Statistics
| Branch: | Revision:

root / hw / ide / ahci.c @ 3f76a7c3

History | View | Annotate | Download (33.1 kB)

1
/*
2
 * QEMU AHCI Emulation
3
 *
4
 * Copyright (c) 2010 qiaochong@loongson.cn
5
 * Copyright (c) 2010 Roland Elek <elek.roland@gmail.com>
6
 * Copyright (c) 2010 Sebastian Herbszt <herbszt@gmx.de>
7
 * Copyright (c) 2010 Alexander Graf <agraf@suse.de>
8
 *
9
 * This library is free software; you can redistribute it and/or
10
 * modify it under the terms of the GNU Lesser General Public
11
 * License as published by the Free Software Foundation; either
12
 * version 2 of the License, or (at your option) any later version.
13
 *
14
 * This library is distributed in the hope that it will be useful,
15
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
17
 * Lesser General Public License for more details.
18
 *
19
 * You should have received a copy of the GNU Lesser General Public
20
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21
 *
22
 */
23

    
24
#include <hw/hw.h>
25
#include <hw/msi.h>
26
#include <hw/pc.h>
27
#include <hw/pci.h>
28

    
29
#include "monitor.h"
30
#include "dma.h"
31
#include "cpu-common.h"
32
#include "internal.h"
33
#include <hw/ide/pci.h>
34
#include <hw/ide/ahci.h>
35

    
36
/* #define DEBUG_AHCI */
37

    
38
#ifdef DEBUG_AHCI
39
#define DPRINTF(port, fmt, ...) \
40
do { fprintf(stderr, "ahci: %s: [%d] ", __FUNCTION__, port); \
41
     fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
42
#else
43
#define DPRINTF(port, fmt, ...) do {} while(0)
44
#endif
45

    
46
static void check_cmd(AHCIState *s, int port);
47
static int handle_cmd(AHCIState *s,int port,int slot);
48
static void ahci_reset_port(AHCIState *s, int port);
49
static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis);
50
static void ahci_init_d2h(AHCIDevice *ad);
51

    
52
static uint32_t  ahci_port_read(AHCIState *s, int port, int offset)
53
{
54
    uint32_t val;
55
    AHCIPortRegs *pr;
56
    pr = &s->dev[port].port_regs;
57

    
58
    switch (offset) {
59
    case PORT_LST_ADDR:
60
        val = pr->lst_addr;
61
        break;
62
    case PORT_LST_ADDR_HI:
63
        val = pr->lst_addr_hi;
64
        break;
65
    case PORT_FIS_ADDR:
66
        val = pr->fis_addr;
67
        break;
68
    case PORT_FIS_ADDR_HI:
69
        val = pr->fis_addr_hi;
70
        break;
71
    case PORT_IRQ_STAT:
72
        val = pr->irq_stat;
73
        break;
74
    case PORT_IRQ_MASK:
75
        val = pr->irq_mask;
76
        break;
77
    case PORT_CMD:
78
        val = pr->cmd;
79
        break;
80
    case PORT_TFDATA:
81
        val = ((uint16_t)s->dev[port].port.ifs[0].error << 8) |
82
              s->dev[port].port.ifs[0].status;
83
        break;
84
    case PORT_SIG:
85
        val = pr->sig;
86
        break;
87
    case PORT_SCR_STAT:
88
        if (s->dev[port].port.ifs[0].bs) {
89
            val = SATA_SCR_SSTATUS_DET_DEV_PRESENT_PHY_UP |
90
                  SATA_SCR_SSTATUS_SPD_GEN1 | SATA_SCR_SSTATUS_IPM_ACTIVE;
91
        } else {
92
            val = SATA_SCR_SSTATUS_DET_NODEV;
93
        }
94
        break;
95
    case PORT_SCR_CTL:
96
        val = pr->scr_ctl;
97
        break;
98
    case PORT_SCR_ERR:
99
        val = pr->scr_err;
100
        break;
101
    case PORT_SCR_ACT:
102
        pr->scr_act &= ~s->dev[port].finished;
103
        s->dev[port].finished = 0;
104
        val = pr->scr_act;
105
        break;
106
    case PORT_CMD_ISSUE:
107
        val = pr->cmd_issue;
108
        break;
109
    case PORT_RESERVED:
110
    default:
111
        val = 0;
112
    }
113
    DPRINTF(port, "offset: 0x%x val: 0x%x\n", offset, val);
114
    return val;
115

    
116
}
117

    
118
static void ahci_irq_raise(AHCIState *s, AHCIDevice *dev)
119
{
120
    struct AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
121

    
122
    DPRINTF(0, "raise irq\n");
123

    
124
    if (msi_enabled(&d->card)) {
125
        msi_notify(&d->card, 0);
126
    } else {
127
        qemu_irq_raise(s->irq);
128
    }
129
}
130

    
131
static void ahci_irq_lower(AHCIState *s, AHCIDevice *dev)
132
{
133
    struct AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
134

    
135
    DPRINTF(0, "lower irq\n");
136

    
137
    if (!msi_enabled(&d->card)) {
138
        qemu_irq_lower(s->irq);
139
    }
140
}
141

    
142
static void ahci_check_irq(AHCIState *s)
143
{
144
    int i;
145

    
146
    DPRINTF(-1, "check irq %#x\n", s->control_regs.irqstatus);
147

    
148
    for (i = 0; i < s->ports; i++) {
149
        AHCIPortRegs *pr = &s->dev[i].port_regs;
150
        if (pr->irq_stat & pr->irq_mask) {
151
            s->control_regs.irqstatus |= (1 << i);
152
        }
153
    }
154

    
155
    if (s->control_regs.irqstatus &&
156
        (s->control_regs.ghc & HOST_CTL_IRQ_EN)) {
157
            ahci_irq_raise(s, NULL);
158
    } else {
159
        ahci_irq_lower(s, NULL);
160
    }
161
}
162

