xref: /openbmc/qemu/hw/block/fdc.c (revision 74433bf0)
1 /*
2  * QEMU Floppy disk emulator (Intel 82078)
3  *
4  * Copyright (c) 2003, 2007 Jocelyn Mayer
5  * Copyright (c) 2008 Hervé Poussineau
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  * The controller is used in Sun4m systems in a slightly different
27  * way. There are changes in DOR register and DMA is not available.
28  */
29 
30 #include "qemu/osdep.h"
31 #include "hw/hw.h"
32 #include "hw/block/fdc.h"
33 #include "qapi/error.h"
34 #include "qemu/error-report.h"
35 #include "qemu/timer.h"
36 #include "hw/isa/isa.h"
37 #include "hw/sysbus.h"
38 #include "hw/block/block.h"
39 #include "sysemu/block-backend.h"
40 #include "sysemu/blockdev.h"
41 #include "sysemu/sysemu.h"
42 #include "qemu/log.h"
43 #include "trace.h"
44 
45 /********************************************************/
46 /* debug Floppy devices */
47 
48 #define DEBUG_FLOPPY 0
49 
50 #define FLOPPY_DPRINTF(fmt, ...)                                \
51     do {                                                        \
52         if (DEBUG_FLOPPY) {                                     \
53             fprintf(stderr, "FLOPPY: " fmt , ## __VA_ARGS__);   \
54         }                                                       \
55     } while (0)
56 
57 
58 /********************************************************/
59 /* qdev floppy bus                                      */
60 
61 #define TYPE_FLOPPY_BUS "floppy-bus"
62 #define FLOPPY_BUS(obj) OBJECT_CHECK(FloppyBus, (obj), TYPE_FLOPPY_BUS)
63 
64 typedef struct FDCtrl FDCtrl;
65 typedef struct FDrive FDrive;
66 static FDrive *get_drv(FDCtrl *fdctrl, int unit);
67 
68 typedef struct FloppyBus {
69     BusState bus;
70     FDCtrl *fdc;
71 } FloppyBus;
72 
73 static const TypeInfo floppy_bus_info = {
74     .name = TYPE_FLOPPY_BUS,
75     .parent = TYPE_BUS,
76     .instance_size = sizeof(FloppyBus),
77 };
78 
79 static void floppy_bus_create(FDCtrl *fdc, FloppyBus *bus, DeviceState *dev)
80 {
81     qbus_create_inplace(bus, sizeof(FloppyBus), TYPE_FLOPPY_BUS, dev, NULL);
82     bus->fdc = fdc;
83 }
84 
85 
86 /********************************************************/
87 /* Floppy drive emulation                               */
88 
89 typedef enum FDriveRate {
90     FDRIVE_RATE_500K = 0x00,  /* 500 Kbps */
91     FDRIVE_RATE_300K = 0x01,  /* 300 Kbps */
92     FDRIVE_RATE_250K = 0x02,  /* 250 Kbps */
93     FDRIVE_RATE_1M   = 0x03,  /*   1 Mbps */
94 } FDriveRate;
95 
96 typedef enum FDriveSize {
97     FDRIVE_SIZE_UNKNOWN,
98     FDRIVE_SIZE_350,
99     FDRIVE_SIZE_525,
100 } FDriveSize;
101 
102 typedef struct FDFormat {
103     FloppyDriveType drive;
104     uint8_t last_sect;
105     uint8_t max_track;
106     uint8_t max_head;
107     FDriveRate rate;
108 } FDFormat;
109 
110 /* In many cases, the total sector size of a format is enough to uniquely
111  * identify it. However, there are some total sector collisions between
112  * formats of different physical size, and these are noted below by
113  * highlighting the total sector size for entries with collisions. */
114 static const FDFormat fd_formats[] = {
115     /* First entry is default format */
116     /* 1.44 MB 3"1/2 floppy disks */
117     { FLOPPY_DRIVE_TYPE_144, 18, 80, 1, FDRIVE_RATE_500K, }, /* 3.5" 2880 */
118     { FLOPPY_DRIVE_TYPE_144, 20, 80, 1, FDRIVE_RATE_500K, }, /* 3.5" 3200 */
119     { FLOPPY_DRIVE_TYPE_144, 21, 80, 1, FDRIVE_RATE_500K, },
120     { FLOPPY_DRIVE_TYPE_144, 21, 82, 1, FDRIVE_RATE_500K, },
121     { FLOPPY_DRIVE_TYPE_144, 21, 83, 1, FDRIVE_RATE_500K, },
122     { FLOPPY_DRIVE_TYPE_144, 22, 80, 1, FDRIVE_RATE_500K, },
123     { FLOPPY_DRIVE_TYPE_144, 23, 80, 1, FDRIVE_RATE_500K, },
124     { FLOPPY_DRIVE_TYPE_144, 24, 80, 1, FDRIVE_RATE_500K, },
125     /* 2.88 MB 3"1/2 floppy disks */
126     { FLOPPY_DRIVE_TYPE_288, 36, 80, 1, FDRIVE_RATE_1M, },
127     { FLOPPY_DRIVE_TYPE_288, 39, 80, 1, FDRIVE_RATE_1M, },
128     { FLOPPY_DRIVE_TYPE_288, 40, 80, 1, FDRIVE_RATE_1M, },
129     { FLOPPY_DRIVE_TYPE_288, 44, 80, 1, FDRIVE_RATE_1M, },
130     { FLOPPY_DRIVE_TYPE_288, 48, 80, 1, FDRIVE_RATE_1M, },
131     /* 720 kB 3"1/2 floppy disks */
132     { FLOPPY_DRIVE_TYPE_144,  9, 80, 1, FDRIVE_RATE_250K, }, /* 3.5" 1440 */
133     { FLOPPY_DRIVE_TYPE_144, 10, 80, 1, FDRIVE_RATE_250K, },
134     { FLOPPY_DRIVE_TYPE_144, 10, 82, 1, FDRIVE_RATE_250K, },
135     { FLOPPY_DRIVE_TYPE_144, 10, 83, 1, FDRIVE_RATE_250K, },
136     { FLOPPY_DRIVE_TYPE_144, 13, 80, 1, FDRIVE_RATE_250K, },
137     { FLOPPY_DRIVE_TYPE_144, 14, 80, 1, FDRIVE_RATE_250K, },
138     /* 1.2 MB 5"1/4 floppy disks */
139     { FLOPPY_DRIVE_TYPE_120, 15, 80, 1, FDRIVE_RATE_500K, },
140     { FLOPPY_DRIVE_TYPE_120, 18, 80, 1, FDRIVE_RATE_500K, }, /* 5.25" 2880 */
141     { FLOPPY_DRIVE_TYPE_120, 18, 82, 1, FDRIVE_RATE_500K, },
142     { FLOPPY_DRIVE_TYPE_120, 18, 83, 1, FDRIVE_RATE_500K, },
143     { FLOPPY_DRIVE_TYPE_120, 20, 80, 1, FDRIVE_RATE_500K, }, /* 5.25" 3200 */
144     /* 720 kB 5"1/4 floppy disks */
145     { FLOPPY_DRIVE_TYPE_120,  9, 80, 1, FDRIVE_RATE_250K, }, /* 5.25" 1440 */
146     { FLOPPY_DRIVE_TYPE_120, 11, 80, 1, FDRIVE_RATE_250K, },
147     /* 360 kB 5"1/4 floppy disks */
148     { FLOPPY_DRIVE_TYPE_120,  9, 40, 1, FDRIVE_RATE_300K, }, /* 5.25" 720 */
149     { FLOPPY_DRIVE_TYPE_120,  9, 40, 0, FDRIVE_RATE_300K, },
150     { FLOPPY_DRIVE_TYPE_120, 10, 41, 1, FDRIVE_RATE_300K, },
151     { FLOPPY_DRIVE_TYPE_120, 10, 42, 1, FDRIVE_RATE_300K, },
152     /* 320 kB 5"1/4 floppy disks */
153     { FLOPPY_DRIVE_TYPE_120,  8, 40, 1, FDRIVE_RATE_250K, },
154     { FLOPPY_DRIVE_TYPE_120,  8, 40, 0, FDRIVE_RATE_250K, },
155     /* 360 kB must match 5"1/4 better than 3"1/2... */
156     { FLOPPY_DRIVE_TYPE_144,  9, 80, 0, FDRIVE_RATE_250K, }, /* 3.5" 720 */
157     /* end */
158     { FLOPPY_DRIVE_TYPE_NONE, -1, -1, 0, 0, },
159 };
160 
161 static FDriveSize drive_size(FloppyDriveType drive)
162 {
163     switch (drive) {
164     case FLOPPY_DRIVE_TYPE_120:
165         return FDRIVE_SIZE_525;
166     case FLOPPY_DRIVE_TYPE_144:
167     case FLOPPY_DRIVE_TYPE_288:
168         return FDRIVE_SIZE_350;
169     default:
170         return FDRIVE_SIZE_UNKNOWN;
171     }
172 }
173 
174 #define GET_CUR_DRV(fdctrl) ((fdctrl)->cur_drv)
175 #define SET_CUR_DRV(fdctrl, drive) ((fdctrl)->cur_drv = (drive))
176 
177 /* Will always be a fixed parameter for us */
178 #define FD_SECTOR_LEN          512
179 #define FD_SECTOR_SC           2   /* Sector size code */
180 #define FD_RESET_SENSEI_COUNT  4   /* Number of sense interrupts on RESET */
181 
182 /* Floppy disk drive emulation */
183 typedef enum FDiskFlags {
184     FDISK_DBL_SIDES  = 0x01,
185 } FDiskFlags;
186 
187 struct FDrive {
188     FDCtrl *fdctrl;
189     BlockBackend *blk;
190     BlockConf *conf;
191     /* Drive status */
192     FloppyDriveType drive;    /* CMOS drive type        */
193     uint8_t perpendicular;    /* 2.88 MB access mode    */
194     /* Position */
195     uint8_t head;
196     uint8_t track;
197     uint8_t sect;
198     /* Media */
199     FloppyDriveType disk;     /* Current disk type      */
200     FDiskFlags flags;
201     uint8_t last_sect;        /* Nb sector per track    */
202     uint8_t max_track;        /* Nb of tracks           */
203     uint16_t bps;             /* Bytes per sector       */
204     uint8_t ro;               /* Is read-only           */
205     uint8_t media_changed;    /* Is media changed       */
206     uint8_t media_rate;       /* Data rate of medium    */
207 
208     bool media_validated;     /* Have we validated the media? */
209 };
210 
211 
212 static FloppyDriveType get_fallback_drive_type(FDrive *drv);
213 
214 /* Hack: FD_SEEK is expected to work on empty drives. However, QEMU
215  * currently goes through some pains to keep seeks within the bounds
216  * established by last_sect and max_track. Correcting this is difficult,
217  * as refactoring FDC code tends to expose nasty bugs in the Linux kernel.
218  *
219  * For now: allow empty drives to have large bounds so we can seek around,
220  * with the understanding that when a diskette is inserted, the bounds will
221  * properly tighten to match the geometry of that inserted medium.
222  */
223 static void fd_empty_seek_hack(FDrive *drv)
224 {
225     drv->last_sect = 0xFF;
226     drv->max_track = 0xFF;
227 }
228 
229 static void fd_init(FDrive *drv)
230 {
231     /* Drive */
232     drv->perpendicular = 0;
233     /* Disk */
234     drv->disk = FLOPPY_DRIVE_TYPE_NONE;
235     drv->last_sect = 0;
236     drv->max_track = 0;
237     drv->ro = true;
238     drv->media_changed = 1;
239 }
240 
241 #define NUM_SIDES(drv) ((drv)->flags & FDISK_DBL_SIDES ? 2 : 1)
242 
243 static int fd_sector_calc(uint8_t head, uint8_t track, uint8_t sect,
244                           uint8_t last_sect, uint8_t num_sides)
245 {
246     return (((track * num_sides) + head) * last_sect) + sect - 1;
247 }
248 
249 /* Returns current position, in sectors, for given drive */
250 static int fd_sector(FDrive *drv)
251 {
252     return fd_sector_calc(drv->head, drv->track, drv->sect, drv->last_sect,
253                           NUM_SIDES(drv));
254 }
255 
256 /* Returns current position, in bytes, for given drive */
257 static int fd_offset(FDrive *drv)
258 {
259     g_assert(fd_sector(drv) < INT_MAX >> BDRV_SECTOR_BITS);
260     return fd_sector(drv) << BDRV_SECTOR_BITS;
261 }
262 
263 /* Seek to a new position:
264  * returns 0 if already on right track
265  * returns 1 if track changed
266  * returns 2 if track is invalid
267  * returns 3 if sector is invalid
268  * returns 4 if seek is disabled
269  */
270 static int fd_seek(FDrive *drv, uint8_t head, uint8_t track, uint8_t sect,
271                    int enable_seek)
272 {
273     uint32_t sector;
274     int ret;
275 
276     if (track > drv->max_track ||
277         (head != 0 && (drv->flags & FDISK_DBL_SIDES) == 0)) {
278         FLOPPY_DPRINTF("try to read %d %02x %02x (max=%d %d %02x %02x)\n",
279                        head, track, sect, 1,
280                        (drv->flags & FDISK_DBL_SIDES) == 0 ? 0 : 1,
281                        drv->max_track, drv->last_sect);
282         return 2;
283     }
284     if (sect > drv->last_sect) {
285         FLOPPY_DPRINTF("try to read %d %02x %02x (max=%d %d %02x %02x)\n",
286                        head, track, sect, 1,
287                        (drv->flags & FDISK_DBL_SIDES) == 0 ? 0 : 1,
288                        drv->max_track, drv->last_sect);
289         return 3;
290     }
291     sector = fd_sector_calc(head, track, sect, drv->last_sect, NUM_SIDES(drv));
292     ret = 0;
293     if (sector != fd_sector(drv)) {
294 #if 0
295         if (!enable_seek) {
296             FLOPPY_DPRINTF("error: no implicit seek %d %02x %02x"
297                            " (max=%d %02x %02x)\n",
298                            head, track, sect, 1, drv->max_track,
299                            drv->last_sect);
300             return 4;
301         }
302 #endif
303         drv->head = head;
304         if (drv->track != track) {
305             if (drv->blk != NULL && blk_is_inserted(drv->blk)) {
306                 drv->media_changed = 0;
307             }
308             ret = 1;
309         }
310         drv->track = track;
311         drv->sect = sect;
312     }
313 
314     if (drv->blk == NULL || !blk_is_inserted(drv->blk)) {
315         ret = 2;
316     }
317 
318     return ret;
319 }
320 
321 /* Set drive back to track 0 */
322 static void fd_recalibrate(FDrive *drv)
323 {
324     FLOPPY_DPRINTF("recalibrate\n");
325     fd_seek(drv, 0, 0, 1, 1);
326 }
327 
328 /**
329  * Determine geometry based on inserted diskette.
330  * Will not operate on an empty drive.
331  *
332  * @return: 0 on success, -1 if the drive is empty.
333  */
334 static int pick_geometry(FDrive *drv)
335 {
336     BlockBackend *blk = drv->blk;
337     const FDFormat *parse;
338     uint64_t nb_sectors, size;
339     int i;
340     int match, size_match, type_match;
341     bool magic = drv->drive == FLOPPY_DRIVE_TYPE_AUTO;
342 
343     /* We can only pick a geometry if we have a diskette. */
344     if (!drv->blk || !blk_is_inserted(drv->blk) ||
345         drv->drive == FLOPPY_DRIVE_TYPE_NONE)
346     {
347         return -1;
348     }
349 
350     /* We need to determine the likely geometry of the inserted medium.
351      * In order of preference, we look for:
352      * (1) The same drive type and number of sectors,
353      * (2) The same diskette size and number of sectors,
354      * (3) The same drive type.
355      *
356      * In all cases, matches that occur higher in the drive table will take
357      * precedence over matches that occur later in the table.
