xref: /openbmc/qemu/hw/ide/core.c (revision 51b24e34)
1 /*
2  * QEMU IDE disk and CD/DVD-ROM Emulator
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  * Copyright (c) 2006 Openedhand Ltd.
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 #include <hw/hw.h>
26 #include <hw/pc.h>
27 #include <hw/pci.h>
28 #include "qemu-error.h"
29 #include "qemu-timer.h"
30 #include "sysemu.h"
31 #include "dma.h"
32 #include "blockdev.h"
33 
34 #include <hw/ide/internal.h>
35 
36 /* These values were based on a Seagate ST3500418AS but have been modified
37    to make more sense in QEMU */
38 static const int smart_attributes[][12] = {
39     /* id,  flags, hflags, val, wrst, raw (6 bytes), threshold */
40     /* raw read error rate*/
41     { 0x01, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06},
42     /* spin up */
43     { 0x03, 0x03, 0x00, 0x64, 0x64, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
44     /* start stop count */
45     { 0x04, 0x02, 0x00, 0x64, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14},
46     /* remapped sectors */
47     { 0x05, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24},
48     /* power on hours */
49     { 0x09, 0x03, 0x00, 0x64, 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
50     /* power cycle count */
51     { 0x0c, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
52     /* airflow-temperature-celsius */
53     { 190,  0x03, 0x00, 0x45, 0x45, 0x1f, 0x00, 0x1f, 0x1f, 0x00, 0x00, 0x32},
54     /* end of list */
55     { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
56 };
57 
58 static int ide_handle_rw_error(IDEState *s, int error, int op);
59 
60 static void padstr(char *str, const char *src, int len)
61 {
62     int i, v;
63     for(i = 0; i < len; i++) {
64         if (*src)
65             v = *src++;
66         else
67             v = ' ';
68         str[i^1] = v;
69     }
70 }
71 
72 static void put_le16(uint16_t *p, unsigned int v)
73 {
74     *p = cpu_to_le16(v);
75 }
76 
77 static void ide_identify(IDEState *s)
78 {
79     uint16_t *p;
80     unsigned int oldsize;
81     IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
82 
83     if (s->identify_set) {
84 	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
85 	return;
86     }
87 
88     memset(s->io_buffer, 0, 512);
89     p = (uint16_t *)s->io_buffer;
90     put_le16(p + 0, 0x0040);
91     put_le16(p + 1, s->cylinders);
92     put_le16(p + 3, s->heads);
93     put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
94     put_le16(p + 5, 512); /* XXX: retired, remove ? */
95     put_le16(p + 6, s->sectors);
96     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
97     put_le16(p + 20, 3); /* XXX: retired, remove ? */
98     put_le16(p + 21, 512); /* cache size in sectors */
99     put_le16(p + 22, 4); /* ecc bytes */
100     padstr((char *)(p + 23), s->version, 8); /* firmware version */
101     padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
102 #if MAX_MULT_SECTORS > 1
103     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
104 #endif
105     put_le16(p + 48, 1); /* dword I/O */
106     put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
107     put_le16(p + 51, 0x200); /* PIO transfer cycle */
108     put_le16(p + 52, 0x200); /* DMA transfer cycle */
109     put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
110     put_le16(p + 54, s->cylinders);
111     put_le16(p + 55, s->heads);
112     put_le16(p + 56, s->sectors);
113     oldsize = s->cylinders * s->heads * s->sectors;
114     put_le16(p + 57, oldsize);
115     put_le16(p + 58, oldsize >> 16);
116     if (s->mult_sectors)
117         put_le16(p + 59, 0x100 | s->mult_sectors);
118     put_le16(p + 60, s->nb_sectors);
119     put_le16(p + 61, s->nb_sectors >> 16);
120     put_le16(p + 62, 0x07); /* single word dma0-2 supported */
121     put_le16(p + 63, 0x07); /* mdma0-2 supported */
122     put_le16(p + 64, 0x03); /* pio3-4 supported */
123     put_le16(p + 65, 120);
124     put_le16(p + 66, 120);
125     put_le16(p + 67, 120);
126     put_le16(p + 68, 120);
127     if (dev && dev->conf.discard_granularity) {
128         put_le16(p + 69, (1 << 14)); /* determinate TRIM behavior */
129     }
130 
131     if (s->ncq_queues) {
132         put_le16(p + 75, s->ncq_queues - 1);
133         /* NCQ supported */
134         put_le16(p + 76, (1 << 8));
135     }
136 
137     put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
138     put_le16(p + 81, 0x16); /* conforms to ata5 */
139     /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */
140     put_le16(p + 82, (1 << 14) | (1 << 5) | 1);
141     /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
142     put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
143     /* 14=set to 1, 1=SMART self test, 0=SMART error logging */
144     put_le16(p + 84, (1 << 14) | 0);
145     /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */
146     if (bdrv_enable_write_cache(s->bs))
147          put_le16(p + 85, (1 << 14) | (1 << 5) | 1);
148     else
149          put_le16(p + 85, (1 << 14) | 1);
150     /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
151     put_le16(p + 86, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
152     /* 14=set to 1, 1=smart self test, 0=smart error logging */
153     put_le16(p + 87, (1 << 14) | 0);
154     put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
155     put_le16(p + 93, 1 | (1 << 14) | 0x2000);
156     put_le16(p + 100, s->nb_sectors);
157     put_le16(p + 101, s->nb_sectors >> 16);
158     put_le16(p + 102, s->nb_sectors >> 32);
159     put_le16(p + 103, s->nb_sectors >> 48);
160 
161     if (dev && dev->conf.physical_block_size)
162         put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));
163     if (dev && dev->conf.discard_granularity) {
164         put_le16(p + 169, 1); /* TRIM support */
165     }
166 
167     memcpy(s->identify_data, p, sizeof(s->identify_data));
168     s->identify_set = 1;
169 }
170 
171 static void ide_atapi_identify(IDEState *s)
172 {
173     uint16_t *p;
174 
175     if (s->identify_set) {
176 	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
177 	return;
178     }
179 
180     memset(s->io_buffer, 0, 512);
181     p = (uint16_t *)s->io_buffer;
182     /* Removable CDROM, 50us response, 12 byte packets */
183     put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
184     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
185     put_le16(p + 20, 3); /* buffer type */
186     put_le16(p + 21, 512); /* cache size in sectors */
187     put_le16(p + 22, 4); /* ecc bytes */
188     padstr((char *)(p + 23), s->version, 8); /* firmware version */
189     padstr((char *)(p + 27), "QEMU DVD-ROM", 40); /* model */
190     put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
191 #ifdef USE_DMA_CDROM
192     put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
193     put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
194     put_le16(p + 62, 7);  /* single word dma0-2 supported */
195     put_le16(p + 63, 7);  /* mdma0-2 supported */
196 #else
197     put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
198     put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
199     put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
200 #endif
201     put_le16(p + 64, 3); /* pio3-4 supported */
202     put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
203     put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
204     put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
205     put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
206 
207     put_le16(p + 71, 30); /* in ns */
208     put_le16(p + 72, 30); /* in ns */
209 
210     if (s->ncq_queues) {
211         put_le16(p + 75, s->ncq_queues - 1);
212         /* NCQ supported */
213         put_le16(p + 76, (1 << 8));
214     }
215 
216     put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
217 #ifdef USE_DMA_CDROM
218     put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
219 #endif
220     memcpy(s->identify_data, p, sizeof(s->identify_data));
221     s->identify_set = 1;
222 }
223 
224 static void ide_cfata_identify(IDEState *s)
225 {
226     uint16_t *p;
227     uint32_t cur_sec;
228 
229     p = (uint16_t *) s->identify_data;
230     if (s->identify_set)
231         goto fill_buffer;
232 
233     memset(p, 0, sizeof(s->identify_data));
234 
235     cur_sec = s->cylinders * s->heads * s->sectors;
236 
237     put_le16(p + 0, 0x848a);			/* CF Storage Card signature */
238     put_le16(p + 1, s->cylinders);		/* Default cylinders */
239     put_le16(p + 3, s->heads);			/* Default heads */
240     put_le16(p + 6, s->sectors);		/* Default sectors per track */
