xref: /qemu/hw/ide/core.c (revision 11d0f125)
1 /*
2  * QEMU IDE disk and CD/DVD-ROM Emulator
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  * Copyright (c) 2006 Openedhand Ltd.
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 #include <hw/hw.h>
26 #include <hw/pc.h>
27 #include <hw/pci.h>
28 #include <hw/isa.h>
29 #include "qemu-error.h"
30 #include "qemu-timer.h"
31 #include "sysemu.h"
32 #include "dma.h"
33 #include "blockdev.h"
34 #include "block_int.h"
35 
36 #include <hw/ide/internal.h>
37 
38 /* These values were based on a Seagate ST3500418AS but have been modified
39    to make more sense in QEMU */
40 static const int smart_attributes[][12] = {
41     /* id,  flags, hflags, val, wrst, raw (6 bytes), threshold */
42     /* raw read error rate*/
43     { 0x01, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06},
44     /* spin up */
45     { 0x03, 0x03, 0x00, 0x64, 0x64, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
46     /* start stop count */
47     { 0x04, 0x02, 0x00, 0x64, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14},
48     /* remapped sectors */
49     { 0x05, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24},
50     /* power on hours */
51     { 0x09, 0x03, 0x00, 0x64, 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
52     /* power cycle count */
53     { 0x0c, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
54     /* airflow-temperature-celsius */
55     { 190,  0x03, 0x00, 0x45, 0x45, 0x1f, 0x00, 0x1f, 0x1f, 0x00, 0x00, 0x32},
56     /* end of list */
57     { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
58 };
59 
60 static int ide_handle_rw_error(IDEState *s, int error, int op);
61 static void ide_dummy_transfer_stop(IDEState *s);
62 
63 static void padstr(char *str, const char *src, int len)
64 {
65     int i, v;
66     for(i = 0; i < len; i++) {
67         if (*src)
68             v = *src++;
69         else
70             v = ' ';
71         str[i^1] = v;
72     }
73 }
74 
75 static void put_le16(uint16_t *p, unsigned int v)
76 {
77     *p = cpu_to_le16(v);
78 }
79 
80 static void ide_identify(IDEState *s)
81 {
82     uint16_t *p;
83     unsigned int oldsize;
84     IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
85 
86     if (s->identify_set) {
87 	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
88 	return;
89     }
90 
91     memset(s->io_buffer, 0, 512);
92     p = (uint16_t *)s->io_buffer;
93     put_le16(p + 0, 0x0040);
94     put_le16(p + 1, s->cylinders);
95     put_le16(p + 3, s->heads);
96     put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
97     put_le16(p + 5, 512); /* XXX: retired, remove ? */
98     put_le16(p + 6, s->sectors);
99     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
100     put_le16(p + 20, 3); /* XXX: retired, remove ? */
101     put_le16(p + 21, 512); /* cache size in sectors */
102     put_le16(p + 22, 4); /* ecc bytes */
103     padstr((char *)(p + 23), s->version, 8); /* firmware version */
104     padstr((char *)(p + 27), "QEMU HARDDISK", 40); /* model */
105 #if MAX_MULT_SECTORS > 1
106     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
107 #endif
108     put_le16(p + 48, 1); /* dword I/O */
109     put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
110     put_le16(p + 51, 0x200); /* PIO transfer cycle */
111     put_le16(p + 52, 0x200); /* DMA transfer cycle */
112     put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
113     put_le16(p + 54, s->cylinders);
114     put_le16(p + 55, s->heads);
115     put_le16(p + 56, s->sectors);
116     oldsize = s->cylinders * s->heads * s->sectors;
117     put_le16(p + 57, oldsize);
118     put_le16(p + 58, oldsize >> 16);
119     if (s->mult_sectors)
120         put_le16(p + 59, 0x100 | s->mult_sectors);
121     put_le16(p + 60, s->nb_sectors);
122     put_le16(p + 61, s->nb_sectors >> 16);
123     put_le16(p + 62, 0x07); /* single word dma0-2 supported */
124     put_le16(p + 63, 0x07); /* mdma0-2 supported */
125     put_le16(p + 64, 0x03); /* pio3-4 supported */
126     put_le16(p + 65, 120);
127     put_le16(p + 66, 120);
128     put_le16(p + 67, 120);
129     put_le16(p + 68, 120);
130     if (dev && dev->conf.discard_granularity) {
131         put_le16(p + 69, (1 << 14)); /* determinate TRIM behavior */
132     }
133 
134     if (s->ncq_queues) {
135         put_le16(p + 75, s->ncq_queues - 1);
136         /* NCQ supported */
137         put_le16(p + 76, (1 << 8));
138     }
139 
140     put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
141     put_le16(p + 81, 0x16); /* conforms to ata5 */
142     /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */
143     put_le16(p + 82, (1 << 14) | (1 << 5) | 1);
144     /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
145     put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
146     /* 14=set to 1, 1=SMART self test, 0=SMART error logging */
147     put_le16(p + 84, (1 << 14) | 0);
148     /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */
149     if (bdrv_enable_write_cache(s->bs))
150          put_le16(p + 85, (1 << 14) | (1 << 5) | 1);
151     else
152          put_le16(p + 85, (1 << 14) | 1);
153     /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
154     put_le16(p + 86, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
155     /* 14=set to 1, 1=smart self test, 0=smart error logging */
156     put_le16(p + 87, (1 << 14) | 0);
157     put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
158     put_le16(p + 93, 1 | (1 << 14) | 0x2000);
159     put_le16(p + 100, s->nb_sectors);
160     put_le16(p + 101, s->nb_sectors >> 16);
161     put_le16(p + 102, s->nb_sectors >> 32);
162     put_le16(p + 103, s->nb_sectors >> 48);
163 
164     if (dev && dev->conf.physical_block_size)
165         put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));
166     if (dev && dev->conf.discard_granularity) {
167         put_le16(p + 169, 1); /* TRIM support */
168     }
169 
170     memcpy(s->identify_data, p, sizeof(s->identify_data));
171     s->identify_set = 1;
172 }
173 
174 static void ide_atapi_identify(IDEState *s)
175 {
176     uint16_t *p;
177 
178     if (s->identify_set) {
179 	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
180 	return;
181     }
182 
183     memset(s->io_buffer, 0, 512);
184     p = (uint16_t *)s->io_buffer;
185     /* Removable CDROM, 50us response, 12 byte packets */
186     put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
187     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
188     put_le16(p + 20, 3); /* buffer type */
189     put_le16(p + 21, 512); /* cache size in sectors */
190     put_le16(p + 22, 4); /* ecc bytes */
191     padstr((char *)(p + 23), s->version, 8); /* firmware version */
192     padstr((char *)(p + 27), "QEMU DVD-ROM", 40); /* model */
193     put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
194 #ifdef USE_DMA_CDROM
195     put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
196     put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
197     put_le16(p + 62, 7);  /* single word dma0-2 supported */
198     put_le16(p + 63, 7);  /* mdma0-2 supported */
199 #else
200     put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
201     put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
202     put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
203 #endif
204     put_le16(p + 64, 3); /* pio3-4 supported */
205     put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
206     put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
207     put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
208     put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
209 
210     put_le16(p + 71, 30); /* in ns */
211     put_le16(p + 72, 30); /* in ns */
212 
213     if (s->ncq_queues) {
214         put_le16(p + 75, s->ncq_queues - 1);
215         /* NCQ supported */
216         put_le16(p + 76, (1 << 8));
217     }
218 
219     put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
220 #ifdef USE_DMA_CDROM
221     put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
222 #endif
223     memcpy(s->identify_data, p, sizeof(s->identify_data));
224     s->identify_set = 1;
225 }
226 
227 static void ide_cfata_identify(IDEState *s)
228 {
229     uint16_t *p;
230     uint32_t cur_sec;
231 
232     p = (uint16_t *) s->identify_data;
233     if (s->identify_set)
234         goto fill_buffer;
235 
236     memset(p, 0, sizeof(s->identify_data));
237 
238     cur_sec = s->cylinders * s->heads * s->sectors;
239 
240     put_le16(p + 0, 0x848a);			/* CF Storage Card signature */
241     put_le16(p + 1, s->cylinders);		/* Default cylinders */
242     put_le16(p + 3, s->heads);			/* Default heads */
243     put_le16(p + 6, s->sectors);		/* Default sectors per track */
244     put_le16(p + 7, s->nb_sectors >> 16);	/* Sectors per card */
245     put_le16(p + 8, s->nb_sectors);		/* Sectors per card */
246     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
247     put_le16(p + 22, 0x0004);			/* ECC bytes */
248     padstr((char *) (p + 23), s->version, 8);	/* Firmware Revision */
249     padstr((char *) (p + 27), "QEMU MICRODRIVE", 40);/* Model number */
250 #if MAX_MULT_SECTORS > 1
251     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
252 #else
253     put_le16(p + 47, 0x0000);
254 #endif
255     put_le16(p + 49, 0x0f00);			/* Capabilities */
256     put_le16(p + 51, 0x0002);			/* PIO cycle timing mode */
