xref: /qemu/hw/ide/core.c (revision 6291ad77d7c57dfc52a6a938d1a77ec3ec3ad16c)
1 /*
2  * QEMU IDE disk and CD/DVD-ROM Emulator
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  * Copyright (c) 2006 Openedhand Ltd.
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 #include <hw/hw.h>
26 #include <hw/i386/pc.h>
27 #include <hw/pci/pci.h>
28 #include <hw/isa/isa.h>
29 #include "qemu/error-report.h"
30 #include "qemu/timer.h"
31 #include "sysemu/sysemu.h"
32 #include "sysemu/dma.h"
33 #include "hw/block/block.h"
34 #include "sysemu/blockdev.h"
35 
36 #include <hw/ide/internal.h>
37 
38 /* These values were based on a Seagate ST3500418AS but have been modified
39    to make more sense in QEMU */
40 static const int smart_attributes[][12] = {
41     /* id,  flags, hflags, val, wrst, raw (6 bytes), threshold */
42     /* raw read error rate*/
43     { 0x01, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06},
44     /* spin up */
45     { 0x03, 0x03, 0x00, 0x64, 0x64, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
46     /* start stop count */
47     { 0x04, 0x02, 0x00, 0x64, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14},
48     /* remapped sectors */
49     { 0x05, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24},
50     /* power on hours */
51     { 0x09, 0x03, 0x00, 0x64, 0x64, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
52     /* power cycle count */
53     { 0x0c, 0x03, 0x00, 0x64, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
54     /* airflow-temperature-celsius */
55     { 190,  0x03, 0x00, 0x45, 0x45, 0x1f, 0x00, 0x1f, 0x1f, 0x00, 0x00, 0x32},
56 };
57 
58 static int ide_handle_rw_error(IDEState *s, int error, int op);
59 static void ide_dummy_transfer_stop(IDEState *s);
60 
61 static void padstr(char *str, const char *src, int len)
62 {
63     int i, v;
64     for(i = 0; i < len; i++) {
65         if (*src)
66             v = *src++;
67         else
68             v = ' ';
69         str[i^1] = v;
70     }
71 }
72 
73 static void put_le16(uint16_t *p, unsigned int v)
74 {
75     *p = cpu_to_le16(v);
76 }
77 
78 static void ide_identify(IDEState *s)
79 {
80     uint16_t *p;
81     unsigned int oldsize;
82     IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
83 
84     if (s->identify_set) {
85 	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
86 	return;
87     }
88 
89     memset(s->io_buffer, 0, 512);
90     p = (uint16_t *)s->io_buffer;
91     put_le16(p + 0, 0x0040);
92     put_le16(p + 1, s->cylinders);
93     put_le16(p + 3, s->heads);
94     put_le16(p + 4, 512 * s->sectors); /* XXX: retired, remove ? */
95     put_le16(p + 5, 512); /* XXX: retired, remove ? */
96     put_le16(p + 6, s->sectors);
97     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
98     put_le16(p + 20, 3); /* XXX: retired, remove ? */
99     put_le16(p + 21, 512); /* cache size in sectors */
100     put_le16(p + 22, 4); /* ecc bytes */
101     padstr((char *)(p + 23), s->version, 8); /* firmware version */
102     padstr((char *)(p + 27), s->drive_model_str, 40); /* model */
103 #if MAX_MULT_SECTORS > 1
104     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
105 #endif
106     put_le16(p + 48, 1); /* dword I/O */
107     put_le16(p + 49, (1 << 11) | (1 << 9) | (1 << 8)); /* DMA and LBA supported */
108     put_le16(p + 51, 0x200); /* PIO transfer cycle */
109     put_le16(p + 52, 0x200); /* DMA transfer cycle */
110     put_le16(p + 53, 1 | (1 << 1) | (1 << 2)); /* words 54-58,64-70,88 are valid */
111     put_le16(p + 54, s->cylinders);
112     put_le16(p + 55, s->heads);
113     put_le16(p + 56, s->sectors);
114     oldsize = s->cylinders * s->heads * s->sectors;
115     put_le16(p + 57, oldsize);
116     put_le16(p + 58, oldsize >> 16);
117     if (s->mult_sectors)
118         put_le16(p + 59, 0x100 | s->mult_sectors);
119     put_le16(p + 60, s->nb_sectors);
120     put_le16(p + 61, s->nb_sectors >> 16);
121     put_le16(p + 62, 0x07); /* single word dma0-2 supported */
122     put_le16(p + 63, 0x07); /* mdma0-2 supported */
123     put_le16(p + 64, 0x03); /* pio3-4 supported */
124     put_le16(p + 65, 120);
125     put_le16(p + 66, 120);
126     put_le16(p + 67, 120);
127     put_le16(p + 68, 120);
128     if (dev && dev->conf.discard_granularity) {
129         put_le16(p + 69, (1 << 14)); /* determinate TRIM behavior */
130     }
131 
132     if (s->ncq_queues) {
133         put_le16(p + 75, s->ncq_queues - 1);
134         /* NCQ supported */
135         put_le16(p + 76, (1 << 8));
136     }
137 
138     put_le16(p + 80, 0xf0); /* ata3 -> ata6 supported */
139     put_le16(p + 81, 0x16); /* conforms to ata5 */
140     /* 14=NOP supported, 5=WCACHE supported, 0=SMART supported */
141     put_le16(p + 82, (1 << 14) | (1 << 5) | 1);
142     /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
143     put_le16(p + 83, (1 << 14) | (1 << 13) | (1 <<12) | (1 << 10));
144     /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */
145     if (s->wwn) {
146         put_le16(p + 84, (1 << 14) | (1 << 8) | 0);
147     } else {
148         put_le16(p + 84, (1 << 14) | 0);
149     }
150     /* 14 = NOP supported, 5=WCACHE enabled, 0=SMART feature set enabled */
151     if (bdrv_enable_write_cache(s->bs))
152          put_le16(p + 85, (1 << 14) | (1 << 5) | 1);
153     else
154          put_le16(p + 85, (1 << 14) | 1);
155     /* 13=flush_cache_ext,12=flush_cache,10=lba48 */
156     put_le16(p + 86, (1 << 13) | (1 <<12) | (1 << 10));
157     /* 14=set to 1, 8=has WWN, 1=SMART self test, 0=SMART error logging */
158     if (s->wwn) {
159         put_le16(p + 87, (1 << 14) | (1 << 8) | 0);
160     } else {
161         put_le16(p + 87, (1 << 14) | 0);
162     }
163     put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
164     put_le16(p + 93, 1 | (1 << 14) | 0x2000);
165     put_le16(p + 100, s->nb_sectors);
166     put_le16(p + 101, s->nb_sectors >> 16);
167     put_le16(p + 102, s->nb_sectors >> 32);
168     put_le16(p + 103, s->nb_sectors >> 48);
169 
170     if (dev && dev->conf.physical_block_size)
171         put_le16(p + 106, 0x6000 | get_physical_block_exp(&dev->conf));
172     if (s->wwn) {
173         /* LE 16-bit words 111-108 contain 64-bit World Wide Name */
174         put_le16(p + 108, s->wwn >> 48);
175         put_le16(p + 109, s->wwn >> 32);
176         put_le16(p + 110, s->wwn >> 16);
177         put_le16(p + 111, s->wwn);
178     }
179     if (dev && dev->conf.discard_granularity) {
180         put_le16(p + 169, 1); /* TRIM support */
181     }
182 
183     memcpy(s->identify_data, p, sizeof(s->identify_data));
184     s->identify_set = 1;
185 }
186 
187 static void ide_atapi_identify(IDEState *s)
188 {
189     uint16_t *p;
190 
191     if (s->identify_set) {
192 	memcpy(s->io_buffer, s->identify_data, sizeof(s->identify_data));
193 	return;
194     }
195 
196     memset(s->io_buffer, 0, 512);
197     p = (uint16_t *)s->io_buffer;
198     /* Removable CDROM, 50us response, 12 byte packets */
199     put_le16(p + 0, (2 << 14) | (5 << 8) | (1 << 7) | (2 << 5) | (0 << 0));
200     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
201     put_le16(p + 20, 3); /* buffer type */
202     put_le16(p + 21, 512); /* cache size in sectors */
203     put_le16(p + 22, 4); /* ecc bytes */
204     padstr((char *)(p + 23), s->version, 8); /* firmware version */
205     padstr((char *)(p + 27), s->drive_model_str, 40); /* model */
206     put_le16(p + 48, 1); /* dword I/O (XXX: should not be set on CDROM) */
207 #ifdef USE_DMA_CDROM
208     put_le16(p + 49, 1 << 9 | 1 << 8); /* DMA and LBA supported */
209     put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
210     put_le16(p + 62, 7);  /* single word dma0-2 supported */
211     put_le16(p + 63, 7);  /* mdma0-2 supported */
212 #else
213     put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
214     put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
215     put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
216 #endif
217     put_le16(p + 64, 3); /* pio3-4 supported */
218     put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
219     put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
220     put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
221     put_le16(p + 68, 0xb4); /* minimum PIO cycle time with IORDY flow control */
222 
223     put_le16(p + 71, 30); /* in ns */
224     put_le16(p + 72, 30); /* in ns */
225 
226     if (s->ncq_queues) {
227         put_le16(p + 75, s->ncq_queues - 1);
228         /* NCQ supported */
229         put_le16(p + 76, (1 << 8));
230     }
231 
232     put_le16(p + 80, 0x1e); /* support up to ATA/ATAPI-4 */
233 #ifdef USE_DMA_CDROM
234     put_le16(p + 88, 0x3f | (1 << 13)); /* udma5 set and supported */
235 #endif
236     memcpy(s->identify_data, p, sizeof(s->identify_data));
237     s->identify_set = 1;
238 }
239 
240 static void ide_cfata_identify(IDEState *s)
241 {
242     uint16_t *p;
243     uint32_t cur_sec;
244 
245     p = (uint16_t *) s->identify_data;
246     if (s->identify_set)
247         goto fill_buffer;
248 
249     memset(p, 0, sizeof(s->identify_data));
250 
251     cur_sec = s->cylinders * s->heads * s->sectors;
252 
253     put_le16(p + 0, 0x848a);			/* CF Storage Card signature */
254     put_le16(p + 1, s->cylinders);		/* Default cylinders */
255     put_le16(p + 3, s->heads);			/* Default heads */
256     put_le16(p + 6, s->sectors);		/* Default sectors per track */
257     put_le16(p + 7, s->nb_sectors >> 16);	/* Sectors per card */
258     put_le16(p + 8, s->nb_sectors);		/* Sectors per card */
259     padstr((char *)(p + 10), s->drive_serial_str, 20); /* serial number */
260     put_le16(p + 22, 0x0004);			/* ECC bytes */
261     padstr((char *) (p + 23), s->version, 8);	/* Firmware Revision */
262     padstr((char *) (p + 27), s->drive_model_str, 40);/* Model number */
263 #if MAX_MULT_SECTORS > 1
264     put_le16(p + 47, 0x8000 | MAX_MULT_SECTORS);
265 #else
266     put_le16(p + 47, 0x0000);
267 #endif
268     put_le16(p + 49, 0x0f00);			/* Capabilities */