    
163
static void ahci_trigger_irq(AHCIState *s, AHCIDevice *d,
164
                             int irq_type)
165
{
166
    DPRINTF(d->port_no, "trigger irq %#x -> %x\n",
167
            irq_type, d->port_regs.irq_mask & irq_type);
168

    
169
    d->port_regs.irq_stat |= irq_type;
170
    ahci_check_irq(s);
171
}
172

    
173
static void map_page(uint8_t **ptr, uint64_t addr, uint32_t wanted)
174
{
175
    target_phys_addr_t len = wanted;
176

    
177
    if (*ptr) {
178
        cpu_physical_memory_unmap(*ptr, len, 1, len);
179
    }
180

    
181
    *ptr = cpu_physical_memory_map(addr, &len, 1);
182
    if (len < wanted) {
183
        cpu_physical_memory_unmap(*ptr, len, 1, len);
184
        *ptr = NULL;
185
    }
186
}
187

    
188
static void  ahci_port_write(AHCIState *s, int port, int offset, uint32_t val)
189
{
190
    AHCIPortRegs *pr = &s->dev[port].port_regs;
191

    
192
    DPRINTF(port, "offset: 0x%x val: 0x%x\n", offset, val);
193
    switch (offset) {
194
        case PORT_LST_ADDR:
195
            pr->lst_addr = val;
196
            map_page(&s->dev[port].lst,
197
                     ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
198
            s->dev[port].cur_cmd = NULL;
199
            break;
200
        case PORT_LST_ADDR_HI:
201
            pr->lst_addr_hi = val;
202
            map_page(&s->dev[port].lst,
203
                     ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
204
            s->dev[port].cur_cmd = NULL;
205
            break;
206
        case PORT_FIS_ADDR:
207
            pr->fis_addr = val;
208
            map_page(&s->dev[port].res_fis,
209
                     ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
210
            break;
211
        case PORT_FIS_ADDR_HI:
212
            pr->fis_addr_hi = val;
213
            map_page(&s->dev[port].res_fis,
214
                     ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
215
            break;
216
        case PORT_IRQ_STAT:
217
            pr->irq_stat &= ~val;
218
            break;
219
        case PORT_IRQ_MASK:
220
            pr->irq_mask = val & 0xfdc000ff;
221
            ahci_check_irq(s);
222
            break;
223
        case PORT_CMD:
224
            pr->cmd = val & ~(PORT_CMD_LIST_ON | PORT_CMD_FIS_ON);
225

    
226
            if (pr->cmd & PORT_CMD_START) {
227
                pr->cmd |= PORT_CMD_LIST_ON;
228
            }
229

    
230
            if (pr->cmd & PORT_CMD_FIS_RX) {
231
                pr->cmd |= PORT_CMD_FIS_ON;
232
            }
233

    
234
            /* XXX usually the FIS would be pending on the bus here and
235
                   issuing deferred until the OS enables FIS receival.
236
                   Instead, we only submit it once - which works in most
237
                   cases, but is a hack. */
238
            if ((pr->cmd & PORT_CMD_FIS_ON) &&
239
                !s->dev[port].init_d2h_sent) {
240
                ahci_init_d2h(&s->dev[port]);
241
                s->dev[port].init_d2h_sent = 1;
242
            }
243

    
244
            check_cmd(s, port);
245
            break;
246
        case PORT_TFDATA:
247
            s->dev[port].port.ifs[0].error = (val >> 8) & 0xff;
248
            s->dev[port].port.ifs[0].status = val & 0xff;
249
            break;
250
        case PORT_SIG:
251
            pr->sig = val;
252
            break;
253
        case PORT_SCR_STAT:
254
            pr->scr_stat = val;
255
            break;
256
        case PORT_SCR_CTL:
257
            if (((pr->scr_ctl & AHCI_SCR_SCTL_DET) == 1) &&
258
                ((val & AHCI_SCR_SCTL_DET) == 0)) {
259
                ahci_reset_port(s, port);
260
            }
261
            pr->scr_ctl = val;
262
            break;
263
        case PORT_SCR_ERR:
264
            pr->scr_err &= ~val;
265
            break;
266
        case PORT_SCR_ACT:
267
            /* RW1 */
268
            pr->scr_act |= val;
269
            break;
270
        case PORT_CMD_ISSUE:
271
            pr->cmd_issue |= val;
272
            check_cmd(s, port);
273
            break;
274
        default:
275
            break;
276
    }
277
}
278

    
279
static uint64_t ahci_mem_read(void *opaque, target_phys_addr_t addr,
280
                              unsigned size)
281
{
282
    AHCIState *s = opaque;
283
    uint32_t val = 0;
284

    
285
    if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
286
        switch (addr) {
287
        case HOST_CAP:
288
            val = s->control_regs.cap;
289
            break;
290
        case HOST_CTL:
291
            val = s->control_regs.ghc;
292
            break;
293
        case HOST_IRQ_STAT:
294
            val = s->control_regs.irqstatus;
295
            break;
296
        case HOST_PORTS_IMPL:
297
            val = s->control_regs.impl;
298
            break;
299
        case HOST_VERSION:
300
            val = s->control_regs.version;
301
            break;
302
        }
303

    
304
        DPRINTF(-1, "(addr 0x%08X), val 0x%08X\n", (unsigned) addr, val);
305
    } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
306
               (addr < (AHCI_PORT_REGS_START_ADDR +
307
                (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
308
        val = ahci_port_read(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
309
                             addr & AHCI_PORT_ADDR_OFFSET_MASK);
310
    }
311

    
312
    return val;
313
}
314

    
315

    
316

    
317
static void ahci_mem_write(void *opaque, target_phys_addr_t addr,
318
                           uint64_t val, unsigned size)
319
{
320
    AHCIState *s = opaque;
321