358      */
359     blk_get_geometry(blk, &nb_sectors);
360     match = size_match = type_match = -1;
361     for (i = 0; ; i++) {
362         parse = &fd_formats[i];
363         if (parse->drive == FLOPPY_DRIVE_TYPE_NONE) {
364             break;
365         }
366         size = (parse->max_head + 1) * parse->max_track * parse->last_sect;
367         if (nb_sectors == size) {
368             if (magic || parse->drive == drv->drive) {
369                 /* (1) perfect match -- nb_sectors and drive type */
370                 goto out;
371             } else if (drive_size(parse->drive) == drive_size(drv->drive)) {
372                 /* (2) size match -- nb_sectors and physical medium size */
373                 match = (match == -1) ? i : match;
374             } else {
375                 /* This is suspicious -- Did the user misconfigure? */
376                 size_match = (size_match == -1) ? i : size_match;
377             }
378         } else if (type_match == -1) {
379             if ((parse->drive == drv->drive) ||
380                 (magic && (parse->drive == get_fallback_drive_type(drv)))) {
381                 /* (3) type match -- nb_sectors mismatch, but matches the type
382                  *     specified explicitly by the user, or matches the fallback
383                  *     default type when using the drive autodetect mechanism */
384                 type_match = i;
385             }
386         }
387     }
388 
389     /* No exact match found */
390     if (match == -1) {
391         if (size_match != -1) {
392             parse = &fd_formats[size_match];
393             FLOPPY_DPRINTF("User requested floppy drive type '%s', "
394                            "but inserted medium appears to be a "
395                            "%"PRId64" sector '%s' type\n",
396                            FloppyDriveType_str(drv->drive),
397                            nb_sectors,
398                            FloppyDriveType_str(parse->drive));
399         }
400         assert(type_match != -1 && "misconfigured fd_format");
401         match = type_match;
402     }
403     parse = &(fd_formats[match]);
404 
405  out:
406     if (parse->max_head == 0) {
407         drv->flags &= ~FDISK_DBL_SIDES;
408     } else {
409         drv->flags |= FDISK_DBL_SIDES;
410     }
411     drv->max_track = parse->max_track;
412     drv->last_sect = parse->last_sect;
413     drv->disk = parse->drive;
414     drv->media_rate = parse->rate;
415     return 0;
416 }
417 
418 static void pick_drive_type(FDrive *drv)
419 {
420     if (drv->drive != FLOPPY_DRIVE_TYPE_AUTO) {
421         return;
422     }
423 
424     if (pick_geometry(drv) == 0) {
425         drv->drive = drv->disk;
426     } else {
427         drv->drive = get_fallback_drive_type(drv);
428     }
429 
430     g_assert(drv->drive != FLOPPY_DRIVE_TYPE_AUTO);
431 }
432 
433 /* Revalidate a disk drive after a disk change */
434 static void fd_revalidate(FDrive *drv)
435 {
436     int rc;
437 
438     FLOPPY_DPRINTF("revalidate\n");
439     if (drv->blk != NULL) {
440         drv->ro = blk_is_read_only(drv->blk);
441         if (!blk_is_inserted(drv->blk)) {
442             FLOPPY_DPRINTF("No disk in drive\n");
443             drv->disk = FLOPPY_DRIVE_TYPE_NONE;
444             fd_empty_seek_hack(drv);
445         } else if (!drv->media_validated) {
446             rc = pick_geometry(drv);
447             if (rc) {
448                 FLOPPY_DPRINTF("Could not validate floppy drive media");
449             } else {
450                 drv->media_validated = true;
451                 FLOPPY_DPRINTF("Floppy disk (%d h %d t %d s) %s\n",
452                                (drv->flags & FDISK_DBL_SIDES) ? 2 : 1,
453                                drv->max_track, drv->last_sect,
454                                drv->ro ? "ro" : "rw");
455             }
456         }
457     } else {
458         FLOPPY_DPRINTF("No drive connected\n");
459         drv->last_sect = 0;
460         drv->max_track = 0;
461         drv->flags &= ~FDISK_DBL_SIDES;
462         drv->drive = FLOPPY_DRIVE_TYPE_NONE;
463         drv->disk = FLOPPY_DRIVE_TYPE_NONE;
464     }
465 }
466 
467 static void fd_change_cb(void *opaque, bool load, Error **errp)
468 {
469     FDrive *drive = opaque;
470 
471     if (!load) {
472         blk_set_perm(drive->blk, 0, BLK_PERM_ALL, &error_abort);
473     } else {
474         if (!blkconf_apply_backend_options(drive->conf,
475                                            blk_is_read_only(drive->blk), false,
476                                            errp)) {
477             return;
478         }
479     }
480 
481     drive->media_changed = 1;
482     drive->media_validated = false;
483     fd_revalidate(drive);
484 }
485 
486 static const BlockDevOps fd_block_ops = {
487     .change_media_cb = fd_change_cb,
488 };
489 
490 
491 #define TYPE_FLOPPY_DRIVE "floppy"
492 #define FLOPPY_DRIVE(obj) \
493      OBJECT_CHECK(FloppyDrive, (obj), TYPE_FLOPPY_DRIVE)
494 
495 typedef struct FloppyDrive {
496     DeviceState     qdev;
497     uint32_t        unit;
498     BlockConf       conf;
499     FloppyDriveType type;
500 } FloppyDrive;
501 
502 static Property floppy_drive_properties[] = {
503     DEFINE_PROP_UINT32("unit", FloppyDrive, unit, -1),
504     DEFINE_BLOCK_PROPERTIES(FloppyDrive, conf),
505     DEFINE_PROP_SIGNED("drive-type", FloppyDrive, type,
506                         FLOPPY_DRIVE_TYPE_AUTO, qdev_prop_fdc_drive_type,
507                         FloppyDriveType),
508     DEFINE_PROP_END_OF_LIST(),
509 };
510 
511 static void floppy_drive_realize(DeviceState *qdev, Error **errp)
512 {
513     FloppyDrive *dev = FLOPPY_DRIVE(qdev);
514     FloppyBus *bus = FLOPPY_BUS(qdev->parent_bus);
515     FDrive *drive;
516     int ret;
517 
518     if (dev->unit == -1) {
519         for (dev->unit = 0; dev->unit < MAX_FD; dev->unit++) {
520             drive = get_drv(bus->fdc, dev->unit);
521             if (!drive->blk) {
522                 break;
523             }
524         }
525     }
526 
527     if (dev->unit >= MAX_FD) {
528         error_setg(errp, "Can't create floppy unit %d, bus supports "
529                    "only %d units", dev->unit, MAX_FD);
530         return;
531     }
532 
533     drive = get_drv(bus->fdc, dev->unit);
534     if (drive->blk) {
535         error_setg(errp, "Floppy unit %d is in use", dev->unit);
536         return;
537     }
538 
539     if (!dev->conf.blk) {
540         /* Anonymous BlockBackend for an empty drive */
541         dev->conf.blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
542         ret = blk_attach_dev(dev->conf.blk, qdev);
543         assert(ret == 0);
544     }
545 
546     blkconf_blocksizes(&dev->conf);
547     if (dev->conf.logical_block_size != 512 ||
548         dev->conf.physical_block_size != 512)
549     {
550         error_setg(errp, "Physical and logical block size must "
551                    "be 512 for floppy");
552         return;
553     }
554 
555     /* rerror/werror aren't supported by fdc and therefore not even registered
556      * with qdev. So set the defaults manually before they are used in
557      * blkconf_apply_backend_options(). */
558     dev->conf.rerror = BLOCKDEV_ON_ERROR_AUTO;
559     dev->conf.werror = BLOCKDEV_ON_ERROR_AUTO;
560 
561     if (!blkconf_apply_backend_options(&dev->conf,
562                                        blk_is_read_only(dev->conf.blk),
563                                        false, errp)) {
564         return;
565     }
566 
567     /* 'enospc' is the default for -drive, 'report' is what blk_new() gives us
568      * for empty drives. */
569     if (blk_get_on_error(dev->conf.blk, 0) != BLOCKDEV_ON_ERROR_ENOSPC &&
570         blk_get_on_error(dev->conf.blk, 0) != BLOCKDEV_ON_ERROR_REPORT) {
571         error_setg(errp, "fdc doesn't support drive option werror");
572         return;
573     }
574     if (blk_get_on_error(dev->conf.blk, 1) != BLOCKDEV_ON_ERROR_REPORT) {
575         error_setg(errp, "fdc doesn't support drive option rerror");
576         return;
577     }
578 
579     drive->conf = &dev->conf;
580     drive->blk = dev->conf.blk;
581     drive->fdctrl = bus->fdc;
582 
583     fd_init(drive);
584     blk_set_dev_ops(drive->blk, &fd_block_ops, drive);
585 
586     /* Keep 'type' qdev property and FDrive->drive in sync */
587     drive->drive = dev->type;
588     pick_drive_type(drive);
589     dev->type = drive->drive;
590 
591     fd_revalidate(drive);
592 }
593 
594 static void floppy_drive_class_init(ObjectClass *klass, void *data)
595 {
596     DeviceClass *k = DEVICE_CLASS(klass);
597     k->realize = floppy_drive_realize;
598     set_bit(DEVICE_CATEGORY_STORAGE, k->categories);
599     k->bus_type = TYPE_FLOPPY_BUS;
600     k->props = floppy_drive_properties;
601     k->desc = "virtual floppy drive";
602 }
603 
604 static const TypeInfo floppy_drive_info = {
605     .name = TYPE_FLOPPY_DRIVE,
606     .parent = TYPE_DEVICE,
607     .instance_size = sizeof(FloppyDrive),
608     .class_init = floppy_drive_class_init,
609 };
610 
611 /********************************************************/
612 /* Intel 82078 floppy disk controller emulation          */
613 
614 static void fdctrl_reset(FDCtrl *fdctrl, int do_irq);
615 static void fdctrl_to_command_phase(FDCtrl *fdctrl);
616 static int fdctrl_transfer_handler (void *opaque, int nchan,
617                                     int dma_pos, int dma_len);
618 static void fdctrl_raise_irq(FDCtrl *fdctrl);
619 static FDrive *get_cur_drv(FDCtrl *fdctrl);
620 
621 static uint32_t fdctrl_read_statusA(FDCtrl *fdctrl);
622 static uint32_t fdctrl_read_statusB(FDCtrl *fdctrl);
623 static uint32_t fdctrl_read_dor(FDCtrl *fdctrl);
624 static void fdctrl_write_dor(FDCtrl *fdctrl, uint32_t value);
625 static uint32_t fdctrl_read_tape(FDCtrl *fdctrl);
626 static void fdctrl_write_tape(FDCtrl *fdctrl, uint32_t value);
627 static uint32_t fdctrl_read_main_status(FDCtrl *fdctrl);
628 static void fdctrl_write_rate(FDCtrl *fdctrl, uint32_t value);
629 static uint32_t fdctrl_read_data(FDCtrl *fdctrl);
630 static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value);
631 static uint32_t fdctrl_read_dir(FDCtrl *fdctrl);
632 static void fdctrl_write_ccr(FDCtrl *fdctrl, uint32_t value);
633 
634 enum {
635     FD_DIR_WRITE   = 0,
636     FD_DIR_READ    = 1,
637     FD_DIR_SCANE   = 2,
638     FD_DIR_SCANL   = 3,
639     FD_DIR_SCANH   = 4,
640     FD_DIR_VERIFY  = 5,
641 };
642 
643 enum {
644     FD_STATE_MULTI  = 0x01,	/* multi track flag */
645     FD_STATE_FORMAT = 0x02,	/* format flag */
646 };
647 
648 enum {
649     FD_REG_SRA = 0x00,
650     FD_REG_SRB = 0x01,
651     FD_REG_DOR = 0x02,
652     FD_REG_TDR = 0x03,
653     FD_REG_MSR = 0x04,
654     FD_REG_DSR = 0x04,
655     FD_REG_FIFO = 0x05,
656     FD_REG_DIR = 0x07,
657     FD_REG_CCR = 0x07,
658 };
659 
660 enum {
661     FD_CMD_READ_TRACK = 0x02,
662     FD_CMD_SPECIFY = 0x03,
663     FD_CMD_SENSE_DRIVE_STATUS = 0x04,
664     FD_CMD_WRITE = 0x05,
665     FD_CMD_READ = 0x06,
666     FD_CMD_RECALIBRATE = 0x07,
667     FD_CMD_SENSE_INTERRUPT_STATUS = 0x08,
668     FD_CMD_WRITE_DELETED = 0x09,
669     FD_CMD_READ_ID = 0x0a,
670     FD_CMD_READ_DELETED = 0x0c,
671     FD_CMD_FORMAT_TRACK = 0x0d,
672     FD_CMD_DUMPREG = 0x0e,
673     FD_CMD_SEEK = 0x0f,
674     FD_CMD_VERSION = 0x10,
675     FD_CMD_SCAN_EQUAL = 0x11,
676     FD_CMD_PERPENDICULAR_MODE = 0x12,
677     FD_CMD_CONFIGURE = 0x13,
678     FD_CMD_LOCK = 0x14,
679     FD_CMD_VERIFY = 0x16,
680     FD_CMD_POWERDOWN_MODE = 0x17,
681     FD_CMD_PART_ID = 0x18,
682     FD_CMD_SCAN_LOW_OR_EQUAL = 0x19,
683     FD_CMD_SCAN_HIGH_OR_EQUAL = 0x1d,
684     FD_CMD_SAVE = 0x2e,
685     FD_CMD_OPTION = 0x33,
686     FD_CMD_RESTORE = 0x4e,
687     FD_CMD_DRIVE_SPECIFICATION_COMMAND = 0x8e,
688     FD_CMD_RELATIVE_SEEK_OUT = 0x8f,
689     FD_CMD_FORMAT_AND_WRITE = 0xcd,
690     FD_CMD_RELATIVE_SEEK_IN = 0xcf,
691 };
692 
693 enum {
694     FD_CONFIG_PRETRK = 0xff, /* Pre-compensation set to track 0 */
695     FD_CONFIG_FIFOTHR = 0x0f, /* FIFO threshold set to 1 byte */
696     FD_CONFIG_POLL  = 0x10, /* Poll enabled */
697     FD_CONFIG_EFIFO = 0x20, /* FIFO disabled */
698     FD_CONFIG_EIS   = 0x40, /* No implied seeks */
699 };
700 
701 enum {
702     FD_SR0_DS0      = 0x01,
703     FD_SR0_DS1      = 0x02,
704     FD_SR0_HEAD     = 0x04,
705     FD_SR0_EQPMT    = 0x10,
706     FD_SR0_SEEK     = 0x20,
707     FD_SR0_ABNTERM  = 0x40,
708     FD_SR0_INVCMD   = 0x80,
709     FD_SR0_RDYCHG   = 0xc0,
710 };
711 
712 enum {
713     FD_SR1_MA       = 0x01, /* Missing address mark */
714     FD_SR1_NW       = 0x02, /* Not writable */
715     FD_SR1_EC       = 0x80, /* End of cylinder */
716 };
717 
718 enum {
719     FD_SR2_SNS      = 0x04, /* Scan not satisfied */
720     FD_SR2_SEH      = 0x08, /* Scan equal hit */
721 };
722 
723 enum {
724     FD_SRA_DIR      = 0x01,
725     FD_SRA_nWP      = 0x02,
726     FD_SRA_nINDX    = 0x04,
727     FD_SRA_HDSEL    = 0x08,
728     FD_SRA_nTRK0    = 0x10,
729     FD_SRA_STEP     = 0x20,
730     FD_SRA_nDRV2    = 0x40,
731     FD_SRA_INTPEND  = 0x80,
732 };
733 
734 enum {
735     FD_SRB_MTR0     = 0x01,
736     FD_SRB_MTR1     = 0x02,
737     FD_SRB_WGATE    = 0x04,
738     FD_SRB_RDATA    = 0x08,
739     FD_SRB_WDATA    = 0x10,
740     FD_SRB_DR0      = 0x20,
741 };
742 
743 enum {
744 #if MAX_FD == 4
745     FD_DOR_SELMASK  = 0x03,
746 #else
747     FD_DOR_SELMASK  = 0x01,
748 #endif
749     FD_DOR_nRESET   = 0x04,
750     FD_DOR_DMAEN    = 0x08,
751     FD_DOR_MOTEN0   = 0x10,
752     FD_DOR_MOTEN1   = 0x20,
753     FD_DOR_MOTEN2   = 0x40,
754     FD_DOR_MOTEN3   = 0x80,
755 };
756 
757 enum {
758 #if MAX_FD == 4
759     FD_TDR_BOOTSEL  = 0x0c,
760 #else
761     FD_TDR_BOOTSEL  = 0x04,
762 #endif
763 };
764 
765 enum {
766     FD_DSR_DRATEMASK= 0x03,
767     FD_DSR_PWRDOWN  = 0x40,
768     FD_DSR_SWRESET  = 0x80,
769 };
770 
771 enum {
772     FD_MSR_DRV0BUSY = 0x01,
773     FD_MSR_DRV1BUSY = 0x02,
774     FD_MSR_DRV2BUSY = 0x04,
775     FD_MSR_DRV3BUSY = 0x08,
776     FD_MSR_CMDBUSY  = 0x10,
777     FD_MSR_NONDMA   = 0x20,
778     FD_MSR_DIO      = 0x40,
779     FD_MSR_RQM      = 0x80,
780 };
781 
782 enum {
783     FD_DIR_DSKCHG   = 0x80,
784 };
785 
786 /*
787  * See chapter 5.0 "Controller phases" of the spec:
788  *
789  * Command phase:
790  * The host writes a command and its parameters into the FIFO. The command
791  * phase is completed when all parameters for the command have been supplied,
792  * and execution phase is entered.