269     put_le16(p + 51, 0x0002);			/* PIO cycle timing mode */
270     put_le16(p + 52, 0x0001);			/* DMA cycle timing mode */
271     put_le16(p + 53, 0x0003);			/* Translation params valid */
272     put_le16(p + 54, s->cylinders);		/* Current cylinders */
273     put_le16(p + 55, s->heads);			/* Current heads */
274     put_le16(p + 56, s->sectors);		/* Current sectors */
275     put_le16(p + 57, cur_sec);			/* Current capacity */
276     put_le16(p + 58, cur_sec >> 16);		/* Current capacity */
277     if (s->mult_sectors)			/* Multiple sector setting */
278         put_le16(p + 59, 0x100 | s->mult_sectors);
279     put_le16(p + 60, s->nb_sectors);		/* Total LBA sectors */
280     put_le16(p + 61, s->nb_sectors >> 16);	/* Total LBA sectors */
281     put_le16(p + 63, 0x0203);			/* Multiword DMA capability */
282     put_le16(p + 64, 0x0001);			/* Flow Control PIO support */
283     put_le16(p + 65, 0x0096);			/* Min. Multiword DMA cycle */
284     put_le16(p + 66, 0x0096);			/* Rec. Multiword DMA cycle */
285     put_le16(p + 68, 0x00b4);			/* Min. PIO cycle time */
286     put_le16(p + 82, 0x400c);			/* Command Set supported */
287     put_le16(p + 83, 0x7068);			/* Command Set supported */
288     put_le16(p + 84, 0x4000);			/* Features supported */
289     put_le16(p + 85, 0x000c);			/* Command Set enabled */
290     put_le16(p + 86, 0x7044);			/* Command Set enabled */
291     put_le16(p + 87, 0x4000);			/* Features enabled */
292     put_le16(p + 91, 0x4060);			/* Current APM level */
293     put_le16(p + 129, 0x0002);			/* Current features option */
294     put_le16(p + 130, 0x0005);			/* Reassigned sectors */
295     put_le16(p + 131, 0x0001);			/* Initial power mode */
296     put_le16(p + 132, 0x0000);			/* User signature */
297     put_le16(p + 160, 0x8100);			/* Power requirement */
298     put_le16(p + 161, 0x8001);			/* CF command set */
299 
300     s->identify_set = 1;
301 
302 fill_buffer:
303     memcpy(s->io_buffer, p, sizeof(s->identify_data));
304 }
305 
306 static void ide_set_signature(IDEState *s)
307 {
308     s->select &= 0xf0; /* clear head */
309     /* put signature */
310     s->nsector = 1;
311     s->sector = 1;
312     if (s->drive_kind == IDE_CD) {
313         s->lcyl = 0x14;
314         s->hcyl = 0xeb;
315     } else if (s->bs) {
316         s->lcyl = 0;
317         s->hcyl = 0;
318     } else {
319         s->lcyl = 0xff;
320         s->hcyl = 0xff;
321     }
322 }
323 
324 typedef struct TrimAIOCB {
325     BlockDriverAIOCB common;
326     QEMUBH *bh;
327     int ret;
328     QEMUIOVector *qiov;
329     BlockDriverAIOCB *aiocb;
330     int i, j;
331 } TrimAIOCB;
332 
333 static void trim_aio_cancel(BlockDriverAIOCB *acb)
334 {
335     TrimAIOCB *iocb = container_of(acb, TrimAIOCB, common);
336 
337     /* Exit the loop in case bdrv_aio_cancel calls ide_issue_trim_cb again.  */
338     iocb->j = iocb->qiov->niov - 1;
339     iocb->i = (iocb->qiov->iov[iocb->j].iov_len / 8) - 1;
340 
341     /* Tell ide_issue_trim_cb not to trigger the completion, too.  */
342     qemu_bh_delete(iocb->bh);
343     iocb->bh = NULL;
344 
345     if (iocb->aiocb) {
346         bdrv_aio_cancel(iocb->aiocb);
347     }
348     qemu_aio_release(iocb);
349 }
350 
351 static const AIOCBInfo trim_aiocb_info = {
352     .aiocb_size         = sizeof(TrimAIOCB),
353     .cancel             = trim_aio_cancel,
354 };
355 
356 static void ide_trim_bh_cb(void *opaque)
357 {
358     TrimAIOCB *iocb = opaque;
359 
360     iocb->common.cb(iocb->common.opaque, iocb->ret);
361 
362     qemu_bh_delete(iocb->bh);
363     iocb->bh = NULL;
364     qemu_aio_release(iocb);
365 }
366 
367 static void ide_issue_trim_cb(void *opaque, int ret)
368 {
369     TrimAIOCB *iocb = opaque;
370     if (ret >= 0) {
371         while (iocb->j < iocb->qiov->niov) {
372             int j = iocb->j;
373             while (++iocb->i < iocb->qiov->iov[j].iov_len / 8) {
374                 int i = iocb->i;
375                 uint64_t *buffer = iocb->qiov->iov[j].iov_base;
376 
377                 /* 6-byte LBA + 2-byte range per entry */
378                 uint64_t entry = le64_to_cpu(buffer[i]);
379                 uint64_t sector = entry & 0x0000ffffffffffffULL;
380                 uint16_t count = entry >> 48;
381 
382                 if (count == 0) {
383                     continue;
384                 }
385 
386                 /* Got an entry! Submit and exit.  */
387                 iocb->aiocb = bdrv_aio_discard(iocb->common.bs, sector, count,
388                                                ide_issue_trim_cb, opaque);
389                 return;
390             }
391 
392             iocb->j++;
393             iocb->i = -1;
394         }
395     } else {
396         iocb->ret = ret;
397     }
398 
399     iocb->aiocb = NULL;
400     if (iocb->bh) {
401         qemu_bh_schedule(iocb->bh);
402     }
403 }
404 
405 BlockDriverAIOCB *ide_issue_trim(BlockDriverState *bs,
406         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
407         BlockDriverCompletionFunc *cb, void *opaque)
408 {
409     TrimAIOCB *iocb;
410 
411     iocb = qemu_aio_get(&trim_aiocb_info, bs, cb, opaque);
412     iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);
413     iocb->ret = 0;
414     iocb->qiov = qiov;
415     iocb->i = -1;
416     iocb->j = 0;
417     ide_issue_trim_cb(iocb, 0);
418     return &iocb->common;
419 }
420 
421 static inline void ide_abort_command(IDEState *s)
422 {
423     s->status = READY_STAT | ERR_STAT;
424     s->error = ABRT_ERR;
425 }
426 
427 /* prepare data transfer and tell what to do after */
428 void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
429                         EndTransferFunc *end_transfer_func)
430 {
431     s->end_transfer_func = end_transfer_func;
432     s->data_ptr = buf;
433     s->data_end = buf + size;
434     if (!(s->status & ERR_STAT)) {
435         s->status |= DRQ_STAT;
436     }
437     s->bus->dma->ops->start_transfer(s->bus->dma);
438 }
439 
440 void ide_transfer_stop(IDEState *s)
441 {
442     s->end_transfer_func = ide_transfer_stop;
443     s->data_ptr = s->io_buffer;
444     s->data_end = s->io_buffer;
445     s->status &= ~DRQ_STAT;
446 }
447 
448 int64_t ide_get_sector(IDEState *s)
449 {
450     int64_t sector_num;
451     if (s->select & 0x40) {
452         /* lba */
453 	if (!s->lba48) {
454 	    sector_num = ((s->select & 0x0f) << 24) | (s->hcyl << 16) |
455 		(s->lcyl << 8) | s->sector;
456 	} else {
457 	    sector_num = ((int64_t)s->hob_hcyl << 40) |
458 		((int64_t) s->hob_lcyl << 32) |
459 		((int64_t) s->hob_sector << 24) |
460 		((int64_t) s->hcyl << 16) |
461 		((int64_t) s->lcyl << 8) | s->sector;
462 	}
463     } else {
464         sector_num = ((s->hcyl << 8) | s->lcyl) * s->heads * s->sectors +
465             (s->select & 0x0f) * s->sectors + (s->sector - 1);
466     }
467     return sector_num;
468 }
469 
470 void ide_set_sector(IDEState *s, int64_t sector_num)
471 {
472     unsigned int cyl, r;
473     if (s->select & 0x40) {
474 	if (!s->lba48) {
475             s->select = (s->select & 0xf0) | (sector_num >> 24);
476             s->hcyl = (sector_num >> 16);
477             s->lcyl = (sector_num >> 8);
478             s->sector = (sector_num);
479 	} else {
480 	    s->sector = sector_num;
481 	    s->lcyl = sector_num >> 8;
482 	    s->hcyl = sector_num >> 16;
483 	    s->hob_sector = sector_num >> 24;
484 	    s->hob_lcyl = sector_num >> 32;
485 	    s->hob_hcyl = sector_num >> 40;
486 	}
487     } else {
488         cyl = sector_num / (s->heads * s->sectors);
489         r = sector_num % (s->heads * s->sectors);
490         s->hcyl = cyl >> 8;
491         s->lcyl = cyl;
492         s->select = (s->select & 0xf0) | ((r / s->sectors) & 0x0f);
493         s->sector = (r % s->sectors) + 1;
494     }
495 }
496 
497 static void ide_rw_error(IDEState *s) {
498     ide_abort_command(s);
499     ide_set_irq(s->bus);
500 }
501 
502 static void ide_sector_read_cb(void *opaque, int ret)
503 {
504     IDEState *s = opaque;
505     int n;
506 
507     s->pio_aiocb = NULL;
508     s->status &= ~BUSY_STAT;
509 
510     bdrv_acct_done(s->bs, &s->acct);
511     if (ret != 0) {
512         if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY |
513                                 BM_STATUS_RETRY_READ)) {
514             return;
515         }
516     }
517 
518     n = s->nsector;
519     if (n > s->req_nb_sectors) {
520         n = s->req_nb_sectors;
521     }
522 
523     /* Allow the guest to read the io_buffer */
524     ide_transfer_start(s, s->io_buffer, n * BDRV_SECTOR_SIZE, ide_sector_read);
525 
526     ide_set_irq(s->bus);
527 
528     ide_set_sector(s, ide_get_sector(s) + n);
529     s->nsector -= n;
530 }
531 
532 void ide_sector_read(IDEState *s)
533 {
534     int64_t sector_num;
535     int n;
536 
537     s->status = READY_STAT | SEEK_STAT;
538     s->error = 0; /* not needed by IDE spec, but needed by Windows */
539     sector_num = ide_get_sector(s);
540     n = s->nsector;
541 
542     if (n == 0) {
543         ide_transfer_stop(s);
544         return;
545     }
546 
547     s->status |= BUSY_STAT;
548 
549     if (n > s->req_nb_sectors) {
550         n = s->req_nb_sectors;
551     }
552 
553 #if defined(DEBUG_IDE)
554     printf("sector=%" PRId64 "\n", sector_num);
555 #endif
556 
557     s->iov.iov_base = s->io_buffer;
558     s->iov.iov_len  = n * BDRV_SECTOR_SIZE;
559     qemu_iovec_init_external(&s->qiov, &s->iov, 1);
560 
561     bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
562     s->pio_aiocb = bdrv_aio_readv(s->bs, sector_num, &s->qiov, n,
563                                   ide_sector_read_cb, s);
564 }
565 
566 static void dma_buf_commit(IDEState *s)
567 {
568     qemu_sglist_destroy(&s->sg);
569 }
570 
571 void ide_set_inactive(IDEState *s)
572 {
573     s->bus->dma->aiocb = NULL;
574     s->bus->dma->ops->set_inactive(s->bus->dma);
575 }
576 
577 void ide_dma_error(IDEState *s)
578 {
579     ide_transfer_stop(s);
580     s->error = ABRT_ERR;