    
322
    /* Only aligned reads are allowed on AHCI */
323
    if (addr & 3) {
324
        fprintf(stderr, "ahci: Mis-aligned write to addr 0x"
325
                TARGET_FMT_plx "\n", addr);
326
        return;
327
    }
328

    
329
    if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
330
        DPRINTF(-1, "(addr 0x%08X), val 0x%08X\n", (unsigned) addr, val);
331

    
332
        switch (addr) {
333
            case HOST_CAP: /* R/WO, RO */
334
                /* FIXME handle R/WO */
335
                break;
336
            case HOST_CTL: /* R/W */
337
                if (val & HOST_CTL_RESET) {
338
                    DPRINTF(-1, "HBA Reset\n");
339
                    ahci_reset(container_of(s, AHCIPCIState, ahci));
340
                } else {
341
                    s->control_regs.ghc = (val & 0x3) | HOST_CTL_AHCI_EN;
342
                    ahci_check_irq(s);
343
                }
344
                break;
345
            case HOST_IRQ_STAT: /* R/WC, RO */
346
                s->control_regs.irqstatus &= ~val;
347
                ahci_check_irq(s);
348
                break;
349
            case HOST_PORTS_IMPL: /* R/WO, RO */
350
                /* FIXME handle R/WO */
351
                break;
352
            case HOST_VERSION: /* RO */
353
                /* FIXME report write? */
354
                break;
355
            default:
356
                DPRINTF(-1, "write to unknown register 0x%x\n", (unsigned)addr);
357
        }
358
    } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
359
               (addr < (AHCI_PORT_REGS_START_ADDR +
360
                (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
361
        ahci_port_write(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
362
                        addr & AHCI_PORT_ADDR_OFFSET_MASK, val);
363
    }
364

    
365
}
366

    
367
static MemoryRegionOps ahci_mem_ops = {
368
    .read = ahci_mem_read,
369
    .write = ahci_mem_write,
370
    .endianness = DEVICE_LITTLE_ENDIAN,
371
};
372

    
373
static void ahci_reg_init(AHCIState *s)
374
{
375
    int i;
376

    
377
    s->control_regs.cap = (s->ports - 1) |
378
                          (AHCI_NUM_COMMAND_SLOTS << 8) |
379
                          (AHCI_SUPPORTED_SPEED_GEN1 << AHCI_SUPPORTED_SPEED) |
380
                          HOST_CAP_NCQ | HOST_CAP_AHCI;
381

    
382
    s->control_regs.impl = (1 << s->ports) - 1;
383

    
384
    s->control_regs.version = AHCI_VERSION_1_0;
385

    
386
    for (i = 0; i < s->ports; i++) {
387
        s->dev[i].port_state = STATE_RUN;
388
    }
389
}
390

    
391
static uint32_t read_from_sglist(uint8_t *buffer, uint32_t len,
392
                                 QEMUSGList *sglist)
393
{
394
    uint32_t i = 0;
395
    uint32_t total = 0, once;
396
    ScatterGatherEntry *cur_prd;
397
    uint32_t sgcount;
398

    
399
    cur_prd = sglist->sg;
400
    sgcount = sglist->nsg;
401
    for (i = 0; len && sgcount; i++) {
402
        once = MIN(cur_prd->len, len);
403
        cpu_physical_memory_read(cur_prd->base, buffer, once);
404
        cur_prd++;
405
        sgcount--;
406
        len -= once;
407
        buffer += once;
408
        total += once;
409
    }
410

    
411
    return total;
412
}
413

    
414
static uint32_t write_to_sglist(uint8_t *buffer, uint32_t len,
415
                                QEMUSGList *sglist)
416
{
417
    uint32_t i = 0;
418
    uint32_t total = 0, once;
419
    ScatterGatherEntry *cur_prd;
420
    uint32_t sgcount;
421

    
422
    DPRINTF(-1, "total: 0x%x bytes\n", len);
423

    
424
    cur_prd = sglist->sg;
425
    sgcount = sglist->nsg;
426
    for (i = 0; len && sgcount; i++) {
427
        once = MIN(cur_prd->len, len);
428
        DPRINTF(-1, "write 0x%x bytes to 0x%lx\n", once, (long)cur_prd->base);
429
        cpu_physical_memory_write(cur_prd->base, buffer, once);
430
        cur_prd++;
431
        sgcount--;
432
        len -= once;
433
        buffer += once;
434
        total += once;
435
    }
436

    
437
    return total;
438
}
439

    
440
static void check_cmd(AHCIState *s, int port)
441
{
442
    AHCIPortRegs *pr = &s->dev[port].port_regs;
443
    int slot;
444

    
445
    if ((pr->cmd & PORT_CMD_START) && pr->cmd_issue) {
446
        for (slot = 0; (slot < 32) && pr->cmd_issue; slot++) {
447
            if ((pr->cmd_issue & (1 << slot)) &&
448
                !handle_cmd(s, port, slot)) {
449
                pr->cmd_issue &= ~(1 << slot);
450
            }
451
        }
452
    }
453
}
454

    
455
static void ahci_check_cmd_bh(void *opaque)
456
{
457
    AHCIDevice *ad = opaque;
458

    
459
    qemu_bh_delete(ad->check_bh);
460
    ad->check_bh = NULL;
461

    
462
    if ((ad->busy_slot != -1) &&
463
        !(ad->port.ifs[0].status & (BUSY_STAT|DRQ_STAT))) {
464
        /* no longer busy */
465
        ad->port_regs.cmd_issue &= ~(1 << ad->busy_slot);
466
        ad->busy_slot = -1;
467
    }
468

    
469
    check_cmd(ad->hba, ad->port_no);
470
}
471

    
472
static void ahci_init_d2h(AHCIDevice *ad)
473
{
474
    uint8_t init_fis[0x20];
475
    IDEState *ide_state = &ad->port.ifs[0];
476

