ide.c 131.0 KB
Newer Older
B
bellard 已提交
1
/*
2
 * QEMU IDE disk and CD/DVD-ROM Emulator
3
 *
B
bellard 已提交
4
 * Copyright (c) 2003 Fabrice Bellard
5
 * Copyright (c) 2006 Openedhand Ltd.
6
 *
B
bellard 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
P
pbrook 已提交
25 26 27 28 29 30
#include "hw.h"
#include "pc.h"
#include "pci.h"
#include "scsi-disk.h"
#include "pcmcia.h"
#include "block.h"
31
#include "block_int.h"
P
pbrook 已提交
32 33
#include "qemu-timer.h"
#include "sysemu.h"
34
#include "ppc_mac.h"
A
aurel32 已提交
35
#include "mac_dbdma.h"
A
aurel32 已提交
36
#include "sh.h"
37
#include "dma.h"
B
bellard 已提交
38 39 40 41

/* debug IDE devices */
//#define DEBUG_IDE
//#define DEBUG_IDE_ATAPI
42 43
//#define DEBUG_AIO
#define USE_DMA_CDROM
B
bellard 已提交
44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146

/* Bits of HD_STATUS */
#define ERR_STAT		0x01
#define INDEX_STAT		0x02
#define ECC_STAT		0x04	/* Corrected error */
#define DRQ_STAT		0x08
#define SEEK_STAT		0x10
#define SRV_STAT		0x10
#define WRERR_STAT		0x20
#define READY_STAT		0x40
#define BUSY_STAT		0x80

/* Bits for HD_ERROR */
#define MARK_ERR		0x01	/* Bad address mark */
#define TRK0_ERR		0x02	/* couldn't find track 0 */
#define ABRT_ERR		0x04	/* Command aborted */
#define MCR_ERR			0x08	/* media change request */
#define ID_ERR			0x10	/* ID field not found */
#define MC_ERR			0x20	/* media changed */
#define ECC_ERR			0x40	/* Uncorrectable ECC error */
#define BBD_ERR			0x80	/* pre-EIDE meaning:  block marked bad */
#define ICRC_ERR		0x80	/* new meaning:  CRC error during transfer */

/* Bits of HD_NSECTOR */
#define CD			0x01
#define IO			0x02
#define REL			0x04
#define TAG_MASK		0xf8

#define IDE_CMD_RESET           0x04
#define IDE_CMD_DISABLE_IRQ     0x02

/* ATA/ATAPI Commands pre T13 Spec */
#define WIN_NOP				0x00
/*
 *	0x01->0x02 Reserved
 */
#define CFA_REQ_EXT_ERROR_CODE		0x03 /* CFA Request Extended Error Code */
/*
 *	0x04->0x07 Reserved
 */
#define WIN_SRST			0x08 /* ATAPI soft reset command */
#define WIN_DEVICE_RESET		0x08
/*
 *	0x09->0x0F Reserved
 */
#define WIN_RECAL			0x10
#define WIN_RESTORE			WIN_RECAL
/*
 *	0x10->0x1F Reserved
 */
#define WIN_READ			0x20 /* 28-Bit */
#define WIN_READ_ONCE			0x21 /* 28-Bit without retries */
#define WIN_READ_LONG			0x22 /* 28-Bit */
#define WIN_READ_LONG_ONCE		0x23 /* 28-Bit without retries */
#define WIN_READ_EXT			0x24 /* 48-Bit */
#define WIN_READDMA_EXT			0x25 /* 48-Bit */
#define WIN_READDMA_QUEUED_EXT		0x26 /* 48-Bit */
#define WIN_READ_NATIVE_MAX_EXT		0x27 /* 48-Bit */
/*
 *	0x28
 */
#define WIN_MULTREAD_EXT		0x29 /* 48-Bit */
/*
 *	0x2A->0x2F Reserved
 */
#define WIN_WRITE			0x30 /* 28-Bit */
#define WIN_WRITE_ONCE			0x31 /* 28-Bit without retries */
#define WIN_WRITE_LONG			0x32 /* 28-Bit */
#define WIN_WRITE_LONG_ONCE		0x33 /* 28-Bit without retries */
#define WIN_WRITE_EXT			0x34 /* 48-Bit */
#define WIN_WRITEDMA_EXT		0x35 /* 48-Bit */
#define WIN_WRITEDMA_QUEUED_EXT		0x36 /* 48-Bit */
#define WIN_SET_MAX_EXT			0x37 /* 48-Bit */
#define CFA_WRITE_SECT_WO_ERASE		0x38 /* CFA Write Sectors without erase */
#define WIN_MULTWRITE_EXT		0x39 /* 48-Bit */
/*
 *	0x3A->0x3B Reserved
 */
#define WIN_WRITE_VERIFY		0x3C /* 28-Bit */
/*
 *	0x3D->0x3F Reserved
 */
#define WIN_VERIFY			0x40 /* 28-Bit - Read Verify Sectors */
#define WIN_VERIFY_ONCE			0x41 /* 28-Bit - without retries */
#define WIN_VERIFY_EXT			0x42 /* 48-Bit */
/*
 *	0x43->0x4F Reserved
 */
#define WIN_FORMAT			0x50
/*
 *	0x51->0x5F Reserved
 */
#define WIN_INIT			0x60
/*
 *	0x61->0x5F Reserved
 */
#define WIN_SEEK			0x70 /* 0x70-0x7F Reserved */
#define CFA_TRANSLATE_SECTOR		0x87 /* CFA Translate Sector */
#define WIN_DIAGNOSE			0x90
#define WIN_SPECIFY			0x91 /* set drive geometry translation */
#define WIN_DOWNLOAD_MICROCODE		0x92
#define WIN_STANDBYNOW2			0x94
147
#define CFA_IDLEIMMEDIATE		0x95 /* force drive to become "ready" */
B
bellard 已提交
148 149 150 151 152 153 154 155 156 157 158
#define WIN_STANDBY2			0x96
#define WIN_SETIDLE2			0x97
#define WIN_CHECKPOWERMODE2		0x98
#define WIN_SLEEPNOW2			0x99
/*
 *	0x9A VENDOR
 */
#define WIN_PACKETCMD			0xA0 /* Send a packet command. */
#define WIN_PIDENTIFY			0xA1 /* identify ATAPI device	*/
#define WIN_QUEUED_SERVICE		0xA2
#define WIN_SMART			0xB0 /* self-monitoring and reporting */
159 160
#define CFA_ACCESS_METADATA_STORAGE	0xB8
#define CFA_ERASE_SECTORS       	0xC0 /* microdrives implement as NOP */
B
bellard 已提交
161 162 163 164 165 166 167 168 169 170
#define WIN_MULTREAD			0xC4 /* read sectors using multiple mode*/
#define WIN_MULTWRITE			0xC5 /* write sectors using multiple mode */
#define WIN_SETMULT			0xC6 /* enable/disable multiple mode */
#define WIN_READDMA_QUEUED		0xC7 /* read sectors using Queued DMA transfers */
#define WIN_READDMA			0xC8 /* read sectors using DMA transfers */
#define WIN_READDMA_ONCE		0xC9 /* 28-Bit - without retries */
#define WIN_WRITEDMA			0xCA /* write sectors using DMA transfers */
#define WIN_WRITEDMA_ONCE		0xCB /* 28-Bit - without retries */
#define WIN_WRITEDMA_QUEUED		0xCC /* write sectors using Queued DMA transfers */
#define CFA_WRITE_MULTI_WO_ERASE	0xCD /* CFA Write multiple without erase */
171
#define WIN_GETMEDIASTATUS		0xDA
B
bellard 已提交
172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193
#define WIN_ACKMEDIACHANGE		0xDB /* ATA-1, ATA-2 vendor */
#define WIN_POSTBOOT			0xDC
#define WIN_PREBOOT			0xDD
#define WIN_DOORLOCK			0xDE /* lock door on removable drives */
#define WIN_DOORUNLOCK			0xDF /* unlock door on removable drives */
#define WIN_STANDBYNOW1			0xE0
#define WIN_IDLEIMMEDIATE		0xE1 /* force drive to become "ready" */
#define WIN_STANDBY             	0xE2 /* Set device in Standby Mode */
#define WIN_SETIDLE1			0xE3
#define WIN_READ_BUFFER			0xE4 /* force read only 1 sector */
#define WIN_CHECKPOWERMODE1		0xE5
#define WIN_SLEEPNOW1			0xE6
#define WIN_FLUSH_CACHE			0xE7
#define WIN_WRITE_BUFFER		0xE8 /* force write only 1 sector */
#define WIN_WRITE_SAME			0xE9 /* read ata-2 to use */
	/* SET_FEATURES 0x22 or 0xDD */
#define WIN_FLUSH_CACHE_EXT		0xEA /* 48-Bit */
#define WIN_IDENTIFY			0xEC /* ask drive to identify itself	*/
#define WIN_MEDIAEJECT			0xED
#define WIN_IDENTIFY_DMA		0xEE /* same as WIN_IDENTIFY, but DMA */
#define WIN_SETFEATURES			0xEF /* set special drive features */
#define EXABYTE_ENABLE_NEST		0xF0
194
#define IBM_SENSE_CONDITION		0xF0 /* measure disk temperature */
B
bellard 已提交
195 196 197 198 199
#define WIN_SECURITY_SET_PASS		0xF1
#define WIN_SECURITY_UNLOCK		0xF2
#define WIN_SECURITY_ERASE_PREPARE	0xF3
#define WIN_SECURITY_ERASE_UNIT		0xF4
#define WIN_SECURITY_FREEZE_LOCK	0xF5
200
#define CFA_WEAR_LEVEL			0xF5 /* microdrives implement as NOP */
B
bellard 已提交
201 202 203 204 205 206
#define WIN_SECURITY_DISABLE		0xF6
#define WIN_READ_NATIVE_MAX		0xF8 /* return the native maximum address */
#define WIN_SET_MAX			0xF9
#define DISABLE_SEAGATE			0xFB

/* set to 1 set disable mult support */
207
#define MAX_MULT_SECTORS 16
B
bellard 已提交
208

209 210 211 212 213 214
#define IDE_DMA_BUF_SECTORS 256

#if (IDE_DMA_BUF_SECTORS < MAX_MULT_SECTORS)
#error "IDE_DMA_BUF_SECTORS must be bigger or equal to MAX_MULT_SECTORS"
#endif

B
bellard 已提交
215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268
/* ATAPI defines */

#define ATAPI_PACKET_SIZE 12

/* The generic packet command opcodes for CD/DVD Logical Units,
 * From Table 57 of the SFF8090 Ver. 3 (Mt. Fuji) draft standard. */
#define GPCMD_BLANK			    0xa1
#define GPCMD_CLOSE_TRACK		    0x5b
#define GPCMD_FLUSH_CACHE		    0x35
#define GPCMD_FORMAT_UNIT		    0x04
#define GPCMD_GET_CONFIGURATION		    0x46
#define GPCMD_GET_EVENT_STATUS_NOTIFICATION 0x4a
#define GPCMD_GET_PERFORMANCE		    0xac
#define GPCMD_INQUIRY			    0x12
#define GPCMD_LOAD_UNLOAD		    0xa6
#define GPCMD_MECHANISM_STATUS		    0xbd
#define GPCMD_MODE_SELECT_10		    0x55
#define GPCMD_MODE_SENSE_10		    0x5a
#define GPCMD_PAUSE_RESUME		    0x4b
#define GPCMD_PLAY_AUDIO_10		    0x45
#define GPCMD_PLAY_AUDIO_MSF		    0x47
#define GPCMD_PLAY_AUDIO_TI		    0x48
#define GPCMD_PLAY_CD			    0xbc
#define GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL  0x1e
#define GPCMD_READ_10			    0x28
#define GPCMD_READ_12			    0xa8
#define GPCMD_READ_CDVD_CAPACITY	    0x25
#define GPCMD_READ_CD			    0xbe
#define GPCMD_READ_CD_MSF		    0xb9
#define GPCMD_READ_DISC_INFO		    0x51
#define GPCMD_READ_DVD_STRUCTURE	    0xad
#define GPCMD_READ_FORMAT_CAPACITIES	    0x23
#define GPCMD_READ_HEADER		    0x44
#define GPCMD_READ_TRACK_RZONE_INFO	    0x52
#define GPCMD_READ_SUBCHANNEL		    0x42
#define GPCMD_READ_TOC_PMA_ATIP		    0x43
#define GPCMD_REPAIR_RZONE_TRACK	    0x58
#define GPCMD_REPORT_KEY		    0xa4
#define GPCMD_REQUEST_SENSE		    0x03
#define GPCMD_RESERVE_RZONE_TRACK	    0x53
#define GPCMD_SCAN			    0xba
#define GPCMD_SEEK			    0x2b
#define GPCMD_SEND_DVD_STRUCTURE	    0xad
#define GPCMD_SEND_EVENT		    0xa2
#define GPCMD_SEND_KEY			    0xa3
#define GPCMD_SEND_OPC			    0x54
#define GPCMD_SET_READ_AHEAD		    0xa7
#define GPCMD_SET_STREAMING		    0xb6
#define GPCMD_START_STOP_UNIT		    0x1b
#define GPCMD_STOP_PLAY_SCAN		    0x4e
#define GPCMD_TEST_UNIT_READY		    0x00
#define GPCMD_VERIFY_10			    0x2f
#define GPCMD_WRITE_10			    0x2a
#define GPCMD_WRITE_AND_VERIFY_10	    0x2e
269
/* This is listed as optional in ATAPI 2.6, but is (curiously)
B
bellard 已提交
270 271 272 273
 * missing from Mt. Fuji, Table 57.  It _is_ mentioned in Mt. Fuji
 * Table 377 as an MMC command for SCSi devices though...  Most ATAPI
 * drives support it. */
#define GPCMD_SET_SPEED			    0xbb
274
/* This seems to be a SCSI specific CD-ROM opcode
B
bellard 已提交
275 276 277 278 279 280 281
 * to play data at track/index */
#define GPCMD_PLAYAUDIO_TI		    0x48
/*
 * From MS Media Status Notification Support Specification. For
 * older drives only.
 */
#define GPCMD_GET_MEDIA_STATUS		    0xda
282
#define GPCMD_MODE_SENSE_6		    0x1a
B
bellard 已提交
283 284 285 286 287 288 289 290 291 292 293 294 295 296

/* Mode page codes for mode sense/set */
#define GPMODE_R_W_ERROR_PAGE		0x01
#define GPMODE_WRITE_PARMS_PAGE		0x05
#define GPMODE_AUDIO_CTL_PAGE		0x0e
#define GPMODE_POWER_PAGE		0x1a
#define GPMODE_FAULT_FAIL_PAGE		0x1c
#define GPMODE_TO_PROTECT_PAGE		0x1d
#define GPMODE_CAPABILITIES_PAGE	0x2a
#define GPMODE_ALL_PAGES		0x3f
/* Not in Mt. Fuji, but in ATAPI 2.6 -- depricated now in favor
 * of MODE_SENSE_POWER_PAGE */
#define GPMODE_CDROM_PAGE		0x0d

297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348
/*
 * Based on values from <linux/cdrom.h> but extending CD_MINS
 * to the maximum common size allowed by the Orange's Book ATIP
 *
 * 90 and 99 min CDs are also available but using them as the
 * upper limit reduces the effectiveness of the heuristic to
 * detect DVDs burned to less than 25% of their maximum capacity
 */

/* Some generally useful CD-ROM information */
#define CD_MINS                       80 /* max. minutes per CD */
#define CD_SECS                       60 /* seconds per minute */
#define CD_FRAMES                     75 /* frames per second */
#define CD_FRAMESIZE                2048 /* bytes per frame, "cooked" mode */
#define CD_MAX_BYTES       (CD_MINS * CD_SECS * CD_FRAMES * CD_FRAMESIZE)
#define CD_MAX_SECTORS     (CD_MAX_BYTES / 512)

/*
 * The MMC values are not IDE specific and might need to be moved
 * to a common header if they are also needed for the SCSI emulation
 */

/* Profile list from MMC-6 revision 1 table 91 */
#define MMC_PROFILE_NONE                0x0000
#define MMC_PROFILE_CD_ROM              0x0008
#define MMC_PROFILE_CD_R                0x0009
#define MMC_PROFILE_CD_RW               0x000A
#define MMC_PROFILE_DVD_ROM             0x0010
#define MMC_PROFILE_DVD_R_SR            0x0011
#define MMC_PROFILE_DVD_RAM             0x0012
#define MMC_PROFILE_DVD_RW_RO           0x0013
#define MMC_PROFILE_DVD_RW_SR           0x0014
#define MMC_PROFILE_DVD_R_DL_SR         0x0015
#define MMC_PROFILE_DVD_R_DL_JR         0x0016
#define MMC_PROFILE_DVD_RW_DL           0x0017
#define MMC_PROFILE_DVD_DDR             0x0018
#define MMC_PROFILE_DVD_PLUS_RW         0x001A
#define MMC_PROFILE_DVD_PLUS_R          0x001B
#define MMC_PROFILE_DVD_PLUS_RW_DL      0x002A
#define MMC_PROFILE_DVD_PLUS_R_DL       0x002B
#define MMC_PROFILE_BD_ROM              0x0040
#define MMC_PROFILE_BD_R_SRM            0x0041
#define MMC_PROFILE_BD_R_RRM            0x0042
#define MMC_PROFILE_BD_RE               0x0043
#define MMC_PROFILE_HDDVD_ROM           0x0050
#define MMC_PROFILE_HDDVD_R             0x0051
#define MMC_PROFILE_HDDVD_RAM           0x0052
#define MMC_PROFILE_HDDVD_RW            0x0053
#define MMC_PROFILE_HDDVD_R_DL          0x0058
#define MMC_PROFILE_HDDVD_RW_DL         0x005A
#define MMC_PROFILE_INVALID             0xFFFF

B
bellard 已提交
349 350 351 352 353 354
#define ATAPI_INT_REASON_CD             0x01 /* 0 = data transfer */
#define ATAPI_INT_REASON_IO             0x02 /* 1 = transfer to the host */
#define ATAPI_INT_REASON_REL            0x04
#define ATAPI_INT_REASON_TAG            0xf8

/* same constants as bochs */
355
#define ASC_ILLEGAL_OPCODE                   0x20
B
bellard 已提交
356 357
#define ASC_LOGICAL_BLOCK_OOR                0x21
#define ASC_INV_FIELD_IN_CMD_PACKET          0x24
358
#define ASC_MEDIUM_MAY_HAVE_CHANGED          0x28
359
#define ASC_INCOMPATIBLE_FORMAT              0x30
B
bellard 已提交
360 361 362
#define ASC_MEDIUM_NOT_PRESENT               0x3a
#define ASC_SAVING_PARAMETERS_NOT_SUPPORTED  0x39

363 364 365 366 367 368
#define CFA_NO_ERROR            0x00
#define CFA_MISC_ERROR          0x09
#define CFA_INVALID_COMMAND     0x20
#define CFA_INVALID_ADDRESS     0x21
#define CFA_ADDRESS_OVERFLOW    0x2f

B
bellard 已提交
369 370 371 372 373 374 375 376 377
#define SENSE_NONE            0
#define SENSE_NOT_READY       2
#define SENSE_ILLEGAL_REQUEST 5
#define SENSE_UNIT_ATTENTION  6

struct IDEState;

typedef void EndTransferFunc(struct IDEState *);

378
/* NOTE: IDEState represents in fact one drive */
B
bellard 已提交
379 380 381
typedef struct IDEState {
    /* ide config */
    int is_cdrom;
382
    int is_cf;
B
bellard 已提交
383 384 385
    int cylinders, heads, sectors;
    int64_t nb_sectors;
    int mult_sectors;
386 387
    int identify_set;
    uint16_t identify_data[256];
P
pbrook 已提交
388
    qemu_irq irq;
389
    PCIDevice *pci_dev;
B
bellard 已提交
390
    struct BMDMAState *bmdma;
391
    int drive_serial;
392
    char drive_serial_str[21];
B
bellard 已提交
393 394 395
    /* ide regs */
    uint8_t feature;
    uint8_t error;
B
bellard 已提交
396
    uint32_t nsector;
B
bellard 已提交
397 398 399
    uint8_t sector;
    uint8_t lcyl;
    uint8_t hcyl;
B
bellard 已提交
400 401 402 403 404 405 406
    /* other part of tf for lba48 support */
    uint8_t hob_feature;
    uint8_t hob_nsector;
    uint8_t hob_sector;
    uint8_t hob_lcyl;
    uint8_t hob_hcyl;

B
bellard 已提交
407 408
    uint8_t select;
    uint8_t status;
B
bellard 已提交
409

B
bellard 已提交
410 411
    /* 0x3f6 command, only meaningful for drive 0 */
    uint8_t cmd;
B
bellard 已提交
412 413
    /* set for lba48 access */
    uint8_t lba48;
B
bellard 已提交
414
    /* depends on bit 4 in select, only meaningful for drive 0 */
415
    struct IDEState *cur_drive;
B
bellard 已提交
416 417 418 419 420 421 422 423
    BlockDriverState *bs;
    /* ATAPI specific */
    uint8_t sense_key;
    uint8_t asc;
    int packet_transfer_size;
    int elementary_transfer_size;
    int io_buffer_index;
    int lba;
B
bellard 已提交
424 425 426 427
    int cd_sector_size;
    int atapi_dma; /* true if dma is requested for the packet cmd */
    /* ATA DMA state */
    int io_buffer_size;
428
    QEMUSGList sg;
B
bellard 已提交
429
    /* PIO transfer handling */
B
bellard 已提交
430 431 432 433
    int req_nb_sectors; /* number of sectors per interrupt */
    EndTransferFunc *end_transfer_func;
    uint8_t *data_ptr;
    uint8_t *data_end;
434
    uint8_t *io_buffer;
435
    QEMUTimer *sector_write_timer; /* only used for win2k install hack */
436
    uint32_t irq_count; /* counts IRQs when using win2k install hack */
437 438 439 440 441 442
    /* CF-ATA extended error */
    uint8_t ext_error;
    /* CF-ATA metadata storage */
    uint32_t mdata_size;
    uint8_t *mdata_storage;
    int media_changed;
A
aurel32 已提交
443 444
    /* for pmac */
    int is_read;
B
bellard 已提交
445 446
} IDEState;

447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462
/* XXX: DVDs that could fit on a CD will be reported as a CD */
static inline int media_present(IDEState *s)
{
    return (s->nb_sectors > 0);
}

static inline int media_is_dvd(IDEState *s)
{
    return (media_present(s) && s->nb_sectors > CD_MAX_SECTORS);
}

static inline int media_is_cd(IDEState *s)
{
    return (media_present(s) && s->nb_sectors <= CD_MAX_SECTORS);
}

B
bellard 已提交
463 464 465
#define BM_STATUS_DMAING 0x01
#define BM_STATUS_ERROR  0x02
#define BM_STATUS_INT    0x04
466 467
#define BM_STATUS_DMA_RETRY  0x08
#define BM_STATUS_PIO_RETRY  0x10
B
bellard 已提交
468 469 470 471