581     s->status = READY_STAT | ERR_STAT;
582     ide_set_inactive(s);
583     ide_set_irq(s->bus);
584 }
585 
586 static int ide_handle_rw_error(IDEState *s, int error, int op)
587 {
588     bool is_read = (op & BM_STATUS_RETRY_READ) != 0;
589     BlockErrorAction action = bdrv_get_error_action(s->bs, is_read, error);
590 
591     if (action == BDRV_ACTION_STOP) {
592         s->bus->dma->ops->set_unit(s->bus->dma, s->unit);
593         s->bus->error_status = op;
594     } else if (action == BDRV_ACTION_REPORT) {
595         if (op & BM_STATUS_DMA_RETRY) {
596             dma_buf_commit(s);
597             ide_dma_error(s);
598         } else {
599             ide_rw_error(s);
600         }
601     }
602     bdrv_error_action(s->bs, action, is_read, error);
603     return action != BDRV_ACTION_IGNORE;
604 }
605 
606 void ide_dma_cb(void *opaque, int ret)
607 {
608     IDEState *s = opaque;
609     int n;
610     int64_t sector_num;
611     bool stay_active = false;
612 
613     if (ret < 0) {
614         int op = BM_STATUS_DMA_RETRY;
615 
616         if (s->dma_cmd == IDE_DMA_READ)
617             op |= BM_STATUS_RETRY_READ;
618         else if (s->dma_cmd == IDE_DMA_TRIM)
619             op |= BM_STATUS_RETRY_TRIM;
620 
621         if (ide_handle_rw_error(s, -ret, op)) {
622             return;
623         }
624     }
625 
626     n = s->io_buffer_size >> 9;
627     if (n > s->nsector) {
628         /* The PRDs were longer than needed for this request. Shorten them so
629          * we don't get a negative remainder. The Active bit must remain set
630          * after the request completes. */
631         n = s->nsector;
632         stay_active = true;
633     }
634 
635     sector_num = ide_get_sector(s);
636     if (n > 0) {
637         dma_buf_commit(s);
638         sector_num += n;
639         ide_set_sector(s, sector_num);
640         s->nsector -= n;
641     }
642 
643     /* end of transfer ? */
644     if (s->nsector == 0) {
645         s->status = READY_STAT | SEEK_STAT;
646         ide_set_irq(s->bus);
647         goto eot;
648     }
649 
650     /* launch next transfer */
651     n = s->nsector;
652     s->io_buffer_index = 0;
653     s->io_buffer_size = n * 512;
654     if (s->bus->dma->ops->prepare_buf(s->bus->dma, ide_cmd_is_read(s)) == 0) {
655         /* The PRDs were too short. Reset the Active bit, but don't raise an
656          * interrupt. */
657         s->status = READY_STAT | SEEK_STAT;
658         goto eot;
659     }
660 
661 #ifdef DEBUG_AIO
662     printf("ide_dma_cb: sector_num=%" PRId64 " n=%d, cmd_cmd=%d\n",
663            sector_num, n, s->dma_cmd);
664 #endif
665 
666     switch (s->dma_cmd) {
667     case IDE_DMA_READ:
668         s->bus->dma->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
669                                            ide_dma_cb, s);
670         break;
671     case IDE_DMA_WRITE:
672         s->bus->dma->aiocb = dma_bdrv_write(s->bs, &s->sg, sector_num,
673                                             ide_dma_cb, s);
674         break;
675     case IDE_DMA_TRIM:
676         s->bus->dma->aiocb = dma_bdrv_io(s->bs, &s->sg, sector_num,
677                                          ide_issue_trim, ide_dma_cb, s,
678                                          DMA_DIRECTION_TO_DEVICE);
679         break;
680     }
681     return;
682 
683 eot:
684     if (s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) {
685         bdrv_acct_done(s->bs, &s->acct);
686     }
687     ide_set_inactive(s);
688     if (stay_active) {
689         s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_DMAING);
690     }
691 }
692 
693 static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
694 {
695     s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT;
696     s->io_buffer_index = 0;
697     s->io_buffer_size = 0;
698     s->dma_cmd = dma_cmd;
699 
700     switch (dma_cmd) {
701     case IDE_DMA_READ:
702         bdrv_acct_start(s->bs, &s->acct, s->nsector * BDRV_SECTOR_SIZE,
703                         BDRV_ACCT_READ);
704         break;
705     case IDE_DMA_WRITE:
706         bdrv_acct_start(s->bs, &s->acct, s->nsector * BDRV_SECTOR_SIZE,
707                         BDRV_ACCT_WRITE);
708         break;
709     default:
710         break;
711     }
712 
713     s->bus->dma->ops->start_dma(s->bus->dma, s, ide_dma_cb);
714 }
715 
716 static void ide_sector_write_timer_cb(void *opaque)
717 {
718     IDEState *s = opaque;
719     ide_set_irq(s->bus);
720 }
721 
722 static void ide_sector_write_cb(void *opaque, int ret)
723 {
724     IDEState *s = opaque;
725     int n;
726 
727     bdrv_acct_done(s->bs, &s->acct);
728 
729     s->pio_aiocb = NULL;
730     s->status &= ~BUSY_STAT;
731 
732     if (ret != 0) {
733         if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY)) {
734             return;
735         }
736     }
737 
738     n = s->nsector;
739     if (n > s->req_nb_sectors) {
740         n = s->req_nb_sectors;
741     }
742     s->nsector -= n;
743     if (s->nsector == 0) {
744         /* no more sectors to write */
745         ide_transfer_stop(s);
746     } else {
747         int n1 = s->nsector;
748         if (n1 > s->req_nb_sectors) {
749             n1 = s->req_nb_sectors;
750         }
751         ide_transfer_start(s, s->io_buffer, n1 * BDRV_SECTOR_SIZE,
752                            ide_sector_write);
753     }
754     ide_set_sector(s, ide_get_sector(s) + n);
755 
756     if (win2k_install_hack && ((++s->irq_count % 16) == 0)) {
757         /* It seems there is a bug in the Windows 2000 installer HDD
758            IDE driver which fills the disk with empty logs when the
759            IDE write IRQ comes too early. This hack tries to correct
760            that at the expense of slower write performances. Use this
761            option _only_ to install Windows 2000. You must disable it
762            for normal use. */
763         qemu_mod_timer(s->sector_write_timer,
764                        qemu_get_clock_ns(vm_clock) + (get_ticks_per_sec() / 1000));
765     } else {
766         ide_set_irq(s->bus);
767     }
768 }
769 
770 void ide_sector_write(IDEState *s)
771 {
772     int64_t sector_num;
773     int n;
774 
775     s->status = READY_STAT | SEEK_STAT | BUSY_STAT;
776     sector_num = ide_get_sector(s);
777 #if defined(DEBUG_IDE)
778     printf("sector=%" PRId64 "\n", sector_num);
779 #endif
780     n = s->nsector;
781     if (n > s->req_nb_sectors) {
782         n = s->req_nb_sectors;
783     }
784 
785     s->iov.iov_base = s->io_buffer;
786     s->iov.iov_len  = n * BDRV_SECTOR_SIZE;
787     qemu_iovec_init_external(&s->qiov, &s->iov, 1);
788 
789     bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
790     s->pio_aiocb = bdrv_aio_writev(s->bs, sector_num, &s->qiov, n,
791                                    ide_sector_write_cb, s);
792 }
793 
794 static void ide_flush_cb(void *opaque, int ret)
795 {
796     IDEState *s = opaque;
797 
798     if (ret < 0) {
799         /* XXX: What sector number to set here? */
800         if (ide_handle_rw_error(s, -ret, BM_STATUS_RETRY_FLUSH)) {
801             return;
802         }
803     }
804 
805     bdrv_acct_done(s->bs, &s->acct);
806     s->status = READY_STAT | SEEK_STAT;
807     ide_set_irq(s->bus);
808 }
809 
810 void ide_flush_cache(IDEState *s)
811 {
812     if (s->bs == NULL) {
813         ide_flush_cb(s, 0);
814         return;
815     }
816 
817     s->status |= BUSY_STAT;
818     bdrv_acct_start(s->bs, &s->acct, 0, BDRV_ACCT_FLUSH);
819     bdrv_aio_flush(s->bs, ide_flush_cb, s);
820 }
821 
822 static void ide_cfata_metadata_inquiry(IDEState *s)
823 {
824     uint16_t *p;
825     uint32_t spd;
826 
827     p = (uint16_t *) s->io_buffer;
828     memset(p, 0, 0x200);
829     spd = ((s->mdata_size - 1) >> 9) + 1;
830 
831     put_le16(p + 0, 0x0001);			/* Data format revision */
832     put_le16(p + 1, 0x0000);			/* Media property: silicon */
833     put_le16(p + 2, s->media_changed);		/* Media status */
834     put_le16(p + 3, s->mdata_size & 0xffff);	/* Capacity in bytes (low) */
835     put_le16(p + 4, s->mdata_size >> 16);	/* Capacity in bytes (high) */
836     put_le16(p + 5, spd & 0xffff);		/* Sectors per device (low) */
837     put_le16(p + 6, spd >> 16);			/* Sectors per device (high) */
838 }
839 
840 static void ide_cfata_metadata_read(IDEState *s)
841 {
842     uint16_t *p;
843 
844     if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
845         s->status = ERR_STAT;
846         s->error = ABRT_ERR;
847         return;
848     }
849 
850     p = (uint16_t *) s->io_buffer;
851     memset(p, 0, 0x200);
852 
853     put_le16(p + 0, s->media_changed);		/* Media status */
854     memcpy(p + 1, s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
855                     MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
856                                     s->nsector << 9), 0x200 - 2));
857 }
858 
859 static void ide_cfata_metadata_write(IDEState *s)
860 {
861     if (((s->hcyl << 16) | s->lcyl) << 9 > s->mdata_size + 2) {
862         s->status = ERR_STAT;
863         s->error = ABRT_ERR;
864         return;
865     }
866 
867     s->media_changed = 0;
868 
869     memcpy(s->mdata_storage + (((s->hcyl << 16) | s->lcyl) << 9),
870                     s->io_buffer + 2,
871                     MIN(MIN(s->mdata_size - (((s->hcyl << 16) | s->lcyl) << 9),
872                                     s->nsector << 9), 0x200 - 2));
873 }
874 
875 /* called when the inserted state of the media has changed */
876 static void ide_cd_change_cb(void *opaque, bool load)
877 {
878     IDEState *s = opaque;
879     uint64_t nb_sectors;
880 
881     s->tray_open = !load;
882     bdrv_get_geometry(s->bs, &nb_sectors);
883     s->nb_sectors = nb_sectors;
884 
885     /*
886      * First indicate to the guest that a CD has been removed.  That's
887      * done on the next command the guest sends us.
888      *
889      * Then we set UNIT_ATTENTION, by which the guest will
890      * detect a new CD in the drive.  See ide_atapi_cmd() for details.