793  *
794  * Execution phase:
795  * Data transfers, either DMA or non-DMA. For non-DMA transfers, the FIFO
796  * contains the payload now, otherwise it's unused. When all bytes of the
797  * required data have been transferred, the state is switched to either result
798  * phase (if the command produces status bytes) or directly back into the
799  * command phase for the next command.
800  *
801  * Result phase:
802  * The host reads out the FIFO, which contains one or more result bytes now.
803  */
804 enum {
805     /* Only for migration: reconstruct phase from registers like qemu 2.3 */
806     FD_PHASE_RECONSTRUCT    = 0,
807 
808     FD_PHASE_COMMAND        = 1,
809     FD_PHASE_EXECUTION      = 2,
810     FD_PHASE_RESULT         = 3,
811 };
812 
813 #define FD_MULTI_TRACK(state) ((state) & FD_STATE_MULTI)
814 #define FD_FORMAT_CMD(state) ((state) & FD_STATE_FORMAT)
815 
816 struct FDCtrl {
817     MemoryRegion iomem;
818     qemu_irq irq;
819     /* Controller state */
820     QEMUTimer *result_timer;
821     int dma_chann;
822     uint8_t phase;
823     IsaDma *dma;
824     /* Controller's identification */
825     uint8_t version;
826     /* HW */
827     uint8_t sra;
828     uint8_t srb;
829     uint8_t dor;
830     uint8_t dor_vmstate; /* only used as temp during vmstate */
831     uint8_t tdr;
832     uint8_t dsr;
833     uint8_t msr;
834     uint8_t cur_drv;
835     uint8_t status0;
836     uint8_t status1;
837     uint8_t status2;
838     /* Command FIFO */
839     uint8_t *fifo;
840     int32_t fifo_size;
841     uint32_t data_pos;
842     uint32_t data_len;
843     uint8_t data_state;
844     uint8_t data_dir;
845     uint8_t eot; /* last wanted sector */
846     /* States kept only to be returned back */
847     /* precompensation */
848     uint8_t precomp_trk;
849     uint8_t config;
850     uint8_t lock;
851     /* Power down config (also with status regB access mode */
852     uint8_t pwrd;
853     /* Floppy drives */
854     FloppyBus bus;
855     uint8_t num_floppies;
856     FDrive drives[MAX_FD];
857     struct {
858         BlockBackend *blk;
859         FloppyDriveType type;
860     } qdev_for_drives[MAX_FD];
861     int reset_sensei;
862     uint32_t check_media_rate;
863     FloppyDriveType fallback; /* type=auto failure fallback */
864     /* Timers state */
865     uint8_t timer0;
866     uint8_t timer1;
867     PortioList portio_list;
868 };
869 
870 static FloppyDriveType get_fallback_drive_type(FDrive *drv)
871 {
872     return drv->fdctrl->fallback;
873 }
874 
875 #define TYPE_SYSBUS_FDC "base-sysbus-fdc"
876 #define SYSBUS_FDC(obj) OBJECT_CHECK(FDCtrlSysBus, (obj), TYPE_SYSBUS_FDC)
877 
878 typedef struct FDCtrlSysBus {
879     /*< private >*/
880     SysBusDevice parent_obj;
881     /*< public >*/
882 
883     struct FDCtrl state;
884 } FDCtrlSysBus;
885 
886 #define ISA_FDC(obj) OBJECT_CHECK(FDCtrlISABus, (obj), TYPE_ISA_FDC)
887 
888 typedef struct FDCtrlISABus {
889     ISADevice parent_obj;
890 
891     uint32_t iobase;
892     uint32_t irq;
893     uint32_t dma;
894     struct FDCtrl state;
895     int32_t bootindexA;
896     int32_t bootindexB;
897 } FDCtrlISABus;
898 
899 static uint32_t fdctrl_read (void *opaque, uint32_t reg)
900 {
901     FDCtrl *fdctrl = opaque;
902     uint32_t retval;
903 
904     reg &= 7;
905     switch (reg) {
906     case FD_REG_SRA:
907         retval = fdctrl_read_statusA(fdctrl);
908         break;
909     case FD_REG_SRB:
910         retval = fdctrl_read_statusB(fdctrl);
911         break;
912     case FD_REG_DOR:
913         retval = fdctrl_read_dor(fdctrl);
914         break;
915     case FD_REG_TDR:
916         retval = fdctrl_read_tape(fdctrl);
917         break;
918     case FD_REG_MSR:
919         retval = fdctrl_read_main_status(fdctrl);
920         break;
921     case FD_REG_FIFO:
922         retval = fdctrl_read_data(fdctrl);
923         break;
924     case FD_REG_DIR:
925         retval = fdctrl_read_dir(fdctrl);
926         break;
927     default:
928         retval = (uint32_t)(-1);
929         break;
930     }
931     trace_fdc_ioport_read(reg, retval);
932 
933     return retval;
934 }
935 
936 static void fdctrl_write (void *opaque, uint32_t reg, uint32_t value)
937 {
938     FDCtrl *fdctrl = opaque;
939 
940     reg &= 7;
941     trace_fdc_ioport_write(reg, value);
942     switch (reg) {
943     case FD_REG_DOR:
944         fdctrl_write_dor(fdctrl, value);
945         break;
946     case FD_REG_TDR:
947         fdctrl_write_tape(fdctrl, value);
948         break;
949     case FD_REG_DSR:
950         fdctrl_write_rate(fdctrl, value);
951         break;
952     case FD_REG_FIFO:
953         fdctrl_write_data(fdctrl, value);
954         break;
955     case FD_REG_CCR:
956         fdctrl_write_ccr(fdctrl, value);
957         break;
958     default:
959         break;
960     }
961 }
962 
963 static uint64_t fdctrl_read_mem (void *opaque, hwaddr reg,
964                                  unsigned ize)
965 {
966     return fdctrl_read(opaque, (uint32_t)reg);
967 }
968 
969 static void fdctrl_write_mem (void *opaque, hwaddr reg,
970                               uint64_t value, unsigned size)
971 {
972     fdctrl_write(opaque, (uint32_t)reg, value);
973 }
974 
975 static const MemoryRegionOps fdctrl_mem_ops = {
976     .read = fdctrl_read_mem,
977     .write = fdctrl_write_mem,
978     .endianness = DEVICE_NATIVE_ENDIAN,
979 };
980 
981 static const MemoryRegionOps fdctrl_mem_strict_ops = {
982     .read = fdctrl_read_mem,
983     .write = fdctrl_write_mem,
984     .endianness = DEVICE_NATIVE_ENDIAN,
985     .valid = {
986         .min_access_size = 1,
987         .max_access_size = 1,
988     },
989 };
990 
991 static bool fdrive_media_changed_needed(void *opaque)
992 {
993     FDrive *drive = opaque;
994 
995     return (drive->blk != NULL && drive->media_changed != 1);
996 }
997 
998 static const VMStateDescription vmstate_fdrive_media_changed = {
999     .name = "fdrive/media_changed",
1000     .version_id = 1,
1001     .minimum_version_id = 1,
1002     .needed = fdrive_media_changed_needed,
1003     .fields = (VMStateField[]) {
1004         VMSTATE_UINT8(media_changed, FDrive),
1005         VMSTATE_END_OF_LIST()
1006     }
1007 };
1008 
1009 static bool fdrive_media_rate_needed(void *opaque)
1010 {
1011     FDrive *drive = opaque;
1012 
1013     return drive->fdctrl->check_media_rate;
1014 }
1015 
1016 static const VMStateDescription vmstate_fdrive_media_rate = {
1017     .name = "fdrive/media_rate",
1018     .version_id = 1,
1019     .minimum_version_id = 1,
1020     .needed = fdrive_media_rate_needed,
1021     .fields = (VMStateField[]) {
1022         VMSTATE_UINT8(media_rate, FDrive),
1023         VMSTATE_END_OF_LIST()
1024     }
1025 };
1026 
1027 static bool fdrive_perpendicular_needed(void *opaque)
1028 {
1029     FDrive *drive = opaque;
1030 
1031     return drive->perpendicular != 0;
1032 }
1033 
1034 static const VMStateDescription vmstate_fdrive_perpendicular = {
1035     .name = "fdrive/perpendicular",
1036     .version_id = 1,
1037     .minimum_version_id = 1,
1038     .needed = fdrive_perpendicular_needed,
1039     .fields = (VMStateField[]) {
1040         VMSTATE_UINT8(perpendicular, FDrive),
1041         VMSTATE_END_OF_LIST()
1042     }
1043 };
1044 
1045 static int fdrive_post_load(void *opaque, int version_id)
1046 {
1047     fd_revalidate(opaque);
1048     return 0;
1049 }
1050 
1051 static const VMStateDescription vmstate_fdrive = {
1052     .name = "fdrive",
1053     .version_id = 1,
1054     .minimum_version_id = 1,
1055     .post_load = fdrive_post_load,
1056     .fields = (VMStateField[]) {
1057         VMSTATE_UINT8(head, FDrive),
1058         VMSTATE_UINT8(track, FDrive),
1059         VMSTATE_UINT8(sect, FDrive),
1060         VMSTATE_END_OF_LIST()
1061     },
1062     .subsections = (const VMStateDescription*[]) {
1063         &vmstate_fdrive_media_changed,
1064         &vmstate_fdrive_media_rate,
1065         &vmstate_fdrive_perpendicular,
1066         NULL
1067     }
1068 };
1069 
1070 /*
1071  * Reconstructs the phase from register values according to the logic that was
1072  * implemented in qemu 2.3. This is the default value that is used if the phase
1073  * subsection is not present on migration.
1074  *
1075  * Don't change this function to reflect newer qemu versions, it is part of
1076  * the migration ABI.