#define BM_CMD_START     0x01
#define BM_CMD_READ      0x08

472 473
#define IDE_TYPE_PIIX3   0
#define IDE_TYPE_CMD646  1
T
ths 已提交
474
#define IDE_TYPE_PIIX4   2
475 476 477 478 479 480 481 482 483 484

/* CMD646 specific */
#define MRDMODE		0x71
#define   MRDMODE_INTR_CH0	0x04
#define   MRDMODE_INTR_CH1	0x08
#define   MRDMODE_BLK_CH0	0x10
#define   MRDMODE_BLK_CH1	0x20
#define UDIDETCR0	0x73
#define UDIDETCR1	0x7B

B
bellard 已提交
485 486 487 488
typedef struct BMDMAState {
    uint8_t cmd;
    uint8_t status;
    uint32_t addr;
489

490
    struct PCIIDEState *pci_dev;
B
bellard 已提交
491
    /* current transfer state */
492 493 494 495
    uint32_t cur_addr;
    uint32_t cur_prd_last;
    uint32_t cur_prd_addr;
    uint32_t cur_prd_len;
B
bellard 已提交
496
    IDEState *ide_if;
497 498
    BlockDriverCompletionFunc *dma_cb;
    BlockDriverAIOCB *aiocb;
499 500
    int64_t sector_num;
    uint32_t nsector;
B
bellard 已提交
501 502 503 504 505 506
} BMDMAState;

typedef struct PCIIDEState {
    PCIDevice dev;
    IDEState ide_if[4];
    BMDMAState bmdma[2];
507
    int type; /* see IDE_TYPE_xxx */
B
bellard 已提交
508 509
} PCIIDEState;

510
static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb);
511
static void ide_dma_restart(IDEState *s);
512
static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret);
B
bellard 已提交
513

B
bellard 已提交
514 515 516 517 518 519 520 521
static void padstr(char *str, const char *src, int len)
{
    int i, v;
    for(i = 0; i < len; i++) {
        if (*src)
            v = *src++;
        else
            v = ' ';
522
        str[i^1] = v;
B
bellard 已提交
523 524 525
    }
}

B
bellard 已提交
526 527 528 529 530 531 532 533 534 535 536
static void padstr8(uint8_t *buf, int buf_size, const char *src)
{
    int i;
    for(i = 0; i < buf_size; i++) {
        if (*src)
            buf[i] = *src++;
        else
            buf[i] = ' ';
    }
}

537 538
static void put_le16(uint16_t *p, unsigned int v)
{
B
bellard 已提交
539
    *p = cpu_to_le16(v);
540 541
}

B
bellard 已提交
542 543 544 545 546
static void ide_identify(IDEState *s)
{
    uint16_t *p;
    unsigned int oldsize;

547 548 549 550 551
    if (s->identify_set) {
	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
	return;
    }

B
bellard 已提交
552 553
    memset(s->io_buffer, 0, 512);
    p = (uint16_t *)s->io_buffer;
554
    put_le16(p + 0, 0x0040);
555
    put_le16(p + 1, s->cylinders);
556 557 558
    put_le16(p + 3, s->heads);
    put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
    put_le16(p + 5, 512); /* XXX: retired, remove ? */
559
    put_le16(p + 6, s->sectors);
560
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
561 562 563
    put_le16(p + 20, 3); /* XXX: retired, remove ? */
    put_le16(p + 21, 512); /* cache size in sectors */
    put_le16(p + 22, 4); /* ecc bytes */
564 565
    padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
    padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
566
#if MAX_MULT_SECTORS > 1
567
    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
B
bellard 已提交
568
#endif
569
    put_le16(p + 48, 1); /* dword I/O */
570
    put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
571 572
    put_le16(p + 51, 0x200); /* PIO transfer cycle */
    put_le16(p + 52, 0x200); /* DMA transfer cycle */
573
    put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
574 575 576
    put_le16(p + 54, s->cylinders);
    put_le16(p + 55, s->heads);
    put_le16(p + 56, s->sectors);
B
bellard 已提交
577
    oldsize = s->cylinders * s->heads * s->sectors;
578 579
    put_le16(p + 57, oldsize);
    put_le16(p + 58, oldsize >> 16);
B
bellard 已提交
580
    if (s->mult_sectors)
581 582 583
        put_le16(p + 59, 0x100 | s->mult_sectors);
    put_le16(p + 60, s->nb_sectors);
    put_le16(p + 61, s->nb_sectors >> 16);
584
    put_le16(p + 62, 0x07); /* single word dma0-2 supported */
585 586 587 588 589 590 591
    put_le16(p + 63, 0x07); /* mdma0-2 supported */
    put_le16(p + 65, 120);
    put_le16(p + 66, 120);
    put_le16(p + 67, 120);
    put_le16(p + 68, 120);
    put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
    put_le16(p + 81, 0x16); /* conforms to ata5 */
592
    put_le16(p + 82, (1 << 14));
B
bellard 已提交
593 594
    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
    put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
595 596
    put_le16(p + 84, (1 << 14));
    put_le16(p + 85, (1 << 14));
B
bellard 已提交
597 598
    /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
    put_le16(p + 86, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
599
    put_le16(p + 87, (1 << 14));
600 601
    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
    put_le16(p + 93, 1 | (1 << 14) | 0x2000);
B
bellard 已提交
602 603 604 605
    put_le16(p + 100, s->nb_sectors);
    put_le16(p + 101, s->nb_sectors >> 16);
    put_le16(p + 102, s->nb_sectors >> 32);
    put_le16(p + 103, s->nb_sectors >> 48);
606 607 608

    memcpy(s->identify_data, p, sizeof(s->identify_data));
    s->identify_set = 1;
B
bellard 已提交
609 610 611 612 613 614
}

static void ide_atapi_identify(IDEState *s)
{
    uint16_t *p;

615 616 617 618 619
    if (s->identify_set) {
	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
	return;
    }

B
bellard 已提交
620 621 622
    memset(s->io_buffer, 0, 512);
    p = (uint16_t *)s->io_buffer;
    /* Removable CDROM, 50us response, 12 byte packets */
623
    put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
624
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
625 626 627
    put_le16(p + 20, 3); /* buffer type */
    put_le16(p + 21, 512); /* cache size in sectors */
    put_le16(p + 22, 4); /* ecc bytes */
628
    padstr((char *)(p + 23), QEMU_VERSION, 8); /* firmware version */
629
    padstr((char *)(p + 27), "QEMU DVD-ROM", 40); /* model */
630
    put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
631 632 633
#ifdef USE_DMA_CDROM
    put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
    put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
634
    put_le16(p + 62, 7);  /* single word dma0-2 supported */
635 636 637
    put_le16(p + 63, 7);  /* mdma0-2 supported */
    put_le16(p + 64, 0x3f); /* PIO modes supported */
#else
638 639 640 641
    put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
    put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
    put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
    put_le16(p + 64, 1); /* PIO modes */
642
#endif
643 644 645 646
    put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
    put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
    put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
    put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
647

648 649
    put_le16(p + 71, 30); /* in ns */
    put_le16(p + 72, 30); /* in ns */
B
bellard 已提交
650

651
    put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
652 653 654
#ifdef USE_DMA_CDROM
    put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
#endif
655 656
    memcpy(s->identify_data, p, sizeof(s->identify_data));
    s->identify_set = 1;
B
bellard 已提交
657 658
}

659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677
static void ide_cfata_identify(IDEState *s)
{
    uint16_t *p;
    uint32_t cur_sec;

    p = (uint16_t *) s->identify_data;
    if (s->identify_set)
        goto fill_buffer;

    memset(p, 0, sizeof(s->identify_data));

    cur_sec = s->cylinders * s->heads * s->sectors;

    put_le16(p + 0, 0x848a);			/* CF Storage Card signature */
    put_le16(p + 1, s->cylinders);		/* Default cylinders */
    put_le16(p + 3, s->heads);			/* Default heads */
    put_le16(p + 6, s->sectors);		/* Default sectors per track */
    put_le16(p + 7, s->nb_sectors >> 16);	/* Sectors per card */
    put_le16(p + 8, s->nb_sectors);		/* Sectors per card */
678
    padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
679
    put_le16(p + 22, 0x0004);			/* ECC bytes */
680 681
    padstr((char *) (p + 23), QEMU_VERSION, 8);	/* Firmware Revision */
    padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724
#if MAX_MULT_SECTORS > 1
    put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
#else
    put_le16(p + 47, 0x0000);
#endif
    put_le16(p + 49, 0x0f00);			/* Capabilities */
    put_le16(p + 51, 0x0002);			/* PIO cycle timing mode */
    put_le16(p + 52, 0x0001);			/* DMA cycle timing mode */
    put_le16(p + 53, 0x0003);			/* Translation params valid */
    put_le16(p + 54, s->cylinders);		/* Current cylinders */
    put_le16(p + 55, s->heads);			/* Current heads */
    put_le16(p + 56, s->sectors);		/* Current sectors */
    put_le16(p + 57, cur_sec);			/* Current capacity */
    put_le16(p + 58, cur_sec >> 16);		/* Current capacity */
    if (s->mult_sectors)			/* Multiple sector setting */
        put_le16(p + 59, 0x100 | s->mult_sectors);
    put_le16(p + 60, s->nb_sectors);		/* Total LBA sectors */
    put_le16(p + 61, s->nb_sectors >> 16);	/* Total LBA sectors */
    put_le16(p + 63, 0x0203);			/* Multiword DMA capability */
    put_le16(p + 64, 0x0001);			/* Flow Control PIO support */
    put_le16(p + 65, 0x0096);			/* Min. Multiword DMA cycle */
    put_le16(p + 66, 0x0096);			/* Rec. Multiword DMA cycle */
    put_le16(p + 68, 0x00b4);			/* Min. PIO cycle time */
    put_le16(p + 82, 0x400c);			/* Command Set supported */
    put_le16(p + 83, 0x7068);			/* Command Set supported */
    put_le16(p + 84, 0x4000);			/* Features supported */
    put_le16(p + 85, 0x000c);			/* Command Set enabled */
    put_le16(p + 86, 0x7044);			/* Command Set enabled */
    put_le16(p + 87, 0x4000);			/* Features enabled */
    put_le16(p + 91, 0x4060);			/* Current APM level */
    put_le16(p + 129, 0x0002);			/* Current features option */
    put_le16(p + 130, 0x0005);			/* Reassigned sectors */
    put_le16(p + 131, 0x0001);			/* Initial power mode */
    put_le16(p + 132, 0x0000);			/* User signature */
    put_le16(p + 160, 0x8100);			/* Power requirement */
    put_le16(p + 161, 0x8001);			/* CF command set */

    s->identify_set = 1;

fill_buffer:
    memcpy(s->io_buffer, p, sizeof(s->identify_data));
}

B
bellard 已提交
725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748
static void ide_set_signature(IDEState *s)
{
    s->select &= 0xf0; /* clear head */
    /* put signature */
    s->nsector = 1;
    s->sector = 1;
    if (s->is_cdrom) {
        s->lcyl = 0x14;
        s->hcyl = 0xeb;
    } else if (s->bs) {
        s->lcyl = 0;
        s->hcyl = 0;
    } else {
        s->lcyl = 0xff;
        s->hcyl = 0xff;
    }
}

static inline void ide_abort_command(IDEState *s)
{
    s->status = READY_STAT | ERR_STAT;
    s->error = ABRT_ERR;
}

749 750 751 752 753 754 755 756
static inline void ide_dma_submit_check(IDEState *s,
          BlockDriverCompletionFunc *dma_cb, BMDMAState *bm)
{
    if (bm->aiocb)
	return;
    dma_cb(bm, -1);
}

B
bellard 已提交
757 758
static inline void ide_set_irq(IDEState *s)
{
759
    BMDMAState *bm = s->bmdma;
B
bellard 已提交
760
    if (!(s->cmd & IDE_CMD_DISABLE_IRQ)) {
761
        if (bm) {
762
            bm->status |= BM_STATUS_INT;
763
        }
P
pbrook 已提交
764
        qemu_irq_raise(s->irq);
B
bellard 已提交
765 766 767 768
    }
}

/* prepare data transfer and tell what to do after */
769
static void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
B
bellard 已提交
770 771 772 773 774
                               EndTransferFunc *end_transfer_func)
{
    s->end_transfer_func = end_transfer_func;
    s->data_ptr = buf;
    s->data_end = buf + size;
775 776
    if (!(s->status & ERR_STAT))
        s->status |= DRQ_STAT;
B
bellard 已提交
777 778 779 780 781 782 783 784 785 786 787 788 789 790 791
}

static void ide_transfer_stop(IDEState *s)
{
    s->end_transfer_func = ide_transfer_stop;
    s->data_ptr = s->io_buffer;
    s->data_end = s->io_buffer;
    s->status &= ~DRQ_STAT;
}

static int64_t ide_get_sector(IDEState *s)
{
    int64_t sector_num;
    if (s->select & 0x40) {
        /* lba */
B
bellard 已提交
792 793 794 795 796 797 798 799 800 801
	if (!s->lba48) {
	    sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
		(s->lcyl << 8) | s->sector;
	} else {
	    sector_num = ((int64_t)s->hob_hcyl << 40) |
		((int64_t) s->hob_lcyl << 32) |
		((int64_t) s->hob_sector << 24) |
		((int64_t) s->hcyl << 16) |
		((int64_t) s->lcyl << 8) | s->sector;
	}
B
bellard 已提交
802 803
    } else {
        sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
B
bellard 已提交
804
            (s->select & 0x0f) * s->sectors + (s->sector - 1);
B
bellard 已提交
805 806 807 808 809 810 811 812
    }
    return sector_num;
}

static void ide_set_sector(IDEState *s, int64_t sector_num)
{
    unsigned int cyl, r;
    if (s->select & 0x40) {
B
bellard 已提交
813 814 815 816 817 818 819 820 821 822 823 824 825
	if (!s->lba48) {
            s->select = (s->select & 0xf0) | (sector_num >> 24);
            s->hcyl = (sector_num >> 16);
            s->lcyl = (sector_num >> 8);
            s->sector = (sector_num);
	} else {
	    s->sector = sector_num;
	    s->lcyl = sector_num >> 8;
	    s->hcyl = sector_num >> 16;
	    s->hob_sector = sector_num >> 24;
	    s->hob_lcyl = sector_num >> 32;
	    s->hob_hcyl = sector_num >> 40;
	}
B
bellard 已提交
826 827 828 829 830
    } else {
        cyl = sector_num / (s->heads * s->sectors);
        r = sector_num % (s->heads * s->sectors);
        s->hcyl = cyl >> 8;
        s->lcyl = cyl;
831
        s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
B
bellard 已提交
832 833 834 835
        s->sector = (r % s->sectors) + 1;
    }
}

836 837 838 839 840
static void ide_rw_error(IDEState *s) {
    ide_abort_command(s);
    ide_set_irq(s);
}

B
bellard 已提交
841 842 843 844 845 846
static void ide_sector_read(IDEState *s)
{
    int64_t sector_num;
    int ret, n;

    s->status = READY_STAT | SEEK_STAT;
847
    s->error = 0; /* not needed by IDE spec, but needed by Windows */
B
bellard 已提交
848 849 850 851 852 853 854
    sector_num = ide_get_sector(s);
    n = s->nsector;
    if (n == 0) {
        /* no more sector to read from disk */
        ide_transfer_stop(s);
    } else {
#if defined(DEBUG_IDE)
855
        printf("read sector=%" PRId64 "\n", sector_num);
B
bellard 已提交
856 857 858 859
#endif
        if (n > s->req_nb_sectors)
            n = s->req_nb_sectors;
        ret = bdrv_read(s->bs, sector_num, s->io_buffer, n);
860 861 862 863
        if (ret != 0) {
            ide_rw_error(s);
            return;
        }
B
bellard 已提交
864 865 866 867 868 869 870
        ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read);
        ide_set_irq(s);
        ide_set_sector(s, sector_num + n);
        s->nsector -= n;
    }
}

871 872 873 874 875 876 877 878 879 880 881

/* return 0 if buffer completed */
static int dma_buf_prepare(BMDMAState *bm, int is_write)
{
    IDEState *s = bm->ide_if;
    struct {
        uint32_t addr;
        uint32_t size;
    } prd;
    int l, len;

882
    qemu_sglist_init(&s->sg, s->nsector / (TARGET_PAGE_SIZE/512) + 1);
883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902
    s->io_buffer_size = 0;
    for(;;) {
        if (bm->cur_prd_len == 0) {
            /* end of table (with a fail safe of one page) */
            if (bm->cur_prd_last ||
                (bm->cur_addr - bm->addr) >= 4096)
                return s->io_buffer_size != 0;
            cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
            bm->cur_addr += 8;
            prd.addr = le32_to_cpu(prd.addr);
            prd.size = le32_to_cpu(prd.size);
            len = prd.size & 0xfffe;
            if (len == 0)
                len = 0x10000;
            bm->cur_prd_len = len;
            bm->cur_prd_addr = prd.addr;
            bm->cur_prd_last = (prd.size & 0x80000000);
        }
        l = bm->cur_prd_len;
        if (l > 0) {
903 904 905 906
            qemu_sglist_add(&s->sg, bm->cur_prd_addr, l);
            bm->cur_prd_addr += l;
            bm->cur_prd_len -= l;
            s->io_buffer_size += l;
907 908 909 910 911 912 913
        }
    }
    return 1;
}

static void dma_buf_commit(IDEState *s, int is_write)
{
914
    qemu_sglist_destroy(&s->sg);
915 916
}

917 918 919 920 921 922 923 924
static void ide_dma_error(IDEState *s)
{
    ide_transfer_stop(s);
    s->error = ABRT_ERR;
    s->status = READY_STAT | ERR_STAT;
    ide_set_irq(s);
}

925 926 927 928 929 930 931 932 933 934 935 936 937
static int ide_handle_write_error(IDEState *s, int error, int op)
{
    BlockInterfaceErrorAction action = drive_get_onerror(s->bs);

    if (action == BLOCK_ERR_IGNORE)
        return 0;

    if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
            || action == BLOCK_ERR_STOP_ANY) {
        s->bmdma->ide_if = s;
        s->bmdma->status |= op;
        vm_stop(0);
    } else {
938 939
        if (op == BM_STATUS_DMA_RETRY) {
            dma_buf_commit(s, 0);
940
            ide_dma_error(s);
941
        } else {
942
            ide_rw_error(s);
943
        }
944 945 946 947 948
    }

    return 1;
}

949 950
/* return 0 if buffer completed */
static int dma_buf_rw(BMDMAState *bm, int is_write)
B
bellard 已提交
951
{
952 953 954 955 956 957
    IDEState *s = bm->ide_if;
    struct {
        uint32_t addr;
        uint32_t size;
    } prd;
    int l, len;
B
bellard 已提交
958

959 960
    for(;;) {
        l = s->io_buffer_size - s->io_buffer_index;
961
        if (l <= 0)
962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982
            break;
        if (bm->cur_prd_len == 0) {
            /* end of table (with a fail safe of one page) */
            if (bm->cur_prd_last ||
                (bm->cur_addr - bm->addr) >= 4096)
                return 0;
            cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
            bm->cur_addr += 8;
            prd.addr = le32_to_cpu(prd.addr);
            prd.size = le32_to_cpu(prd.size);
            len = prd.size & 0xfffe;
            if (len == 0)
                len = 0x10000;
            bm->cur_prd_len = len;
            bm->cur_prd_addr = prd.addr;
            bm->cur_prd_last = (prd.size & 0x80000000);
        }
        if (l > bm->cur_prd_len)
            l = bm->cur_prd_len;
        if (l > 0) {
            if (is_write) {
983
                cpu_physical_memory_write(bm->cur_prd_addr,
984 985
                                          s->io_buffer + s->io_buffer_index, l);
            } else {
986
                cpu_physical_memory_read(bm->cur_prd_addr,
987 988 989 990 991
                                          s->io_buffer + s->io_buffer_index, l);
            }
            bm->cur_prd_addr += l;
            bm->cur_prd_len -= l;
            s->io_buffer_index += l;
B
bellard 已提交
992 993
        }
    }
994 995 996 997 998 999 1000 1001 1002 1003
    return 1;
}

static void ide_read_dma_cb(void *opaque, int ret)
{
    BMDMAState *bm = opaque;
    IDEState *s = bm->ide_if;
    int n;
    int64_t sector_num;

1004
    if (ret < 0) {
1005
        dma_buf_commit(s, 1);
1006 1007 1008 1009
	ide_dma_error(s);
	return;
    }

1010 1011 1012
    n = s->io_buffer_size >> 9;
    sector_num = ide_get_sector(s);
    if (n > 0) {
1013
        dma_buf_commit(s, 1);
1014 1015 1016 1017 1018 1019 1020
        sector_num += n;
        ide_set_sector(s, sector_num);
        s->nsector -= n;
    }

    /* end of transfer ? */
    if (s->nsector == 0) {
B
bellard 已提交
1021 1022
        s->status = READY_STAT | SEEK_STAT;
        ide_set_irq(s);
1023 1024 1025 1026 1027 1028 1029
    eot:
        bm->status &= ~BM_STATUS_DMAING;
        bm->status |= BM_STATUS_INT;
        bm->dma_cb = NULL;
        bm->ide_if = NULL;
        bm->aiocb = NULL;
        return;
B
bellard 已提交
1030
    }
1031 1032 1033 1034 1035

    /* launch next transfer */
    n = s->nsector;
    s->io_buffer_index = 0;
    s->io_buffer_size = n * 512;
1036 1037
    if (dma_buf_prepare(bm, 1) == 0)
        goto eot;
1038
#ifdef DEBUG_AIO
B
blueswir1 已提交
1039
    printf("aio_read: sector_num=%" PRId64 " n=%d\n", sector_num, n);
1040
#endif
1041
    bm->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num, ide_read_dma_cb, bm);
1042
    ide_dma_submit_check(s, ide_read_dma_cb, bm);
B
bellard 已提交
1043 1044 1045 1046
}

static void ide_sector_read_dma(IDEState *s)
{
1047
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
B
bellard 已提交
1048 1049
    s->io_buffer_index = 0;
    s->io_buffer_size = 0;
A
aurel32 已提交
1050
    s->is_read = 1;
B
bellard 已提交
1051 1052 1053
    ide_dma_start(s, ide_read_dma_cb);
}

1054 1055 1056 1057 1058 1059
static void ide_sector_write_timer_cb(void *opaque)
{
    IDEState *s = opaque;
    ide_set_irq(s);
}