241     put_le16(p + 7, s->nb_sectors >> 16);	/* Sectors per card */
242     put_le16(p + 8, s->nb_sectors);		/* Sectors per card */
243     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
244     put_le16(p + 22, 0x0004);			/* ECC bytes */
245     padstr((char *) (p + 23), s->version, 8);	/* Firmware Revision */
246     padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
247 #if MAX_MULT_SECTORS > 1
248     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
249 #else
250     put_le16(p + 47, 0x0000);
251 #endif
252     put_le16(p + 49, 0x0f00);			/* Capabilities */
253     put_le16(p + 51, 0x0002);			/* PIO cycle timing mode */
254     put_le16(p + 52, 0x0001);			/* DMA cycle timing mode */
255     put_le16(p + 53, 0x0003);			/* Translation params valid */
256     put_le16(p + 54, s->cylinders);		/* Current cylinders */
257     put_le16(p + 55, s->heads);			/* Current heads */
258     put_le16(p + 56, s->sectors);		/* Current sectors */
259     put_le16(p + 57, cur_sec);			/* Current capacity */
260     put_le16(p + 58, cur_sec >> 16);		/* Current capacity */
261     if (s->mult_sectors)			/* Multiple sector setting */
262         put_le16(p + 59, 0x100 | s->mult_sectors);
263     put_le16(p + 60, s->nb_sectors);		/* Total LBA sectors */
264     put_le16(p + 61, s->nb_sectors >> 16);	/* Total LBA sectors */
265     put_le16(p + 63, 0x0203);			/* Multiword DMA capability */
266     put_le16(p + 64, 0x0001);			/* Flow Control PIO support */
267     put_le16(p + 65, 0x0096);			/* Min. Multiword DMA cycle */
268     put_le16(p + 66, 0x0096);			/* Rec. Multiword DMA cycle */
269     put_le16(p + 68, 0x00b4);			/* Min. PIO cycle time */
270     put_le16(p + 82, 0x400c);			/* Command Set supported */
271     put_le16(p + 83, 0x7068);			/* Command Set supported */
272     put_le16(p + 84, 0x4000);			/* Features supported */
273     put_le16(p + 85, 0x000c);			/* Command Set enabled */
274     put_le16(p + 86, 0x7044);			/* Command Set enabled */
275     put_le16(p + 87, 0x4000);			/* Features enabled */
276     put_le16(p + 91, 0x4060);			/* Current APM level */
277     put_le16(p + 129, 0x0002);			/* Current features option */
278     put_le16(p + 130, 0x0005);			/* Reassigned sectors */
279     put_le16(p + 131, 0x0001);			/* Initial power mode */
280     put_le16(p + 132, 0x0000);			/* User signature */
281     put_le16(p + 160, 0x8100);			/* Power requirement */
282     put_le16(p + 161, 0x8001);			/* CF command set */
283 
284     s->identify_set = 1;
285 
286 fill_buffer:
287     memcpy(s->io_buffer, p, sizeof(s->identify_data));
288 }
289 
290 static void ide_set_signature(IDEState *s)
291 {
292     s->select &= 0xf0; /* clear head */
293     /* put signature */
294     s->nsector = 1;
295     s->sector = 1;
296     if (s->drive_kind == IDE_CD) {
297         s->lcyl = 0x14;
298         s->hcyl = 0xeb;
299     } else if (s->bs) {
300         s->lcyl = 0;
301         s->hcyl = 0;
302     } else {
303         s->lcyl = 0xff;
304         s->hcyl = 0xff;
305     }
306 }
307 
308 typedef struct TrimAIOCB {
309     BlockDriverAIOCB common;
310     QEMUBH *bh;
311     int ret;
312 } TrimAIOCB;
313 
314 static void trim_aio_cancel(BlockDriverAIOCB *acb)
315 {
316     TrimAIOCB *iocb = container_of(acb, TrimAIOCB, common);
317 
318     qemu_bh_delete(iocb->bh);
319     iocb->bh = NULL;
320     qemu_aio_release(iocb);
321 }
322 
323 static AIOPool trim_aio_pool = {
324     .aiocb_size         = sizeof(TrimAIOCB),
325     .cancel             = trim_aio_cancel,
326 };
327 
328 static void ide_trim_bh_cb(void *opaque)
329 {
330     TrimAIOCB *iocb = opaque;
331 
332     iocb->common.cb(iocb->common.opaque, iocb->ret);
333 
334     qemu_bh_delete(iocb->bh);
335     iocb->bh = NULL;
336 
337     qemu_aio_release(iocb);
338 }
339 
340 BlockDriverAIOCB *ide_issue_trim(BlockDriverState *bs,
341         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
342         BlockDriverCompletionFunc *cb, void *opaque)
343 {
344     TrimAIOCB *iocb;
345     int i, j, ret;
346 
347     iocb = qemu_aio_get(&trim_aio_pool, bs, cb, opaque);
348     iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);
349     iocb->ret = 0;
350 
351     for (j = 0; j < qiov->niov; j++) {
352         uint64_t *buffer = qiov->iov[j].iov_base;
353 
354         for (i = 0; i < qiov->iov[j].iov_len / 8; i++) {
355             /* 6-byte LBA + 2-byte range per entry */
356             uint64_t entry = le64_to_cpu(buffer[i]);
357             uint64_t sector = entry & 0x0000ffffffffffffULL;
358             uint16_t count = entry >> 48;
359 
360             if (count == 0) {
361                 break;
362             }
363 
364             ret = bdrv_discard(bs, sector, count);
365             if (!iocb->ret) {
366                 iocb->ret = ret;
367             }
368         }
369     }
370 
371     qemu_bh_schedule(iocb->bh);
372 
373     return &iocb->common;
374 }
375 
376 static inline void ide_abort_command(IDEState *s)
377 {
378     s->status = READY_STAT | ERR_STAT;
379     s->error = ABRT_ERR;
380 }
381 
382 /* prepare data transfer and tell what to do after */
383 void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
384                         EndTransferFunc *end_transfer_func)
385 {
386     s->end_transfer_func = end_transfer_func;
387     s->data_ptr = buf;
388     s->data_end = buf + size;
389     if (!(s->status & ERR_STAT)) {
390         s->status |= DRQ_STAT;
391     }
392     s->bus->dma->ops->start_transfer(s->bus->dma);
393 }
394 
395 void ide_transfer_stop(IDEState *s)
396 {
397     s->end_transfer_func = ide_transfer_stop;
398     s->data_ptr = s->io_buffer;
399     s->data_end = s->io_buffer;
400     s->status &= ~DRQ_STAT;
401 }
402 
403 int64_t ide_get_sector(IDEState *s)
404 {
405     int64_t sector_num;
406     if (s->select & 0x40) {
407         /* lba */
408 	if (!s->lba48) {
409 	    sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
410 		(s->lcyl << 8) | s->sector;
411 	} else {
412 	    sector_num = ((int64_t)s->hob_hcyl << 40) |
413 		((int64_t) s->hob_lcyl << 32) |
414 		((int64_t) s->hob_sector << 24) |
415 		((int64_t) s->hcyl << 16) |
416 		((int64_t) s->lcyl << 8) | s->sector;
417 	}
418     } else {
419         sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
420             (s->select & 0x0f) * s->sectors + (s->sector - 1);
421     }
422     return sector_num;
423 }
424 
425 void ide_set_sector(IDEState *s, int64_t sector_num)
426 {
427     unsigned int cyl, r;
428     if (s->select & 0x40) {
429 	if (!s->lba48) {
430             s->select = (s->select & 0xf0) | (sector_num >> 24);
431             s->hcyl = (sector_num >> 16);
432             s->lcyl = (sector_num >> 8);
433             s->sector = (sector_num);
434 	} else {
435 	    s->sector = sector_num;
436 	    s->lcyl = sector_num >> 8;
437 	    s->hcyl = sector_num >> 16;
438 	    s->hob_sector = sector_num >> 24;
439 	    s->hob_lcyl = sector_num >> 32;
440 	    s->hob_hcyl = sector_num >> 40;
441 	}
442     } else {
443         cyl = sector_num / (s->heads * s->sectors);
444         r = sector_num % (s->heads * s->sectors);
445         s->hcyl = cyl >> 8;
446         s->lcyl = cyl;
447         s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
448         s->sector = (r % s->sectors) + 1;
449     }
450 }
451 
452 static void ide_rw_error(IDEState *s) {
453     ide_abort_command(s);
454     ide_set_irq(s->bus);
455 }
456 
457 void ide_sector_read(IDEState *s)
458 {
459     int64_t sector_num;
460     int ret, n;
461 
462     s->status = READY_STAT | SEEK_STAT;
463     s->error = 0; /* not needed by IDE spec, but needed by Windows */
464     sector_num = ide_get_sector(s);
465     n = s->nsector;
466     if (n == 0) {
467         /* no more sector to read from disk */
468         ide_transfer_stop(s);
469     } else {
470 #if defined(DEBUG_IDE)
471         printf("read sector=%" PRId64 "\n", sector_num);
472 #endif
473         if (n > s->req_nb_sectors)
474             n = s->req_nb_sectors;
475         ret = bdrv_read(s->bs, sector_num, s->io_buffer, n);
476         if (ret != 0) {
477             if (ide_handle_rw_error(s, -ret,
478                 BM_STATUS_PIO_RETRY | BM_STATUS_RETRY_READ))
479             {
480                 return;
481             }
482         }
483         ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read);
484         ide_set_irq(s->bus);
485         ide_set_sector(s, sector_num + n);
486         s->nsector -= n;
487     }
488 }
489 
490 static void dma_buf_commit(IDEState *s, int is_write)
491 {
492     qemu_sglist_destroy(&s->sg);
493 }
494 
495 void ide_set_inactive(IDEState *s)
496 {
497     s->bus->dma->aiocb = NULL;
498     s->bus->dma->ops->set_inactive(s->bus->dma);
499 }
500 
