]> git.proxmox.com Git - mirror_qemu.git/blob - hw/ide/core.c
projects / mirror_qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
hw/ide/piix: properly initialize the BMIBA register
[mirror_qemu.git] / hw / ide / core.c
1 /*
2 * QEMU IDE disk and CD/DVD-ROM Emulator
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 * Copyright (c) 2006 Openedhand Ltd.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu/osdep.h"
27 #include "hw/irq.h"
28 #include "hw/isa/isa.h"
29 #include "migration/vmstate.h"
30 #include "qemu/error-report.h"
31 #include "qemu/main-loop.h"
32 #include "qemu/timer.h"
33 #include "qemu/hw-version.h"
34 #include "qemu/memalign.h"
35 #include "sysemu/sysemu.h"
36 #include "sysemu/blockdev.h"
37 #include "sysemu/dma.h"
38 #include "hw/block/block.h"
39 #include "sysemu/block-backend.h"
40 #include "qapi/error.h"
41 #include "qemu/cutils.h"
42 #include "sysemu/replay.h"
43 #include "sysemu/runstate.h"
44 #include "hw/ide/internal.h"
45 #include "trace.h"
46
47 /* These values were based on a Seagate ST3500418AS but have been modified
48 to make more sense in QEMU */
49 static const int smart_attributes[][12] = {
50 /* id, flags, hflags, val, wrst, raw (6 bytes), threshold */
51 /* raw read error rate*/
52 { 0x01, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06},
53 /* spin up */
54 { 0x03, 0x03, 0x00, 0x64, 0x64, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
55 /* start stop count */
56 { 0x04, 0x02, 0x00, 0x64, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14},
57 /* remapped sectors */
58 { 0x05, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24},
59 /* power on hours */
60 { 0x09, 0x03, 0x00, 0x64, 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
61 /* power cycle count */
62 { 0x0c, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
63 /* airflow-temperature-celsius */
64 { 190, 0x03, 0x00, 0x45, 0x45, 0x1f, 0x00, 0x1f, 0x1f, 0x00, 0x00, 0x32},
65 };
66
67 const char *IDE_DMA_CMD_lookup[IDE_DMA__COUNT] = {
68 [IDE_DMA_READ] = "DMA READ",
69 [IDE_DMA_WRITE] = "DMA WRITE",
70 [IDE_DMA_TRIM] = "DMA TRIM",
71 [IDE_DMA_ATAPI] = "DMA ATAPI"
72 };
73
74 static const char *IDE_DMA_CMD_str(enum ide_dma_cmd enval)
75 {
76 if ((unsigned)enval < IDE_DMA__COUNT) {
77 return IDE_DMA_CMD_lookup[enval];
78 }
79 return "DMA UNKNOWN CMD";
80 }
81
82 static void ide_dummy_transfer_stop(IDEState *s);
83
84 static void padstr(char *str, const char *src, int len)
85 {
86 int i, v;
87 for(i = 0; i < len; i++) {
88 if (*src)
89 v = *src++;
90 else
91 v = ' ';
92 str[i^1] = v;
93 }
94 }
95
96 static void put_le16(uint16_t *p, unsigned int v)
97 {
98 *p = cpu_to_le16(v);
99 }
100
101 static void ide_identify_size(IDEState *s)
102 {
103 uint16_t *p = (uint16_t *)s->identify_data;
104 int64_t nb_sectors_lba28 = s->nb_sectors;
105 if (nb_sectors_lba28 >= 1 << 28) {
106 nb_sectors_lba28 = (1 << 28) - 1;
107 }
108 put_le16(p + 60, nb_sectors_lba28);
109 put_le16(p + 61, nb_sectors_lba28 >> 16);
110 put_le16(p + 100, s->nb_sectors);
111 put_le16(p + 101, s->nb_sectors >> 16);
112 put_le16(p + 102, s->nb_sectors >> 32);
113 put_le16(p + 103, s->nb_sectors >> 48);
114 }
115
116 static void ide_identify(IDEState *s)
117 {
118 uint16_t *p;
119 unsigned int oldsize;
120 IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
121
122 p = (uint16_t *)s->identify_data;
123 if (s->identify_set) {
124 goto fill_buffer;
125 }
126 memset(p, 0, sizeof(s->identify_data));
127
128 put_le16(p + 0, 0x0040);
129 put_le16(p + 1, s->cylinders);
130 put_le16(p + 3, s->heads);
131 put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
132 put_le16(p + 5, 512); /* XXX: retired, remove ? */
133 put_le16(p + 6, s->sectors);
134 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
135 put_le16(p + 20, 3); /* XXX: retired, remove ? */
136 put_le16(p + 21, 512); /* cache size in sectors */
137 put_le16(p + 22, 4); /* ecc bytes */
138 padstr((char *)(p + 23), s->version, 8); /* firmware version */
139 padstr((char *)(p + 27), s->drive_model_str, 40); /* model */
140 #if MAX_MULT_SECTORS > 1
141 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
142 #endif
143 put_le16(p + 48, 1); /* dword I/O */
144 put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
145 put_le16(p + 51, 0x200); /* PIO transfer cycle */
146 put_le16(p + 52, 0x200); /* DMA transfer cycle */
147 put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
148 put_le16(p + 54, s->cylinders);
149 put_le16(p + 55, s->heads);
150 put_le16(p + 56, s->sectors);
151 oldsize = s->cylinders * s->heads * s->sectors;
152 put_le16(p + 57, oldsize);
153 put_le16(p + 58, oldsize >> 16);
154 if (s->mult_sectors)
155 put_le16(p + 59, 0x100 | s->mult_sectors);
156 /* *(p + 60) := nb_sectors -- see ide_identify_size */
157 /* *(p + 61) := nb_sectors >> 16 -- see ide_identify_size */
158 put_le16(p + 62, 0x07); /* single word dma0-2 supported */
159 put_le16(p + 63, 0x07); /* mdma0-2 supported */
160 put_le16(p + 64, 0x03); /* pio3-4 supported */
161 put_le16(p + 65, 120);
162 put_le16(p + 66, 120);
163 put_le16(p + 67, 120);
164 put_le16(p + 68, 120);
165 if (dev && dev->conf.discard_granularity) {
166 put_le16(p + 69, (1 << 14)); /* determinate TRIM behavior */
167 }
168
169 if (s->ncq_queues) {
170 put_le16(p + 75, s->ncq_queues - 1);
171 /* NCQ supported */
172 put_le16(p + 76, (1 << 8));
173 }
174
175 put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
176 put_le16(p + 81, 0x16); /* conforms to ata5 */
177 /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */
178 put_le16(p + 82, (1 << 14) | (1 << 5) | 1);
179 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
180 put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
181 /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */
182 if (s->wwn) {
183 put_le16(p + 84, (1 << 14) | (1 << 8) | 0);
184 } else {
185 put_le16(p + 84, (1 << 14) | 0);
186 }
187 /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */
188 if (blk_enable_write_cache(s->blk)) {
189 put_le16(p + 85, (1 << 14) | (1 << 5) | 1);
190 } else {
191 put_le16(p + 85, (1 << 14) | 1);
192 }
193 /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
194 put_le16(p + 86, (1 << 13) | (1 <<12) | (1 << 10));
195 /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */
196 if (s->wwn) {
197 put_le16(p + 87, (1 << 14) | (1 << 8) | 0);
198 } else {
199 put_le16(p + 87, (1 << 14) | 0);
200 }
201 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
202 put_le16(p + 93, 1 | (1 << 14) | 0x2000);
203 /* *(p + 100) := nb_sectors -- see ide_identify_size */
204 /* *(p + 101) := nb_sectors >> 16 -- see ide_identify_size */
205 /* *(p + 102) := nb_sectors >> 32 -- see ide_identify_size */
206 /* *(p + 103) := nb_sectors >> 48 -- see ide_identify_size */
207
208 if (dev && dev->conf.physical_block_size)
209 put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));
210 if (s->wwn) {
211 /* LE 16-bit words 111-108 contain 64-bit World Wide Name */
212 put_le16(p + 108, s->wwn >> 48);
213 put_le16(p + 109, s->wwn >> 32);
214 put_le16(p + 110, s->wwn >> 16);
215 put_le16(p + 111, s->wwn);
216 }
217 if (dev && dev->conf.discard_granularity) {
218 put_le16(p + 169, 1); /* TRIM support */
219 }
220 if (dev) {
221 put_le16(p + 217, dev->rotation_rate); /* Nominal media rotation rate */
222 }
223
224 ide_identify_size(s);
225 s->identify_set = 1;
226
227 fill_buffer:
228 memcpy(s->io_buffer, p, sizeof(s->identify_data));
229 }
230
231 static void ide_atapi_identify(IDEState *s)
232 {
233 uint16_t *p;
234
235 p = (uint16_t *)s->identify_data;
236 if (s->identify_set) {
237 goto fill_buffer;
238 }
239 memset(p, 0, sizeof(s->identify_data));
240
241 /* Removable CDROM, 50us response, 12 byte packets */
242 put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
243 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
244 put_le16(p + 20, 3); /* buffer type */
245 put_le16(p + 21, 512); /* cache size in sectors */
246 put_le16(p + 22, 4); /* ecc bytes */
247 padstr((char *)(p + 23), s->version, 8); /* firmware version */
248 padstr((char *)(p + 27), s->drive_model_str, 40); /* model */
249 put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
250 #ifdef USE_DMA_CDROM
251 put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
252 put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
253 put_le16(p + 62, 7); /* single word dma0-2 supported */
254 put_le16(p + 63, 7); /* mdma0-2 supported */
255 #else
256 put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
257 put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
258 put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
259 #endif
260 put_le16(p + 64, 3); /* pio3-4 supported */
261 put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
262 put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
263 put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
264 put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
265
266 put_le16(p + 71, 30); /* in ns */
267 put_le16(p + 72, 30); /* in ns */
268
269 if (s->ncq_queues) {
270 put_le16(p + 75, s->ncq_queues - 1);
271 /* NCQ supported */
272 put_le16(p + 76, (1 << 8));
273 }
274
275 put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
276 if (s->wwn) {
277 put_le16(p + 84, (1 << 8)); /* supports WWN for words 108-111 */
278 put_le16(p + 87, (1 << 8)); /* WWN enabled */
279 }
280
281 #ifdef USE_DMA_CDROM
282 put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
283 #endif
284
285 if (s->wwn) {
286 /* LE 16-bit words 111-108 contain 64-bit World Wide Name */
287 put_le16(p + 108, s->wwn >> 48);
288 put_le16(p + 109, s->wwn >> 32);
289 put_le16(p + 110, s->wwn >> 16);
290 put_le16(p + 111, s->wwn);
291 }
292
293 s->identify_set = 1;
294
295 fill_buffer:
296 memcpy(s->io_buffer, p, sizeof(s->identify_data));
297 }
298
299 static void ide_cfata_identify_size(IDEState *s)
300 {
301 uint16_t *p = (uint16_t *)s->identify_data;
302 put_le16(p + 7, s->nb_sectors >> 16); /* Sectors per card */
303 put_le16(p + 8, s->nb_sectors); /* Sectors per card */
304 put_le16(p + 60, s->nb_sectors); /* Total LBA sectors */
305 put_le16(p + 61, s->nb_sectors >> 16); /* Total LBA sectors */
306 }
307
308 static void ide_cfata_identify(IDEState *s)
309 {
310 uint16_t *p;
311 uint32_t cur_sec;
312
313 p = (uint16_t *)s->identify_data;
314 if (s->identify_set) {
315 goto fill_buffer;
316 }
317 memset(p, 0, sizeof(s->identify_data));
318
319 cur_sec = s->cylinders * s->heads * s->sectors;
320
321 put_le16(p + 0, 0x848a); /* CF Storage Card signature */
322 put_le16(p + 1, s->cylinders); /* Default cylinders */
323 put_le16(p + 3, s->heads); /* Default heads */
324 put_le16(p + 6, s->sectors); /* Default sectors per track */
325 /* *(p + 7) := nb_sectors >> 16 -- see ide_cfata_identify_size */
326 /* *(p + 8) := nb_sectors -- see ide_cfata_identify_size */
327 padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
328 put_le16(p + 22, 0x0004); /* ECC bytes */
329 padstr((char *) (p + 23), s->version, 8); /* Firmware Revision */
330 padstr((char *) (p + 27), s->drive_model_str, 40);/* Model number */
331 #if MAX_MULT_SECTORS > 1
332 put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
333 #else
334 put_le16(p + 47, 0x0000);
335 #endif
336 put_le16(p + 49, 0x0f00); /* Capabilities */
337 put_le16(p + 51, 0x0002); /* PIO cycle timing mode */
338 put_le16(p + 52, 0x0001); /* DMA cycle timing mode */
339 put_le16(p + 53, 0x0003); /* Translation params valid */