1077  */
1078 static int reconstruct_phase(FDCtrl *fdctrl)
1079 {
1080     if (fdctrl->msr & FD_MSR_NONDMA) {
1081         return FD_PHASE_EXECUTION;
1082     } else if ((fdctrl->msr & FD_MSR_RQM) == 0) {
1083         /* qemu 2.3 disabled RQM only during DMA transfers */
1084         return FD_PHASE_EXECUTION;
1085     } else if (fdctrl->msr & FD_MSR_DIO) {
1086         return FD_PHASE_RESULT;
1087     } else {
1088         return FD_PHASE_COMMAND;
1089     }
1090 }
1091 
1092 static int fdc_pre_save(void *opaque)
1093 {
1094     FDCtrl *s = opaque;
1095 
1096     s->dor_vmstate = s->dor | GET_CUR_DRV(s);
1097 
1098     return 0;
1099 }
1100 
1101 static int fdc_pre_load(void *opaque)
1102 {
1103     FDCtrl *s = opaque;
1104     s->phase = FD_PHASE_RECONSTRUCT;
1105     return 0;
1106 }
1107 
1108 static int fdc_post_load(void *opaque, int version_id)
1109 {
1110     FDCtrl *s = opaque;
1111 
1112     SET_CUR_DRV(s, s->dor_vmstate & FD_DOR_SELMASK);
1113     s->dor = s->dor_vmstate & ~FD_DOR_SELMASK;
1114 
1115     if (s->phase == FD_PHASE_RECONSTRUCT) {
1116         s->phase = reconstruct_phase(s);
1117     }
1118 
1119     return 0;
1120 }
1121 
1122 static bool fdc_reset_sensei_needed(void *opaque)
1123 {
1124     FDCtrl *s = opaque;
1125 
1126     return s->reset_sensei != 0;
1127 }
1128 
1129 static const VMStateDescription vmstate_fdc_reset_sensei = {
1130     .name = "fdc/reset_sensei",
1131     .version_id = 1,
1132     .minimum_version_id = 1,
1133     .needed = fdc_reset_sensei_needed,
1134     .fields = (VMStateField[]) {
1135         VMSTATE_INT32(reset_sensei, FDCtrl),
1136         VMSTATE_END_OF_LIST()
1137     }
1138 };
1139 
1140 static bool fdc_result_timer_needed(void *opaque)
1141 {
1142     FDCtrl *s = opaque;
1143 
1144     return timer_pending(s->result_timer);
1145 }
1146 
1147 static const VMStateDescription vmstate_fdc_result_timer = {
1148     .name = "fdc/result_timer",
1149     .version_id = 1,
1150     .minimum_version_id = 1,
1151     .needed = fdc_result_timer_needed,
1152     .fields = (VMStateField[]) {
1153         VMSTATE_TIMER_PTR(result_timer, FDCtrl),
1154         VMSTATE_END_OF_LIST()
1155     }
1156 };
1157 
1158 static bool fdc_phase_needed(void *opaque)
1159 {
1160     FDCtrl *fdctrl = opaque;
1161 
1162     return reconstruct_phase(fdctrl) != fdctrl->phase;
1163 }
1164 
1165 static const VMStateDescription vmstate_fdc_phase = {
1166     .name = "fdc/phase",
1167     .version_id = 1,
1168     .minimum_version_id = 1,
1169     .needed = fdc_phase_needed,
1170     .fields = (VMStateField[]) {
1171         VMSTATE_UINT8(phase, FDCtrl),
1172         VMSTATE_END_OF_LIST()
1173     }
1174 };
1175 
1176 static const VMStateDescription vmstate_fdc = {
1177     .name = "fdc",
1178     .version_id = 2,
1179     .minimum_version_id = 2,
1180     .pre_save = fdc_pre_save,
1181     .pre_load = fdc_pre_load,
1182     .post_load = fdc_post_load,
1183     .fields = (VMStateField[]) {
1184         /* Controller State */
1185         VMSTATE_UINT8(sra, FDCtrl),
1186         VMSTATE_UINT8(srb, FDCtrl),
1187         VMSTATE_UINT8(dor_vmstate, FDCtrl),
1188         VMSTATE_UINT8(tdr, FDCtrl),
1189         VMSTATE_UINT8(dsr, FDCtrl),
1190         VMSTATE_UINT8(msr, FDCtrl),
1191         VMSTATE_UINT8(status0, FDCtrl),
1192         VMSTATE_UINT8(status1, FDCtrl),
1193         VMSTATE_UINT8(status2, FDCtrl),
1194         /* Command FIFO */
1195         VMSTATE_VARRAY_INT32(fifo, FDCtrl, fifo_size, 0, vmstate_info_uint8,
1196                              uint8_t),
1197         VMSTATE_UINT32(data_pos, FDCtrl),
1198         VMSTATE_UINT32(data_len, FDCtrl),
1199         VMSTATE_UINT8(data_state, FDCtrl),
1200         VMSTATE_UINT8(data_dir, FDCtrl),
1201         VMSTATE_UINT8(eot, FDCtrl),
1202         /* States kept only to be returned back */
1203         VMSTATE_UINT8(timer0, FDCtrl),
1204         VMSTATE_UINT8(timer1, FDCtrl),
1205         VMSTATE_UINT8(precomp_trk, FDCtrl),
1206         VMSTATE_UINT8(config, FDCtrl),
1207         VMSTATE_UINT8(lock, FDCtrl),
1208         VMSTATE_UINT8(pwrd, FDCtrl),
1209         VMSTATE_UINT8_EQUAL(num_floppies, FDCtrl, NULL),
1210         VMSTATE_STRUCT_ARRAY(drives, FDCtrl, MAX_FD, 1,
1211                              vmstate_fdrive, FDrive),
1212         VMSTATE_END_OF_LIST()
1213     },
1214     .subsections = (const VMStateDescription*[]) {
1215         &vmstate_fdc_reset_sensei,
1216         &vmstate_fdc_result_timer,
1217         &vmstate_fdc_phase,
1218         NULL
1219     }
1220 };
1221 
1222 static void fdctrl_external_reset_sysbus(DeviceState *d)
1223 {
1224     FDCtrlSysBus *sys = SYSBUS_FDC(d);
1225     FDCtrl *s = &sys->state;
1226 
1227     fdctrl_reset(s, 0);
1228 }
1229 
1230 static void fdctrl_external_reset_isa(DeviceState *d)
1231 {
1232     FDCtrlISABus *isa = ISA_FDC(d);
1233     FDCtrl *s = &isa->state;
1234 
1235     fdctrl_reset(s, 0);
1236 }
1237 
1238 static void fdctrl_handle_tc(void *opaque, int irq, int level)
1239 {
1240     //FDCtrl *s = opaque;
1241 
1242     if (level) {
1243         // XXX
1244         FLOPPY_DPRINTF("TC pulsed\n");
1245     }
1246 }
1247 
1248 /* Change IRQ state */
1249 static void fdctrl_reset_irq(FDCtrl *fdctrl)
1250 {
1251     fdctrl->status0 = 0;
1252     if (!(fdctrl->sra & FD_SRA_INTPEND))
1253         return;
1254     FLOPPY_DPRINTF("Reset interrupt\n");
1255     qemu_set_irq(fdctrl->irq, 0);
1256     fdctrl->sra &= ~FD_SRA_INTPEND;
1257 }
1258 
1259 static void fdctrl_raise_irq(FDCtrl *fdctrl)
1260 {
1261     if (!(fdctrl->sra & FD_SRA_INTPEND)) {
1262         qemu_set_irq(fdctrl->irq, 1);
1263         fdctrl->sra |= FD_SRA_INTPEND;
1264     }
1265 
1266     fdctrl->reset_sensei = 0;
1267     FLOPPY_DPRINTF("Set interrupt status to 0x%02x\n", fdctrl->status0);
1268 }
1269 
1270 /* Reset controller */
1271 static void fdctrl_reset(FDCtrl *fdctrl, int do_irq)
1272 {
1273     int i;
1274 
1275     FLOPPY_DPRINTF("reset controller\n");
1276     fdctrl_reset_irq(fdctrl);
1277     /* Initialise controller */
1278     fdctrl->sra = 0;
1279     fdctrl->srb = 0xc0;
1280     if (!fdctrl->drives[1].blk) {
1281         fdctrl->sra |= FD_SRA_nDRV2;
1282     }
1283     fdctrl->cur_drv = 0;
1284     fdctrl->dor = FD_DOR_nRESET;
1285     fdctrl->dor |= (fdctrl->dma_chann != -1) ? FD_DOR_DMAEN : 0;
1286     fdctrl->msr = FD_MSR_RQM;
1287     fdctrl->reset_sensei = 0;
1288     timer_del(fdctrl->result_timer);
1289     /* FIFO state */
1290     fdctrl->data_pos = 0;
1291     fdctrl->data_len = 0;
1292     fdctrl->data_state = 0;
1293     fdctrl->data_dir = FD_DIR_WRITE;
1294     for (i = 0; i < MAX_FD; i++)
1295         fd_recalibrate(&fdctrl->drives[i]);
1296     fdctrl_to_command_phase(fdctrl);
1297     if (do_irq) {
1298         fdctrl->status0 |= FD_SR0_RDYCHG;
1299         fdctrl_raise_irq(fdctrl);
1300         fdctrl->reset_sensei = FD_RESET_SENSEI_COUNT;
1301     }
1302 }
1303 
1304 static inline FDrive *drv0(FDCtrl *fdctrl)
1305 {
1306     return &fdctrl->drives[(fdctrl->tdr & FD_TDR_BOOTSEL) >> 2];
1307 }
1308 
1309 static inline FDrive *drv1(FDCtrl *fdctrl)
1310 {
1311     if ((fdctrl->tdr & FD_TDR_BOOTSEL) < (1 << 2))
1312         return &fdctrl->drives[1];
1313     else
1314         return &fdctrl->drives[0];
1315 }
1316 
1317 #if MAX_FD == 4
1318 static inline FDrive *drv2(FDCtrl *fdctrl)
1319 {
1320     if ((fdctrl->tdr & FD_TDR_BOOTSEL) < (2 << 2))
1321         return &fdctrl->drives[2];
1322     else
1323         return &fdctrl->drives[1];
1324 }
1325 
1326 static inline FDrive *drv3(FDCtrl *fdctrl)
1327 {
1328     if ((fdctrl->tdr & FD_TDR_BOOTSEL) < (3 << 2))
1329         return &fdctrl->drives[3];
1330     else
1331         return &fdctrl->drives[2];
1332 }
1333 #endif
1334 
1335 static FDrive *get_drv(FDCtrl *fdctrl, int unit)
1336 {
1337     switch (unit) {
1338         case 0: return drv0(fdctrl);
1339         case 1: return drv1(fdctrl);
1340 #if MAX_FD == 4
1341         case 2: return drv2(fdctrl);
1342         case 3: return drv3(fdctrl);
1343 #endif
1344         default: return NULL;
1345     }
1346 }
1347 
1348 static FDrive *get_cur_drv(FDCtrl *fdctrl)
1349 {
1350     return get_drv(fdctrl, fdctrl->cur_drv);
1351 }
1352 
1353 /* Status A register : 0x00 (read-only) */
1354 static uint32_t fdctrl_read_statusA(FDCtrl *fdctrl)
1355 {
1356     uint32_t retval = fdctrl->sra;
1357 
1358     FLOPPY_DPRINTF("status register A: 0x%02x\n", retval);
1359 
1360     return retval;
1361 }
1362 
1363 /* Status B register : 0x01 (read-only) */
1364 static uint32_t fdctrl_read_statusB(FDCtrl *fdctrl)
1365 {
1366     uint32_t retval = fdctrl->srb;
1367 
1368     FLOPPY_DPRINTF("status register B: 0x%02x\n", retval);
1369 
1370     return retval;
1371 }
1372 
1373 /* Digital output register : 0x02 */
1374 static uint32_t fdctrl_read_dor(FDCtrl *fdctrl)
1375 {
1376     uint32_t retval = fdctrl->dor;
1377 
1378     /* Selected drive */
1379     retval |= fdctrl->cur_drv;
1380     FLOPPY_DPRINTF("digital output register: 0x%02x\n", retval);
1381 
1382     return retval;
1383 }
1384 
1385 static void fdctrl_write_dor(FDCtrl *fdctrl, uint32_t value)
1386 {
1387     FLOPPY_DPRINTF("digital output register set to 0x%02x\n", value);
1388 
1389     /* Motors */
1390     if (value & FD_DOR_MOTEN0)
1391         fdctrl->srb |= FD_SRB_MTR0;
1392     else
1393         fdctrl->srb &= ~FD_SRB_MTR0;
1394     if (value & FD_DOR_MOTEN1)
1395         fdctrl->srb |= FD_SRB_MTR1;
1396     else
1397         fdctrl->srb &= ~FD_SRB_MTR1;
1398 
1399     /* Drive */
1400     if (value & 1)
1401         fdctrl->srb |= FD_SRB_DR0;
1402     else
1403         fdctrl->srb &= ~FD_SRB_DR0;
1404 
1405     /* Reset */
1406     if (!(value & FD_DOR_nRESET)) {
1407         if (fdctrl->dor & FD_DOR_nRESET) {
1408             FLOPPY_DPRINTF("controller enter RESET state\n");
1409         }
1410     } else {
1411         if (!(fdctrl->dor & FD_DOR_nRESET)) {
1412             FLOPPY_DPRINTF("controller out of RESET state\n");
1413             fdctrl_reset(fdctrl, 1);
1414             fdctrl->dsr &= ~FD_DSR_PWRDOWN;
1415         }
1416     }
1417     /* Selected drive */
1418     fdctrl->cur_drv = value & FD_DOR_SELMASK;
1419 
1420     fdctrl->dor = value;
1421 }
1422 
1423 /* Tape drive register : 0x03 */
1424 static uint32_t fdctrl_read_tape(FDCtrl *fdctrl)
1425 {
1426     uint32_t retval = fdctrl->tdr;
1427 
1428     FLOPPY_DPRINTF("tape drive register: 0x%02x\n", retval);
1429 
1430     return retval;
1431 }
1432 
1433 static void fdctrl_write_tape(FDCtrl *fdctrl, uint32_t value)
1434 {
1435     /* Reset mode */
1436     if (!(fdctrl->dor & FD_DOR_nRESET)) {
1437         FLOPPY_DPRINTF("Floppy controller in RESET state !\n");
1438         return;
1439     }
1440     FLOPPY_DPRINTF("tape drive register set to 0x%02x\n", value);
1441     /* Disk boot selection indicator */
1442     fdctrl->tdr = value & FD_TDR_BOOTSEL;
1443     /* Tape indicators: never allow */
1444 }
1445 
1446 /* Main status register : 0x04 (read) */
1447 static uint32_t fdctrl_read_main_status(FDCtrl *fdctrl)
1448 {
1449     uint32_t retval = fdctrl->msr;
1450 
1451     fdctrl->dsr &= ~FD_DSR_PWRDOWN;
1452     fdctrl->dor |= FD_DOR_nRESET;
1453 
1454     FLOPPY_DPRINTF("main status register: 0x%02x\n", retval);
1455 
1456     return retval;
1457 }
1458 
1459 /* Data select rate register : 0x04 (write) */
1460 static void fdctrl_write_rate(FDCtrl *fdctrl, uint32_t value)
1461 {
1462     /* Reset mode */
1463     if (!(fdctrl->dor & FD_DOR_nRESET)) {
1464         FLOPPY_DPRINTF("Floppy controller in RESET state !\n");
1465         return;
1466     }
1467     FLOPPY_DPRINTF("select rate register set to 0x%02x\n", value);
1468     /* Reset: autoclear */
1469     if (value & FD_DSR_SWRESET) {
1470         fdctrl->dor &= ~FD_DOR_nRESET;
1471         fdctrl_reset(fdctrl, 1);
1472         fdctrl->dor |= FD_DOR_nRESET;
1473     }
1474     if (value & FD_DSR_PWRDOWN) {
1475         fdctrl_reset(fdctrl, 1);
1476     }
1477     fdctrl->dsr = value;
1478 }
1479 
1480 /* Configuration control register: 0x07 (write) */
1481 static void fdctrl_write_ccr(FDCtrl *fdctrl, uint32_t value)
1482 {
1483     /* Reset mode */
1484     if (!(fdctrl->dor & FD_DOR_nRESET)) {
1485         FLOPPY_DPRINTF("Floppy controller in RESET state !\n");
1486         return;
1487     }
1488     FLOPPY_DPRINTF("configuration control register set to 0x%02x\n", value);
1489 
1490     /* Only the rate selection bits used in AT mode, and we
1491      * store those in the DSR.
1492      */
1493     fdctrl->dsr = (fdctrl->dsr & ~FD_DSR_DRATEMASK) |
1494                   (value & FD_DSR_DRATEMASK);
1495 }
1496 
1497 static int fdctrl_media_changed(FDrive *drv)
1498 {
1499     return drv->media_changed;
1500 }
1501 
1502 /* Digital input register : 0x07 (read-only) */
1503 static uint32_t fdctrl_read_dir(FDCtrl *fdctrl)
1504 {
1505     uint32_t retval = 0;
1506 
1507     if (fdctrl_media_changed(get_cur_drv(fdctrl))) {
1508         retval |= FD_DIR_DSKCHG;
1509     }
1510     if (retval != 0) {
1511         FLOPPY_DPRINTF("Floppy digital input register: 0x%02x\n", retval);
1512     }
1513 
1514     return retval;
1515 }
1516 
1517 /* Clear the FIFO and update the state for receiving the next command */
1518 static void fdctrl_to_command_phase(FDCtrl *fdctrl)
1519 {
1520     fdctrl->phase = FD_PHASE_COMMAND;
1521     fdctrl->data_dir = FD_DIR_WRITE;
1522     fdctrl->data_pos = 0;
1523     fdctrl->data_len = 1; /* Accept command byte, adjust for params later */
1524     fdctrl->msr &= ~(FD_MSR_CMDBUSY | FD_MSR_DIO);
1525     fdctrl->msr |= FD_MSR_RQM;
1526 }
1527 
1528 /* Update the state to allow the guest to read out the command status.