501 void ide_dma_error(IDEState *s)
502 {
503     ide_transfer_stop(s);
504     s->error = ABRT_ERR;
505     s->status = READY_STAT | ERR_STAT;
506     ide_set_inactive(s);
507     ide_set_irq(s->bus);
508 }
509 
510 static int ide_handle_rw_error(IDEState *s, int error, int op)
511 {
512     int is_read = (op & BM_STATUS_RETRY_READ);
513     BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);
514 
515     if (action == BLOCK_ERR_IGNORE) {
516         bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);
517         return 0;
518     }
519 
520     if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
521             || action == BLOCK_ERR_STOP_ANY) {
522         s->bus->dma->ops->set_unit(s->bus->dma, s->unit);
523         s->bus->error_status = op;
524         bdrv_mon_event(s->bs, BDRV_ACTION_STOP, is_read);
525         vm_stop(VMSTOP_DISKFULL);
526     } else {
527         if (op & BM_STATUS_DMA_RETRY) {
528             dma_buf_commit(s, 0);
529             ide_dma_error(s);
530         } else {
531             ide_rw_error(s);
532         }
533         bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read);
534     }
535 
536     return 1;
537 }
538 
539 void ide_dma_cb(void *opaque, int ret)
540 {
541     IDEState *s = opaque;
542     int n;
543     int64_t sector_num;
544 
545 handle_rw_error:
546     if (ret < 0) {
547         int op = BM_STATUS_DMA_RETRY;
548 
549         if (s->dma_cmd == IDE_DMA_READ)
550             op |= BM_STATUS_RETRY_READ;
551         else if (s->dma_cmd == IDE_DMA_TRIM)
552             op |= BM_STATUS_RETRY_TRIM;
553 
554         if (ide_handle_rw_error(s, -ret, op)) {
555             return;
556         }
557     }
558 
559     n = s->io_buffer_size >> 9;
560     sector_num = ide_get_sector(s);
561     if (n > 0) {
562         dma_buf_commit(s, ide_cmd_is_read(s));
563         sector_num += n;
564         ide_set_sector(s, sector_num);
565         s->nsector -= n;
566     }
567 
568     /* end of transfer ? */
569     if (s->nsector == 0) {
570         s->status = READY_STAT | SEEK_STAT;
571         ide_set_irq(s->bus);
572         goto eot;
573     }
574 
575     /* launch next transfer */
576     n = s->nsector;
577     s->io_buffer_index = 0;
578     s->io_buffer_size = n * 512;
579     if (s->bus->dma->ops->prepare_buf(s->bus->dma, ide_cmd_is_read(s)) == 0) {
580         /* The PRDs were too short. Reset the Active bit, but don't raise an
581          * interrupt. */
582         goto eot;
583     }
584 
585 #ifdef DEBUG_AIO
586     printf("ide_dma_cb: sector_num=%" PRId64 " n=%d, cmd_cmd=%d\n",
587            sector_num, n, s->dma_cmd);
588 #endif
589 
590     switch (s->dma_cmd) {
591     case IDE_DMA_READ:
592         s->bus->dma->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
593                                            ide_dma_cb, s);
594         break;
595     case IDE_DMA_WRITE:
596         s->bus->dma->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num,
597                                             ide_dma_cb, s);
598         break;
599     case IDE_DMA_TRIM:
600         s->bus->dma->aiocb = dma_bdrv_io(s->bs, &s->sg, sector_num,
601                                          ide_issue_trim, ide_dma_cb, s, 1);
602         break;
603     }
604 
605     if (!s->bus->dma->aiocb) {
606         ret = -1;
607         goto handle_rw_error;
608     }
609     return;
610 
611 eot:
612    ide_set_inactive(s);
613 }
614 
615 static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
616 {
617     s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
618     s->io_buffer_index = 0;
619     s->io_buffer_size = 0;
620     s->dma_cmd = dma_cmd;
621     s->bus->dma->ops->start_dma(s->bus->dma, s, ide_dma_cb);
622 }
623 
624 static void ide_sector_write_timer_cb(void *opaque)
625 {
626     IDEState *s = opaque;
627     ide_set_irq(s->bus);
628 }
629 
630 void ide_sector_write(IDEState *s)
631 {
632     int64_t sector_num;
633     int ret, n, n1;
634 
635     s->status = READY_STAT | SEEK_STAT;
636     sector_num = ide_get_sector(s);
637 #if defined(DEBUG_IDE)
638     printf("write sector=%" PRId64 "\n", sector_num);
639 #endif
640     n = s->nsector;
641     if (n > s->req_nb_sectors)
642         n = s->req_nb_sectors;
643     ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
644 
645     if (ret != 0) {
646         if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY))
647             return;
648     }
649 
650     s->nsector -= n;
651     if (s->nsector == 0) {
652         /* no more sectors to write */
653         ide_transfer_stop(s);
654     } else {
655         n1 = s->nsector;
656         if (n1 > s->req_nb_sectors)
657             n1 = s->req_nb_sectors;
658         ide_transfer_start(s, s->io_buffer, 512 * n1, ide_sector_write);
659     }
660     ide_set_sector(s, sector_num + n);
661 
662     if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
663         /* It seems there is a bug in the Windows 2000 installer HDD
664            IDE driver which fills the disk with empty logs when the
665            IDE write IRQ comes too early. This hack tries to correct
666            that at the expense of slower write performances. Use this
667            option _only_ to install Windows 2000. You must disable it
668            for normal use. */
669         qemu_mod_timer(s->sector_write_timer,
670                        qemu_get_clock_ns(vm_clock) + (get_ticks_per_sec() / 1000));
671     } else {
672         ide_set_irq(s->bus);
673     }
674 }
675 
676 static void ide_flush_cb(void *opaque, int ret)
677 {
678     IDEState *s = opaque;
679 
680     if (ret < 0) {
681         /* XXX: What sector number to set here? */
682         if (ide_handle_rw_error(s, -ret, BM_STATUS_RETRY_FLUSH)) {
683             return;
684         }
685     }
686 
687     s->status = READY_STAT | SEEK_STAT;
688     ide_set_irq(s->bus);
689 }
690 
691 void ide_flush_cache(IDEState *s)
692 {
693     BlockDriverAIOCB *acb;
694 
695     if (s->bs == NULL) {
696         ide_flush_cb(s, 0);
697         return;
698     }
699 
700     acb = bdrv_aio_flush(s->bs, ide_flush_cb, s);
701     if (acb == NULL) {
702         ide_flush_cb(s, -EIO);
703     }
704 }
705 
706 static void ide_cfata_metadata_inquiry(IDEState *s)
707 {
708     uint16_t *p;
709     uint32_t spd;
710 
711     p = (uint16_t *) s->io_buffer;
712     memset(p, 0, 0x200);
713     spd = ((s->mdata_size - 1) >> 9) + 1;
714 
715     put_le16(p + 0, 0x0001);			/* Data format revision */
716     put_le16(p + 1, 0x0000);			/* Media property: silicon */
717     put_le16(p + 2, s->media_changed);		/* Media status */
718     put_le16(p + 3, s->mdata_size & 0xffff);	/* Capacity in bytes (low) */
719     put_le16(p + 4, s->mdata_size >> 16);	/* Capacity in bytes (high) */
720     put_le16(p + 5, spd & 0xffff);		/* Sectors per device (low) */
721     put_le16(p + 6, spd >> 16);			/* Sectors per device (high) */
722 }
723 
724 static void ide_cfata_metadata_read(IDEState *s)
725 {
726     uint16_t *p;
727 
728     if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
729         s->status = ERR_STAT;
730         s->error = ABRT_ERR;
731         return;
732     }
733 
734     p = (uint16_t *) s->io_buffer;
735     memset(p, 0, 0x200);
736 
737     put_le16(p + 0, s->media_changed);		/* Media status */
738     memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
739                     MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
740                                     s->nsector << 9), 0x200 - 2));
741 }
742 
743 static void ide_cfata_metadata_write(IDEState *s)
744 {
745     if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
746         s->status = ERR_STAT;
747         s->error = ABRT_ERR;
748         return;
749     }
750 
751     s->media_changed = 0;
752 
753     memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
754                     s->io_buffer + 2,
755                     MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
756                                     s->nsector << 9), 0x200 - 2));
757 }
758 
759 /* called when the inserted state of the media has changed */
760 static void cdrom_change_cb(void *opaque, int reason)
761 {
762     IDEState *s = opaque;
763     uint64_t nb_sectors;
764 
765     if (!(reason & CHANGE_MEDIA)) {
766         return;
767     }
768 
769     bdrv_get_geometry(s->bs, &nb_sectors);
770     s->nb_sectors = nb_sectors;
771 
772     /*
773      * First indicate to the guest that a CD has been removed.  That's
774      * done on the next command the guest sends us.
775      *
776      * Then we set SENSE_UNIT_ATTENTION, by which the guest will
777      * detect a new CD in the drive.  See ide_atapi_cmd() for details.