257     put_le16(p + 52, 0x0001);			/* DMA cycle timing mode */
258     put_le16(p + 53, 0x0003);			/* Translation params valid */
259     put_le16(p + 54, s->cylinders);		/* Current cylinders */
260     put_le16(p + 55, s->heads);			/* Current heads */
261     put_le16(p + 56, s->sectors);		/* Current sectors */
262     put_le16(p + 57, cur_sec);			/* Current capacity */
263     put_le16(p + 58, cur_sec >> 16);		/* Current capacity */
264     if (s->mult_sectors)			/* Multiple sector setting */
265         put_le16(p + 59, 0x100 | s->mult_sectors);
266     put_le16(p + 60, s->nb_sectors);		/* Total LBA sectors */
267     put_le16(p + 61, s->nb_sectors >> 16);	/* Total LBA sectors */
268     put_le16(p + 63, 0x0203);			/* Multiword DMA capability */
269     put_le16(p + 64, 0x0001);			/* Flow Control PIO support */
270     put_le16(p + 65, 0x0096);			/* Min. Multiword DMA cycle */
271     put_le16(p + 66, 0x0096);			/* Rec. Multiword DMA cycle */
272     put_le16(p + 68, 0x00b4);			/* Min. PIO cycle time */
273     put_le16(p + 82, 0x400c);			/* Command Set supported */
274     put_le16(p + 83, 0x7068);			/* Command Set supported */
275     put_le16(p + 84, 0x4000);			/* Features supported */
276     put_le16(p + 85, 0x000c);			/* Command Set enabled */
277     put_le16(p + 86, 0x7044);			/* Command Set enabled */
278     put_le16(p + 87, 0x4000);			/* Features enabled */
279     put_le16(p + 91, 0x4060);			/* Current APM level */
280     put_le16(p + 129, 0x0002);			/* Current features option */
281     put_le16(p + 130, 0x0005);			/* Reassigned sectors */
282     put_le16(p + 131, 0x0001);			/* Initial power mode */
283     put_le16(p + 132, 0x0000);			/* User signature */
284     put_le16(p + 160, 0x8100);			/* Power requirement */
285     put_le16(p + 161, 0x8001);			/* CF command set */
286 
287     s->identify_set = 1;
288 
289 fill_buffer:
290     memcpy(s->io_buffer, p, sizeof(s->identify_data));
291 }
292 
293 static void ide_set_signature(IDEState *s)
294 {
295     s->select &= 0xf0; /* clear head */
296     /* put signature */
297     s->nsector = 1;
298     s->sector = 1;
299     if (s->drive_kind == IDE_CD) {
300         s->lcyl = 0x14;
301         s->hcyl = 0xeb;
302     } else if (s->bs) {
303         s->lcyl = 0;
304         s->hcyl = 0;
305     } else {
306         s->lcyl = 0xff;
307         s->hcyl = 0xff;
308     }
309 }
310 
311 typedef struct TrimAIOCB {
312     BlockDriverAIOCB common;
313     QEMUBH *bh;
314     int ret;
315 } TrimAIOCB;
316 
317 static void trim_aio_cancel(BlockDriverAIOCB *acb)
318 {
319     TrimAIOCB *iocb = container_of(acb, TrimAIOCB, common);
320 
321     qemu_bh_delete(iocb->bh);
322     iocb->bh = NULL;
323     qemu_aio_release(iocb);
324 }
325 
326 static AIOPool trim_aio_pool = {
327     .aiocb_size         = sizeof(TrimAIOCB),
328     .cancel             = trim_aio_cancel,
329 };
330 
331 static void ide_trim_bh_cb(void *opaque)
332 {
333     TrimAIOCB *iocb = opaque;
334 
335     iocb->common.cb(iocb->common.opaque, iocb->ret);
336 
337     qemu_bh_delete(iocb->bh);
338     iocb->bh = NULL;
339 
340     qemu_aio_release(iocb);
341 }
342 
343 BlockDriverAIOCB *ide_issue_trim(BlockDriverState *bs,
344         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
345         BlockDriverCompletionFunc *cb, void *opaque)
346 {
347     TrimAIOCB *iocb;
348     int i, j, ret;
349 
350     iocb = qemu_aio_get(&trim_aio_pool, bs, cb, opaque);
351     iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);
352     iocb->ret = 0;
353 
354     for (j = 0; j < qiov->niov; j++) {
355         uint64_t *buffer = qiov->iov[j].iov_base;
356 
357         for (i = 0; i < qiov->iov[j].iov_len / 8; i++) {
358             /* 6-byte LBA + 2-byte range per entry */
359             uint64_t entry = le64_to_cpu(buffer[i]);
360             uint64_t sector = entry & 0x0000ffffffffffffULL;
361             uint16_t count = entry >> 48;
362 
363             if (count == 0) {
364                 break;
365             }
366 
367             ret = bdrv_discard(bs, sector, count);
368             if (!iocb->ret) {
369                 iocb->ret = ret;
370             }
371         }
372     }
373 
374     qemu_bh_schedule(iocb->bh);
375 
376     return &iocb->common;
377 }
378 
379 static inline void ide_abort_command(IDEState *s)
380 {
381     s->status = READY_STAT | ERR_STAT;
382     s->error = ABRT_ERR;
383 }
384 
385 /* prepare data transfer and tell what to do after */
386 void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
387                         EndTransferFunc *end_transfer_func)
388 {
389     s->end_transfer_func = end_transfer_func;
390     s->data_ptr = buf;
391     s->data_end = buf + size;
392     if (!(s->status & ERR_STAT)) {
393         s->status |= DRQ_STAT;
394     }
395     s->bus->dma->ops->start_transfer(s->bus->dma);
396 }
397 
398 void ide_transfer_stop(IDEState *s)
399 {
400     s->end_transfer_func = ide_transfer_stop;
401     s->data_ptr = s->io_buffer;
402     s->data_end = s->io_buffer;
403     s->status &= ~DRQ_STAT;
404 }
405 
406 int64_t ide_get_sector(IDEState *s)
407 {
408     int64_t sector_num;
409     if (s->select & 0x40) {
410         /* lba */
411 	if (!s->lba48) {
412 	    sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
413 		(s->lcyl << 8) | s->sector;
414 	} else {
415 	    sector_num = ((int64_t)s->hob_hcyl << 40) |
416 		((int64_t) s->hob_lcyl << 32) |
417 		((int64_t) s->hob_sector << 24) |
418 		((int64_t) s->hcyl << 16) |
419 		((int64_t) s->lcyl << 8) | s->sector;
420 	}
421     } else {
422         sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
423             (s->select & 0x0f) * s->sectors + (s->sector - 1);
424     }
425     return sector_num;
426 }
427 
428 void ide_set_sector(IDEState *s, int64_t sector_num)
429 {
430     unsigned int cyl, r;
431     if (s->select & 0x40) {
432 	if (!s->lba48) {
433             s->select = (s->select & 0xf0) | (sector_num >> 24);
434             s->hcyl = (sector_num >> 16);
435             s->lcyl = (sector_num >> 8);
436             s->sector = (sector_num);
437 	} else {
438 	    s->sector = sector_num;
439 	    s->lcyl = sector_num >> 8;
440 	    s->hcyl = sector_num >> 16;
441 	    s->hob_sector = sector_num >> 24;
442 	    s->hob_lcyl = sector_num >> 32;
443 	    s->hob_hcyl = sector_num >> 40;
444 	}
445     } else {
446         cyl = sector_num / (s->heads * s->sectors);
447         r = sector_num % (s->heads * s->sectors);
448         s->hcyl = cyl >> 8;
449         s->lcyl = cyl;
450         s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
451         s->sector = (r % s->sectors) + 1;
452     }
453 }
454 
455 static void ide_rw_error(IDEState *s) {
456     ide_abort_command(s);
457     ide_set_irq(s->bus);
458 }
459 
460 void ide_sector_read(IDEState *s)
461 {
462     int64_t sector_num;
463     int ret, n;
464 
465     s->status = READY_STAT | SEEK_STAT;
466     s->error = 0; /* not needed by IDE spec, but needed by Windows */
467     sector_num = ide_get_sector(s);
468     n = s->nsector;
469     if (n == 0) {
470         /* no more sector to read from disk */
471         ide_transfer_stop(s);
472     } else {
473 #if defined(DEBUG_IDE)
474         printf("read sector=%" PRId64 "\n", sector_num);
475 #endif
476         if (n > s->req_nb_sectors)
477             n = s->req_nb_sectors;
478 
479         bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
480         ret = bdrv_read(s->bs, sector_num, s->io_buffer, n);
481         bdrv_acct_done(s->bs, &s->acct);
482         if (ret != 0) {
483             if (ide_handle_rw_error(s, -ret,
484                 BM_STATUS_PIO_RETRY | BM_STATUS_RETRY_READ))
485             {
486                 return;
487             }
488         }
489         ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read);
490         ide_set_irq(s->bus);
491         ide_set_sector(s, sector_num + n);
492         s->nsector -= n;
493     }
494 }
495 
496 static void dma_buf_commit(IDEState *s)
497 {
498     qemu_sglist_destroy(&s->sg);
499 }
500 
501 void ide_set_inactive(IDEState *s)
502 {
503     s->bus->dma->aiocb = NULL;
504     s->bus->dma->ops->set_inactive(s->bus->dma);
505 }
506 
507 void ide_dma_error(IDEState *s)
508 {
509     ide_transfer_stop(s);
510     s->error = ABRT_ERR;
511     s->status = READY_STAT | ERR_STAT;
512     ide_set_inactive(s);
513     ide_set_irq(s->bus);
514 }
515 
516 static int ide_handle_rw_error(IDEState *s, int error, int op)
517 {
518     int is_read = (op & BM_STATUS_RETRY_READ);
519     BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);
520 
521     if (action == BLOCK_ERR_IGNORE) {
522         bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_IGNORE, is_read);
523         return 0;
524     }
525 
526     if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)
527             || action == BLOCK_ERR_STOP_ANY) {
528         s->bus->dma->ops->set_unit(s->bus->dma, s->unit);
529         s->bus->error_status = op;
530         bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_STOP, is_read);
531         vm_stop(RUN_STATE_IO_ERROR);
532         bdrv_iostatus_set_err(s->bs, error);
533     } else {
534         if (op & BM_STATUS_DMA_RETRY) {
535             dma_buf_commit(s);
536             ide_dma_error(s);
537         } else {
538             ide_rw_error(s);
539         }
540         bdrv_emit_qmp_error_event(s->bs, BDRV_ACTION_REPORT, is_read);
541     }
542 
543     return 1;