340 put_le16(p + 54, s->cylinders); /* Current cylinders */
341 put_le16(p + 55, s->heads); /* Current heads */
342 put_le16(p + 56, s->sectors); /* Current sectors */
343 put_le16(p + 57, cur_sec); /* Current capacity */
344 put_le16(p + 58, cur_sec >> 16); /* Current capacity */
345 if (s->mult_sectors) /* Multiple sector setting */
346 put_le16(p + 59, 0x100 | s->mult_sectors);
347 /* *(p + 60) := nb_sectors -- see ide_cfata_identify_size */
348 /* *(p + 61) := nb_sectors >> 16 -- see ide_cfata_identify_size */
349 put_le16(p + 63, 0x0203); /* Multiword DMA capability */
350 put_le16(p + 64, 0x0001); /* Flow Control PIO support */
351 put_le16(p + 65, 0x0096); /* Min. Multiword DMA cycle */
352 put_le16(p + 66, 0x0096); /* Rec. Multiword DMA cycle */
353 put_le16(p + 68, 0x00b4); /* Min. PIO cycle time */
354 put_le16(p + 82, 0x400c); /* Command Set supported */
355 put_le16(p + 83, 0x7068); /* Command Set supported */
356 put_le16(p + 84, 0x4000); /* Features supported */
357 put_le16(p + 85, 0x000c); /* Command Set enabled */
358 put_le16(p + 86, 0x7044); /* Command Set enabled */
359 put_le16(p + 87, 0x4000); /* Features enabled */
360 put_le16(p + 91, 0x4060); /* Current APM level */
361 put_le16(p + 129, 0x0002); /* Current features option */
362 put_le16(p + 130, 0x0005); /* Reassigned sectors */
363 put_le16(p + 131, 0x0001); /* Initial power mode */
364 put_le16(p + 132, 0x0000); /* User signature */
365 put_le16(p + 160, 0x8100); /* Power requirement */
366 put_le16(p + 161, 0x8001); /* CF command set */
367
368 ide_cfata_identify_size(s);
369 s->identify_set = 1;
370
371 fill_buffer:
372 memcpy(s->io_buffer, p, sizeof(s->identify_data));
373 }
374
375 static void ide_set_signature(IDEState *s)
376 {
377 s->select &= ~(ATA_DEV_HS); /* clear head */
378 /* put signature */
379 s->nsector = 1;
380 s->sector = 1;
381 if (s->drive_kind == IDE_CD) {
382 s->lcyl = 0x14;
383 s->hcyl = 0xeb;
384 } else if (s->blk) {
385 s->lcyl = 0;
386 s->hcyl = 0;
387 } else {
388 s->lcyl = 0xff;
389 s->hcyl = 0xff;
390 }
391 }
392
393 static bool ide_sect_range_ok(IDEState *s,
394 uint64_t sector, uint64_t nb_sectors)
395 {
396 uint64_t total_sectors;
397
398 blk_get_geometry(s->blk, &total_sectors);
399 if (sector > total_sectors || nb_sectors > total_sectors - sector) {
400 return false;
401 }
402 return true;
403 }
404
405 typedef struct TrimAIOCB {
406 BlockAIOCB common;
407 IDEState *s;
408 QEMUBH *bh;
409 int ret;
410 QEMUIOVector *qiov;
411 BlockAIOCB *aiocb;
412 int i, j;
413 } TrimAIOCB;
414
415 static void trim_aio_cancel(BlockAIOCB *acb)
416 {
417 TrimAIOCB *iocb = container_of(acb, TrimAIOCB, common);
418
419 /* Exit the loop so ide_issue_trim_cb will not continue */
420 iocb->j = iocb->qiov->niov - 1;
421 iocb->i = (iocb->qiov->iov[iocb->j].iov_len / 8) - 1;
422
423 iocb->ret = -ECANCELED;
424
425 if (iocb->aiocb) {
426 blk_aio_cancel_async(iocb->aiocb);
427 iocb->aiocb = NULL;
428 }
429 }
430
431 static const AIOCBInfo trim_aiocb_info = {
432 .aiocb_size = sizeof(TrimAIOCB),
433 .cancel_async = trim_aio_cancel,
434 };
435
436 static void ide_trim_bh_cb(void *opaque)
437 {
438 TrimAIOCB *iocb = opaque;
439 BlockBackend *blk = iocb->s->blk;
440
441 iocb->common.cb(iocb->common.opaque, iocb->ret);
442
443 qemu_bh_delete(iocb->bh);
444 iocb->bh = NULL;
445 qemu_aio_unref(iocb);
446
447 /* Paired with an increment in ide_issue_trim() */
448 blk_dec_in_flight(blk);
449 }
450
451 static void ide_issue_trim_cb(void *opaque, int ret)
452 {
453 TrimAIOCB *iocb = opaque;
454 IDEState *s = iocb->s;
455
456 if (iocb->i >= 0) {
457 if (ret >= 0) {
458 block_acct_done(blk_get_stats(s->blk), &s->acct);
459 } else {
460 block_acct_failed(blk_get_stats(s->blk), &s->acct);
461 }
462 }
463
464 if (ret >= 0) {
465 while (iocb->j < iocb->qiov->niov) {
466 int j = iocb->j;
467 while (++iocb->i < iocb->qiov->iov[j].iov_len / 8) {
468 int i = iocb->i;
469 uint64_t *buffer = iocb->qiov->iov[j].iov_base;
470
471 /* 6-byte LBA + 2-byte range per entry */
472 uint64_t entry = le64_to_cpu(buffer[i]);
473 uint64_t sector = entry & 0x0000ffffffffffffULL;
474 uint16_t count = entry >> 48;
475
476 if (count == 0) {
477 continue;
478 }
479
480 if (!ide_sect_range_ok(s, sector, count)) {
481 block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_UNMAP);
482 iocb->ret = -EINVAL;
483 goto done;
484 }
485
486 block_acct_start(blk_get_stats(s->blk), &s->acct,
487 count << BDRV_SECTOR_BITS, BLOCK_ACCT_UNMAP);
488
489 /* Got an entry! Submit and exit. */
490 iocb->aiocb = blk_aio_pdiscard(s->blk,
491 sector << BDRV_SECTOR_BITS,
492 count << BDRV_SECTOR_BITS,
493 ide_issue_trim_cb, opaque);
494 return;
495 }
496
497 iocb->j++;
498 iocb->i = -1;
499 }
500 } else {
501 iocb->ret = ret;
502 }
503
504 done:
505 iocb->aiocb = NULL;
506 if (iocb->bh) {
507 replay_bh_schedule_event(iocb->bh);
508 }
509 }
510
511 BlockAIOCB *ide_issue_trim(
512 int64_t offset, QEMUIOVector *qiov,
513 BlockCompletionFunc *cb, void *cb_opaque, void *opaque)
514 {
515 IDEState *s = opaque;
516 IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
517 TrimAIOCB *iocb;
518
519 /* Paired with a decrement in ide_trim_bh_cb() */
520 blk_inc_in_flight(s->blk);
521
522 iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque);
523 iocb->s = s;
524 iocb->bh = qemu_bh_new_guarded(ide_trim_bh_cb, iocb,
525 &DEVICE(dev)->mem_reentrancy_guard);
526 iocb->ret = 0;
527 iocb->qiov = qiov;
528 iocb->i = -1;
529 iocb->j = 0;
530 ide_issue_trim_cb(iocb, 0);
531 return &iocb->common;
532 }
533
534 void ide_abort_command(IDEState *s)
535 {
536 ide_transfer_stop(s);
537 s->status = READY_STAT | ERR_STAT;
538 s->error = ABRT_ERR;
539 }
540
541 static void ide_set_retry(IDEState *s)
542 {
543 s->bus->retry_unit = s->unit;
544 s->bus->retry_sector_num = ide_get_sector(s);
545 s->bus->retry_nsector = s->nsector;
546 }
547
548 static void ide_clear_retry(IDEState *s)
549 {
550 s->bus->retry_unit = -1;
551 s->bus->retry_sector_num = 0;
552 s->bus->retry_nsector = 0;
553 }
554
555 /* prepare data transfer and tell what to do after */
556 bool ide_transfer_start_norecurse(IDEState *s, uint8_t *buf, int size,
557 EndTransferFunc *end_transfer_func)
558 {
559 s->data_ptr = buf;
560 s->data_end = buf + size;
561 ide_set_retry(s);
562 if (!(s->status & ERR_STAT)) {
563 s->status |= DRQ_STAT;
564 }
565 if (!s->bus->dma->ops->pio_transfer) {
566 s->end_transfer_func = end_transfer_func;
567 return false;
568 }
569 s->bus->dma->ops->pio_transfer(s->bus->dma);
570 return true;
571 }
572
573 void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
574 EndTransferFunc *end_transfer_func)
575 {
576 if (ide_transfer_start_norecurse(s, buf, size, end_transfer_func)) {
577 end_transfer_func(s);
578 }
579 }
580
581 static void ide_cmd_done(IDEState *s)
582 {
583 if (s->bus->dma->ops->cmd_done) {
584 s->bus->dma->ops->cmd_done(s->bus->dma);
585 }
586 }
587
588 static void ide_transfer_halt(IDEState *s)
589 {
590 s->end_transfer_func = ide_transfer_stop;
591 s->data_ptr = s->io_buffer;
592 s->data_end = s->io_buffer;
593 s->status &= ~DRQ_STAT;
594 }
595
596 void ide_transfer_stop(IDEState *s)
597 {
598 ide_transfer_halt(s);
599 ide_cmd_done(s);
600 }
601
602 int64_t ide_get_sector(IDEState *s)
603 {
604 int64_t sector_num;
605 if (s->select & (ATA_DEV_LBA)) {
606 if (s->lba48) {
607 sector_num = ((int64_t)s->hob_hcyl << 40) |
608 ((int64_t) s->hob_lcyl << 32) |
609 ((int64_t) s->hob_sector << 24) |
610 ((int64_t) s->hcyl << 16) |
611 ((int64_t) s->lcyl << 8) | s->sector;
612 } else {
613 /* LBA28 */
614 sector_num = ((s->select & (ATA_DEV_LBA_MSB)) << 24) |
615 (s->hcyl << 16) | (s->lcyl << 8) | s->sector;
616 }
617 } else {
618 /* CHS */
619 sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
620 (s->select & (ATA_DEV_HS)) * s->sectors + (s->sector - 1);
621 }
622
623 return sector_num;
624 }
625
626 void ide_set_sector(IDEState *s, int64_t sector_num)
627 {
628 unsigned int cyl, r;
629 if (s->select & (ATA_DEV_LBA)) {
630 if (s->lba48) {
631 s->sector = sector_num;
632 s->lcyl = sector_num >> 8;
633 s->hcyl = sector_num >> 16;
634 s->hob_sector = sector_num >> 24;
635 s->hob_lcyl = sector_num >> 32;
636 s->hob_hcyl = sector_num >> 40;
637 } else {
638 /* LBA28 */
639 s->select = (s->select & ~(ATA_DEV_LBA_MSB)) |
640 ((sector_num >> 24) & (ATA_DEV_LBA_MSB));
641 s->hcyl = (sector_num >> 16);
642 s->lcyl = (sector_num >> 8);
643 s->sector = (sector_num);
644 }
645 } else {
646 /* CHS */
647 cyl = sector_num / (s->heads * s->sectors);
648 r = sector_num % (s->heads * s->sectors);
649 s->hcyl = cyl >> 8;
650 s->lcyl = cyl;
651 s->select = (s->select & ~(ATA_DEV_HS)) |
652 ((r / s->sectors) & (ATA_DEV_HS));
653 s->sector = (r % s->sectors) + 1;
654 }
655 }
656
657 static void ide_rw_error(IDEState *s) {
658 ide_abort_command(s);
659 ide_bus_set_irq(s->bus);
660 }
661
662 static void ide_buffered_readv_cb(void *opaque, int ret)
663 {
664 IDEBufferedRequest *req = opaque;
665 if (!req->orphaned) {
666 if (!ret) {
667 assert(req->qiov.size == req->original_qiov->size);
668 qemu_iovec_from_buf(req->original_qiov, 0,
669 req->qiov.local_iov.iov_base,
670 req->original_qiov->size);
671 }
672 req->original_cb(req->original_opaque, ret);
673 }
674 QLIST_REMOVE(req, list);
675 qemu_vfree(qemu_iovec_buf(&req->qiov));
676 g_free(req);
677 }
678
679 #define MAX_BUFFERED_REQS 16
680
681 BlockAIOCB *ide_buffered_readv(IDEState *s, int64_t sector_num,
682 QEMUIOVector *iov, int nb_sectors,
683 BlockCompletionFunc *cb, void *opaque)
684 {
685 BlockAIOCB *aioreq;
686 IDEBufferedRequest *req;
687 int c = 0;
688
689 QLIST_FOREACH(req, &s->buffered_requests, list) {
690 c++;
691 }
692 if (c > MAX_BUFFERED_REQS) {
693 return blk_abort_aio_request(s->blk, cb, opaque, -EIO);
694 }
695
696 req = g_new0(IDEBufferedRequest, 1);
697 req->original_qiov = iov;
698 req->original_cb = cb;
699 req->original_opaque = opaque;
700 qemu_iovec_init_buf(&req->qiov, blk_blockalign(s->blk, iov->size),
701 iov->size);
702
703 aioreq = blk_aio_preadv(s->blk, sector_num << BDRV_SECTOR_BITS,
704 &req->qiov, 0, ide_buffered_readv_cb, req);
705
706 QLIST_INSERT_HEAD(&s->buffered_requests, req, list);
707 return aioreq;
708 }
709
710 /**
711 * Cancel all pending DMA requests.
712 * Any buffered DMA requests are instantly canceled,
713 * but any pending unbuffered DMA requests must be waited on.
714 */
715 void ide_cancel_dma_sync(IDEState *s)
716 {
717 IDEBufferedRequest *req;
718
719 /* First invoke the callbacks of all buffered requests
720 * and flag those requests as orphaned. Ideally there
721 * are no unbuffered (Scatter Gather DMA Requests or
722 * write requests) pending and we can avoid to drain. */
723 QLIST_FOREACH(req, &s->buffered_requests, list) {
724 if (!req->orphaned) {
725 trace_ide_cancel_dma_sync_buffered(req->original_cb, req);
726 req->original_cb(req->original_opaque, -ECANCELED);
727 }
728 req->orphaned = true;
729 }
730
731 /*
732 * We can't cancel Scatter Gather DMA in the middle of the
733 * operation or a partial (not full) DMA transfer would reach
734 * the storage so we wait for completion instead (we behave
735 * like if the DMA was completed by the time the guest trying
736 * to cancel dma with bmdma_cmd_writeb with BM_CMD_START not
737 * set).
738 *
739 * In the future we'll be able to safely cancel the I/O if the
740 * whole DMA operation will be submitted to disk with a single
741 * aio operation with preadv/pwritev.