778      */
779     s->cdrom_changed = 1;
780     s->events.new_media = true;
781     ide_set_irq(s->bus);
782 }
783 
784 static void ide_cmd_lba48_transform(IDEState *s, int lba48)
785 {
786     s->lba48 = lba48;
787 
788     /* handle the 'magic' 0 nsector count conversion here. to avoid
789      * fiddling with the rest of the read logic, we just store the
790      * full sector count in ->nsector and ignore ->hob_nsector from now
791      */
792     if (!s->lba48) {
793 	if (!s->nsector)
794 	    s->nsector = 256;
795     } else {
796 	if (!s->nsector && !s->hob_nsector)
797 	    s->nsector = 65536;
798 	else {
799 	    int lo = s->nsector;
800 	    int hi = s->hob_nsector;
801 
802 	    s->nsector = (hi << 8) | lo;
803 	}
804     }
805 }
806 
807 static void ide_clear_hob(IDEBus *bus)
808 {
809     /* any write clears HOB high bit of device control register */
810     bus->ifs[0].select &= ~(1 << 7);
811     bus->ifs[1].select &= ~(1 << 7);
812 }
813 
814 void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
815 {
816     IDEBus *bus = opaque;
817 
818 #ifdef DEBUG_IDE
819     printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
820 #endif
821 
822     addr &= 7;
823 
824     /* ignore writes to command block while busy with previous command */
825     if (addr != 7 && (idebus_active_if(bus)->status & (BUSY_STAT|DRQ_STAT)))
826         return;
827 
828     switch(addr) {
829     case 0:
830         break;
831     case 1:
832 	ide_clear_hob(bus);
833         /* NOTE: data is written to the two drives */
834 	bus->ifs[0].hob_feature = bus->ifs[0].feature;
835 	bus->ifs[1].hob_feature = bus->ifs[1].feature;
836         bus->ifs[0].feature = val;
837         bus->ifs[1].feature = val;
838         break;
839     case 2:
840 	ide_clear_hob(bus);
841 	bus->ifs[0].hob_nsector = bus->ifs[0].nsector;
842 	bus->ifs[1].hob_nsector = bus->ifs[1].nsector;
843         bus->ifs[0].nsector = val;
844         bus->ifs[1].nsector = val;
845         break;
846     case 3:
847 	ide_clear_hob(bus);
848 	bus->ifs[0].hob_sector = bus->ifs[0].sector;
849 	bus->ifs[1].hob_sector = bus->ifs[1].sector;
850         bus->ifs[0].sector = val;
851         bus->ifs[1].sector = val;
852         break;
853     case 4:
854 	ide_clear_hob(bus);
855 	bus->ifs[0].hob_lcyl = bus->ifs[0].lcyl;
856 	bus->ifs[1].hob_lcyl = bus->ifs[1].lcyl;
857         bus->ifs[0].lcyl = val;
858         bus->ifs[1].lcyl = val;
859         break;
860     case 5:
861 	ide_clear_hob(bus);
862 	bus->ifs[0].hob_hcyl = bus->ifs[0].hcyl;
863 	bus->ifs[1].hob_hcyl = bus->ifs[1].hcyl;
864         bus->ifs[0].hcyl = val;
865         bus->ifs[1].hcyl = val;
866         break;
867     case 6:
868 	/* FIXME: HOB readback uses bit 7 */
869         bus->ifs[0].select = (val & ~0x10) | 0xa0;
870         bus->ifs[1].select = (val | 0x10) | 0xa0;
871         /* select drive */
872         bus->unit = (val >> 4) & 1;
873         break;
874     default:
875     case 7:
876         /* command */
877         ide_exec_cmd(bus, val);
878         break;
879     }
880 }
881 
882 
883 void ide_exec_cmd(IDEBus *bus, uint32_t val)
884 {
885     IDEState *s;
886     int n;
887     int lba48 = 0;
888 
889 #if defined(DEBUG_IDE)
890     printf("ide: CMD=%02x\n", val);
891 #endif
892     s = idebus_active_if(bus);
893     /* ignore commands to non existant slave */
894     if (s != bus->ifs && !s->bs)
895         return;
896 
897     /* Only DEVICE RESET is allowed while BSY or/and DRQ are set */
898     if ((s->status & (BUSY_STAT|DRQ_STAT)) && val != WIN_DEVICE_RESET)
899         return;
900 
901     switch(val) {
902     case WIN_DSM:
903         switch (s->feature) {
904         case DSM_TRIM:
905             if (!s->bs) {
906                 goto abort_cmd;
907             }
908             ide_sector_start_dma(s, IDE_DMA_TRIM);
909             break;
910         default:
911             goto abort_cmd;
912         }
913         break;
914     case WIN_IDENTIFY:
915         if (s->bs && s->drive_kind != IDE_CD) {
916             if (s->drive_kind != IDE_CFATA)
917                 ide_identify(s);
918             else
919                 ide_cfata_identify(s);
920             s->status = READY_STAT | SEEK_STAT;
921             ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
922         } else {
923             if (s->drive_kind == IDE_CD) {
924                 ide_set_signature(s);
925             }
926             ide_abort_command(s);
927         }
928         ide_set_irq(s->bus);
929         break;
930     case WIN_SPECIFY:
931     case WIN_RECAL:
932         s->error = 0;
933         s->status = READY_STAT | SEEK_STAT;
934         ide_set_irq(s->bus);
935         break;
936     case WIN_SETMULT:
937         if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
938             /* Disable Read and Write Multiple */
939             s->mult_sectors = 0;
940             s->status = READY_STAT | SEEK_STAT;
941         } else if ((s->nsector & 0xff) != 0 &&
942             ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
943              (s->nsector & (s->nsector - 1)) != 0)) {
944             ide_abort_command(s);
945         } else {
946             s->mult_sectors = s->nsector & 0xff;
947             s->status = READY_STAT | SEEK_STAT;
948         }
949         ide_set_irq(s->bus);
950         break;
951     case WIN_VERIFY_EXT:
952 	lba48 = 1;
953     case WIN_VERIFY:
954     case WIN_VERIFY_ONCE:
955         /* do sector number check ? */
956 	ide_cmd_lba48_transform(s, lba48);
957         s->status = READY_STAT | SEEK_STAT;
958         ide_set_irq(s->bus);
959         break;
960 	case WIN_READ_EXT:
961 	lba48 = 1;
962     case WIN_READ:
963     case WIN_READ_ONCE:
964         if (!s->bs)
965             goto abort_cmd;
966 	ide_cmd_lba48_transform(s, lba48);
967         s->req_nb_sectors = 1;
968         ide_sector_read(s);
969         break;
970 	case WIN_WRITE_EXT:
971 	lba48 = 1;
972     case WIN_WRITE:
973     case WIN_WRITE_ONCE:
974     case CFA_WRITE_SECT_WO_ERASE:
975     case WIN_WRITE_VERIFY:
976 	ide_cmd_lba48_transform(s, lba48);
977         s->error = 0;
978         s->status = SEEK_STAT | READY_STAT;
979         s->req_nb_sectors = 1;
980         ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
981         s->media_changed = 1;
982         break;
983 	case WIN_MULTREAD_EXT:
984 	lba48 = 1;
985     case WIN_MULTREAD:
986         if (!s->mult_sectors)
987             goto abort_cmd;
988 	ide_cmd_lba48_transform(s, lba48);
989         s->req_nb_sectors = s->mult_sectors;
990         ide_sector_read(s);
991         break;
992     case WIN_MULTWRITE_EXT:
993 	lba48 = 1;
994     case WIN_MULTWRITE:
995     case CFA_WRITE_MULTI_WO_ERASE:
996         if (!s->mult_sectors)
997             goto abort_cmd;
998 	ide_cmd_lba48_transform(s, lba48);
999         s->error = 0;
1000         s->status = SEEK_STAT | READY_STAT;
1001         s->req_nb_sectors = s->mult_sectors;
1002         n = s->nsector;
1003         if (n > s->req_nb_sectors)
1004             n = s->req_nb_sectors;
1005         ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
1006         s->media_changed = 1;
1007         break;
1008 	case WIN_READDMA_EXT:
1009 	lba48 = 1;
1010     case WIN_READDMA:
1011     case WIN_READDMA_ONCE:
1012         if (!s->bs)
1013             goto abort_cmd;
1014 	ide_cmd_lba48_transform(s, lba48);
1015         ide_sector_start_dma(s, IDE_DMA_READ);
1016         break;
1017 	case WIN_WRITEDMA_EXT:
1018 	lba48 = 1;
1019     case WIN_WRITEDMA:
1020     case WIN_WRITEDMA_ONCE:
1021         if (!s->bs)
1022             goto abort_cmd;
1023 	ide_cmd_lba48_transform(s, lba48);
1024         ide_sector_start_dma(s, IDE_DMA_WRITE);
1025         s->media_changed = 1;
1026         break;
1027     case WIN_READ_NATIVE_MAX_EXT:
1028 	lba48 = 1;
1029     case WIN_READ_NATIVE_MAX:
1030 	ide_cmd_lba48_transform(s, lba48);
1031         ide_set_sector(s, s->nb_sectors - 1);
1032         s->status = READY_STAT | SEEK_STAT;
1033         ide_set_irq(s->bus);
1034         break;
1035     case WIN_CHECKPOWERMODE1:
1036     case WIN_CHECKPOWERMODE2:
1037         s->error = 0;
1038         s->nsector = 0xff; /* device active or idle */
1039         s->status = READY_STAT | SEEK_STAT;
1040         ide_set_irq(s->bus);
1041         break;
1042     case WIN_SETFEATURES:
1043         if (!s->bs)
1044             goto abort_cmd;