891      */
892     s->cdrom_changed = 1;
893     s->events.new_media = true;
894     s->events.eject_request = false;
895     ide_set_irq(s->bus);
896 }
897 
898 static void ide_cd_eject_request_cb(void *opaque, bool force)
899 {
900     IDEState *s = opaque;
901 
902     s->events.eject_request = true;
903     if (force) {
904         s->tray_locked = false;
905     }
906     ide_set_irq(s->bus);
907 }
908 
909 static void ide_cmd_lba48_transform(IDEState *s, int lba48)
910 {
911     s->lba48 = lba48;
912 
913     /* handle the 'magic' 0 nsector count conversion here. to avoid
914      * fiddling with the rest of the read logic, we just store the
915      * full sector count in ->nsector and ignore ->hob_nsector from now
916      */
917     if (!s->lba48) {
918 	if (!s->nsector)
919 	    s->nsector = 256;
920     } else {
921 	if (!s->nsector && !s->hob_nsector)
922 	    s->nsector = 65536;
923 	else {
924 	    int lo = s->nsector;
925 	    int hi = s->hob_nsector;
926 
927 	    s->nsector = (hi << 8) | lo;
928 	}
929     }
930 }
931 
932 static void ide_clear_hob(IDEBus *bus)
933 {
934     /* any write clears HOB high bit of device control register */
935     bus->ifs[0].select &= ~(1 << 7);
936     bus->ifs[1].select &= ~(1 << 7);
937 }
938 
939 void ide_ioport_write(void *opaque, uint32_t addr, uint32_t val)
940 {
941     IDEBus *bus = opaque;
942 
943 #ifdef DEBUG_IDE
944     printf("IDE: write addr=0x%x val=0x%02x\n", addr, val);
945 #endif
946 
947     addr &= 7;
948 
949     /* ignore writes to command block while busy with previous command */
950     if (addr != 7 && (idebus_active_if(bus)->status & (BUSY_STAT|DRQ_STAT)))
951         return;
952 
953     switch(addr) {
954     case 0:
955         break;
956     case 1:
957 	ide_clear_hob(bus);
958         /* NOTE: data is written to the two drives */
959 	bus->ifs[0].hob_feature = bus->ifs[0].feature;
960 	bus->ifs[1].hob_feature = bus->ifs[1].feature;
961         bus->ifs[0].feature = val;
962         bus->ifs[1].feature = val;
963         break;
964     case 2:
965 	ide_clear_hob(bus);
966 	bus->ifs[0].hob_nsector = bus->ifs[0].nsector;
967 	bus->ifs[1].hob_nsector = bus->ifs[1].nsector;
968         bus->ifs[0].nsector = val;
969         bus->ifs[1].nsector = val;
970         break;
971     case 3:
972 	ide_clear_hob(bus);
973 	bus->ifs[0].hob_sector = bus->ifs[0].sector;
974 	bus->ifs[1].hob_sector = bus->ifs[1].sector;
975         bus->ifs[0].sector = val;
976         bus->ifs[1].sector = val;
977         break;
978     case 4:
979 	ide_clear_hob(bus);
980 	bus->ifs[0].hob_lcyl = bus->ifs[0].lcyl;
981 	bus->ifs[1].hob_lcyl = bus->ifs[1].lcyl;
982         bus->ifs[0].lcyl = val;
983         bus->ifs[1].lcyl = val;
984         break;
985     case 5:
986 	ide_clear_hob(bus);
987 	bus->ifs[0].hob_hcyl = bus->ifs[0].hcyl;
988 	bus->ifs[1].hob_hcyl = bus->ifs[1].hcyl;
989         bus->ifs[0].hcyl = val;
990         bus->ifs[1].hcyl = val;
991         break;
992     case 6:
993 	/* FIXME: HOB readback uses bit 7 */
994         bus->ifs[0].select = (val & ~0x10) | 0xa0;
995         bus->ifs[1].select = (val | 0x10) | 0xa0;
996         /* select drive */
997         bus->unit = (val >> 4) & 1;
998         break;
999     default:
1000     case 7:
1001         /* command */
1002         ide_exec_cmd(bus, val);
1003         break;
1004     }
1005 }
1006 
1007 static bool cmd_nop(IDEState *s, uint8_t cmd)
1008 {
1009     return true;
1010 }
1011 
1012 static bool cmd_data_set_management(IDEState *s, uint8_t cmd)
1013 {
1014     switch (s->feature) {
1015     case DSM_TRIM:
1016         if (s->bs) {
1017             ide_sector_start_dma(s, IDE_DMA_TRIM);
1018             return false;
1019         }
1020         break;
1021     }
1022 
1023     ide_abort_command(s);
1024     return true;
1025 }
1026 
1027 static bool cmd_identify(IDEState *s, uint8_t cmd)
1028 {
1029     if (s->bs && s->drive_kind != IDE_CD) {
1030         if (s->drive_kind != IDE_CFATA) {
1031             ide_identify(s);
1032         } else {
1033             ide_cfata_identify(s);
1034         }
1035         s->status = READY_STAT | SEEK_STAT;
1036         ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1037         ide_set_irq(s->bus);
1038         return false;
1039     } else {
1040         if (s->drive_kind == IDE_CD) {
1041             ide_set_signature(s);
1042         }
1043         ide_abort_command(s);
1044     }
1045 
1046     return true;
1047 }
1048 
1049 static bool cmd_verify(IDEState *s, uint8_t cmd)
1050 {
1051     bool lba48 = (cmd == WIN_VERIFY_EXT);
1052 
1053     /* do sector number check ? */
1054     ide_cmd_lba48_transform(s, lba48);
1055 
1056     return true;
1057 }
1058 
1059 static bool cmd_set_multiple_mode(IDEState *s, uint8_t cmd)
1060 {
1061     if (s->drive_kind == IDE_CFATA && s->nsector == 0) {
1062         /* Disable Read and Write Multiple */
1063         s->mult_sectors = 0;
1064     } else if ((s->nsector & 0xff) != 0 &&
1065         ((s->nsector & 0xff) > MAX_MULT_SECTORS ||
1066          (s->nsector & (s->nsector - 1)) != 0)) {
1067         ide_abort_command(s);
1068     } else {
1069         s->mult_sectors = s->nsector & 0xff;
1070     }
1071 
1072     return true;
1073 }
1074 
1075 static bool cmd_read_multiple(IDEState *s, uint8_t cmd)
1076 {
1077     bool lba48 = (cmd == WIN_MULTREAD_EXT);
1078 
1079     if (!s->bs || !s->mult_sectors) {
1080         ide_abort_command(s);
1081         return true;
1082     }
1083 
1084     ide_cmd_lba48_transform(s, lba48);
1085     s->req_nb_sectors = s->mult_sectors;
1086     ide_sector_read(s);
1087     return false;
1088 }
1089 
1090 static bool cmd_write_multiple(IDEState *s, uint8_t cmd)
1091 {
1092     bool lba48 = (cmd == WIN_MULTWRITE_EXT);
1093     int n;
1094 
1095     if (!s->bs || !s->mult_sectors) {
1096         ide_abort_command(s);
1097         return true;
1098     }
1099 
1100     ide_cmd_lba48_transform(s, lba48);
1101 
1102     s->req_nb_sectors = s->mult_sectors;
1103     n = MIN(s->nsector, s->req_nb_sectors);
1104 
1105     s->status = SEEK_STAT | READY_STAT;
1106     ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);
1107 
1108     s->media_changed = 1;
1109 
1110     return false;
1111 }
1112 
1113 static bool cmd_read_pio(IDEState *s, uint8_t cmd)
1114 {
1115     bool lba48 = (cmd == WIN_READ_EXT);
1116 
1117     if (s->drive_kind == IDE_CD) {
1118         ide_set_signature(s); /* odd, but ATA4 8.27.5.2 requires it */
1119         ide_abort_command(s);
1120         return true;
1121     }
1122 
1123     if (!s->bs) {
1124         ide_abort_command(s);
1125         return true;
1126     }
1127 
1128     ide_cmd_lba48_transform(s, lba48);
1129     s->req_nb_sectors = 1;
1130     ide_sector_read(s);
1131 
1132     return false;
1133 }
1134 
1135 static bool cmd_write_pio(IDEState *s, uint8_t cmd)
1136 {
1137     bool lba48 = (cmd == WIN_WRITE_EXT);
1138 
1139     if (!s->bs) {
1140         ide_abort_command(s);
1141         return true;
1142     }
1143 
1144     ide_cmd_lba48_transform(s, lba48);
1145 
1146     s->req_nb_sectors = 1;
1147     s->status = SEEK_STAT | READY_STAT;
1148     ide_transfer_start(s, s->io_buffer, 512, ide_sector_write);
1149 
1150     s->media_changed = 1;
1151 
1152     return false;
1153 }
1154 
1155 static bool cmd_read_dma(IDEState *s, uint8_t cmd)
1156 {
1157     bool lba48 = (cmd == WIN_READDMA_EXT);
1158 
1159     if (!s->bs) {
1160         ide_abort_command(s);
1161         return true;
1162     }
1163 
1164     ide_cmd_lba48_transform(s, lba48);
1165     ide_sector_start_dma(s, IDE_DMA_READ);
1166 
1167     return false;
1168 }
1169 
1170 static bool cmd_write_dma(IDEState *s, uint8_t cmd)
1171 {
1172     bool lba48 = (cmd == WIN_WRITEDMA_EXT);
1173 
1174     if (!s->bs) {
1175         ide_abort_command(s);
1176         return true;
1177     }
1178 
1179     ide_cmd_lba48_transform(s, lba48);
1180     ide_sector_start_dma(s, IDE_DMA_WRITE);
1181 
1182     s->media_changed = 1;
1183 
1184     return false;
1185 }
1186 
1187 static bool cmd_flush_cache(IDEState *s, uint8_t cmd)
1188 {
1189     ide_flush_cache(s);
1190     return false;
1191 }
1192 
1193 static bool cmd_seek(IDEState *s, uint8_t cmd)
1194 {
1195     /* XXX: Check that seek is within bounds */
1196     return true;
1197 }
1198 
1199 static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
1200 {
1201     bool lba48 = (cmd == WIN_READ_NATIVE_MAX_EXT);
1202 
1203     /* Refuse if no sectors are addressable (e.g. medium not inserted) */
1204     if (s->nb_sectors == 0) {
1205         ide_abort_command(s);
1206         return true;
1207     }
1208 
1209     ide_cmd_lba48_transform(s, lba48);
1210     ide_set_sector(s, s->nb_sectors - 1);
1211 
1212     return true;
1213 }
1214 
1215 static bool cmd_check_power_mode(IDEState *s, uint8_t cmd)
1216 {
1217     s->nsector = 0xff; /* device active or idle */
1218     return true;
1219 }
1220 
1221 static bool cmd_set_features(IDEState *s, uint8_t cmd)
1222 {
1223     uint16_t *identify_data;
1224 
1225     if (!s->bs) {
1226         ide_abort_command(s);
1227         return true;
1228     }
1229 
1230     /* XXX: valid for CDROM ? */
1231     switch (s->feature) {
1232     case 0x02: /* write cache enable */
1233         bdrv_set_enable_write_cache(s->bs, true);
1234         identify_data = (uint16_t *)s->identify_data;
1235         put_le16(identify_data + 85, (1 << 14) | (1 << 5) | 1);
1236         return true;
1237     case 0x82: /* write cache disable */
1238         bdrv_set_enable_write_cache(s->bs, false);
1239         identify_data = (uint16_t *)s->identify_data;
1240         put_le16(identify_data + 85, (1 << 14) | 1);
1241         ide_flush_cache(s);
1242         return false;
1243     case 0xcc: /* reverting to power-on defaults enable */
1244     case 0x66: /* reverting to power-on defaults disable */
1245     case 0xaa: /* read look-ahead enable */
1246     case 0x55: /* read look-ahead disable */
1247     case 0x05: /* set advanced power management mode */
1248     case 0x85: /* disable advanced power management mode */
1249     case 0x69: /* NOP */
1250     case 0x67: /* NOP */
1251     case 0x96: /* NOP */
1252     case 0x9a: /* NOP */
1253     case 0x42: /* enable Automatic Acoustic Mode */
1254     case 0xc2: /* disable Automatic Acoustic Mode */
1255         return true;
1256     case 0x03: /* set transfer mode */
1257         {
1258             uint8_t val = s->nsector & 0x07;
1259             identify_data = (uint16_t *)s->identify_data;
1260 
1261             switch (s->nsector >> 3) {
1262             case 0x00: /* pio default */
1263             case 0x01: /* pio mode */
1264                 put_le16(identify_data + 62, 0x07);
1265                 put_le16(identify_data + 63, 0x07);
1266                 put_le16(identify_data + 88, 0x3f);
1267                 break;
1268             case 0x02: /* sigle word dma mode*/
1269                 put_le16(identify_data + 62, 0x07 | (1 << (val + 8)));
1270                 put_le16(identify_data + 63, 0x07);
1271                 put_le16(identify_data + 88, 0x3f);
1272                 break;
1273             case 0x04: /* mdma mode */
1274                 put_le16(identify_data + 62, 0x07);
1275                 put_le16(identify_data + 63, 0x07 | (1 << (val + 8)));
1276                 put_le16(identify_data + 88, 0x3f);
1277                 break;
1278             case 0x08: /* udma mode */
1279                 put_le16(identify_data + 62, 0x07);
1280                 put_le16(identify_data + 63, 0x07);
1281                 put_le16(identify_data + 88, 0x3f | (1 << (val + 8)));
1282                 break;
1283             default:
1284                 goto abort_cmd;
1285             }
1286             return true;
1287         }
1288     }
1289 
1290 abort_cmd:
1291     ide_abort_command(s);
1292     return true;
1293 }
1294 
1295 
1296 /*** ATAPI commands ***/
1297 
1298 static bool cmd_identify_packet(IDEState *s, uint8_t cmd)
1299 {
1300     ide_atapi_identify(s);
1301     s->status = READY_STAT | SEEK_STAT;
1302     ide_transfer_start(s, s->io_buffer, 512, ide_transfer_stop);
1303     ide_set_irq(s->bus);
1304     return false;
1305 }
1306 
1307 static bool cmd_exec_dev_diagnostic(IDEState *s, uint8_t cmd)
1308 {
1309     ide_set_signature(s);
1310 
1311     if (s->drive_kind == IDE_CD) {
1312         s->status = 0; /* ATAPI spec (v6) section 9.10 defines packet
1313                         * devices to return a clear status register
1314                         * with READY_STAT *not* set. */
1315     } else {
1316         s->status = READY_STAT | SEEK_STAT;
1317         /* The bits of the error register are not as usual for this command!