742 */
743 if (s->bus->dma->aiocb) {
744 trace_ide_cancel_dma_sync_remaining();
745 blk_drain(s->blk);
746 assert(s->bus->dma->aiocb == NULL);
747 }
748 }
749
750 static void ide_sector_read(IDEState *s);
751
752 static void ide_sector_read_cb(void *opaque, int ret)
753 {
754 IDEState *s = opaque;
755 int n;
756
757 s->pio_aiocb = NULL;
758 s->status &= ~BUSY_STAT;
759
760 if (ret != 0) {
761 if (ide_handle_rw_error(s, -ret, IDE_RETRY_PIO |
762 IDE_RETRY_READ)) {
763 return;
764 }
765 }
766
767 block_acct_done(blk_get_stats(s->blk), &s->acct);
768
769 n = s->nsector;
770 if (n > s->req_nb_sectors) {
771 n = s->req_nb_sectors;
772 }
773
774 ide_set_sector(s, ide_get_sector(s) + n);
775 s->nsector -= n;
776 /* Allow the guest to read the io_buffer */
777 ide_transfer_start(s, s->io_buffer, n * BDRV_SECTOR_SIZE, ide_sector_read);
778 ide_bus_set_irq(s->bus);
779 }
780
781 static void ide_sector_read(IDEState *s)
782 {
783 int64_t sector_num;
784 int n;
785
786 s->status = READY_STAT | SEEK_STAT;
787 s->error = 0; /* not needed by IDE spec, but needed by Windows */
788 sector_num = ide_get_sector(s);
789 n = s->nsector;
790
791 if (n == 0) {
792 ide_transfer_stop(s);
793 return;
794 }
795
796 s->status |= BUSY_STAT;
797
798 if (n > s->req_nb_sectors) {
799 n = s->req_nb_sectors;
800 }
801
802 trace_ide_sector_read(sector_num, n);
803
804 if (!ide_sect_range_ok(s, sector_num, n)) {
805 ide_rw_error(s);
806 block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_READ);
807 return;
808 }
809
810 qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
811
812 block_acct_start(blk_get_stats(s->blk), &s->acct,
813 n * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);
814 s->pio_aiocb = ide_buffered_readv(s, sector_num, &s->qiov, n,
815 ide_sector_read_cb, s);
816 }
817
818 void dma_buf_commit(IDEState *s, uint32_t tx_bytes)
819 {
820 if (s->bus->dma->ops->commit_buf) {
821 s->bus->dma->ops->commit_buf(s->bus->dma, tx_bytes);
822 }
823 s->io_buffer_offset += tx_bytes;
824 qemu_sglist_destroy(&s->sg);
825 }
826
827 void ide_set_inactive(IDEState *s, bool more)
828 {
829 s->bus->dma->aiocb = NULL;
830 ide_clear_retry(s);
831 if (s->bus->dma->ops->set_inactive) {
832 s->bus->dma->ops->set_inactive(s->bus->dma, more);
833 }
834 ide_cmd_done(s);
835 }
836
837 void ide_dma_error(IDEState *s)
838 {
839 dma_buf_commit(s, 0);
840 ide_abort_command(s);
841 ide_set_inactive(s, false);
842 ide_bus_set_irq(s->bus);
843 }
844
845 int ide_handle_rw_error(IDEState *s, int error, int op)
846 {
847 bool is_read = (op & IDE_RETRY_READ) != 0;
848 BlockErrorAction action = blk_get_error_action(s->blk, is_read, error);
849
850 if (action == BLOCK_ERROR_ACTION_STOP) {
851 assert(s->bus->retry_unit == s->unit);
852 s->bus->error_status = op;
853 } else if (action == BLOCK_ERROR_ACTION_REPORT) {
854 block_acct_failed(blk_get_stats(s->blk), &s->acct);
855 if (IS_IDE_RETRY_DMA(op)) {
856 ide_dma_error(s);
857 } else if (IS_IDE_RETRY_ATAPI(op)) {
858 ide_atapi_io_error(s, -error);
859 } else {
860 ide_rw_error(s);
861 }
862 }
863 blk_error_action(s->blk, action, is_read, error);
864 return action != BLOCK_ERROR_ACTION_IGNORE;
865 }
866
867 static void ide_dma_cb(void *opaque, int ret)
868 {
869 IDEState *s = opaque;
870 int n;
871 int64_t sector_num;
872 uint64_t offset;
873 bool stay_active = false;
874 int32_t prep_size = 0;
875
876 if (ret == -EINVAL) {
877 ide_dma_error(s);
878 return;
879 }
880
881 if (ret < 0) {
882 if (ide_handle_rw_error(s, -ret, ide_dma_cmd_to_retry(s->dma_cmd))) {
883 s->bus->dma->aiocb = NULL;
884 dma_buf_commit(s, 0);
885 return;
886 }
887 }
888
889 if (s->io_buffer_size > s->nsector * 512) {
890 /*
891 * The PRDs were longer than needed for this request.
892 * The Active bit must remain set after the request completes.
893 */
894 n = s->nsector;
895 stay_active = true;
896 } else {
897 n = s->io_buffer_size >> 9;
898 }
899
900 sector_num = ide_get_sector(s);
901 if (n > 0) {
902 assert(n * 512 == s->sg.size);
903 dma_buf_commit(s, s->sg.size);
904 sector_num += n;
905 ide_set_sector(s, sector_num);
906 s->nsector -= n;
907 }
908
909 /* end of transfer ? */
910 if (s->nsector == 0) {
911 s->status = READY_STAT | SEEK_STAT;
912 ide_bus_set_irq(s->bus);
913 goto eot;
914 }
915
916 /* launch next transfer */
917 n = s->nsector;
918 s->io_buffer_index = 0;
919 s->io_buffer_size = n * 512;
920 prep_size = s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_size);
921 /* prepare_buf() must succeed and respect the limit */
922 assert(prep_size >= 0 && prep_size <= n * 512);
923
924 /*
925 * Now prep_size stores the number of bytes in the sglist, and
926 * s->io_buffer_size stores the number of bytes described by the PRDs.
927 */
928
929 if (prep_size < n * 512) {
930 /*
931 * The PRDs are too short for this request. Error condition!
932 * Reset the Active bit and don't raise the interrupt.
933 */
934 s->status = READY_STAT | SEEK_STAT;
935 dma_buf_commit(s, 0);
936 goto eot;
937 }
938
939 trace_ide_dma_cb(s, sector_num, n, IDE_DMA_CMD_str(s->dma_cmd));
940
941 if ((s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) &&
942 !ide_sect_range_ok(s, sector_num, n)) {
943 ide_dma_error(s);
944 block_acct_invalid(blk_get_stats(s->blk), s->acct.type);
945 return;
946 }
947
948 offset = sector_num << BDRV_SECTOR_BITS;
949 switch (s->dma_cmd) {
950 case IDE_DMA_READ:
951 s->bus->dma->aiocb = dma_blk_read(s->blk, &s->sg, offset,
952 BDRV_SECTOR_SIZE, ide_dma_cb, s);
953 break;
954 case IDE_DMA_WRITE:
955 s->bus->dma->aiocb = dma_blk_write(s->blk, &s->sg, offset,
956 BDRV_SECTOR_SIZE, ide_dma_cb, s);
957 break;
958 case IDE_DMA_TRIM:
959 s->bus->dma->aiocb = dma_blk_io(blk_get_aio_context(s->blk),
960 &s->sg, offset, BDRV_SECTOR_SIZE,
961 ide_issue_trim, s, ide_dma_cb, s,
962 DMA_DIRECTION_TO_DEVICE);
963 break;
964 default:
965 abort();
966 }
967 return;
968
969 eot:
970 if (s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) {
971 block_acct_done(blk_get_stats(s->blk), &s->acct);
972 }
973 ide_set_inactive(s, stay_active);
974 }
975
976 static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
977 {
978 s->status = READY_STAT | SEEK_STAT | DRQ_STAT;
979 s->io_buffer_size = 0;
980 s->dma_cmd = dma_cmd;
981
982 switch (dma_cmd) {
983 case IDE_DMA_READ:
984 block_acct_start(blk_get_stats(s->blk), &s->acct,
985 s->nsector * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);
986 break;
987 case IDE_DMA_WRITE:
988 block_acct_start(blk_get_stats(s->blk), &s->acct,
989 s->nsector * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE);
990 break;
991 default:
992 break;
993 }
994
995 ide_start_dma(s, ide_dma_cb);
996 }
997
998 void ide_start_dma(IDEState *s, BlockCompletionFunc *cb)
999 {
1000 s->io_buffer_index = 0;
1001 ide_set_retry(s);
1002 if (s->bus->dma->ops->start_dma) {
1003 s->bus->dma->ops->start_dma(s->bus->dma, s, cb);
1004 }
1005 }
1006
1007 static void ide_sector_write(IDEState *s);
1008
1009 static void ide_sector_write_timer_cb(void *opaque)
1010 {
1011 IDEState *s = opaque;
1012 ide_bus_set_irq(s->bus);
1013 }
1014
1015 static void ide_sector_write_cb(void *opaque, int ret)
1016 {
1017 IDEState *s = opaque;
1018 int n;
1019
1020 s->pio_aiocb = NULL;
1021 s->status &= ~BUSY_STAT;
1022
1023 if (ret != 0) {
1024 if (ide_handle_rw_error(s, -ret, IDE_RETRY_PIO)) {
1025 return;
1026 }
1027 }
1028
1029 block_acct_done(blk_get_stats(s->blk), &s->acct);
1030
1031 n = s->nsector;
1032 if (n > s->req_nb_sectors) {
1033 n = s->req_nb_sectors;
1034 }
1035 s->nsector -= n;
1036
1037 ide_set_sector(s, ide_get_sector(s) + n);
1038 if (s->nsector == 0) {
1039 /* no more sectors to write */
1040 ide_transfer_stop(s);
1041 } else {
1042 int n1 = s->nsector;
1043 if (n1 > s->req_nb_sectors) {
1044 n1 = s->req_nb_sectors;
1045 }
1046 ide_transfer_start(s, s->io_buffer, n1 * BDRV_SECTOR_SIZE,
1047 ide_sector_write);
1048 }
1049
1050 if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
1051 /* It seems there is a bug in the Windows 2000 installer HDD
1052 IDE driver which fills the disk with empty logs when the
1053 IDE write IRQ comes too early. This hack tries to correct
1054 that at the expense of slower write performances. Use this
1055 option _only_ to install Windows 2000. You must disable it
1056 for normal use. */
1057 timer_mod(s->sector_write_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1058 (NANOSECONDS_PER_SECOND / 1000));
1059 } else {
1060 ide_bus_set_irq(s->bus);
1061 }
1062 }
1063
1064 static void ide_sector_write(IDEState *s)
1065 {
1066 int64_t sector_num;
1067 int n;
1068
1069 s->status = READY_STAT | SEEK_STAT | BUSY_STAT;
1070 sector_num = ide_get_sector(s);
1071
1072 n = s->nsector;
1073 if (n > s->req_nb_sectors) {
1074 n = s->req_nb_sectors;
1075 }
1076
1077 trace_ide_sector_write(sector_num, n);
1078
1079 if (!ide_sect_range_ok(s, sector_num, n)) {
1080 ide_rw_error(s);
1081 block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_WRITE);
1082 return;
1083 }
1084
1085 qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
1086
1087 block_acct_start(blk_get_stats(s->blk), &s->acct,
1088 n * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE);
1089 s->pio_aiocb = blk_aio_pwritev(s->blk, sector_num << BDRV_SECTOR_BITS,
1090 &s->qiov, 0, ide_sector_write_cb, s);
1091 }
1092
1093 static void ide_flush_cb(void *opaque, int ret)
1094 {
1095 IDEState *s = opaque;
1096
1097 s->pio_aiocb = NULL;
1098
1099 if (ret < 0) {
1100 /* XXX: What sector number to set here? */
1101 if (ide_handle_rw_error(s, -ret, IDE_RETRY_FLUSH)) {
1102 return;
1103 }
1104 }
1105
1106 if (s->blk) {
1107 block_acct_done(blk_get_stats(s->blk), &s->acct);
1108 }
1109 s->status = READY_STAT | SEEK_STAT;
1110 ide_cmd_done(s);
1111 ide_bus_set_irq(s->bus);
1112 }
1113
1114 static void ide_flush_cache(IDEState *s)
1115 {
1116 if (s->blk == NULL) {
1117 ide_flush_cb(s, 0);
1118 return;
1119 }
1120
1121 s->status |= BUSY_STAT;
1122 ide_set_retry(s);
1123 block_acct_start(blk_get_stats(s->blk), &s->acct, 0, BLOCK_ACCT_FLUSH);
1124 s->pio_aiocb = blk_aio_flush(s->blk, ide_flush_cb, s);
1125 }
1126
1127 static void ide_cfata_metadata_inquiry(IDEState *s)
1128 {
1129 uint16_t *p;
1130 uint32_t spd;
1131
1132 p = (uint16_t *) s->io_buffer;
1133 memset(p, 0, 0x200);
1134 spd = ((s->mdata_size - 1) >> 9) + 1;
1135
1136 put_le16(p + 0, 0x0001); /* Data format revision */
1137 put_le16(p + 1, 0x0000); /* Media property: silicon */
1138 put_le16(p + 2, s->media_changed); /* Media status */
1139 put_le16(p + 3, s->mdata_size & 0xffff); /* Capacity in bytes (low) */
1140 put_le16(p + 4, s->mdata_size >> 16); /* Capacity in bytes (high) */
1141 put_le16(p + 5, spd & 0xffff); /* Sectors per device (low) */
1142 put_le16(p + 6, spd >> 16); /* Sectors per device (high) */
1143 }
1144
1145 static void ide_cfata_metadata_read(IDEState *s)
1146 {
1147 uint16_t *p;
1148
1149 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1150 s->status = ERR_STAT;
1151 s->error = ABRT_ERR;
1152 return;
1153 }
1154
1155 p = (uint16_t *) s->io_buffer;
1156 memset(p, 0, 0x200);
1157
1158 put_le16(p + 0, s->media_changed); /* Media status */
1159 memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1160 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1161 s->nsector << 9), 0x200 - 2));
1162 }
1163
1164 static void ide_cfata_metadata_write(IDEState *s)
1165 {
1166 if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
1167 s->status = ERR_STAT;
1168 s->error = ABRT_ERR;
1169 return;
1170 }
1171
1172 s->media_changed = 0;
1173
1174 memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
1175 s->io_buffer + 2,
1176 MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
1177 s->nsector << 9), 0x200 - 2));
1178 }
1179
1180 /* called when the inserted state of the media has changed */
1181 static void ide_cd_change_cb(void *opaque, bool load, Error **errp)
1182 {
1183 IDEState *s = opaque;
1184 uint64_t nb_sectors;
1185
1186 s->tray_open = !load;
1187 blk_get_geometry(s->blk, &nb_sectors);
1188 s->nb_sectors = nb_sectors;
1189
1190 /*
1191 * First indicate to the guest that a CD has been removed. That's
1192 * done on the next command the guest sends us.