1045         /* XXX: valid for CDROM ? */
1046         switch(s->feature) {
1047         case 0xcc: /* reverting to power-on defaults enable */
1048         case 0x66: /* reverting to power-on defaults disable */
1049         case 0x02: /* write cache enable */
1050         case 0x82: /* write cache disable */
1051         case 0xaa: /* read look-ahead enable */
1052         case 0x55: /* read look-ahead disable */
1053         case 0x05: /* set advanced power management mode */
1054         case 0x85: /* disable advanced power management mode */
1055         case 0x69: /* NOP */
1056         case 0x67: /* NOP */
1057         case 0x96: /* NOP */
1058         case 0x9a: /* NOP */
1059         case 0x42: /* enable Automatic Acoustic Mode */
1060         case 0xc2: /* disable Automatic Acoustic Mode */
1061             s->status = READY_STAT | SEEK_STAT;
1062             ide_set_irq(s->bus);
1063             break;
1064         case 0x03: { /* set transfer mode */
1065 		uint8_t val = s->nsector & 0x07;
1066             uint16_t *identify_data = (uint16_t *)s->identify_data;
1067 
1068 		switch (s->nsector >> 3) {
1069 		case 0x00: /* pio default */
1070 		case 0x01: /* pio mode */
1071 			put_le16(identify_data + 62,0x07);
1072 			put_le16(identify_data + 63,0x07);
1073 			put_le16(identify_data + 88,0x3f);
1074 			break;
1075                 case 0x02: /* sigle word dma mode*/
1076 			put_le16(identify_data + 62,0x07 | (1 << (val + 8)));
1077 			put_le16(identify_data + 63,0x07);
1078 			put_le16(identify_data + 88,0x3f);
1079 			break;
1080 		case 0x04: /* mdma mode */
1081 			put_le16(identify_data + 62,0x07);
1082 			put_le16(identify_data + 63,0x07 | (1 << (val + 8)));
1083 			put_le16(identify_data + 88,0x3f);
1084 			break;
1085 		case 0x08: /* udma mode */
1086 			put_le16(identify_data + 62,0x07);
1087 			put_le16(identify_data + 63,0x07);
1088 			put_le16(identify_data + 88,0x3f | (1 << (val + 8)));
1089 			break;
1090 		default:
1091 			goto abort_cmd;
1092 		}
1093             s->status = READY_STAT | SEEK_STAT;
1094             ide_set_irq(s->bus);
1095             break;
1096 	}
1097         default:
1098             goto abort_cmd;
1099         }
1100         break;
1101     case WIN_FLUSH_CACHE:
1102     case WIN_FLUSH_CACHE_EXT:
1103         ide_flush_cache(s);
1104         break;
1105     case WIN_STANDBY:
1106     case WIN_STANDBY2:
1107     case WIN_STANDBYNOW1:
1108     case WIN_STANDBYNOW2:
1109     case WIN_IDLEIMMEDIATE:
1110     case CFA_IDLEIMMEDIATE:
1111     case WIN_SETIDLE1:
1112     case WIN_SETIDLE2:
1113     case WIN_SLEEPNOW1:
1114     case WIN_SLEEPNOW2:
1115         s->status = READY_STAT;
1116         ide_set_irq(s->bus);
1117         break;
1118     case WIN_SEEK:
1119         if(s->drive_kind == IDE_CD)
1120             goto abort_cmd;
1121         /* XXX: Check that seek is within bounds */
1122         s->status = READY_STAT | SEEK_STAT;
1123         ide_set_irq(s->bus);
1124         break;
1125         /* ATAPI commands */
1126     case WIN_PIDENTIFY:
1127         if (s->drive_kind == IDE_CD) {
1128             ide_atapi_identify(s);
1129             s->status = READY_STAT | SEEK_STAT;
1130             ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1131         } else {
1132             ide_abort_command(s);
1133         }
1134         ide_set_irq(s->bus);
1135         break;
1136     case WIN_DIAGNOSE:
1137         ide_set_signature(s);
1138         if (s->drive_kind == IDE_CD)
1139             s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
1140                             * devices to return a clear status register
1141                             * with READY_STAT *not* set. */
1142         else
1143             s->status = READY_STAT | SEEK_STAT;
1144         s->error = 0x01; /* Device 0 passed, Device 1 passed or not
1145                           * present.
1146                           */
1147         ide_set_irq(s->bus);
1148         break;
1149     case WIN_SRST:
1150         if (s->drive_kind != IDE_CD)
1151             goto abort_cmd;
1152         ide_set_signature(s);
1153         s->status = 0x00; /* NOTE: READY is _not_ set */
1154         s->error = 0x01;
1155         break;
1156     case WIN_PACKETCMD:
1157         if (s->drive_kind != IDE_CD)
1158             goto abort_cmd;
1159         /* overlapping commands not supported */
1160         if (s->feature & 0x02)
1161             goto abort_cmd;
1162         s->status = READY_STAT | SEEK_STAT;
1163         s->atapi_dma = s->feature & 1;
1164         s->nsector = 1;
1165         ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
1166                            ide_atapi_cmd);
1167         break;
1168     /* CF-ATA commands */
1169     case CFA_REQ_EXT_ERROR_CODE:
1170         if (s->drive_kind != IDE_CFATA)
1171             goto abort_cmd;
1172         s->error = 0x09;    /* miscellaneous error */
1173         s->status = READY_STAT | SEEK_STAT;
1174         ide_set_irq(s->bus);
1175         break;
1176     case CFA_ERASE_SECTORS:
1177     case CFA_WEAR_LEVEL:
1178         if (s->drive_kind != IDE_CFATA)
1179             goto abort_cmd;
1180         if (val == CFA_WEAR_LEVEL)
1181             s->nsector = 0;
1182         if (val == CFA_ERASE_SECTORS)
1183             s->media_changed = 1;
1184         s->error = 0x00;
1185         s->status = READY_STAT | SEEK_STAT;
1186         ide_set_irq(s->bus);
1187         break;
1188     case CFA_TRANSLATE_SECTOR:
1189         if (s->drive_kind != IDE_CFATA)
1190             goto abort_cmd;
1191         s->error = 0x00;
1192         s->status = READY_STAT | SEEK_STAT;
1193         memset(s->io_buffer, 0, 0x200);
1194         s->io_buffer[0x00] = s->hcyl;			/* Cyl MSB */
1195         s->io_buffer[0x01] = s->lcyl;			/* Cyl LSB */
1196         s->io_buffer[0x02] = s->select;			/* Head */
1197         s->io_buffer[0x03] = s->sector;			/* Sector */
1198         s->io_buffer[0x04] = ide_get_sector(s) >> 16;	/* LBA MSB */
1199         s->io_buffer[0x05] = ide_get_sector(s) >> 8;	/* LBA */
1200         s->io_buffer[0x06] = ide_get_sector(s) >> 0;	/* LBA LSB */
1201         s->io_buffer[0x13] = 0x00;				/* Erase flag */
1202         s->io_buffer[0x18] = 0x00;				/* Hot count */
1203         s->io_buffer[0x19] = 0x00;				/* Hot count */
1204         s->io_buffer[0x1a] = 0x01;				/* Hot count */
1205         ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1206         ide_set_irq(s->bus);
1207         break;
1208     case CFA_ACCESS_METADATA_STORAGE:
1209         if (s->drive_kind != IDE_CFATA)
1210             goto abort_cmd;
1211         switch (s->feature) {
1212         case 0x02:	/* Inquiry Metadata Storage */
1213             ide_cfata_metadata_inquiry(s);
1214             break;
1215         case 0x03:	/* Read Metadata Storage */
1216             ide_cfata_metadata_read(s);
1217             break;
1218         case 0x04:	/* Write Metadata Storage */
1219             ide_cfata_metadata_write(s);
1220             break;
1221         default:
1222             goto abort_cmd;
1223         }
1224         ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1225         s->status = 0x00; /* NOTE: READY is _not_ set */
1226         ide_set_irq(s->bus);
1227         break;
1228     case IBM_SENSE_CONDITION:
1229         if (s->drive_kind != IDE_CFATA)
1230             goto abort_cmd;
1231         switch (s->feature) {
1232         case 0x01:  /* sense temperature in device */
1233             s->nsector = 0x50;      /* +20 C */
1234             break;
1235         default:
1236             goto abort_cmd;
1237         }
1238         s->status = READY_STAT | SEEK_STAT;
1239         ide_set_irq(s->bus);
1240         break;
1241 
1242 	case WIN_SMART:
1243 	if (s->drive_kind == IDE_CD)
1244 		goto abort_cmd;
1245 	if (s->hcyl != 0xc2 || s->lcyl != 0x4f)
1246 		goto abort_cmd;
1247 	if (!s->smart_enabled && s->feature != SMART_ENABLE)
1248 		goto abort_cmd;
1249 	switch (s->feature) {
1250 	case SMART_DISABLE:
1251 		s->smart_enabled = 0;
1252 		s->status = READY_STAT | SEEK_STAT;
1253 		ide_set_irq(s->bus);
1254 		break;
1255 	case SMART_ENABLE:
1256 		s->smart_enabled = 1;
1257 		s->status = READY_STAT | SEEK_STAT;
1258 		ide_set_irq(s->bus);
1259 		break;
1260 	case SMART_ATTR_AUTOSAVE:
1261 		switch (s->sector) {
1262 		case 0x00:
1263 		s->smart_autosave = 0;
1264 		break;
1265 		case 0xf1:
1266 		s->smart_autosave = 1;