B
bellard 已提交
1060 1061 1062
static void ide_sector_write(IDEState *s)
{
    int64_t sector_num;
1063
    int ret, n, n1;
B
bellard 已提交
1064 1065 1066 1067

    s->status = READY_STAT | SEEK_STAT;
    sector_num = ide_get_sector(s);
#if defined(DEBUG_IDE)
1068
    printf("write sector=%" PRId64 "\n", sector_num);
B
bellard 已提交
1069 1070 1071 1072
#endif
    n = s->nsector;
    if (n > s->req_nb_sectors)
        n = s->req_nb_sectors;
1073
    ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
1074

1075
    if (ret != 0) {
1076 1077
        if (ide_handle_write_error(s, -ret, BM_STATUS_PIO_RETRY))
            return;
1078 1079
    }

B
bellard 已提交
1080 1081
    s->nsector -= n;
    if (s->nsector == 0) {
1082
        /* no more sectors to write */
B
bellard 已提交
1083 1084 1085 1086 1087 1088 1089 1090
        ide_transfer_stop(s);
    } else {
        n1 = s->nsector;
        if (n1 > s->req_nb_sectors)
            n1 = s->req_nb_sectors;
        ide_transfer_start(s, s->io_buffer, 512 * n1, ide_sector_write);
    }
    ide_set_sector(s, sector_num + n);
1091

1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106
#ifdef TARGET_I386
    if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
        /* It seems there is a bug in the Windows 2000 installer HDD
           IDE driver which fills the disk with empty logs when the
           IDE write IRQ comes too early. This hack tries to correct
           that at the expense of slower write performances. Use this
           option _only_ to install Windows 2000. You must disable it
           for normal use. */
        qemu_mod_timer(s->sector_write_timer, 
                       qemu_get_clock(vm_clock) + (ticks_per_sec / 1000));
    } else 
#endif
    {
        ide_set_irq(s);
    }
B
bellard 已提交
1107 1108
}

A
aliguori 已提交
1109
static void ide_dma_restart_cb(void *opaque, int running, int reason)
1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122
{
    BMDMAState *bm = opaque;
    if (!running)
        return;
    if (bm->status & BM_STATUS_DMA_RETRY) {
        bm->status &= ~BM_STATUS_DMA_RETRY;
        ide_dma_restart(bm->ide_if);
    } else if (bm->status & BM_STATUS_PIO_RETRY) {
        bm->status &= ~BM_STATUS_PIO_RETRY;
        ide_sector_write(bm->ide_if);
    }
}

1123
static void ide_write_dma_cb(void *opaque, int ret)
B
bellard 已提交
1124
{
1125 1126 1127
    BMDMAState *bm = opaque;
    IDEState *s = bm->ide_if;
    int n;
B
bellard 已提交
1128 1129
    int64_t sector_num;

1130
    if (ret < 0) {
1131 1132
        if (ide_handle_write_error(s, -ret,  BM_STATUS_DMA_RETRY))
            return;
1133 1134
    }

1135 1136 1137
    n = s->io_buffer_size >> 9;
    sector_num = ide_get_sector(s);
    if (n > 0) {
1138
        dma_buf_commit(s, 0);
1139 1140 1141
        sector_num += n;
        ide_set_sector(s, sector_num);
        s->nsector -= n;
B
bellard 已提交
1142 1143
    }

1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156
    /* end of transfer ? */
    if (s->nsector == 0) {
        s->status = READY_STAT | SEEK_STAT;
        ide_set_irq(s);
    eot:
        bm->status &= ~BM_STATUS_DMAING;
        bm->status |= BM_STATUS_INT;
        bm->dma_cb = NULL;
        bm->ide_if = NULL;
        bm->aiocb = NULL;
        return;
    }

B
bellard 已提交
1157 1158
    n = s->nsector;
    s->io_buffer_size = n * 512;
1159 1160
    /* launch next transfer */
    if (dma_buf_prepare(bm, 0) == 0)
1161 1162
        goto eot;
#ifdef DEBUG_AIO
B
blueswir1 已提交
1163
    printf("aio_write: sector_num=%" PRId64 " n=%d\n", sector_num, n);
1164
#endif
1165
    bm->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num, ide_write_dma_cb, bm);
1166
    ide_dma_submit_check(s, ide_write_dma_cb, bm);
1167 1168 1169 1170 1171 1172 1173
}

static void ide_sector_write_dma(IDEState *s)
{
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
    s->io_buffer_index = 0;
    s->io_buffer_size = 0;
A
aurel32 已提交
1174
    s->is_read = 0;
B
bellard 已提交
1175 1176 1177
    ide_dma_start(s, ide_write_dma_cb);
}

B
bellard 已提交
1178 1179 1180
static void ide_atapi_cmd_ok(IDEState *s)
{
    s->error = 0;
A
aliguori 已提交
1181
    s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198
    s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
    ide_set_irq(s);
}

static void ide_atapi_cmd_error(IDEState *s, int sense_key, int asc)
{
#ifdef DEBUG_IDE_ATAPI
    printf("atapi_cmd_error: sense=0x%x asc=0x%x\n", sense_key, asc);
#endif
    s->error = sense_key << 4;
    s->status = READY_STAT | ERR_STAT;
    s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
    s->sense_key = sense_key;
    s->asc = asc;
    ide_set_irq(s);
}

1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209
static void ide_atapi_cmd_check_status(IDEState *s)
{
#ifdef DEBUG_IDE_ATAPI
    printf("atapi_cmd_check_status\n");
#endif
    s->error = MC_ERR | (SENSE_UNIT_ATTENTION << 4);
    s->status = ERR_STAT;
    s->nsector = 0;
    ide_set_irq(s);
}

B
bellard 已提交
1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233
static inline void cpu_to_ube16(uint8_t *buf, int val)
{
    buf[0] = val >> 8;
    buf[1] = val;
}

static inline void cpu_to_ube32(uint8_t *buf, unsigned int val)
{
    buf[0] = val >> 24;
    buf[1] = val >> 16;
    buf[2] = val >> 8;
    buf[3] = val;
}

static inline int ube16_to_cpu(const uint8_t *buf)
{
    return (buf[0] << 8) | buf[1];
}

static inline int ube32_to_cpu(const uint8_t *buf)
{
    return (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
}

B
bellard 已提交
1234 1235 1236 1237 1238 1239 1240 1241
static void lba_to_msf(uint8_t *buf, int lba)
{
    lba += 150;
    buf[0] = (lba / 75) / 60;
    buf[1] = (lba / 75) % 60;
    buf[2] = lba % 75;
}

1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258
static void cd_data_to_raw(uint8_t *buf, int lba)
{
    /* sync bytes */
    buf[0] = 0x00;
    memset(buf + 1, 0xff, 10);
    buf[11] = 0x00;
    buf += 12;
    /* MSF */
    lba_to_msf(buf, lba);
    buf[3] = 0x01; /* mode 1 data */
    buf += 4;
    /* data */
    buf += 2048;
    /* XXX: ECC not computed */
    memset(buf, 0, 288);
}

1259
static int cd_read_sector(BlockDriverState *bs, int lba, uint8_t *buf,
B
bellard 已提交
1260 1261
                           int sector_size)
{
1262 1263
    int ret;

B
bellard 已提交
1264 1265
    switch(sector_size) {
    case 2048:
1266
        ret = bdrv_read(bs, (int64_t)lba << 2, buf, 4);
B
bellard 已提交
1267 1268
        break;
    case 2352:
1269 1270 1271
        ret = bdrv_read(bs, (int64_t)lba << 2, buf + 16, 4);
        if (ret < 0)
            return ret;
1272
        cd_data_to_raw(buf, lba);
B
bellard 已提交
1273 1274
        break;
    default:
1275
        ret = -EIO;
B
bellard 已提交
1276 1277
        break;
    }
1278 1279 1280 1281 1282 1283 1284
    return ret;
}

static void ide_atapi_io_error(IDEState *s, int ret)
{
    /* XXX: handle more errors */
    if (ret == -ENOMEDIUM) {
1285
        ide_atapi_cmd_error(s, SENSE_NOT_READY,
1286 1287
                            ASC_MEDIUM_NOT_PRESENT);
    } else {
1288
        ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1289 1290
                            ASC_LOGICAL_BLOCK_OOR);
    }
B
bellard 已提交
1291 1292
}

B
bellard 已提交
1293 1294 1295
/* The whole ATAPI transfer logic is handled in this function */
static void ide_atapi_cmd_reply_end(IDEState *s)
{
1296
    int byte_count_limit, size, ret;
B
bellard 已提交
1297
#ifdef DEBUG_IDE_ATAPI
1298
    printf("reply: tx_size=%d elem_tx_size=%d index=%d\n",
B
bellard 已提交
1299 1300 1301 1302 1303 1304 1305
           s->packet_transfer_size,
           s->elementary_transfer_size,
           s->io_buffer_index);
#endif
    if (s->packet_transfer_size <= 0) {
        /* end of transfer */
        ide_transfer_stop(s);
A
aliguori 已提交
1306
        s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
1307 1308 1309 1310 1311 1312 1313
        s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
        ide_set_irq(s);
#ifdef DEBUG_IDE_ATAPI
        printf("status=0x%x\n", s->status);
#endif
    } else {
        /* see if a new sector must be read */
B
bellard 已提交
1314
        if (s->lba != -1 && s->io_buffer_index >= s->cd_sector_size) {
1315 1316 1317 1318 1319 1320
            ret = cd_read_sector(s->bs, s->lba, s->io_buffer, s->cd_sector_size);
            if (ret < 0) {
                ide_transfer_stop(s);
                ide_atapi_io_error(s, ret);
                return;
            }
B
bellard 已提交
1321 1322 1323 1324 1325 1326
            s->lba++;
            s->io_buffer_index = 0;
        }
        if (s->elementary_transfer_size > 0) {
            /* there are some data left to transmit in this elementary
               transfer */
B
bellard 已提交
1327
            size = s->cd_sector_size - s->io_buffer_index;
B
bellard 已提交
1328 1329
            if (size > s->elementary_transfer_size)
                size = s->elementary_transfer_size;
1330
            ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
B
bellard 已提交
1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350
                               size, ide_atapi_cmd_reply_end);
            s->packet_transfer_size -= size;
            s->elementary_transfer_size -= size;
            s->io_buffer_index += size;
        } else {
            /* a new transfer is needed */
            s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO;
            byte_count_limit = s->lcyl | (s->hcyl << 8);
#ifdef DEBUG_IDE_ATAPI
            printf("byte_count_limit=%d\n", byte_count_limit);
#endif
            if (byte_count_limit == 0xffff)
                byte_count_limit--;
            size = s->packet_transfer_size;
            if (size > byte_count_limit) {
                /* byte count limit must be even if this case */
                if (byte_count_limit & 1)
                    byte_count_limit--;
                size = byte_count_limit;
            }
1351 1352
            s->lcyl = size;
            s->hcyl = size >> 8;
B
bellard 已提交
1353 1354 1355
            s->elementary_transfer_size = size;
            /* we cannot transmit more than one sector at a time */
            if (s->lba != -1) {
B
bellard 已提交
1356 1357
                if (size > (s->cd_sector_size - s->io_buffer_index))
                    size = (s->cd_sector_size - s->io_buffer_index);
B
bellard 已提交
1358
            }
1359
            ide_transfer_start(s, s->io_buffer + s->io_buffer_index,
B
bellard 已提交
1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378
                               size, ide_atapi_cmd_reply_end);
            s->packet_transfer_size -= size;
            s->elementary_transfer_size -= size;
            s->io_buffer_index += size;
            ide_set_irq(s);
#ifdef DEBUG_IDE_ATAPI
            printf("status=0x%x\n", s->status);
#endif
        }
    }
}

/* send a reply of 'size' bytes in s->io_buffer to an ATAPI command */
static void ide_atapi_cmd_reply(IDEState *s, int size, int max_size)
{
    if (size > max_size)
        size = max_size;
    s->lba = -1; /* no sector read */
    s->packet_transfer_size = size;
1379
    s->io_buffer_size = size;    /* dma: send the reply data as one chunk */
B
bellard 已提交
1380 1381 1382
    s->elementary_transfer_size = 0;
    s->io_buffer_index = 0;

1383
    if (s->atapi_dma) {
A
aliguori 已提交
1384
    	s->status = READY_STAT | SEEK_STAT | DRQ_STAT;
1385 1386
	ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
    } else {
A
aliguori 已提交
1387
    	s->status = READY_STAT | SEEK_STAT;
1388 1389
    	ide_atapi_cmd_reply_end(s);
    }
B
bellard 已提交
1390 1391 1392
}

/* start a CD-CDROM read command */
B
bellard 已提交
1393 1394
static void ide_atapi_cmd_read_pio(IDEState *s, int lba, int nb_sectors,
                                   int sector_size)
B
bellard 已提交
1395 1396
{
    s->lba = lba;
B
bellard 已提交
1397
    s->packet_transfer_size = nb_sectors * sector_size;
B
bellard 已提交
1398
    s->elementary_transfer_size = 0;
B
bellard 已提交
1399 1400
    s->io_buffer_index = sector_size;
    s->cd_sector_size = sector_size;
B
bellard 已提交
1401

A
aliguori 已提交
1402
    s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
1403 1404 1405
    ide_atapi_cmd_reply_end(s);
}

B
bellard 已提交
1406
/* ATAPI DMA support */
1407 1408 1409

/* XXX: handle read errors */
static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
B
bellard 已提交
1410
{
1411 1412 1413 1414
    BMDMAState *bm = opaque;
    IDEState *s = bm->ide_if;
    int data_offset, n;

1415 1416 1417 1418 1419
    if (ret < 0) {
        ide_atapi_io_error(s, ret);
        goto eot;
    }

1420
    if (s->io_buffer_size > 0) {
1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436
	/*
	 * For a cdrom read sector command (s->lba != -1),
	 * adjust the lba for the next s->io_buffer_size chunk
	 * and dma the current chunk.
	 * For a command != read (s->lba == -1), just transfer
	 * the reply data.
	 */
	if (s->lba != -1) {
	    if (s->cd_sector_size == 2352) {
		n = 1;
		cd_data_to_raw(s->io_buffer, s->lba);
	    } else {
		n = s->io_buffer_size >> 11;
	    }
	    s->lba += n;
	}
1437 1438 1439
        s->packet_transfer_size -= s->io_buffer_size;
        if (dma_buf_rw(bm, 1) == 0)
            goto eot;
B
bellard 已提交
1440
    }
1441

B
bellard 已提交
1442
    if (s->packet_transfer_size <= 0) {
A
aliguori 已提交
1443
        s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
1444 1445
        s->nsector = (s->nsector & ~7) | ATAPI_INT_REASON_IO | ATAPI_INT_REASON_CD;
        ide_set_irq(s);
1446 1447 1448 1449 1450 1451 1452 1453
    eot:
        bm->status &= ~BM_STATUS_DMAING;
        bm->status |= BM_STATUS_INT;
        bm->dma_cb = NULL;
        bm->ide_if = NULL;
        bm->aiocb = NULL;
        return;
    }
1454

1455 1456 1457 1458 1459 1460 1461
    s->io_buffer_index = 0;
    if (s->cd_sector_size == 2352) {
        n = 1;
        s->io_buffer_size = s->cd_sector_size;
        data_offset = 16;
    } else {
        n = s->packet_transfer_size >> 11;
1462 1463
        if (n > (IDE_DMA_BUF_SECTORS / 4))
            n = (IDE_DMA_BUF_SECTORS / 4);
1464 1465
        s->io_buffer_size = n * 2048;
        data_offset = 0;
B
bellard 已提交
1466
    }
1467 1468 1469
#ifdef DEBUG_AIO
    printf("aio_read_cd: lba=%u n=%d\n", s->lba, n);
#endif
1470 1471
    bm->aiocb = bdrv_aio_read(s->bs, (int64_t)s->lba << 2,
                              s->io_buffer + data_offset, n * 4,
1472
                              ide_atapi_cmd_read_dma_cb, bm);
1473 1474
    if (!bm->aiocb) {
        /* Note: media not present is the most likely case */
1475
        ide_atapi_cmd_error(s, SENSE_NOT_READY,
1476 1477 1478
                            ASC_MEDIUM_NOT_PRESENT);
        goto eot;
    }
B
bellard 已提交
1479 1480 1481 1482 1483 1484 1485 1486 1487
}

/* start a CD-CDROM read command with DMA */
/* XXX: test if DMA is available */
static void ide_atapi_cmd_read_dma(IDEState *s, int lba, int nb_sectors,
                                   int sector_size)
{
    s->lba = lba;
    s->packet_transfer_size = nb_sectors * sector_size;
1488 1489
    s->io_buffer_index = 0;
    s->io_buffer_size = 0;
B
bellard 已提交
1490 1491
    s->cd_sector_size = sector_size;

1492
    /* XXX: check if BUSY_STAT should be set */
A
aliguori 已提交
1493
    s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
B
bellard 已提交
1494 1495 1496
    ide_dma_start(s, ide_atapi_cmd_read_dma_cb);
}

1497
static void ide_atapi_cmd_read(IDEState *s, int lba, int nb_sectors,
B
bellard 已提交
1498 1499 1500
                               int sector_size)
{
#ifdef DEBUG_IDE_ATAPI
1501 1502
    printf("read %s: LBA=%d nb_sectors=%d\n", s->atapi_dma ? "dma" : "pio",
	lba, nb_sectors);
B
bellard 已提交
1503 1504 1505 1506 1507 1508 1509 1510
#endif
    if (s->atapi_dma) {
        ide_atapi_cmd_read_dma(s, lba, nb_sectors, sector_size);
    } else {
        ide_atapi_cmd_read_pio(s, lba, nb_sectors, sector_size);
    }
}

1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526
static inline uint8_t ide_atapi_set_profile(uint8_t *buf, uint8_t *index,
                                            uint16_t profile)
{
    uint8_t *buf_profile = buf + 12; /* start of profiles */

    buf_profile += ((*index) * 4); /* start of indexed profile */
    cpu_to_ube16 (buf_profile, profile);
    buf_profile[2] = ((buf_profile[0] == buf[6]) && (buf_profile[1] == buf[7]));

    /* each profile adds 4 bytes to the response */
    (*index)++;
    buf[11] += 4; /* Additional Length */

    return 4;
}

1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613
static int ide_dvd_read_structure(IDEState *s, int format,
                                  const uint8_t *packet, uint8_t *buf)
{
    switch (format) {
        case 0x0: /* Physical format information */
            {
                int layer = packet[6];
                uint64_t total_sectors;

                if (layer != 0)
                    return -ASC_INV_FIELD_IN_CMD_PACKET;

                bdrv_get_geometry(s->bs, &total_sectors);
                total_sectors >>= 2;
                if (total_sectors == 0)
                    return -ASC_MEDIUM_NOT_PRESENT;

                buf[4] = 1;   /* DVD-ROM, part version 1 */
                buf[5] = 0xf; /* 120mm disc, minimum rate unspecified */
                buf[6] = 1;   /* one layer, read-only (per MMC-2 spec) */
                buf[7] = 0;   /* default densities */

                /* FIXME: 0x30000 per spec? */
                cpu_to_ube32(buf + 8, 0); /* start sector */
                cpu_to_ube32(buf + 12, total_sectors - 1); /* end sector */
                cpu_to_ube32(buf + 16, total_sectors - 1); /* l0 end sector */

                /* Size of buffer, not including 2 byte size field */
                cpu_to_be16wu((uint16_t *)buf, 2048 + 2);

                /* 2k data + 4 byte header */
                return (2048 + 4);
            }

        case 0x01: /* DVD copyright information */
            buf[4] = 0; /* no copyright data */
            buf[5] = 0; /* no region restrictions */

            /* Size of buffer, not including 2 byte size field */
            cpu_to_be16wu((uint16_t *)buf, 4 + 2);

            /* 4 byte header + 4 byte data */
            return (4 + 4);

        case 0x03: /* BCA information - invalid field for no BCA info */
            return -ASC_INV_FIELD_IN_CMD_PACKET;

        case 0x04: /* DVD disc manufacturing information */
            /* Size of buffer, not including 2 byte size field */
            cpu_to_be16wu((uint16_t *)buf, 2048 + 2);

            /* 2k data + 4 byte header */
            return (2048 + 4);

        case 0xff:
            /*
             * This lists all the command capabilities above.  Add new ones
             * in order and update the length and buffer return values.
             */

            buf[4] = 0x00; /* Physical format */
            buf[5] = 0x40; /* Not writable, is readable */
            cpu_to_be16wu((uint16_t *)(buf + 6), 2048 + 4);

            buf[8] = 0x01; /* Copyright info */
            buf[9] = 0x40; /* Not writable, is readable */
            cpu_to_be16wu((uint16_t *)(buf + 10), 4 + 4);

            buf[12] = 0x03; /* BCA info */
            buf[13] = 0x40; /* Not writable, is readable */
            cpu_to_be16wu((uint16_t *)(buf + 14), 188 + 4);

            buf[16] = 0x04; /* Manufacturing info */
            buf[17] = 0x40; /* Not writable, is readable */
            cpu_to_be16wu((uint16_t *)(buf + 18), 2048 + 4);

            /* Size of buffer, not including 2 byte size field */
            cpu_to_be16wu((uint16_t *)buf, 16 + 2);

            /* data written + 4 byte header */
            return (16 + 4);

        default: /* TODO: formats beyond DVD-ROM requires */
            return -ASC_INV_FIELD_IN_CMD_PACKET;
    }
}

B
bellard 已提交
1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631
static void ide_atapi_cmd(IDEState *s)
{
    const uint8_t *packet;
    uint8_t *buf;
    int max_len;

    packet = s->io_buffer;
    buf = s->io_buffer;
#ifdef DEBUG_IDE_ATAPI
    {
        int i;
        printf("ATAPI limit=0x%x packet:", s->lcyl | (s->hcyl << 8));
        for(i = 0; i < ATAPI_PACKET_SIZE; i++) {
            printf(" %02x", packet[i]);
        }
        printf("\n");
    }
#endif
1632 1633 1634 1635 1636 1637 1638 1639
    /* If there's a UNIT_ATTENTION condition pending, only
       REQUEST_SENSE and INQUIRY commands are allowed to complete. */
    if (s->sense_key == SENSE_UNIT_ATTENTION &&
	s->io_buffer[0] != GPCMD_REQUEST_SENSE &&
	s->io_buffer[0] != GPCMD_INQUIRY) {
	ide_atapi_cmd_check_status(s);
	return;
    }
B
bellard 已提交
1640 1641
    switch(s->io_buffer[0]) {
    case GPCMD_TEST_UNIT_READY:
1642
        if (bdrv_is_inserted(s->bs)) {
B
bellard 已提交
1643 1644
            ide_atapi_cmd_ok(s);
        } else {
1645
            ide_atapi_cmd_error(s, SENSE_NOT_READY,
B
bellard 已提交
1646 1647 1648
                                ASC_MEDIUM_NOT_PRESENT);
        }
        break;
1649
    case GPCMD_MODE_SENSE_6:
B
bellard 已提交
1650 1651 1652
    case GPCMD_MODE_SENSE_10:
        {
            int action, code;
1653 1654 1655 1656
            if (packet[0] == GPCMD_MODE_SENSE_10)
                max_len = ube16_to_cpu(packet + 7);
            else
                max_len = packet[4];
B
bellard 已提交
1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691
            action = packet[2] >> 6;
            code = packet[2] & 0x3f;
            switch(action) {
            case 0: /* current values */
                switch(code) {
                case 0x01: /* error recovery */
                    cpu_to_ube16(&buf[0], 16 + 6);
                    buf[2] = 0x70;
                    buf[3] = 0;
                    buf[4] = 0;
                    buf[5] = 0;
                    buf[6] = 0;
                    buf[7] = 0;

                    buf[8] = 0x01;
                    buf[9] = 0x06;
                    buf[10] = 0x00;
                    buf[11] = 0x05;
                    buf[12] = 0x00;
                    buf[13] = 0x00;
                    buf[14] = 0x00;
                    buf[15] = 0x00;
                    ide_atapi_cmd_reply(s, 16, max_len);
                    break;
                case 0x2a:
                    cpu_to_ube16(&buf[0], 28 + 6);
                    buf[2] = 0x70;
                    buf[3] = 0;
                    buf[4] = 0;
                    buf[5] = 0;
                    buf[6] = 0;
                    buf[7] = 0;

                    buf[8] = 0x2a;
                    buf[9] = 0x12;
1692
                    buf[10] = 0x00;
B
bellard 已提交
1693
                    buf[11] = 0x00;
1694