    
477
    memset(init_fis, 0, sizeof(init_fis));
478

    
479
    init_fis[4] = 1;
480
    init_fis[12] = 1;
481

    
482
    if (ide_state->drive_kind == IDE_CD) {
483
        init_fis[5] = ide_state->lcyl;
484
        init_fis[6] = ide_state->hcyl;
485
    }
486

    
487
    ahci_write_fis_d2h(ad, init_fis);
488
}
489

    
490
static void ahci_reset_port(AHCIState *s, int port)
491
{
492
    AHCIDevice *d = &s->dev[port];
493
    AHCIPortRegs *pr = &d->port_regs;
494
    IDEState *ide_state = &d->port.ifs[0];
495
    int i;
496

    
497
    DPRINTF(port, "reset port\n");
498

    
499
    ide_bus_reset(&d->port);
500
    ide_state->ncq_queues = AHCI_MAX_CMDS;
501

    
502
    pr->irq_stat = 0;
503
    pr->irq_mask = 0;
504
    pr->scr_stat = 0;
505
    pr->scr_ctl = 0;
506
    pr->scr_err = 0;
507
    pr->scr_act = 0;
508
    d->busy_slot = -1;
509
    d->init_d2h_sent = 0;
510

    
511
    ide_state = &s->dev[port].port.ifs[0];
512
    if (!ide_state->bs) {
513
        return;
514
    }
515

    
516
    /* reset ncq queue */
517
    for (i = 0; i < AHCI_MAX_CMDS; i++) {
518
        NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[i];
519
        if (!ncq_tfs->used) {
520
            continue;
521
        }
522

    
523
        if (ncq_tfs->aiocb) {
524
            bdrv_aio_cancel(ncq_tfs->aiocb);
525
            ncq_tfs->aiocb = NULL;
526
        }
527

    
528
        qemu_sglist_destroy(&ncq_tfs->sglist);
529
        ncq_tfs->used = 0;
530
    }
531

    
532
    s->dev[port].port_state = STATE_RUN;
533
    if (!ide_state->bs) {
534
        s->dev[port].port_regs.sig = 0;
535
        ide_state->status = SEEK_STAT | WRERR_STAT;
536
    } else if (ide_state->drive_kind == IDE_CD) {
537
        s->dev[port].port_regs.sig = SATA_SIGNATURE_CDROM;
538
        ide_state->lcyl = 0x14;
539
        ide_state->hcyl = 0xeb;
540
        DPRINTF(port, "set lcyl = %d\n", ide_state->lcyl);
541
        ide_state->status = SEEK_STAT | WRERR_STAT | READY_STAT;
542
    } else {
543
        s->dev[port].port_regs.sig = SATA_SIGNATURE_DISK;
544
        ide_state->status = SEEK_STAT | WRERR_STAT;
545
    }
546

    
547
    ide_state->error = 1;
548
    ahci_init_d2h(d);
549
}
550

    
551
static void debug_print_fis(uint8_t *fis, int cmd_len)
552
{
553
#ifdef DEBUG_AHCI
554
    int i;
555

    
556
    fprintf(stderr, "fis:");
557
    for (i = 0; i < cmd_len; i++) {
558
        if ((i & 0xf) == 0) {
559
            fprintf(stderr, "\n%02x:",i);
560
        }
561
        fprintf(stderr, "%02x ",fis[i]);
562
    }
563
    fprintf(stderr, "\n");
564
#endif
565
}
566

    
567
static void ahci_write_fis_sdb(AHCIState *s, int port, uint32_t finished)
568
{
569
    AHCIPortRegs *pr = &s->dev[port].port_regs;
570
    IDEState *ide_state;
571
    uint8_t *sdb_fis;
572

    
573
    if (!s->dev[port].res_fis ||
574
        !(pr->cmd & PORT_CMD_FIS_RX)) {
575
        return;
576
    }
577

    
578
    sdb_fis = &s->dev[port].res_fis[RES_FIS_SDBFIS];
579
    ide_state = &s->dev[port].port.ifs[0];
580

    
581
    /* clear memory */
582
    *(uint32_t*)sdb_fis = 0;
583

    
584
    /* write values */
585
    sdb_fis[0] = ide_state->error;
586
    sdb_fis[2] = ide_state->status & 0x77;
587
    s->dev[port].finished |= finished;
588
    *(uint32_t*)(sdb_fis + 4) = cpu_to_le32(s->dev[port].finished);
589

    
590
    ahci_trigger_irq(s, &s->dev[port], PORT_IRQ_STAT_SDBS);
591
}
592

    
593
static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis)
594
{
595
    AHCIPortRegs *pr = &ad->port_regs;
596
    uint8_t *d2h_fis;
597
    int i;
598
    target_phys_addr_t cmd_len = 0x80;
599
    int cmd_mapped = 0;
600

    
601
    if (!ad->res_fis || !(pr->cmd & PORT_CMD_FIS_RX)) {
602
        return;
603
    }
604

    
605
    if (!cmd_fis) {
606
        /* map cmd_fis */
607
        uint64_t tbl_addr = le64_to_cpu(ad->cur_cmd->tbl_addr);
608
        cmd_fis = cpu_physical_memory_map(tbl_addr, &cmd_len, 0);
609
        cmd_mapped = 1;
610
    }
611

    
612
    d2h_fis = &ad->res_fis[RES_FIS_RFIS];
613

    
614
    d2h_fis[0] = 0x34;
615
    d2h_fis[1] = (ad->hba->control_regs.irqstatus ? (1 << 6) : 0);
616
    d2h_fis[2] = ad->port.ifs[0].status;
617
    d2h_fis[3] = ad->port.ifs[0].error;
618