1193 *
1194 * Then we set UNIT_ATTENTION, by which the guest will
1195 * detect a new CD in the drive. See ide_atapi_cmd() for details.
1196 */
1197 s->cdrom_changed = 1;
1198 s->events.new_media = true;
1199 s->events.eject_request = false;
1200 ide_bus_set_irq(s->bus);
1201 }
1202
1203 static void ide_cd_eject_request_cb(void *opaque, bool force)
1204 {
1205 IDEState *s = opaque;
1206
1207 s->events.eject_request = true;
1208 if (force) {
1209 s->tray_locked = false;
1210 }
1211 ide_bus_set_irq(s->bus);
1212 }
1213
1214 static void ide_cmd_lba48_transform(IDEState *s, int lba48)
1215 {
1216 s->lba48 = lba48;
1217
1218 /* handle the 'magic' 0 nsector count conversion here. to avoid
1219 * fiddling with the rest of the read logic, we just store the
1220 * full sector count in ->nsector and ignore ->hob_nsector from now
1221 */
1222 if (!s->lba48) {
1223 if (!s->nsector)
1224 s->nsector = 256;
1225 } else {
1226 if (!s->nsector && !s->hob_nsector)
1227 s->nsector = 65536;
1228 else {
1229 int lo = s->nsector;
1230 int hi = s->hob_nsector;
1231
1232 s->nsector = (hi << 8) | lo;
1233 }
1234 }
1235 }
1236
1237 static void ide_clear_hob(IDEBus *bus)
1238 {
1239 /* any write clears HOB high bit of device control register */
1240 bus->cmd &= ~(IDE_CTRL_HOB);
1241 }
1242
1243 /* IOport [W]rite [R]egisters */
1244 enum ATA_IOPORT_WR {
1245 ATA_IOPORT_WR_DATA = 0,
1246 ATA_IOPORT_WR_FEATURES = 1,
1247 ATA_IOPORT_WR_SECTOR_COUNT = 2,
1248 ATA_IOPORT_WR_SECTOR_NUMBER = 3,
1249 ATA_IOPORT_WR_CYLINDER_LOW = 4,
1250 ATA_IOPORT_WR_CYLINDER_HIGH = 5,
1251 ATA_IOPORT_WR_DEVICE_HEAD = 6,
1252 ATA_IOPORT_WR_COMMAND = 7,
1253 ATA_IOPORT_WR_NUM_REGISTERS,
1254 };
1255
1256 const char *ATA_IOPORT_WR_lookup[ATA_IOPORT_WR_NUM_REGISTERS] = {
1257 [ATA_IOPORT_WR_DATA] = "Data",
1258 [ATA_IOPORT_WR_FEATURES] = "Features",
1259 [ATA_IOPORT_WR_SECTOR_COUNT] = "Sector Count",
1260 [ATA_IOPORT_WR_SECTOR_NUMBER] = "Sector Number",
1261 [ATA_IOPORT_WR_CYLINDER_LOW] = "Cylinder Low",
1262 [ATA_IOPORT_WR_CYLINDER_HIGH] = "Cylinder High",
1263 [ATA_IOPORT_WR_DEVICE_HEAD] = "Device/Head",
1264 [ATA_IOPORT_WR_COMMAND] = "Command"
1265 };
1266
1267 void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
1268 {
1269 IDEBus *bus = opaque;
1270 IDEState *s = ide_bus_active_if(bus);
1271 int reg_num = addr & 7;
1272
1273 trace_ide_ioport_write(addr, ATA_IOPORT_WR_lookup[reg_num], val, bus, s);
1274
1275 /* ignore writes to command block while busy with previous command */
1276 if (reg_num != 7 && (s->status & (BUSY_STAT|DRQ_STAT))) {
1277 return;
1278 }
1279
1280 /* NOTE: Device0 and Device1 both receive incoming register writes.
1281 * (They're on the same bus! They have to!) */
1282
1283 switch (reg_num) {
1284 case 0:
1285 break;
1286 case ATA_IOPORT_WR_FEATURES:
1287 ide_clear_hob(bus);
1288 bus->ifs[0].hob_feature = bus->ifs[0].feature;
1289 bus->ifs[1].hob_feature = bus->ifs[1].feature;
1290 bus->ifs[0].feature = val;
1291 bus->ifs[1].feature = val;
1292 break;
1293 case ATA_IOPORT_WR_SECTOR_COUNT:
1294 ide_clear_hob(bus);
1295 bus->ifs[0].hob_nsector = bus->ifs[0].nsector;
1296 bus->ifs[1].hob_nsector = bus->ifs[1].nsector;
1297 bus->ifs[0].nsector = val;
1298 bus->ifs[1].nsector = val;
1299 break;
1300 case ATA_IOPORT_WR_SECTOR_NUMBER:
1301 ide_clear_hob(bus);
1302 bus->ifs[0].hob_sector = bus->ifs[0].sector;
1303 bus->ifs[1].hob_sector = bus->ifs[1].sector;
1304 bus->ifs[0].sector = val;
1305 bus->ifs[1].sector = val;
1306 break;
1307 case ATA_IOPORT_WR_CYLINDER_LOW:
1308 ide_clear_hob(bus);
1309 bus->ifs[0].hob_lcyl = bus->ifs[0].lcyl;
1310 bus->ifs[1].hob_lcyl = bus->ifs[1].lcyl;
1311 bus->ifs[0].lcyl = val;
1312 bus->ifs[1].lcyl = val;
1313 break;
1314 case ATA_IOPORT_WR_CYLINDER_HIGH:
1315 ide_clear_hob(bus);
1316 bus->ifs[0].hob_hcyl = bus->ifs[0].hcyl;
1317 bus->ifs[1].hob_hcyl = bus->ifs[1].hcyl;
1318 bus->ifs[0].hcyl = val;
1319 bus->ifs[1].hcyl = val;
1320 break;
1321 case ATA_IOPORT_WR_DEVICE_HEAD:
1322 ide_clear_hob(bus);
1323 bus->ifs[0].select = val | (ATA_DEV_ALWAYS_ON);
1324 bus->ifs[1].select = val | (ATA_DEV_ALWAYS_ON);
1325 /* select drive */
1326 bus->unit = (val & (ATA_DEV_SELECT)) ? 1 : 0;
1327 break;
1328 default:
1329 case ATA_IOPORT_WR_COMMAND:
1330 ide_clear_hob(bus);
1331 qemu_irq_lower(bus->irq);
1332 ide_bus_exec_cmd(bus, val);
1333 break;
1334 }
1335 }
1336
1337 static void ide_reset(IDEState *s)
1338 {
1339 trace_ide_reset(s);
1340
1341 if (s->pio_aiocb) {
1342 blk_aio_cancel(s->pio_aiocb);
1343 s->pio_aiocb = NULL;
1344 }
1345
1346 if (s->reset_reverts) {
1347 s->reset_reverts = false;
1348 s->heads = s->drive_heads;
1349 s->sectors = s->drive_sectors;
1350 }
1351 if (s->drive_kind == IDE_CFATA)
1352 s->mult_sectors = 0;
1353 else
1354 s->mult_sectors = MAX_MULT_SECTORS;
1355 /* ide regs */
1356 s->feature = 0;
1357 s->error = 0;
1358 s->nsector = 0;
1359 s->sector = 0;
1360 s->lcyl = 0;
1361 s->hcyl = 0;
1362
1363 /* lba48 */
1364 s->hob_feature = 0;
1365 s->hob_sector = 0;
1366 s->hob_nsector = 0;
1367 s->hob_lcyl = 0;
1368 s->hob_hcyl = 0;
1369
1370 s->select = (ATA_DEV_ALWAYS_ON);
1371 s->status = READY_STAT | SEEK_STAT;
1372
1373 s->lba48 = 0;
1374
1375 /* ATAPI specific */
1376 s->sense_key = 0;
1377 s->asc = 0;
1378 s->cdrom_changed = 0;
1379 s->packet_transfer_size = 0;
1380 s->elementary_transfer_size = 0;
1381 s->io_buffer_index = 0;
1382 s->cd_sector_size = 0;
1383 s->atapi_dma = 0;
1384 s->tray_locked = 0;
1385 s->tray_open = 0;
1386 /* ATA DMA state */
1387 s->io_buffer_size = 0;
1388 s->req_nb_sectors = 0;
1389
1390 ide_set_signature(s);
1391 /* init the transfer handler so that 0xffff is returned on data
1392 accesses */
1393 s->end_transfer_func = ide_dummy_transfer_stop;
1394 ide_dummy_transfer_stop(s);
1395 s->media_changed = 0;
1396 }
1397
1398 static bool cmd_nop(IDEState *s, uint8_t cmd)
1399 {
1400 return true;
1401 }
1402
1403 static bool cmd_device_reset(IDEState *s, uint8_t cmd)
1404 {
1405 /* Halt PIO (in the DRQ phase), then DMA */
1406 ide_transfer_halt(s);
1407 ide_cancel_dma_sync(s);
1408
1409 /* Reset any PIO commands, reset signature, etc */
1410 ide_reset(s);
1411
1412 /* RESET: ATA8-ACS3 7.10.4 "Normal Outputs";
1413 * ATA8-ACS3 Table 184 "Device Signatures for Normal Output" */
1414 s->status = 0x00;
1415
1416 /* Do not overwrite status register */
1417 return false;
1418 }
1419
1420 static bool cmd_data_set_management(IDEState *s, uint8_t cmd)
1421 {
1422 switch (s->feature) {
1423 case DSM_TRIM:
1424 if (s->blk) {
1425 ide_sector_start_dma(s, IDE_DMA_TRIM);
1426 return false;
1427 }
1428 break;
1429 }
1430
1431 ide_abort_command(s);
1432 return true;
1433 }
1434
1435 static bool cmd_identify(IDEState *s, uint8_t cmd)
1436 {
1437 if (s->blk && s->drive_kind != IDE_CD) {
1438 if (s->drive_kind != IDE_CFATA) {
1439 ide_identify(s);
1440 } else {
1441 ide_cfata_identify(s);
1442 }
1443 s->status = READY_STAT | SEEK_STAT;
1444 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1445 ide_bus_set_irq(s->bus);
1446 return false;
1447 } else {
1448 if (s->drive_kind == IDE_CD) {
1449 ide_set_signature(s);
1450 }
1451 ide_abort_command(s);
1452 }
1453
1454 return true;
1455 }
1456
1457 static bool cmd_verify(IDEState *s, uint8_t cmd)
1458 {
1459 bool lba48 = (cmd == WIN_VERIFY_EXT);
1460
1461 /* do sector number check ? */
1462 ide_cmd_lba48_transform(s, lba48);
1463
1464 return true;
1465 }
1466
1467 static bool cmd_set_multiple_mode(IDEState *s, uint8_t cmd)
1468 {
1469 if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
1470 /* Disable Read and Write Multiple */
1471 s->mult_sectors = 0;
1472 } else if ((s->nsector & 0xff) != 0 &&
1473 ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
1474 (s->nsector & (s->nsector - 1)) != 0)) {
1475 ide_abort_command(s);
1476 } else {
1477 s->mult_sectors = s->nsector & 0xff;
1478 }
1479
1480 return true;
1481 }
1482
1483 static bool cmd_read_multiple(IDEState *s, uint8_t cmd)
1484 {
1485 bool lba48 = (cmd == WIN_MULTREAD_EXT);
1486
1487 if (!s->blk || !s->mult_sectors) {
1488 ide_abort_command(s);
1489 return true;
1490 }
1491
1492 ide_cmd_lba48_transform(s, lba48);
1493 s->req_nb_sectors = s->mult_sectors;
1494 ide_sector_read(s);
1495 return false;
1496 }
1497
1498 static bool cmd_write_multiple(IDEState *s, uint8_t cmd)
1499 {
1500 bool lba48 = (cmd == WIN_MULTWRITE_EXT);
1501 int n;
1502
1503 if (!s->blk || !s->mult_sectors) {
1504 ide_abort_command(s);
1505 return true;
1506 }
1507
1508 ide_cmd_lba48_transform(s, lba48);
1509
1510 s->req_nb_sectors = s->mult_sectors;
1511 n = MIN(s->nsector, s->req_nb_sectors);
1512
1513 s->status = SEEK_STAT | READY_STAT;
1514 ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
1515
1516 s->media_changed = 1;
1517
1518 return false;
1519 }
1520
1521 static bool cmd_read_pio(IDEState *s, uint8_t cmd)
1522 {
1523 bool lba48 = (cmd == WIN_READ_EXT);
1524
1525 if (s->drive_kind == IDE_CD) {
1526 ide_set_signature(s); /* odd, but ATA4 8.27.5.2 requires it */
1527 ide_abort_command(s);
1528 return true;
1529 }
1530
1531 if (!s->blk) {
1532 ide_abort_command(s);
1533 return true;
1534 }
1535
1536 ide_cmd_lba48_transform(s, lba48);
1537 s->req_nb_sectors = 1;
1538 ide_sector_read(s);
1539
1540 return false;
1541 }
1542
1543 static bool cmd_write_pio(IDEState *s, uint8_t cmd)
1544 {
1545 bool lba48 = (cmd == WIN_WRITE_EXT);
1546
1547 if (!s->blk) {
1548 ide_abort_command(s);
1549 return true;
1550 }
1551
1552 ide_cmd_lba48_transform(s, lba48);
1553
1554 s->req_nb_sectors = 1;
1555 s->status = SEEK_STAT | READY_STAT;
1556 ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
1557
1558 s->media_changed = 1;
1559
1560 return false;
1561 }
1562
1563 static bool cmd_read_dma(IDEState *s, uint8_t cmd)
1564 {
1565 bool lba48 = (cmd == WIN_READDMA_EXT);
1566
1567 if (!s->blk) {
1568 ide_abort_command(s);
1569 return true;
1570 }