1695 1696 1697
                    /* Claim PLAY_AUDIO capability (0x01) since some Linux
                       code checks for this to automount media. */
                    buf[12] = 0x71;
B
bellard 已提交
1698 1699
                    buf[13] = 3 << 5;
                    buf[14] = (1 << 0) | (1 << 3) | (1 << 5);
1700
                    if (bdrv_is_locked(s->bs))
B
bellard 已提交
1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723
                        buf[6] |= 1 << 1;
                    buf[15] = 0x00;
                    cpu_to_ube16(&buf[16], 706);
                    buf[18] = 0;
                    buf[19] = 2;
                    cpu_to_ube16(&buf[20], 512);
                    cpu_to_ube16(&buf[22], 706);
                    buf[24] = 0;
                    buf[25] = 0;
                    buf[26] = 0;
                    buf[27] = 0;
                    ide_atapi_cmd_reply(s, 28, max_len);
                    break;
                default:
                    goto error_cmd;
                }
                break;
            case 1: /* changeable values */
                goto error_cmd;
            case 2: /* default values */
                goto error_cmd;
            default:
            case 3: /* saved values */
1724
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
B
bellard 已提交
1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736
                                    ASC_SAVING_PARAMETERS_NOT_SUPPORTED);
                break;
            }
        }
        break;
    case GPCMD_REQUEST_SENSE:
        max_len = packet[4];
        memset(buf, 0, 18);
        buf[0] = 0x70 | (1 << 7);
        buf[2] = s->sense_key;
        buf[7] = 10;
        buf[12] = s->asc;
1737 1738
        if (s->sense_key == SENSE_UNIT_ATTENTION)
            s->sense_key = SENSE_NONE;
B
bellard 已提交
1739 1740 1741
        ide_atapi_cmd_reply(s, 18, max_len);
        break;
    case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
1742 1743
        if (bdrv_is_inserted(s->bs)) {
            bdrv_set_locked(s->bs, packet[4] & 1);
B
bellard 已提交
1744 1745
            ide_atapi_cmd_ok(s);
        } else {
1746
            ide_atapi_cmd_error(s, SENSE_NOT_READY,
B
bellard 已提交
1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763
                                ASC_MEDIUM_NOT_PRESENT);
        }
        break;
    case GPCMD_READ_10:
    case GPCMD_READ_12:
        {
            int nb_sectors, lba;

            if (packet[0] == GPCMD_READ_10)
                nb_sectors = ube16_to_cpu(packet + 7);
            else
                nb_sectors = ube32_to_cpu(packet + 6);
            lba = ube32_to_cpu(packet + 2);
            if (nb_sectors == 0) {
                ide_atapi_cmd_ok(s);
                break;
            }
B
bellard 已提交
1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791
            ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
        }
        break;
    case GPCMD_READ_CD:
        {
            int nb_sectors, lba, transfer_request;

            nb_sectors = (packet[6] << 16) | (packet[7] << 8) | packet[8];
            lba = ube32_to_cpu(packet + 2);
            if (nb_sectors == 0) {
                ide_atapi_cmd_ok(s);
                break;
            }
            transfer_request = packet[9];
            switch(transfer_request & 0xf8) {
            case 0x00:
                /* nothing */
                ide_atapi_cmd_ok(s);
                break;
            case 0x10:
                /* normal read */
                ide_atapi_cmd_read(s, lba, nb_sectors, 2048);
                break;
            case 0xf8:
                /* read all data */
                ide_atapi_cmd_read(s, lba, nb_sectors, 2352);
                break;
            default:
1792
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
B
bellard 已提交
1793 1794 1795
                                    ASC_INV_FIELD_IN_CMD_PACKET);
                break;
            }
B
bellard 已提交
1796 1797 1798 1799
        }
        break;
    case GPCMD_SEEK:
        {
1800 1801
            unsigned int lba;
            uint64_t total_sectors;
1802 1803 1804

            bdrv_get_geometry(s->bs, &total_sectors);
            total_sectors >>= 2;
1805
            if (total_sectors == 0) {
1806
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
B
bellard 已提交
1807 1808 1809 1810
                                    ASC_MEDIUM_NOT_PRESENT);
                break;
            }
            lba = ube32_to_cpu(packet + 2);
1811
            if (lba >= total_sectors) {
1812
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
B
bellard 已提交
1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823
                                    ASC_LOGICAL_BLOCK_OOR);
                break;
            }
            ide_atapi_cmd_ok(s);
        }
        break;
    case GPCMD_START_STOP_UNIT:
        {
            int start, eject;
            start = packet[4] & 1;
            eject = (packet[4] >> 1) & 1;
1824

1825 1826
            if (eject && !start) {
                /* eject the disk */
1827 1828 1829 1830
                bdrv_eject(s->bs, 1);
            } else if (eject && start) {
                /* close the tray */
                bdrv_eject(s->bs, 0);
1831
            }
B
bellard 已提交
1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850
            ide_atapi_cmd_ok(s);
        }
        break;
    case GPCMD_MECHANISM_STATUS:
        {
            max_len = ube16_to_cpu(packet + 8);
            cpu_to_ube16(buf, 0);
            /* no current LBA */
            buf[2] = 0;
            buf[3] = 0;
            buf[4] = 0;
            buf[5] = 1;
            cpu_to_ube16(buf + 6, 0);
            ide_atapi_cmd_reply(s, 8, max_len);
        }
        break;
    case GPCMD_READ_TOC_PMA_ATIP:
        {
            int format, msf, start_track, len;
1851
            uint64_t total_sectors;
B
bellard 已提交
1852

1853 1854
            bdrv_get_geometry(s->bs, &total_sectors);
            total_sectors >>= 2;
1855
            if (total_sectors == 0) {
1856
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
B
bellard 已提交
1857 1858 1859 1860 1861 1862 1863 1864 1865
                                    ASC_MEDIUM_NOT_PRESENT);
                break;
            }
            max_len = ube16_to_cpu(packet + 7);
            format = packet[9] >> 6;
            msf = (packet[1] >> 1) & 1;
            start_track = packet[6];
            switch(format) {
            case 0:
1866
                len = cdrom_read_toc(total_sectors, buf, msf, start_track);
B
bellard 已提交
1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878
                if (len < 0)
                    goto error_cmd;
                ide_atapi_cmd_reply(s, len, max_len);
                break;
            case 1:
                /* multi session : only a single session defined */
                memset(buf, 0, 12);
                buf[1] = 0x0a;
                buf[2] = 0x01;
                buf[3] = 0x01;
                ide_atapi_cmd_reply(s, 12, max_len);
                break;
B
bellard 已提交
1879
            case 2:
1880
                len = cdrom_read_toc_raw(total_sectors, buf, msf, start_track);
B
bellard 已提交
1881 1882 1883 1884
                if (len < 0)
                    goto error_cmd;
                ide_atapi_cmd_reply(s, len, max_len);
                break;
B
bellard 已提交
1885
            default:
1886
            error_cmd:
1887
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
1888 1889
                                    ASC_INV_FIELD_IN_CMD_PACKET);
                break;
B
bellard 已提交
1890 1891 1892 1893
            }
        }
        break;
    case GPCMD_READ_CDVD_CAPACITY:
1894
        {
1895
            uint64_t total_sectors;
1896 1897 1898

            bdrv_get_geometry(s->bs, &total_sectors);
            total_sectors >>= 2;
1899
            if (total_sectors == 0) {
1900
                ide_atapi_cmd_error(s, SENSE_NOT_READY,
1901 1902 1903 1904 1905 1906 1907
                                    ASC_MEDIUM_NOT_PRESENT);
                break;
            }
            /* NOTE: it is really the number of sectors minus 1 */
            cpu_to_ube32(buf, total_sectors - 1);
            cpu_to_ube32(buf + 4, 2048);
            ide_atapi_cmd_reply(s, 8, 8);
B
bellard 已提交
1908 1909
        }
        break;
1910 1911 1912
    case GPCMD_READ_DVD_STRUCTURE:
        {
            int media = packet[1];
1913 1914
            int format = packet[7];
            int ret;
1915

1916
            max_len = ube16_to_cpu(packet + 8);
1917

1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928
            if (format < 0xff) {
                if (media_is_cd(s)) {
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
                                        ASC_INCOMPATIBLE_FORMAT);
                    break;
                } else if (!media_present(s)) {
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
                                        ASC_INV_FIELD_IN_CMD_PACKET);
                    break;
                }
            }
1929

1930 1931
            memset(buf, 0, max_len > IDE_DMA_BUF_SECTORS * 512 + 4 ?
                   IDE_DMA_BUF_SECTORS * 512 + 4 : max_len);
1932

1933 1934 1935 1936 1937
            switch (format) {
                case 0x00 ... 0x7f:
                case 0xff:
                    if (media == 0) {
                        ret = ide_dvd_read_structure(s, format, packet, buf);
1938

1939 1940 1941 1942
                        if (ret < 0)
                            ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST, -ret);
                        else
                            ide_atapi_cmd_reply(s, ret, max_len);
1943

1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954
                        break;
                    }
                    /* TODO: BD support, fall through for now */

                /* Generic disk structures */
                case 0x80: /* TODO: AACS volume identifier */
                case 0x81: /* TODO: AACS media serial number */
                case 0x82: /* TODO: AACS media identifier */
                case 0x83: /* TODO: AACS media key block */
                case 0x90: /* TODO: List of recognized format layers */
                case 0xc0: /* TODO: Write protection status */
1955 1956 1957 1958 1959 1960 1961 1962 1963 1964
                default:
                    ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
                                        ASC_INV_FIELD_IN_CMD_PACKET);
                    break;
            }
        }
        break;
    case GPCMD_SET_SPEED:
        ide_atapi_cmd_ok(s);
        break;
B
bellard 已提交
1965 1966 1967 1968 1969 1970
    case GPCMD_INQUIRY:
        max_len = packet[4];
        buf[0] = 0x05; /* CD-ROM */
        buf[1] = 0x80; /* removable */
        buf[2] = 0x00; /* ISO */
        buf[3] = 0x21; /* ATAPI-2 (XXX: put ATAPI-4 ?) */
T
ths 已提交
1971
        buf[4] = 31; /* additional length */
B
bellard 已提交
1972 1973 1974 1975
        buf[5] = 0; /* reserved */
        buf[6] = 0; /* reserved */
        buf[7] = 0; /* reserved */
        padstr8(buf + 8, 8, "QEMU");
1976
        padstr8(buf + 16, 16, "QEMU DVD-ROM");
B
bellard 已提交
1977 1978 1979
        padstr8(buf + 32, 4, QEMU_VERSION);
        ide_atapi_cmd_reply(s, 36, max_len);
        break;
1980 1981
    case GPCMD_GET_CONFIGURATION:
        {
1982
            uint32_t len;
1983
            uint8_t index = 0;
1984 1985 1986 1987 1988 1989 1990

            /* only feature 0 is supported */
            if (packet[2] != 0 || packet[3] != 0) {
                ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
                                    ASC_INV_FIELD_IN_CMD_PACKET);
                break;
            }
1991 1992 1993

            /* XXX: could result in alignment problems in some architectures */
            max_len = ube16_to_cpu(packet + 7);
1994

1995
            /*
1996 1997 1998
             * XXX: avoid overflow for io_buffer if max_len is bigger than
             *      the size of that buffer (dimensioned to max number of
             *      sectors to transfer at once)
1999
             *
2000
             *      Only a problem if the feature/profiles grow.
2001 2002 2003 2004 2005 2006 2007 2008 2009
             */
            if (max_len > 512) /* XXX: assume 1 sector */
                max_len = 512;

            memset(buf, 0, max_len);
            /* 
             * the number of sectors from the media tells us which profile
             * to use as current.  0 means there is no media
             */
2010 2011 2012 2013
            if (media_is_dvd(s))
                cpu_to_ube16(buf + 6, MMC_PROFILE_DVD_ROM);
            else if (media_is_cd(s))
                cpu_to_ube16(buf + 6, MMC_PROFILE_CD_ROM);
2014

2015 2016 2017 2018
            buf[10] = 0x02 | 0x01; /* persistent and current */
            len = 12; /* headers: 8 + 4 */
            len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_DVD_ROM);
            len += ide_atapi_set_profile(buf, &index, MMC_PROFILE_CD_ROM);
2019 2020 2021
            cpu_to_ube32(buf, len - 4); /* data length */

            ide_atapi_cmd_reply(s, len, max_len);
2022 2023
            break;
        }
B
bellard 已提交
2024
    default:
2025
        ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST,
2026
                            ASC_ILLEGAL_OPCODE);
B
bellard 已提交
2027 2028 2029 2030
        break;
    }
}

2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083
static void ide_cfata_metadata_inquiry(IDEState *s)
{
    uint16_t *p;
    uint32_t spd;

    p = (uint16_t *) s->io_buffer;
    memset(p, 0, 0x200);
    spd = ((s->mdata_size - 1) >> 9) + 1;

    put_le16(p + 0, 0x0001);			/* Data format revision */
    put_le16(p + 1, 0x0000);			/* Media property: silicon */
    put_le16(p + 2, s->media_changed);		/* Media status */
    put_le16(p + 3, s->mdata_size & 0xffff);	/* Capacity in bytes (low) */
    put_le16(p + 4, s->mdata_size >> 16);	/* Capacity in bytes (high) */
    put_le16(p + 5, spd & 0xffff);		/* Sectors per device (low) */
    put_le16(p + 6, spd >> 16);			/* Sectors per device (high) */
}

static void ide_cfata_metadata_read(IDEState *s)
{
    uint16_t *p;

    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
        s->status = ERR_STAT;
        s->error = ABRT_ERR;
        return;
    }

    p = (uint16_t *) s->io_buffer;
    memset(p, 0, 0x200);

    put_le16(p + 0, s->media_changed);		/* Media status */
    memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
                                    s->nsector << 9), 0x200 - 2));
}

static void ide_cfata_metadata_write(IDEState *s)
{
    if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
        s->status = ERR_STAT;
        s->error = ABRT_ERR;
        return;
    }

    s->media_changed = 0;

    memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
                    s->io_buffer + 2,
                    MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
                                    s->nsector << 9), 0x200 - 2));
}

2084 2085 2086 2087
/* called when the inserted state of the media has changed */
static void cdrom_change_cb(void *opaque)
{
    IDEState *s = opaque;
2088
    uint64_t nb_sectors;
2089 2090 2091

    bdrv_get_geometry(s->bs, &nb_sectors);
    s->nb_sectors = nb_sectors;
2092 2093 2094 2095 2096

    s->sense_key = SENSE_UNIT_ATTENTION;
    s->asc = ASC_MEDIUM_MAY_HAVE_CHANGED;

    ide_set_irq(s);
2097 2098
}

B
bellard 已提交
2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128
static void ide_cmd_lba48_transform(IDEState *s, int lba48)
{
    s->lba48 = lba48;

    /* handle the 'magic' 0 nsector count conversion here. to avoid
     * fiddling with the rest of the read logic, we just store the
     * full sector count in ->nsector and ignore ->hob_nsector from now
     */
    if (!s->lba48) {
	if (!s->nsector)
	    s->nsector = 256;
    } else {
	if (!s->nsector && !s->hob_nsector)
	    s->nsector = 65536;
	else {
	    int lo = s->nsector;
	    int hi = s->hob_nsector;

	    s->nsector = (hi << 8) | lo;
	}
    }
}

static void ide_clear_hob(IDEState *ide_if)
{
    /* any write clears HOB high bit of device control register */
    ide_if[0].select &= ~(1 << 7);
    ide_if[1].select &= ~(1 << 7);
}

2129 2130 2131
static void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
{
    IDEState *ide_if = opaque;
2132
    IDEState *s;
B
bellard 已提交
2133
    int unit, n;
B
bellard 已提交
2134
    int lba48 = 0;
B
bellard 已提交
2135 2136 2137 2138

#ifdef DEBUG_IDE
    printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
#endif
B
bellard 已提交
2139

B
bellard 已提交
2140
    addr &= 7;
2141 2142 2143 2144 2145

    /* ignore writes to command block while busy with previous command */
    if (addr != 7 && (ide_if->cur_drive->status & (BUSY_STAT|DRQ_STAT)))
        return;

B
bellard 已提交
2146 2147 2148 2149
    switch(addr) {
    case 0:
        break;
    case 1:
B
bellard 已提交
2150
	ide_clear_hob(ide_if);
2151
        /* NOTE: data is written to the two drives */
B
bellard 已提交
2152 2153
	ide_if[0].hob_feature = ide_if[0].feature;
	ide_if[1].hob_feature = ide_if[1].feature;
2154 2155
        ide_if[0].feature = val;
        ide_if[1].feature = val;
B
bellard 已提交
2156 2157
        break;
    case 2:
B
bellard 已提交
2158 2159 2160
	ide_clear_hob(ide_if);
	ide_if[0].hob_nsector = ide_if[0].nsector;
	ide_if[1].hob_nsector = ide_if[1].nsector;
2161 2162
        ide_if[0].nsector = val;
        ide_if[1].nsector = val;
B
bellard 已提交
2163 2164
        break;
    case 3:
B
bellard 已提交
2165 2166 2167
	ide_clear_hob(ide_if);
	ide_if[0].hob_sector = ide_if[0].sector;
	ide_if[1].hob_sector = ide_if[1].sector;
2168 2169
        ide_if[0].sector = val;
        ide_if[1].sector = val;
B
bellard 已提交
2170 2171
        break;
    case 4:
B
bellard 已提交
2172 2173 2174
	ide_clear_hob(ide_if);
	ide_if[0].hob_lcyl = ide_if[0].lcyl;
	ide_if[1].hob_lcyl = ide_if[1].lcyl;
2175 2176
        ide_if[0].lcyl = val;
        ide_if[1].lcyl = val;
B
bellard 已提交
2177 2178
        break;
    case 5:
B
bellard 已提交
2179 2180 2181
	ide_clear_hob(ide_if);
	ide_if[0].hob_hcyl = ide_if[0].hcyl;
	ide_if[1].hob_hcyl = ide_if[1].hcyl;
2182 2183
        ide_if[0].hcyl = val;
        ide_if[1].hcyl = val;
B
bellard 已提交
2184 2185
        break;
    case 6:
B
bellard 已提交
2186
	/* FIXME: HOB readback uses bit 7 */
B
bellard 已提交
2187 2188
        ide_if[0].select = (val & ~0x10) | 0xa0;
        ide_if[1].select = (val | 0x10) | 0xa0;
B
bellard 已提交
2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199
        /* select drive */
        unit = (val >> 4) & 1;
        s = ide_if + unit;
        ide_if->cur_drive = s;
        break;
    default:
    case 7:
        /* command */
#if defined(DEBUG_IDE)
        printf("ide: CMD=%02x\n", val);
#endif
2200
        s = ide_if->cur_drive;
2201
        /* ignore commands to non existant slave */
2202
        if (s != ide_if && !s->bs)
2203
            break;
B
bellard 已提交
2204

2205 2206 2207 2208
        /* Only DEVICE RESET is allowed while BSY or/and DRQ are set */
        if ((s->status & (BUSY_STAT|DRQ_STAT)) && val != WIN_DEVICE_RESET)
            break;