1267 		break;
1268 		default:
1269 		goto abort_cmd;
1270 		}
1271 		s->status = READY_STAT | SEEK_STAT;
1272 		ide_set_irq(s->bus);
1273 		break;
1274 	case SMART_STATUS:
1275 		if (!s->smart_errors) {
1276 		s->hcyl = 0xc2;
1277 		s->lcyl = 0x4f;
1278 		} else {
1279 		s->hcyl = 0x2c;
1280 		s->lcyl = 0xf4;
1281 		}
1282 		s->status = READY_STAT | SEEK_STAT;
1283 		ide_set_irq(s->bus);
1284 		break;
1285 	case SMART_READ_THRESH:
1286 		memset(s->io_buffer, 0, 0x200);
1287 		s->io_buffer[0] = 0x01; /* smart struct version */
1288 		for (n=0; n<30; n++) {
1289 		if (smart_attributes[n][0] == 0)
1290 			break;
1291 		s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
1292 		s->io_buffer[2+1+(n*12)] = smart_attributes[n][11];
1293 		}
1294 		for (n=0; n<511; n++) /* checksum */
1295 		s->io_buffer[511] += s->io_buffer[n];
1296 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1297 		s->status = READY_STAT | SEEK_STAT;
1298 		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1299 		ide_set_irq(s->bus);
1300 		break;
1301 	case SMART_READ_DATA:
1302 		memset(s->io_buffer, 0, 0x200);
1303 		s->io_buffer[0] = 0x01; /* smart struct version */
1304 		for (n=0; n<30; n++) {
1305 		    if (smart_attributes[n][0] == 0) {
1306 			break;
1307 		    }
1308 		    int i;
1309 		    for(i = 0; i < 11; i++) {
1310 			s->io_buffer[2+i+(n*12)] = smart_attributes[n][i];
1311 		    }
1312 		}
1313 		s->io_buffer[362] = 0x02 | (s->smart_autosave?0x80:0x00);
1314 		if (s->smart_selftest_count == 0) {
1315 		s->io_buffer[363] = 0;
1316 		} else {
1317 		s->io_buffer[363] =
1318 			s->smart_selftest_data[3 +
1319 					   (s->smart_selftest_count - 1) *
1320 					   24];
1321 		}
1322 		s->io_buffer[364] = 0x20;
1323 		s->io_buffer[365] = 0x01;
1324 		/* offline data collection capacity: execute + self-test*/
1325 		s->io_buffer[367] = (1<<4 | 1<<3 | 1);
1326 		s->io_buffer[368] = 0x03; /* smart capability (1) */
1327 		s->io_buffer[369] = 0x00; /* smart capability (2) */
1328 		s->io_buffer[370] = 0x01; /* error logging supported */
1329 		s->io_buffer[372] = 0x02; /* minutes for poll short test */
1330 		s->io_buffer[373] = 0x36; /* minutes for poll ext test */
1331 		s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
1332 
1333 		for (n=0; n<511; n++)
1334 		s->io_buffer[511] += s->io_buffer[n];
1335 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1336 		s->status = READY_STAT | SEEK_STAT;
1337 		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1338 		ide_set_irq(s->bus);
1339 		break;
1340 	case SMART_READ_LOG:
1341 		switch (s->sector) {
1342 		case 0x01: /* summary smart error log */
1343 		memset(s->io_buffer, 0, 0x200);
1344 		s->io_buffer[0] = 0x01;
1345 		s->io_buffer[1] = 0x00; /* no error entries */
1346 		s->io_buffer[452] = s->smart_errors & 0xff;
1347 		s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
1348 
1349 		for (n=0; n<511; n++)
1350 			s->io_buffer[511] += s->io_buffer[n];
1351 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1352 		break;
1353 		case 0x06: /* smart self test log */
1354 		memset(s->io_buffer, 0, 0x200);
1355 		s->io_buffer[0] = 0x01;
1356 		if (s->smart_selftest_count == 0) {
1357 			s->io_buffer[508] = 0;
1358 		} else {
1359 			s->io_buffer[508] = s->smart_selftest_count;
1360 			for (n=2; n<506; n++)
1361 			s->io_buffer[n] = s->smart_selftest_data[n];
1362 		}
1363 		for (n=0; n<511; n++)
1364 			s->io_buffer[511] += s->io_buffer[n];
1365 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1366 		break;
1367 		default:
1368 		goto abort_cmd;
1369 		}
1370 		s->status = READY_STAT | SEEK_STAT;
1371 		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1372 		ide_set_irq(s->bus);
1373 		break;
1374 	case SMART_EXECUTE_OFFLINE:
1375 		switch (s->sector) {
1376 		case 0: /* off-line routine */
1377 		case 1: /* short self test */
1378 		case 2: /* extended self test */
1379 		s->smart_selftest_count++;
1380 		if(s->smart_selftest_count > 21)
1381 			s->smart_selftest_count = 0;
1382 		n = 2 + (s->smart_selftest_count - 1) * 24;
1383 		s->smart_selftest_data[n] = s->sector;
1384 		s->smart_selftest_data[n+1] = 0x00; /* OK and finished */
1385 		s->smart_selftest_data[n+2] = 0x34; /* hour count lsb */
1386 		s->smart_selftest_data[n+3] = 0x12; /* hour count msb */
1387 		s->status = READY_STAT | SEEK_STAT;
1388 		ide_set_irq(s->bus);
1389 		break;
1390 		default:
1391 		goto abort_cmd;
1392 		}
1393 		break;
1394 	default:
1395 		goto abort_cmd;
1396 	}
1397 	break;
1398     default:
1399     abort_cmd:
1400         ide_abort_command(s);
1401         ide_set_irq(s->bus);
1402         break;
1403     }
1404 }
1405 
1406 uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
1407 {
1408     IDEBus *bus = opaque;
1409     IDEState *s = idebus_active_if(bus);
1410     uint32_t addr;
1411     int ret, hob;
1412 
1413     addr = addr1 & 7;
1414     /* FIXME: HOB readback uses bit 7, but it's always set right now */
1415     //hob = s->select & (1 << 7);
1416     hob = 0;
1417     switch(addr) {
1418     case 0:
1419         ret = 0xff;
1420         break;
1421     case 1:
1422         if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1423             (s != bus->ifs && !s->bs))
1424             ret = 0;
1425         else if (!hob)
1426             ret = s->error;
1427 	else
1428 	    ret = s->hob_feature;
1429         break;
1430     case 2:
1431         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1432             ret = 0;
1433         else if (!hob)
1434             ret = s->nsector & 0xff;
1435 	else
1436 	    ret = s->hob_nsector;
1437         break;
1438     case 3:
1439         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1440             ret = 0;
1441         else if (!hob)
1442             ret = s->sector;
1443 	else
1444 	    ret = s->hob_sector;
1445         break;
1446     case 4:
1447         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1448             ret = 0;
1449         else if (!hob)
1450             ret = s->lcyl;
1451 	else
1452 	    ret = s->hob_lcyl;
1453         break;
1454     case 5:
1455         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1456             ret = 0;
1457         else if (!hob)
1458             ret = s->hcyl;
1459 	else
1460 	    ret = s->hob_hcyl;
1461         break;
1462     case 6:
1463         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1464             ret = 0;
1465         else
1466             ret = s->select;
1467         break;
1468     default:
1469     case 7:
1470         if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1471             (s != bus->ifs && !s->bs))
1472             ret = 0;
1473         else
1474             ret = s->status;
1475         qemu_irq_lower(bus->irq);
1476         break;
1477     }
1478 #ifdef DEBUG_IDE
1479     printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
1480 #endif
1481     return ret;
1482 }
1483 
1484 uint32_t ide_status_read(void *opaque, uint32_t addr)
1485 {
1486     IDEBus *bus = opaque;
1487     IDEState *s = idebus_active_if(bus);
1488     int ret;
1489 
1490     if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1491         (s != bus->ifs && !s->bs))
1492         ret = 0;
1493     else
1494         ret = s->status;
1495 #ifdef DEBUG_IDE
1496     printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
1497 #endif
1498     return ret;
1499 }
1500 
1501 void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
1502 {
1503     IDEBus *bus = opaque;
1504     IDEState *s;
1505     int i;
1506 
1507 #ifdef DEBUG_IDE
1508     printf("ide: write control addr=0x%x val=%02x\n", addr, val);
1509 #endif
1510     /* common for both drives */
1511     if (!(bus->cmd & IDE_CMD_RESET) &&
1512         (val & IDE_CMD_RESET)) {
1513         /* reset low to high */
1514         for(i = 0;i < 2; i++) {
1515             s = &bus->ifs[i];
1516             s->status = BUSY_STAT | SEEK_STAT;
1517             s->error = 0x01;
1518         }
1519     } else if ((bus->cmd & IDE_CMD_RESET) &&
1520                !(val & IDE_CMD_RESET)) {
1521         /* high to low */
1522         for(i = 0;i < 2; i++) {
1523             s = &bus->ifs[i];
1524             if (s->drive_kind == IDE_CD)
1525                 s->status = 0x00; /* NOTE: READY is _not_ set */
1526             else
1527                 s->status = READY_STAT | SEEK_STAT;
1528             ide_set_signature(s);
1529         }