1318          * They are part of the regular output (this is why ERR_STAT isn't set)
1319          * Device 0 passed, Device 1 passed or not present. */
1320         s->error = 0x01;
1321         ide_set_irq(s->bus);
1322     }
1323 
1324     return false;
1325 }
1326 
1327 static bool cmd_device_reset(IDEState *s, uint8_t cmd)
1328 {
1329     ide_set_signature(s);
1330     s->status = 0x00; /* NOTE: READY is _not_ set */
1331     s->error = 0x01;
1332 
1333     return false;
1334 }
1335 
1336 static bool cmd_packet(IDEState *s, uint8_t cmd)
1337 {
1338     /* overlapping commands not supported */
1339     if (s->feature & 0x02) {
1340         ide_abort_command(s);
1341         return true;
1342     }
1343 
1344     s->status = READY_STAT | SEEK_STAT;
1345     s->atapi_dma = s->feature & 1;
1346     s->nsector = 1;
1347     ide_transfer_start(s, s->io_buffer, ATAPI_PACKET_SIZE,
1348                        ide_atapi_cmd);
1349     return false;
1350 }
1351 
1352 
1353 /*** CF-ATA commands ***/
1354 
1355 static bool cmd_cfa_req_ext_error_code(IDEState *s, uint8_t cmd)
1356 {
1357     s->error = 0x09;    /* miscellaneous error */
1358     s->status = READY_STAT | SEEK_STAT;
1359     ide_set_irq(s->bus);
1360 
1361     return false;
1362 }
1363 
1364 static bool cmd_cfa_erase_sectors(IDEState *s, uint8_t cmd)
1365 {
1366     /* WIN_SECURITY_FREEZE_LOCK has the same ID as CFA_WEAR_LEVEL and is
1367      * required for Windows 8 to work with AHCI */
1368 
1369     if (cmd == CFA_WEAR_LEVEL) {
1370         s->nsector = 0;
1371     }
1372 
1373     if (cmd == CFA_ERASE_SECTORS) {
1374         s->media_changed = 1;
1375     }
1376 
1377     return true;
1378 }
1379 
1380 static bool cmd_cfa_translate_sector(IDEState *s, uint8_t cmd)
1381 {
1382     s->status = READY_STAT | SEEK_STAT;
1383 
1384     memset(s->io_buffer, 0, 0x200);
1385     s->io_buffer[0x00] = s->hcyl;                   /* Cyl MSB */
1386     s->io_buffer[0x01] = s->lcyl;                   /* Cyl LSB */
1387     s->io_buffer[0x02] = s->select;                 /* Head */
1388     s->io_buffer[0x03] = s->sector;                 /* Sector */
1389     s->io_buffer[0x04] = ide_get_sector(s) >> 16;   /* LBA MSB */
1390     s->io_buffer[0x05] = ide_get_sector(s) >> 8;    /* LBA */
1391     s->io_buffer[0x06] = ide_get_sector(s) >> 0;    /* LBA LSB */
1392     s->io_buffer[0x13] = 0x00;                      /* Erase flag */
1393     s->io_buffer[0x18] = 0x00;                      /* Hot count */
1394     s->io_buffer[0x19] = 0x00;                      /* Hot count */
1395     s->io_buffer[0x1a] = 0x01;                      /* Hot count */
1396 
1397     ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1398     ide_set_irq(s->bus);
1399 
1400     return false;
1401 }
1402 
1403 static bool cmd_cfa_access_metadata_storage(IDEState *s, uint8_t cmd)
1404 {
1405     switch (s->feature) {
1406     case 0x02:  /* Inquiry Metadata Storage */
1407         ide_cfata_metadata_inquiry(s);
1408         break;
1409     case 0x03:  /* Read Metadata Storage */
1410         ide_cfata_metadata_read(s);
1411         break;
1412     case 0x04:  /* Write Metadata Storage */
1413         ide_cfata_metadata_write(s);
1414         break;
1415     default:
1416         ide_abort_command(s);
1417         return true;
1418     }
1419 
1420     ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1421     s->status = 0x00; /* NOTE: READY is _not_ set */
1422     ide_set_irq(s->bus);
1423 
1424     return false;
1425 }
1426 
1427 static bool cmd_ibm_sense_condition(IDEState *s, uint8_t cmd)
1428 {
1429     switch (s->feature) {
1430     case 0x01:  /* sense temperature in device */
1431         s->nsector = 0x50;      /* +20 C */
1432         break;
1433     default:
1434         ide_abort_command(s);
1435         return true;
1436     }
1437 
1438     return true;
1439 }
1440 
1441 
1442 /*** SMART commands ***/
1443 
1444 static bool cmd_smart(IDEState *s, uint8_t cmd)
1445 {
1446     int n;
1447 
1448     if (s->hcyl != 0xc2 || s->lcyl != 0x4f) {
1449         goto abort_cmd;
1450     }
1451 
1452     if (!s->smart_enabled && s->feature != SMART_ENABLE) {
1453         goto abort_cmd;
1454     }
1455 
1456     switch (s->feature) {
1457     case SMART_DISABLE:
1458         s->smart_enabled = 0;
1459         return true;
1460 
1461     case SMART_ENABLE:
1462         s->smart_enabled = 1;
1463         return true;
1464 
1465     case SMART_ATTR_AUTOSAVE:
1466         switch (s->sector) {
1467         case 0x00:
1468             s->smart_autosave = 0;
1469             break;
1470         case 0xf1:
1471             s->smart_autosave = 1;
1472             break;
1473         default:
1474             goto abort_cmd;
1475         }
1476         return true;
1477 
1478     case SMART_STATUS:
1479         if (!s->smart_errors) {
1480             s->hcyl = 0xc2;
1481             s->lcyl = 0x4f;
1482         } else {
1483             s->hcyl = 0x2c;
1484             s->lcyl = 0xf4;
1485         }
1486         return true;
1487 
1488     case SMART_READ_THRESH:
1489         memset(s->io_buffer, 0, 0x200);
1490         s->io_buffer[0] = 0x01; /* smart struct version */
1491 
1492         for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
1493             s->io_buffer[2 + 0 + (n * 12)] = smart_attributes[n][0];
1494             s->io_buffer[2 + 1 + (n * 12)] = smart_attributes[n][11];
1495         }
1496 
1497         /* checksum */
1498         for (n = 0; n < 511; n++) {
1499             s->io_buffer[511] += s->io_buffer[n];
1500         }
1501         s->io_buffer[511] = 0x100 - s->io_buffer[511];
1502 
1503         s->status = READY_STAT | SEEK_STAT;
1504         ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1505         ide_set_irq(s->bus);
1506         return false;
1507 
1508     case SMART_READ_DATA:
1509         memset(s->io_buffer, 0, 0x200);
1510         s->io_buffer[0] = 0x01; /* smart struct version */
1511 
1512         for (n = 0; n < ARRAY_SIZE(smart_attributes); n++) {
1513             int i;
1514             for (i = 0; i < 11; i++) {
1515                 s->io_buffer[2 + i + (n * 12)] = smart_attributes[n][i];
1516             }
1517         }
1518 
1519         s->io_buffer[362] = 0x02 | (s->smart_autosave ? 0x80 : 0x00);
1520         if (s->smart_selftest_count == 0) {
1521             s->io_buffer[363] = 0;
1522         } else {
1523             s->io_buffer[363] =
1524                 s->smart_selftest_data[3 +
1525                            (s->smart_selftest_count - 1) *
1526                            24];
1527         }
1528         s->io_buffer[364] = 0x20;
1529         s->io_buffer[365] = 0x01;
1530         /* offline data collection capacity: execute + self-test*/
1531         s->io_buffer[367] = (1 << 4 | 1 << 3 | 1);
1532         s->io_buffer[368] = 0x03; /* smart capability (1) */
1533         s->io_buffer[369] = 0x00; /* smart capability (2) */
1534         s->io_buffer[370] = 0x01; /* error logging supported */
1535         s->io_buffer[372] = 0x02; /* minutes for poll short test */
1536         s->io_buffer[373] = 0x36; /* minutes for poll ext test */
1537         s->io_buffer[374] = 0x01; /* minutes for poll conveyance */
1538 
1539         for (n = 0; n < 511; n++) {
1540             s->io_buffer[511] += s->io_buffer[n];
1541         }
1542         s->io_buffer[511] = 0x100 - s->io_buffer[511];
1543 
1544         s->status = READY_STAT | SEEK_STAT;
1545         ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1546         ide_set_irq(s->bus);
1547         return false;
1548 
1549     case SMART_READ_LOG:
1550         switch (s->sector) {
1551         case 0x01: /* summary smart error log */
1552             memset(s->io_buffer, 0, 0x200);
1553             s->io_buffer[0] = 0x01;
1554             s->io_buffer[1] = 0x00; /* no error entries */
1555             s->io_buffer[452] = s->smart_errors & 0xff;
1556             s->io_buffer[453] = (s->smart_errors & 0xff00) >> 8;
1557 
1558             for (n = 0; n < 511; n++) {
1559                 s->io_buffer[511] += s->io_buffer[n];
1560             }
1561             s->io_buffer[511] = 0x100 - s->io_buffer[511];
1562             break;
1563         case 0x06: /* smart self test log */
1564             memset(s->io_buffer, 0, 0x200);
1565             s->io_buffer[0] = 0x01;
1566             if (s->smart_selftest_count == 0) {
1567                 s->io_buffer[508] = 0;
1568             } else {
1569                 s->io_buffer[508] = s->smart_selftest_count;
1570                 for (n = 2; n < 506; n++)  {
1571                     s->io_buffer[n] = s->smart_selftest_data[n];
1572                 }
1573             }
1574 
1575             for (n = 0; n < 511; n++) {
1576                 s->io_buffer[511] += s->io_buffer[n];
1577             }
1578             s->io_buffer[511] = 0x100 - s->io_buffer[511];
1579             break;
1580         default:
1581             goto abort_cmd;
1582         }
1583         s->status = READY_STAT | SEEK_STAT;
1584         ide_transfer_start(s, s->io_buffer, 0x200, ide_transfer_stop);
1585         ide_set_irq(s->bus);
1586         return false;
1587 
1588     case SMART_EXECUTE_OFFLINE:
1589         switch (s->sector) {
1590         case 0: /* off-line routine */
1591         case 1: /* short self test */
1592         case 2: /* extended self test */
1593             s->smart_selftest_count++;
1594             if (s->smart_selftest_count > 21) {
1595                 s->smart_selftest_count = 0;
1596             }
1597             n = 2 + (s->smart_selftest_count - 1) * 24;
1598             s->smart_selftest_data[n] = s->sector;
1599             s->smart_selftest_data[n + 1] = 0x00; /* OK and finished */
1600             s->smart_selftest_data[n + 2] = 0x34; /* hour count lsb */
1601             s->smart_selftest_data[n + 3] = 0x12; /* hour count msb */
1602             break;
1603         default:
1604             goto abort_cmd;
1605         }
1606         return true;
1607     }
1608 
1609 abort_cmd:
1610     ide_abort_command(s);
1611     return true;
1612 }
1613 
1614 #define HD_OK (1u << IDE_HD)
1615 #define CD_OK (1u << IDE_CD)
1616 #define CFA_OK (1u << IDE_CFATA)
1617 #define HD_CFA_OK (HD_OK | CFA_OK)