B
bellard 已提交
2209 2210 2211
        switch(val) {
        case WIN_IDENTIFY:
            if (s->bs && !s->is_cdrom) {
2212 2213 2214 2215
                if (!s->is_cf)
                    ide_identify(s);
                else
                    ide_cfata_identify(s);
2216
                s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227
                ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
            } else {
                if (s->is_cdrom) {
                    ide_set_signature(s);
                }
                ide_abort_command(s);
            }
            ide_set_irq(s);
            break;
        case WIN_SPECIFY:
        case WIN_RECAL:
2228
            s->error = 0;
B
bellard 已提交
2229
            s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2230 2231 2232
            ide_set_irq(s);
            break;
        case WIN_SETMULT:
2233 2234 2235
            if (s->is_cf && s->nsector == 0) {
                /* Disable Read and Write Multiple */
                s->mult_sectors = 0;
A
aliguori 已提交
2236
                s->status = READY_STAT | SEEK_STAT;
2237
            } else if ((s->nsector & 0xff) != 0 &&
2238 2239
                ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
                 (s->nsector & (s->nsector - 1)) != 0)) {
B
bellard 已提交
2240 2241
                ide_abort_command(s);
            } else {
2242
                s->mult_sectors = s->nsector & 0xff;
A
aliguori 已提交
2243
                s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2244 2245 2246
            }
            ide_set_irq(s);
            break;
B
bellard 已提交
2247 2248
        case WIN_VERIFY_EXT:
	    lba48 = 1;
B
bellard 已提交
2249 2250 2251
        case WIN_VERIFY:
        case WIN_VERIFY_ONCE:
            /* do sector number check ? */
B
bellard 已提交
2252
	    ide_cmd_lba48_transform(s, lba48);
A
aliguori 已提交
2253
            s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2254 2255
            ide_set_irq(s);
            break;
B
bellard 已提交
2256 2257
	case WIN_READ_EXT:
	    lba48 = 1;
B
bellard 已提交
2258 2259
        case WIN_READ:
        case WIN_READ_ONCE:
2260
            if (!s->bs)
B
bellard 已提交
2261
                goto abort_cmd;
B
bellard 已提交
2262
	    ide_cmd_lba48_transform(s, lba48);
B
bellard 已提交
2263 2264 2265
            s->req_nb_sectors = 1;
            ide_sector_read(s);
            break;
B
bellard 已提交
2266 2267
	case WIN_WRITE_EXT:
	    lba48 = 1;
B
bellard 已提交
2268 2269
        case WIN_WRITE:
        case WIN_WRITE_ONCE:
2270 2271
        case CFA_WRITE_SECT_WO_ERASE:
        case WIN_WRITE_VERIFY:
B
bellard 已提交
2272
	    ide_cmd_lba48_transform(s, lba48);
2273
            s->error = 0;
2274
            s->status = SEEK_STAT | READY_STAT;
B
bellard 已提交
2275 2276
            s->req_nb_sectors = 1;
            ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
2277
            s->media_changed = 1;
B
bellard 已提交
2278
            break;
B
bellard 已提交
2279 2280
	case WIN_MULTREAD_EXT:
	    lba48 = 1;
B
bellard 已提交
2281 2282 2283
        case WIN_MULTREAD:
            if (!s->mult_sectors)
                goto abort_cmd;
B
bellard 已提交
2284
	    ide_cmd_lba48_transform(s, lba48);
B
bellard 已提交
2285 2286 2287
            s->req_nb_sectors = s->mult_sectors;
            ide_sector_read(s);
            break;
B
bellard 已提交
2288 2289
        case WIN_MULTWRITE_EXT:
	    lba48 = 1;
B
bellard 已提交
2290
        case WIN_MULTWRITE:
2291
        case CFA_WRITE_MULTI_WO_ERASE:
B
bellard 已提交
2292 2293
            if (!s->mult_sectors)
                goto abort_cmd;
B
bellard 已提交
2294
	    ide_cmd_lba48_transform(s, lba48);
2295
            s->error = 0;
2296
            s->status = SEEK_STAT | READY_STAT;
B
bellard 已提交
2297 2298 2299 2300 2301
            s->req_nb_sectors = s->mult_sectors;
            n = s->nsector;
            if (n > s->req_nb_sectors)
                n = s->req_nb_sectors;
            ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
2302
            s->media_changed = 1;
B
bellard 已提交
2303
            break;
B
bellard 已提交
2304 2305
	case WIN_READDMA_EXT:
	    lba48 = 1;
B
bellard 已提交
2306 2307
        case WIN_READDMA:
        case WIN_READDMA_ONCE:
2308
            if (!s->bs)
B
bellard 已提交
2309
                goto abort_cmd;
B
bellard 已提交
2310
	    ide_cmd_lba48_transform(s, lba48);
B
bellard 已提交
2311 2312
            ide_sector_read_dma(s);
            break;
B
bellard 已提交
2313 2314
	case WIN_WRITEDMA_EXT:
	    lba48 = 1;
B
bellard 已提交
2315 2316
        case WIN_WRITEDMA:
        case WIN_WRITEDMA_ONCE:
2317
            if (!s->bs)
B
bellard 已提交
2318
                goto abort_cmd;
B
bellard 已提交
2319
	    ide_cmd_lba48_transform(s, lba48);
B
bellard 已提交
2320
            ide_sector_write_dma(s);
2321
            s->media_changed = 1;
B
bellard 已提交
2322
            break;
B
bellard 已提交
2323 2324
        case WIN_READ_NATIVE_MAX_EXT:
	    lba48 = 1;
B
bellard 已提交
2325
        case WIN_READ_NATIVE_MAX:
B
bellard 已提交
2326
	    ide_cmd_lba48_transform(s, lba48);
B
bellard 已提交
2327
            ide_set_sector(s, s->nb_sectors - 1);
A
aliguori 已提交
2328
            s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2329 2330
            ide_set_irq(s);
            break;
2331
        case WIN_CHECKPOWERMODE1:
2332
        case WIN_CHECKPOWERMODE2:
2333
            s->nsector = 0xff; /* device active or idle */
A
aliguori 已提交
2334
            s->status = READY_STAT | SEEK_STAT;
2335 2336
            ide_set_irq(s);
            break;
2337 2338 2339 2340 2341
        case WIN_SETFEATURES:
            if (!s->bs)
                goto abort_cmd;
            /* XXX: valid for CDROM ? */
            switch(s->feature) {
2342 2343
            case 0xcc: /* reverting to power-on defaults enable */
            case 0x66: /* reverting to power-on defaults disable */
2344 2345 2346 2347
            case 0x02: /* write cache enable */
            case 0x82: /* write cache disable */
            case 0xaa: /* read look-ahead enable */
            case 0x55: /* read look-ahead disable */
2348 2349 2350 2351 2352 2353
            case 0x05: /* set advanced power management mode */
            case 0x85: /* disable advanced power management mode */
            case 0x69: /* NOP */
            case 0x67: /* NOP */
            case 0x96: /* NOP */
            case 0x9a: /* NOP */
2354 2355
            case 0x42: /* enable Automatic Acoustic Mode */
            case 0xc2: /* disable Automatic Acoustic Mode */
B
bellard 已提交
2356
                s->status = READY_STAT | SEEK_STAT;
2357 2358
                ide_set_irq(s);
                break;
2359 2360 2361 2362 2363 2364
            case 0x03: { /* set transfer mode */
		uint8_t val = s->nsector & 0x07;

		switch (s->nsector >> 3) {
		    case 0x00: /* pio default */
		    case 0x01: /* pio mode */
2365 2366 2367 2368 2369 2370
			put_le16(s->identify_data + 62,0x07);
			put_le16(s->identify_data + 63,0x07);
			put_le16(s->identify_data + 88,0x3f);
			break;
                    case 0x02: /* sigle word dma mode*/
			put_le16(s->identify_data + 62,0x07 | (1 << (val + 8)));
2371 2372 2373 2374
			put_le16(s->identify_data + 63,0x07);
			put_le16(s->identify_data + 88,0x3f);
			break;
		    case 0x04: /* mdma mode */
2375
			put_le16(s->identify_data + 62,0x07);
2376 2377 2378 2379
			put_le16(s->identify_data + 63,0x07 | (1 << (val + 8)));
			put_le16(s->identify_data + 88,0x3f);
			break;
		    case 0x08: /* udma mode */
2380
			put_le16(s->identify_data + 62,0x07);
2381 2382 2383 2384 2385 2386 2387 2388 2389 2390
			put_le16(s->identify_data + 63,0x07);
			put_le16(s->identify_data + 88,0x3f | (1 << (val + 8)));
			break;
		    default:
			goto abort_cmd;
		}
                s->status = READY_STAT | SEEK_STAT;
                ide_set_irq(s);
                break;
	    }
2391 2392 2393 2394
            default:
                goto abort_cmd;
            }
            break;
B
bellard 已提交
2395 2396
        case WIN_FLUSH_CACHE:
        case WIN_FLUSH_CACHE_EXT:
P
pbrook 已提交
2397 2398
            if (s->bs)
                bdrv_flush(s->bs);
A
aliguori 已提交
2399
	    s->status = READY_STAT | SEEK_STAT;
P
pbrook 已提交
2400 2401
            ide_set_irq(s);
            break;
2402 2403 2404
        case WIN_STANDBY:
        case WIN_STANDBY2:
        case WIN_STANDBYNOW1:
2405
        case WIN_STANDBYNOW2:
2406
        case WIN_IDLEIMMEDIATE:
2407 2408 2409
        case CFA_IDLEIMMEDIATE:
        case WIN_SETIDLE1:
        case WIN_SETIDLE2:
2410 2411 2412
        case WIN_SLEEPNOW1:
        case WIN_SLEEPNOW2:
            s->status = READY_STAT;
2413 2414
            ide_set_irq(s);
            break;
A
aurel32 已提交
2415 2416 2417 2418 2419 2420 2421
        case WIN_SEEK:
            if(s->is_cdrom)
                goto abort_cmd;
            /* XXX: Check that seek is within bounds */
            s->status = READY_STAT | SEEK_STAT;
            ide_set_irq(s);
            break;
B
bellard 已提交
2422 2423 2424 2425
            /* ATAPI commands */
        case WIN_PIDENTIFY:
            if (s->is_cdrom) {
                ide_atapi_identify(s);
B
bellard 已提交
2426
                s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2427 2428 2429 2430 2431 2432
                ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
            } else {
                ide_abort_command(s);
            }
            ide_set_irq(s);
            break;
2433 2434
        case WIN_DIAGNOSE:
            ide_set_signature(s);
2435 2436 2437 2438 2439 2440 2441 2442 2443
            if (s->is_cdrom)
                s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
                                * devices to return a clear status register
                                * with READY_STAT *not* set. */
            else
                s->status = READY_STAT | SEEK_STAT;
            s->error = 0x01; /* Device 0 passed, Device 1 passed or not
                              * present. 
                              */
2444
            ide_set_irq(s);
2445
            break;
B
bellard 已提交
2446 2447 2448 2449
        case WIN_SRST:
            if (!s->is_cdrom)
                goto abort_cmd;
            ide_set_signature(s);
B
bellard 已提交
2450
            s->status = 0x00; /* NOTE: READY is _not_ set */
B
bellard 已提交
2451 2452 2453 2454 2455
            s->error = 0x01;
            break;
        case WIN_PACKETCMD:
            if (!s->is_cdrom)
                goto abort_cmd;
B
bellard 已提交
2456 2457
            /* overlapping commands not supported */
            if (s->feature & 0x02)
B
bellard 已提交
2458
                goto abort_cmd;
A
aliguori 已提交
2459
            s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2460
            s->atapi_dma = s->feature & 1;
B
bellard 已提交
2461
            s->nsector = 1;
2462
            ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
B
bellard 已提交
2463 2464
                               ide_atapi_cmd);
            break;
2465 2466 2467 2468 2469
        /* CF-ATA commands */
        case CFA_REQ_EXT_ERROR_CODE:
            if (!s->is_cf)
                goto abort_cmd;
            s->error = 0x09;    /* miscellaneous error */
A
aliguori 已提交
2470
            s->status = READY_STAT | SEEK_STAT;
2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481
            ide_set_irq(s);
            break;
        case CFA_ERASE_SECTORS:
        case CFA_WEAR_LEVEL:
            if (!s->is_cf)
                goto abort_cmd;
            if (val == CFA_WEAR_LEVEL)
                s->nsector = 0;
            if (val == CFA_ERASE_SECTORS)
                s->media_changed = 1;
            s->error = 0x00;
A
aliguori 已提交
2482
            s->status = READY_STAT | SEEK_STAT;
2483 2484 2485 2486 2487 2488
            ide_set_irq(s);
            break;
        case CFA_TRANSLATE_SECTOR:
            if (!s->is_cf)
                goto abort_cmd;
            s->error = 0x00;
A
aliguori 已提交
2489
            s->status = READY_STAT | SEEK_STAT;
2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534
            memset(s->io_buffer, 0, 0x200);
            s->io_buffer[0x00] = s->hcyl;			/* Cyl MSB */
            s->io_buffer[0x01] = s->lcyl;			/* Cyl LSB */
            s->io_buffer[0x02] = s->select;			/* Head */
            s->io_buffer[0x03] = s->sector;			/* Sector */
            s->io_buffer[0x04] = ide_get_sector(s) >> 16;	/* LBA MSB */
            s->io_buffer[0x05] = ide_get_sector(s) >> 8;	/* LBA */
            s->io_buffer[0x06] = ide_get_sector(s) >> 0;	/* LBA LSB */
            s->io_buffer[0x13] = 0x00;				/* Erase flag */
            s->io_buffer[0x18] = 0x00;				/* Hot count */
            s->io_buffer[0x19] = 0x00;				/* Hot count */
            s->io_buffer[0x1a] = 0x01;				/* Hot count */
            ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
            ide_set_irq(s);
            break;
        case CFA_ACCESS_METADATA_STORAGE:
            if (!s->is_cf)
                goto abort_cmd;
            switch (s->feature) {
            case 0x02:	/* Inquiry Metadata Storage */
                ide_cfata_metadata_inquiry(s);
                break;
            case 0x03:	/* Read Metadata Storage */
                ide_cfata_metadata_read(s);
                break;
            case 0x04:	/* Write Metadata Storage */
                ide_cfata_metadata_write(s);
                break;
            default:
                goto abort_cmd;
            }
            ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
            s->status = 0x00; /* NOTE: READY is _not_ set */
            ide_set_irq(s);
            break;
        case IBM_SENSE_CONDITION:
            if (!s->is_cf)
                goto abort_cmd;
            switch (s->feature) {
            case 0x01:  /* sense temperature in device */
                s->nsector = 0x50;      /* +20 C */
                break;
            default:
                goto abort_cmd;
            }
A
aliguori 已提交
2535
            s->status = READY_STAT | SEEK_STAT;
2536 2537
            ide_set_irq(s);
            break;
B
bellard 已提交
2538 2539 2540 2541 2542 2543 2544 2545 2546
        default:
        abort_cmd:
            ide_abort_command(s);
            ide_set_irq(s);
            break;
        }
    }
}

2547
static uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
B
bellard 已提交
2548
{
B
bellard 已提交
2549 2550
    IDEState *ide_if = opaque;
    IDEState *s = ide_if->cur_drive;
B
bellard 已提交
2551
    uint32_t addr;
B
bellard 已提交
2552
    int ret, hob;
B
bellard 已提交
2553 2554

    addr = addr1 & 7;
B
bellard 已提交
2555 2556 2557
    /* FIXME: HOB readback uses bit 7, but it's always set right now */
    //hob = s->select & (1 << 7);
    hob = 0;
B
bellard 已提交
2558 2559 2560 2561 2562
    switch(addr) {
    case 0:
        ret = 0xff;
        break;
    case 1:
2563 2564
        if ((!ide_if[0].bs && !ide_if[1].bs) ||
            (s != ide_if && !s->bs))
2565
            ret = 0;
B
bellard 已提交
2566
        else if (!hob)
2567
            ret = s->error;
B
bellard 已提交
2568 2569
	else
	    ret = s->hob_feature;
B
bellard 已提交
2570 2571
        break;
    case 2:
B
bellard 已提交
2572
        if (!ide_if[0].bs && !ide_if[1].bs)
2573
            ret = 0;
B
bellard 已提交
2574
        else if (!hob)
2575
            ret = s->nsector & 0xff;
B
bellard 已提交
2576 2577
	else
	    ret = s->hob_nsector;
B
bellard 已提交
2578 2579
        break;
    case 3:
B
bellard 已提交
2580
        if (!ide_if[0].bs && !ide_if[1].bs)
2581
            ret = 0;
B
bellard 已提交
2582
        else if (!hob)
2583
            ret = s->sector;
B
bellard 已提交
2584 2585
	else
	    ret = s->hob_sector;
B
bellard 已提交
2586 2587
        break;
    case 4:
B
bellard 已提交
2588
        if (!ide_if[0].bs && !ide_if[1].bs)
2589
            ret = 0;
B
bellard 已提交
2590
        else if (!hob)
2591
            ret = s->lcyl;
B
bellard 已提交
2592 2593
	else
	    ret = s->hob_lcyl;
B
bellard 已提交
2594 2595
        break;
    case 5:
B
bellard 已提交
2596
        if (!ide_if[0].bs && !ide_if[1].bs)
2597
            ret = 0;
B
bellard 已提交
2598
        else if (!hob)
2599
            ret = s->hcyl;
B
bellard 已提交
2600 2601
	else
	    ret = s->hob_hcyl;
B
bellard 已提交
2602 2603
        break;
    case 6:
B
bellard 已提交
2604
        if (!ide_if[0].bs && !ide_if[1].bs)
2605 2606
            ret = 0;
        else
B
bellard 已提交
2607
            ret = s->select;
B
bellard 已提交
2608 2609 2610
        break;
    default:
    case 7:
2611 2612
        if ((!ide_if[0].bs && !ide_if[1].bs) ||
            (s != ide_if && !s->bs))
2613 2614 2615
            ret = 0;
        else
            ret = s->status;
P
pbrook 已提交
2616
        qemu_irq_lower(s->irq);
B
bellard 已提交
2617 2618 2619 2620 2621 2622 2623 2624
        break;
    }
#ifdef DEBUG_IDE
    printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
#endif
    return ret;
}

2625
static uint32_t ide_status_read(void *opaque, uint32_t addr)
B
bellard 已提交
2626
{
B
bellard 已提交
2627 2628
    IDEState *ide_if = opaque;
    IDEState *s = ide_if->cur_drive;
B
bellard 已提交
2629
    int ret;
B
bellard 已提交
2630

2631 2632
    if ((!ide_if[0].bs && !ide_if[1].bs) ||
        (s != ide_if && !s->bs))
B
bellard 已提交
2633 2634 2635
        ret = 0;
    else
        ret = s->status;
B
bellard 已提交
2636 2637 2638 2639 2640 2641
#ifdef DEBUG_IDE
    printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
#endif
    return ret;
}

2642
static void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
B
bellard 已提交
2643
{
2644
    IDEState *ide_if = opaque;
B
bellard 已提交
2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664
    IDEState *s;
    int i;

#ifdef DEBUG_IDE
    printf("ide: write control addr=0x%x val=%02x\n", addr, val);
#endif
    /* common for both drives */
    if (!(ide_if[0].cmd & IDE_CMD_RESET) &&
        (val & IDE_CMD_RESET)) {
        /* reset low to high */
        for(i = 0;i < 2; i++) {
            s = &ide_if[i];
            s->status = BUSY_STAT | SEEK_STAT;
            s->error = 0x01;
        }
    } else if ((ide_if[0].cmd & IDE_CMD_RESET) &&
               !(val & IDE_CMD_RESET)) {
        /* high to low */
        for(i = 0;i < 2; i++) {
            s = &ide_if[i];
B
bellard 已提交
2665 2666 2667
            if (s->is_cdrom)
                s->status = 0x00; /* NOTE: READY is _not_ set */
            else
2668
                s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2669 2670 2671 2672 2673 2674 2675 2676
            ide_set_signature(s);
        }
    }

    ide_if[0].cmd = val;
    ide_if[1].cmd = val;
}

2677
static void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
B
bellard 已提交
2678
{
2679
    IDEState *s = ((IDEState *)opaque)->cur_drive;
B
bellard 已提交
2680 2681
    uint8_t *p;

2682 2683 2684 2685
    /* PIO data access allowed only when DRQ bit is set */
    if (!(s->status & DRQ_STAT))
        return;

B
bellard 已提交
2686
    p = s->data_ptr;
B
bellard 已提交
2687
    *(uint16_t *)p = le16_to_cpu(val);
B
bellard 已提交
2688 2689 2690 2691 2692 2693
    p += 2;
    s->data_ptr = p;
    if (p >= s->data_end)
        s->end_transfer_func(s);
}

2694
static uint32_t ide_data_readw(void *opaque, uint32_t addr)
B
bellard 已提交
2695
{
2696
    IDEState *s = ((IDEState *)opaque)->cur_drive;
B
bellard 已提交
2697 2698
    uint8_t *p;
    int ret;
2699 2700 2701 2702 2703

    /* PIO data access allowed only when DRQ bit is set */
    if (!(s->status & DRQ_STAT))
        return 0;

B
bellard 已提交
2704
    p = s->data_ptr;
B
bellard 已提交
2705
    ret = cpu_to_le16(*(uint16_t *)p);
B
bellard 已提交
2706 2707 2708 2709 2710 2711 2712
    p += 2;
    s->data_ptr = p;
    if (p >= s->data_end)
        s->end_transfer_func(s);
    return ret;
}

2713
static void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
B
bellard 已提交
2714
{
2715
    IDEState *s = ((IDEState *)opaque)->cur_drive;
B
bellard 已提交
2716 2717
    uint8_t *p;

2718 2719 2720 2721
    /* PIO data access allowed only when DRQ bit is set */
    if (!(s->status & DRQ_STAT))
        return;

B
bellard 已提交
2722
    p = s->data_ptr;
B
bellard 已提交
2723
    *(uint32_t *)p = le32_to_cpu(val);
B
bellard 已提交
2724 2725 2726 2727 2728 2729
    p += 4;
    s->data_ptr = p;
    if (p >= s->data_end)
        s->end_transfer_func(s);
}

2730
static uint32_t ide_data_readl(void *opaque, uint32_t addr)
B
bellard 已提交
2731
{
2732
    IDEState *s = ((IDEState *)opaque)->cur_drive;
B
bellard 已提交
2733 2734
    uint8_t *p;
    int ret;
2735

2736 2737 2738 2739
    /* PIO data access allowed only when DRQ bit is set */
    if (!(s->status & DRQ_STAT))
        return 0;

B
bellard 已提交
2740
    p = s->data_ptr;
B
bellard 已提交
2741
    ret = cpu_to_le32(*(uint32_t *)p);
B
bellard 已提交
2742 2743 2744 2745 2746 2747 2748
    p += 4;
    s->data_ptr = p;
    if (p >= s->data_end)
        s->end_transfer_func(s);
    return ret;
}

2749 2750 2751 2752 2753 2754 2755 2756 2757 2758
static void ide_dummy_transfer_stop(IDEState *s)
{
    s->data_ptr = s->io_buffer;
    s->data_end = s->io_buffer;
    s->io_buffer[0] = 0xff;
    s->io_buffer[1] = 0xff;
    s->io_buffer[2] = 0xff;
    s->io_buffer[3] = 0xff;
}

B
bellard 已提交
2759 2760
static void ide_reset(IDEState *s)
{
2761 2762 2763 2764
    if (s->is_cf)
        s->mult_sectors = 0;
    else
        s->mult_sectors = MAX_MULT_SECTORS;
B
bellard 已提交
2765 2766
    s->cur_drive = s;
    s->select = 0xa0;
A
aliguori 已提交
2767
    s->status = READY_STAT | SEEK_STAT;
B
bellard 已提交
2768
    ide_set_signature(s);
2769 2770 2771 2772
    /* init the transfer handler so that 0xffff is returned on data
       accesses */
    s->end_transfer_func = ide_dummy_transfer_stop;
    ide_dummy_transfer_stop(s);
2773
    s->media_changed = 0;
B
bellard 已提交
2774 2775
}

2776 2777
static void ide_init2(IDEState *ide_state,
                      BlockDriverState *hd0, BlockDriverState *hd1,
P
pbrook 已提交
2778
                      qemu_irq irq)
B
bellard 已提交
2779
{
B
bellard 已提交
2780
    IDEState *s;
2781
    static int drive_serial = 1;
2782
    int i, cylinders, heads, secs;
2783
    uint64_t nb_sectors;
B
bellard 已提交
2784

2785 2786
    for(i = 0; i < 2; i++) {
        s = ide_state + i;
2787
        s->io_buffer = qemu_memalign(512, IDE_DMA_BUF_SECTORS*512 + 4);
2788 2789 2790 2791
        if (i == 0)
            s->bs = hd0;
        else
            s->bs = hd1;
B
bellard 已提交
2792 2793
        if (s->bs) {
            bdrv_get_geometry(s->bs, &nb_sectors);
2794 2795 2796 2797
            bdrv_guess_geometry(s->bs, &cylinders, &heads, &secs);
            s->cylinders = cylinders;
            s->heads = heads;
            s->sectors = secs;
B
bellard 已提交
2798
            s->nb_sectors = nb_sectors;
2799