1571
1572 ide_cmd_lba48_transform(s, lba48);
1573 ide_sector_start_dma(s, IDE_DMA_READ);
1574
1575 return false;
1576 }
1577
1578 static bool cmd_write_dma(IDEState *s, uint8_t cmd)
1579 {
1580 bool lba48 = (cmd == WIN_WRITEDMA_EXT);
1581
1582 if (!s->blk) {
1583 ide_abort_command(s);
1584 return true;
1585 }
1586
1587 ide_cmd_lba48_transform(s, lba48);
1588 ide_sector_start_dma(s, IDE_DMA_WRITE);
1589
1590 s->media_changed = 1;
1591
1592 return false;
1593 }
1594
1595 static bool cmd_flush_cache(IDEState *s, uint8_t cmd)
1596 {
1597 ide_flush_cache(s);
1598 return false;
1599 }
1600
1601 static bool cmd_seek(IDEState *s, uint8_t cmd)
1602 {
1603 /* XXX: Check that seek is within bounds */
1604 return true;
1605 }
1606
1607 static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
1608 {
1609 bool lba48 = (cmd == WIN_READ_NATIVE_MAX_EXT);
1610
1611 /* Refuse if no sectors are addressable (e.g. medium not inserted) */
1612 if (s->nb_sectors == 0) {
1613 ide_abort_command(s);
1614 return true;
1615 }
1616
1617 ide_cmd_lba48_transform(s, lba48);
1618 ide_set_sector(s, s->nb_sectors - 1);
1619
1620 return true;
1621 }
1622
1623 static bool cmd_check_power_mode(IDEState *s, uint8_t cmd)
1624 {
1625 s->nsector = 0xff; /* device active or idle */
1626 return true;
1627 }
1628
1629 /* INITIALIZE DEVICE PARAMETERS */
1630 static bool cmd_specify(IDEState *s, uint8_t cmd)
1631 {
1632 if (s->blk && s->drive_kind != IDE_CD) {
1633 s->heads = (s->select & (ATA_DEV_HS)) + 1;
1634 s->sectors = s->nsector;
1635 ide_bus_set_irq(s->bus);
1636 } else {
1637 ide_abort_command(s);
1638 }
1639
1640 return true;
1641 }
1642
1643 static bool cmd_set_features(IDEState *s, uint8_t cmd)
1644 {
1645 uint16_t *identify_data;
1646
1647 if (!s->blk) {
1648 ide_abort_command(s);
1649 return true;
1650 }
1651
1652 /* XXX: valid for CDROM ? */
1653 switch (s->feature) {
1654 case 0x01: /* 8-bit I/O enable (CompactFlash) */
1655 case 0x81: /* 8-bit I/O disable (CompactFlash) */
1656 if (s->drive_kind != IDE_CFATA) {
1657 goto abort_cmd;
1658 }
1659 s->io8 = !(s->feature & 0x80);
1660 return true;
1661 case 0x02: /* write cache enable */
1662 blk_set_enable_write_cache(s->blk, true);
1663 identify_data = (uint16_t *)s->identify_data;
1664 put_le16(identify_data + 85, (1 << 14) | (1 << 5) | 1);
1665 return true;
1666 case 0x82: /* write cache disable */
1667 blk_set_enable_write_cache(s->blk, false);
1668 identify_data = (uint16_t *)s->identify_data;
1669 put_le16(identify_data + 85, (1 << 14) | 1);
1670 ide_flush_cache(s);
1671 return false;
1672 case 0xcc: /* reverting to power-on defaults enable */
1673 s->reset_reverts = true;
1674 return true;
1675 case 0x66: /* reverting to power-on defaults disable */
1676 s->reset_reverts = false;
1677 return true;
1678 case 0xaa: /* read look-ahead enable */
1679 case 0x55: /* read look-ahead disable */
1680 case 0x05: /* set advanced power management mode */
1681 case 0x85: /* disable advanced power management mode */
1682 case 0x69: /* NOP */
1683 case 0x67: /* NOP */
1684 case 0x96: /* NOP */
1685 case 0x9a: /* NOP */
1686 case 0x42: /* enable Automatic Acoustic Mode */
1687 case 0xc2: /* disable Automatic Acoustic Mode */
1688 return true;
1689 case 0x03: /* set transfer mode */
1690 {
1691 uint8_t val = s->nsector & 0x07;
1692 identify_data = (uint16_t *)s->identify_data;
1693
1694 switch (s->nsector >> 3) {
1695 case 0x00: /* pio default */
1696 case 0x01: /* pio mode */
1697 put_le16(identify_data + 62, 0x07);
1698 put_le16(identify_data + 63, 0x07);
1699 put_le16(identify_data + 88, 0x3f);
1700 break;
1701 case 0x02: /* sigle word dma mode*/
1702 put_le16(identify_data + 62, 0x07 | (1 << (val + 8)));
1703 put_le16(identify_data + 63, 0x07);
1704 put_le16(identify_data + 88, 0x3f);
1705 break;
1706 case 0x04: /* mdma mode */
1707 put_le16(identify_data + 62, 0x07);
1708 put_le16(identify_data + 63, 0x07 | (1 << (val + 8)));
1709 put_le16(identify_data + 88, 0x3f);
1710 break;
1711 case 0x08: /* udma mode */
1712 put_le16(identify_data + 62, 0x07);
1713 put_le16(identify_data + 63, 0x07);
1714 put_le16(identify_data + 88, 0x3f | (1 << (val + 8)));
1715 break;
1716 default:
1717 goto abort_cmd;
1718 }
1719 return true;
1720 }
1721 }
1722
1723 abort_cmd:
1724 ide_abort_command(s);
1725 return true;
1726 }
1727
1728
1729 /*** ATAPI commands ***/
1730
1731 static bool cmd_identify_packet(IDEState *s, uint8_t cmd)
1732 {
1733 ide_atapi_identify(s);
1734 s->status = READY_STAT | SEEK_STAT;
1735 ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1736 ide_bus_set_irq(s->bus);
1737 return false;
1738 }
1739
1740 /* EXECUTE DEVICE DIAGNOSTIC */
1741 static bool cmd_exec_dev_diagnostic(IDEState *s, uint8_t cmd)
1742 {
1743 /*
1744 * Clear the device register per the ATA (v6) specification,
1745 * because ide_set_signature does not clear LBA or drive bits.
1746 */
1747 s->select = (ATA_DEV_ALWAYS_ON);
1748 ide_set_signature(s);
1749
1750 if (s->drive_kind == IDE_CD) {
1751 s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
1752 * devices to return a clear status register
1753 * with READY_STAT *not* set. */
1754 s->error = 0x01;
1755 } else {
1756 s->status = READY_STAT | SEEK_STAT;
1757 /* The bits of the error register are not as usual for this command!
1758 * They are part of the regular output (this is why ERR_STAT isn't set)
1759 * Device 0 passed, Device 1 passed or not present. */
1760 s->error = 0x01;
1761 ide_bus_set_irq(s->bus);
1762 }
1763
1764 return false;
1765 }
1766
1767 static bool cmd_packet(IDEState *s, uint8_t cmd)
1768 {
1769 /* overlapping commands not supported */
1770 if (s->feature & 0x02) {
1771 ide_abort_command(s);
1772 return true;
1773 }
1774
1775 s->status = READY_STAT | SEEK_STAT;
1776 s->atapi_dma = s->feature & 1;
1777 if (s->atapi_dma) {
1778 s->dma_cmd = IDE_DMA_ATAPI;
1779 }
1780 s->nsector = 1;
1781 ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
1782 ide_atapi_cmd);
1783 return false;
1784 }
1785
1786
1787 /*** CF-ATA commands ***/
1788
1789 static bool cmd_cfa_req_ext_error_code(IDEState *s, uint8_t cmd)
1790 {
1791 s->error = 0x09; /* miscellaneous error */
1792 s->status = READY_STAT | SEEK_STAT;
1793 ide_bus_set_irq(s->bus);
1794
1795 return false;
1796 }
1797
1798 static bool cmd_cfa_erase_sectors(IDEState *s, uint8_t cmd)
1799 {
1800 /* WIN_SECURITY_FREEZE_LOCK has the same ID as CFA_WEAR_LEVEL and is
1801 * required for Windows 8 to work with AHCI */
1802
1803 if (cmd == CFA_WEAR_LEVEL) {
1804 s->nsector = 0;
1805 }
1806
1807 if (cmd == CFA_ERASE_SECTORS) {
1808 s->media_changed = 1;
1809 }
1810
1811 return true;
1812 }
1813
1814 static bool cmd_cfa_translate_sector(IDEState *s, uint8_t cmd)
1815 {
1816 s->status = READY_STAT | SEEK_STAT;
1817
1818 memset(s->io_buffer, 0, 0x200);
1819 s->io_buffer[0x00] = s->hcyl; /* Cyl MSB */
1820 s->io_buffer[0x01] = s->lcyl; /* Cyl LSB */
1821 s->io_buffer[0x02] = s->select; /* Head */
1822 s->io_buffer[0x03] = s->sector; /* Sector */
1823 s->io_buffer[0x04] = ide_get_sector(s) >> 16; /* LBA MSB */
1824 s->io_buffer[0x05] = ide_get_sector(s) >> 8; /* LBA */
1825 s->io_buffer[0x06] = ide_get_sector(s) >> 0; /* LBA LSB */
1826 s->io_buffer[0x13] = 0x00; /* Erase flag */
1827 s->io_buffer[0x18] = 0x00; /* Hot count */
1828 s->io_buffer[0x19] = 0x00; /* Hot count */
1829 s->io_buffer[0x1a] = 0x01; /* Hot count */
1830
1831 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1832 ide_bus_set_irq(s->bus);
1833
1834 return false;
1835 }
1836
1837 static bool cmd_cfa_access_metadata_storage(IDEState *s, uint8_t cmd)
1838 {
1839 switch (s->feature) {
1840 case 0x02: /* Inquiry Metadata Storage */
1841 ide_cfata_metadata_inquiry(s);
1842 break;
1843 case 0x03: /* Read Metadata Storage */
1844 ide_cfata_metadata_read(s);
1845 break;
1846 case 0x04: /* Write Metadata Storage */
1847 ide_cfata_metadata_write(s);
1848 break;
1849 default:
1850 ide_abort_command(s);
1851 return true;
1852 }
1853
1854 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1855 s->status = 0x00; /* NOTE: READY is _not_ set */
1856 ide_bus_set_irq(s->bus);
1857
1858 return false;
1859 }
1860
1861 static bool cmd_ibm_sense_condition(IDEState *s, uint8_t cmd)
1862 {
1863 switch (s->feature) {
1864 case 0x01: /* sense temperature in device */
1865 s->nsector = 0x50; /* +20 C */
1866 break;
1867 default:
1868 ide_abort_command(s);
1869 return true;
1870 }
1871
1872 return true;
1873 }
1874
1875
1876 /*** SMART commands ***/
1877
1878 static bool cmd_smart(IDEState *s, uint8_t cmd)
1879 {
1880 int n;
1881
1882 if (s->hcyl != 0xc2 || s->lcyl != 0x4f) {
1883 goto abort_cmd;
1884 }
1885
1886 if (!s->smart_enabled && s->feature != SMART_ENABLE) {
1887 goto abort_cmd;
1888 }
1889
1890 switch (s->feature) {
1891 case SMART_DISABLE:
1892 s->smart_enabled = 0;
1893 return true;
1894
1895 case SMART_ENABLE:
1896 s->smart_enabled = 1;
1897 return true;
1898
1899 case SMART_ATTR_AUTOSAVE:
1900 switch (s->sector) {
1901 case 0x00:
1902 s->smart_autosave = 0;
1903 break;
1904 case 0xf1:
1905 s->smart_autosave = 1;
1906 break;
1907 default:
1908 goto abort_cmd;
1909 }
1910 return true;
1911
1912 case SMART_STATUS:
1913 if (!s->smart_errors) {
1914 s->hcyl = 0xc2;
1915 s->lcyl = 0x4f;
1916 } else {
1917 s->hcyl = 0x2c;
1918 s->lcyl = 0xf4;
1919 }
1920 return true;
1921
1922 case SMART_READ_THRESH:
1923 memset(s->io_buffer, 0, 0x200);
1924 s->io_buffer[0] = 0x01; /* smart struct version */
1925
1926 for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
1927 s->io_buffer[2 + 0 + (n * 12)] = smart_attributes[n][0];
1928 s->io_buffer[2 + 1 + (n * 12)] = smart_attributes[n][11];
1929 }
1930
1931 /* checksum */
1932 for (n = 0; n < 511; n++) {
1933 s->io_buffer[511] += s->io_buffer[n];
1934 }
1935 s->io_buffer[511] = 0x100 - s->io_buffer[511];
1936
1937 s->status = READY_STAT | SEEK_STAT;