1529  * @fifo_len is the number of result bytes to be read out. */
1530 static void fdctrl_to_result_phase(FDCtrl *fdctrl, int fifo_len)
1531 {
1532     fdctrl->phase = FD_PHASE_RESULT;
1533     fdctrl->data_dir = FD_DIR_READ;
1534     fdctrl->data_len = fifo_len;
1535     fdctrl->data_pos = 0;
1536     fdctrl->msr |= FD_MSR_CMDBUSY | FD_MSR_RQM | FD_MSR_DIO;
1537 }
1538 
1539 /* Set an error: unimplemented/unknown command */
1540 static void fdctrl_unimplemented(FDCtrl *fdctrl, int direction)
1541 {
1542     qemu_log_mask(LOG_UNIMP, "fdc: unimplemented command 0x%02x\n",
1543                   fdctrl->fifo[0]);
1544     fdctrl->fifo[0] = FD_SR0_INVCMD;
1545     fdctrl_to_result_phase(fdctrl, 1);
1546 }
1547 
1548 /* Seek to next sector
1549  * returns 0 when end of track reached (for DBL_SIDES on head 1)
1550  * otherwise returns 1
1551  */
1552 static int fdctrl_seek_to_next_sect(FDCtrl *fdctrl, FDrive *cur_drv)
1553 {
1554     FLOPPY_DPRINTF("seek to next sector (%d %02x %02x => %d)\n",
1555                    cur_drv->head, cur_drv->track, cur_drv->sect,
1556                    fd_sector(cur_drv));
1557     /* XXX: cur_drv->sect >= cur_drv->last_sect should be an
1558        error in fact */
1559     uint8_t new_head = cur_drv->head;
1560     uint8_t new_track = cur_drv->track;
1561     uint8_t new_sect = cur_drv->sect;
1562 
1563     int ret = 1;
1564 
1565     if (new_sect >= cur_drv->last_sect ||
1566         new_sect == fdctrl->eot) {
1567         new_sect = 1;
1568         if (FD_MULTI_TRACK(fdctrl->data_state)) {
1569             if (new_head == 0 &&
1570                 (cur_drv->flags & FDISK_DBL_SIDES) != 0) {
1571                 new_head = 1;
1572             } else {
1573                 new_head = 0;
1574                 new_track++;
1575                 fdctrl->status0 |= FD_SR0_SEEK;
1576                 if ((cur_drv->flags & FDISK_DBL_SIDES) == 0) {
1577                     ret = 0;
1578                 }
1579             }
1580         } else {
1581             fdctrl->status0 |= FD_SR0_SEEK;
1582             new_track++;
1583             ret = 0;
1584         }
1585         if (ret == 1) {
1586             FLOPPY_DPRINTF("seek to next track (%d %02x %02x => %d)\n",
1587                     new_head, new_track, new_sect, fd_sector(cur_drv));
1588         }
1589     } else {
1590         new_sect++;
1591     }
1592     fd_seek(cur_drv, new_head, new_track, new_sect, 1);
1593     return ret;
1594 }
1595 
1596 /* Callback for transfer end (stop or abort) */
1597 static void fdctrl_stop_transfer(FDCtrl *fdctrl, uint8_t status0,
1598                                  uint8_t status1, uint8_t status2)
1599 {
1600     FDrive *cur_drv;
1601     cur_drv = get_cur_drv(fdctrl);
1602 
1603     fdctrl->status0 &= ~(FD_SR0_DS0 | FD_SR0_DS1 | FD_SR0_HEAD);
1604     fdctrl->status0 |= GET_CUR_DRV(fdctrl);
1605     if (cur_drv->head) {
1606         fdctrl->status0 |= FD_SR0_HEAD;
1607     }
1608     fdctrl->status0 |= status0;
1609 
1610     FLOPPY_DPRINTF("transfer status: %02x %02x %02x (%02x)\n",
1611                    status0, status1, status2, fdctrl->status0);
1612     fdctrl->fifo[0] = fdctrl->status0;
1613     fdctrl->fifo[1] = status1;
1614     fdctrl->fifo[2] = status2;
1615     fdctrl->fifo[3] = cur_drv->track;
1616     fdctrl->fifo[4] = cur_drv->head;
1617     fdctrl->fifo[5] = cur_drv->sect;
1618     fdctrl->fifo[6] = FD_SECTOR_SC;
1619     fdctrl->data_dir = FD_DIR_READ;
1620     if (fdctrl->dma_chann != -1 && !(fdctrl->msr & FD_MSR_NONDMA)) {
1621         IsaDmaClass *k = ISADMA_GET_CLASS(fdctrl->dma);
1622         k->release_DREQ(fdctrl->dma, fdctrl->dma_chann);
1623     }
1624     fdctrl->msr |= FD_MSR_RQM | FD_MSR_DIO;
1625     fdctrl->msr &= ~FD_MSR_NONDMA;
1626 
1627     fdctrl_to_result_phase(fdctrl, 7);
1628     fdctrl_raise_irq(fdctrl);
1629 }
1630 
1631 /* Prepare a data transfer (either DMA or FIFO) */
1632 static void fdctrl_start_transfer(FDCtrl *fdctrl, int direction)
1633 {
1634     FDrive *cur_drv;
1635     uint8_t kh, kt, ks;
1636 
1637     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
1638     cur_drv = get_cur_drv(fdctrl);
1639     kt = fdctrl->fifo[2];
1640     kh = fdctrl->fifo[3];
1641     ks = fdctrl->fifo[4];
1642     FLOPPY_DPRINTF("Start transfer at %d %d %02x %02x (%d)\n",
1643                    GET_CUR_DRV(fdctrl), kh, kt, ks,
1644                    fd_sector_calc(kh, kt, ks, cur_drv->last_sect,
1645                                   NUM_SIDES(cur_drv)));
1646     switch (fd_seek(cur_drv, kh, kt, ks, fdctrl->config & FD_CONFIG_EIS)) {
1647     case 2:
1648         /* sect too big */
1649         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, 0x00, 0x00);
1650         fdctrl->fifo[3] = kt;
1651         fdctrl->fifo[4] = kh;
1652         fdctrl->fifo[5] = ks;
1653         return;
1654     case 3:
1655         /* track too big */
1656         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, FD_SR1_EC, 0x00);
1657         fdctrl->fifo[3] = kt;
1658         fdctrl->fifo[4] = kh;
1659         fdctrl->fifo[5] = ks;
1660         return;
1661     case 4:
1662         /* No seek enabled */
1663         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, 0x00, 0x00);
1664         fdctrl->fifo[3] = kt;
1665         fdctrl->fifo[4] = kh;
1666         fdctrl->fifo[5] = ks;
1667         return;
1668     case 1:
1669         fdctrl->status0 |= FD_SR0_SEEK;
1670         break;
1671     default:
1672         break;
1673     }
1674 
1675     /* Check the data rate. If the programmed data rate does not match
1676      * the currently inserted medium, the operation has to fail. */
1677     if (fdctrl->check_media_rate &&
1678         (fdctrl->dsr & FD_DSR_DRATEMASK) != cur_drv->media_rate) {
1679         FLOPPY_DPRINTF("data rate mismatch (fdc=%d, media=%d)\n",
1680                        fdctrl->dsr & FD_DSR_DRATEMASK, cur_drv->media_rate);
1681         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, FD_SR1_MA, 0x00);
1682         fdctrl->fifo[3] = kt;
1683         fdctrl->fifo[4] = kh;
1684         fdctrl->fifo[5] = ks;
1685         return;
1686     }
1687 
1688     /* Set the FIFO state */
1689     fdctrl->data_dir = direction;
1690     fdctrl->data_pos = 0;
1691     assert(fdctrl->msr & FD_MSR_CMDBUSY);
1692     if (fdctrl->fifo[0] & 0x80)
1693         fdctrl->data_state |= FD_STATE_MULTI;
1694     else
1695         fdctrl->data_state &= ~FD_STATE_MULTI;
1696     if (fdctrl->fifo[5] == 0) {
1697         fdctrl->data_len = fdctrl->fifo[8];
1698     } else {
1699         int tmp;
1700         fdctrl->data_len = 128 << (fdctrl->fifo[5] > 7 ? 7 : fdctrl->fifo[5]);
1701         tmp = (fdctrl->fifo[6] - ks + 1);
1702         if (fdctrl->fifo[0] & 0x80)
1703             tmp += fdctrl->fifo[6];
1704         fdctrl->data_len *= tmp;
1705     }
1706     fdctrl->eot = fdctrl->fifo[6];
1707     if (fdctrl->dor & FD_DOR_DMAEN) {
1708         IsaDmaTransferMode dma_mode;
1709         IsaDmaClass *k = ISADMA_GET_CLASS(fdctrl->dma);
1710         bool dma_mode_ok;
1711         /* DMA transfer are enabled. Check if DMA channel is well programmed */
1712         dma_mode = k->get_transfer_mode(fdctrl->dma, fdctrl->dma_chann);
1713         FLOPPY_DPRINTF("dma_mode=%d direction=%d (%d - %d)\n",
1714                        dma_mode, direction,
1715                        (128 << fdctrl->fifo[5]) *
1716                        (cur_drv->last_sect - ks + 1), fdctrl->data_len);
1717         switch (direction) {
1718         case FD_DIR_SCANE:
1719         case FD_DIR_SCANL:
1720         case FD_DIR_SCANH:
1721             dma_mode_ok = (dma_mode == ISADMA_TRANSFER_VERIFY);
1722             break;
1723         case FD_DIR_WRITE:
1724             dma_mode_ok = (dma_mode == ISADMA_TRANSFER_WRITE);
1725             break;
1726         case FD_DIR_READ:
1727             dma_mode_ok = (dma_mode == ISADMA_TRANSFER_READ);
1728             break;
1729         case FD_DIR_VERIFY:
1730             dma_mode_ok = true;
1731             break;
1732         default:
1733             dma_mode_ok = false;
1734             break;
1735         }
1736         if (dma_mode_ok) {
1737             /* No access is allowed until DMA transfer has completed */
1738             fdctrl->msr &= ~FD_MSR_RQM;
1739             if (direction != FD_DIR_VERIFY) {
1740                 /* Now, we just have to wait for the DMA controller to
1741                  * recall us...
1742                  */
1743                 k->hold_DREQ(fdctrl->dma, fdctrl->dma_chann);
1744                 k->schedule(fdctrl->dma);
1745             } else {
1746                 /* Start transfer */
1747                 fdctrl_transfer_handler(fdctrl, fdctrl->dma_chann, 0,
1748                                         fdctrl->data_len);
1749             }
1750             return;
1751         } else {
1752             FLOPPY_DPRINTF("bad dma_mode=%d direction=%d\n", dma_mode,
1753                            direction);
1754         }
1755     }
1756     FLOPPY_DPRINTF("start non-DMA transfer\n");
1757     fdctrl->msr |= FD_MSR_NONDMA | FD_MSR_RQM;
1758     if (direction != FD_DIR_WRITE)
1759         fdctrl->msr |= FD_MSR_DIO;
1760     /* IO based transfer: calculate len */
1761     fdctrl_raise_irq(fdctrl);
1762 }
1763 
1764 /* Prepare a transfer of deleted data */
1765 static void fdctrl_start_transfer_del(FDCtrl *fdctrl, int direction)
1766 {
1767     qemu_log_mask(LOG_UNIMP, "fdctrl_start_transfer_del() unimplemented\n");
1768 
1769     /* We don't handle deleted data,
1770      * so we don't return *ANYTHING*
1771      */
1772     fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM | FD_SR0_SEEK, 0x00, 0x00);
1773 }
1774 
1775 /* handlers for DMA transfers */
1776 static int fdctrl_transfer_handler (void *opaque, int nchan,
1777                                     int dma_pos, int dma_len)
1778 {
1779     FDCtrl *fdctrl;
1780     FDrive *cur_drv;
1781     int len, start_pos, rel_pos;
1782     uint8_t status0 = 0x00, status1 = 0x00, status2 = 0x00;
1783     IsaDmaClass *k;
1784 
1785     fdctrl = opaque;
1786     if (fdctrl->msr & FD_MSR_RQM) {
1787         FLOPPY_DPRINTF("Not in DMA transfer mode !\n");
1788         return 0;
1789     }
1790     k = ISADMA_GET_CLASS(fdctrl->dma);
1791     cur_drv = get_cur_drv(fdctrl);
1792     if (fdctrl->data_dir == FD_DIR_SCANE || fdctrl->data_dir == FD_DIR_SCANL ||
1793         fdctrl->data_dir == FD_DIR_SCANH)
1794         status2 = FD_SR2_SNS;
1795     if (dma_len > fdctrl->data_len)
1796         dma_len = fdctrl->data_len;
1797     if (cur_drv->blk == NULL) {
1798         if (fdctrl->data_dir == FD_DIR_WRITE)
1799             fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM | FD_SR0_SEEK, 0x00, 0x00);
1800         else
1801             fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, 0x00, 0x00);
1802         len = 0;
1803         goto transfer_error;
1804     }
1805     rel_pos = fdctrl->data_pos % FD_SECTOR_LEN;
1806     for (start_pos = fdctrl->data_pos; fdctrl->data_pos < dma_len;) {
1807         len = dma_len - fdctrl->data_pos;
1808         if (len + rel_pos > FD_SECTOR_LEN)
1809             len = FD_SECTOR_LEN - rel_pos;
1810         FLOPPY_DPRINTF("copy %d bytes (%d %d %d) %d pos %d %02x "
1811                        "(%d-0x%08x 0x%08x)\n", len, dma_len, fdctrl->data_pos,
1812                        fdctrl->data_len, GET_CUR_DRV(fdctrl), cur_drv->head,
1813                        cur_drv->track, cur_drv->sect, fd_sector(cur_drv),
1814                        fd_sector(cur_drv) * FD_SECTOR_LEN);
1815         if (fdctrl->data_dir != FD_DIR_WRITE ||
1816             len < FD_SECTOR_LEN || rel_pos != 0) {
1817             /* READ & SCAN commands and realign to a sector for WRITE */
1818             if (blk_pread(cur_drv->blk, fd_offset(cur_drv),
1819                           fdctrl->fifo, BDRV_SECTOR_SIZE) < 0) {
1820                 FLOPPY_DPRINTF("Floppy: error getting sector %d\n",
1821                                fd_sector(cur_drv));
1822                 /* Sure, image size is too small... */
1823                 memset(fdctrl->fifo, 0, FD_SECTOR_LEN);
1824             }
1825         }
1826         switch (fdctrl->data_dir) {
1827         case FD_DIR_READ:
1828             /* READ commands */
1829             k->write_memory(fdctrl->dma, nchan, fdctrl->fifo + rel_pos,
1830                             fdctrl->data_pos, len);
1831             break;
1832         case FD_DIR_WRITE:
1833             /* WRITE commands */
1834             if (cur_drv->ro) {
1835                 /* Handle readonly medium early, no need to do DMA, touch the
1836                  * LED or attempt any writes. A real floppy doesn't attempt
1837                  * to write to readonly media either. */
1838                 fdctrl_stop_transfer(fdctrl,
1839                                      FD_SR0_ABNTERM | FD_SR0_SEEK, FD_SR1_NW,
1840                                      0x00);
1841                 goto transfer_error;
1842             }
1843 
1844             k->read_memory(fdctrl->dma, nchan, fdctrl->fifo + rel_pos,
1845                            fdctrl->data_pos, len);
1846             if (blk_pwrite(cur_drv->blk, fd_offset(cur_drv),
1847                            fdctrl->fifo, BDRV_SECTOR_SIZE, 0) < 0) {
1848                 FLOPPY_DPRINTF("error writing sector %d\n",
1849                                fd_sector(cur_drv));
1850                 fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM | FD_SR0_SEEK, 0x00, 0x00);
1851                 goto transfer_error;
1852             }
1853             break;
1854         case FD_DIR_VERIFY:
1855             /* VERIFY commands */
1856             break;
1857         default:
1858             /* SCAN commands */
1859             {