544 }
545 
546 void ide_dma_cb(void *opaque, int ret)
547 {
548     IDEState *s = opaque;
549     int n;
550     int64_t sector_num;
551 
552     if (ret < 0) {
553         int op = BM_STATUS_DMA_RETRY;
554 
555         if (s->dma_cmd == IDE_DMA_READ)
556             op |= BM_STATUS_RETRY_READ;
557         else if (s->dma_cmd == IDE_DMA_TRIM)
558             op |= BM_STATUS_RETRY_TRIM;
559 
560         if (ide_handle_rw_error(s, -ret, op)) {
561             return;
562         }
563     }
564 
565     n = s->io_buffer_size >> 9;
566     sector_num = ide_get_sector(s);
567     if (n > 0) {
568         dma_buf_commit(s);
569         sector_num += n;
570         ide_set_sector(s, sector_num);
571         s->nsector -= n;
572     }
573 
574     /* end of transfer ? */
575     if (s->nsector == 0) {
576         s->status = READY_STAT | SEEK_STAT;
577         ide_set_irq(s->bus);
578         goto eot;
579     }
580 
581     /* launch next transfer */
582     n = s->nsector;
583     s->io_buffer_index = 0;
584     s->io_buffer_size = n * 512;
585     if (s->bus->dma->ops->prepare_buf(s->bus->dma, ide_cmd_is_read(s)) == 0) {
586         /* The PRDs were too short. Reset the Active bit, but don't raise an
587          * interrupt. */
588         goto eot;
589     }
590 
591 #ifdef DEBUG_AIO
592     printf("ide_dma_cb: sector_num=%" PRId64 " n=%d, cmd_cmd=%d\n",
593            sector_num, n, s->dma_cmd);
594 #endif
595 
596     switch (s->dma_cmd) {
597     case IDE_DMA_READ:
598         s->bus->dma->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
599                                            ide_dma_cb, s);
600         break;
601     case IDE_DMA_WRITE:
602         s->bus->dma->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num,
603                                             ide_dma_cb, s);
604         break;
605     case IDE_DMA_TRIM:
606         s->bus->dma->aiocb = dma_bdrv_io(s->bs, &s->sg, sector_num,
607                                          ide_issue_trim, ide_dma_cb, s, true);
608         break;
609     }
610     return;
611 
612 eot:
613     if (s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) {
614         bdrv_acct_done(s->bs, &s->acct);
615     }
616     ide_set_inactive(s);
617 }
618 
619 static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
620 {
621     s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
622     s->io_buffer_index = 0;
623     s->io_buffer_size = 0;
624     s->dma_cmd = dma_cmd;
625 
626     switch (dma_cmd) {
627     case IDE_DMA_READ:
628         bdrv_acct_start(s->bs, &s->acct, s->nsector * BDRV_SECTOR_SIZE,
629                         BDRV_ACCT_READ);
630         break;
631     case IDE_DMA_WRITE:
632         bdrv_acct_start(s->bs, &s->acct, s->nsector * BDRV_SECTOR_SIZE,
633                         BDRV_ACCT_WRITE);
634         break;
635     default:
636         break;
637     }
638 
639     s->bus->dma->ops->start_dma(s->bus->dma, s, ide_dma_cb);
640 }
641 
642 static void ide_sector_write_timer_cb(void *opaque)
643 {
644     IDEState *s = opaque;
645     ide_set_irq(s->bus);
646 }
647 
648 void ide_sector_write(IDEState *s)
649 {
650     int64_t sector_num;
651     int ret, n, n1;
652 
653     s->status = READY_STAT | SEEK_STAT;
654     sector_num = ide_get_sector(s);
655 #if defined(DEBUG_IDE)
656     printf("write sector=%" PRId64 "\n", sector_num);
657 #endif
658     n = s->nsector;
659     if (n > s->req_nb_sectors)
660         n = s->req_nb_sectors;
661 
662     bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
663     ret = bdrv_write(s->bs, sector_num, s->io_buffer, n);
664     bdrv_acct_done(s->bs, &s->acct);
665 
666     if (ret != 0) {
667         if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY))
668             return;
669     }
670 
671     s->nsector -= n;
672     if (s->nsector == 0) {
673         /* no more sectors to write */
674         ide_transfer_stop(s);
675     } else {
676         n1 = s->nsector;
677         if (n1 > s->req_nb_sectors)
678             n1 = s->req_nb_sectors;
679         ide_transfer_start(s, s->io_buffer, 512 * n1, ide_sector_write);
680     }
681     ide_set_sector(s, sector_num + n);
682 
683     if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
684         /* It seems there is a bug in the Windows 2000 installer HDD
685            IDE driver which fills the disk with empty logs when the
686            IDE write IRQ comes too early. This hack tries to correct
687            that at the expense of slower write performances. Use this
688            option _only_ to install Windows 2000. You must disable it
689            for normal use. */
690         qemu_mod_timer(s->sector_write_timer,
691                        qemu_get_clock_ns(vm_clock) + (get_ticks_per_sec() / 1000));
692     } else {
693         ide_set_irq(s->bus);
694     }
695 }
696 
697 static void ide_flush_cb(void *opaque, int ret)
698 {
699     IDEState *s = opaque;
700 
701     if (ret < 0) {
702         /* XXX: What sector number to set here? */
703         if (ide_handle_rw_error(s, -ret, BM_STATUS_RETRY_FLUSH)) {
704             return;
705         }
706     }
707 
708     bdrv_acct_done(s->bs, &s->acct);
709     s->status = READY_STAT | SEEK_STAT;
710     ide_set_irq(s->bus);
711 }
712 
713 void ide_flush_cache(IDEState *s)
714 {
715     if (s->bs == NULL) {
716         ide_flush_cb(s, 0);
717         return;
718     }
719 
720     bdrv_acct_start(s->bs, &s->acct, 0, BDRV_ACCT_FLUSH);
721     bdrv_aio_flush(s->bs, ide_flush_cb, s);
722 }
723 
724 static void ide_cfata_metadata_inquiry(IDEState *s)
725 {
726     uint16_t *p;
727     uint32_t spd;
728 
729     p = (uint16_t *) s->io_buffer;
730     memset(p, 0, 0x200);
731     spd = ((s->mdata_size - 1) >> 9) + 1;
732 
733     put_le16(p + 0, 0x0001);			/* Data format revision */
734     put_le16(p + 1, 0x0000);			/* Media property: silicon */
735     put_le16(p + 2, s->media_changed);		/* Media status */
736     put_le16(p + 3, s->mdata_size & 0xffff);	/* Capacity in bytes (low) */
737     put_le16(p + 4, s->mdata_size >> 16);	/* Capacity in bytes (high) */
738     put_le16(p + 5, spd & 0xffff);		/* Sectors per device (low) */
739     put_le16(p + 6, spd >> 16);			/* Sectors per device (high) */
740 }
741 
742 static void ide_cfata_metadata_read(IDEState *s)
743 {
744     uint16_t *p;
745 
746     if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
747         s->status = ERR_STAT;
748         s->error = ABRT_ERR;
749         return;
750     }
751 
752     p = (uint16_t *) s->io_buffer;
753     memset(p, 0, 0x200);
754 
755     put_le16(p + 0, s->media_changed);		/* Media status */
756     memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
757                     MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
758                                     s->nsector << 9), 0x200 - 2));
759 }
760 
761 static void ide_cfata_metadata_write(IDEState *s)
762 {
763     if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
764         s->status = ERR_STAT;
765         s->error = ABRT_ERR;
766         return;
767     }
768 
769     s->media_changed = 0;
770 
771     memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
772                     s->io_buffer + 2,
773                     MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
774                                     s->nsector << 9), 0x200 - 2));
775 }
776 
777 /* called when the inserted state of the media has changed */
778 static void ide_cd_change_cb(void *opaque, bool load)
779 {
780     IDEState *s = opaque;
781     uint64_t nb_sectors;
782 
783     s->tray_open = !load;
784     bdrv_get_geometry(s->bs, &nb_sectors);
785     s->nb_sectors = nb_sectors;
786 
787     /*
788      * First indicate to the guest that a CD has been removed.  That's
789      * done on the next command the guest sends us.
790      *
791      * Then we set UNIT_ATTENTION, by which the guest will
792      * detect a new CD in the drive.  See ide_atapi_cmd() for details.
793      */
794     s->cdrom_changed = 1;
795     s->events.new_media = true;
796     s->events.eject_request = false;
797     ide_set_irq(s->bus);
798 }
799 
800 static void ide_cd_eject_request_cb(void *opaque, bool force)
801 {
802     IDEState *s = opaque;
803 
804     s->events.eject_request = true;
805     if (force) {
806         s->tray_locked = false;
807     }
808     ide_set_irq(s->bus);
809 }
810 
811 static void ide_cmd_lba48_transform(IDEState *s, int lba48)
812 {
813     s->lba48 = lba48;
814 
815     /* handle the 'magic' 0 nsector count conversion here. to avoid
816      * fiddling with the rest of the read logic, we just store the
817      * full sector count in ->nsector and ignore ->hob_nsector from now
818      */
819     if (!s->lba48) {
820 	if (!s->nsector)
821 	    s->nsector = 256;
822     } else {
823 	if (!s->nsector && !s->hob_nsector)
824 	    s->nsector = 65536;
825 	else {
826 	    int lo = s->nsector;
827 	    int hi = s->hob_nsector;
828 
829 	    s->nsector = (hi << 8) | lo;
830 	}
831     }
832 }
833 
834 static void ide_clear_hob(IDEBus *bus)
835 {
836     /* any write clears HOB high bit of device control register */
837     bus->ifs[0].select &= ~(1 << 7);
838     bus->ifs[1].select &= ~(1 << 7);
839 }
840 
841 void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
842 {
843     IDEBus *bus = opaque;
844 
845 #ifdef DEBUG_IDE
846     printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