1618 #define ALL_OK (HD_OK | CD_OK | CFA_OK)
1619 
1620 /* Set the Disk Seek Completed status bit during completion */
1621 #define SET_DSC (1u << 8)
1622 
1623 /* See ACS-2 T13/2015-D Table B.2 Command codes */
1624 static const struct {
1625     /* Returns true if the completion code should be run */
1626     bool (*handler)(IDEState *s, uint8_t cmd);
1627     int flags;
1628 } ide_cmd_table[0x100] = {
1629     /* NOP not implemented, mandatory for CD */
1630     [CFA_REQ_EXT_ERROR_CODE]      = { cmd_cfa_req_ext_error_code, CFA_OK },
1631     [WIN_DSM]                     = { cmd_data_set_management, ALL_OK },
1632     [WIN_DEVICE_RESET]            = { cmd_device_reset, CD_OK },
1633     [WIN_RECAL]                   = { cmd_nop, HD_CFA_OK | SET_DSC},
1634     [WIN_READ]                    = { cmd_read_pio, ALL_OK },
1635     [WIN_READ_ONCE]               = { cmd_read_pio, ALL_OK },
1636     [WIN_READ_EXT]                = { cmd_read_pio, HD_CFA_OK },
1637     [WIN_READDMA_EXT]             = { cmd_read_dma, HD_CFA_OK },
1638     [WIN_READ_NATIVE_MAX_EXT]     = { cmd_read_native_max, HD_CFA_OK | SET_DSC },
1639     [WIN_MULTREAD_EXT]            = { cmd_read_multiple, HD_CFA_OK },
1640     [WIN_WRITE]                   = { cmd_write_pio, HD_CFA_OK },
1641     [WIN_WRITE_ONCE]              = { cmd_write_pio, HD_CFA_OK },
1642     [WIN_WRITE_EXT]               = { cmd_write_pio, HD_CFA_OK },
1643     [WIN_WRITEDMA_EXT]            = { cmd_write_dma, HD_CFA_OK },
1644     [CFA_WRITE_SECT_WO_ERASE]     = { cmd_write_pio, CFA_OK },
1645     [WIN_MULTWRITE_EXT]           = { cmd_write_multiple, HD_CFA_OK },
1646     [WIN_WRITE_VERIFY]            = { cmd_write_pio, HD_CFA_OK },
1647     [WIN_VERIFY]                  = { cmd_verify, HD_CFA_OK | SET_DSC },
1648     [WIN_VERIFY_ONCE]             = { cmd_verify, HD_CFA_OK | SET_DSC },
1649     [WIN_VERIFY_EXT]              = { cmd_verify, HD_CFA_OK | SET_DSC },
1650     [WIN_SEEK]                    = { cmd_seek, HD_CFA_OK | SET_DSC },
1651     [CFA_TRANSLATE_SECTOR]        = { cmd_cfa_translate_sector, CFA_OK },
1652     [WIN_DIAGNOSE]                = { cmd_exec_dev_diagnostic, ALL_OK },
1653     [WIN_SPECIFY]                 = { cmd_nop, HD_CFA_OK | SET_DSC },
1654     [WIN_STANDBYNOW2]             = { cmd_nop, ALL_OK },
1655     [WIN_IDLEIMMEDIATE2]          = { cmd_nop, ALL_OK },
1656     [WIN_STANDBY2]                = { cmd_nop, ALL_OK },
1657     [WIN_SETIDLE2]                = { cmd_nop, ALL_OK },
1658     [WIN_CHECKPOWERMODE2]         = { cmd_check_power_mode, ALL_OK | SET_DSC },
1659     [WIN_SLEEPNOW2]               = { cmd_nop, ALL_OK },
1660     [WIN_PACKETCMD]               = { cmd_packet, CD_OK },
1661     [WIN_PIDENTIFY]               = { cmd_identify_packet, CD_OK },
1662     [WIN_SMART]                   = { cmd_smart, HD_CFA_OK | SET_DSC },
1663     [CFA_ACCESS_METADATA_STORAGE] = { cmd_cfa_access_metadata_storage, CFA_OK },
1664     [CFA_ERASE_SECTORS]           = { cmd_cfa_erase_sectors, CFA_OK | SET_DSC },
1665     [WIN_MULTREAD]                = { cmd_read_multiple, HD_CFA_OK },
1666     [WIN_MULTWRITE]               = { cmd_write_multiple, HD_CFA_OK },
1667     [WIN_SETMULT]                 = { cmd_set_multiple_mode, HD_CFA_OK | SET_DSC },
1668     [WIN_READDMA]                 = { cmd_read_dma, HD_CFA_OK },
1669     [WIN_READDMA_ONCE]            = { cmd_read_dma, HD_CFA_OK },
1670     [WIN_WRITEDMA]                = { cmd_write_dma, HD_CFA_OK },
1671     [WIN_WRITEDMA_ONCE]           = { cmd_write_dma, HD_CFA_OK },
1672     [CFA_WRITE_MULTI_WO_ERASE]    = { cmd_write_multiple, CFA_OK },
1673     [WIN_STANDBYNOW1]             = { cmd_nop, ALL_OK },
1674     [WIN_IDLEIMMEDIATE]           = { cmd_nop, ALL_OK },
1675     [WIN_STANDBY]                 = { cmd_nop, ALL_OK },
1676     [WIN_SETIDLE1]                = { cmd_nop, ALL_OK },
1677     [WIN_CHECKPOWERMODE1]         = { cmd_check_power_mode, ALL_OK | SET_DSC },
1678     [WIN_SLEEPNOW1]               = { cmd_nop, ALL_OK },
1679     [WIN_FLUSH_CACHE]             = { cmd_flush_cache, ALL_OK },
1680     [WIN_FLUSH_CACHE_EXT]         = { cmd_flush_cache, HD_CFA_OK },
1681     [WIN_IDENTIFY]                = { cmd_identify, ALL_OK },
1682     [WIN_SETFEATURES]             = { cmd_set_features, ALL_OK | SET_DSC },
1683     [IBM_SENSE_CONDITION]         = { cmd_ibm_sense_condition, CFA_OK | SET_DSC },
1684     [CFA_WEAR_LEVEL]              = { cmd_cfa_erase_sectors, HD_CFA_OK | SET_DSC },
1685     [WIN_READ_NATIVE_MAX]         = { cmd_read_native_max, ALL_OK | SET_DSC },
1686 };
1687 
1688 static bool ide_cmd_permitted(IDEState *s, uint32_t cmd)
1689 {
1690     return cmd < ARRAY_SIZE(ide_cmd_table)
1691         && (ide_cmd_table[cmd].flags & (1u << s->drive_kind));
1692 }
1693 
1694 void ide_exec_cmd(IDEBus *bus, uint32_t val)
1695 {
1696     IDEState *s;
1697     bool complete;
1698 
1699 #if defined(DEBUG_IDE)
1700     printf("ide: CMD=%02x\n", val);
1701 #endif
1702     s = idebus_active_if(bus);
1703     /* ignore commands to non existent slave */
1704     if (s != bus->ifs && !s->bs)
1705         return;
1706 
1707     /* Only DEVICE RESET is allowed while BSY or/and DRQ are set */
1708     if ((s->status & (BUSY_STAT|DRQ_STAT)) && val != WIN_DEVICE_RESET)
1709         return;
1710 
1711     if (!ide_cmd_permitted(s, val)) {
1712         ide_abort_command(s);
1713         ide_set_irq(s->bus);
1714         return;
1715     }
1716 
1717     s->status = READY_STAT | BUSY_STAT;
1718     s->error = 0;
1719 
1720     complete = ide_cmd_table[val].handler(s, val);
1721     if (complete) {
1722         s->status &= ~BUSY_STAT;
1723         assert(!!s->error == !!(s->status & ERR_STAT));
1724 
1725         if ((ide_cmd_table[val].flags & SET_DSC) && !s->error) {
1726             s->status |= SEEK_STAT;
1727         }
1728 
1729         ide_set_irq(s->bus);
1730     }
1731 }
1732 
1733 uint32_t ide_ioport_read(void *opaque, uint32_t addr1)
1734 {
1735     IDEBus *bus = opaque;
1736     IDEState *s = idebus_active_if(bus);
1737     uint32_t addr;
1738     int ret, hob;
1739 
1740     addr = addr1 & 7;
1741     /* FIXME: HOB readback uses bit 7, but it's always set right now */
1742     //hob = s->select & (1 << 7);
1743     hob = 0;
1744     switch(addr) {
1745     case 0:
1746         ret = 0xff;
1747         break;
1748     case 1:
1749         if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1750             (s != bus->ifs && !s->bs))
1751             ret = 0;
1752         else if (!hob)
1753             ret = s->error;
1754 	else
1755 	    ret = s->hob_feature;
1756         break;
1757     case 2:
1758         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1759             ret = 0;
1760         else if (!hob)
1761             ret = s->nsector & 0xff;
1762 	else
1763 	    ret = s->hob_nsector;
1764         break;
1765     case 3:
1766         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1767             ret = 0;
1768         else if (!hob)
1769             ret = s->sector;
1770 	else
1771 	    ret = s->hob_sector;
1772         break;
1773     case 4:
1774         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1775             ret = 0;
1776         else if (!hob)
1777             ret = s->lcyl;
1778 	else
1779 	    ret = s->hob_lcyl;
1780         break;
1781     case 5:
1782         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1783             ret = 0;
1784         else if (!hob)
1785             ret = s->hcyl;
1786 	else
1787 	    ret = s->hob_hcyl;
1788         break;
1789     case 6:
1790         if (!bus->ifs[0].bs && !bus->ifs[1].bs)
1791             ret = 0;
1792         else
1793             ret = s->select;
1794         break;
1795     default:
1796     case 7:
1797         if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1798             (s != bus->ifs && !s->bs))
1799             ret = 0;
1800         else
1801             ret = s->status;
1802         qemu_irq_lower(bus->irq);
1803         break;
1804     }
1805 #ifdef DEBUG_IDE
1806     printf("ide: read addr=0x%x val=%02x\n", addr1, ret);
1807 #endif
1808     return ret;
1809 }
1810 
1811 uint32_t ide_status_read(void *opaque, uint32_t addr)
1812 {
1813     IDEBus *bus = opaque;
1814     IDEState *s = idebus_active_if(bus);
1815     int ret;
1816 
1817     if ((!bus->ifs[0].bs && !bus->ifs[1].bs) ||
1818         (s != bus->ifs && !s->bs))
1819         ret = 0;
1820     else
1821         ret = s->status;
1822 #ifdef DEBUG_IDE
1823     printf("ide: read status addr=0x%x val=%02x\n", addr, ret);
1824 #endif
1825     return ret;
1826 }
1827 
1828 void ide_cmd_write(void *opaque, uint32_t addr, uint32_t val)
1829 {
1830     IDEBus *bus = opaque;
1831     IDEState *s;
1832     int i;
1833 
1834 #ifdef DEBUG_IDE
1835     printf("ide: write control addr=0x%x val=%02x\n", addr, val);
1836 #endif
1837     /* common for both drives */
1838     if (!(bus->cmd & IDE_CMD_RESET) &&
1839         (val & IDE_CMD_RESET)) {
1840         /* reset low to high */
1841         for(i = 0;i < 2; i++) {
1842             s = &bus->ifs[i];
1843             s->status = BUSY_STAT | SEEK_STAT;
1844             s->error = 0x01;
1845         }
1846     } else if ((bus->cmd & IDE_CMD_RESET) &&
1847                !(val & IDE_CMD_RESET)) {
1848         /* high to low */
1849         for(i = 0;i < 2; i++) {
1850             s = &bus->ifs[i];
1851             if (s->drive_kind == IDE_CD)
1852                 s->status = 0x00; /* NOTE: READY is _not_ set */
1853             else
1854                 s->status = READY_STAT | SEEK_STAT;
1855             ide_set_signature(s);
1856         }
1857     }
1858 
1859     bus->cmd = val;
1860 }
1861 
1862 /*
1863  * Returns true if the running PIO transfer is a PIO out (i.e. data is
1864  * transferred from the device to the guest), false if it's a PIO in
1865  */
1866 static bool ide_is_pio_out(IDEState *s)
1867 {
1868     if (s->end_transfer_func == ide_sector_write ||
1869         s->end_transfer_func == ide_atapi_cmd) {
1870         return false;
1871     } else if (s->end_transfer_func == ide_sector_read ||
1872                s->end_transfer_func == ide_transfer_stop ||
1873                s->end_transfer_func == ide_atapi_cmd_reply_end ||