1860                 uint8_t tmpbuf[FD_SECTOR_LEN];
1861                 int ret;
1862                 k->read_memory(fdctrl->dma, nchan, tmpbuf, fdctrl->data_pos,
1863                                len);
1864                 ret = memcmp(tmpbuf, fdctrl->fifo + rel_pos, len);
1865                 if (ret == 0) {
1866                     status2 = FD_SR2_SEH;
1867                     goto end_transfer;
1868                 }
1869                 if ((ret < 0 && fdctrl->data_dir == FD_DIR_SCANL) ||
1870                     (ret > 0 && fdctrl->data_dir == FD_DIR_SCANH)) {
1871                     status2 = 0x00;
1872                     goto end_transfer;
1873                 }
1874             }
1875             break;
1876         }
1877         fdctrl->data_pos += len;
1878         rel_pos = fdctrl->data_pos % FD_SECTOR_LEN;
1879         if (rel_pos == 0) {
1880             /* Seek to next sector */
1881             if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv))
1882                 break;
1883         }
1884     }
1885  end_transfer:
1886     len = fdctrl->data_pos - start_pos;
1887     FLOPPY_DPRINTF("end transfer %d %d %d\n",
1888                    fdctrl->data_pos, len, fdctrl->data_len);
1889     if (fdctrl->data_dir == FD_DIR_SCANE ||
1890         fdctrl->data_dir == FD_DIR_SCANL ||
1891         fdctrl->data_dir == FD_DIR_SCANH)
1892         status2 = FD_SR2_SEH;
1893     fdctrl->data_len -= len;
1894     fdctrl_stop_transfer(fdctrl, status0, status1, status2);
1895  transfer_error:
1896 
1897     return len;
1898 }
1899 
1900 /* Data register : 0x05 */
1901 static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
1902 {
1903     FDrive *cur_drv;
1904     uint32_t retval = 0;
1905     uint32_t pos;
1906 
1907     cur_drv = get_cur_drv(fdctrl);
1908     fdctrl->dsr &= ~FD_DSR_PWRDOWN;
1909     if (!(fdctrl->msr & FD_MSR_RQM) || !(fdctrl->msr & FD_MSR_DIO)) {
1910         FLOPPY_DPRINTF("error: controller not ready for reading\n");
1911         return 0;
1912     }
1913 
1914     /* If data_len spans multiple sectors, the current position in the FIFO
1915      * wraps around while fdctrl->data_pos is the real position in the whole
1916      * request. */
1917     pos = fdctrl->data_pos;
1918     pos %= FD_SECTOR_LEN;
1919 
1920     switch (fdctrl->phase) {
1921     case FD_PHASE_EXECUTION:
1922         assert(fdctrl->msr & FD_MSR_NONDMA);
1923         if (pos == 0) {
1924             if (fdctrl->data_pos != 0)
1925                 if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
1926                     FLOPPY_DPRINTF("error seeking to next sector %d\n",
1927                                    fd_sector(cur_drv));
1928                     return 0;
1929                 }
1930             if (blk_pread(cur_drv->blk, fd_offset(cur_drv), fdctrl->fifo,
1931                           BDRV_SECTOR_SIZE)
1932                 < 0) {
1933                 FLOPPY_DPRINTF("error getting sector %d\n",
1934                                fd_sector(cur_drv));
1935                 /* Sure, image size is too small... */
1936                 memset(fdctrl->fifo, 0, FD_SECTOR_LEN);
1937             }
1938         }
1939 
1940         if (++fdctrl->data_pos == fdctrl->data_len) {
1941             fdctrl->msr &= ~FD_MSR_RQM;
1942             fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
1943         }
1944         break;
1945 
1946     case FD_PHASE_RESULT:
1947         assert(!(fdctrl->msr & FD_MSR_NONDMA));
1948         if (++fdctrl->data_pos == fdctrl->data_len) {
1949             fdctrl->msr &= ~FD_MSR_RQM;
1950             fdctrl_to_command_phase(fdctrl);
1951             fdctrl_reset_irq(fdctrl);
1952         }
1953         break;
1954 
1955     case FD_PHASE_COMMAND:
1956     default:
1957         abort();
1958     }
1959 
1960     retval = fdctrl->fifo[pos];
1961     FLOPPY_DPRINTF("data register: 0x%02x\n", retval);
1962 
1963     return retval;
1964 }
1965 
1966 static void fdctrl_format_sector(FDCtrl *fdctrl)
1967 {
1968     FDrive *cur_drv;
1969     uint8_t kh, kt, ks;
1970 
1971     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
1972     cur_drv = get_cur_drv(fdctrl);
1973     kt = fdctrl->fifo[6];
1974     kh = fdctrl->fifo[7];
1975     ks = fdctrl->fifo[8];
1976     FLOPPY_DPRINTF("format sector at %d %d %02x %02x (%d)\n",
1977                    GET_CUR_DRV(fdctrl), kh, kt, ks,
1978                    fd_sector_calc(kh, kt, ks, cur_drv->last_sect,
1979                                   NUM_SIDES(cur_drv)));
1980     switch (fd_seek(cur_drv, kh, kt, ks, fdctrl->config & FD_CONFIG_EIS)) {
1981     case 2:
1982         /* sect too big */
1983         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, 0x00, 0x00);
1984         fdctrl->fifo[3] = kt;
1985         fdctrl->fifo[4] = kh;
1986         fdctrl->fifo[5] = ks;
1987         return;
1988     case 3:
1989         /* track too big */
1990         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, FD_SR1_EC, 0x00);
1991         fdctrl->fifo[3] = kt;
1992         fdctrl->fifo[4] = kh;
1993         fdctrl->fifo[5] = ks;
1994         return;
1995     case 4:
1996         /* No seek enabled */
1997         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, 0x00, 0x00);
1998         fdctrl->fifo[3] = kt;
1999         fdctrl->fifo[4] = kh;
2000         fdctrl->fifo[5] = ks;
2001         return;
2002     case 1:
2003         fdctrl->status0 |= FD_SR0_SEEK;
2004         break;
2005     default:
2006         break;
2007     }
2008     memset(fdctrl->fifo, 0, FD_SECTOR_LEN);
2009     if (cur_drv->blk == NULL ||
2010         blk_pwrite(cur_drv->blk, fd_offset(cur_drv), fdctrl->fifo,
2011                    BDRV_SECTOR_SIZE, 0) < 0) {
2012         FLOPPY_DPRINTF("error formatting sector %d\n", fd_sector(cur_drv));
2013         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM | FD_SR0_SEEK, 0x00, 0x00);
2014     } else {
2015         if (cur_drv->sect == cur_drv->last_sect) {
2016             fdctrl->data_state &= ~FD_STATE_FORMAT;
2017             /* Last sector done */
2018             fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
2019         } else {
2020             /* More to do */
2021             fdctrl->data_pos = 0;
2022             fdctrl->data_len = 4;
2023         }
2024     }
2025 }
2026 
2027 static void fdctrl_handle_lock(FDCtrl *fdctrl, int direction)
2028 {
2029     fdctrl->lock = (fdctrl->fifo[0] & 0x80) ? 1 : 0;
2030     fdctrl->fifo[0] = fdctrl->lock << 4;
2031     fdctrl_to_result_phase(fdctrl, 1);
2032 }
2033 
2034 static void fdctrl_handle_dumpreg(FDCtrl *fdctrl, int direction)
2035 {
2036     FDrive *cur_drv = get_cur_drv(fdctrl);
2037 
2038     /* Drives position */
2039     fdctrl->fifo[0] = drv0(fdctrl)->track;
2040     fdctrl->fifo[1] = drv1(fdctrl)->track;
2041 #if MAX_FD == 4
2042     fdctrl->fifo[2] = drv2(fdctrl)->track;
2043     fdctrl->fifo[3] = drv3(fdctrl)->track;
2044 #else
2045     fdctrl->fifo[2] = 0;
2046     fdctrl->fifo[3] = 0;
2047 #endif
2048     /* timers */
2049     fdctrl->fifo[4] = fdctrl->timer0;
2050     fdctrl->fifo[5] = (fdctrl->timer1 << 1) | (fdctrl->dor & FD_DOR_DMAEN ? 1 : 0);
2051     fdctrl->fifo[6] = cur_drv->last_sect;
2052     fdctrl->fifo[7] = (fdctrl->lock << 7) |
2053         (cur_drv->perpendicular << 2);
2054     fdctrl->fifo[8] = fdctrl->config;
2055     fdctrl->fifo[9] = fdctrl->precomp_trk;
2056     fdctrl_to_result_phase(fdctrl, 10);
2057 }
2058 
2059 static void fdctrl_handle_version(FDCtrl *fdctrl, int direction)
2060 {
2061     /* Controller's version */
2062     fdctrl->fifo[0] = fdctrl->version;
2063     fdctrl_to_result_phase(fdctrl, 1);
2064 }
2065 
2066 static void fdctrl_handle_partid(FDCtrl *fdctrl, int direction)
2067 {
2068     fdctrl->fifo[0] = 0x41; /* Stepping 1 */
2069     fdctrl_to_result_phase(fdctrl, 1);
2070 }
2071 
2072 static void fdctrl_handle_restore(FDCtrl *fdctrl, int direction)
2073 {
2074     FDrive *cur_drv = get_cur_drv(fdctrl);
2075 
2076     /* Drives position */
2077     drv0(fdctrl)->track = fdctrl->fifo[3];
2078     drv1(fdctrl)->track = fdctrl->fifo[4];
2079 #if MAX_FD == 4
2080     drv2(fdctrl)->track = fdctrl->fifo[5];
2081     drv3(fdctrl)->track = fdctrl->fifo[6];
2082 #endif
2083     /* timers */
2084     fdctrl->timer0 = fdctrl->fifo[7];
2085     fdctrl->timer1 = fdctrl->fifo[8];
2086     cur_drv->last_sect = fdctrl->fifo[9];
2087     fdctrl->lock = fdctrl->fifo[10] >> 7;
2088     cur_drv->perpendicular = (fdctrl->fifo[10] >> 2) & 0xF;
2089     fdctrl->config = fdctrl->fifo[11];
2090     fdctrl->precomp_trk = fdctrl->fifo[12];
2091     fdctrl->pwrd = fdctrl->fifo[13];
2092     fdctrl_to_command_phase(fdctrl);
2093 }
2094 
2095 static void fdctrl_handle_save(FDCtrl *fdctrl, int direction)
2096 {
2097     FDrive *cur_drv = get_cur_drv(fdctrl);
2098 
2099     fdctrl->fifo[0] = 0;
2100     fdctrl->fifo[1] = 0;
2101     /* Drives position */
2102     fdctrl->fifo[2] = drv0(fdctrl)->track;
2103     fdctrl->fifo[3] = drv1(fdctrl)->track;
2104 #if MAX_FD == 4
2105     fdctrl->fifo[4] = drv2(fdctrl)->track;
2106     fdctrl->fifo[5] = drv3(fdctrl)->track;
2107 #else
2108     fdctrl->fifo[4] = 0;
2109     fdctrl->fifo[5] = 0;
2110 #endif
2111     /* timers */
2112     fdctrl->fifo[6] = fdctrl->timer0;
2113     fdctrl->fifo[7] = fdctrl->timer1;
2114     fdctrl->fifo[8] = cur_drv->last_sect;
2115     fdctrl->fifo[9] = (fdctrl->lock << 7) |
2116         (cur_drv->perpendicular << 2);
2117     fdctrl->fifo[10] = fdctrl->config;
2118     fdctrl->fifo[11] = fdctrl->precomp_trk;
2119     fdctrl->fifo[12] = fdctrl->pwrd;
2120     fdctrl->fifo[13] = 0;
2121     fdctrl->fifo[14] = 0;
2122     fdctrl_to_result_phase(fdctrl, 15);
2123 }
2124 
2125 static void fdctrl_handle_readid(FDCtrl *fdctrl, int direction)
2126 {
2127     FDrive *cur_drv = get_cur_drv(fdctrl);
2128 
2129     cur_drv->head = (fdctrl->fifo[1] >> 2) & 1;
2130     timer_mod(fdctrl->result_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
2131              (NANOSECONDS_PER_SECOND / 50));
2132 }
2133 
2134 static void fdctrl_handle_format_track(FDCtrl *fdctrl, int direction)
2135 {
2136     FDrive *cur_drv;
2137 
2138     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
2139     cur_drv = get_cur_drv(fdctrl);
2140     fdctrl->data_state |= FD_STATE_FORMAT;
2141     if (fdctrl->fifo[0] & 0x80)
2142         fdctrl->data_state |= FD_STATE_MULTI;
2143     else
2144         fdctrl->data_state &= ~FD_STATE_MULTI;
2145     cur_drv->bps =
2146         fdctrl->fifo[2] > 7 ? 16384 : 128 << fdctrl->fifo[2];
2147 #if 0
2148     cur_drv->last_sect =
2149         cur_drv->flags & FDISK_DBL_SIDES ? fdctrl->fifo[3] :
2150         fdctrl->fifo[3] / 2;
2151 #else
2152     cur_drv->last_sect = fdctrl->fifo[3];
2153 #endif
2154     /* TODO: implement format using DMA expected by the Bochs BIOS
2155      * and Linux fdformat (read 3 bytes per sector via DMA and fill
2156      * the sector with the specified fill byte
2157      */
2158     fdctrl->data_state &= ~FD_STATE_FORMAT;
2159     fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
2160 }
2161 
2162 static void fdctrl_handle_specify(FDCtrl *fdctrl, int direction)
2163 {
2164     fdctrl->timer0 = (fdctrl->fifo[1] >> 4) & 0xF;
2165     fdctrl->timer1 = fdctrl->fifo[2] >> 1;
2166     if (fdctrl->fifo[2] & 1)
2167         fdctrl->dor &= ~FD_DOR_DMAEN;
2168     else
2169         fdctrl->dor |= FD_DOR_DMAEN;
2170     /* No result back */
2171     fdctrl_to_command_phase(fdctrl);
2172 }
2173 
2174 static void fdctrl_handle_sense_drive_status(FDCtrl *fdctrl, int direction)
2175 {
2176     FDrive *cur_drv;
2177 
2178     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
2179     cur_drv = get_cur_drv(fdctrl);
2180     cur_drv->head = (fdctrl->fifo[1] >> 2) & 1;
2181     /* 1 Byte status back */
2182     fdctrl->fifo[0] = (cur_drv->ro << 6) |
2183         (cur_drv->track == 0 ? 0x10 : 0x00) |
2184         (cur_drv->head << 2) |
2185         GET_CUR_DRV(fdctrl) |
2186         0x28;
2187     fdctrl_to_result_phase(fdctrl, 1);
2188 }
2189 
2190 static void fdctrl_handle_recalibrate(FDCtrl *fdctrl, int direction)
2191 {
2192     FDrive *cur_drv;
2193 
2194     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
2195     cur_drv = get_cur_drv(fdctrl);
2196     fd_recalibrate(cur_drv);
2197     fdctrl_to_command_phase(fdctrl);
2198     /* Raise Interrupt */
2199     fdctrl->status0 |= FD_SR0_SEEK;
2200     fdctrl_raise_irq(fdctrl);
2201 }
2202 
2203 static void fdctrl_handle_sense_interrupt_status(FDCtrl *fdctrl, int direction)
2204 {
2205     FDrive *cur_drv = get_cur_drv(fdctrl);
2206 
2207     if (fdctrl->reset_sensei > 0) {
2208         fdctrl->fifo[0] =
2209             FD_SR0_RDYCHG + FD_RESET_SENSEI_COUNT - fdctrl->reset_sensei;
2210         fdctrl->reset_sensei--;
2211     } else if (!(fdctrl->sra & FD_SRA_INTPEND)) {
2212         fdctrl->fifo[0] = FD_SR0_INVCMD;
2213         fdctrl_to_result_phase(fdctrl, 1);
2214         return;
2215     } else {
2216         fdctrl->fifo[0] =
2217                 (fdctrl->status0 & ~(FD_SR0_HEAD | FD_SR0_DS1 | FD_SR0_DS0))
2218                 | GET_CUR_DRV(fdctrl);
2219     }
2220 
2221     fdctrl->fifo[1] = cur_drv->track;
2222     fdctrl_to_result_phase(fdctrl, 2);
2223     fdctrl_reset_irq(fdctrl);
2224     fdctrl->status0 = FD_SR0_RDYCHG;
2225 }
2226 
2227 static void fdctrl_handle_seek(FDCtrl *fdctrl, int direction)
2228 {
2229     FDrive *cur_drv;
2230 
2231     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
2232     cur_drv = get_cur_drv(fdctrl);
2233     fdctrl_to_command_phase(fdctrl);
2234     /* The seek command just sends step pulses to the drive and doesn't care if
2235      * there is a medium inserted of if it's banging the head against the drive.