2800 2801
            if (bdrv_get_type_hint(s->bs) == BDRV_TYPE_CDROM) {
                s->is_cdrom = 1;
2802
		bdrv_set_change_cb(s->bs, cdrom_change_cb, s);
B
bellard 已提交
2803 2804
            }
        }
2805
        s->drive_serial = drive_serial++;
2806 2807 2808 2809 2810
        strncpy(s->drive_serial_str, drive_get_serial(s->bs),
                sizeof(s->drive_serial_str));
        if (strlen(s->drive_serial_str) == 0)
            snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
                    "QM%05d", s->drive_serial);
2811
        s->irq = irq;
2812
        s->sector_write_timer = qemu_new_timer(vm_clock,
2813
                                               ide_sector_write_timer_cb, s);
B
bellard 已提交
2814 2815
        ide_reset(s);
    }
B
bellard 已提交
2816 2817
}

2818
static void ide_init_ioport(IDEState *ide_state, int iobase, int iobase2)
B
bellard 已提交
2819
{
2820 2821 2822 2823 2824
    register_ioport_write(iobase, 8, 1, ide_ioport_write, ide_state);
    register_ioport_read(iobase, 8, 1, ide_ioport_read, ide_state);
    if (iobase2) {
        register_ioport_read(iobase2, 1, 1, ide_status_read, ide_state);
        register_ioport_write(iobase2, 1, 1, ide_cmd_write, ide_state);
B
bellard 已提交
2825
    }
2826

2827 2828 2829 2830 2831
    /* data ports */
    register_ioport_write(iobase, 2, 2, ide_data_writew, ide_state);
    register_ioport_read(iobase, 2, 2, ide_data_readw, ide_state);
    register_ioport_write(iobase, 4, 4, ide_data_writel, ide_state);
    register_ioport_read(iobase, 4, 4, ide_data_readl, ide_state);
B
bellard 已提交
2832
}
B
bellard 已提交
2833

2834 2835 2836
/* save per IDE drive data */
static void ide_save(QEMUFile* f, IDEState *s)
{
2837 2838
    qemu_put_be32(f, s->mult_sectors);
    qemu_put_be32(f, s->identify_set);
2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864
    if (s->identify_set) {
        qemu_put_buffer(f, (const uint8_t *)s->identify_data, 512);
    }
    qemu_put_8s(f, &s->feature);
    qemu_put_8s(f, &s->error);
    qemu_put_be32s(f, &s->nsector);
    qemu_put_8s(f, &s->sector);
    qemu_put_8s(f, &s->lcyl);
    qemu_put_8s(f, &s->hcyl);
    qemu_put_8s(f, &s->hob_feature);
    qemu_put_8s(f, &s->hob_nsector);
    qemu_put_8s(f, &s->hob_sector);
    qemu_put_8s(f, &s->hob_lcyl);
    qemu_put_8s(f, &s->hob_hcyl);
    qemu_put_8s(f, &s->select);
    qemu_put_8s(f, &s->status);
    qemu_put_8s(f, &s->lba48);

    qemu_put_8s(f, &s->sense_key);
    qemu_put_8s(f, &s->asc);
    /* XXX: if a transfer is pending, we do not save it yet */
}

/* load per IDE drive data */
static void ide_load(QEMUFile* f, IDEState *s)
{
2865 2866
    s->mult_sectors=qemu_get_be32(f);
    s->identify_set=qemu_get_be32(f);
2867 2868 2869 2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889
    if (s->identify_set) {
        qemu_get_buffer(f, (uint8_t *)s->identify_data, 512);
    }
    qemu_get_8s(f, &s->feature);
    qemu_get_8s(f, &s->error);
    qemu_get_be32s(f, &s->nsector);
    qemu_get_8s(f, &s->sector);
    qemu_get_8s(f, &s->lcyl);
    qemu_get_8s(f, &s->hcyl);
    qemu_get_8s(f, &s->hob_feature);
    qemu_get_8s(f, &s->hob_nsector);
    qemu_get_8s(f, &s->hob_sector);
    qemu_get_8s(f, &s->hob_lcyl);
    qemu_get_8s(f, &s->hob_hcyl);
    qemu_get_8s(f, &s->select);
    qemu_get_8s(f, &s->status);
    qemu_get_8s(f, &s->lba48);

    qemu_get_8s(f, &s->sense_key);
    qemu_get_8s(f, &s->asc);
    /* XXX: if a transfer is pending, we do not save it yet */
}

2890 2891 2892
/***********************************************************/
/* ISA IDE definitions */

P
pbrook 已提交
2893
void isa_ide_init(int iobase, int iobase2, qemu_irq irq,
2894 2895 2896 2897 2898
                  BlockDriverState *hd0, BlockDriverState *hd1)
{
    IDEState *ide_state;

    ide_state = qemu_mallocz(sizeof(IDEState) * 2);
2899

P
pbrook 已提交
2900
    ide_init2(ide_state, hd0, hd1, irq);
2901 2902 2903
    ide_init_ioport(ide_state, iobase, iobase2);
}

B
bellard 已提交
2904 2905 2906
/***********************************************************/
/* PCI IDE definitions */

2907 2908
static void cmd646_update_irq(PCIIDEState *d);

2909
static void ide_map(PCIDevice *pci_dev, int region_num,
B
bellard 已提交
2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932
                    uint32_t addr, uint32_t size, int type)
{
    PCIIDEState *d = (PCIIDEState *)pci_dev;
    IDEState *ide_state;

    if (region_num <= 3) {
        ide_state = &d->ide_if[(region_num >> 1) * 2];
        if (region_num & 1) {
            register_ioport_read(addr + 2, 1, 1, ide_status_read, ide_state);
            register_ioport_write(addr + 2, 1, 1, ide_cmd_write, ide_state);
        } else {
            register_ioport_write(addr, 8, 1, ide_ioport_write, ide_state);
            register_ioport_read(addr, 8, 1, ide_ioport_read, ide_state);

            /* data ports */
            register_ioport_write(addr, 2, 2, ide_data_writew, ide_state);
            register_ioport_read(addr, 2, 2, ide_data_readw, ide_state);
            register_ioport_write(addr, 4, 4, ide_data_writel, ide_state);
            register_ioport_read(addr, 4, 4, ide_data_readl, ide_state);
        }
    }
}

2933
static void ide_dma_start(IDEState *s, BlockDriverCompletionFunc *dma_cb)
B
bellard 已提交
2934 2935 2936 2937 2938 2939
{
    BMDMAState *bm = s->bmdma;
    if(!bm)
        return;
    bm->ide_if = s;
    bm->dma_cb = dma_cb;
2940 2941 2942
    bm->cur_prd_last = 0;
    bm->cur_prd_addr = 0;
    bm->cur_prd_len = 0;
2943 2944
    bm->sector_num = ide_get_sector(s);
    bm->nsector = s->nsector;
B
bellard 已提交
2945
    if (bm->status & BM_STATUS_DMAING) {
2946
        bm->dma_cb(bm, 0);
B
bellard 已提交
2947 2948 2949
    }
}

2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961
static void ide_dma_restart(IDEState *s)
{
    BMDMAState *bm = s->bmdma;
    ide_set_sector(s, bm->sector_num);
    s->io_buffer_index = 0;
    s->io_buffer_size = 0;
    s->nsector = bm->nsector;
    bm->cur_addr = bm->addr;
    bm->dma_cb = ide_write_dma_cb;
    ide_dma_start(s, bm->dma_cb);
}

2962 2963 2964 2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978
static void ide_dma_cancel(BMDMAState *bm)
{
    if (bm->status & BM_STATUS_DMAING) {
        bm->status &= ~BM_STATUS_DMAING;
        /* cancel DMA request */
        bm->ide_if = NULL;
        bm->dma_cb = NULL;
        if (bm->aiocb) {
#ifdef DEBUG_AIO
            printf("aio_cancel\n");
#endif
            bdrv_aio_cancel(bm->aiocb);
            bm->aiocb = NULL;
        }
    }
}

B
bellard 已提交
2979 2980 2981 2982 2983 2984 2985 2986
static void bmdma_cmd_writeb(void *opaque, uint32_t addr, uint32_t val)
{
    BMDMAState *bm = opaque;
#ifdef DEBUG_IDE
    printf("%s: 0x%08x\n", __func__, val);
#endif
    if (!(val & BM_CMD_START)) {
        /* XXX: do it better */
2987
        ide_dma_cancel(bm);
B
bellard 已提交
2988 2989
        bm->cmd = val & 0x09;
    } else {
2990 2991 2992 2993 2994 2995
        if (!(bm->status & BM_STATUS_DMAING)) {
            bm->status |= BM_STATUS_DMAING;
            /* start dma transfer if possible */
            if (bm->dma_cb)
                bm->dma_cb(bm, 0);
        }
B
bellard 已提交
2996 2997 2998 2999
        bm->cmd = val & 0x09;
    }
}

3000
static uint32_t bmdma_readb(void *opaque, uint32_t addr)
B
bellard 已提交
3001 3002
{
    BMDMAState *bm = opaque;
3003
    PCIIDEState *pci_dev;
B
bellard 已提交
3004
    uint32_t val;
3005

3006
    switch(addr & 3) {
3007
    case 0:
3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034 3035
        val = bm->cmd;
        break;
    case 1:
        pci_dev = bm->pci_dev;
        if (pci_dev->type == IDE_TYPE_CMD646) {
            val = pci_dev->dev.config[MRDMODE];
        } else {
            val = 0xff;
        }
        break;
    case 2:
        val = bm->status;
        break;
    case 3:
        pci_dev = bm->pci_dev;
        if (pci_dev->type == IDE_TYPE_CMD646) {
            if (bm == &pci_dev->bmdma[0])
                val = pci_dev->dev.config[UDIDETCR0];
            else
                val = pci_dev->dev.config[UDIDETCR1];
        } else {
            val = 0xff;
        }
        break;
    default:
        val = 0xff;
        break;
    }
B
bellard 已提交
3036
#ifdef DEBUG_IDE
3037
    printf("bmdma: readb 0x%02x : 0x%02x\n", addr, val);
B
bellard 已提交
3038 3039 3040 3041
#endif
    return val;
}

3042
static void bmdma_writeb(void *opaque, uint32_t addr, uint32_t val)
B
bellard 已提交
3043 3044
{
    BMDMAState *bm = opaque;
3045
    PCIIDEState *pci_dev;
B
bellard 已提交
3046
#ifdef DEBUG_IDE
3047
    printf("bmdma: writeb 0x%02x : 0x%02x\n", addr, val);
B
bellard 已提交
3048
#endif
3049 3050 3051 3052
    switch(addr & 3) {
    case 1:
        pci_dev = bm->pci_dev;
        if (pci_dev->type == IDE_TYPE_CMD646) {
3053
            pci_dev->dev.config[MRDMODE] =
3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070
                (pci_dev->dev.config[MRDMODE] & ~0x30) | (val & 0x30);
            cmd646_update_irq(pci_dev);
        }
        break;
    case 2:
        bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
        break;
    case 3:
        pci_dev = bm->pci_dev;
        if (pci_dev->type == IDE_TYPE_CMD646) {
            if (bm == &pci_dev->bmdma[0])
                pci_dev->dev.config[UDIDETCR0] = val;
            else
                pci_dev->dev.config[UDIDETCR1] = val;
        }
        break;
    }
B
bellard 已提交
3071 3072
}

3073 3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100 3101 3102 3103 3104 3105 3106 3107 3108 3109 3110 3111 3112 3113 3114 3115 3116 3117 3118
static uint32_t bmdma_addr_readb(void *opaque, uint32_t addr)
{
    BMDMAState *bm = opaque;
    uint32_t val;
    val = (bm->addr >> ((addr & 3) * 8)) & 0xff;
#ifdef DEBUG_IDE
    printf("%s: 0x%08x\n", __func__, val);
#endif
    return val;
}

static void bmdma_addr_writeb(void *opaque, uint32_t addr, uint32_t val)
{
    BMDMAState *bm = opaque;
    int shift = (addr & 3) * 8;
#ifdef DEBUG_IDE
    printf("%s: 0x%08x\n", __func__, val);
#endif
    bm->addr &= ~(0xFF << shift);
    bm->addr |= ((val & 0xFF) << shift) & ~3;
    bm->cur_addr = bm->addr;
}

static uint32_t bmdma_addr_readw(void *opaque, uint32_t addr)
{
    BMDMAState *bm = opaque;
    uint32_t val;
    val = (bm->addr >> ((addr & 3) * 8)) & 0xffff;
#ifdef DEBUG_IDE
    printf("%s: 0x%08x\n", __func__, val);
#endif
    return val;
}

static void bmdma_addr_writew(void *opaque, uint32_t addr, uint32_t val)
{
    BMDMAState *bm = opaque;
    int shift = (addr & 3) * 8;
#ifdef DEBUG_IDE
    printf("%s: 0x%08x\n", __func__, val);
#endif
    bm->addr &= ~(0xFFFF << shift);
    bm->addr |= ((val & 0xFFFF) << shift) & ~3;
    bm->cur_addr = bm->addr;
}

B
bellard 已提交
3119 3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136
static uint32_t bmdma_addr_readl(void *opaque, uint32_t addr)
{
    BMDMAState *bm = opaque;
    uint32_t val;
    val = bm->addr;
#ifdef DEBUG_IDE
    printf("%s: 0x%08x\n", __func__, val);
#endif
    return val;
}

static void bmdma_addr_writel(void *opaque, uint32_t addr, uint32_t val)
{
    BMDMAState *bm = opaque;
#ifdef DEBUG_IDE
    printf("%s: 0x%08x\n", __func__, val);
#endif
    bm->addr = val & ~3;
3137
    bm->cur_addr = bm->addr;
B
bellard 已提交
3138 3139
}

3140
static void bmdma_map(PCIDevice *pci_dev, int region_num,
B
bellard 已提交
3141 3142 3143 3144 3145 3146 3147 3148 3149
                    uint32_t addr, uint32_t size, int type)
{
    PCIIDEState *d = (PCIIDEState *)pci_dev;
    int i;

    for(i = 0;i < 2; i++) {
        BMDMAState *bm = &d->bmdma[i];
        d->ide_if[2 * i].bmdma = bm;
        d->ide_if[2 * i + 1].bmdma = bm;
3150
        bm->pci_dev = (PCIIDEState *)pci_dev;
3151
        qemu_add_vm_change_state_handler(ide_dma_restart_cb, bm);
3152

B
bellard 已提交
3153 3154
        register_ioport_write(addr, 1, 1, bmdma_cmd_writeb, bm);

3155 3156
        register_ioport_write(addr + 1, 3, 1, bmdma_writeb, bm);
        register_ioport_read(addr, 4, 1, bmdma_readb, bm);
B
bellard 已提交
3157

3158 3159 3160 3161
        register_ioport_write(addr + 4, 4, 1, bmdma_addr_writeb, bm);
        register_ioport_read(addr + 4, 4, 1, bmdma_addr_readb, bm);
        register_ioport_write(addr + 4, 4, 2, bmdma_addr_writew, bm);
        register_ioport_read(addr + 4, 4, 2, bmdma_addr_readw, bm);
B
bellard 已提交
3162 3163 3164 3165 3166 3167
        register_ioport_write(addr + 4, 4, 4, bmdma_addr_writel, bm);
        register_ioport_read(addr + 4, 4, 4, bmdma_addr_readl, bm);
        addr += 8;
    }
}

3168 3169 3170 3171 3172 3173 3174 3175 3176
static void pci_ide_save(QEMUFile* f, void *opaque)
{
    PCIIDEState *d = opaque;
    int i;

    pci_device_save(&d->dev, f);

    for(i = 0; i < 2; i++) {
        BMDMAState *bm = &d->bmdma[i];
3177
        uint8_t ifidx;
3178 3179 3180
        qemu_put_8s(f, &bm->cmd);
        qemu_put_8s(f, &bm->status);
        qemu_put_be32s(f, &bm->addr);
3181 3182 3183 3184
        qemu_put_sbe64s(f, &bm->sector_num);
        qemu_put_be32s(f, &bm->nsector);
        ifidx = bm->ide_if ? bm->ide_if - d->ide_if : 0;
        qemu_put_8s(f, &ifidx);
3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207
        /* XXX: if a transfer is pending, we do not save it yet */
    }

    /* per IDE interface data */
    for(i = 0; i < 2; i++) {
        IDEState *s = &d->ide_if[i * 2];
        uint8_t drive1_selected;
        qemu_put_8s(f, &s->cmd);
        drive1_selected = (s->cur_drive != s);
        qemu_put_8s(f, &drive1_selected);
    }

    /* per IDE drive data */
    for(i = 0; i < 4; i++) {
        ide_save(f, &d->ide_if[i]);
    }
}

static int pci_ide_load(QEMUFile* f, void *opaque, int version_id)
{
    PCIIDEState *d = opaque;
    int ret, i;

3208
    if (version_id != 2)
3209 3210 3211 3212 3213 3214 3215
        return -EINVAL;
    ret = pci_device_load(&d->dev, f);
    if (ret < 0)
        return ret;

    for(i = 0; i < 2; i++) {
        BMDMAState *bm = &d->bmdma[i];
3216
        uint8_t ifidx;
3217 3218 3219
        qemu_get_8s(f, &bm->cmd);
        qemu_get_8s(f, &bm->status);
        qemu_get_be32s(f, &bm->addr);
3220 3221 3222 3223
        qemu_get_sbe64s(f, &bm->sector_num);
        qemu_get_be32s(f, &bm->nsector);
        qemu_get_8s(f, &ifidx);
        bm->ide_if = &d->ide_if[ifidx];
3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242
        /* XXX: if a transfer is pending, we do not save it yet */
    }

    /* per IDE interface data */
    for(i = 0; i < 2; i++) {
        IDEState *s = &d->ide_if[i * 2];
        uint8_t drive1_selected;
        qemu_get_8s(f, &s->cmd);
        qemu_get_8s(f, &drive1_selected);
        s->cur_drive = &d->ide_if[i * 2 + (drive1_selected != 0)];
    }

    /* per IDE drive data */
    for(i = 0; i < 4; i++) {
        ide_load(f, &d->ide_if[i]);
    }
    return 0;
}

3243 3244 3245 3246 3247 3248 3249 3250 3251
/* XXX: call it also when the MRDMODE is changed from the PCI config
   registers */
static void cmd646_update_irq(PCIIDEState *d)
{
    int pci_level;
    pci_level = ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH0) &&
                 !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH0)) ||
        ((d->dev.config[MRDMODE] & MRDMODE_INTR_CH1) &&
         !(d->dev.config[MRDMODE] & MRDMODE_BLK_CH1));
P
pbrook 已提交
3252
    qemu_set_irq(d->dev.irq[0], pci_level);
3253 3254 3255 3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267 3268
}

/* the PCI irq level is the logical OR of the two channels */
static void cmd646_set_irq(void *opaque, int channel, int level)
{
    PCIIDEState *d = opaque;
    int irq_mask;

    irq_mask = MRDMODE_INTR_CH0 << channel;
    if (level)
        d->dev.config[MRDMODE] |= irq_mask;
    else
        d->dev.config[MRDMODE] &= ~irq_mask;
    cmd646_update_irq(d);
}

B
blueswir1 已提交
3269 3270 3271 3272 3273 3274 3275 3276 3277
static void cmd646_reset(void *opaque)
{
    PCIIDEState *d = opaque;
    unsigned int i;

    for (i = 0; i < 2; i++)
        ide_dma_cancel(&d->bmdma[i]);
}

3278 3279 3280
/* CMD646 PCI IDE controller */
void pci_cmd646_ide_init(PCIBus *bus, BlockDriverState **hd_table,
                         int secondary_ide_enabled)
B
bellard 已提交
3281 3282 3283
{
    PCIIDEState *d;
    uint8_t *pci_conf;
3284
    int i;
P
pbrook 已提交
3285
    qemu_irq *irq;
3286

3287
    d = (PCIIDEState *)pci_register_device(bus, "CMD646 IDE",
3288
                                           sizeof(PCIIDEState),
3289
                                           -1,
B
cleanup  
bellard 已提交
3290
                                           NULL, NULL);
3291
    d->type = IDE_TYPE_CMD646;
B
bellard 已提交
3292
    pci_conf = d->dev.config;
3293 3294
    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_CMD);
    pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_CMD_646);
3295 3296

    pci_conf[0x08] = 0x07; // IDE controller revision
3297
    pci_conf[0x09] = 0x8f;
3298

3299
    pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_IDE);
3300
    pci_conf[0x0e] = 0x00; // header_type
3301

3302
    pci_conf[0x51] = 0x04; // enable IDE0
3303 3304
    if (secondary_ide_enabled) {
        /* XXX: if not enabled, really disable the seconday IDE controller */
3305
        pci_conf[0x51] |= 0x08; /* enable IDE1 */
3306
    }
B
bellard 已提交
3307

3308
    pci_register_io_region((PCIDevice *)d, 0, 0x8,
B
bellard 已提交
3309
                           PCI_ADDRESS_SPACE_IO, ide_map);
3310
    pci_register_io_region((PCIDevice *)d, 1, 0x4,
B
bellard 已提交
3311
                           PCI_ADDRESS_SPACE_IO, ide_map);
3312
    pci_register_io_region((PCIDevice *)d, 2, 0x8,
B
bellard 已提交
3313
                           PCI_ADDRESS_SPACE_IO, ide_map);
3314
    pci_register_io_region((PCIDevice *)d, 3, 0x4,
B
bellard 已提交
3315
                           PCI_ADDRESS_SPACE_IO, ide_map);
3316
    pci_register_io_region((PCIDevice *)d, 4, 0x10,
B
bellard 已提交
3317
                           PCI_ADDRESS_SPACE_IO, bmdma_map);
B
bellard 已提交
3318

3319
    pci_conf[0x3d] = 0x01; // interrupt on pin 1
3320

3321 3322
    for(i = 0; i < 4; i++)
        d->ide_if[i].pci_dev = (PCIDevice *)d;
P
pbrook 已提交
3323 3324 3325 3326

    irq = qemu_allocate_irqs(cmd646_set_irq, d, 2);
    ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], irq[0]);
    ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], irq[1]);
B
blueswir1 已提交
3327

3328
    register_savevm("ide", 0, 2, pci_ide_save, pci_ide_load, d);
B
blueswir1 已提交
3329 3330
    qemu_register_reset(cmd646_reset, d);
    cmd646_reset(d);
3331 3332
}

3333
static void piix3_reset(void *opaque)
3334
{
3335
    PCIIDEState *d = opaque;
3336
    uint8_t *pci_conf = d->dev.config;
3337 3338 3339 3340
    int i;

    for (i = 0; i < 2; i++)
        ide_dma_cancel(&d->bmdma[i]);
3341 3342 3343 3344 3345 3346 3347 3348

    pci_conf[0x04] = 0x00;
    pci_conf[0x05] = 0x00;
    pci_conf[0x06] = 0x80; /* FBC */
    pci_conf[0x07] = 0x02; // PCI_status_devsel_medium
    pci_conf[0x20] = 0x01; /* BMIBA: 20-23h */
}