    
619
    d2h_fis[4] = cmd_fis[4];
620
    d2h_fis[5] = cmd_fis[5];
621
    d2h_fis[6] = cmd_fis[6];
622
    d2h_fis[7] = cmd_fis[7];
623
    d2h_fis[8] = cmd_fis[8];
624
    d2h_fis[9] = cmd_fis[9];
625
    d2h_fis[10] = cmd_fis[10];
626
    d2h_fis[11] = cmd_fis[11];
627
    d2h_fis[12] = cmd_fis[12];
628
    d2h_fis[13] = cmd_fis[13];
629
    for (i = 14; i < 0x20; i++) {
630
        d2h_fis[i] = 0;
631
    }
632

    
633
    if (d2h_fis[2] & ERR_STAT) {
634
        ahci_trigger_irq(ad->hba, ad, PORT_IRQ_STAT_TFES);
635
    }
636

    
637
    ahci_trigger_irq(ad->hba, ad, PORT_IRQ_D2H_REG_FIS);
638

    
639
    if (cmd_mapped) {
640
        cpu_physical_memory_unmap(cmd_fis, cmd_len, 0, cmd_len);
641
    }
642
}
643

    
644
static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist)
645
{
646
    AHCICmdHdr *cmd = ad->cur_cmd;
647
    uint32_t opts = le32_to_cpu(cmd->opts);
648
    uint64_t prdt_addr = le64_to_cpu(cmd->tbl_addr) + 0x80;
649
    int sglist_alloc_hint = opts >> AHCI_CMD_HDR_PRDT_LEN;
650
    target_phys_addr_t prdt_len = (sglist_alloc_hint * sizeof(AHCI_SG));
651
    target_phys_addr_t real_prdt_len = prdt_len;
652
    uint8_t *prdt;
653
    int i;
654
    int r = 0;
655

    
656
    if (!sglist_alloc_hint) {
657
        DPRINTF(ad->port_no, "no sg list given by guest: 0x%08x\n", opts);
658
        return -1;
659
    }
660

    
661
    /* map PRDT */
662
    if (!(prdt = cpu_physical_memory_map(prdt_addr, &prdt_len, 0))){
663
        DPRINTF(ad->port_no, "map failed\n");
664
        return -1;
665
    }
666

    
667
    if (prdt_len < real_prdt_len) {
668
        DPRINTF(ad->port_no, "mapped less than expected\n");
669
        r = -1;
670
        goto out;
671
    }
672

    
673
    /* Get entries in the PRDT, init a qemu sglist accordingly */
674
    if (sglist_alloc_hint > 0) {
675
        AHCI_SG *tbl = (AHCI_SG *)prdt;
676

    
677
        qemu_sglist_init(sglist, sglist_alloc_hint);
678
        for (i = 0; i < sglist_alloc_hint; i++) {
679
            /* flags_size is zero-based */
680
            qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
681
                            le32_to_cpu(tbl[i].flags_size) + 1);
682
        }
683
    }
684

    
685
out:
686
    cpu_physical_memory_unmap(prdt, prdt_len, 0, prdt_len);
687
    return r;
688
}
689

    
690
static void ncq_cb(void *opaque, int ret)
691
{
692
    NCQTransferState *ncq_tfs = (NCQTransferState *)opaque;
693
    IDEState *ide_state = &ncq_tfs->drive->port.ifs[0];
694

    
695
    /* Clear bit for this tag in SActive */
696
    ncq_tfs->drive->port_regs.scr_act &= ~(1 << ncq_tfs->tag);
697

    
698
    if (ret < 0) {
699
        /* error */
700
        ide_state->error = ABRT_ERR;
701
        ide_state->status = READY_STAT | ERR_STAT;
702
        ncq_tfs->drive->port_regs.scr_err |= (1 << ncq_tfs->tag);
703
    } else {
704
        ide_state->status = READY_STAT | SEEK_STAT;
705
    }
706

    
707
    ahci_write_fis_sdb(ncq_tfs->drive->hba, ncq_tfs->drive->port_no,
708
                       (1 << ncq_tfs->tag));
709

    
710
    DPRINTF(ncq_tfs->drive->port_no, "NCQ transfer tag %d finished\n",
711
            ncq_tfs->tag);
712

    
713
    bdrv_acct_done(ncq_tfs->drive->port.ifs[0].bs, &ncq_tfs->acct);
714
    qemu_sglist_destroy(&ncq_tfs->sglist);
715
    ncq_tfs->used = 0;
716
}
717

    
718
static void process_ncq_command(AHCIState *s, int port, uint8_t *cmd_fis,
719
                                int slot)
720
{
721
    NCQFrame *ncq_fis = (NCQFrame*)cmd_fis;
722
    uint8_t tag = ncq_fis->tag >> 3;
723
    NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[tag];
724

    
725
    if (ncq_tfs->used) {
726
        /* error - already in use */
727
        fprintf(stderr, "%s: tag %d already used\n", __FUNCTION__, tag);
728
        return;
729
    }
730

    
731
    ncq_tfs->used = 1;
732
    ncq_tfs->drive = &s->dev[port];
733
    ncq_tfs->slot = slot;
734
    ncq_tfs->lba = ((uint64_t)ncq_fis->lba5 << 40) |
735
                   ((uint64_t)ncq_fis->lba4 << 32) |
736
                   ((uint64_t)ncq_fis->lba3 << 24) |
737
                   ((uint64_t)ncq_fis->lba2 << 16) |
738
                   ((uint64_t)ncq_fis->lba1 << 8) |
739
                   (uint64_t)ncq_fis->lba0;
740

    
741
    /* Note: We calculate the sector count, but don't currently rely on it.
742
     * The total size of the DMA buffer tells us the transfer size instead. */
743
    ncq_tfs->sector_count = ((uint16_t)ncq_fis->sector_count_high << 8) |
744
                                ncq_fis->sector_count_low;
745