2236      */
2237     fd_seek(cur_drv, cur_drv->head, fdctrl->fifo[2], cur_drv->sect, 1);
2238     /* Raise Interrupt */
2239     fdctrl->status0 |= FD_SR0_SEEK;
2240     fdctrl_raise_irq(fdctrl);
2241 }
2242 
2243 static void fdctrl_handle_perpendicular_mode(FDCtrl *fdctrl, int direction)
2244 {
2245     FDrive *cur_drv = get_cur_drv(fdctrl);
2246 
2247     if (fdctrl->fifo[1] & 0x80)
2248         cur_drv->perpendicular = fdctrl->fifo[1] & 0x7;
2249     /* No result back */
2250     fdctrl_to_command_phase(fdctrl);
2251 }
2252 
2253 static void fdctrl_handle_configure(FDCtrl *fdctrl, int direction)
2254 {
2255     fdctrl->config = fdctrl->fifo[2];
2256     fdctrl->precomp_trk =  fdctrl->fifo[3];
2257     /* No result back */
2258     fdctrl_to_command_phase(fdctrl);
2259 }
2260 
2261 static void fdctrl_handle_powerdown_mode(FDCtrl *fdctrl, int direction)
2262 {
2263     fdctrl->pwrd = fdctrl->fifo[1];
2264     fdctrl->fifo[0] = fdctrl->fifo[1];
2265     fdctrl_to_result_phase(fdctrl, 1);
2266 }
2267 
2268 static void fdctrl_handle_option(FDCtrl *fdctrl, int direction)
2269 {
2270     /* No result back */
2271     fdctrl_to_command_phase(fdctrl);
2272 }
2273 
2274 static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int direction)
2275 {
2276     FDrive *cur_drv = get_cur_drv(fdctrl);
2277     uint32_t pos;
2278 
2279     pos = fdctrl->data_pos - 1;
2280     pos %= FD_SECTOR_LEN;
2281     if (fdctrl->fifo[pos] & 0x80) {
2282         /* Command parameters done */
2283         if (fdctrl->fifo[pos] & 0x40) {
2284             fdctrl->fifo[0] = fdctrl->fifo[1];
2285             fdctrl->fifo[2] = 0;
2286             fdctrl->fifo[3] = 0;
2287             fdctrl_to_result_phase(fdctrl, 4);
2288         } else {
2289             fdctrl_to_command_phase(fdctrl);
2290         }
2291     } else if (fdctrl->data_len > 7) {
2292         /* ERROR */
2293         fdctrl->fifo[0] = 0x80 |
2294             (cur_drv->head << 2) | GET_CUR_DRV(fdctrl);
2295         fdctrl_to_result_phase(fdctrl, 1);
2296     }
2297 }
2298 
2299 static void fdctrl_handle_relative_seek_in(FDCtrl *fdctrl, int direction)
2300 {
2301     FDrive *cur_drv;
2302 
2303     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
2304     cur_drv = get_cur_drv(fdctrl);
2305     if (fdctrl->fifo[2] + cur_drv->track >= cur_drv->max_track) {
2306         fd_seek(cur_drv, cur_drv->head, cur_drv->max_track - 1,
2307                 cur_drv->sect, 1);
2308     } else {
2309         fd_seek(cur_drv, cur_drv->head,
2310                 cur_drv->track + fdctrl->fifo[2], cur_drv->sect, 1);
2311     }
2312     fdctrl_to_command_phase(fdctrl);
2313     /* Raise Interrupt */
2314     fdctrl->status0 |= FD_SR0_SEEK;
2315     fdctrl_raise_irq(fdctrl);
2316 }
2317 
2318 static void fdctrl_handle_relative_seek_out(FDCtrl *fdctrl, int direction)
2319 {
2320     FDrive *cur_drv;
2321 
2322     SET_CUR_DRV(fdctrl, fdctrl->fifo[1] & FD_DOR_SELMASK);
2323     cur_drv = get_cur_drv(fdctrl);
2324     if (fdctrl->fifo[2] > cur_drv->track) {
2325         fd_seek(cur_drv, cur_drv->head, 0, cur_drv->sect, 1);
2326     } else {
2327         fd_seek(cur_drv, cur_drv->head,
2328                 cur_drv->track - fdctrl->fifo[2], cur_drv->sect, 1);
2329     }
2330     fdctrl_to_command_phase(fdctrl);
2331     /* Raise Interrupt */
2332     fdctrl->status0 |= FD_SR0_SEEK;
2333     fdctrl_raise_irq(fdctrl);
2334 }
2335 
2336 /*
2337  * Handlers for the execution phase of each command
2338  */
2339 typedef struct FDCtrlCommand {
2340     uint8_t value;
2341     uint8_t mask;
2342     const char* name;
2343     int parameters;
2344     void (*handler)(FDCtrl *fdctrl, int direction);
2345     int direction;
2346 } FDCtrlCommand;
2347 
2348 static const FDCtrlCommand handlers[] = {
2349     { FD_CMD_READ, 0x1f, "READ", 8, fdctrl_start_transfer, FD_DIR_READ },
2350     { FD_CMD_WRITE, 0x3f, "WRITE", 8, fdctrl_start_transfer, FD_DIR_WRITE },
2351     { FD_CMD_SEEK, 0xff, "SEEK", 2, fdctrl_handle_seek },
2352     { FD_CMD_SENSE_INTERRUPT_STATUS, 0xff, "SENSE INTERRUPT STATUS", 0, fdctrl_handle_sense_interrupt_status },
2353     { FD_CMD_RECALIBRATE, 0xff, "RECALIBRATE", 1, fdctrl_handle_recalibrate },
2354     { FD_CMD_FORMAT_TRACK, 0xbf, "FORMAT TRACK", 5, fdctrl_handle_format_track },
2355     { FD_CMD_READ_TRACK, 0xbf, "READ TRACK", 8, fdctrl_start_transfer, FD_DIR_READ },
2356     { FD_CMD_RESTORE, 0xff, "RESTORE", 17, fdctrl_handle_restore }, /* part of READ DELETED DATA */
2357     { FD_CMD_SAVE, 0xff, "SAVE", 0, fdctrl_handle_save }, /* part of READ DELETED DATA */
2358     { FD_CMD_READ_DELETED, 0x1f, "READ DELETED DATA", 8, fdctrl_start_transfer_del, FD_DIR_READ },
2359     { FD_CMD_SCAN_EQUAL, 0x1f, "SCAN EQUAL", 8, fdctrl_start_transfer, FD_DIR_SCANE },
2360     { FD_CMD_VERIFY, 0x1f, "VERIFY", 8, fdctrl_start_transfer, FD_DIR_VERIFY },
2361     { FD_CMD_SCAN_LOW_OR_EQUAL, 0x1f, "SCAN LOW OR EQUAL", 8, fdctrl_start_transfer, FD_DIR_SCANL },
2362     { FD_CMD_SCAN_HIGH_OR_EQUAL, 0x1f, "SCAN HIGH OR EQUAL", 8, fdctrl_start_transfer, FD_DIR_SCANH },
2363     { FD_CMD_WRITE_DELETED, 0x3f, "WRITE DELETED DATA", 8, fdctrl_start_transfer_del, FD_DIR_WRITE },
2364     { FD_CMD_READ_ID, 0xbf, "READ ID", 1, fdctrl_handle_readid },
2365     { FD_CMD_SPECIFY, 0xff, "SPECIFY", 2, fdctrl_handle_specify },
2366     { FD_CMD_SENSE_DRIVE_STATUS, 0xff, "SENSE DRIVE STATUS", 1, fdctrl_handle_sense_drive_status },
2367     { FD_CMD_PERPENDICULAR_MODE, 0xff, "PERPENDICULAR MODE", 1, fdctrl_handle_perpendicular_mode },
2368     { FD_CMD_CONFIGURE, 0xff, "CONFIGURE", 3, fdctrl_handle_configure },
2369     { FD_CMD_POWERDOWN_MODE, 0xff, "POWERDOWN MODE", 2, fdctrl_handle_powerdown_mode },
2370     { FD_CMD_OPTION, 0xff, "OPTION", 1, fdctrl_handle_option },
2371     { FD_CMD_DRIVE_SPECIFICATION_COMMAND, 0xff, "DRIVE SPECIFICATION COMMAND", 5, fdctrl_handle_drive_specification_command },
2372     { FD_CMD_RELATIVE_SEEK_OUT, 0xff, "RELATIVE SEEK OUT", 2, fdctrl_handle_relative_seek_out },
2373     { FD_CMD_FORMAT_AND_WRITE, 0xff, "FORMAT AND WRITE", 10, fdctrl_unimplemented },
2374     { FD_CMD_RELATIVE_SEEK_IN, 0xff, "RELATIVE SEEK IN", 2, fdctrl_handle_relative_seek_in },
2375     { FD_CMD_LOCK, 0x7f, "LOCK", 0, fdctrl_handle_lock },
2376     { FD_CMD_DUMPREG, 0xff, "DUMPREG", 0, fdctrl_handle_dumpreg },
2377     { FD_CMD_VERSION, 0xff, "VERSION", 0, fdctrl_handle_version },
2378     { FD_CMD_PART_ID, 0xff, "PART ID", 0, fdctrl_handle_partid },
2379     { FD_CMD_WRITE, 0x1f, "WRITE (BeOS)", 8, fdctrl_start_transfer, FD_DIR_WRITE }, /* not in specification ; BeOS 4.5 bug */
2380     { 0, 0, "unknown", 0, fdctrl_unimplemented }, /* default handler */
2381 };
2382 /* Associate command to an index in the 'handlers' array */
2383 static uint8_t command_to_handler[256];
2384 
2385 static const FDCtrlCommand *get_command(uint8_t cmd)
2386 {
2387     int idx;
2388 
2389     idx = command_to_handler[cmd];
2390     FLOPPY_DPRINTF("%s command\n", handlers[idx].name);
2391     return &handlers[idx];
2392 }
2393 
2394 static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
2395 {
2396     FDrive *cur_drv;
2397     const FDCtrlCommand *cmd;
2398     uint32_t pos;
2399 
2400     /* Reset mode */
2401     if (!(fdctrl->dor & FD_DOR_nRESET)) {
2402         FLOPPY_DPRINTF("Floppy controller in RESET state !\n");
2403         return;
2404     }
2405     if (!(fdctrl->msr & FD_MSR_RQM) || (fdctrl->msr & FD_MSR_DIO)) {
2406         FLOPPY_DPRINTF("error: controller not ready for writing\n");
2407         return;
2408     }
2409     fdctrl->dsr &= ~FD_DSR_PWRDOWN;
2410 
2411     FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
2412 
2413     /* If data_len spans multiple sectors, the current position in the FIFO
2414      * wraps around while fdctrl->data_pos is the real position in the whole
2415      * request. */
2416     pos = fdctrl->data_pos++;
2417     pos %= FD_SECTOR_LEN;
2418     fdctrl->fifo[pos] = value;
2419 
2420     if (fdctrl->data_pos == fdctrl->data_len) {
2421         fdctrl->msr &= ~FD_MSR_RQM;
2422     }
2423 
2424     switch (fdctrl->phase) {
2425     case FD_PHASE_EXECUTION:
2426         /* For DMA requests, RQM should be cleared during execution phase, so
2427          * we would have errored out above. */
2428         assert(fdctrl->msr & FD_MSR_NONDMA);
2429 
2430         /* FIFO data write */
2431         if (pos == FD_SECTOR_LEN - 1 ||
2432             fdctrl->data_pos == fdctrl->data_len) {
2433             cur_drv = get_cur_drv(fdctrl);
2434             if (blk_pwrite(cur_drv->blk, fd_offset(cur_drv), fdctrl->fifo,
2435                            BDRV_SECTOR_SIZE, 0) < 0) {
2436                 FLOPPY_DPRINTF("error writing sector %d\n",
2437                                fd_sector(cur_drv));
2438                 break;
2439             }
2440             if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
2441                 FLOPPY_DPRINTF("error seeking to next sector %d\n",
2442                                fd_sector(cur_drv));
2443                 break;
2444             }
2445         }
2446 
2447         /* Switch to result phase when done with the transfer */
2448         if (fdctrl->data_pos == fdctrl->data_len) {
2449             fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
2450         }
2451         break;
2452 
2453     case FD_PHASE_COMMAND:
2454         assert(!(fdctrl->msr & FD_MSR_NONDMA));
2455         assert(fdctrl->data_pos < FD_SECTOR_LEN);
2456 
2457         if (pos == 0) {
2458             /* The first byte specifies the command. Now we start reading
2459              * as many parameters as this command requires. */
2460             cmd = get_command(value);
2461             fdctrl->data_len = cmd->parameters + 1;
2462             if (cmd->parameters) {
2463                 fdctrl->msr |= FD_MSR_RQM;
2464             }
2465             fdctrl->msr |= FD_MSR_CMDBUSY;
2466         }
2467 
2468         if (fdctrl->data_pos == fdctrl->data_len) {
2469             /* We have all parameters now, execute the command */
2470             fdctrl->phase = FD_PHASE_EXECUTION;
2471 
2472             if (fdctrl->data_state & FD_STATE_FORMAT) {
2473                 fdctrl_format_sector(fdctrl);
2474                 break;
2475             }
2476 
2477             cmd = get_command(fdctrl->fifo[0]);
2478             FLOPPY_DPRINTF("Calling handler for '%s'\n", cmd->name);
2479             cmd->handler(fdctrl, cmd->direction);
2480         }
2481         break;
2482 
2483     case FD_PHASE_RESULT:
2484     default:
2485         abort();
2486     }
2487 }
2488 
2489 static void fdctrl_result_timer(void *opaque)
2490 {
2491     FDCtrl *fdctrl = opaque;
2492     FDrive *cur_drv = get_cur_drv(fdctrl);
2493 
2494     /* Pretend we are spinning.
2495      * This is needed for Coherent, which uses READ ID to check for
2496      * sector interleaving.