1874                s->end_transfer_func == ide_dummy_transfer_stop) {
1875         return true;
1876     }
1877 
1878     abort();
1879 }
1880 
1881 void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
1882 {
1883     IDEBus *bus = opaque;
1884     IDEState *s = idebus_active_if(bus);
1885     uint8_t *p;
1886 
1887     /* PIO data access allowed only when DRQ bit is set. The result of a write
1888      * during PIO out is indeterminate, just ignore it. */
1889     if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
1890         return;
1891     }
1892 
1893     p = s->data_ptr;
1894     *(uint16_t *)p = le16_to_cpu(val);
1895     p += 2;
1896     s->data_ptr = p;
1897     if (p >= s->data_end)
1898         s->end_transfer_func(s);
1899 }
1900 
1901 uint32_t ide_data_readw(void *opaque, uint32_t addr)
1902 {
1903     IDEBus *bus = opaque;
1904     IDEState *s = idebus_active_if(bus);
1905     uint8_t *p;
1906     int ret;
1907 
1908     /* PIO data access allowed only when DRQ bit is set. The result of a read
1909      * during PIO in is indeterminate, return 0 and don't move forward. */
1910     if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
1911         return 0;
1912     }
1913 
1914     p = s->data_ptr;
1915     ret = cpu_to_le16(*(uint16_t *)p);
1916     p += 2;
1917     s->data_ptr = p;
1918     if (p >= s->data_end)
1919         s->end_transfer_func(s);
1920     return ret;
1921 }
1922 
1923 void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
1924 {
1925     IDEBus *bus = opaque;
1926     IDEState *s = idebus_active_if(bus);
1927     uint8_t *p;
1928 
1929     /* PIO data access allowed only when DRQ bit is set. The result of a write
1930      * during PIO out is indeterminate, just ignore it. */
1931     if (!(s->status & DRQ_STAT) || ide_is_pio_out(s)) {
1932         return;
1933     }
1934 
1935     p = s->data_ptr;
1936     *(uint32_t *)p = le32_to_cpu(val);
1937     p += 4;
1938     s->data_ptr = p;
1939     if (p >= s->data_end)
1940         s->end_transfer_func(s);
1941 }
1942 
1943 uint32_t ide_data_readl(void *opaque, uint32_t addr)
1944 {
1945     IDEBus *bus = opaque;
1946     IDEState *s = idebus_active_if(bus);
1947     uint8_t *p;
1948     int ret;
1949 
1950     /* PIO data access allowed only when DRQ bit is set. The result of a read
1951      * during PIO in is indeterminate, return 0 and don't move forward. */
1952     if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {
1953         return 0;
1954     }
1955 
1956     p = s->data_ptr;
1957     ret = cpu_to_le32(*(uint32_t *)p);
1958     p += 4;
1959     s->data_ptr = p;
1960     if (p >= s->data_end)
1961         s->end_transfer_func(s);
1962     return ret;
1963 }
1964 
1965 static void ide_dummy_transfer_stop(IDEState *s)
1966 {
1967     s->data_ptr = s->io_buffer;
1968     s->data_end = s->io_buffer;
1969     s->io_buffer[0] = 0xff;
1970     s->io_buffer[1] = 0xff;
1971     s->io_buffer[2] = 0xff;
1972     s->io_buffer[3] = 0xff;
1973 }
1974 
1975 static void ide_reset(IDEState *s)
1976 {
1977 #ifdef DEBUG_IDE
1978     printf("ide: reset\n");
1979 #endif
1980 
1981     if (s->pio_aiocb) {
1982         bdrv_aio_cancel(s->pio_aiocb);
1983         s->pio_aiocb = NULL;
1984     }
1985 
1986     if (s->drive_kind == IDE_CFATA)
1987         s->mult_sectors = 0;
1988     else
1989         s->mult_sectors = MAX_MULT_SECTORS;
1990     /* ide regs */
1991     s->feature = 0;
1992     s->error = 0;
1993     s->nsector = 0;
1994     s->sector = 0;
1995     s->lcyl = 0;
1996     s->hcyl = 0;
1997 
1998     /* lba48 */
1999     s->hob_feature = 0;
2000     s->hob_sector = 0;
2001     s->hob_nsector = 0;
2002     s->hob_lcyl = 0;
2003     s->hob_hcyl = 0;
2004 
2005     s->select = 0xa0;
2006     s->status = READY_STAT | SEEK_STAT;
2007 
2008     s->lba48 = 0;
2009 
2010     /* ATAPI specific */
2011     s->sense_key = 0;
2012     s->asc = 0;
2013     s->cdrom_changed = 0;
2014     s->packet_transfer_size = 0;
2015     s->elementary_transfer_size = 0;
2016     s->io_buffer_index = 0;
2017     s->cd_sector_size = 0;
2018     s->atapi_dma = 0;
2019     s->tray_locked = 0;
2020     s->tray_open = 0;
2021     /* ATA DMA state */
2022     s->io_buffer_size = 0;
2023     s->req_nb_sectors = 0;
2024 
2025     ide_set_signature(s);
2026     /* init the transfer handler so that 0xffff is returned on data
2027        accesses */
2028     s->end_transfer_func = ide_dummy_transfer_stop;
2029     ide_dummy_transfer_stop(s);
2030     s->media_changed = 0;
2031 }
2032 
2033 void ide_bus_reset(IDEBus *bus)
2034 {
2035     bus->unit = 0;
2036     bus->cmd = 0;
2037     ide_reset(&bus->ifs[0]);
2038     ide_reset(&bus->ifs[1]);
2039     ide_clear_hob(bus);
2040 
2041     /* pending async DMA */
2042     if (bus->dma->aiocb) {
2043 #ifdef DEBUG_AIO
2044         printf("aio_cancel\n");
2045 #endif
2046         bdrv_aio_cancel(bus->dma->aiocb);
2047         bus->dma->aiocb = NULL;
2048     }
2049 
2050     /* reset dma provider too */
2051     bus->dma->ops->reset(bus->dma);
2052 }
2053 
2054 static bool ide_cd_is_tray_open(void *opaque)
2055 {
2056     return ((IDEState *)opaque)->tray_open;
2057 }
2058 
2059 static bool ide_cd_is_medium_locked(void *opaque)
2060 {
2061     return ((IDEState *)opaque)->tray_locked;
2062 }
2063 
2064 static const BlockDevOps ide_cd_block_ops = {
2065     .change_media_cb = ide_cd_change_cb,
2066     .eject_request_cb = ide_cd_eject_request_cb,
2067     .is_tray_open = ide_cd_is_tray_open,
2068     .is_medium_locked = ide_cd_is_medium_locked,
2069 };
2070 
2071 int ide_init_drive(IDEState *s, BlockDriverState *bs, IDEDriveKind kind,
2072                    const char *version, const char *serial, const char *model,
2073                    uint64_t wwn,
2074                    uint32_t cylinders, uint32_t heads, uint32_t secs,
2075                    int chs_trans)
2076 {
2077     uint64_t nb_sectors;
2078 
2079     s->bs = bs;
2080     s->drive_kind = kind;
2081 
2082     bdrv_get_geometry(bs, &nb_sectors);
2083     s->cylinders = cylinders;
2084     s->heads = heads;
2085     s->sectors = secs;
2086     s->chs_trans = chs_trans;
2087     s->nb_sectors = nb_sectors;
2088     s->wwn = wwn;
2089     /* The SMART values should be preserved across power cycles
2090        but they aren't.  */
2091     s->smart_enabled = 1;
2092     s->smart_autosave = 1;
2093     s->smart_errors = 0;
2094     s->smart_selftest_count = 0;
2095     if (kind == IDE_CD) {
2096         bdrv_set_dev_ops(bs, &ide_cd_block_ops, s);
2097         bdrv_set_buffer_alignment(bs, 2048);
2098     } else {
2099         if (!bdrv_is_inserted(s->bs)) {
2100             error_report("Device needs media, but drive is empty");
2101             return -1;
2102         }
2103         if (bdrv_is_read_only(bs)) {
2104             error_report("Can't use a read-only drive");
2105             return -1;
2106         }
2107     }
2108     if (serial) {
2109         pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), serial);
2110     } else {
2111         snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
2112                  "QM%05d", s->drive_serial);
2113     }
2114     if (model) {
2115         pstrcpy(s->drive_model_str, sizeof(s->drive_model_str), model);
2116     } else {
2117         switch (kind) {
2118         case IDE_CD:
2119             strcpy(s->drive_model_str, "QEMU DVD-ROM");
2120             break;
2121         case IDE_CFATA:
2122             strcpy(s->drive_model_str, "QEMU MICRODRIVE");
2123             break;
2124         default:
2125             strcpy(s->drive_model_str, "QEMU HARDDISK");
2126             break;
2127         }
2128     }
2129 
2130     if (version) {
2131         pstrcpy(s->version, sizeof(s->version), version);
2132     } else {
2133         pstrcpy(s->version, sizeof(s->version), qemu_get_version());
2134     }
2135 
2136     ide_reset(s);
2137     bdrv_iostatus_enable(bs);
2138     return 0;
2139 }
2140 
2141 static void ide_init1(IDEBus *bus, int unit)
2142 {
2143     static int drive_serial = 1;
2144     IDEState *s = &bus->ifs[unit];
2145 
2146     s->bus = bus;
2147     s->unit = unit;
2148     s->drive_serial = drive_serial++;
2149     /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */
2150     s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;
2151     s->io_buffer = qemu_memalign(2048, s->io_buffer_total_len);
2152     memset(s->io_buffer, 0, s->io_buffer_total_len);
2153 
2154     s->smart_selftest_data = qemu_blockalign(s->bs, 512);
2155     memset(s->smart_selftest_data, 0, 512);
2156 
2157     s->sector_write_timer = qemu_new_timer_ns(vm_clock,
2158                                            ide_sector_write_timer_cb, s);
2159 }
2160 
2161 static void ide_nop_start(IDEDMA *dma, IDEState *s,
2162                           BlockDriverCompletionFunc *cb)
2163 {
2164 }
2165 
2166 static int ide_nop(IDEDMA *dma)
2167 {
2168     return 0;
2169 }
2170 
2171 static int ide_nop_int(IDEDMA *dma, int x)
2172 {
2173     return 0;
2174 }
2175 
2176 static void ide_nop_restart(void *opaque, int x, RunState y)
2177 {
2178 }
2179 
2180 static const IDEDMAOps ide_dma_nop_ops = {
2181     .start_dma      = ide_nop_start,
2182     .start_transfer = ide_nop,
2183     .prepare_buf    = ide_nop_int,
2184     .rw_buf         = ide_nop_int,
2185     .set_unit       = ide_nop_int,
2186     .add_status     = ide_nop_int,
2187     .set_inactive   = ide_nop,
2188     .restart_cb     = ide_nop_restart,
2189     .reset          = ide_nop,
2190 };
2191 
2192 static IDEDMA ide_dma_nop = {
2193     .ops = &ide_dma_nop_ops,
2194     .aiocb = NULL,
2195 };
2196 
2197 void ide_init2(IDEBus *bus, qemu_irq irq)
2198 {
2199     int i;
2200 
2201     for(i = 0; i < 2; i++) {
2202         ide_init1(bus, i);
2203         ide_reset(&bus->ifs[i]);
2204     }
2205     bus->irq = irq;
2206     bus->dma = &ide_dma_nop;
2207 }
2208 
2209 /* TODO convert users to qdev and remove */
2210 void ide_init2_with_non_qdev_drives(IDEBus *bus, DriveInfo *hd0,
2211                                     DriveInfo *hd1, qemu_irq irq)
2212 {
2213     int i, trans;
2214     DriveInfo *dinfo;
2215     uint32_t cyls, heads, secs;
2216 
2217     for(i = 0; i < 2; i++) {