    
746
    DPRINTF(port, "NCQ transfer LBA from %ld to %ld, drive max %ld\n",
747
            ncq_tfs->lba, ncq_tfs->lba + ncq_tfs->sector_count - 2,
748
            s->dev[port].port.ifs[0].nb_sectors - 1);
749

    
750
    ahci_populate_sglist(&s->dev[port], &ncq_tfs->sglist);
751
    ncq_tfs->tag = tag;
752

    
753
    switch(ncq_fis->command) {
754
        case READ_FPDMA_QUEUED:
755
            DPRINTF(port, "NCQ reading %d sectors from LBA %ld, tag %d\n",
756
                    ncq_tfs->sector_count-1, ncq_tfs->lba, ncq_tfs->tag);
757
            ncq_tfs->is_read = 1;
758

    
759
            DPRINTF(port, "tag %d aio read %ld\n", ncq_tfs->tag, ncq_tfs->lba);
760

    
761
            bdrv_acct_start(ncq_tfs->drive->port.ifs[0].bs, &ncq_tfs->acct,
762
                            (ncq_tfs->sector_count-1) * BDRV_SECTOR_SIZE,
763
                            BDRV_ACCT_READ);
764
            ncq_tfs->aiocb = dma_bdrv_read(ncq_tfs->drive->port.ifs[0].bs,
765
                                           &ncq_tfs->sglist, ncq_tfs->lba,
766
                                           ncq_cb, ncq_tfs);
767
            break;
768
        case WRITE_FPDMA_QUEUED:
769
            DPRINTF(port, "NCQ writing %d sectors to LBA %ld, tag %d\n",
770
                    ncq_tfs->sector_count-1, ncq_tfs->lba, ncq_tfs->tag);
771
            ncq_tfs->is_read = 0;
772

    
773
            DPRINTF(port, "tag %d aio write %ld\n", ncq_tfs->tag, ncq_tfs->lba);
774

    
775
            bdrv_acct_start(ncq_tfs->drive->port.ifs[0].bs, &ncq_tfs->acct,
776
                            (ncq_tfs->sector_count-1) * BDRV_SECTOR_SIZE,
777
                            BDRV_ACCT_WRITE);
778
            ncq_tfs->aiocb = dma_bdrv_write(ncq_tfs->drive->port.ifs[0].bs,
779
                                            &ncq_tfs->sglist, ncq_tfs->lba,
780
                                            ncq_cb, ncq_tfs);
781
            break;
782
        default:
783
            DPRINTF(port, "error: tried to process non-NCQ command as NCQ\n");
784
            qemu_sglist_destroy(&ncq_tfs->sglist);
785
            break;
786
    }
787
}
788

    
789
static int handle_cmd(AHCIState *s, int port, int slot)
790
{
791
    IDEState *ide_state;
792
    uint32_t opts;
793
    uint64_t tbl_addr;
794
    AHCICmdHdr *cmd;
795
    uint8_t *cmd_fis;
796
    target_phys_addr_t cmd_len;
797

    
798
    if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) {
799
        /* Engine currently busy, try again later */
800
        DPRINTF(port, "engine busy\n");
801
        return -1;
802
    }
803

    
804
    cmd = &((AHCICmdHdr *)s->dev[port].lst)[slot];
805

    
806
    if (!s->dev[port].lst) {
807
        DPRINTF(port, "error: lst not given but cmd handled");
808
        return -1;
809
    }
810

    
811
    /* remember current slot handle for later */
812
    s->dev[port].cur_cmd = cmd;
813

    
814
    opts = le32_to_cpu(cmd->opts);
815
    tbl_addr = le64_to_cpu(cmd->tbl_addr);
816

    
817
    cmd_len = 0x80;
818
    cmd_fis = cpu_physical_memory_map(tbl_addr, &cmd_len, 1);
819

    
820
    if (!cmd_fis) {
821
        DPRINTF(port, "error: guest passed us an invalid cmd fis\n");
822
        return -1;
823
    }
824

    
825
    /* The device we are working for */
826
    ide_state = &s->dev[port].port.ifs[0];
827

    
828
    if (!ide_state->bs) {
829
        DPRINTF(port, "error: guest accessed unused port");
830
        goto out;
831
    }
832

    
833
    debug_print_fis(cmd_fis, 0x90);
834
    //debug_print_fis(cmd_fis, (opts & AHCI_CMD_HDR_CMD_FIS_LEN) * 4);
835

    
836
    switch (cmd_fis[0]) {
837
        case SATA_FIS_TYPE_REGISTER_H2D:
838
            break;
839
        default:
840
            DPRINTF(port, "unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "
841
                          "cmd_fis[2]=%02x\n", cmd_fis[0], cmd_fis[1],
842
                          cmd_fis[2]);
843
            goto out;
844
            break;
845
    }
846

    
847
    switch (cmd_fis[1]) {
848
        case SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER:
849
            break;
850
        case 0:
851
            break;
852
        default:
853
            DPRINTF(port, "unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "
854
                          "cmd_fis[2]=%02x\n", cmd_fis[0], cmd_fis[1],
855
                          cmd_fis[2]);
856
            goto out;
857
            break;
858
    }
859

    
860
    switch (s->dev[port].port_state) {
861
        case STATE_RUN:
862
            if (cmd_fis[15] & ATA_SRST) {
863
                s->dev[port].port_state = STATE_RESET;
864
            }
865
            break;
866
        case STATE_RESET:
867
            if (!(cmd_fis[15] & ATA_SRST)) {
868
                ahci_reset_port(s, port);
869
            }
870
            break;
871
    }
872

    
873
    if (cmd_fis[1] == SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER) {
874

    
875
        /* Check for NCQ command */
876
        if ((cmd_fis[2] == READ_FPDMA_QUEUED) ||
877
            (cmd_fis[2] == WRITE_FPDMA_QUEUED)) {
878
            process_ncq_command(s, port, cmd_fis, slot);
879
            goto out;
880
        }
881