847 #endif
848 
849     addr &= 7;
850 
851     /* ignore writes to command block while busy with previous command */
852     if (addr != 7 && (idebus_active_if(bus)->status & (BUSY_STAT|DRQ_STAT)))
853         return;
854 
855     switch(addr) {
856     case 0:
857         break;
858     case 1:
859 	ide_clear_hob(bus);
860         /* NOTE: data is written to the two drives */
861 	bus->ifs[0].hob_feature = bus->ifs[0].feature;
862 	bus->ifs[1].hob_feature = bus->ifs[1].feature;
863         bus->ifs[0].feature = val;
864         bus->ifs[1].feature = val;
865         break;
866     case 2:
867 	ide_clear_hob(bus);
868 	bus->ifs[0].hob_nsector = bus->ifs[0].nsector;
869 	bus->ifs[1].hob_nsector = bus->ifs[1].nsector;
870         bus->ifs[0].nsector = val;
871         bus->ifs[1].nsector = val;
872         break;
873     case 3:
874 	ide_clear_hob(bus);
875 	bus->ifs[0].hob_sector = bus->ifs[0].sector;
876 	bus->ifs[1].hob_sector = bus->ifs[1].sector;
877         bus->ifs[0].sector = val;
878         bus->ifs[1].sector = val;
879         break;
880     case 4:
881 	ide_clear_hob(bus);
882 	bus->ifs[0].hob_lcyl = bus->ifs[0].lcyl;
883 	bus->ifs[1].hob_lcyl = bus->ifs[1].lcyl;
884         bus->ifs[0].lcyl = val;
885         bus->ifs[1].lcyl = val;
886         break;
887     case 5:
888 	ide_clear_hob(bus);
889 	bus->ifs[0].hob_hcyl = bus->ifs[0].hcyl;
890 	bus->ifs[1].hob_hcyl = bus->ifs[1].hcyl;
891         bus->ifs[0].hcyl = val;
892         bus->ifs[1].hcyl = val;
893         break;
894     case 6:
895 	/* FIXME: HOB readback uses bit 7 */
896         bus->ifs[0].select = (val & ~0x10) | 0xa0;
897         bus->ifs[1].select = (val | 0x10) | 0xa0;
898         /* select drive */
899         bus->unit = (val >> 4) & 1;
900         break;
901     default:
902     case 7:
903         /* command */
904         ide_exec_cmd(bus, val);
905         break;
906     }
907 }
908 
909 #define HD_OK (1u << IDE_HD)
910 #define CD_OK (1u << IDE_CD)
911 #define CFA_OK (1u << IDE_CFATA)
912 #define HD_CFA_OK (HD_OK | CFA_OK)
913 #define ALL_OK (HD_OK | CD_OK | CFA_OK)
914 
915 /* See ACS-2 T13/2015-D Table B.2 Command codes */
916 static const uint8_t ide_cmd_table[0x100] = {
917     /* NOP not implemented, mandatory for CD */
918     [CFA_REQ_EXT_ERROR_CODE]            = CFA_OK,
919     [WIN_DSM]                           = ALL_OK,
920     [WIN_DEVICE_RESET]                  = CD_OK,
921     [WIN_RECAL]                         = HD_CFA_OK,
922     [WIN_READ]                          = ALL_OK,
923     [WIN_READ_ONCE]                     = ALL_OK,
924     [WIN_READ_EXT]                      = HD_CFA_OK,
925     [WIN_READDMA_EXT]                   = HD_CFA_OK,
926     [WIN_READ_NATIVE_MAX_EXT]           = HD_CFA_OK,
927     [WIN_MULTREAD_EXT]                  = HD_CFA_OK,
928     [WIN_WRITE]                         = HD_CFA_OK,
929     [WIN_WRITE_ONCE]                    = HD_CFA_OK,
930     [WIN_WRITE_EXT]                     = HD_CFA_OK,
931     [WIN_WRITEDMA_EXT]                  = HD_CFA_OK,
932     [CFA_WRITE_SECT_WO_ERASE]           = CFA_OK,
933     [WIN_MULTWRITE_EXT]                 = HD_CFA_OK,
934     [WIN_WRITE_VERIFY]                  = HD_CFA_OK,
935     [WIN_VERIFY]                        = HD_CFA_OK,
936     [WIN_VERIFY_ONCE]                   = HD_CFA_OK,
937     [WIN_VERIFY_EXT]                    = HD_CFA_OK,
938     [WIN_SEEK]                          = HD_CFA_OK,
939     [CFA_TRANSLATE_SECTOR]              = CFA_OK,
940     [WIN_DIAGNOSE]                      = ALL_OK,
941     [WIN_SPECIFY]                       = HD_CFA_OK,
942     [WIN_STANDBYNOW2]                   = ALL_OK,
943     [WIN_IDLEIMMEDIATE2]                = ALL_OK,
944     [WIN_STANDBY2]                      = ALL_OK,
945     [WIN_SETIDLE2]                      = ALL_OK,
946     [WIN_CHECKPOWERMODE2]               = ALL_OK,
947     [WIN_SLEEPNOW2]                     = ALL_OK,
948     [WIN_PACKETCMD]                     = CD_OK,
949     [WIN_PIDENTIFY]                     = CD_OK,
950     [WIN_SMART]                         = HD_CFA_OK,
951     [CFA_ACCESS_METADATA_STORAGE]       = CFA_OK,
952     [CFA_ERASE_SECTORS]                 = CFA_OK,
953     [WIN_MULTREAD]                      = HD_CFA_OK,
954     [WIN_MULTWRITE]                     = HD_CFA_OK,
955     [WIN_SETMULT]                       = HD_CFA_OK,
956     [WIN_READDMA]                       = HD_CFA_OK,
957     [WIN_READDMA_ONCE]                  = HD_CFA_OK,
958     [WIN_WRITEDMA]                      = HD_CFA_OK,
959     [WIN_WRITEDMA_ONCE]                 = HD_CFA_OK,
960     [CFA_WRITE_MULTI_WO_ERASE]          = CFA_OK,
961     [WIN_STANDBYNOW1]                   = ALL_OK,
962     [WIN_IDLEIMMEDIATE]                 = ALL_OK,
963     [WIN_STANDBY]                       = ALL_OK,
964     [WIN_SETIDLE1]                      = ALL_OK,
965     [WIN_CHECKPOWERMODE1]               = ALL_OK,
966     [WIN_SLEEPNOW1]                     = ALL_OK,
967     [WIN_FLUSH_CACHE]                   = ALL_OK,
968     [WIN_FLUSH_CACHE_EXT]               = HD_CFA_OK,
969     [WIN_IDENTIFY]                      = ALL_OK,
970     [WIN_SETFEATURES]                   = ALL_OK,
971     [IBM_SENSE_CONDITION]               = CFA_OK,
972     [CFA_WEAR_LEVEL]                    = CFA_OK,
973     [WIN_READ_NATIVE_MAX]               = ALL_OK,
974 };
975 
976 static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
977 {
978     return cmd < ARRAY_SIZE(ide_cmd_table)
979         && (ide_cmd_table[cmd] & (1u << s->drive_kind));
980 }
981 
982 void ide_exec_cmd(IDEBus *bus, uint32_t val)
983 {
984     IDEState *s;
985     int n;
986     int lba48 = 0;
987 
988 #if defined(DEBUG_IDE)
989     printf("ide: CMD=%02x\n", val);
990 #endif
991     s = idebus_active_if(bus);
992     /* ignore commands to non existent slave */
993     if (s != bus->ifs && !s->bs)
994         return;
995 
996     /* Only DEVICE RESET is allowed while BSY or/and DRQ are set */
997     if ((s->status & (BUSY_STAT|DRQ_STAT)) && val != WIN_DEVICE_RESET)
998         return;
999 
1000     if (!ide_cmd_permitted(s, val)) {
1001         goto abort_cmd;
1002     }
1003 
1004     switch(val) {
1005     case WIN_DSM:
1006         switch (s->feature) {
1007         case DSM_TRIM:
1008             if (!s->bs) {
1009                 goto abort_cmd;
1010             }
1011             ide_sector_start_dma(s, IDE_DMA_TRIM);
1012             break;
1013         default:
1014             goto abort_cmd;
1015         }
1016         break;
1017     case WIN_IDENTIFY:
1018         if (s->bs && s->drive_kind != IDE_CD) {
1019             if (s->drive_kind != IDE_CFATA)
1020                 ide_identify(s);
1021             else
1022                 ide_cfata_identify(s);
1023             s->status = READY_STAT | SEEK_STAT;
1024             ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1025         } else {
1026             if (s->drive_kind == IDE_CD) {
1027                 ide_set_signature(s);
1028             }
1029             ide_abort_command(s);
1030         }
1031         ide_set_irq(s->bus);
1032         break;
1033     case WIN_SPECIFY:
1034     case WIN_RECAL:
1035         s->error = 0;
1036         s->status = READY_STAT | SEEK_STAT;
1037         ide_set_irq(s->bus);
1038         break;
1039     case WIN_SETMULT:
1040         if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
1041             /* Disable Read and Write Multiple */
1042             s->mult_sectors = 0;
1043             s->status = READY_STAT | SEEK_STAT;
1044         } else if ((s->nsector & 0xff) != 0 &&
1045             ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
1046              (s->nsector & (s->nsector - 1)) != 0)) {
1047             ide_abort_command(s);
1048         } else {
1049             s->mult_sectors = s->nsector & 0xff;
1050             s->status = READY_STAT | SEEK_STAT;
1051         }
1052         ide_set_irq(s->bus);
1053         break;
1054     case WIN_VERIFY_EXT:
1055 	lba48 = 1;
1056     case WIN_VERIFY:
1057     case WIN_VERIFY_ONCE:
1058         /* do sector number check ? */
1059 	ide_cmd_lba48_transform(s, lba48);
1060         s->status = READY_STAT | SEEK_STAT;
1061         ide_set_irq(s->bus);
1062         break;
1063     case WIN_READ_EXT:
1064 	lba48 = 1;
1065     case WIN_READ:
1066     case WIN_READ_ONCE:
1067         if (s->drive_kind == IDE_CD) {
1068             ide_set_signature(s); /* odd, but ATA4 8.27.5.2 requires it */
1069             goto abort_cmd;
1070         }
1071         if (!s->bs) {
1072             goto abort_cmd;
1073         }
1074 	ide_cmd_lba48_transform(s, lba48);
1075         s->req_nb_sectors = 1;
1076         ide_sector_read(s);
1077         break;
1078     case WIN_WRITE_EXT:
1079 	lba48 = 1;
1080     case WIN_WRITE:
1081     case WIN_WRITE_ONCE:
1082     case CFA_WRITE_SECT_WO_ERASE:
1083     case WIN_WRITE_VERIFY:
1084         if (!s->bs) {
1085             goto abort_cmd;
1086         }
1087 	ide_cmd_lba48_transform(s, lba48);
1088         s->error = 0;
1089         s->status = SEEK_STAT | READY_STAT;
1090         s->req_nb_sectors = 1;
1091         ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
1092         s->media_changed = 1;
1093         break;
1094     case WIN_MULTREAD_EXT:
1095 	lba48 = 1;
1096     case WIN_MULTREAD:
1097         if (!s->bs) {
1098             goto abort_cmd;
1099         }
1100         if (!s->mult_sectors) {
1101             goto abort_cmd;