2218         dinfo = i == 0 ? hd0 : hd1;
2219         ide_init1(bus, i);
2220         if (dinfo) {
2221             cyls  = dinfo->cyls;
2222             heads = dinfo->heads;
2223             secs  = dinfo->secs;
2224             trans = dinfo->trans;
2225             if (!cyls && !heads && !secs) {
2226                 hd_geometry_guess(dinfo->bdrv, &cyls, &heads, &secs, &trans);
2227             } else if (trans == BIOS_ATA_TRANSLATION_AUTO) {
2228                 trans = hd_bios_chs_auto_trans(cyls, heads, secs);
2229             }
2230             if (cyls < 1 || cyls > 65535) {
2231                 error_report("cyls must be between 1 and 65535");
2232                 exit(1);
2233             }
2234             if (heads < 1 || heads > 16) {
2235                 error_report("heads must be between 1 and 16");
2236                 exit(1);
2237             }
2238             if (secs < 1 || secs > 255) {
2239                 error_report("secs must be between 1 and 255");
2240                 exit(1);
2241             }
2242             if (ide_init_drive(&bus->ifs[i], dinfo->bdrv,
2243                                dinfo->media_cd ? IDE_CD : IDE_HD,
2244                                NULL, dinfo->serial, NULL, 0,
2245                                cyls, heads, secs, trans) < 0) {
2246                 error_report("Can't set up IDE drive %s", dinfo->id);
2247                 exit(1);
2248             }
2249             bdrv_attach_dev_nofail(dinfo->bdrv, &bus->ifs[i]);
2250         } else {
2251             ide_reset(&bus->ifs[i]);
2252         }
2253     }
2254     bus->irq = irq;
2255     bus->dma = &ide_dma_nop;
2256 }
2257 
2258 static const MemoryRegionPortio ide_portio_list[] = {
2259     { 0, 8, 1, .read = ide_ioport_read, .write = ide_ioport_write },
2260     { 0, 2, 2, .read = ide_data_readw, .write = ide_data_writew },
2261     { 0, 4, 4, .read = ide_data_readl, .write = ide_data_writel },
2262     PORTIO_END_OF_LIST(),
2263 };
2264 
2265 static const MemoryRegionPortio ide_portio2_list[] = {
2266     { 0, 1, 1, .read = ide_status_read, .write = ide_cmd_write },
2267     PORTIO_END_OF_LIST(),
2268 };
2269 
2270 void ide_init_ioport(IDEBus *bus, ISADevice *dev, int iobase, int iobase2)
2271 {
2272     /* ??? Assume only ISA and PCI configurations, and that the PCI-ISA
2273        bridge has been setup properly to always register with ISA.  */
2274     isa_register_portio_list(dev, iobase, ide_portio_list, bus, "ide");
2275 
2276     if (iobase2) {
2277         isa_register_portio_list(dev, iobase2, ide_portio2_list, bus, "ide");
2278     }
2279 }
2280 
2281 static bool is_identify_set(void *opaque, int version_id)
2282 {
2283     IDEState *s = opaque;
2284 
2285     return s->identify_set != 0;
2286 }
2287 
2288 static EndTransferFunc* transfer_end_table[] = {
2289         ide_sector_read,
2290         ide_sector_write,
2291         ide_transfer_stop,
2292         ide_atapi_cmd_reply_end,
2293         ide_atapi_cmd,
2294         ide_dummy_transfer_stop,
2295 };
2296 
2297 static int transfer_end_table_idx(EndTransferFunc *fn)
2298 {
2299     int i;
2300 
2301     for (i = 0; i < ARRAY_SIZE(transfer_end_table); i++)
2302         if (transfer_end_table[i] == fn)
2303             return i;
2304 
2305     return -1;
2306 }
2307 
2308 static int ide_drive_post_load(void *opaque, int version_id)
2309 {
2310     IDEState *s = opaque;
2311 
2312     if (s->identify_set) {
2313         bdrv_set_enable_write_cache(s->bs, !!(s->identify_data[85] & (1 << 5)));
2314     }
2315     return 0;
2316 }
2317 
2318 static int ide_drive_pio_post_load(void *opaque, int version_id)
2319 {
2320     IDEState *s = opaque;
2321 
2322     if (s->end_transfer_fn_idx >= ARRAY_SIZE(transfer_end_table)) {
2323         return -EINVAL;
2324     }
2325     s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
2326     s->data_ptr = s->io_buffer + s->cur_io_buffer_offset;
2327     s->data_end = s->data_ptr + s->cur_io_buffer_len;
2328 
2329     return 0;
2330 }
2331 
2332 static void ide_drive_pio_pre_save(void *opaque)
2333 {
2334     IDEState *s = opaque;
2335     int idx;
2336 
2337     s->cur_io_buffer_offset = s->data_ptr - s->io_buffer;
2338     s->cur_io_buffer_len = s->data_end - s->data_ptr;
2339 
2340     idx = transfer_end_table_idx(s->end_transfer_func);
2341     if (idx == -1) {
2342         fprintf(stderr, "%s: invalid end_transfer_func for DRQ_STAT\n",
2343                         __func__);
2344         s->end_transfer_fn_idx = 2;
2345     } else {
2346         s->end_transfer_fn_idx = idx;
2347     }
2348 }
2349 
2350 static bool ide_drive_pio_state_needed(void *opaque)
2351 {
2352     IDEState *s = opaque;
2353 
2354     return ((s->status & DRQ_STAT) != 0)
2355         || (s->bus->error_status & BM_STATUS_PIO_RETRY);
2356 }
2357 
2358 static bool ide_tray_state_needed(void *opaque)
2359 {
2360     IDEState *s = opaque;
2361 
2362     return s->tray_open || s->tray_locked;
2363 }
2364 
2365 static bool ide_atapi_gesn_needed(void *opaque)
2366 {
2367     IDEState *s = opaque;
2368 
2369     return s->events.new_media || s->events.eject_request;
2370 }
2371 
2372 static bool ide_error_needed(void *opaque)
2373 {
2374     IDEBus *bus = opaque;
2375 
2376     return (bus->error_status != 0);
2377 }
2378 
2379 /* Fields for GET_EVENT_STATUS_NOTIFICATION ATAPI command */
2380 static const VMStateDescription vmstate_ide_atapi_gesn_state = {
2381     .name ="ide_drive/atapi/gesn_state",
2382     .version_id = 1,
2383     .minimum_version_id = 1,
2384     .minimum_version_id_old = 1,
2385     .fields = (VMStateField []) {
2386         VMSTATE_BOOL(events.new_media, IDEState),
2387         VMSTATE_BOOL(events.eject_request, IDEState),
2388         VMSTATE_END_OF_LIST()
2389     }
2390 };
2391 
2392 static const VMStateDescription vmstate_ide_tray_state = {
2393     .name = "ide_drive/tray_state",
2394     .version_id = 1,
2395     .minimum_version_id = 1,
2396     .minimum_version_id_old = 1,
2397     .fields = (VMStateField[]) {
2398         VMSTATE_BOOL(tray_open, IDEState),
2399         VMSTATE_BOOL(tray_locked, IDEState),
2400         VMSTATE_END_OF_LIST()
2401     }
2402 };
2403 
2404 static const VMStateDescription vmstate_ide_drive_pio_state = {
2405     .name = "ide_drive/pio_state",
2406     .version_id = 1,
2407     .minimum_version_id = 1,
2408     .minimum_version_id_old = 1,
2409     .pre_save = ide_drive_pio_pre_save,
2410     .post_load = ide_drive_pio_post_load,
2411     .fields      = (VMStateField []) {
2412         VMSTATE_INT32(req_nb_sectors, IDEState),
2413         VMSTATE_VARRAY_INT32(io_buffer, IDEState, io_buffer_total_len, 1,
2414 			     vmstate_info_uint8, uint8_t),
2415         VMSTATE_INT32(cur_io_buffer_offset, IDEState),
2416         VMSTATE_INT32(cur_io_buffer_len, IDEState),
2417         VMSTATE_UINT8(end_transfer_fn_idx, IDEState),
2418         VMSTATE_INT32(elementary_transfer_size, IDEState),
2419         VMSTATE_INT32(packet_transfer_size, IDEState),
2420         VMSTATE_END_OF_LIST()
2421     }
2422 };
2423 
2424 const VMStateDescription vmstate_ide_drive = {
2425     .name = "ide_drive",
2426     .version_id = 3,
2427     .minimum_version_id = 0,
2428     .minimum_version_id_old = 0,
2429     .post_load = ide_drive_post_load,
2430     .fields      = (VMStateField []) {
2431         VMSTATE_INT32(mult_sectors, IDEState),
2432         VMSTATE_INT32(identify_set, IDEState),
2433         VMSTATE_BUFFER_TEST(identify_data, IDEState, is_identify_set),
2434         VMSTATE_UINT8(feature, IDEState),
2435         VMSTATE_UINT8(error, IDEState),
2436         VMSTATE_UINT32(nsector, IDEState),
2437         VMSTATE_UINT8(sector, IDEState),
2438         VMSTATE_UINT8(lcyl, IDEState),
2439         VMSTATE_UINT8(hcyl, IDEState),
2440         VMSTATE_UINT8(hob_feature, IDEState),
2441         VMSTATE_UINT8(hob_sector, IDEState),
2442         VMSTATE_UINT8(hob_nsector, IDEState),
2443         VMSTATE_UINT8(hob_lcyl, IDEState),
2444         VMSTATE_UINT8(hob_hcyl, IDEState),
2445         VMSTATE_UINT8(select, IDEState),
2446         VMSTATE_UINT8(status, IDEState),
2447         VMSTATE_UINT8(lba48, IDEState),
2448         VMSTATE_UINT8(sense_key, IDEState),
2449         VMSTATE_UINT8(asc, IDEState),
2450         VMSTATE_UINT8_V(cdrom_changed, IDEState, 3),
2451         VMSTATE_END_OF_LIST()
2452     },
2453     .subsections = (VMStateSubsection []) {
2454         {
2455             .vmsd = &vmstate_ide_drive_pio_state,
2456             .needed = ide_drive_pio_state_needed,
2457         }, {
2458             .vmsd = &vmstate_ide_tray_state,
2459             .needed = ide_tray_state_needed,
2460         }, {
2461             .vmsd = &vmstate_ide_atapi_gesn_state,
2462             .needed = ide_atapi_gesn_needed,
2463         }, {
2464             /* empty */
2465         }
2466     }
2467 };
2468 
2469 static const VMStateDescription vmstate_ide_error_status = {
2470     .name ="ide_bus/error",
2471     .version_id = 1,
2472     .minimum_version_id = 1,
2473     .minimum_version_id_old = 1,
2474     .fields = (VMStateField []) {
2475         VMSTATE_INT32(error_status, IDEBus),
2476         VMSTATE_END_OF_LIST()
2477     }
2478 };
2479 
2480 const VMStateDescription vmstate_ide_bus = {
2481     .name = "ide_bus",
2482     .version_id = 1,
2483     .minimum_version_id = 1,
2484     .minimum_version_id_old = 1,
2485     .fields      = (VMStateField []) {
2486         VMSTATE_UINT8(cmd, IDEBus),
2487         VMSTATE_UINT8(unit, IDEBus),
2488         VMSTATE_END_OF_LIST()
2489     },
2490     .subsections = (VMStateSubsection []) {
2491         {
2492             .vmsd = &vmstate_ide_error_status,
2493             .needed = ide_error_needed,
2494         }, {
2495             /* empty */
2496         }
2497     }
2498 };
2499 
2500 void ide_drive_get(DriveInfo **hd, int max_bus)
2501 {
2502     int i;
2503 
2504     if (drive_get_max_bus(IF_IDE) >= max_bus) {
2505         fprintf(stderr, "qemu: too many IDE bus: %d\n", max_bus);
2506         exit(1);
2507     }
2508 
2509     for(i = 0; i < max_bus * MAX_IDE_DEVS; i++) {
2510         hd[i] = drive_get(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);
2511     }
2512 }
2513