1938 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1939 ide_bus_set_irq(s->bus);
1940 return false;
1941
1942 case SMART_READ_DATA:
1943 memset(s->io_buffer, 0, 0x200);
1944 s->io_buffer[0] = 0x01; /* smart struct version */
1945
1946 for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
1947 int i;
1948 for (i = 0; i < 11; i++) {
1949 s->io_buffer[2 + i + (n * 12)] = smart_attributes[n][i];
1950 }
1951 }
1952
1953 s->io_buffer[362] = 0x02 | (s->smart_autosave ? 0x80 : 0x00);
1954 if (s->smart_selftest_count == 0) {
1955 s->io_buffer[363] = 0;
1956 } else {
1957 s->io_buffer[363] =
1958 s->smart_selftest_data[3 +
1959 (s->smart_selftest_count - 1) *
1960 24];
1961 }
1962 s->io_buffer[364] = 0x20;
1963 s->io_buffer[365] = 0x01;
1964 /* offline data collection capacity: execute + self-test*/
1965 s->io_buffer[367] = (1 << 4 | 1 << 3 | 1);
1966 s->io_buffer[368] = 0x03; /* smart capability (1) */
1967 s->io_buffer[369] = 0x00; /* smart capability (2) */
1968 s->io_buffer[370] = 0x01; /* error logging supported */
1969 s->io_buffer[372] = 0x02; /* minutes for poll short test */
1970 s->io_buffer[373] = 0x36; /* minutes for poll ext test */
1971 s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
1972
1973 for (n = 0; n < 511; n++) {
1974 s->io_buffer[511] += s->io_buffer[n];
1975 }
1976 s->io_buffer[511] = 0x100 - s->io_buffer[511];
1977
1978 s->status = READY_STAT | SEEK_STAT;
1979 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1980 ide_bus_set_irq(s->bus);
1981 return false;
1982
1983 case SMART_READ_LOG:
1984 switch (s->sector) {
1985 case 0x01: /* summary smart error log */
1986 memset(s->io_buffer, 0, 0x200);
1987 s->io_buffer[0] = 0x01;
1988 s->io_buffer[1] = 0x00; /* no error entries */
1989 s->io_buffer[452] = s->smart_errors & 0xff;
1990 s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
1991
1992 for (n = 0; n < 511; n++) {
1993 s->io_buffer[511] += s->io_buffer[n];
1994 }
1995 s->io_buffer[511] = 0x100 - s->io_buffer[511];
1996 break;
1997 case 0x06: /* smart self test log */
1998 memset(s->io_buffer, 0, 0x200);
1999 s->io_buffer[0] = 0x01;
2000 if (s->smart_selftest_count == 0) {
2001 s->io_buffer[508] = 0;
2002 } else {
2003 s->io_buffer[508] = s->smart_selftest_count;
2004 for (n = 2; n < 506; n++) {
2005 s->io_buffer[n] = s->smart_selftest_data[n];
2006 }
2007 }
2008
2009 for (n = 0; n < 511; n++) {
2010 s->io_buffer[511] += s->io_buffer[n];
2011 }
2012 s->io_buffer[511] = 0x100 - s->io_buffer[511];
2013 break;
2014 default:
2015 goto abort_cmd;
2016 }
2017 s->status = READY_STAT | SEEK_STAT;
2018 ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
2019 ide_bus_set_irq(s->bus);
2020 return false;
2021
2022 case SMART_EXECUTE_OFFLINE:
2023 switch (s->sector) {
2024 case 0: /* off-line routine */
2025 case 1: /* short self test */
2026 case 2: /* extended self test */
2027 s->smart_selftest_count++;
2028 if (s->smart_selftest_count > 21) {
2029 s->smart_selftest_count = 1;
2030 }
2031 n = 2 + (s->smart_selftest_count - 1) * 24;
2032 s->smart_selftest_data[n] = s->sector;
2033 s->smart_selftest_data[n + 1] = 0x00; /* OK and finished */
2034 s->smart_selftest_data[n + 2] = 0x34; /* hour count lsb */
2035 s->smart_selftest_data[n + 3] = 0x12; /* hour count msb */
2036 break;
2037 default:
2038 goto abort_cmd;
2039 }
2040 return true;
2041 }
2042
2043 abort_cmd:
2044 ide_abort_command(s);
2045 return true;
2046 }
2047
2048 #define HD_OK (1u << IDE_HD)
2049 #define CD_OK (1u << IDE_CD)
2050 #define CFA_OK (1u << IDE_CFATA)
2051 #define HD_CFA_OK (HD_OK | CFA_OK)
2052 #define ALL_OK (HD_OK | CD_OK | CFA_OK)
2053
2054 /* Set the Disk Seek Completed status bit during completion */
2055 #define SET_DSC (1u << 8)
2056
2057 /* See ACS-2 T13/2015-D Table B.2 Command codes */
2058 static const struct {
2059 /* Returns true if the completion code should be run */
2060 bool (*handler)(IDEState *s, uint8_t cmd);
2061 int flags;
2062 } ide_cmd_table[0x100] = {
2063 /* NOP not implemented, mandatory for CD */
2064 [CFA_REQ_EXT_ERROR_CODE] = { cmd_cfa_req_ext_error_code, CFA_OK },
2065 [WIN_DSM] = { cmd_data_set_management, HD_CFA_OK },
2066 [WIN_DEVICE_RESET] = { cmd_device_reset, CD_OK },
2067 [WIN_RECAL] = { cmd_nop, HD_CFA_OK | SET_DSC},
2068 [WIN_READ] = { cmd_read_pio, ALL_OK },
2069 [WIN_READ_ONCE] = { cmd_read_pio, HD_CFA_OK },
2070 [WIN_READ_EXT] = { cmd_read_pio, HD_CFA_OK },
2071 [WIN_READDMA_EXT] = { cmd_read_dma, HD_CFA_OK },
2072 [WIN_READ_NATIVE_MAX_EXT] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
2073 [WIN_MULTREAD_EXT] = { cmd_read_multiple, HD_CFA_OK },
2074 [WIN_WRITE] = { cmd_write_pio, HD_CFA_OK },
2075 [WIN_WRITE_ONCE] = { cmd_write_pio, HD_CFA_OK },
2076 [WIN_WRITE_EXT] = { cmd_write_pio, HD_CFA_OK },
2077 [WIN_WRITEDMA_EXT] = { cmd_write_dma, HD_CFA_OK },
2078 [CFA_WRITE_SECT_WO_ERASE] = { cmd_write_pio, CFA_OK },
2079 [WIN_MULTWRITE_EXT] = { cmd_write_multiple, HD_CFA_OK },
2080 [WIN_WRITE_VERIFY] = { cmd_write_pio, HD_CFA_OK },
2081 [WIN_VERIFY] = { cmd_verify, HD_CFA_OK | SET_DSC },
2082 [WIN_VERIFY_ONCE] = { cmd_verify, HD_CFA_OK | SET_DSC },
2083 [WIN_VERIFY_EXT] = { cmd_verify, HD_CFA_OK | SET_DSC },
2084 [WIN_SEEK] = { cmd_seek, HD_CFA_OK | SET_DSC },
2085 [CFA_TRANSLATE_SECTOR] = { cmd_cfa_translate_sector, CFA_OK },
2086 [WIN_DIAGNOSE] = { cmd_exec_dev_diagnostic, ALL_OK },
2087 [WIN_SPECIFY] = { cmd_specify, HD_CFA_OK | SET_DSC },
2088 [WIN_STANDBYNOW2] = { cmd_nop, HD_CFA_OK },
2089 [WIN_IDLEIMMEDIATE2] = { cmd_nop, HD_CFA_OK },
2090 [WIN_STANDBY2] = { cmd_nop, HD_CFA_OK },
2091 [WIN_SETIDLE2] = { cmd_nop, HD_CFA_OK },
2092 [WIN_CHECKPOWERMODE2] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
2093 [WIN_SLEEPNOW2] = { cmd_nop, HD_CFA_OK },
2094 [WIN_PACKETCMD] = { cmd_packet, CD_OK },
2095 [WIN_PIDENTIFY] = { cmd_identify_packet, CD_OK },
2096 [WIN_SMART] = { cmd_smart, HD_CFA_OK | SET_DSC },
2097 [CFA_ACCESS_METADATA_STORAGE] = { cmd_cfa_access_metadata_storage, CFA_OK },
2098 [CFA_ERASE_SECTORS] = { cmd_cfa_erase_sectors, CFA_OK | SET_DSC },
2099 [WIN_MULTREAD] = { cmd_read_multiple, HD_CFA_OK },
2100 [WIN_MULTWRITE] = { cmd_write_multiple, HD_CFA_OK },
2101 [WIN_SETMULT] = { cmd_set_multiple_mode, HD_CFA_OK | SET_DSC },
2102 [WIN_READDMA] = { cmd_read_dma, HD_CFA_OK },
2103 [WIN_READDMA_ONCE] = { cmd_read_dma, HD_CFA_OK },
2104 [WIN_WRITEDMA] = { cmd_write_dma, HD_CFA_OK },
2105 [WIN_WRITEDMA_ONCE] = { cmd_write_dma, HD_CFA_OK },
2106 [CFA_WRITE_MULTI_WO_ERASE] = { cmd_write_multiple, CFA_OK },
2107 [WIN_STANDBYNOW1] = { cmd_nop, HD_CFA_OK },
2108 [WIN_IDLEIMMEDIATE] = { cmd_nop, HD_CFA_OK },
2109 [WIN_STANDBY] = { cmd_nop, HD_CFA_OK },
2110 [WIN_SETIDLE1] = { cmd_nop, HD_CFA_OK },
2111 [WIN_CHECKPOWERMODE1] = { cmd_check_power_mode, HD_CFA_OK | SET_DSC },
2112 [WIN_SLEEPNOW1] = { cmd_nop, HD_CFA_OK },
2113 [WIN_FLUSH_CACHE] = { cmd_flush_cache, ALL_OK },
2114 [WIN_FLUSH_CACHE_EXT] = { cmd_flush_cache, HD_CFA_OK },
2115 [WIN_IDENTIFY] = { cmd_identify, ALL_OK },
2116 [WIN_SETFEATURES] = { cmd_set_features, ALL_OK | SET_DSC },
2117 [IBM_SENSE_CONDITION] = { cmd_ibm_sense_condition, CFA_OK | SET_DSC },
2118 [CFA_WEAR_LEVEL] = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC },
2119 [WIN_READ_NATIVE_MAX] = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
2120 };
2121
2122 static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
2123 {
2124 return cmd < ARRAY_SIZE(ide_cmd_table)
2125 && (ide_cmd_table[cmd].flags & (1u << s->drive_kind));
2126 }
2127
2128 void ide_bus_exec_cmd(IDEBus *bus, uint32_t val)
2129 {
2130 IDEState *s;
2131 bool complete;
2132
2133 s = ide_bus_active_if(bus);
2134 trace_ide_bus_exec_cmd(bus, s, val);
2135
2136 /* ignore commands to non existent slave */
2137 if (s != bus->ifs && !s->blk) {
2138 return;
2139 }
2140
2141 /* Only RESET is allowed while BSY and/or DRQ are set,
2142 * and only to ATAPI devices. */
2143 if (s->status & (BUSY_STAT|DRQ_STAT)) {
2144 if (val != WIN_DEVICE_RESET || s->drive_kind != IDE_CD) {
2145 return;
2146 }
2147 }
2148
2149 if (!ide_cmd_permitted(s, val)) {
2150 ide_abort_command(s);
2151 ide_bus_set_irq(s->bus);
2152 return;
2153 }
2154
2155 s->status = READY_STAT | BUSY_STAT;
2156 s->error = 0;
2157 s->io_buffer_offset = 0;
2158
2159 complete = ide_cmd_table[val].handler(s, val);
2160 if (complete) {
2161 s->status &= ~BUSY_STAT;
2162 assert(!!s->error == !!(s->status & ERR_STAT));
2163
2164 if ((ide_cmd_table[val].flags & SET_DSC) && !s->error) {
2165 s->status |= SEEK_STAT;
2166 }
2167
2168 ide_cmd_done(s);
2169 ide_bus_set_irq(s->bus);
2170 }
2171 }
2172
2173 /* IOport [R]ead [R]egisters */
2174 enum ATA_IOPORT_RR {
2175 ATA_IOPORT_RR_DATA = 0,
2176 ATA_IOPORT_RR_ERROR = 1,
2177 ATA_IOPORT_RR_SECTOR_COUNT = 2,
2178 ATA_IOPORT_RR_SECTOR_NUMBER = 3,
2179 ATA_IOPORT_RR_CYLINDER_LOW = 4,
2180 ATA_IOPORT_RR_CYLINDER_HIGH = 5,
2181 ATA_IOPORT_RR_DEVICE_HEAD = 6,
2182 ATA_IOPORT_RR_STATUS = 7,
2183 ATA_IOPORT_RR_NUM_REGISTERS,
2184 };
2185
2186 const char *ATA_IOPORT_RR_lookup[ATA_IOPORT_RR_NUM_REGISTERS] = {
2187 [ATA_IOPORT_RR_DATA] = "Data",
2188 [ATA_IOPORT_RR_ERROR] = "Error",
2189 [ATA_IOPORT_RR_SECTOR_COUNT] = "Sector Count",
2190 [ATA_IOPORT_RR_SECTOR_NUMBER] = "Sector Number",
2191 [ATA_IOPORT_RR_CYLINDER_LOW] = "Cylinder Low",
2192 [ATA_IOPORT_RR_CYLINDER_HIGH] = "Cylinder High",
2193 [ATA_IOPORT_RR_DEVICE_HEAD] = "Device/Head",
2194 [ATA_IOPORT_RR_STATUS] = "Status"
2195 };
2196
2197 uint32_t ide_ioport_read(void *opaque, uint32_t addr)
2198 {
2199 IDEBus *bus = opaque;
2200 IDEState *s = ide_bus_active_if(bus);
2201 uint32_t reg_num;
2202 int ret, hob;
2203
2204 reg_num = addr & 7;
2205 hob = bus->cmd & (IDE_CTRL_HOB);
2206 switch (reg_num) {
2207 case ATA_IOPORT_RR_DATA:
2208 /*
2209 * The pre-GRUB Solaris x86 bootloader relies upon inb
2210 * consuming a word from the drive's sector buffer.