2497      */
2498     if (cur_drv->last_sect != 0) {
2499         cur_drv->sect = (cur_drv->sect % cur_drv->last_sect) + 1;
2500     }
2501     /* READ_ID can't automatically succeed! */
2502     if (fdctrl->check_media_rate &&
2503         (fdctrl->dsr & FD_DSR_DRATEMASK) != cur_drv->media_rate) {
2504         FLOPPY_DPRINTF("read id rate mismatch (fdc=%d, media=%d)\n",
2505                        fdctrl->dsr & FD_DSR_DRATEMASK, cur_drv->media_rate);
2506         fdctrl_stop_transfer(fdctrl, FD_SR0_ABNTERM, FD_SR1_MA, 0x00);
2507     } else {
2508         fdctrl_stop_transfer(fdctrl, 0x00, 0x00, 0x00);
2509     }
2510 }
2511 
2512 /* Init functions */
2513 static void fdctrl_connect_drives(FDCtrl *fdctrl, DeviceState *fdc_dev,
2514                                   Error **errp)
2515 {
2516     unsigned int i;
2517     FDrive *drive;
2518     DeviceState *dev;
2519     BlockBackend *blk;
2520     Error *local_err = NULL;
2521 
2522     for (i = 0; i < MAX_FD; i++) {
2523         drive = &fdctrl->drives[i];
2524         drive->fdctrl = fdctrl;
2525 
2526         /* If the drive is not present, we skip creating the qdev device, but
2527          * still have to initialise the controller. */
2528         blk = fdctrl->qdev_for_drives[i].blk;
2529         if (!blk) {
2530             fd_init(drive);
2531             fd_revalidate(drive);
2532             continue;
2533         }
2534 
2535         dev = qdev_create(&fdctrl->bus.bus, "floppy");
2536         qdev_prop_set_uint32(dev, "unit", i);
2537         qdev_prop_set_enum(dev, "drive-type", fdctrl->qdev_for_drives[i].type);
2538 
2539         blk_ref(blk);
2540         blk_detach_dev(blk, fdc_dev);
2541         fdctrl->qdev_for_drives[i].blk = NULL;
2542         qdev_prop_set_drive(dev, "drive", blk, &local_err);
2543         blk_unref(blk);
2544 
2545         if (local_err) {
2546             error_propagate(errp, local_err);
2547             return;
2548         }
2549 
2550         object_property_set_bool(OBJECT(dev), true, "realized", &local_err);
2551         if (local_err) {
2552             error_propagate(errp, local_err);
2553             return;
2554         }
2555     }
2556 }
2557 
2558 ISADevice *fdctrl_init_isa(ISABus *bus, DriveInfo **fds)
2559 {
2560     DeviceState *dev;
2561     ISADevice *isadev;
2562 
2563     isadev = isa_try_create(bus, TYPE_ISA_FDC);
2564     if (!isadev) {
2565         return NULL;
2566     }
2567     dev = DEVICE(isadev);
2568 
2569     if (fds[0]) {
2570         qdev_prop_set_drive(dev, "driveA", blk_by_legacy_dinfo(fds[0]),
2571                             &error_fatal);
2572     }
2573     if (fds[1]) {
2574         qdev_prop_set_drive(dev, "driveB", blk_by_legacy_dinfo(fds[1]),
2575                             &error_fatal);
2576     }
2577     qdev_init_nofail(dev);
2578 
2579     return isadev;
2580 }
2581 
2582 void fdctrl_init_sysbus(qemu_irq irq, int dma_chann,
2583                         hwaddr mmio_base, DriveInfo **fds)
2584 {
2585     FDCtrl *fdctrl;
2586     DeviceState *dev;
2587     SysBusDevice *sbd;
2588     FDCtrlSysBus *sys;
2589 
2590     dev = qdev_create(NULL, "sysbus-fdc");
2591     sys = SYSBUS_FDC(dev);
2592     fdctrl = &sys->state;
2593     fdctrl->dma_chann = dma_chann; /* FIXME */
2594     if (fds[0]) {
2595         qdev_prop_set_drive(dev, "driveA", blk_by_legacy_dinfo(fds[0]),
2596                             &error_fatal);
2597     }
2598     if (fds[1]) {
2599         qdev_prop_set_drive(dev, "driveB", blk_by_legacy_dinfo(fds[1]),
2600                             &error_fatal);
2601     }
2602     qdev_init_nofail(dev);
2603     sbd = SYS_BUS_DEVICE(dev);
2604     sysbus_connect_irq(sbd, 0, irq);
2605     sysbus_mmio_map(sbd, 0, mmio_base);
2606 }
2607 
2608 void sun4m_fdctrl_init(qemu_irq irq, hwaddr io_base,
2609                        DriveInfo **fds, qemu_irq *fdc_tc)
2610 {
2611     DeviceState *dev;
2612     FDCtrlSysBus *sys;
2613 
2614     dev = qdev_create(NULL, "SUNW,fdtwo");
2615     if (fds[0]) {
2616         qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(fds[0]),
2617                             &error_fatal);
2618     }
2619     qdev_init_nofail(dev);
2620     sys = SYSBUS_FDC(dev);
2621     sysbus_connect_irq(SYS_BUS_DEVICE(sys), 0, irq);
2622     sysbus_mmio_map(SYS_BUS_DEVICE(sys), 0, io_base);
2623     *fdc_tc = qdev_get_gpio_in(dev, 0);
2624 }
2625 
2626 static void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl,
2627                                   Error **errp)
2628 {
2629     int i, j;
2630     static int command_tables_inited = 0;
2631 
2632     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
2633         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
2634     }
2635 
2636     /* Fill 'command_to_handler' lookup table */
2637     if (!command_tables_inited) {
2638         command_tables_inited = 1;
2639         for (i = ARRAY_SIZE(handlers) - 1; i >= 0; i--) {
2640             for (j = 0; j < sizeof(command_to_handler); j++) {
2641                 if ((j & handlers[i].mask) == handlers[i].value) {
2642                     command_to_handler[j] = i;
2643                 }
2644             }
2645         }
2646     }
2647 
2648     FLOPPY_DPRINTF("init controller\n");
2649     fdctrl->fifo = qemu_memalign(512, FD_SECTOR_LEN);
2650     fdctrl->fifo_size = 512;
2651     fdctrl->result_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
2652                                              fdctrl_result_timer, fdctrl);
2653 
2654     fdctrl->version = 0x90; /* Intel 82078 controller */
2655     fdctrl->config = FD_CONFIG_EIS | FD_CONFIG_EFIFO; /* Implicit seek, polling & FIFO enabled */
2656     fdctrl->num_floppies = MAX_FD;
2657 
2658     if (fdctrl->dma_chann != -1) {
2659         IsaDmaClass *k;
2660         assert(fdctrl->dma);
2661         k = ISADMA_GET_CLASS(fdctrl->dma);
2662         k->register_channel(fdctrl->dma, fdctrl->dma_chann,
2663                             &fdctrl_transfer_handler, fdctrl);
2664     }
2665 
2666     floppy_bus_create(fdctrl, &fdctrl->bus, dev);
2667     fdctrl_connect_drives(fdctrl, dev, errp);
2668 }
2669 
2670 static const MemoryRegionPortio fdc_portio_list[] = {
2671     { 1, 5, 1, .read = fdctrl_read, .write = fdctrl_write },
2672     { 7, 1, 1, .read = fdctrl_read, .write = fdctrl_write },
2673     PORTIO_END_OF_LIST(),
2674 };
2675 
2676 static void isabus_fdc_realize(DeviceState *dev, Error **errp)
2677 {
2678     ISADevice *isadev = ISA_DEVICE(dev);
2679     FDCtrlISABus *isa = ISA_FDC(dev);
2680     FDCtrl *fdctrl = &isa->state;
2681     Error *err = NULL;
2682 
2683     isa_register_portio_list(isadev, &fdctrl->portio_list,
2684                              isa->iobase, fdc_portio_list, fdctrl,
2685                              "fdc");
2686 
2687     isa_init_irq(isadev, &fdctrl->irq, isa->irq);
2688     fdctrl->dma_chann = isa->dma;
2689     if (fdctrl->dma_chann != -1) {
2690         fdctrl->dma = isa_get_dma(isa_bus_from_device(isadev), isa->dma);
2691         if (!fdctrl->dma) {
2692             error_setg(errp, "ISA controller does not support DMA");
2693             return;
2694         }
2695     }
2696 
2697     qdev_set_legacy_instance_id(dev, isa->iobase, 2);
2698     fdctrl_realize_common(dev, fdctrl, &err);
2699     if (err != NULL) {
2700         error_propagate(errp, err);
2701         return;
2702     }
2703 }
2704 
2705 static void sysbus_fdc_initfn(Object *obj)
2706 {
2707     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
2708     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
2709     FDCtrl *fdctrl = &sys->state;
2710 
2711     fdctrl->dma_chann = -1;
2712 
2713     memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_ops, fdctrl,
2714                           "fdc", 0x08);
2715     sysbus_init_mmio(sbd, &fdctrl->iomem);
2716 }
2717 
2718 static void sun4m_fdc_initfn(Object *obj)
2719 {
2720     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
2721     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
2722     FDCtrl *fdctrl = &sys->state;
2723 
2724     fdctrl->dma_chann = -1;
2725 
2726     memory_region_init_io(&fdctrl->iomem, obj, &fdctrl_mem_strict_ops,
2727                           fdctrl, "fdctrl", 0x08);
2728     sysbus_init_mmio(sbd, &fdctrl->iomem);
2729 }
2730 
2731 static void sysbus_fdc_common_initfn(Object *obj)
2732 {
2733     DeviceState *dev = DEVICE(obj);
2734     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
2735     FDCtrlSysBus *sys = SYSBUS_FDC(obj);
2736     FDCtrl *fdctrl = &sys->state;
2737 
2738     qdev_set_legacy_instance_id(dev, 0 /* io */, 2); /* FIXME */
2739 
2740     sysbus_init_irq(sbd, &fdctrl->irq);
2741     qdev_init_gpio_in(dev, fdctrl_handle_tc, 1);
2742 }
2743 
2744 static void sysbus_fdc_common_realize(DeviceState *dev, Error **errp)
2745 {
2746     FDCtrlSysBus *sys = SYSBUS_FDC(dev);
2747     FDCtrl *fdctrl = &sys->state;
2748 
2749     fdctrl_realize_common(dev, fdctrl, errp);
2750 }
2751 
2752 FloppyDriveType isa_fdc_get_drive_type(ISADevice *fdc, int i)
2753 {
2754     FDCtrlISABus *isa = ISA_FDC(fdc);
2755 
2756     return isa->state.drives[i].drive;
2757 }
2758 
2759 void isa_fdc_get_drive_max_chs(FloppyDriveType type,
2760                                uint8_t *maxc, uint8_t *maxh, uint8_t *maxs)
2761 {
2762     const FDFormat *fdf;
2763 
2764     *maxc = *maxh = *maxs = 0;
2765     for (fdf = fd_formats; fdf->drive != FLOPPY_DRIVE_TYPE_NONE; fdf++) {
2766         if (fdf->drive != type) {
2767             continue;
2768         }
2769         if (*maxc < fdf->max_track) {
2770             *maxc = fdf->max_track;
2771         }
2772         if (*maxh < fdf->max_head) {
2773             *maxh = fdf->max_head;
2774         }
2775         if (*maxs < fdf->last_sect) {
2776             *maxs = fdf->last_sect;
2777         }
2778     }
2779     (*maxc)--;
2780 }
2781 
2782 static const VMStateDescription vmstate_isa_fdc ={
2783     .name = "fdc",
2784     .version_id = 2,
2785     .minimum_version_id = 2,
2786     .fields = (VMStateField[]) {
2787         VMSTATE_STRUCT(state, FDCtrlISABus, 0, vmstate_fdc, FDCtrl),
2788         VMSTATE_END_OF_LIST()
2789     }
2790 };
2791 
2792 static Property isa_fdc_properties[] = {
2793     DEFINE_PROP_UINT32("iobase", FDCtrlISABus, iobase, 0x3f0),
2794     DEFINE_PROP_UINT32("irq", FDCtrlISABus, irq, 6),
2795     DEFINE_PROP_UINT32("dma", FDCtrlISABus, dma, 2),
2796     DEFINE_PROP_DRIVE("driveA", FDCtrlISABus, state.qdev_for_drives[0].blk),
2797     DEFINE_PROP_DRIVE("driveB", FDCtrlISABus, state.qdev_for_drives[1].blk),
2798     DEFINE_PROP_BIT("check_media_rate", FDCtrlISABus, state.check_media_rate,
2799                     0, true),
2800     DEFINE_PROP_SIGNED("fdtypeA", FDCtrlISABus, state.qdev_for_drives[0].type,
2801                         FLOPPY_DRIVE_TYPE_AUTO, qdev_prop_fdc_drive_type,
2802                         FloppyDriveType),
2803     DEFINE_PROP_SIGNED("fdtypeB", FDCtrlISABus, state.qdev_for_drives[1].type,
2804                         FLOPPY_DRIVE_TYPE_AUTO, qdev_prop_fdc_drive_type,
2805                         FloppyDriveType),
2806     DEFINE_PROP_SIGNED("fallback", FDCtrlISABus, state.fallback,
2807                         FLOPPY_DRIVE_TYPE_288, qdev_prop_fdc_drive_type,
2808                         FloppyDriveType),
2809     DEFINE_PROP_END_OF_LIST(),
2810 };
2811 
2812 static void isabus_fdc_class_init(ObjectClass *klass, void *data)
2813 {
2814     DeviceClass *dc = DEVICE_CLASS(klass);
2815 
2816     dc->realize = isabus_fdc_realize;
2817     dc->fw_name = "fdc";
2818     dc->reset = fdctrl_external_reset_isa;
2819     dc->vmsd = &vmstate_isa_fdc;
2820     dc->props = isa_fdc_properties;
2821     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2822 }
2823 
2824 static void isabus_fdc_instance_init(Object *obj)
2825 {
2826     FDCtrlISABus *isa = ISA_FDC(obj);
2827 
2828     device_add_bootindex_property(obj, &isa->bootindexA,
2829                                   "bootindexA", "/floppy@0",
2830                                   DEVICE(obj), NULL);
2831     device_add_bootindex_property(obj, &isa->bootindexB,
2832                                   "bootindexB", "/floppy@1",
2833                                   DEVICE(obj), NULL);
2834 }
2835 
2836 static const TypeInfo isa_fdc_info = {
2837     .name          = TYPE_ISA_FDC,
2838     .parent        = TYPE_ISA_DEVICE,
2839     .instance_size = sizeof(FDCtrlISABus),
2840     .class_init    = isabus_fdc_class_init,
2841     .instance_init = isabus_fdc_instance_init,
2842 };
2843 
2844 static const VMStateDescription vmstate_sysbus_fdc ={
2845     .name = "fdc",
2846     .version_id = 2,
2847     .minimum_version_id = 2,
2848     .fields = (VMStateField[]) {
2849         VMSTATE_STRUCT(state, FDCtrlSysBus, 0, vmstate_fdc, FDCtrl),
2850         VMSTATE_END_OF_LIST()
2851     }
2852 };
2853 
2854 static Property sysbus_fdc_properties[] = {
2855     DEFINE_PROP_DRIVE("driveA", FDCtrlSysBus, state.qdev_for_drives[0].blk),
2856     DEFINE_PROP_DRIVE("driveB", FDCtrlSysBus, state.qdev_for_drives[1].blk),
2857     DEFINE_PROP_SIGNED("fdtypeA", FDCtrlSysBus, state.qdev_for_drives[0].type,
2858                         FLOPPY_DRIVE_TYPE_AUTO, qdev_prop_fdc_drive_type,
2859                         FloppyDriveType),
2860     DEFINE_PROP_SIGNED("fdtypeB", FDCtrlSysBus, state.qdev_for_drives[1].type,
2861                         FLOPPY_DRIVE_TYPE_AUTO, qdev_prop_fdc_drive_type,
2862                         FloppyDriveType),
2863     DEFINE_PROP_SIGNED("fallback", FDCtrlISABus, state.fallback,
2864                         FLOPPY_DRIVE_TYPE_144, qdev_prop_fdc_drive_type,
2865                         FloppyDriveType),
2866     DEFINE_PROP_END_OF_LIST(),
2867 };
2868 
2869 static void sysbus_fdc_class_init(ObjectClass *klass, void *data)
2870 {
2871     DeviceClass *dc = DEVICE_CLASS(klass);
2872 
2873     dc->props = sysbus_fdc_properties;
2874     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2875 }
2876 
2877 static const TypeInfo sysbus_fdc_info = {
2878     .name          = "sysbus-fdc",
2879     .parent        = TYPE_SYSBUS_FDC,
2880     .instance_init = sysbus_fdc_initfn,
2881     .class_init    = sysbus_fdc_class_init,
2882 };
2883 
2884 static Property sun4m_fdc_properties[] = {
2885     DEFINE_PROP_DRIVE("drive", FDCtrlSysBus, state.qdev_for_drives[0].blk),
2886     DEFINE_PROP_SIGNED("fdtype", FDCtrlSysBus, state.qdev_for_drives[0].type,
2887                         FLOPPY_DRIVE_TYPE_AUTO, qdev_prop_fdc_drive_type,
2888                         FloppyDriveType),
2889     DEFINE_PROP_SIGNED("fallback", FDCtrlISABus, state.fallback,
2890                         FLOPPY_DRIVE_TYPE_144, qdev_prop_fdc_drive_type,
2891                         FloppyDriveType),
2892     DEFINE_PROP_END_OF_LIST(),
2893 };
2894 
2895 static void sun4m_fdc_class_init(ObjectClass *klass, void *data)
2896 {
2897     DeviceClass *dc = DEVICE_CLASS(klass);
2898 
2899     dc->props = sun4m_fdc_properties;
2900     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2901 }
2902 
2903 static const TypeInfo sun4m_fdc_info = {
2904     .name          = "SUNW,fdtwo",
2905     .parent        = TYPE_SYSBUS_FDC,
2906     .instance_init = sun4m_fdc_initfn,
2907     .class_init    = sun4m_fdc_class_init,
2908 };
2909 
2910 static void sysbus_fdc_common_class_init(ObjectClass *klass, void *data)
2911 {
2912     DeviceClass *dc = DEVICE_CLASS(klass);
2913 
2914     dc->realize = sysbus_fdc_common_realize;
2915     dc->reset = fdctrl_external_reset_sysbus;
2916     dc->vmsd = &vmstate_sysbus_fdc;
2917 }
2918 
2919 static const TypeInfo sysbus_fdc_type_info = {
2920     .name          = TYPE_SYSBUS_FDC,
2921     .parent        = TYPE_SYS_BUS_DEVICE,
2922     .instance_size = sizeof(FDCtrlSysBus),
2923     .instance_init = sysbus_fdc_common_initfn,
2924     .abstract      = true,
2925     .class_init    = sysbus_fdc_common_class_init,
2926 };
2927 
2928 static void fdc_register_types(void)
2929 {
2930     type_register_static(&isa_fdc_info);
2931     type_register_static(&sysbus_fdc_type_info);
2932     type_register_static(&sysbus_fdc_info);
2933     type_register_static(&sun4m_fdc_info);
2934     type_register_static(&floppy_bus_info);
2935     type_register_static(&floppy_drive_info);
2936 }
2937 
2938 type_init(fdc_register_types)
2939