3349 3350
/* hd_table must contain 4 block drivers */
/* NOTE: for the PIIX3, the IRQs and IOports are hardcoded */
P
pbrook 已提交
3351 3352
void pci_piix3_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
                        qemu_irq *pic)
3353 3354 3355
{
    PCIIDEState *d;
    uint8_t *pci_conf;
3356
    int i;
3357

3358
    /* register a function 1 of PIIX3 */
3359
    d = (PCIIDEState *)pci_register_device(bus, "PIIX3 IDE",
B
bellard 已提交
3360
                                           sizeof(PCIIDEState),
3361
                                           devfn,
3362
                                           NULL, NULL);
3363 3364
    d->type = IDE_TYPE_PIIX3;

3365
    pci_conf = d->dev.config;
3366 3367
    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
    pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371SB_1);
3368
    pci_conf[0x09] = 0x80; // legacy ATA mode
3369
    pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_IDE);
3370 3371
    pci_conf[0x0e] = 0x00; // header_type

3372
    qemu_register_reset(piix3_reset, d);
3373 3374
    piix3_reset(d);

3375
    pci_register_io_region((PCIDevice *)d, 4, 0x10,
B
bellard 已提交
3376
                           PCI_ADDRESS_SPACE_IO, bmdma_map);
3377

P
pbrook 已提交
3378 3379
    ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], pic[14]);
    ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], pic[15]);
3380 3381
    ide_init_ioport(&d->ide_if[0], 0x1f0, 0x3f6);
    ide_init_ioport(&d->ide_if[2], 0x170, 0x376);
B
bellard 已提交
3382

3383 3384 3385 3386
    for (i = 0; i < 4; i++)
        if (hd_table[i])
            hd_table[i]->private = &d->dev;

3387
    register_savevm("ide", 0, 2, pci_ide_save, pci_ide_load, d);
B
bellard 已提交
3388
}
B
bellard 已提交
3389

T
ths 已提交
3390 3391 3392 3393 3394 3395 3396 3397 3398 3399 3400 3401 3402 3403 3404 3405
/* hd_table must contain 4 block drivers */
/* NOTE: for the PIIX4, the IRQs and IOports are hardcoded */
void pci_piix4_ide_init(PCIBus *bus, BlockDriverState **hd_table, int devfn,
                        qemu_irq *pic)
{
    PCIIDEState *d;
    uint8_t *pci_conf;

    /* register a function 1 of PIIX4 */
    d = (PCIIDEState *)pci_register_device(bus, "PIIX4 IDE",
                                           sizeof(PCIIDEState),
                                           devfn,
                                           NULL, NULL);
    d->type = IDE_TYPE_PIIX4;

    pci_conf = d->dev.config;
3406 3407
    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
    pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82371AB);
T
ths 已提交
3408
    pci_conf[0x09] = 0x80; // legacy ATA mode
3409
    pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_IDE);
T
ths 已提交
3410 3411
    pci_conf[0x0e] = 0x00; // header_type

3412
    qemu_register_reset(piix3_reset, d);
T
ths 已提交
3413 3414 3415 3416 3417 3418 3419 3420 3421 3422
    piix3_reset(d);

    pci_register_io_region((PCIDevice *)d, 4, 0x10,
                           PCI_ADDRESS_SPACE_IO, bmdma_map);

    ide_init2(&d->ide_if[0], hd_table[0], hd_table[1], pic[14]);
    ide_init2(&d->ide_if[2], hd_table[2], hd_table[3], pic[15]);
    ide_init_ioport(&d->ide_if[0], 0x1f0, 0x3f6);
    ide_init_ioport(&d->ide_if[2], 0x170, 0x376);

3423
    register_savevm("ide", 0, 2, pci_ide_save, pci_ide_load, d);
T
ths 已提交
3424 3425
}

A
aurel32 已提交
3426
#if defined(TARGET_PPC)
B
bellard 已提交
3427 3428 3429
/***********************************************************/
/* MacIO based PowerPC IDE */

A
aurel32 已提交
3430 3431
typedef struct MACIOIDEState {
    IDEState ide_if[2];
A
aurel32 已提交
3432
    BlockDriverAIOCB *aiocb;
A
aurel32 已提交
3433 3434
} MACIOIDEState;

A
aurel32 已提交
3435
static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
A
aurel32 已提交
3436
{
A
aurel32 已提交
3437
    DBDMA_io *io = opaque;
A
aurel32 已提交
3438
    MACIOIDEState *m = io->opaque;
A
aurel32 已提交
3439 3440
    IDEState *s = m->ide_if->cur_drive;

A
aurel32 已提交
3441 3442 3443 3444 3445 3446 3447
    if (ret < 0) {
        m->aiocb = NULL;
        qemu_sglist_destroy(&s->sg);
        ide_atapi_io_error(s, ret);
        io->dma_end(opaque);
        return;
    }
A
aurel32 已提交
3448

A
aurel32 已提交
3449 3450 3451
    if (s->io_buffer_size > 0) {
        m->aiocb = NULL;
        qemu_sglist_destroy(&s->sg);
A
aurel32 已提交
3452

A
aurel32 已提交
3453
        s->packet_transfer_size -= s->io_buffer_size;
A
aurel32 已提交
3454

A
aurel32 已提交
3455 3456 3457 3458
        s->io_buffer_index += s->io_buffer_size;
	s->lba += s->io_buffer_index >> 11;
        s->io_buffer_index &= 0x7ff;
    }
A
aurel32 已提交
3459

A
aurel32 已提交
3460 3461
    if (s->packet_transfer_size <= 0)
        ide_atapi_cmd_ok(s);
A
aurel32 已提交
3462

A
aurel32 已提交
3463 3464 3465
    if (io->len == 0) {
        io->dma_end(opaque);
        return;
A
aurel32 已提交
3466
    }
A
aurel32 已提交
3467

A
aurel32 已提交
3468
    /* launch next transfer */
A
aurel32 已提交
3469

A
aurel32 已提交
3470 3471 3472 3473 3474 3475 3476 3477 3478 3479 3480 3481 3482 3483 3484 3485 3486
    s->io_buffer_size = io->len;

    qemu_sglist_init(&s->sg, io->len / TARGET_PAGE_SIZE + 1);
    qemu_sglist_add(&s->sg, io->addr, io->len);
    io->addr += io->len;
    io->len = 0;

    m->aiocb = dma_bdrv_read(s->bs, &s->sg,
                             (int64_t)(s->lba << 2) + (s->io_buffer_index >> 9),
                             pmac_ide_atapi_transfer_cb, io);
    if (!m->aiocb) {
        qemu_sglist_destroy(&s->sg);
        /* Note: media not present is the most likely case */
        ide_atapi_cmd_error(s, SENSE_NOT_READY,
                            ASC_MEDIUM_NOT_PRESENT);
        io->dma_end(opaque);
        return;
A
aurel32 已提交
3487 3488 3489
    }
}

A
aurel32 已提交
3490
static void pmac_ide_transfer_cb(void *opaque, int ret)
A
aurel32 已提交
3491
{
A
aurel32 已提交
3492
    DBDMA_io *io = opaque;
A
aurel32 已提交
3493
    MACIOIDEState *m = io->opaque;
A
aurel32 已提交
3494
    IDEState *s = m->ide_if->cur_drive;
A
aurel32 已提交
3495
    int n;
A
aurel32 已提交
3496 3497
    int64_t sector_num;

A
aurel32 已提交
3498 3499 3500 3501 3502
    if (ret < 0) {
        m->aiocb = NULL;
        qemu_sglist_destroy(&s->sg);
	ide_dma_error(s);
        io->dma_end(io);
A
aurel32 已提交
3503 3504
        return;
    }
A
aurel32 已提交
3505

A
aurel32 已提交
3506 3507 3508 3509 3510 3511 3512 3513 3514 3515 3516 3517 3518 3519 3520
    sector_num = ide_get_sector(s);
    if (s->io_buffer_size > 0) {
        m->aiocb = NULL;
        qemu_sglist_destroy(&s->sg);
        n = (s->io_buffer_size + 0x1ff) >> 9;
        sector_num += n;
        ide_set_sector(s, sector_num);
        s->nsector -= n;
    }

    /* end of transfer ? */
    if (s->nsector == 0) {
        s->status = READY_STAT | SEEK_STAT;
        ide_set_irq(s);
    }
A
aurel32 已提交
3521

A
aurel32 已提交
3522
    /* end of DMA ? */
A
aurel32 已提交
3523

A
aurel32 已提交
3524 3525 3526 3527
    if (io->len == 0) {
        io->dma_end(io);
	return;
    }
A
aurel32 已提交
3528

A
aurel32 已提交
3529
    /* launch next transfer */
A
aurel32 已提交
3530

A
aurel32 已提交
3531 3532
    s->io_buffer_index = 0;
    s->io_buffer_size = io->len;
A
aurel32 已提交
3533

A
aurel32 已提交
3534 3535 3536 3537
    qemu_sglist_init(&s->sg, io->len / TARGET_PAGE_SIZE + 1);
    qemu_sglist_add(&s->sg, io->addr, io->len);
    io->addr += io->len;
    io->len = 0;
A
aurel32 已提交
3538

A
aurel32 已提交
3539 3540 3541 3542 3543 3544 3545 3546 3547
    if (s->is_read)
        m->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
		                 pmac_ide_transfer_cb, io);
    else
        m->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num,
		                  pmac_ide_transfer_cb, io);
    if (!m->aiocb)
        pmac_ide_transfer_cb(io, -1);
}
A
aurel32 已提交
3548

A
aurel32 已提交
3549 3550 3551 3552
static void pmac_ide_transfer(DBDMA_io *io)
{
    MACIOIDEState *m = io->opaque;
    IDEState *s = m->ide_if->cur_drive;
A
aurel32 已提交
3553

A
aurel32 已提交
3554 3555 3556 3557
    s->io_buffer_size = 0;
    if (s->is_cdrom) {
        pmac_ide_atapi_transfer_cb(io, 0);
        return;
A
aurel32 已提交
3558 3559
    }

A
aurel32 已提交
3560 3561 3562 3563 3564 3565 3566 3567 3568
    pmac_ide_transfer_cb(io, 0);
}

static void pmac_ide_flush(DBDMA_io *io)
{
    MACIOIDEState *m = io->opaque;

    if (m->aiocb)
        qemu_aio_flush();
A
aurel32 已提交
3569 3570
}

B
bellard 已提交
3571 3572 3573 3574
/* PowerMac IDE memory IO */
static void pmac_ide_writeb (void *opaque,
                             target_phys_addr_t addr, uint32_t val)
{
A
aurel32 已提交
3575 3576
    MACIOIDEState *d = opaque;

3577
    addr = (addr & 0xFFF) >> 4;
B
bellard 已提交
3578 3579
    switch (addr) {
    case 1 ... 7:
A
aurel32 已提交
3580
        ide_ioport_write(d->ide_if, addr, val);
B
bellard 已提交
3581 3582 3583
        break;
    case 8:
    case 22:
A
aurel32 已提交
3584
        ide_cmd_write(d->ide_if, 0, val);
B
bellard 已提交
3585 3586 3587 3588 3589 3590 3591 3592 3593
        break;
    default:
        break;
    }
}

static uint32_t pmac_ide_readb (void *opaque,target_phys_addr_t addr)
{
    uint8_t retval;
A
aurel32 已提交
3594
    MACIOIDEState *d = opaque;
B
bellard 已提交
3595 3596 3597 3598

    addr = (addr & 0xFFF) >> 4;
    switch (addr) {
    case 1 ... 7:
A
aurel32 已提交
3599
        retval = ide_ioport_read(d->ide_if, addr);
B
bellard 已提交
3600 3601 3602
        break;
    case 8:
    case 22:
A
aurel32 已提交
3603
        retval = ide_status_read(d->ide_if, 0);
B
bellard 已提交
3604 3605 3606 3607 3608 3609 3610 3611 3612 3613 3614
        break;
    default:
        retval = 0xFF;
        break;
    }
    return retval;
}

static void pmac_ide_writew (void *opaque,
                             target_phys_addr_t addr, uint32_t val)
{
A
aurel32 已提交
3615 3616
    MACIOIDEState *d = opaque;

3617
    addr = (addr & 0xFFF) >> 4;
B
bellard 已提交
3618 3619 3620 3621
#ifdef TARGET_WORDS_BIGENDIAN
    val = bswap16(val);
#endif
    if (addr == 0) {
A
aurel32 已提交
3622
        ide_data_writew(d->ide_if, 0, val);
B
bellard 已提交
3623 3624 3625 3626 3627 3628
    }
}

static uint32_t pmac_ide_readw (void *opaque,target_phys_addr_t addr)
{
    uint16_t retval;
A
aurel32 已提交
3629
    MACIOIDEState *d = opaque;
B
bellard 已提交
3630

3631
    addr = (addr & 0xFFF) >> 4;
B
bellard 已提交
3632
    if (addr == 0) {
A
aurel32 已提交
3633
        retval = ide_data_readw(d->ide_if, 0);
B
bellard 已提交
3634 3635 3636 3637 3638 3639 3640 3641 3642 3643 3644 3645
    } else {
        retval = 0xFFFF;
    }
#ifdef TARGET_WORDS_BIGENDIAN
    retval = bswap16(retval);
#endif
    return retval;
}

static void pmac_ide_writel (void *opaque,
                             target_phys_addr_t addr, uint32_t val)
{
A
aurel32 已提交
3646 3647
    MACIOIDEState *d = opaque;

3648
    addr = (addr & 0xFFF) >> 4;
B
bellard 已提交
3649 3650 3651 3652
#ifdef TARGET_WORDS_BIGENDIAN
    val = bswap32(val);
#endif
    if (addr == 0) {
A
aurel32 已提交
3653
        ide_data_writel(d->ide_if, 0, val);
B
bellard 已提交
3654 3655 3656 3657 3658 3659
    }
}

static uint32_t pmac_ide_readl (void *opaque,target_phys_addr_t addr)
{
    uint32_t retval;
A
aurel32 已提交
3660
    MACIOIDEState *d = opaque;
B
bellard 已提交
3661

3662
    addr = (addr & 0xFFF) >> 4;
B
bellard 已提交
3663
    if (addr == 0) {
A
aurel32 已提交
3664
        retval = ide_data_readl(d->ide_if, 0);
B
bellard 已提交
3665 3666 3667 3668 3669 3670 3671 3672 3673 3674 3675 3676 3677 3678 3679 3680 3681 3682 3683 3684 3685
    } else {
        retval = 0xFFFFFFFF;
    }
#ifdef TARGET_WORDS_BIGENDIAN
    retval = bswap32(retval);
#endif
    return retval;
}

static CPUWriteMemoryFunc *pmac_ide_write[] = {
    pmac_ide_writeb,
    pmac_ide_writew,
    pmac_ide_writel,
};

static CPUReadMemoryFunc *pmac_ide_read[] = {
    pmac_ide_readb,
    pmac_ide_readw,
    pmac_ide_readl,
};

3686 3687
static void pmac_ide_save(QEMUFile *f, void *opaque)
{
A
aurel32 已提交
3688 3689
    MACIOIDEState *d = opaque;
    IDEState *s = d->ide_if;
3690 3691 3692 3693 3694 3695 3696 3697 3698 3699 3700 3701 3702 3703 3704 3705
    uint8_t drive1_selected;
    unsigned int i;

    /* per IDE interface data */
    qemu_put_8s(f, &s->cmd);
    drive1_selected = (s->cur_drive != s);
    qemu_put_8s(f, &drive1_selected);

    /* per IDE drive data */
    for(i = 0; i < 2; i++) {
        ide_save(f, &s[i]);
    }
}

static int pmac_ide_load(QEMUFile *f, void *opaque, int version_id)
{
A
aurel32 已提交
3706 3707
    MACIOIDEState *d = opaque;
    IDEState *s = d->ide_if;
3708 3709 3710 3711 3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725
    uint8_t drive1_selected;
    unsigned int i;

    if (version_id != 1)
        return -EINVAL;

    /* per IDE interface data */
    qemu_get_8s(f, &s->cmd);
    qemu_get_8s(f, &drive1_selected);
    s->cur_drive = &s[(drive1_selected != 0)];

    /* per IDE drive data */
    for(i = 0; i < 2; i++) {
        ide_load(f, &s[i]);
    }
    return 0;
}

B
blueswir1 已提交
3726 3727
static void pmac_ide_reset(void *opaque)
{
A
aurel32 已提交
3728 3729
    MACIOIDEState *d = opaque;
    IDEState *s = d->ide_if;
B
blueswir1 已提交
3730 3731 3732 3733 3734

    ide_reset(&s[0]);
    ide_reset(&s[1]);
}

B
bellard 已提交
3735 3736 3737
/* hd_table must contain 4 block drivers */
/* PowerMac uses memory mapped registers, not I/O. Return the memory
   I/O index to access the ide. */
A
aurel32 已提交
3738 3739
int pmac_ide_init (BlockDriverState **hd_table, qemu_irq irq,
		   void *dbdma, int channel, qemu_irq dma_irq)
B
bellard 已提交
3740
{
A
aurel32 已提交
3741
    MACIOIDEState *d;
B
bellard 已提交
3742 3743
    int pmac_ide_memory;

A
aurel32 已提交
3744 3745 3746
    d = qemu_mallocz(sizeof(MACIOIDEState));
    ide_init2(d->ide_if, hd_table[0], hd_table[1], irq);

A
aurel32 已提交
3747
    if (dbdma)
A
aurel32 已提交
3748
        DBDMA_register_channel(dbdma, channel, dma_irq, pmac_ide_transfer, pmac_ide_flush, d);
3749

B
bellard 已提交
3750
    pmac_ide_memory = cpu_register_io_memory(0, pmac_ide_read,
A
aurel32 已提交
3751 3752 3753 3754 3755
                                             pmac_ide_write, d);
    register_savevm("ide", 0, 1, pmac_ide_save, pmac_ide_load, d);
    qemu_register_reset(pmac_ide_reset, d);
    pmac_ide_reset(d);

B
bellard 已提交
3756 3757
    return pmac_ide_memory;
}
A
aurel32 已提交
3758
#endif /* TARGET_PPC */
3759

3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851
/***********************************************************/
/* MMIO based ide port
 * This emulates IDE device connected directly to the CPU bus without
 * dedicated ide controller, which is often seen on embedded boards.
 */

typedef struct {
    void *dev;
    int shift;
} MMIOState;

static uint32_t mmio_ide_read (void *opaque, target_phys_addr_t addr)
{
    MMIOState *s = (MMIOState*)opaque;
    IDEState *ide = (IDEState*)s->dev;
    addr >>= s->shift;
    if (addr & 7)
        return ide_ioport_read(ide, addr);
    else
        return ide_data_readw(ide, 0);
}

static void mmio_ide_write (void *opaque, target_phys_addr_t addr,
	uint32_t val)
{
    MMIOState *s = (MMIOState*)opaque;
    IDEState *ide = (IDEState*)s->dev;
    addr >>= s->shift;
    if (addr & 7)
        ide_ioport_write(ide, addr, val);
    else
        ide_data_writew(ide, 0, val);
}

static CPUReadMemoryFunc *mmio_ide_reads[] = {
    mmio_ide_read,
    mmio_ide_read,
    mmio_ide_read,
};

static CPUWriteMemoryFunc *mmio_ide_writes[] = {
    mmio_ide_write,
    mmio_ide_write,
    mmio_ide_write,
};

static uint32_t mmio_ide_status_read (void *opaque, target_phys_addr_t addr)
{
    MMIOState *s= (MMIOState*)opaque;
    IDEState *ide = (IDEState*)s->dev;
    return ide_status_read(ide, 0);
}

static void mmio_ide_cmd_write (void *opaque, target_phys_addr_t addr,
	uint32_t val)
{
    MMIOState *s = (MMIOState*)opaque;
    IDEState *ide = (IDEState*)s->dev;
    ide_cmd_write(ide, 0, val);
}

static CPUReadMemoryFunc *mmio_ide_status[] = {
    mmio_ide_status_read,
    mmio_ide_status_read,
    mmio_ide_status_read,
};

static CPUWriteMemoryFunc *mmio_ide_cmd[] = {
    mmio_ide_cmd_write,
    mmio_ide_cmd_write,
    mmio_ide_cmd_write,
};

void mmio_ide_init (target_phys_addr_t membase, target_phys_addr_t membase2,
                    qemu_irq irq, int shift,
                    BlockDriverState *hd0, BlockDriverState *hd1)
{
    MMIOState *s = qemu_mallocz(sizeof(MMIOState));
    IDEState *ide = qemu_mallocz(sizeof(IDEState) * 2);
    int mem1, mem2;

    ide_init2(ide, hd0, hd1, irq);

    s->dev = ide;
    s->shift = shift;

    mem1 = cpu_register_io_memory(0, mmio_ide_reads, mmio_ide_writes, s);
    mem2 = cpu_register_io_memory(0, mmio_ide_status, mmio_ide_cmd, s);
    cpu_register_physical_memory(membase, 16 << shift, mem1);
    cpu_register_physical_memory(membase2, 2 << shift, mem2);
}

3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932
/***********************************************************/
/* CF-ATA Microdrive */

#define METADATA_SIZE	0x20

/* DSCM-1XXXX Microdrive hard disk with CF+ II / PCMCIA interface.  */
struct md_s {
    IDEState ide[2];
    struct pcmcia_card_s card;
    uint32_t attr_base;
    uint32_t io_base;

    /* Card state */
    uint8_t opt;
    uint8_t stat;
    uint8_t pins;

    uint8_t ctrl;
    uint16_t io;
    int cycle;
};

/* Register bitfields */
enum md_opt {
    OPT_MODE_MMAP	= 0,
    OPT_MODE_IOMAP16	= 1,
    OPT_MODE_IOMAP1	= 2,
    OPT_MODE_IOMAP2	= 3,
    OPT_MODE		= 0x3f,
    OPT_LEVIREQ		= 0x40,
    OPT_SRESET		= 0x80,
};
enum md_cstat {
    STAT_INT		= 0x02,
    STAT_PWRDWN		= 0x04,
    STAT_XE		= 0x10,
    STAT_IOIS8		= 0x20,
    STAT_SIGCHG		= 0x40,
    STAT_CHANGED	= 0x80,
};
enum md_pins {
    PINS_MRDY		= 0x02,
    PINS_CRDY		= 0x20,
};
enum md_ctrl {
    CTRL_IEN		= 0x02,
    CTRL_SRST		= 0x04,
};

static inline void md_interrupt_update(struct md_s *s)
{
    if (!s->card.slot)
        return;

    qemu_set_irq(s->card.slot->irq,
                    !(s->stat & STAT_INT) &&	/* Inverted */
                    !(s->ctrl & (CTRL_IEN | CTRL_SRST)) &&
                    !(s->opt & OPT_SRESET));
}

static void md_set_irq(void *opaque, int irq, int level)
{
    struct md_s *s = (struct md_s *) opaque;
    if (level)
        s->stat |= STAT_INT;
    else
        s->stat &= ~STAT_INT;

    md_interrupt_update(s);
}

static void md_reset(struct md_s *s)
{
    s->opt = OPT_MODE_MMAP;
    s->stat = 0;
    s->pins = 0;
    s->cycle = 0;
    s->ctrl = 0;
    ide_reset(s->ide);
}