    
882
        /* Decompose the FIS  */
883
        ide_state->nsector = (int64_t)((cmd_fis[13] << 8) | cmd_fis[12]);
884
        ide_state->feature = cmd_fis[3];
885
        if (!ide_state->nsector) {
886
            ide_state->nsector = 256;
887
        }
888

    
889
        if (ide_state->drive_kind != IDE_CD) {
890
            /*
891
             * We set the sector depending on the sector defined in the FIS.
892
             * Unfortunately, the spec isn't exactly obvious on this one.
893
             *
894
             * Apparently LBA48 commands set fis bytes 10,9,8,6,5,4 to the
895
             * 48 bit sector number. ATA_CMD_READ_DMA_EXT is an example for
896
             * such a command.
897
             *
898
             * Non-LBA48 commands however use 7[lower 4 bits],6,5,4 to define a
899
             * 28-bit sector number. ATA_CMD_READ_DMA is an example for such
900
             * a command.
901
             *
902
             * Since the spec doesn't explicitly state what each field should
903
             * do, I simply assume non-used fields as reserved and OR everything
904
             * together, independent of the command.
905
             */
906
            ide_set_sector(ide_state, ((uint64_t)cmd_fis[10] << 40)
907
                                    | ((uint64_t)cmd_fis[9] << 32)
908
                                    /* This is used for LBA48 commands */
909
                                    | ((uint64_t)cmd_fis[8] << 24)
910
                                    /* This is used for non-LBA48 commands */
911
                                    | ((uint64_t)(cmd_fis[7] & 0xf) << 24)
912
                                    | ((uint64_t)cmd_fis[6] << 16)
913
                                    | ((uint64_t)cmd_fis[5] << 8)
914
                                    | cmd_fis[4]);
915
        }
916

    
917
        /* Copy the ACMD field (ATAPI packet, if any) from the AHCI command
918
         * table to ide_state->io_buffer
919
         */
920
        if (opts & AHCI_CMD_ATAPI) {
921
            memcpy(ide_state->io_buffer, &cmd_fis[AHCI_COMMAND_TABLE_ACMD], 0x10);
922
            ide_state->lcyl = 0x14;
923
            ide_state->hcyl = 0xeb;
924
            debug_print_fis(ide_state->io_buffer, 0x10);
925
            ide_state->feature = IDE_FEATURE_DMA;
926
            s->dev[port].done_atapi_packet = 0;
927
            /* XXX send PIO setup FIS */
928
        }
929

    
930
        ide_state->error = 0;
931

    
932
        /* Reset transferred byte counter */
933
        cmd->status = 0;
934

    
935
        /* We're ready to process the command in FIS byte 2. */
936
        ide_exec_cmd(&s->dev[port].port, cmd_fis[2]);
937

    
938
        if (s->dev[port].port.ifs[0].status & READY_STAT) {
939
            ahci_write_fis_d2h(&s->dev[port], cmd_fis);
940
        }
941
    }
942

    
943
out:
944
    cpu_physical_memory_unmap(cmd_fis, cmd_len, 1, cmd_len);
945

    
946
    if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) {
947
        /* async command, complete later */
948
        s->dev[port].busy_slot = slot;
949
        return -1;
950
    }
951

    
952
    /* done handling the command */
953
    return 0;
954
}
955

    
956
/* DMA dev <-> ram */
957
static int ahci_start_transfer(IDEDMA *dma)
958
{
959
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
960
    IDEState *s = &ad->port.ifs[0];
961
    uint32_t size = (uint32_t)(s->data_end - s->data_ptr);
962
    /* write == ram -> device */
963
    uint32_t opts = le32_to_cpu(ad->cur_cmd->opts);
964
    int is_write = opts & AHCI_CMD_WRITE;
965
    int is_atapi = opts & AHCI_CMD_ATAPI;
966
    int has_sglist = 0;
967

    
968
    if (is_atapi && !ad->done_atapi_packet) {
969
        /* already prepopulated iobuffer */
970
        ad->done_atapi_packet = 1;
971
        goto out;
972
    }
973

    
974
    if (!ahci_populate_sglist(ad, &s->sg)) {
975
        has_sglist = 1;
976
    }
977

    
978
    DPRINTF(ad->port_no, "%sing %d bytes on %s w/%s sglist\n",
979
            is_write ? "writ" : "read", size, is_atapi ? "atapi" : "ata",
980
            has_sglist ? "" : "o");
981

    
982
    if (is_write && has_sglist && (s->data_ptr < s->data_end)) {
983
        read_from_sglist(s->data_ptr, size, &s->sg);
984
    }
985

    
986
    if (!is_write && has_sglist && (s->data_ptr < s->data_end)) {
987
        write_to_sglist(s->data_ptr, size, &s->sg);
988
    }
989

    
990
    /* update number of transferred bytes */
991
    ad->cur_cmd->status = cpu_to_le32(le32_to_cpu(ad->cur_cmd->status) + size);
992

    
993
out:
994
    /* declare that we processed everything */
995
    s->data_ptr = s->data_end;
996

    
997
    if (has_sglist) {
998
        qemu_sglist_destroy(&s->sg);
999
    }
1000

    
1001
    s->end_transfer_func(s);
1002

    
1003
    if (!(s->status & DRQ_STAT)) {
1004
        /* done with DMA */
1005
        ahci_trigger_irq(ad->hba, ad, PORT_IRQ_STAT_DSS);
1006
    }
1007

    
1008
    return 0;
1009
}
1010

    
1011
static void ahci_start_dma(IDEDMA *dma, IDEState *s,
1012
                           BlockDriverCompletionFunc *dma_cb)
1013
{
1014
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1015