1102         }
1103 	ide_cmd_lba48_transform(s, lba48);
1104         s->req_nb_sectors = s->mult_sectors;
1105         ide_sector_read(s);
1106         break;
1107     case WIN_MULTWRITE_EXT:
1108 	lba48 = 1;
1109     case WIN_MULTWRITE:
1110     case CFA_WRITE_MULTI_WO_ERASE:
1111         if (!s->bs) {
1112             goto abort_cmd;
1113         }
1114         if (!s->mult_sectors) {
1115             goto abort_cmd;
1116         }
1117 	ide_cmd_lba48_transform(s, lba48);
1118         s->error = 0;
1119         s->status = SEEK_STAT | READY_STAT;
1120         s->req_nb_sectors = s->mult_sectors;
1121         n = s->nsector;
1122         if (n > s->req_nb_sectors)
1123             n = s->req_nb_sectors;
1124         ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
1125         s->media_changed = 1;
1126         break;
1127     case WIN_READDMA_EXT:
1128 	lba48 = 1;
1129     case WIN_READDMA:
1130     case WIN_READDMA_ONCE:
1131         if (!s->bs) {
1132             goto abort_cmd;
1133         }
1134 	ide_cmd_lba48_transform(s, lba48);
1135         ide_sector_start_dma(s, IDE_DMA_READ);
1136         break;
1137     case WIN_WRITEDMA_EXT:
1138 	lba48 = 1;
1139     case WIN_WRITEDMA:
1140     case WIN_WRITEDMA_ONCE:
1141         if (!s->bs) {
1142             goto abort_cmd;
1143         }
1144 	ide_cmd_lba48_transform(s, lba48);
1145         ide_sector_start_dma(s, IDE_DMA_WRITE);
1146         s->media_changed = 1;
1147         break;
1148     case WIN_READ_NATIVE_MAX_EXT:
1149 	lba48 = 1;
1150     case WIN_READ_NATIVE_MAX:
1151 	ide_cmd_lba48_transform(s, lba48);
1152         ide_set_sector(s, s->nb_sectors - 1);
1153         s->status = READY_STAT | SEEK_STAT;
1154         ide_set_irq(s->bus);
1155         break;
1156     case WIN_CHECKPOWERMODE1:
1157     case WIN_CHECKPOWERMODE2:
1158         s->error = 0;
1159         s->nsector = 0xff; /* device active or idle */
1160         s->status = READY_STAT | SEEK_STAT;
1161         ide_set_irq(s->bus);
1162         break;
1163     case WIN_SETFEATURES:
1164         if (!s->bs)
1165             goto abort_cmd;
1166         /* XXX: valid for CDROM ? */
1167         switch(s->feature) {
1168         case 0xcc: /* reverting to power-on defaults enable */
1169         case 0x66: /* reverting to power-on defaults disable */
1170         case 0x02: /* write cache enable */
1171         case 0x82: /* write cache disable */
1172         case 0xaa: /* read look-ahead enable */
1173         case 0x55: /* read look-ahead disable */
1174         case 0x05: /* set advanced power management mode */
1175         case 0x85: /* disable advanced power management mode */
1176         case 0x69: /* NOP */
1177         case 0x67: /* NOP */
1178         case 0x96: /* NOP */
1179         case 0x9a: /* NOP */
1180         case 0x42: /* enable Automatic Acoustic Mode */
1181         case 0xc2: /* disable Automatic Acoustic Mode */
1182             s->status = READY_STAT | SEEK_STAT;
1183             ide_set_irq(s->bus);
1184             break;
1185         case 0x03: { /* set transfer mode */
1186 		uint8_t val = s->nsector & 0x07;
1187             uint16_t *identify_data = (uint16_t *)s->identify_data;
1188 
1189 		switch (s->nsector >> 3) {
1190 		case 0x00: /* pio default */
1191 		case 0x01: /* pio mode */
1192 			put_le16(identify_data + 62,0x07);
1193 			put_le16(identify_data + 63,0x07);
1194 			put_le16(identify_data + 88,0x3f);
1195 			break;
1196                 case 0x02: /* sigle word dma mode*/
1197 			put_le16(identify_data + 62,0x07 | (1 << (val + 8)));
1198 			put_le16(identify_data + 63,0x07);
1199 			put_le16(identify_data + 88,0x3f);
1200 			break;
1201 		case 0x04: /* mdma mode */
1202 			put_le16(identify_data + 62,0x07);
1203 			put_le16(identify_data + 63,0x07 | (1 << (val + 8)));
1204 			put_le16(identify_data + 88,0x3f);
1205 			break;
1206 		case 0x08: /* udma mode */
1207 			put_le16(identify_data + 62,0x07);
1208 			put_le16(identify_data + 63,0x07);
1209 			put_le16(identify_data + 88,0x3f | (1 << (val + 8)));
1210 			break;
1211 		default:
1212 			goto abort_cmd;
1213 		}
1214             s->status = READY_STAT | SEEK_STAT;
1215             ide_set_irq(s->bus);
1216             break;
1217 	}
1218         default:
1219             goto abort_cmd;
1220         }
1221         break;
1222     case WIN_FLUSH_CACHE:
1223     case WIN_FLUSH_CACHE_EXT:
1224         ide_flush_cache(s);
1225         break;
1226     case WIN_STANDBY:
1227     case WIN_STANDBY2:
1228     case WIN_STANDBYNOW1:
1229     case WIN_STANDBYNOW2:
1230     case WIN_IDLEIMMEDIATE:
1231     case WIN_IDLEIMMEDIATE2:
1232     case WIN_SETIDLE1:
1233     case WIN_SETIDLE2:
1234     case WIN_SLEEPNOW1:
1235     case WIN_SLEEPNOW2:
1236         s->status = READY_STAT;
1237         ide_set_irq(s->bus);
1238         break;
1239     case WIN_SEEK:
1240         /* XXX: Check that seek is within bounds */
1241         s->status = READY_STAT | SEEK_STAT;
1242         ide_set_irq(s->bus);
1243         break;
1244         /* ATAPI commands */
1245     case WIN_PIDENTIFY:
1246         ide_atapi_identify(s);
1247         s->status = READY_STAT | SEEK_STAT;
1248         ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1249         ide_set_irq(s->bus);
1250         break;
1251     case WIN_DIAGNOSE:
1252         ide_set_signature(s);
1253         if (s->drive_kind == IDE_CD)
1254             s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
1255                             * devices to return a clear status register
1256                             * with READY_STAT *not* set. */
1257         else
1258             s->status = READY_STAT | SEEK_STAT;
1259         s->error = 0x01; /* Device 0 passed, Device 1 passed or not
1260                           * present.
1261                           */
1262         ide_set_irq(s->bus);
1263         break;
1264     case WIN_DEVICE_RESET:
1265         ide_set_signature(s);
1266         s->status = 0x00; /* NOTE: READY is _not_ set */
1267         s->error = 0x01;
1268         break;
1269     case WIN_PACKETCMD:
1270         /* overlapping commands not supported */
1271         if (s->feature & 0x02)
1272             goto abort_cmd;
1273         s->status = READY_STAT | SEEK_STAT;
1274         s->atapi_dma = s->feature & 1;
1275         s->nsector = 1;
1276         ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
1277                            ide_atapi_cmd);
1278         break;
1279     /* CF-ATA commands */
1280     case CFA_REQ_EXT_ERROR_CODE:
1281         s->error = 0x09;    /* miscellaneous error */
1282         s->status = READY_STAT | SEEK_STAT;
1283         ide_set_irq(s->bus);
1284         break;
1285     case CFA_ERASE_SECTORS:
1286     case CFA_WEAR_LEVEL:
1287         if (val == CFA_WEAR_LEVEL)
1288             s->nsector = 0;
1289         if (val == CFA_ERASE_SECTORS)
1290             s->media_changed = 1;
1291         s->error = 0x00;
1292         s->status = READY_STAT | SEEK_STAT;
1293         ide_set_irq(s->bus);
1294         break;
1295     case CFA_TRANSLATE_SECTOR:
1296         s->error = 0x00;
1297         s->status = READY_STAT | SEEK_STAT;
1298         memset(s->io_buffer, 0, 0x200);
1299         s->io_buffer[0x00] = s->hcyl;			/* Cyl MSB */
1300         s->io_buffer[0x01] = s->lcyl;			/* Cyl LSB */
1301         s->io_buffer[0x02] = s->select;			/* Head */
1302         s->io_buffer[0x03] = s->sector;			/* Sector */
1303         s->io_buffer[0x04] = ide_get_sector(s) >> 16;	/* LBA MSB */
1304         s->io_buffer[0x05] = ide_get_sector(s) >> 8;	/* LBA */
1305         s->io_buffer[0x06] = ide_get_sector(s) >> 0;	/* LBA LSB */
1306         s->io_buffer[0x13] = 0x00;				/* Erase flag */
1307         s->io_buffer[0x18] = 0x00;				/* Hot count */
1308         s->io_buffer[0x19] = 0x00;				/* Hot count */
1309         s->io_buffer[0x1a] = 0x01;				/* Hot count */
1310         ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1311         ide_set_irq(s->bus);
1312         break;
1313     case CFA_ACCESS_METADATA_STORAGE:
1314         switch (s->feature) {
1315         case 0x02:	/* Inquiry Metadata Storage */
1316             ide_cfata_metadata_inquiry(s);
1317             break;
1318         case 0x03:	/* Read Metadata Storage */
1319             ide_cfata_metadata_read(s);
1320             break;
1321         case 0x04:	/* Write Metadata Storage */
1322             ide_cfata_metadata_write(s);
1323             break;
1324         default:
1325             goto abort_cmd;
1326         }
1327         ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1328         s->status = 0x00; /* NOTE: READY is _not_ set */
1329         ide_set_irq(s->bus);
1330         break;
1331     case IBM_SENSE_CONDITION:
1332         switch (s->feature) {
1333         case 0x01:  /* sense temperature in device */
1334             s->nsector = 0x50;      /* +20 C */
1335             break;
1336         default:
1337             goto abort_cmd;
1338         }
1339         s->status = READY_STAT | SEEK_STAT;
1340         ide_set_irq(s->bus);
1341         break;
1342 
1343     case WIN_SMART:
1344 	if (s->hcyl != 0xc2 || s->lcyl != 0x4f)
1345 		goto abort_cmd;
1346 	if (!s->smart_enabled && s->feature != SMART_ENABLE)
1347 		goto abort_cmd;
1348 	switch (s->feature) {
1349 	case SMART_DISABLE:
1350 		s->smart_enabled = 0;
1351 		s->status = READY_STAT | SEEK_STAT;
1352 		ide_set_irq(s->bus);
1353 		break;
1354 	case SMART_ENABLE:
1355 		s->smart_enabled = 1;
1356 		s->status = READY_STAT | SEEK_STAT;
1357 		ide_set_irq(s->bus);
1358 		break;
1359 	case SMART_ATTR_AUTOSAVE:
1360 		switch (s->sector) {
1361 		case 0x00:
1362 		s->smart_autosave = 0;
1363 		break;
1364 		case 0xf1:
1365 		s->smart_autosave = 1;
1366 		break;
1367 		default:
1368 		goto abort_cmd;
1369 		}
1370 		s->status = READY_STAT | SEEK_STAT;
1371 		ide_set_irq(s->bus);
1372 		break;
1373 	case SMART_STATUS:
1374 		if (!s->smart_errors) {
1375 		s->hcyl = 0xc2;
1376 		s->lcyl = 0x4f;
1377 		} else {
1378 		s->hcyl = 0x2c;
1379 		s->lcyl = 0xf4;
1380 		}
1381 		s->status = READY_STAT | SEEK_STAT;
1382 		ide_set_irq(s->bus);
1383 		break;
1384 	case SMART_READ_THRESH:
1385 		memset(s->io_buffer, 0, 0x200);
1386 		s->io_buffer[0] = 0x01; /* smart struct version */
1387 		for (n=0; n<30; n++) {
1388 		if (smart_attributes[n][0] == 0)
1389 			break;
1390 		s->io_buffer[2+0+(n*12)] = smart_attributes[n][0];
1391 		s->io_buffer[2+1+(n*12)] = smart_attributes[n][11];
1392 		}
1393 		for (n=0; n<511; n++) /* checksum */
1394 		s->io_buffer[511] += s->io_buffer[n];
1395 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1396 		s->status = READY_STAT | SEEK_STAT;
1397 		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1398 		ide_set_irq(s->bus);
1399 		break;
1400 	case SMART_READ_DATA:
1401 		memset(s->io_buffer, 0, 0x200);
1402 		s->io_buffer[0] = 0x01; /* smart struct version */
1403 		for (n=0; n<30; n++) {
1404 		    if (smart_attributes[n][0] == 0) {
1405 			break;
1406 		    }
1407 		    int i;
1408 		    for(i = 0; i < 11; i++) {
1409 			s->io_buffer[2+i+(n*12)] = smart_attributes[n][i];
1410 		    }
1411 		}
1412 		s->io_buffer[362] = 0x02 | (s->smart_autosave?0x80:0x00);
1413 		if (s->smart_selftest_count == 0) {
1414 		s->io_buffer[363] = 0;
1415 		} else {
1416 		s->io_buffer[363] =
1417 			s->smart_selftest_data[3 +
1418 					   (s->smart_selftest_count - 1) *
1419 					   24];
1420 		}
1421 		s->io_buffer[364] = 0x20;
1422 		s->io_buffer[365] = 0x01;
1423 		/* offline data collection capacity: execute + self-test*/
1424 		s->io_buffer[367] = (1<<4 | 1<<3 | 1);
1425 		s->io_buffer[368] = 0x03; /* smart capability (1) */
1426 		s->io_buffer[369] = 0x00; /* smart capability (2) */
1427 		s->io_buffer[370] = 0x01; /* error logging supported */
1428 		s->io_buffer[372] = 0x02; /* minutes for poll short test */
1429 		s->io_buffer[373] = 0x36; /* minutes for poll ext test */
1430 		s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
1431 
1432 		for (n=0; n<511; n++)
1433 		s->io_buffer[511] += s->io_buffer[n];
1434 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1435 		s->status = READY_STAT | SEEK_STAT;
1436 		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1437 		ide_set_irq(s->bus);
1438 		break;
1439 	case SMART_READ_LOG:
1440 		switch (s->sector) {
1441 		case 0x01: /* summary smart error log */
1442 		memset(s->io_buffer, 0, 0x200);
1443 		s->io_buffer[0] = 0x01;
1444 		s->io_buffer[1] = 0x00; /* no error entries */
1445 		s->io_buffer[452] = s->smart_errors & 0xff;
1446 		s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
1447 
1448 		for (n=0; n<511; n++)
1449 			s->io_buffer[511] += s->io_buffer[n];
1450 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1451 		break;
1452 		case 0x06: /* smart self test log */
1453 		memset(s->io_buffer, 0, 0x200);
1454 		s->io_buffer[0] = 0x01;
1455 		if (s->smart_selftest_count == 0) {
1456 			s->io_buffer[508] = 0;
1457 		} else {
1458 			s->io_buffer[508] = s->smart_selftest_count;
1459 			for (n=2; n<506; n++)
1460 			s->io_buffer[n] = s->smart_selftest_data[n];
1461 		}
1462 		for (n=0; n<511; n++)
1463 			s->io_buffer[511] += s->io_buffer[n];
1464 		s->io_buffer[511] = 0x100 - s->io_buffer[511];
1465 		break;
1466 		default:
1467 		goto abort_cmd;
1468 		}
1469 		s->status = READY_STAT | SEEK_STAT;
1470 		ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1471 		ide_set_irq(s->bus);
1472 		break;
1473 	case SMART_EXECUTE_OFFLINE:
1474 		switch (s->sector) {
1475 		case 0: /* off-line routine */
1476 		case 1: /* short self test */
1477 		case 2: /* extended self test */
1478 		s->smart_selftest_count++;
1479 		if(s->smart_selftest_count > 21)
1480 			s->smart_selftest_count = 0;
1481 		n = 2 + (s->smart_selftest_count - 1) * 24;
1482 		s->smart_selftest_data[n] = s->sector;
1483 		s->smart_selftest_data[n+1] = 0x00; /* OK and finished */
1484 		s->smart_selftest_data[n+2] = 0x34; /* hour count lsb */
1485 		s->smart_selftest_data[n+3] = 0x12; /* hour count msb */
1486 		s->status = READY_STAT | SEEK_STAT;
1487 		ide_set_irq(s->bus);
1488 		break;
1489 		default:
1490 		goto abort_cmd;
1491 		}
1492 		break;
1493 	default:
1494 		goto abort_cmd;
1495 	}
1496 	break;
1497     default:
1498         /* should not be reachable */
1499     abort_cmd:
1500         ide_abort_command(s);
1501         ide_set_irq(s->bus);
1502         break;
1503     }
1504 }
1505 
1506 uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
1507 {
1508     IDEBus *bus = opaque;
1509     IDEState *s = idebus_active_if(bus);
1510     uint32_t addr;
1511     int ret, hob;
1512 
1513     addr = addr1 & 7;
1514     /* FIXME: HOB readback uses bit 7, but it's always set right now */
1515     //hob = s->select & (1 << 7);
1516     hob = 0;
1517     switch(addr) {
1518     case 0:
1519         ret = 0xff;
1520         break;
1521     case 1:
1522         if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1523             (s != bus->ifs && !s->bs))
1524             ret = 0;
1525         else if (!hob)
1526             ret = s->error;
1527 	else
1528 	    ret = s->hob_feature;
1529         break;
1530     case 2:
1531         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1532             ret = 0;
1533         else if (!hob)
1534             ret = s->nsector & 0xff;
1535 	else
1536 	    ret = s->hob_nsector;
1537         break;
1538     case 3:
1539         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1540             ret = 0;
1541         else if (!hob)
1542             ret = s->sector;
1543 	else
1544 	    ret = s->hob_sector;
1545         break;
1546     case 4:
1547         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1548             ret = 0;
1549         else if (!hob)
1550             ret = s->lcyl;
1551 	else
1552 	    ret = s->hob_lcyl;
1553         break;
1554     case 5:
1555         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1556             ret = 0;
1557         else if (!hob)
1558             ret = s->hcyl;
1559 	else
1560 	    ret = s->hob_hcyl;
1561         break;
1562     case 6:
1563         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1564             ret = 0;
1565         else
1566             ret = s->select;
1567         break;
1568     default:
1569     case 7:
1570         if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1571             (s != bus->ifs && !s->bs))
1572             ret = 0;
1573         else
1574             ret = s->status;
1575         qemu_irq_lower(bus->irq);
1576         break;
1577     }
1578 #ifdef DEBUG_IDE
1579     printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
1580 #endif
1581     return ret;
1582 }
1583 
1584 uint32_t ide_status_read(void *opaque, uint32_t addr)
1585 {
1586     IDEBus *bus = opaque;
1587     IDEState *s = idebus_active_if(bus);
1588     int ret;
1589 
1590     if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1591         (s != bus->ifs && !s->bs))
1592         ret = 0;
1593     else
1594         ret = s->status;
1595 #ifdef DEBUG_IDE
1596     printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
1597 #endif
1598     return ret;
1599 }
1600 
1601 void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
1602 {
1603     IDEBus *bus = opaque;
1604     IDEState *s;
1605     int i;
1606 
1607 #ifdef DEBUG_IDE
1608     printf("ide: write control addr=0x%x val=%02x\n", addr, val);
1609 #endif
1610     /* common for both drives */
1611     if (!(bus->cmd & IDE_CMD_RESET) &&
1612         (val & IDE_CMD_RESET)) {
1613         /* reset low to high */
1614         for(i = 0;i < 2; i++) {
1615             s = &bus->ifs[i];
1616             s->status = BUSY_STAT | SEEK_STAT;
1617             s->error = 0x01;
1618         }
1619     } else if ((bus->cmd & IDE_CMD_RESET) &&
1620                !(val & IDE_CMD_RESET)) {
1621         /* high to low */
1622         for(i = 0;i < 2; i++) {
1623             s = &bus->ifs[i];
1624             if (s->drive_kind == IDE_CD)
1625                 s->status = 0x00; /* NOTE: READY is _not_ set */
1626             else
1627                 s->status = READY_STAT | SEEK_STAT;
1628             ide_set_signature(s);
1629         }
1630     }
1631 
1632     bus->cmd = val;
1633 }
1634 
1635 /*
1636  * Returns true if the running PIO transfer is a PIO out (i.e. data is
1637  * transferred from the device to the guest), false if it's a PIO in
1638  */
1639 static bool ide_is_pio_out(IDEState *s)
1640 {
1641     if (s->end_transfer_func == ide_sector_write ||
1642         s->end_transfer_func == ide_atapi_cmd) {
1643         return false;
1644     } else if (s->end_transfer_func == ide_sector_read ||
1645                s->end_transfer_func == ide_transfer_stop ||
1646                s->end_transfer_func == ide_atapi_cmd_reply_end ||
1647                s->end_transfer_func == ide_dummy_transfer_stop) {
1648         return true;
1649     }
1650 
1651     abort();
1652 }
