592 /* TODO: 8-bit accesses */
3593 if (s->cycle)
3594 ret = s->io >> 8;
3595 else {
3596 s->io = ide_data_readw(s->ide, 0);
3597 ret = s->io & 0xff;
3598 }
3599 s->cycle = !s->cycle;
3600 return ret;
3601 case 0x9: /* Odd RD Data */
3602 return s->io >> 8;
3603 case 0xd: /* Error */
3604 return ide_ioport_read(s->ide, 0x1);
3605 case 0xe: /* Alternate Status */
3606 if (s->ide->cur_drive->bs)
3607 return s->ide->cur_drive->status;
3608 else
3609 return 0;
3610 case 0xf: /* Device Address */
3611 return 0xc2 | ((~s->ide->select << 2) & 0x3c);
3612 default:
3613 return ide_ioport_read(s->ide, at);
3614 }
3615
3616 return 0;
3617 }
3618
3619 static void md_common_write(void *opaque, uint32_t at, uint16_t value)
3620 {
3621 struct md_s *s = (struct md_s *) opaque;
3622 at -= s->io_base;
3623
3624 switch (s->opt & OPT_MODE) {
3625 case OPT_MODE_MMAP:
3626 if ((at & ~0x3ff) == 0x400)
3627 at = 0;
3628 break;
3629 case OPT_MODE_IOMAP16:
3630 at &= 0xf;
3631 break;
3632 case OPT_MODE_IOMAP1:
3633 if ((at & ~0xf) == 0x3f0)
3634 at -= 0x3e8;
3635 else if ((at & ~0xf) == 0x1f0)
3636 at -= 0x1f0;
3637 break;
3638 case OPT_MODE_IOMAP2:
3639 if ((at & ~0xf) == 0x370)
3640 at -= 0x368;
3641 else if ((at & ~0xf) == 0x170)
3642 at -= 0x170;
3643 }
3644
3645 switch (at) {
3646 case 0x0: /* Even WR Data */
3647 case 0x8:
3648 ide_data_writew(s->ide, 0, value);
3649 break;
3650
3651 /* TODO: 8-bit accesses */
3652 if (s->cycle)
3653 ide_data_writew(s->ide, 0, s->io | (value << 8));
3654 else
3655 s->io = value & 0xff;
3656 s->cycle = !s->cycle;
3657 break;
3658 case 0x9:
3659 s->io = value & 0xff;
3660 s->cycle = !s->cycle;
3661 break;
3662 case 0xd: /* Features */
3663 ide_ioport_write(s->ide, 0x1, value);
3664 break;
3665 case 0xe: /* Device Control */
3666 s->ctrl = value;
3667 if (value & CTRL_SRST)
3668 md_reset(s);
3669 md_interrupt_update(s);
3670 break;
3671 default:
3672 if (s->stat & STAT_PWRDWN) {
3673 s->pins |= PINS_CRDY;
3674 s->stat &= ~STAT_PWRDWN;
3675 }
3676 ide_ioport_write(s->ide, at, value);
3677 }
3678 }
3679
3680 static void md_save(QEMUFile *f, void *opaque)
3681 {
3682 struct md_s *s = (struct md_s *) opaque;
3683 int i;
3684 uint8_t drive1_selected;
3685
3686 qemu_put_8s(f, &s->opt);
3687 qemu_put_8s(f, &s->stat);
3688 qemu_put_8s(f, &s->pins);
3689
3690 qemu_put_8s(f, &s->ctrl);
3691 qemu_put_be16s(f, &s->io);
3692 qemu_put_byte(f, s->cycle);
3693
3694 drive1_selected = (s->ide->cur_drive != s->ide);
3695 qemu_put_8s(f, &s->ide->cmd);
3696 qemu_put_8s(f, &drive1_selected);
3697
3698 for (i = 0; i < 2; i ++)
3699 ide_save(f, &s->ide[i]);
3700 }
3701
3702 static int md_load(QEMUFile *f, void *opaque, int version_id)
3703 {
3704 struct md_s *s = (struct md_s *) opaque;
3705 int i;
3706 uint8_t drive1_selected;
3707
3708 qemu_get_8s(f, &s->opt);
3709 qemu_get_8s(f, &s->stat);
3710 qemu_get_8s(f, &s->pins);
3711
3712 qemu_get_8s(f, &s->ctrl);
3713 qemu_get_be16s(f, &s->io);
3714 s->cycle = qemu_get_byte(f);
3715
3716 qemu_get_8s(f, &s->ide->cmd);
3717 qemu_get_8s(f, &drive1_selected);
3718 s->ide->cur_drive = &s->ide[(drive1_selected != 0)];
3719
3720 for (i = 0; i < 2; i ++)
3721 ide_load(f, &s->ide[i]);
3722
3723 return 0;
3724 }
3725