    
1016
    DPRINTF(ad->port_no, "\n");
1017
    ad->dma_cb = dma_cb;
1018
    ad->dma_status |= BM_STATUS_DMAING;
1019
    dma_cb(s, 0);
1020
}
1021

    
1022
static int ahci_dma_prepare_buf(IDEDMA *dma, int is_write)
1023
{
1024
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1025
    IDEState *s = &ad->port.ifs[0];
1026
    int i;
1027

    
1028
    ahci_populate_sglist(ad, &s->sg);
1029

    
1030
    s->io_buffer_size = 0;
1031
    for (i = 0; i < s->sg.nsg; i++) {
1032
        s->io_buffer_size += s->sg.sg[i].len;
1033
    }
1034

    
1035
    DPRINTF(ad->port_no, "len=%#x\n", s->io_buffer_size);
1036
    return s->io_buffer_size != 0;
1037
}
1038

    
1039
static int ahci_dma_rw_buf(IDEDMA *dma, int is_write)
1040
{
1041
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1042
    IDEState *s = &ad->port.ifs[0];
1043
    uint8_t *p = s->io_buffer + s->io_buffer_index;
1044
    int l = s->io_buffer_size - s->io_buffer_index;
1045

    
1046
    if (ahci_populate_sglist(ad, &s->sg)) {
1047
        return 0;
1048
    }
1049

    
1050
    if (is_write) {
1051
        write_to_sglist(p, l, &s->sg);
1052
    } else {
1053
        read_from_sglist(p, l, &s->sg);
1054
    }
1055

    
1056
    /* update number of transferred bytes */
1057
    ad->cur_cmd->status = cpu_to_le32(le32_to_cpu(ad->cur_cmd->status) + l);
1058
    s->io_buffer_index += l;
1059

    
1060
    DPRINTF(ad->port_no, "len=%#x\n", l);
1061

    
1062
    return 1;
1063
}
1064

    
1065
static int ahci_dma_set_unit(IDEDMA *dma, int unit)
1066
{
1067
    /* only a single unit per link */
1068
    return 0;
1069
}
1070

    
1071
static int ahci_dma_add_status(IDEDMA *dma, int status)
1072
{
1073
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1074
    ad->dma_status |= status;
1075
    DPRINTF(ad->port_no, "set status: %x\n", status);
1076

    
1077
    if (status & BM_STATUS_INT) {
1078
        ahci_trigger_irq(ad->hba, ad, PORT_IRQ_STAT_DSS);
1079
    }
1080

    
1081
    return 0;
1082
}
1083

    
1084
static int ahci_dma_set_inactive(IDEDMA *dma)
1085
{
1086
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1087

    
1088
    DPRINTF(ad->port_no, "dma done\n");
1089

    
1090
    /* update d2h status */
1091
    ahci_write_fis_d2h(ad, NULL);
1092

    
1093
    ad->dma_cb = NULL;
1094

    
1095
    if (!ad->check_bh) {
1096
        /* maybe we still have something to process, check later */
1097
        ad->check_bh = qemu_bh_new(ahci_check_cmd_bh, ad);
1098
        qemu_bh_schedule(ad->check_bh);
1099
    }
1100

    
1101
    return 0;
1102
}
1103

    
1104
static void ahci_irq_set(void *opaque, int n, int level)
1105
{
1106
}
1107

    
1108
static void ahci_dma_restart_cb(void *opaque, int running, int reason)
1109
{
1110
}
1111

    
1112
static int ahci_dma_reset(IDEDMA *dma)
1113
{
1114
    return 0;
1115
}
1116

    
1117
static const IDEDMAOps ahci_dma_ops = {
1118
    .start_dma = ahci_start_dma,
1119
    .start_transfer = ahci_start_transfer,
1120
    .prepare_buf = ahci_dma_prepare_buf,
1121
    .rw_buf = ahci_dma_rw_buf,
1122
    .set_unit = ahci_dma_set_unit,
1123
    .add_status = ahci_dma_add_status,
1124
    .set_inactive = ahci_dma_set_inactive,
1125
    .restart_cb = ahci_dma_restart_cb,
1126
    .reset = ahci_dma_reset,
1127
};
1128

    
1129
void ahci_init(AHCIState *s, DeviceState *qdev, int ports)
1130
{
1131
    qemu_irq *irqs;
1132
    int i;
1133

    
1134
    s->ports = ports;
1135
    s->dev = g_malloc0(sizeof(AHCIDevice) * ports);
1136
    ahci_reg_init(s);
1137
    /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
1138
    memory_region_init_io(&s->mem, &ahci_mem_ops, s, "ahci", 0x1000);
1139
    irqs = qemu_allocate_irqs(ahci_irq_set, s, s->ports);
1140

    
1141
    for (i = 0; i < s->ports; i++) {
1142
        AHCIDevice *ad = &s->dev[i];
1143

    
1144
        ide_bus_new(&ad->port, qdev, i);
1145
        ide_init2(&ad->port, irqs[i]);
1146

    
1147
        ad->hba = s;
1148
        ad->port_no = i;
1149
        ad->port.dma = &ad->dma;
1150
        ad->port.dma->ops = &ahci_dma_ops;
1151
        ad->port_regs.cmd = PORT_CMD_SPIN_UP | PORT_CMD_POWER_ON;
1152
    }
1153
}
1154

    
1155
void ahci_uninit(AHCIState *s)
1156
{
1157
    memory_region_destroy(&s->mem);
1158
    g_free(s->dev);
1159
}
1160

    
1161
void ahci_reset(void *opaque)
1162
{
1163
    struct AHCIPCIState *d = opaque;
1164
    int i;
1165

    
1166
    d->ahci.control_regs.irqstatus = 0;
1167
    d->ahci.control_regs.ghc = 0;
1168

    
1169
    for (i = 0; i < d->ahci.ports; i++) {
1170
        ahci_reset_port(&d->ahci, i);
1171
    }
1172
}