1653 
1654 void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
1655 {
1656     IDEBus *bus = opaque;
1657     IDEState *s = idebus_active_if(bus);
1658     uint8_t *p;
1659 
1660     /* PIO data access allowed only when DRQ bit is set. The result of a write
1661      * during PIO out is indeterminate, just ignore it. */
1662     if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
1663         return;
1664     }
1665 
1666     p = s->data_ptr;
1667     *(uint16_t *)p = le16_to_cpu(val);
1668     p += 2;
1669     s->data_ptr = p;
1670     if (p >= s->data_end)
1671         s->end_transfer_func(s);
1672 }
1673 
1674 uint32_t ide_data_readw(void *opaque, uint32_t addr)
1675 {
1676     IDEBus *bus = opaque;
1677     IDEState *s = idebus_active_if(bus);
1678     uint8_t *p;
1679     int ret;
1680 
1681     /* PIO data access allowed only when DRQ bit is set. The result of a read
1682      * during PIO in is indeterminate, return 0 and don't move forward. */
1683     if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
1684         return 0;
1685     }
1686 
1687     p = s->data_ptr;
1688     ret = cpu_to_le16(*(uint16_t *)p);
1689     p += 2;
1690     s->data_ptr = p;
1691     if (p >= s->data_end)
1692         s->end_transfer_func(s);
1693     return ret;
1694 }
1695 
1696 void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
1697 {
1698     IDEBus *bus = opaque;
1699     IDEState *s = idebus_active_if(bus);
1700     uint8_t *p;
1701 
1702     /* PIO data access allowed only when DRQ bit is set. The result of a write
1703      * during PIO out is indeterminate, just ignore it. */
1704     if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
1705         return;
1706     }
1707 
1708     p = s->data_ptr;
1709     *(uint32_t *)p = le32_to_cpu(val);
1710     p += 4;
1711     s->data_ptr = p;
1712     if (p >= s->data_end)
1713         s->end_transfer_func(s);
1714 }
1715 
1716 uint32_t ide_data_readl(void *opaque, uint32_t addr)
1717 {
1718     IDEBus *bus = opaque;
1719     IDEState *s = idebus_active_if(bus);
1720     uint8_t *p;
1721     int ret;
1722 
1723     /* PIO data access allowed only when DRQ bit is set. The result of a read
1724      * during PIO in is indeterminate, return 0 and don't move forward. */
1725     if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
1726         return 0;
1727     }
1728 
1729     p = s->data_ptr;
1730     ret = cpu_to_le32(*(uint32_t *)p);
1731     p += 4;
1732     s->data_ptr = p;
1733     if (p >= s->data_end)
1734         s->end_transfer_func(s);
1735     return ret;
1736 }
1737 
1738 static void ide_dummy_transfer_stop(IDEState *s)
1739 {
1740     s->data_ptr = s->io_buffer;
1741     s->data_end = s->io_buffer;
1742     s->io_buffer[0] = 0xff;
1743     s->io_buffer[1] = 0xff;
1744     s->io_buffer[2] = 0xff;
1745     s->io_buffer[3] = 0xff;
1746 }
1747 
1748 static void ide_reset(IDEState *s)
1749 {
1750 #ifdef DEBUG_IDE
1751     printf("ide: reset\n");
1752 #endif
1753     if (s->drive_kind == IDE_CFATA)
1754         s->mult_sectors = 0;
1755     else
1756         s->mult_sectors = MAX_MULT_SECTORS;
1757     /* ide regs */
1758     s->feature = 0;
1759     s->error = 0;
1760     s->nsector = 0;
1761     s->sector = 0;
1762     s->lcyl = 0;
1763     s->hcyl = 0;
1764 
1765     /* lba48 */
1766     s->hob_feature = 0;
1767     s->hob_sector = 0;
1768     s->hob_nsector = 0;
1769     s->hob_lcyl = 0;
1770     s->hob_hcyl = 0;
1771 
1772     s->select = 0xa0;
1773     s->status = READY_STAT | SEEK_STAT;
1774 
1775     s->lba48 = 0;
1776 
1777     /* ATAPI specific */
1778     s->sense_key = 0;
1779     s->asc = 0;
1780     s->cdrom_changed = 0;
1781     s->packet_transfer_size = 0;
1782     s->elementary_transfer_size = 0;
1783     s->io_buffer_index = 0;
1784     s->cd_sector_size = 0;
1785     s->atapi_dma = 0;
1786     /* ATA DMA state */
1787     s->io_buffer_size = 0;
1788     s->req_nb_sectors = 0;
1789 
1790     ide_set_signature(s);
1791     /* init the transfer handler so that 0xffff is returned on data
1792        accesses */
1793     s->end_transfer_func = ide_dummy_transfer_stop;
1794     ide_dummy_transfer_stop(s);
1795     s->media_changed = 0;
1796 }
1797 
1798 void ide_bus_reset(IDEBus *bus)
1799 {
1800     bus->unit = 0;
1801     bus->cmd = 0;
1802     ide_reset(&bus->ifs[0]);
1803     ide_reset(&bus->ifs[1]);
1804     ide_clear_hob(bus);
1805 
1806     /* pending async DMA */
1807     if (bus->dma->aiocb) {
1808 #ifdef DEBUG_AIO
1809         printf("aio_cancel\n");
1810 #endif
1811         bdrv_aio_cancel(bus->dma->aiocb);
1812         bus->dma->aiocb = NULL;
1813     }
1814 
1815     /* reset dma provider too */
1816     bus->dma->ops->reset(bus->dma);
1817 }
1818 
1819 static bool ide_cd_is_tray_open(void *opaque)
1820 {
1821     return ((IDEState *)opaque)->tray_open;
1822 }
1823 
1824 static bool ide_cd_is_medium_locked(void *opaque)
1825 {
1826     return ((IDEState *)opaque)->tray_locked;
1827 }
1828 
1829 static const BlockDevOps ide_cd_block_ops = {
1830     .change_media_cb = ide_cd_change_cb,
1831     .eject_request_cb = ide_cd_eject_request_cb,
1832     .is_tray_open = ide_cd_is_tray_open,
1833     .is_medium_locked = ide_cd_is_medium_locked,
1834 };
1835 
1836 int ide_init_drive(IDEState *s, BlockDriverState *bs, IDEDriveKind kind,
1837                    const char *version, const char *serial)
1838 {
1839     int cylinders, heads, secs;
1840     uint64_t nb_sectors;
1841 
1842     s->bs = bs;
1843     s->drive_kind = kind;
1844 
1845     bdrv_get_geometry(bs, &nb_sectors);
1846     bdrv_guess_geometry(bs, &cylinders, &heads, &secs);
1847     if (cylinders < 1 || cylinders > 16383) {
1848         error_report("cyls must be between 1 and 16383");
1849         return -1;
1850     }
1851     if (heads < 1 || heads > 16) {
1852         error_report("heads must be between 1 and 16");
1853         return -1;
1854     }
1855     if (secs < 1 || secs > 63) {
1856         error_report("secs must be between 1 and 63");
1857         return -1;
1858     }
1859     s->cylinders = cylinders;
1860     s->heads = heads;
1861     s->sectors = secs;
1862     s->nb_sectors = nb_sectors;
1863     /* The SMART values should be preserved across power cycles
1864        but they aren't.  */
1865     s->smart_enabled = 1;
1866     s->smart_autosave = 1;
1867     s->smart_errors = 0;
1868     s->smart_selftest_count = 0;
1869     if (kind == IDE_CD) {
1870         bdrv_set_dev_ops(bs, &ide_cd_block_ops, s);
1871         bdrv_set_buffer_alignment(bs, 2048);
1872     } else {
1873         if (!bdrv_is_inserted(s->bs)) {
1874             error_report("Device needs media, but drive is empty");
1875             return -1;
1876         }
1877         if (bdrv_is_read_only(bs)) {
1878             error_report("Can't use a read-only drive");
1879             return -1;
1880         }
1881     }
1882     if (serial) {
1883         strncpy(s->drive_serial_str, serial, sizeof(s->drive_serial_str));
1884     } else {
1885         snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
1886                  "QM%05d", s->drive_serial);
1887     }
1888     if (version) {
1889         pstrcpy(s->version, sizeof(s->version), version);
1890     } else {
1891         pstrcpy(s->version, sizeof(s->version), QEMU_VERSION);
1892     }
1893 
1894     ide_reset(s);
1895     bdrv_iostatus_enable(bs);
1896     return 0;
1897 }
1898 
1899 static void ide_init1(IDEBus *bus, int unit)
1900 {
1901     static int drive_serial = 1;
1902     IDEState *s = &bus->ifs[unit];
1903 
1904     s->bus = bus;
1905     s->unit = unit;
1906     s->drive_serial = drive_serial++;
1907     /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */
1908     s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;
1909     s->io_buffer = qemu_memalign(2048, s->io_buffer_total_len);
1910     memset(s->io_buffer, 0, s->io_buffer_total_len);
1911 
1912     s->smart_selftest_data = qemu_blockalign(s->bs, 512);
1913     memset(s->smart_selftest_data, 0, 512);
1914 
1915     s->sector_write_timer = qemu_new_timer_ns(vm_clock,
1916                                            ide_sector_write_timer_cb, s);
1917 }
1918 
1919 static void ide_nop_start(IDEDMA *dma, IDEState *s,
1920                           BlockDriverCompletionFunc *cb)
1921 {
1922 }
1923 
1924 static int ide_nop(IDEDMA *dma)
1925 {
1926     return 0;
1927 }
1928 
1929 static int ide_nop_int(IDEDMA *dma, int x)
1930 {
1931     return 0;
1932 }
1933 
1934 static void ide_nop_restart(void *opaque, int x, RunState y)
1935 {
1936 }
1937 
1938 static const IDEDMAOps ide_dma_nop_ops = {
1939     .start_dma      = ide_nop_start,
1940     .start_transfer = ide_nop,
1941     .prepare_buf    = ide_nop_int,
1942     .rw_buf         = ide_nop_int,
1943     .set_unit       = ide_nop_int,
1944     .add_status     = ide_nop_int,
1945     .set_inactive   = ide_nop,
1946     .restart_cb     = ide_nop_restart,
1947     .reset          = ide_nop,
1948 };
1949 
1950 static IDEDMA ide_dma_nop = {
1951     .ops = &ide_dma_nop_ops,
1952     .aiocb = NULL,
1953 };
1954 
1955 void ide_init2(IDEBus *bus, qemu_irq irq)
1956 {
1957     int i;
1958 
1959     for(i = 0; i < 2; i++) {
1960         ide_init1(bus, i);
1961         ide_reset(&bus->ifs[i]);
1962     }
1963     bus->irq = irq;
1964     bus->dma = &ide_dma_nop;
1965 }
1966 
1967 /* TODO convert users to qdev and remove */
1968 void ide_init2_with_non_qdev_drives(IDEBus *bus, DriveInfo *hd0,