3726 static const uint8_t dscm1xxxx_cis[0x14a] = {
3727 [0x000] = CISTPL_DEVICE, /* 5V Device Information */
3728 [0x002] = 0x03, /* Tuple length = 4 bytes */
3729 [0x004] = 0xdb, /* ID: DTYPE_FUNCSPEC, non WP, DSPEED_150NS */
3730 [0x006] = 0x01, /* Size = 2K bytes */
3731 [0x008] = CISTPL_ENDMARK,
3732
3733 [0x00a] = CISTPL_DEVICE_OC, /* Additional Device Information */
3734 [0x00c] = 0x04, /* Tuple length = 4 byest */
3735 [0x00e] = 0x03, /* Conditions: Ext = 0, Vcc 3.3V, MWAIT = 1 */
3736 [0x010] = 0xdb, /* ID: DTYPE_FUNCSPEC, non WP, DSPEED_150NS */
3737 [0x012] = 0x01, /* Size = 2K bytes */
3738 [0x014] = CISTPL_ENDMARK,
3739
3740 [0x016] = CISTPL_JEDEC_C, /* JEDEC ID */
3741 [0x018] = 0x02, /* Tuple length = 2 bytes */
3742 [0x01a] = 0xdf, /* PC Card ATA with no Vpp required */
3743 [0x01c] = 0x01,
3744
3745 [0x01e] = CISTPL_MANFID, /* Manufacture ID */
3746 [0x020] = 0x04, /* Tuple length = 4 bytes */
3747 [0x022] = 0xa4, /* TPLMID_MANF = 00a4 (IBM) */
3748 [0x024] = 0x00,
3749 [0x026] = 0x00, /* PLMID_CARD = 0000 */
3750 [0x028] = 0x00,
3751
3752 [0x02a] = CISTPL_VERS_1, /* Level 1 Version */
3753 [0x02c] = 0x12, /* Tuple length = 23 bytes */
3754 [0x02e] = 0x04, /* Major Version = JEIDA 4.2 / PCMCIA 2.1 */
3755 [0x030] = 0x01, /* Minor Version = 1 */
3756 [0x032] = 'I',
3757 [0x034] = 'B',
3758 [0x036] = 'M',
3759 [0x038] = 0x00,
3760 [0x03a] = 'm',
3761 [0x03c] = 'i',
3762 [0x03e] = 'c',
3763 [0x040] = 'r',
3764 [0x042] = 'o',
3765 [0x044] = 'd',
3766 [0x046] = 'r',
3767 [0x048] = 'i',
3768 [0x04a] = 'v',
3769 [0x04c] = 'e',
3770 [0x04e] = 0x00,
3771 [0x050] = CISTPL_ENDMARK,
3772
3773 [0x052] = CISTPL_FUNCID, /* Function ID */
3774 [0x054] = 0x02, /* Tuple length = 2 bytes */
3775 [0x056] = 0x04, /* TPLFID_FUNCTION = Fixed Disk */
3776 [0x058] = 0x01, /* TPLFID_SYSINIT: POST = 1, ROM = 0 */
3777
3778 [0x05a] = CISTPL_FUNCE, /* Function Extension */
3779 [0x05c] = 0x02, /* Tuple length = 2 bytes */
3780 [0x05e] = 0x01, /* TPLFE_TYPE = Disk Device Interface */
3781 [0x060] = 0x01, /* TPLFE_DATA = PC Card ATA Interface */
3782
3783 [0x062] = CISTPL_FUNCE, /* Function Extension */
3784 [0x064] = 0x03, /* Tuple length = 3 bytes */
3785 [0x066] = 0x02, /* TPLFE_TYPE = Basic PC Card ATA Interface */
3786 [0x068] = 0x08, /* TPLFE_DATA: Rotating, Unique, Single */
3787 [0x06a] = 0x0f, /* TPLFE_DATA: Sleep, Standby, Idle, Auto */
3788
3789 [0x06c] = CISTPL_CONFIG, /* Configuration */
3790 [0x06e] = 0x05, /* Tuple length = 5 bytes */
3791 [0x070] = 0x01, /* TPCC_RASZ = 2 bytes, TPCC_RMSZ = 1 byte */
3792 [0x072] = 0x07, /* TPCC_LAST = 7 */
3793 [0x074] = 0x00, /* TPCC_RADR = 0200 */
3794 [0x076] = 0x02,
3795 [0x078] = 0x0f, /* TPCC_RMSK = 200, 202, 204, 206 */
3796
3797 [0x07a] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3798 [0x07c] = 0x0b, /* Tuple length = 11 bytes */
3799 [0x07e] = 0xc0, /* TPCE_INDX = Memory Mode, Default, Iface */
3800 [0x080] = 0xc0, /* TPCE_IF = Memory, no BVDs, no WP, READY */
3801 [0x082] = 0xa1, /* TPCE_FS = Vcc only, no I/O, Memory, Misc */
3802 [0x084] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
3803 [0x086] = 0x55, /* NomV: 5.0 V */
3804 [0x088] = 0x4d, /* MinV: 4.5 V */
3805 [0x08a] = 0x5d, /* MaxV: 5.5 V */
3806 [0x08c] = 0x4e, /* Peakl: 450 mA */