2211 */
2212 ret = ide_data_readw(bus, addr) & 0xff;
2213 break;
2214 case ATA_IOPORT_RR_ERROR:
2215 if ((!bus->ifs[0].blk && !bus->ifs[1].blk) ||
2216 (s != bus->ifs && !s->blk)) {
2217 ret = 0;
2218 } else if (!hob) {
2219 ret = s->error;
2220 } else {
2221 ret = s->hob_feature;
2222 }
2223 break;
2224 case ATA_IOPORT_RR_SECTOR_COUNT:
2225 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2226 ret = 0;
2227 } else if (!hob) {
2228 ret = s->nsector & 0xff;
2229 } else {
2230 ret = s->hob_nsector;
2231 }
2232 break;
2233 case ATA_IOPORT_RR_SECTOR_NUMBER:
2234 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2235 ret = 0;
2236 } else if (!hob) {
2237 ret = s->sector;
2238 } else {
2239 ret = s->hob_sector;
2240 }
2241 break;
2242 case ATA_IOPORT_RR_CYLINDER_LOW:
2243 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2244 ret = 0;
2245 } else if (!hob) {
2246 ret = s->lcyl;
2247 } else {
2248 ret = s->hob_lcyl;
2249 }
2250 break;
2251 case ATA_IOPORT_RR_CYLINDER_HIGH:
2252 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2253 ret = 0;
2254 } else if (!hob) {
2255 ret = s->hcyl;
2256 } else {
2257 ret = s->hob_hcyl;
2258 }
2259 break;
2260 case ATA_IOPORT_RR_DEVICE_HEAD:
2261 if (!bus->ifs[0].blk && !bus->ifs[1].blk) {
2262 ret = 0;
2263 } else {
2264 ret = s->select;
2265 }
2266 break;
2267 default:
2268 case ATA_IOPORT_RR_STATUS:
2269 if ((!bus->ifs[0].blk && !bus->ifs[1].blk) ||
2270 (s != bus->ifs && !s->blk)) {
2271 ret = 0;
2272 } else {
2273 ret = s->status;
2274 }
2275 qemu_irq_lower(bus->irq);
2276 break;
2277 }
2278
2279 trace_ide_ioport_read(addr, ATA_IOPORT_RR_lookup[reg_num], ret, bus, s);
2280 return ret;
2281 }
2282
2283 uint32_t ide_status_read(void *opaque, uint32_t addr)
2284 {
2285 IDEBus *bus = opaque;
2286 IDEState *s = ide_bus_active_if(bus);
2287 int ret;
2288
2289 if ((!bus->ifs[0].blk && !bus->ifs[1].blk) ||
2290 (s != bus->ifs && !s->blk)) {
2291 ret = 0;
2292 } else {
2293 ret = s->status;
2294 }
2295
2296 trace_ide_status_read(addr, ret, bus, s);
2297 return ret;
2298 }
2299
2300 static void ide_perform_srst(IDEState *s)
2301 {
2302 s->status |= BUSY_STAT;
2303
2304 /* Halt PIO (Via register state); PIO BH remains scheduled. */
2305 ide_transfer_halt(s);
2306
2307 /* Cancel DMA -- may drain block device and invoke callbacks */
2308 ide_cancel_dma_sync(s);
2309
2310 /* Cancel PIO callback, reset registers/signature, etc */
2311 ide_reset(s);
2312
2313 /* perform diagnostic */
2314 cmd_exec_dev_diagnostic(s, WIN_DIAGNOSE);
2315 }
2316
2317 static void ide_bus_perform_srst(void *opaque)
2318 {
2319 IDEBus *bus = opaque;
2320 IDEState *s;
2321 int i;
2322
2323 for (i = 0; i < 2; i++) {
2324 s = &bus->ifs[i];
2325 ide_perform_srst(s);
2326 }
2327
2328 bus->cmd &= ~IDE_CTRL_RESET;
2329 }
2330
2331 void ide_ctrl_write(void *opaque, uint32_t addr, uint32_t val)
2332 {
2333 IDEBus *bus = opaque;
2334 IDEState *s;
2335 int i;
2336
2337 trace_ide_ctrl_write(addr, val, bus);
2338
2339 /* Device0 and Device1 each have their own control register,
2340 * but QEMU models it as just one register in the controller. */
2341 if (!(bus->cmd & IDE_CTRL_RESET) && (val & IDE_CTRL_RESET)) {
2342 for (i = 0; i < 2; i++) {
2343 s = &bus->ifs[i];
2344 s->status |= BUSY_STAT;
2345 }
2346 replay_bh_schedule_oneshot_event(qemu_get_aio_context(),
2347 ide_bus_perform_srst, bus);
2348 }
2349
2350 bus->cmd = val;
2351 }
2352
2353 /*
2354 * Returns true if the running PIO transfer is a PIO out (i.e. data is
2355 * transferred from the device to the guest), false if it's a PIO in
2356 */
2357 static bool ide_is_pio_out(IDEState *s)
2358 {
2359 if (s->end_transfer_func == ide_sector_write ||
2360 s->end_transfer_func == ide_atapi_cmd) {
2361 return false;
2362 } else if (s->end_transfer_func == ide_sector_read ||
2363 s->end_transfer_func == ide_transfer_stop ||
2364 s->end_transfer_func == ide_atapi_cmd_reply_end ||
2365 s->end_transfer_func == ide_dummy_transfer_stop) {
2366 return true;
2367 }
2368
2369 abort();
2370 }
2371
2372 void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
2373 {
2374 IDEBus *bus = opaque;
2375 IDEState *s = ide_bus_active_if(bus);
2376 uint8_t *p;
2377
2378 trace_ide_data_writew(addr, val, bus, s);
2379
2380 /* PIO data access allowed only when DRQ bit is set. The result of a write
2381 * during PIO out is indeterminate, just ignore it. */
2382 if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
2383 return;
2384 }
2385
2386 p = s->data_ptr;
2387 if (s->io8) {
2388 if (p + 1 > s->data_end) {
2389 return;
2390 }
2391
2392 *p++ = val;
2393 } else {
2394 if (p + 2 > s->data_end) {
2395 return;
2396 }
2397
2398 *(uint16_t *)p = le16_to_cpu(val);
2399 p += 2;
2400 }
2401 s->data_ptr = p;
2402 if (p >= s->data_end) {
2403 s->status &= ~DRQ_STAT;
2404 s->end_transfer_func(s);
2405 }
2406 }
2407
2408 uint32_t ide_data_readw(void *opaque, uint32_t addr)
2409 {
2410 IDEBus *bus = opaque;
2411 IDEState *s = ide_bus_active_if(bus);
2412 uint8_t *p;
2413 int ret;
2414
2415 /* PIO data access allowed only when DRQ bit is set. The result of a read
2416 * during PIO in is indeterminate, return 0 and don't move forward. */
2417 if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
2418 return 0;
2419 }
2420
2421 p = s->data_ptr;
2422 if (s->io8) {
2423 if (p + 1 > s->data_end) {
2424 return 0;
2425 }
2426
2427 ret = *p++;
2428 } else {
2429 if (p + 2 > s->data_end) {
2430 return 0;
2431 }
2432
2433 ret = cpu_to_le16(*(uint16_t *)p);
2434 p += 2;
2435 }
2436 s->data_ptr = p;
2437 if (p >= s->data_end) {
2438 s->status &= ~DRQ_STAT;
2439 s->end_transfer_func(s);
2440 }
2441
2442 trace_ide_data_readw(addr, ret, bus, s);
2443 return ret;
2444 }
2445
2446 void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
2447 {
2448 IDEBus *bus = opaque;
2449 IDEState *s = ide_bus_active_if(bus);
2450 uint8_t *p;
2451
2452 trace_ide_data_writel(addr, val, bus, s);
2453
2454 /* PIO data access allowed only when DRQ bit is set. The result of a write
2455 * during PIO out is indeterminate, just ignore it. */
2456 if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
2457 return;
2458 }
2459
2460 p = s->data_ptr;
2461 if (p + 4 > s->data_end) {
2462 return;
2463 }
2464
2465 *(uint32_t *)p = le32_to_cpu(val);
2466 p += 4;
2467 s->data_ptr = p;
2468 if (p >= s->data_end) {
2469 s->status &= ~DRQ_STAT;
2470 s->end_transfer_func(s);
2471 }
2472 }
2473
2474 uint32_t ide_data_readl(void *opaque, uint32_t addr)
2475 {
2476 IDEBus *bus = opaque;
2477 IDEState *s = ide_bus_active_if(bus);
2478 uint8_t *p;
2479 int ret;
2480
2481 /* PIO data access allowed only when DRQ bit is set. The result of a read
2482 * during PIO in is indeterminate, return 0 and don't move forward. */
2483 if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
2484 ret = 0;
2485 goto out;
2486 }
2487
2488 p = s->data_ptr;
2489 if (p + 4 > s->data_end) {
2490 return 0;
2491 }
2492
2493 ret = cpu_to_le32(*(uint32_t *)p);
2494 p += 4;
2495 s->data_ptr = p;
2496 if (p >= s->data_end) {
2497 s->status &= ~DRQ_STAT;
2498 s->end_transfer_func(s);
2499 }
2500
2501 out:
2502 trace_ide_data_readl(addr, ret, bus, s);
2503 return ret;
2504 }
2505
2506 static void ide_dummy_transfer_stop(IDEState *s)
2507 {
2508 s->data_ptr = s->io_buffer;
2509 s->data_end = s->io_buffer;
2510 s->io_buffer[0] = 0xff;
2511 s->io_buffer[1] = 0xff;
2512 s->io_buffer[2] = 0xff;
2513 s->io_buffer[3] = 0xff;
2514 }
2515
2516 void ide_bus_reset(IDEBus *bus)
2517 {
2518 bus->unit = 0;
2519 bus->cmd = 0;
2520 ide_reset(&bus->ifs[0]);
2521 ide_reset(&bus->ifs[1]);
2522 ide_clear_hob(bus);
2523
2524 /* pending async DMA */
2525 if (bus->dma->aiocb) {
2526 trace_ide_bus_reset_aio();
2527 blk_aio_cancel(bus->dma->aiocb);
2528 bus->dma->aiocb = NULL;
2529 }
2530
2531 /* reset dma provider too */
2532 if (bus->dma->ops->reset) {
2533 bus->dma->ops->reset(bus->dma);
2534 }
2535 }
2536
2537 static bool ide_cd_is_tray_open(void *opaque)
2538 {
2539 return ((IDEState *)opaque)->tray_open;
2540 }
2541
2542 static bool ide_cd_is_medium_locked(void *opaque)
2543 {
2544 return ((IDEState *)opaque)->tray_locked;
2545 }
2546
2547 static void ide_resize_cb(void *opaque)
2548 {
2549 IDEState *s = opaque;
2550 uint64_t nb_sectors;
2551
2552 if (!s->identify_set) {
2553 return;
2554 }
2555
2556 blk_get_geometry(s->blk, &nb_sectors);
2557 s->nb_sectors = nb_sectors;
2558
2559 /* Update the identify data buffer. */
2560 if (s->drive_kind == IDE_CFATA) {
2561 ide_cfata_identify_size(s);
2562 } else {
2563 /* IDE_CD uses a different set of callbacks entirely. */
2564 assert(s->drive_kind != IDE_CD);
2565 ide_identify_size(s);
2566 }
2567 }
2568
2569 static const BlockDevOps ide_cd_block_ops = {
2570 .change_media_cb = ide_cd_change_cb,
2571 .eject_request_cb = ide_cd_eject_request_cb,
2572 .is_tray_open = ide_cd_is_tray_open,
2573 .is_medium_locked = ide_cd_is_medium_locked,
2574 };
2575
2576 static const BlockDevOps ide_hd_block_ops = {
2577 .resize_cb = ide_resize_cb,
2578 };
2579
2580 int ide_init_drive(IDEState *s, BlockBackend *blk, IDEDriveKind kind,
2581 const char *version, const char *serial, const char *model,
2582 uint64_t wwn,
2583 uint32_t cylinders, uint32_t heads, uint32_t secs,
2584 int chs_trans, Error **errp)
2585 {
2586 uint64_t nb_sectors;
2587
2588 s->blk = blk;
2589 s->drive_kind = kind;
2590
2591 blk_get_geometry(blk, &nb_sectors);
2592 s->cylinders = cylinders;
2593 s->heads = s->drive_heads = heads;
2594 s->sectors = s->drive_sectors = secs;
2595 s->chs_trans = chs_trans;
2596 s->nb_sectors = nb_sectors;
2597 s->wwn = wwn;
2598 /* The SMART values should be preserved across power cycles
2599 but they aren't. */
2600 s->smart_enabled = 1;
2601 s->smart_autosave = 1;
2602 s->smart_errors = 0;
2603 s->smart_selftest_count = 0;
2604 if (kind == IDE_CD) {
2605 blk_set_dev_ops(blk, &ide_cd_block_ops, s);
2606 } else {
2607 if (!blk_is_inserted(s->blk)) {
2608 error_setg(errp, "Device needs media, but drive is empty");
2609 return -1;
2610 }
2611 if (!blk_is_writable(blk)) {
2612 error_setg(errp, "Can't use a read-only drive");
2613 return -1;
2614 }
2615 blk_set_dev_ops(blk, &ide_hd_block_ops, s);
2616 }
2617 if (serial) {
2618 pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), serial);
2619 } else {
2620 snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
2621 "QM%05d", s->drive_serial);
2622 }
2623 if (model) {
2624 pstrcpy(s->drive_model_str, sizeof(s->drive_model_str), model);
2625 } else {
2626 switch (kind) {
2627 case IDE_CD:
2628 strcpy(s->drive_model_str, "QEMU DVD-ROM");
2629 break;
2630 case IDE_CFATA:
2631 strcpy(s->drive_model_str, "QEMU MICRODRIVE");
2632 break;
2633 default:
2634 strcpy(s->drive_model_str, "QEMU HARDDISK");
2635 break;
2636 }
2637 }
2638
2639 if (version) {
2640 pstrcpy(s->version, sizeof(s->version), version);
2641 } else {
2642 pstrcpy(s->version, sizeof(s->version), qemu_hw_version());
2643 }
2644
2645 ide_reset(s);
2646 blk_iostatus_enable(blk);
2647 return 0;
2648 }
2649
2650 static void ide_init1(IDEBus *bus, int unit)
2651 {
2652 static int drive_serial = 1;
2653 IDEState *s = &bus->ifs[unit];
2654
2655 s->bus = bus;
2656 s->unit = unit;
2657 s->drive_serial = drive_serial++;
2658 /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */
2659 s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;
2660 s->io_buffer = qemu_memalign(2048, s->io_buffer_total_len);
2661 memset(s->io_buffer, 0, s->io_buffer_total_len);
2662
2663 s->smart_selftest_data = blk_blockalign(s->blk, 512);
2664 memset(s->smart_selftest_data, 0, 512);
2665
2666 s->sector_write_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
2667 ide_sector_write_timer_cb, s);
2668 }
2669
2670 static int ide_nop_int(const IDEDMA *dma, bool is_write)
2671 {
2672 return 0;
2673 }
2674
2675 static void ide_nop(const IDEDMA *dma)
2676 {
2677 }
2678
2679 static int32_t ide_nop_int32(const IDEDMA *dma, int32_t l)
2680 {
2681 return 0;
2682 }
2683
2684 static const IDEDMAOps ide_dma_nop_ops = {
2685 .prepare_buf = ide_nop_int32,
2686 .restart_dma = ide_nop,
2687 .rw_buf = ide_nop_int,
2688 };
2689
2690 static void ide_restart_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
2691 {
2692 s->unit = s->bus->retry_unit;
2693 ide_set_sector(s, s->bus->retry_sector_num);
2694 s->nsector = s->bus->retry_nsector;
2695 s->bus->dma->ops->restart_dma(s->bus->dma);
2696 s->io_buffer_size = 0;
2697 s->dma_cmd = dma_cmd;
2698 ide_start_dma(s, ide_dma_cb);
2699 }
2700
2701 static void ide_restart_bh(void *opaque)
2702 {
2703 IDEBus *bus = opaque;
2704 IDEState *s;
2705 bool is_read;
2706 int error_status;
2707
2708 qemu_bh_delete(bus->bh);
2709 bus->bh = NULL;
2710
2711 error_status = bus->error_status;
2712 if (bus->error_status == 0) {
2713 return;
2714 }
2715
2716 s = ide_bus_active_if(bus);
2717 is_read = (bus->error_status & IDE_RETRY_READ) != 0;
2718
2719 /* The error status must be cleared before resubmitting the request: The
2720 * request may fail again, and this case can only be distinguished if the
2721 * called function can set a new error status. */
2722 bus->error_status = 0;
2723
2724 /* The HBA has generically asked to be kicked on retry */
2725 if (error_status & IDE_RETRY_HBA) {
2726 if (s->bus->dma->ops->restart) {
2727 s->bus->dma->ops->restart(s->bus->dma);
2728 }
2729 } else if (IS_IDE_RETRY_DMA(error_status)) {
2730 if (error_status & IDE_RETRY_TRIM) {
2731 ide_restart_dma(s, IDE_DMA_TRIM);
2732 } else {
2733 ide_restart_dma(s, is_read ? IDE_DMA_READ : IDE_DMA_WRITE);
2734 }
2735 } else if (IS_IDE_RETRY_PIO(error_status)) {
2736 if (is_read) {
2737 ide_sector_read(s);
2738 } else {
2739 ide_sector_write(s);
2740 }
2741 } else if (error_status & IDE_RETRY_FLUSH) {
2742 ide_flush_cache(s);
2743 } else if (IS_IDE_RETRY_ATAPI(error_status)) {
2744 assert(s->end_transfer_func == ide_atapi_cmd);
2745 ide_atapi_dma_restart(s);
2746 } else {
2747 abort();
2748 }
2749 }
2750
2751 static void ide_restart_cb(void *opaque, bool running, RunState state)
2752 {
2753 IDEBus *bus = opaque;
2754
2755 if (!running)
2756 return;
2757
2758 if (!bus->bh) {
2759 bus->bh = qemu_bh_new(ide_restart_bh, bus);
2760 qemu_bh_schedule(bus->bh);
2761 }
2762 }
2763
2764 void ide_bus_register_restart_cb(IDEBus *bus)
2765 {
2766 if (bus->dma->ops->restart_dma) {
2767 bus->vmstate = qemu_add_vm_change_state_handler(ide_restart_cb, bus);
2768 }
2769 }
2770
2771 static IDEDMA ide_dma_nop = {
2772 .ops = &ide_dma_nop_ops,
2773 .aiocb = NULL,
2774 };
2775
2776 void ide_bus_init_output_irq(IDEBus *bus, qemu_irq irq_out)
2777 {
2778 int i;
2779
2780 for(i = 0; i < 2; i++) {
2781 ide_init1(bus, i);
2782 ide_reset(&bus->ifs[i]);
2783 }
2784 bus->irq = irq_out;
2785 bus->dma = &ide_dma_nop;
2786 }
2787
2788 void ide_bus_set_irq(IDEBus *bus)
2789 {
2790 if (!(bus->cmd & IDE_CTRL_DISABLE_IRQ)) {
2791 qemu_irq_raise(bus->irq);
2792 }
2793 }
2794
2795 void ide_exit(IDEState *s)
2796 {
2797 timer_free(s->sector_write_timer);
2798 qemu_vfree(s->smart_selftest_data);
2799 qemu_vfree(s->io_buffer);
2800 }
2801
2802 static bool is_identify_set(void *opaque, int version_id)
2803 {
2804 IDEState *s = opaque;
2805
2806 return s->identify_set != 0;
2807 }
2808
2809 static EndTransferFunc* transfer_end_table[] = {
2810 ide_sector_read,
2811 ide_sector_write,
2812 ide_transfer_stop,
2813 ide_atapi_cmd_reply_end,
2814 ide_atapi_cmd,
2815 ide_dummy_transfer_stop,
2816 };
2817
2818 static int transfer_end_table_idx(EndTransferFunc *fn)
2819 {
2820 int i;
2821
2822 for (i = 0; i < ARRAY_SIZE(transfer_end_table); i++)
2823 if (transfer_end_table[i] == fn)
2824 return i;
2825
2826 return -1;
2827 }
2828
2829 static int ide_drive_post_load(void *opaque, int version_id)
2830 {
2831 IDEState *s = opaque;
2832
2833 if (s->blk && s->identify_set) {
2834 blk_set_enable_write_cache(s->blk, !!(s->identify_data[85] & (1 << 5)));
2835 }
2836 return 0;
2837 }
2838
2839 static int ide_drive_pio_post_load(void *opaque, int version_id)
2840 {
2841 IDEState *s = opaque;
2842
2843 if (s->end_transfer_fn_idx >= ARRAY_SIZE(transfer_end_table)) {
2844 return -EINVAL;
2845 }
2846 s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
2847 s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
2848 s->data_end = s->data_ptr + s->cur_io_buffer_len;
2849 s->atapi_dma = s->feature & 1; /* as per cmd_packet */
2850
2851 return 0;
2852 }
2853
2854 static int ide_drive_pio_pre_save(void *opaque)
2855 {
2856 IDEState *s = opaque;
2857 int idx;
2858
2859 s->cur_io_buffer_offset = s->data_ptr - s->io_buffer;
2860 s->cur_io_buffer_len = s->data_end - s->data_ptr;
2861
2862 idx = transfer_end_table_idx(s->end_transfer_func);
2863 if (idx == -1) {
2864 fprintf(stderr, "%s: invalid end_transfer_func for DRQ_STAT\n",
2865 __func__);
2866 s->end_transfer_fn_idx = 2;
2867 } else {
2868 s->end_transfer_fn_idx = idx;
2869 }
2870
2871 return 0;
2872 }
2873
2874 static bool ide_drive_pio_state_needed(void *opaque)
2875 {
2876 IDEState *s = opaque;
2877
2878 return ((s->status & DRQ_STAT) != 0)
2879 || (s->bus->error_status & IDE_RETRY_PIO);
2880 }
2881
2882 static bool ide_tray_state_needed(void *opaque)
2883 {
2884 IDEState *s = opaque;
2885
2886 return s->tray_open || s->tray_locked;
2887 }
2888
2889 static bool ide_atapi_gesn_needed(void *opaque)
2890 {
2891 IDEState *s = opaque;
2892
2893 return s->events.new_media || s->events.eject_request;
2894 }
2895
2896 static bool ide_error_needed(void *opaque)
2897 {
2898 IDEBus *bus = opaque;
2899
2900 return (bus->error_status != 0);
2901 }
2902
2903 /* Fields for GET_EVENT_STATUS_NOTIFICATION ATAPI command */
2904 static const VMStateDescription vmstate_ide_atapi_gesn_state = {
2905 .name ="ide_drive/atapi/gesn_state",
2906 .version_id = 1,
2907 .minimum_version_id = 1,
2908 .needed = ide_atapi_gesn_needed,
2909 .fields = (VMStateField[]) {
2910 VMSTATE_BOOL(events.new_media, IDEState),
2911 VMSTATE_BOOL(events.eject_request, IDEState),
2912 VMSTATE_END_OF_LIST()
2913 }
2914 };
2915
2916 static const VMStateDescription vmstate_ide_tray_state = {
2917 .name = "ide_drive/tray_state",
2918 .version_id = 1,
2919 .minimum_version_id = 1,
2920 .needed = ide_tray_state_needed,
2921 .fields = (VMStateField[]) {
2922 VMSTATE_BOOL(tray_open, IDEState),
2923 VMSTATE_BOOL(tray_locked, IDEState),
2924 VMSTATE_END_OF_LIST()
2925 }
2926 };
2927
2928 static const VMStateDescription vmstate_ide_drive_pio_state = {
2929 .name = "ide_drive/pio_state",
2930 .version_id = 1,
2931 .minimum_version_id = 1,
2932 .pre_save = ide_drive_pio_pre_save,
2933 .post_load = ide_drive_pio_post_load,
2934 .needed = ide_drive_pio_state_needed,
2935 .fields = (VMStateField[]) {
2936 VMSTATE_INT32(req_nb_sectors, IDEState),
2937 VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1,
2938 vmstate_info_uint8, uint8_t),
2939 VMSTATE_INT32(cur_io_buffer_offset, IDEState),
2940 VMSTATE_INT32(cur_io_buffer_len, IDEState),
2941 VMSTATE_UINT8(end_transfer_fn_idx, IDEState),
2942 VMSTATE_INT32(elementary_transfer_size, IDEState),
2943 VMSTATE_INT32(packet_transfer_size, IDEState),
2944 VMSTATE_END_OF_LIST()
2945 }
2946 };
2947
2948 const VMStateDescription vmstate_ide_drive = {
2949 .name = "ide_drive",
2950 .version_id = 3,
2951 .minimum_version_id = 0,
2952 .post_load = ide_drive_post_load,
2953 .fields = (VMStateField[]) {
2954 VMSTATE_INT32(mult_sectors, IDEState),
2955 VMSTATE_INT32(identify_set, IDEState),
2956 VMSTATE_BUFFER_TEST(identify_data, IDEState, is_identify_set),
2957 VMSTATE_UINT8(feature, IDEState),
2958 VMSTATE_UINT8(error, IDEState),
2959 VMSTATE_UINT32(nsector, IDEState),
2960 VMSTATE_UINT8(sector, IDEState),
2961 VMSTATE_UINT8(lcyl, IDEState),
2962 VMSTATE_UINT8(hcyl, IDEState),
2963 VMSTATE_UINT8(hob_feature, IDEState),
2964 VMSTATE_UINT8(hob_sector, IDEState),
2965 VMSTATE_UINT8(hob_nsector, IDEState),
2966 VMSTATE_UINT8(hob_lcyl, IDEState),
2967 VMSTATE_UINT8(hob_hcyl, IDEState),
2968 VMSTATE_UINT8(select, IDEState),
2969 VMSTATE_UINT8(status, IDEState),
2970 VMSTATE_UINT8(lba48, IDEState),
2971 VMSTATE_UINT8(sense_key, IDEState),
2972 VMSTATE_UINT8(asc, IDEState),
2973 VMSTATE_UINT8_V(cdrom_changed, IDEState, 3),
2974 VMSTATE_END_OF_LIST()
2975 },
2976 .subsections = (const VMStateDescription*[]) {
2977 &vmstate_ide_drive_pio_state,
2978 &vmstate_ide_tray_state,
2979 &vmstate_ide_atapi_gesn_state,
2980 NULL
2981 }
2982 };
2983
2984 static const VMStateDescription vmstate_ide_error_status = {
2985 .name ="ide_bus/error",
2986 .version_id = 2,
2987 .minimum_version_id = 1,
2988 .needed = ide_error_needed,
2989 .fields = (VMStateField[]) {
2990 VMSTATE_INT32(error_status, IDEBus),
2991 VMSTATE_INT64_V(retry_sector_num, IDEBus, 2),
2992 VMSTATE_UINT32_V(retry_nsector, IDEBus, 2),
2993 VMSTATE_UINT8_V(retry_unit, IDEBus, 2),
2994 VMSTATE_END_OF_LIST()
2995 }
2996 };
2997
2998 const VMStateDescription vmstate_ide_bus = {
2999 .name = "ide_bus",
3000 .version_id = 1,
3001 .minimum_version_id = 1,
3002 .fields = (VMStateField[]) {
3003 VMSTATE_UINT8(cmd, IDEBus),
3004 VMSTATE_UINT8(unit, IDEBus),
3005 VMSTATE_END_OF_LIST()
3006 },
3007 .subsections = (const VMStateDescription*[]) {
3008 &vmstate_ide_error_status,
3009 NULL
3010 }
3011 };
3012
3013 void ide_drive_get(DriveInfo **hd, int n)
3014 {
3015 int i;
3016
3017 for (i = 0; i < n; i++) {
3018 hd[i] = drive_get_by_index(IF_IDE, i);
3019 }
3020 }
QEMU mirror