1969                                     DriveInfo *hd1, qemu_irq irq)
1970 {
1971     int i;
1972     DriveInfo *dinfo;
1973 
1974     for(i = 0; i < 2; i++) {
1975         dinfo = i == 0 ? hd0 : hd1;
1976         ide_init1(bus, i);
1977         if (dinfo) {
1978             if (ide_init_drive(&bus->ifs[i], dinfo->bdrv,
1979                                dinfo->media_cd ? IDE_CD : IDE_HD, NULL,
1980                                *dinfo->serial ? dinfo->serial : NULL) < 0) {
1981                 error_report("Can't set up IDE drive %s", dinfo->id);
1982                 exit(1);
1983             }
1984             bdrv_attach_dev_nofail(dinfo->bdrv, &bus->ifs[i]);
1985         } else {
1986             ide_reset(&bus->ifs[i]);
1987         }
1988     }
1989     bus->irq = irq;
1990     bus->dma = &ide_dma_nop;
1991 }
1992 
1993 static const MemoryRegionPortio ide_portio_list[] = {
1994     { 0, 8, 1, .read = ide_ioport_read, .write = ide_ioport_write },
1995     { 0, 2, 2, .read = ide_data_readw, .write = ide_data_writew },
1996     { 0, 4, 4, .read = ide_data_readl, .write = ide_data_writel },
1997     PORTIO_END_OF_LIST(),
1998 };
1999 
2000 static const MemoryRegionPortio ide_portio2_list[] = {
2001     { 0, 1, 1, .read = ide_status_read, .write = ide_cmd_write },
2002     PORTIO_END_OF_LIST(),
2003 };
2004 
2005 void ide_init_ioport(IDEBus *bus, ISADevice *dev, int iobase, int iobase2)
2006 {
2007     /* ??? Assume only ISA and PCI configurations, and that the PCI-ISA
2008        bridge has been setup properly to always register with ISA.  */
2009     isa_register_portio_list(dev, iobase, ide_portio_list, bus, "ide");
2010 
2011     if (iobase2) {
2012         isa_register_portio_list(dev, iobase2, ide_portio2_list, bus, "ide");
2013     }
2014 }
2015 
2016 static bool is_identify_set(void *opaque, int version_id)
2017 {
2018     IDEState *s = opaque;
2019 
2020     return s->identify_set != 0;
2021 }
2022 
2023 static EndTransferFunc* transfer_end_table[] = {
2024         ide_sector_read,
2025         ide_sector_write,
2026         ide_transfer_stop,
2027         ide_atapi_cmd_reply_end,
2028         ide_atapi_cmd,
2029         ide_dummy_transfer_stop,
2030 };
2031 
2032 static int transfer_end_table_idx(EndTransferFunc *fn)
2033 {
2034     int i;
2035 
2036     for (i = 0; i < ARRAY_SIZE(transfer_end_table); i++)
2037         if (transfer_end_table[i] == fn)
2038             return i;
2039 
2040     return -1;
2041 }
2042 
2043 static int ide_drive_post_load(void *opaque, int version_id)
2044 {
2045     IDEState *s = opaque;
2046 
2047     if (version_id < 3) {
2048         if (s->sense_key == UNIT_ATTENTION &&
2049             s->asc == ASC_MEDIUM_MAY_HAVE_CHANGED) {
2050             s->cdrom_changed = 1;
2051         }
2052     }
2053     return 0;
2054 }
2055 
2056 static int ide_drive_pio_post_load(void *opaque, int version_id)
2057 {
2058     IDEState *s = opaque;
2059 
2060     if (s->end_transfer_fn_idx >= ARRAY_SIZE(transfer_end_table)) {
2061         return -EINVAL;
2062     }
2063     s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
2064     s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
2065     s->data_end = s->data_ptr + s->cur_io_buffer_len;
2066 
2067     return 0;
2068 }
2069 
2070 static void ide_drive_pio_pre_save(void *opaque)
2071 {
2072     IDEState *s = opaque;
2073     int idx;
2074 
2075     s->cur_io_buffer_offset = s->data_ptr - s->io_buffer;
2076     s->cur_io_buffer_len = s->data_end - s->data_ptr;
2077 
2078     idx = transfer_end_table_idx(s->end_transfer_func);
2079     if (idx == -1) {
2080         fprintf(stderr, "%s: invalid end_transfer_func for DRQ_STAT\n",
2081                         __func__);
2082         s->end_transfer_fn_idx = 2;
2083     } else {
2084         s->end_transfer_fn_idx = idx;
2085     }
2086 }
2087 
2088 static bool ide_drive_pio_state_needed(void *opaque)
2089 {
2090     IDEState *s = opaque;
2091 
2092     return ((s->status & DRQ_STAT) != 0)
2093         || (s->bus->error_status & BM_STATUS_PIO_RETRY);
2094 }
2095 
2096 static bool ide_tray_state_needed(void *opaque)
2097 {
2098     IDEState *s = opaque;
2099 
2100     return s->tray_open || s->tray_locked;
2101 }
2102 
2103 static bool ide_atapi_gesn_needed(void *opaque)
2104 {
2105     IDEState *s = opaque;
2106 
2107     return s->events.new_media || s->events.eject_request;
2108 }
2109 
2110 static bool ide_error_needed(void *opaque)
2111 {
2112     IDEBus *bus = opaque;
2113 
2114     return (bus->error_status != 0);
2115 }
2116 
2117 /* Fields for GET_EVENT_STATUS_NOTIFICATION ATAPI command */
2118 static const VMStateDescription vmstate_ide_atapi_gesn_state = {
2119     .name ="ide_drive/atapi/gesn_state",
2120     .version_id = 1,
2121     .minimum_version_id = 1,
2122     .minimum_version_id_old = 1,
2123     .fields = (VMStateField []) {
2124         VMSTATE_BOOL(events.new_media, IDEState),
2125         VMSTATE_BOOL(events.eject_request, IDEState),
2126         VMSTATE_END_OF_LIST()
2127     }
2128 };
2129 
2130 static const VMStateDescription vmstate_ide_tray_state = {
2131     .name = "ide_drive/tray_state",
2132     .version_id = 1,
2133     .minimum_version_id = 1,
2134     .minimum_version_id_old = 1,
2135     .fields = (VMStateField[]) {
2136         VMSTATE_BOOL(tray_open, IDEState),
2137         VMSTATE_BOOL(tray_locked, IDEState),
2138         VMSTATE_END_OF_LIST()
2139     }
2140 };
2141 
2142 static const VMStateDescription vmstate_ide_drive_pio_state = {
2143     .name = "ide_drive/pio_state",
2144     .version_id = 1,
2145     .minimum_version_id = 1,
2146     .minimum_version_id_old = 1,
2147     .pre_save = ide_drive_pio_pre_save,
2148     .post_load = ide_drive_pio_post_load,
2149     .fields      = (VMStateField []) {
2150         VMSTATE_INT32(req_nb_sectors, IDEState),
2151         VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1,
2152 			     vmstate_info_uint8, uint8_t),
2153         VMSTATE_INT32(cur_io_buffer_offset, IDEState),
2154         VMSTATE_INT32(cur_io_buffer_len, IDEState),
2155         VMSTATE_UINT8(end_transfer_fn_idx, IDEState),
2156         VMSTATE_INT32(elementary_transfer_size, IDEState),
2157         VMSTATE_INT32(packet_transfer_size, IDEState),
2158         VMSTATE_END_OF_LIST()
2159     }
2160 };
2161 
2162 const VMStateDescription vmstate_ide_drive = {
2163     .name = "ide_drive",
2164     .version_id = 3,
2165     .minimum_version_id = 0,
2166     .minimum_version_id_old = 0,
2167     .post_load = ide_drive_post_load,
2168     .fields      = (VMStateField []) {
2169         VMSTATE_INT32(mult_sectors, IDEState),
2170         VMSTATE_INT32(identify_set, IDEState),
2171         VMSTATE_BUFFER_TEST(identify_data, IDEState, is_identify_set),
2172         VMSTATE_UINT8(feature, IDEState),
2173         VMSTATE_UINT8(error, IDEState),
2174         VMSTATE_UINT32(nsector, IDEState),
2175         VMSTATE_UINT8(sector, IDEState),
2176         VMSTATE_UINT8(lcyl, IDEState),
2177         VMSTATE_UINT8(hcyl, IDEState),
2178         VMSTATE_UINT8(hob_feature, IDEState),
2179         VMSTATE_UINT8(hob_sector, IDEState),
2180         VMSTATE_UINT8(hob_nsector, IDEState),
2181         VMSTATE_UINT8(hob_lcyl, IDEState),
2182         VMSTATE_UINT8(hob_hcyl, IDEState),
2183         VMSTATE_UINT8(select, IDEState),
2184         VMSTATE_UINT8(status, IDEState),
2185         VMSTATE_UINT8(lba48, IDEState),
2186         VMSTATE_UINT8(sense_key, IDEState),
2187         VMSTATE_UINT8(asc, IDEState),
2188         VMSTATE_UINT8_V(cdrom_changed, IDEState, 3),
2189         VMSTATE_END_OF_LIST()
2190     },
2191     .subsections = (VMStateSubsection []) {
2192         {
2193             .vmsd = &vmstate_ide_drive_pio_state,
2194             .needed = ide_drive_pio_state_needed,
2195         }, {
2196             .vmsd = &vmstate_ide_tray_state,
2197             .needed = ide_tray_state_needed,
2198         }, {
2199             .vmsd = &vmstate_ide_atapi_gesn_state,
2200             .needed = ide_atapi_gesn_needed,
2201         }, {
2202             /* empty */
2203         }
2204     }
2205 };
2206 
2207 static const VMStateDescription vmstate_ide_error_status = {
2208     .name ="ide_bus/error",
2209     .version_id = 1,
2210     .minimum_version_id = 1,
2211     .minimum_version_id_old = 1,
2212     .fields = (VMStateField []) {
2213         VMSTATE_INT32(error_status, IDEBus),
2214         VMSTATE_END_OF_LIST()
2215     }
2216 };
2217 
2218 const VMStateDescription vmstate_ide_bus = {
2219     .name = "ide_bus",
2220     .version_id = 1,
2221     .minimum_version_id = 1,
2222     .minimum_version_id_old = 1,
2223     .fields      = (VMStateField []) {
2224         VMSTATE_UINT8(cmd, IDEBus),
2225         VMSTATE_UINT8(unit, IDEBus),
2226         VMSTATE_END_OF_LIST()
2227     },
2228     .subsections = (VMStateSubsection []) {
2229         {
2230             .vmsd = &vmstate_ide_error_status,
2231             .needed = ide_error_needed,
2232         }, {
2233             /* empty */
2234         }
2235     }
2236 };
2237 
2238 void ide_drive_get(DriveInfo **hd, int max_bus)
2239 {
2240     int i;
2241 
2242     if (drive_get_max_bus(IF_IDE) >= max_bus) {
2243         fprintf(stderr, "qemu: too many IDE bus: %d\n", max_bus);
2244         exit(1);
2245     }
2246 
2247     for(i = 0; i < max_bus * MAX_IDE_DEVS; i++) {
2248         hd[i] = drive_get(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
2249     }
2250 }
2251