3807 [0x08e] = 0x08, /* TPCE_MS = 1 window, 1 byte, Host address */
3808 [0x090] = 0x00, /* Window descriptor: Window length = 0 */
3809 [0x092] = 0x20, /* TPCE_MI: support power down mode, RW */
3810
3811 [0x094] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3812 [0x096] = 0x06, /* Tuple length = 6 bytes */
3813 [0x098] = 0x00, /* TPCE_INDX = Memory Mode, no Default */
3814 [0x09a] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
3815 [0x09c] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
3816 [0x09e] = 0xb5, /* NomV: 3.3 V */
3817 [0x0a0] = 0x1e,
3818 [0x0a2] = 0x3e, /* Peakl: 350 mA */
3819
3820 [0x0a4] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3821 [0x0a6] = 0x0d, /* Tuple length = 13 bytes */
3822 [0x0a8] = 0xc1, /* TPCE_INDX = I/O and Memory Mode, Default */
3823 [0x0aa] = 0x41, /* TPCE_IF = I/O and Memory, no BVD, no WP */
3824 [0x0ac] = 0x99, /* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
3825 [0x0ae] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
3826 [0x0b0] = 0x55, /* NomV: 5.0 V */
3827 [0x0b2] = 0x4d, /* MinV: 4.5 V */
3828 [0x0b4] = 0x5d, /* MaxV: 5.5 V */
3829 [0x0b6] = 0x4e, /* Peakl: 450 mA */
3830 [0x0b8] = 0x64, /* TPCE_IO = 16-byte boundary, 16/8 accesses */
3831 [0x0ba] = 0xf0, /* TPCE_IR = MASK, Level, Pulse, Share */
3832 [0x0bc] = 0xff, /* IRQ0..IRQ7 supported */
3833 [0x0be] = 0xff, /* IRQ8..IRQ15 supported */
3834 [0x0c0] = 0x20, /* TPCE_MI = support power down mode */
3835
3836 [0x0c2] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3837 [0x0c4] = 0x06, /* Tuple length = 6 bytes */
3838 [0x0c6] = 0x01, /* TPCE_INDX = I/O and Memory Mode */
3839 [0x0c8] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
3840 [0x0ca] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
3841 [0x0cc] = 0xb5, /* NomV: 3.3 V */
3842 [0x0ce] = 0x1e,
3843 [0x0d0] = 0x3e, /* Peakl: 350 mA */
3844
3845 [0x0d2] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3846 [0x0d4] = 0x12, /* Tuple length = 18 bytes */
3847 [0x0d6] = 0xc2, /* TPCE_INDX = I/O Primary Mode */
3848 [0x0d8] = 0x41, /* TPCE_IF = I/O and Memory, no BVD, no WP */
3849 [0x0da] = 0x99, /* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
3850 [0x0dc] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
3851 [0x0de] = 0x55, /* NomV: 5.0 V */
3852 [0x0e0] = 0x4d, /* MinV: 4.5 V */
3853 [0x0e2] = 0x5d, /* MaxV: 5.5 V */
3854 [0x0e4] = 0x4e, /* Peakl: 450 mA */
3855 [0x0e6] = 0xea, /* TPCE_IO = 1K boundary, 16/8 access, Range */
3856 [0x0e8] = 0x61, /* Range: 2 fields, 2 bytes addr, 1 byte len */
3857 [0x0ea] = 0xf0, /* Field 1 address = 0x01f0 */
3858 [0x0ec] = 0x01,
3859 [0x0ee] = 0x07, /* Address block length = 8 */
3860 [0x0f0] = 0xf6, /* Field 2 address = 0x03f6 */
3861 [0x0f2] = 0x03,
3862 [0x0f4] = 0x01, /* Address block length = 2 */
3863 [0x0f6] = 0xee, /* TPCE_IR = IRQ E, Level, Pulse, Share */
3864 [0x0f8] = 0x20, /* TPCE_MI = support power down mode */
3865
3866 [0x0fa] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3867 [0x0fc] = 0x06, /* Tuple length = 6 bytes */
3868 [0x0fe] = 0x02, /* TPCE_INDX = I/O Primary Mode, no Default */
3869 [0x100] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