1530     }
1531 
1532     bus->cmd = val;
1533 }
1534 
1535 void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
1536 {
1537     IDEBus *bus = opaque;
1538     IDEState *s = idebus_active_if(bus);
1539     uint8_t *p;
1540 
1541     /* PIO data access allowed only when DRQ bit is set */
1542     if (!(s->status & DRQ_STAT))
1543         return;
1544 
1545     p = s->data_ptr;
1546     *(uint16_t *)p = le16_to_cpu(val);
1547     p += 2;
1548     s->data_ptr = p;
1549     if (p >= s->data_end)
1550         s->end_transfer_func(s);
1551 }
1552 
1553 uint32_t ide_data_readw(void *opaque, uint32_t addr)
1554 {
1555     IDEBus *bus = opaque;
1556     IDEState *s = idebus_active_if(bus);
1557     uint8_t *p;
1558     int ret;
1559 
1560     /* PIO data access allowed only when DRQ bit is set */
1561     if (!(s->status & DRQ_STAT))
1562         return 0;
1563 
1564     p = s->data_ptr;
1565     ret = cpu_to_le16(*(uint16_t *)p);
1566     p += 2;
1567     s->data_ptr = p;
1568     if (p >= s->data_end)
1569         s->end_transfer_func(s);
1570     return ret;
1571 }
1572 
1573 void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
1574 {
1575     IDEBus *bus = opaque;
1576     IDEState *s = idebus_active_if(bus);
1577     uint8_t *p;
1578 
1579     /* PIO data access allowed only when DRQ bit is set */
1580     if (!(s->status & DRQ_STAT))
1581         return;
1582 
1583     p = s->data_ptr;
1584     *(uint32_t *)p = le32_to_cpu(val);
1585     p += 4;
1586     s->data_ptr = p;
1587     if (p >= s->data_end)
1588         s->end_transfer_func(s);
1589 }
1590 
1591 uint32_t ide_data_readl(void *opaque, uint32_t addr)
1592 {
1593     IDEBus *bus = opaque;
1594     IDEState *s = idebus_active_if(bus);
1595     uint8_t *p;
1596     int ret;
1597 
1598     /* PIO data access allowed only when DRQ bit is set */
1599     if (!(s->status & DRQ_STAT))
1600         return 0;
1601 
1602     p = s->data_ptr;
1603     ret = cpu_to_le32(*(uint32_t *)p);
1604     p += 4;
1605     s->data_ptr = p;
1606     if (p >= s->data_end)
1607         s->end_transfer_func(s);
1608     return ret;
1609 }
1610 
1611 static void ide_dummy_transfer_stop(IDEState *s)
1612 {
1613     s->data_ptr = s->io_buffer;
1614     s->data_end = s->io_buffer;
1615     s->io_buffer[0] = 0xff;
1616     s->io_buffer[1] = 0xff;
1617     s->io_buffer[2] = 0xff;
1618     s->io_buffer[3] = 0xff;
1619 }
1620 
1621 static void ide_reset(IDEState *s)
1622 {
1623 #ifdef DEBUG_IDE
1624     printf("ide: reset\n");
1625 #endif
1626     if (s->drive_kind == IDE_CFATA)
1627         s->mult_sectors = 0;
1628     else
1629         s->mult_sectors = MAX_MULT_SECTORS;
1630     /* ide regs */
1631     s->feature = 0;
1632     s->error = 0;
1633     s->nsector = 0;
1634     s->sector = 0;
1635     s->lcyl = 0;
1636     s->hcyl = 0;
1637 
1638     /* lba48 */
1639     s->hob_feature = 0;
1640     s->hob_sector = 0;
1641     s->hob_nsector = 0;
1642     s->hob_lcyl = 0;
1643     s->hob_hcyl = 0;
1644 
1645     s->select = 0xa0;
1646     s->status = READY_STAT | SEEK_STAT;
1647 
1648     s->lba48 = 0;
1649 
1650     /* ATAPI specific */
1651     s->sense_key = 0;
1652     s->asc = 0;
1653     s->cdrom_changed = 0;
1654     s->packet_transfer_size = 0;
1655     s->elementary_transfer_size = 0;
1656     s->io_buffer_index = 0;
1657     s->cd_sector_size = 0;
1658     s->atapi_dma = 0;
1659     /* ATA DMA state */
1660     s->io_buffer_size = 0;
1661     s->req_nb_sectors = 0;
1662 
1663     ide_set_signature(s);
1664     /* init the transfer handler so that 0xffff is returned on data
1665        accesses */
1666     s->end_transfer_func = ide_dummy_transfer_stop;
1667     ide_dummy_transfer_stop(s);
1668     s->media_changed = 0;
1669 }
1670 
1671 void ide_bus_reset(IDEBus *bus)
1672 {
1673     bus->unit = 0;
1674     bus->cmd = 0;
1675     ide_reset(&bus->ifs[0]);
1676     ide_reset(&bus->ifs[1]);
1677     ide_clear_hob(bus);
1678 
1679     /* pending async DMA */
1680     if (bus->dma->aiocb) {
1681 #ifdef DEBUG_AIO
1682         printf("aio_cancel\n");
1683 #endif
1684         bdrv_aio_cancel(bus->dma->aiocb);
1685         bus->dma->aiocb = NULL;
1686     }
1687 
1688     /* reset dma provider too */
1689     bus->dma->ops->reset(bus->dma);
1690 }
1691 
1692 int ide_init_drive(IDEState *s, BlockDriverState *bs, IDEDriveKind kind,
1693                    const char *version, const char *serial)
1694 {
1695     int cylinders, heads, secs;
1696     uint64_t nb_sectors;
1697 
1698     s->bs = bs;
1699     s->drive_kind = kind;
1700 
1701     bdrv_get_geometry(bs, &nb_sectors);
1702     bdrv_guess_geometry(bs, &cylinders, &heads, &secs);
1703     if (cylinders < 1 || cylinders > 16383) {
1704         error_report("cyls must be between 1 and 16383");
1705         return -1;
1706     }
1707     if (heads < 1 || heads > 16) {
1708         error_report("heads must be between 1 and 16");
1709         return -1;
1710     }
1711     if (secs < 1 || secs > 63) {
1712         error_report("secs must be between 1 and 63");
1713         return -1;
1714     }
1715     s->cylinders = cylinders;
1716     s->heads = heads;
1717     s->sectors = secs;
1718     s->nb_sectors = nb_sectors;
1719     /* The SMART values should be preserved across power cycles
1720        but they aren't.  */
1721     s->smart_enabled = 1;
1722     s->smart_autosave = 1;
1723     s->smart_errors = 0;
1724     s->smart_selftest_count = 0;
1725     if (kind == IDE_CD) {
1726         bdrv_set_change_cb(bs, cdrom_change_cb, s);
1727         bs->buffer_alignment = 2048;
1728     } else {
1729         if (!bdrv_is_inserted(s->bs)) {
1730             error_report("Device needs media, but drive is empty");
1731             return -1;
1732         }
1733         if (bdrv_is_read_only(bs)) {
1734             error_report("Can't use a read-only drive");
1735             return -1;
1736         }
1737     }
1738     if (serial) {
1739         strncpy(s->drive_serial_str, serial, sizeof(s->drive_serial_str));
1740     } else {
1741         snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
1742                  "QM%05d", s->drive_serial);
1743     }
1744     if (version) {
1745         pstrcpy(s->version, sizeof(s->version), version);
1746     } else {
1747         pstrcpy(s->version, sizeof(s->version), QEMU_VERSION);
1748     }
1749 
1750     ide_reset(s);
1751     bdrv_set_removable(bs, s->drive_kind == IDE_CD);
1752     return 0;
1753 }
1754 
1755 static void ide_init1(IDEBus *bus, int unit)
1756 {
1757     static int drive_serial = 1;
1758     IDEState *s = &bus->ifs[unit];
1759 
1760     s->bus = bus;
1761     s->unit = unit;
1762     s->drive_serial = drive_serial++;
1763     /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */
1764     s->io_buffer = qemu_memalign(2048, IDE_DMA_BUF_SECTORS*512 + 4);
1765     s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;
1766     s->smart_selftest_data = qemu_blockalign(s->bs, 512);
1767     s->sector_write_timer = qemu_new_timer_ns(vm_clock,
1768                                            ide_sector_write_timer_cb, s);
1769 }
1770 
1771 static void ide_nop_start(IDEDMA *dma, IDEState *s,
1772                           BlockDriverCompletionFunc *cb)
1773 {
1774 }
1775 
1776 static int ide_nop(IDEDMA *dma)
1777 {
1778     return 0;
1779 }
1780 
1781 static int ide_nop_int(IDEDMA *dma, int x)
1782 {
1783     return 0;
1784 }
1785 
1786 static void ide_nop_restart(void *opaque, int x, int y)
1787 {
1788 }
1789 
1790 static const IDEDMAOps ide_dma_nop_ops = {
1791     .start_dma      = ide_nop_start,
1792     .start_transfer = ide_nop,
1793     .prepare_buf    = ide_nop_int,
1794     .rw_buf         = ide_nop_int,
1795     .set_unit       = ide_nop_int,
1796     .add_status     = ide_nop_int,
1797     .set_inactive   = ide_nop,
1798     .restart_cb     = ide_nop_restart,
1799     .reset          = ide_nop,
1800 };
1801 
1802 static IDEDMA ide_dma_nop = {
1803     .ops = &ide_dma_nop_ops,
1804     .aiocb = NULL,
1805 };
1806 
1807 void ide_init2(IDEBus *bus, qemu_irq irq)
1808 {
1809     int i;
1810 
1811     for(i = 0; i < 2; i++) {
1812         ide_init1(bus, i);
1813         ide_reset(&bus->ifs[i]);
1814     }
1815     bus->irq = irq;
1816     bus->dma = &ide_dma_nop;
1817 }
1818 
1819 /* TODO convert users to qdev and remove */
1820 void ide_init2_with_non_qdev_drives(IDEBus *bus, DriveInfo *hd0,