3933
static uint8_t md_attr_read(void *opaque, uint32_t at)
3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965
{
    struct md_s *s = (struct md_s *) opaque;
    if (at < s->attr_base) {
        if (at < s->card.cis_len)
            return s->card.cis[at];
        else
            return 0x00;
    }

    at -= s->attr_base;

    switch (at) {
    case 0x00:	/* Configuration Option Register */
        return s->opt;
    case 0x02:	/* Card Configuration Status Register */
        if (s->ctrl & CTRL_IEN)
            return s->stat & ~STAT_INT;
        else
            return s->stat;
    case 0x04:	/* Pin Replacement Register */
        return (s->pins & PINS_CRDY) | 0x0c;
    case 0x06:	/* Socket and Copy Register */
        return 0x00;
#ifdef VERBOSE
    default:
        printf("%s: Bad attribute space register %02x\n", __FUNCTION__, at);
#endif
    }

    return 0;
}

3966
static void md_attr_write(void *opaque, uint32_t at, uint8_t value)
3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977 3978 3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991 3992 3993 3994 3995 3996
{
    struct md_s *s = (struct md_s *) opaque;
    at -= s->attr_base;

    switch (at) {
    case 0x00:	/* Configuration Option Register */
        s->opt = value & 0xcf;
        if (value & OPT_SRESET)
            md_reset(s);
        md_interrupt_update(s);
        break;
    case 0x02:	/* Card Configuration Status Register */
        if ((s->stat ^ value) & STAT_PWRDWN)
            s->pins |= PINS_CRDY;
        s->stat &= 0x82;
        s->stat |= value & 0x74;
        md_interrupt_update(s);
        /* Word 170 in Identify Device must be equal to STAT_XE */
        break;
    case 0x04:	/* Pin Replacement Register */
        s->pins &= PINS_CRDY;
        s->pins |= value & PINS_MRDY;
        break;
    case 0x06:	/* Socket and Copy Register */
        break;
    default:
        printf("%s: Bad attribute space register %02x\n", __FUNCTION__, at);
    }
}

3997
static uint16_t md_common_read(void *opaque, uint32_t at)
3998 3999 4000 4001 4002 4003 4004 4005 4006 4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018 4019 4020 4021 4022 4023 4024 4025 4026 4027 4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040 4041 4042 4043 4044 4045 4046 4047 4048 4049 4050 4051 4052 4053 4054 4055
{
    struct md_s *s = (struct md_s *) opaque;
    uint16_t ret;
    at -= s->io_base;

    switch (s->opt & OPT_MODE) {
    case OPT_MODE_MMAP:
        if ((at & ~0x3ff) == 0x400)
            at = 0;
        break;
    case OPT_MODE_IOMAP16:
        at &= 0xf;
        break;
    case OPT_MODE_IOMAP1:
        if ((at & ~0xf) == 0x3f0)
            at -= 0x3e8;
        else if ((at & ~0xf) == 0x1f0)
            at -= 0x1f0;
        break;
    case OPT_MODE_IOMAP2:
        if ((at & ~0xf) == 0x370)
            at -= 0x368;
        else if ((at & ~0xf) == 0x170)
            at -= 0x170;
    }

    switch (at) {
    case 0x0:	/* Even RD Data */
    case 0x8:
        return ide_data_readw(s->ide, 0);

        /* TODO: 8-bit accesses */
        if (s->cycle)
            ret = s->io >> 8;
        else {
            s->io = ide_data_readw(s->ide, 0);
            ret = s->io & 0xff;
        }
        s->cycle = !s->cycle;
        return ret;
    case 0x9:	/* Odd RD Data */
        return s->io >> 8;
    case 0xd:	/* Error */
        return ide_ioport_read(s->ide, 0x1);
    case 0xe:	/* Alternate Status */
        if (s->ide->cur_drive->bs)
            return s->ide->cur_drive->status;
        else
            return 0;
    case 0xf:	/* Device Address */
        return 0xc2 | ((~s->ide->select << 2) & 0x3c);
    default:
        return ide_ioport_read(s->ide, at);
    }

    return 0;
}

4056
static void md_common_write(void *opaque, uint32_t at, uint16_t value)
4057 4058 4059 4060 4061 4062 4063 4064 4065 4066 4067 4068 4069 4070 4071 4072 4073 4074 4075 4076 4077 4078 4079 4080 4081 4082 4083 4084 4085 4086 4087 4088 4089 4090 4091 4092 4093 4094 4095 4096 4097 4098 4099 4100 4101 4102 4103 4104 4105 4106 4107 4108 4109 4110 4111 4112 4113 4114 4115 4116
{
    struct md_s *s = (struct md_s *) opaque;
    at -= s->io_base;

    switch (s->opt & OPT_MODE) {
    case OPT_MODE_MMAP:
        if ((at & ~0x3ff) == 0x400)
            at = 0;
        break;
    case OPT_MODE_IOMAP16:
        at &= 0xf;
        break;
    case OPT_MODE_IOMAP1:
        if ((at & ~0xf) == 0x3f0)
            at -= 0x3e8;
        else if ((at & ~0xf) == 0x1f0)
            at -= 0x1f0;
        break;
    case OPT_MODE_IOMAP2:
        if ((at & ~0xf) == 0x370)
            at -= 0x368;
        else if ((at & ~0xf) == 0x170)
            at -= 0x170;
    }

    switch (at) {
    case 0x0:	/* Even WR Data */
    case 0x8:
        ide_data_writew(s->ide, 0, value);
        break;

        /* TODO: 8-bit accesses */
        if (s->cycle)
            ide_data_writew(s->ide, 0, s->io | (value << 8));
        else
            s->io = value & 0xff;
        s->cycle = !s->cycle;
        break;
    case 0x9:
        s->io = value & 0xff;
        s->cycle = !s->cycle;
        break;
    case 0xd:	/* Features */
        ide_ioport_write(s->ide, 0x1, value);
        break;
    case 0xe:	/* Device Control */
        s->ctrl = value;
        if (value & CTRL_SRST)
            md_reset(s);
        md_interrupt_update(s);
        break;
    default:
        if (s->stat & STAT_PWRDWN) {
            s->pins |= PINS_CRDY;
            s->stat &= ~STAT_PWRDWN;
        }
        ide_ioport_write(s->ide, at, value);
    }
}

4117 4118 4119 4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140 4141 4142 4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156 4157 4158 4159 4160 4161 4162
static void md_save(QEMUFile *f, void *opaque)
{
    struct md_s *s = (struct md_s *) opaque;
    int i;
    uint8_t drive1_selected;

    qemu_put_8s(f, &s->opt);
    qemu_put_8s(f, &s->stat);
    qemu_put_8s(f, &s->pins);

    qemu_put_8s(f, &s->ctrl);
    qemu_put_be16s(f, &s->io);
    qemu_put_byte(f, s->cycle);

    drive1_selected = (s->ide->cur_drive != s->ide);
    qemu_put_8s(f, &s->ide->cmd);
    qemu_put_8s(f, &drive1_selected);

    for (i = 0; i < 2; i ++)
        ide_save(f, &s->ide[i]);
}

static int md_load(QEMUFile *f, void *opaque, int version_id)
{
    struct md_s *s = (struct md_s *) opaque;
    int i;
    uint8_t drive1_selected;

    qemu_get_8s(f, &s->opt);
    qemu_get_8s(f, &s->stat);
    qemu_get_8s(f, &s->pins);

    qemu_get_8s(f, &s->ctrl);
    qemu_get_be16s(f, &s->io);
    s->cycle = qemu_get_byte(f);

    qemu_get_8s(f, &s->ide->cmd);
    qemu_get_8s(f, &drive1_selected);
    s->ide->cur_drive = &s->ide[(drive1_selected != 0)];

    for (i = 0; i < 2; i ++)
        ide_load(f, &s->ide[i]);

    return 0;
}

4163 4164 4165 4166 4167 4168 4169 4170 4171 4172 4173 4174 4175 4176 4177 4178 4179 4180 4181 4182 4183 4184 4185 4186 4187 4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206 4207 4208 4209 4210 4211 4212 4213 4214 4215 4216 4217 4218 4219 4220 4221 4222 4223 4224 4225 4226 4227 4228 4229 4230 4231 4232 4233 4234 4235 4236 4237 4238 4239 4240 4241 4242 4243 4244 4245 4246 4247 4248 4249 4250 4251 4252 4253 4254 4255 4256 4257 4258 4259 4260 4261 4262 4263 4264 4265 4266 4267 4268 4269 4270 4271 4272 4273 4274 4275 4276 4277 4278 4279 4280 4281 4282 4283 4284 4285 4286 4287 4288 4289 4290 4291 4292 4293 4294 4295 4296 4297 4298 4299 4300 4301 4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312 4313 4314 4315 4316 4317 4318 4319 4320 4321 4322 4323 4324 4325 4326 4327 4328 4329 4330 4331 4332 4333 4334 4335 4336 4337 4338 4339 4340 4341 4342 4343 4344 4345 4346 4347 4348 4349 4350 4351 4352 4353 4354 4355 4356 4357 4358 4359 4360 4361 4362 4363 4364 4365 4366 4367 4368 4369 4370 4371 4372 4373 4374 4375 4376 4377 4378 4379 4380 4381 4382 4383 4384 4385 4386 4387
static const uint8_t dscm1xxxx_cis[0x14a] = {
    [0x000] = CISTPL_DEVICE,	/* 5V Device Information */
    [0x002] = 0x03,		/* Tuple length = 4 bytes */
    [0x004] = 0xdb,		/* ID: DTYPE_FUNCSPEC, non WP, DSPEED_150NS */
    [0x006] = 0x01,		/* Size = 2K bytes */
    [0x008] = CISTPL_ENDMARK,

    [0x00a] = CISTPL_DEVICE_OC,	/* Additional Device Information */
    [0x00c] = 0x04,		/* Tuple length = 4 byest */
    [0x00e] = 0x03,		/* Conditions: Ext = 0, Vcc 3.3V, MWAIT = 1 */
    [0x010] = 0xdb,		/* ID: DTYPE_FUNCSPEC, non WP, DSPEED_150NS */
    [0x012] = 0x01,		/* Size = 2K bytes */
    [0x014] = CISTPL_ENDMARK,

    [0x016] = CISTPL_JEDEC_C,	/* JEDEC ID */
    [0x018] = 0x02,		/* Tuple length = 2 bytes */
    [0x01a] = 0xdf,		/* PC Card ATA with no Vpp required */
    [0x01c] = 0x01,

    [0x01e] = CISTPL_MANFID,	/* Manufacture ID */
    [0x020] = 0x04,		/* Tuple length = 4 bytes */
    [0x022] = 0xa4,		/* TPLMID_MANF = 00a4 (IBM) */
    [0x024] = 0x00,
    [0x026] = 0x00,		/* PLMID_CARD = 0000 */
    [0x028] = 0x00,

    [0x02a] = CISTPL_VERS_1,	/* Level 1 Version */
    [0x02c] = 0x12,		/* Tuple length = 23 bytes */
    [0x02e] = 0x04,		/* Major Version = JEIDA 4.2 / PCMCIA 2.1 */
    [0x030] = 0x01,		/* Minor Version = 1 */
    [0x032] = 'I',
    [0x034] = 'B',
    [0x036] = 'M',
    [0x038] = 0x00,
    [0x03a] = 'm',
    [0x03c] = 'i',
    [0x03e] = 'c',
    [0x040] = 'r',
    [0x042] = 'o',
    [0x044] = 'd',
    [0x046] = 'r',
    [0x048] = 'i',
    [0x04a] = 'v',
    [0x04c] = 'e',
    [0x04e] = 0x00,
    [0x050] = CISTPL_ENDMARK,

    [0x052] = CISTPL_FUNCID,	/* Function ID */
    [0x054] = 0x02,		/* Tuple length = 2 bytes */
    [0x056] = 0x04,		/* TPLFID_FUNCTION = Fixed Disk */
    [0x058] = 0x01,		/* TPLFID_SYSINIT: POST = 1, ROM = 0 */

    [0x05a] = CISTPL_FUNCE,	/* Function Extension */
    [0x05c] = 0x02,		/* Tuple length = 2 bytes */
    [0x05e] = 0x01,		/* TPLFE_TYPE = Disk Device Interface */
    [0x060] = 0x01,		/* TPLFE_DATA = PC Card ATA Interface */

    [0x062] = CISTPL_FUNCE,	/* Function Extension */
    [0x064] = 0x03,		/* Tuple length = 3 bytes */
    [0x066] = 0x02,		/* TPLFE_TYPE = Basic PC Card ATA Interface */
    [0x068] = 0x08,		/* TPLFE_DATA: Rotating, Unique, Single */
    [0x06a] = 0x0f,		/* TPLFE_DATA: Sleep, Standby, Idle, Auto */

    [0x06c] = CISTPL_CONFIG,	/* Configuration */
    [0x06e] = 0x05,		/* Tuple length = 5 bytes */
    [0x070] = 0x01,		/* TPCC_RASZ = 2 bytes, TPCC_RMSZ = 1 byte */
    [0x072] = 0x07,		/* TPCC_LAST = 7 */
    [0x074] = 0x00,		/* TPCC_RADR = 0200 */
    [0x076] = 0x02,
    [0x078] = 0x0f,		/* TPCC_RMSK = 200, 202, 204, 206 */

    [0x07a] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x07c] = 0x0b,		/* Tuple length = 11 bytes */
    [0x07e] = 0xc0,		/* TPCE_INDX = Memory Mode, Default, Iface */
    [0x080] = 0xc0,		/* TPCE_IF = Memory, no BVDs, no WP, READY */
    [0x082] = 0xa1,		/* TPCE_FS = Vcc only, no I/O, Memory, Misc */
    [0x084] = 0x27,		/* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
    [0x086] = 0x55,		/* NomV: 5.0 V */
    [0x088] = 0x4d,		/* MinV: 4.5 V */
    [0x08a] = 0x5d,		/* MaxV: 5.5 V */
    [0x08c] = 0x4e,		/* Peakl: 450 mA */
    [0x08e] = 0x08,		/* TPCE_MS = 1 window, 1 byte, Host address */
    [0x090] = 0x00,		/* Window descriptor: Window length = 0 */
    [0x092] = 0x20,		/* TPCE_MI: support power down mode, RW */

    [0x094] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x096] = 0x06,		/* Tuple length = 6 bytes */
    [0x098] = 0x00,		/* TPCE_INDX = Memory Mode, no Default */
    [0x09a] = 0x01,		/* TPCE_FS = Vcc only, no I/O, no Memory */
    [0x09c] = 0x21,		/* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
    [0x09e] = 0xb5,		/* NomV: 3.3 V */
    [0x0a0] = 0x1e,
    [0x0a2] = 0x3e,		/* Peakl: 350 mA */

    [0x0a4] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x0a6] = 0x0d,		/* Tuple length = 13 bytes */
    [0x0a8] = 0xc1,		/* TPCE_INDX = I/O and Memory Mode, Default */
    [0x0aa] = 0x41,		/* TPCE_IF = I/O and Memory, no BVD, no WP */
    [0x0ac] = 0x99,		/* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
    [0x0ae] = 0x27,		/* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
    [0x0b0] = 0x55,		/* NomV: 5.0 V */
    [0x0b2] = 0x4d,		/* MinV: 4.5 V */
    [0x0b4] = 0x5d,		/* MaxV: 5.5 V */
    [0x0b6] = 0x4e,		/* Peakl: 450 mA */
    [0x0b8] = 0x64,		/* TPCE_IO = 16-byte boundary, 16/8 accesses */
    [0x0ba] = 0xf0,		/* TPCE_IR =  MASK, Level, Pulse, Share */
    [0x0bc] = 0xff,		/* IRQ0..IRQ7 supported */
    [0x0be] = 0xff,		/* IRQ8..IRQ15 supported */
    [0x0c0] = 0x20,		/* TPCE_MI = support power down mode */

    [0x0c2] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x0c4] = 0x06,		/* Tuple length = 6 bytes */
    [0x0c6] = 0x01,		/* TPCE_INDX = I/O and Memory Mode */
    [0x0c8] = 0x01,		/* TPCE_FS = Vcc only, no I/O, no Memory */
    [0x0ca] = 0x21,		/* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
    [0x0cc] = 0xb5,		/* NomV: 3.3 V */
    [0x0ce] = 0x1e,
    [0x0d0] = 0x3e,		/* Peakl: 350 mA */

    [0x0d2] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x0d4] = 0x12,		/* Tuple length = 18 bytes */
    [0x0d6] = 0xc2,		/* TPCE_INDX = I/O Primary Mode */
    [0x0d8] = 0x41,		/* TPCE_IF = I/O and Memory, no BVD, no WP */
    [0x0da] = 0x99,		/* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
    [0x0dc] = 0x27,		/* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
    [0x0de] = 0x55,		/* NomV: 5.0 V */
    [0x0e0] = 0x4d,		/* MinV: 4.5 V */
    [0x0e2] = 0x5d,		/* MaxV: 5.5 V */
    [0x0e4] = 0x4e,		/* Peakl: 450 mA */
    [0x0e6] = 0xea,		/* TPCE_IO = 1K boundary, 16/8 access, Range */
    [0x0e8] = 0x61,		/* Range: 2 fields, 2 bytes addr, 1 byte len */
    [0x0ea] = 0xf0,		/* Field 1 address = 0x01f0 */
    [0x0ec] = 0x01,
    [0x0ee] = 0x07,		/* Address block length = 8 */
    [0x0f0] = 0xf6,		/* Field 2 address = 0x03f6 */
    [0x0f2] = 0x03,
    [0x0f4] = 0x01,		/* Address block length = 2 */
    [0x0f6] = 0xee,		/* TPCE_IR = IRQ E, Level, Pulse, Share */
    [0x0f8] = 0x20,		/* TPCE_MI = support power down mode */

    [0x0fa] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x0fc] = 0x06,		/* Tuple length = 6 bytes */
    [0x0fe] = 0x02,		/* TPCE_INDX = I/O Primary Mode, no Default */
    [0x100] = 0x01,		/* TPCE_FS = Vcc only, no I/O, no Memory */
    [0x102] = 0x21,		/* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
    [0x104] = 0xb5,		/* NomV: 3.3 V */
    [0x106] = 0x1e,
    [0x108] = 0x3e,		/* Peakl: 350 mA */

    [0x10a] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x10c] = 0x12,		/* Tuple length = 18 bytes */
    [0x10e] = 0xc3,		/* TPCE_INDX = I/O Secondary Mode, Default */
    [0x110] = 0x41,		/* TPCE_IF = I/O and Memory, no BVD, no WP */
    [0x112] = 0x99,		/* TPCE_FS = Vcc only, I/O, Interrupt, Misc */
    [0x114] = 0x27,		/* NomV = 1, MinV = 1, MaxV = 1, Peakl = 1 */
    [0x116] = 0x55,		/* NomV: 5.0 V */
    [0x118] = 0x4d,		/* MinV: 4.5 V */
    [0x11a] = 0x5d,		/* MaxV: 5.5 V */
    [0x11c] = 0x4e,		/* Peakl: 450 mA */
    [0x11e] = 0xea,		/* TPCE_IO = 1K boundary, 16/8 access, Range */
    [0x120] = 0x61,		/* Range: 2 fields, 2 byte addr, 1 byte len */
    [0x122] = 0x70,		/* Field 1 address = 0x0170 */
    [0x124] = 0x01,
    [0x126] = 0x07,		/* Address block length = 8 */
    [0x128] = 0x76,		/* Field 2 address = 0x0376 */
    [0x12a] = 0x03,
    [0x12c] = 0x01,		/* Address block length = 2 */
    [0x12e] = 0xee,		/* TPCE_IR = IRQ E, Level, Pulse, Share */
    [0x130] = 0x20,		/* TPCE_MI = support power down mode */

    [0x132] = CISTPL_CFTABLE_ENTRY,	/* 16-bit PC Card Configuration */
    [0x134] = 0x06,		/* Tuple length = 6 bytes */
    [0x136] = 0x03,		/* TPCE_INDX = I/O Secondary Mode */
    [0x138] = 0x01,		/* TPCE_FS = Vcc only, no I/O, no Memory */
    [0x13a] = 0x21,		/* NomV = 1, MinV = 0, MaxV = 0, Peakl = 1 */
    [0x13c] = 0xb5,		/* NomV: 3.3 V */
    [0x13e] = 0x1e,
    [0x140] = 0x3e,		/* Peakl: 350 mA */

    [0x142] = CISTPL_NO_LINK,	/* No Link */
    [0x144] = 0x00,		/* Tuple length = 0 bytes */

    [0x146] = CISTPL_END,	/* Tuple End */
};

static int dscm1xxxx_attach(void *opaque)
{
    struct md_s *md = (struct md_s *) opaque;
    md->card.attr_read = md_attr_read;
    md->card.attr_write = md_attr_write;
    md->card.common_read = md_common_read;
    md->card.common_write = md_common_write;
    md->card.io_read = md_common_read;
    md->card.io_write = md_common_write;

    md->attr_base = md->card.cis[0x74] | (md->card.cis[0x76] << 8);
    md->io_base = 0x0;

    md_reset(md);
    md_interrupt_update(md);

    md->card.slot->card_string = "DSCM-1xxxx Hitachi Microdrive";
    return 0;
}

static int dscm1xxxx_detach(void *opaque)
{
    struct md_s *md = (struct md_s *) opaque;
    md_reset(md);
    return 0;
}

struct pcmcia_card_s *dscm1xxxx_init(BlockDriverState *bdrv)
{
    struct md_s *md = (struct md_s *) qemu_mallocz(sizeof(struct md_s));
    md->card.state = md;
    md->card.attach = dscm1xxxx_attach;
    md->card.detach = dscm1xxxx_detach;
    md->card.cis = dscm1xxxx_cis;
    md->card.cis_len = sizeof(dscm1xxxx_cis);

    ide_init2(md->ide, bdrv, 0, qemu_allocate_irqs(md_set_irq, md, 1)[0]);
    md->ide->is_cf = 1;
    md->ide->mdata_size = METADATA_SIZE;
    md->ide->mdata_storage = (uint8_t *) qemu_mallocz(METADATA_SIZE);
4388

4389
    register_savevm("microdrive", -1, 0, md_save, md_load, md);
4390

4391 4392
    return &md->card;
}
反馈
建议
客服 返回
顶部