3870 [0x102] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
3871 [0x104] = 0xb5, /* NomV: 3.3 V */
3872 [0x106] = 0x1e,
3873 [0x108] = 0x3e, /* Peakl: 350 mA */
3874
3875 [0x10a] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3876 [0x10c] = 0x12, /* Tuple length = 18 bytes */
3877 [0x10e] = 0xc3, /* TPCE_INDX = I/O Secondary Mode, Default */
3878 [0x110] = 0x41, /* TPCE_IF = I/O and Memory, no BVD, no WP */
3879 [0x112] = 0x99, /* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
3880 [0x114] = 0x27, /* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
3881 [0x116] = 0x55, /* NomV: 5.0 V */
3882 [0x118] = 0x4d, /* MinV: 4.5 V */
3883 [0x11a] = 0x5d, /* MaxV: 5.5 V */
3884 [0x11c] = 0x4e, /* Peakl: 450 mA */
3885 [0x11e] = 0xea, /* TPCE_IO = 1K boundary, 16/8 access, Range */
3886 [0x120] = 0x61, /* Range: 2 fields, 2 byte addr, 1 byte len */
3887 [0x122] = 0x70, /* Field 1 address = 0x0170 */
3888 [0x124] = 0x01,
3889 [0x126] = 0x07, /* Address block length = 8 */
3890 [0x128] = 0x76, /* Field 2 address = 0x0376 */
3891 [0x12a] = 0x03,
3892 [0x12c] = 0x01, /* Address block length = 2 */
3893 [0x12e] = 0xee, /* TPCE_IR = IRQ E, Level, Pulse, Share */
3894 [0x130] = 0x20, /* TPCE_MI = support power down mode */
3895
3896 [0x132] = CISTPL_CFTABLE_ENTRY, /* 16-bit PC Card Configuration */
3897 [0x134] = 0x06, /* Tuple length = 6 bytes */
3898 [0x136] = 0x03, /* TPCE_INDX = I/O Secondary Mode */
3899 [0x138] = 0x01, /* TPCE_FS = Vcc only, no I/O, no Memory */
3900 [0x13a] = 0x21, /* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
3901 [0x13c] = 0xb5, /* NomV: 3.3 V */
3902 [0x13e] = 0x1e,
3903 [0x140] = 0x3e, /* Peakl: 350 mA */
3904
3905 [0x142] = CISTPL_NO_LINK, /* No Link */
3906 [0x144] = 0x00, /* Tuple length = 0 bytes */
3907
3908 [0x146] = CISTPL_END, /* Tuple End */
3909 };
3910
3911 static int dscm1xxxx_attach(void *opaque)
3912 {
3913 struct md_s *md = (struct md_s *) opaque;
3914 md->card.attr_read = md_attr_read;
3915 md->card.attr_write = md_attr_write;
3916 md->card.common_read = md_common_read;
3917 md->card.common_write = md_common_write;
3918 md->card.io_read = md_common_read;
3919 md->card.io_write = md_common_write;
3920
3921 md->attr_base = md->card.cis[0x74] | (md->card.cis[0x76] << 8);
3922 md->io_base = 0x0;
3923
3924 md_reset(md);
3925 md_interrupt_update(md);
3926
3927 md->card.slot->card_string = "DSCM-1xxxx Hitachi Microdrive";
3928 return 0;
3929 }
3930
3931 static int dscm1xxxx_detach(void *opaque)
3932 {
3933 struct md_s *md = (struct md_s *) opaque;
3934 md_reset(md);
3935 return 0;
3936 }
3937
3938 struct pcmcia_card_s *dscm1xxxx_init(BlockDriverState *bdrv)
3939 {
3940 struct md_s *md = (struct md_s *) qemu_mallocz(sizeof(struct md_s));
3941 md->card.state = md;
3942 md->card.attach = dscm1xxxx_attach;
3943 md->card.detach = dscm1xxxx_detach;
3944 md->card.cis = dscm1xxxx_cis;
3945 md->card.cis_len = sizeof(dscm1xxxx_cis);
3946
3947 ide_init2(md->ide, bdrv, 0, qemu_allocate_irqs(md_set_irq, md, 1)[0]);
3948 md->ide->is_cf = 1;
3949 md->ide->mdata_size = METADATA_SIZE;
3950 md->ide->mdata_storage = (uint8_t *) qemu_mallocz(METADATA_SIZE);
3951
3952 register_savevm("microdrive", -1, 0, md_save, md_load, md);
3953
3954 return &md->card;
3955 }