1821                                     DriveInfo *hd1, qemu_irq irq)
1822 {
1823     int i;
1824     DriveInfo *dinfo;
1825 
1826     for(i = 0; i < 2; i++) {
1827         dinfo = i == 0 ? hd0 : hd1;
1828         ide_init1(bus, i);
1829         if (dinfo) {
1830             if (ide_init_drive(&bus->ifs[i], dinfo->bdrv,
1831                                dinfo->media_cd ? IDE_CD : IDE_HD, NULL,
1832                                *dinfo->serial ? dinfo->serial : NULL) < 0) {
1833                 error_report("Can't set up IDE drive %s", dinfo->id);
1834                 exit(1);
1835             }
1836         } else {
1837             ide_reset(&bus->ifs[i]);
1838         }
1839     }
1840     bus->irq = irq;
1841     bus->dma = &ide_dma_nop;
1842 }
1843 
1844 void ide_init_ioport(IDEBus *bus, int iobase, int iobase2)
1845 {
1846     register_ioport_write(iobase, 8, 1, ide_ioport_write, bus);
1847     register_ioport_read(iobase, 8, 1, ide_ioport_read, bus);
1848     if (iobase2) {
1849         register_ioport_read(iobase2, 1, 1, ide_status_read, bus);
1850         register_ioport_write(iobase2, 1, 1, ide_cmd_write, bus);
1851     }
1852 
1853     /* data ports */
1854     register_ioport_write(iobase, 2, 2, ide_data_writew, bus);
1855     register_ioport_read(iobase, 2, 2, ide_data_readw, bus);
1856     register_ioport_write(iobase, 4, 4, ide_data_writel, bus);
1857     register_ioport_read(iobase, 4, 4, ide_data_readl, bus);
1858 }
1859 
1860 static bool is_identify_set(void *opaque, int version_id)
1861 {
1862     IDEState *s = opaque;
1863 
1864     return s->identify_set != 0;
1865 }
1866 
1867 static EndTransferFunc* transfer_end_table[] = {
1868         ide_sector_read,
1869         ide_sector_write,
1870         ide_transfer_stop,
1871         ide_atapi_cmd_reply_end,
1872         ide_atapi_cmd,
1873         ide_dummy_transfer_stop,
1874 };
1875 
1876 static int transfer_end_table_idx(EndTransferFunc *fn)
1877 {
1878     int i;
1879 
1880     for (i = 0; i < ARRAY_SIZE(transfer_end_table); i++)
1881         if (transfer_end_table[i] == fn)
1882             return i;
1883 
1884     return -1;
1885 }
1886 
1887 static int ide_drive_post_load(void *opaque, int version_id)
1888 {
1889     IDEState *s = opaque;
1890 
1891     if (version_id < 3) {
1892         if (s->sense_key == SENSE_UNIT_ATTENTION &&
1893             s->asc == ASC_MEDIUM_MAY_HAVE_CHANGED) {
1894             s->cdrom_changed = 1;
1895         }
1896     }
1897     return 0;
1898 }
1899 
1900 static int ide_drive_pio_post_load(void *opaque, int version_id)
1901 {
1902     IDEState *s = opaque;
1903 
1904     if (s->end_transfer_fn_idx > ARRAY_SIZE(transfer_end_table)) {
1905         return -EINVAL;
1906     }
1907     s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
1908     s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
1909     s->data_end = s->data_ptr + s->cur_io_buffer_len;
1910 
1911     return 0;
1912 }
1913 
1914 static void ide_drive_pio_pre_save(void *opaque)
1915 {
1916     IDEState *s = opaque;
1917     int idx;
1918 
1919     s->cur_io_buffer_offset = s->data_ptr - s->io_buffer;
1920     s->cur_io_buffer_len = s->data_end - s->data_ptr;
1921 
1922     idx = transfer_end_table_idx(s->end_transfer_func);
1923     if (idx == -1) {
1924         fprintf(stderr, "%s: invalid end_transfer_func for DRQ_STAT\n",
1925                         __func__);
1926         s->end_transfer_fn_idx = 2;
1927     } else {
1928         s->end_transfer_fn_idx = idx;
1929     }
1930 }
1931 
1932 static bool ide_drive_pio_state_needed(void *opaque)
1933 {
1934     IDEState *s = opaque;
1935 
1936     return ((s->status & DRQ_STAT) != 0)
1937         || (s->bus->error_status & BM_STATUS_PIO_RETRY);
1938 }
1939 
1940 static bool ide_atapi_gesn_needed(void *opaque)
1941 {
1942     IDEState *s = opaque;
1943 
1944     return s->events.new_media || s->events.eject_request;
1945 }
1946 
1947 static bool ide_error_needed(void *opaque)
1948 {
1949     IDEBus *bus = opaque;
1950 
1951     return (bus->error_status != 0);
1952 }
1953 
1954 /* Fields for GET_EVENT_STATUS_NOTIFICATION ATAPI command */
1955 const VMStateDescription vmstate_ide_atapi_gesn_state = {
1956     .name ="ide_drive/atapi/gesn_state",
1957     .version_id = 1,
1958     .minimum_version_id = 1,
1959     .minimum_version_id_old = 1,
1960     .fields = (VMStateField []) {
1961         VMSTATE_BOOL(events.new_media, IDEState),
1962         VMSTATE_BOOL(events.eject_request, IDEState),
1963         VMSTATE_END_OF_LIST()
1964     }
1965 };
1966 
1967 const VMStateDescription vmstate_ide_drive_pio_state = {
1968     .name = "ide_drive/pio_state",
1969     .version_id = 1,
1970     .minimum_version_id = 1,
1971     .minimum_version_id_old = 1,
1972     .pre_save = ide_drive_pio_pre_save,
1973     .post_load = ide_drive_pio_post_load,
1974     .fields      = (VMStateField []) {
1975         VMSTATE_INT32(req_nb_sectors, IDEState),
1976         VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1,
1977 			     vmstate_info_uint8, uint8_t),
1978         VMSTATE_INT32(cur_io_buffer_offset, IDEState),
1979         VMSTATE_INT32(cur_io_buffer_len, IDEState),
1980         VMSTATE_UINT8(end_transfer_fn_idx, IDEState),
1981         VMSTATE_INT32(elementary_transfer_size, IDEState),
1982         VMSTATE_INT32(packet_transfer_size, IDEState),
1983         VMSTATE_END_OF_LIST()
1984     }
1985 };
1986 
1987 const VMStateDescription vmstate_ide_drive = {
1988     .name = "ide_drive",
1989     .version_id = 3,
1990     .minimum_version_id = 0,
1991     .minimum_version_id_old = 0,
1992     .post_load = ide_drive_post_load,
1993     .fields      = (VMStateField []) {
1994         VMSTATE_INT32(mult_sectors, IDEState),
1995         VMSTATE_INT32(identify_set, IDEState),
1996         VMSTATE_BUFFER_TEST(identify_data, IDEState, is_identify_set),
1997         VMSTATE_UINT8(feature, IDEState),
1998         VMSTATE_UINT8(error, IDEState),
1999         VMSTATE_UINT32(nsector, IDEState),
2000         VMSTATE_UINT8(sector, IDEState),
2001         VMSTATE_UINT8(lcyl, IDEState),
2002         VMSTATE_UINT8(hcyl, IDEState),
2003         VMSTATE_UINT8(hob_feature, IDEState),
2004         VMSTATE_UINT8(hob_sector, IDEState),
2005         VMSTATE_UINT8(hob_nsector, IDEState),
2006         VMSTATE_UINT8(hob_lcyl, IDEState),
2007         VMSTATE_UINT8(hob_hcyl, IDEState),
2008         VMSTATE_UINT8(select, IDEState),
2009         VMSTATE_UINT8(status, IDEState),
2010         VMSTATE_UINT8(lba48, IDEState),
2011         VMSTATE_UINT8(sense_key, IDEState),
2012         VMSTATE_UINT8(asc, IDEState),
2013         VMSTATE_UINT8_V(cdrom_changed, IDEState, 3),
2014         VMSTATE_END_OF_LIST()
2015     },
2016     .subsections = (VMStateSubsection []) {
2017         {
2018             .vmsd = &vmstate_ide_drive_pio_state,
2019             .needed = ide_drive_pio_state_needed,
2020         }, {
2021             .vmsd = &vmstate_ide_atapi_gesn_state,
2022             .needed = ide_atapi_gesn_needed,
2023         }, {
2024             /* empty */
2025         }
2026     }
2027 };
2028 
2029 const VMStateDescription vmstate_ide_error_status = {
2030     .name ="ide_bus/error",
2031     .version_id = 1,
2032     .minimum_version_id = 1,
2033     .minimum_version_id_old = 1,
2034     .fields = (VMStateField []) {
2035         VMSTATE_INT32(error_status, IDEBus),
2036         VMSTATE_END_OF_LIST()
2037     }
2038 };
2039 
2040 const VMStateDescription vmstate_ide_bus = {
2041     .name = "ide_bus",
2042     .version_id = 1,
2043     .minimum_version_id = 1,
2044     .minimum_version_id_old = 1,
2045     .fields      = (VMStateField []) {
2046         VMSTATE_UINT8(cmd, IDEBus),
2047         VMSTATE_UINT8(unit, IDEBus),
2048         VMSTATE_END_OF_LIST()
2049     },
2050     .subsections = (VMStateSubsection []) {
2051         {
2052             .vmsd = &vmstate_ide_error_status,
2053             .needed = ide_error_needed,
2054         }, {
2055             /* empty */
2056         }
2057     }
2058 };
2059 
2060 void ide_drive_get(DriveInfo **hd, int max_bus)
2061 {
2062     int i;
2063 
2064     if (drive_get_max_bus(IF_IDE) >= max_bus) {
2065         fprintf(stderr, "qemu: too many IDE bus: %d\n", max_bus);
2066         exit(1);
2067     }
2068 
2069     for(i = 0; i < max_bus * MAX_IDE_DEVS; i++) {
2070         hd[i] = drive_get(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
2071     }
2072 }
2073