Statistics
| Branch: | Revision:

root / hw / ide / ahci.c @ 7267c094

History | View | Annotate | Download (32.6 kB)

1
/*
2
 * QEMU AHCI Emulation
3
 *
4
 * Copyright (c) 2010 qiaochong@loongson.cn
5
 * Copyright (c) 2010 Roland Elek <elek.roland@gmail.com>
6
 * Copyright (c) 2010 Sebastian Herbszt <herbszt@gmx.de>
7
 * Copyright (c) 2010 Alexander Graf <agraf@suse.de>
8
 *
9
 * This library is free software; you can redistribute it and/or
10
 * modify it under the terms of the GNU Lesser General Public
11
 * License as published by the Free Software Foundation; either
12
 * version 2 of the License, or (at your option) any later version.
13
 *
14
 * This library is distributed in the hope that it will be useful,
15
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
17
 * Lesser General Public License for more details.
18
 *
19
 * You should have received a copy of the GNU Lesser General Public
20
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21
 *
22
 */
23

    
24
#include <hw/hw.h>
25
#include <hw/msi.h>
26
#include <hw/pc.h>
27
#include <hw/pci.h>
28

    
29
#include "monitor.h"
30
#include "dma.h"
31
#include "cpu-common.h"
32
#include "internal.h"
33
#include <hw/ide/pci.h>
34
#include <hw/ide/ahci.h>
35

    
36
/* #define DEBUG_AHCI */
37

    
38
#ifdef DEBUG_AHCI
39
#define DPRINTF(port, fmt, ...) \
40
do { fprintf(stderr, "ahci: %s: [%d] ", __FUNCTION__, port); \
41
     fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
42
#else
43
#define DPRINTF(port, fmt, ...) do {} while(0)
44
#endif
45

    
46
static void check_cmd(AHCIState *s, int port);
47
static int handle_cmd(AHCIState *s,int port,int slot);
48
static void ahci_reset_port(AHCIState *s, int port);
49
static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis);
50
static void ahci_init_d2h(AHCIDevice *ad);
51

    
52
static uint32_t  ahci_port_read(AHCIState *s, int port, int offset)
53
{
54
    uint32_t val;
55
    AHCIPortRegs *pr;
56
    pr = &s->dev[port].port_regs;
57

    
58
    switch (offset) {
59
    case PORT_LST_ADDR:
60
        val = pr->lst_addr;
61
        break;
62
    case PORT_LST_ADDR_HI:
63
        val = pr->lst_addr_hi;
64
        break;
65
    case PORT_FIS_ADDR:
66
        val = pr->fis_addr;
67
        break;
68
    case PORT_FIS_ADDR_HI:
69
        val = pr->fis_addr_hi;
70
        break;
71
    case PORT_IRQ_STAT:
72
        val = pr->irq_stat;
73
        break;
74
    case PORT_IRQ_MASK:
75
        val = pr->irq_mask;
76
        break;
77
    case PORT_CMD:
78
        val = pr->cmd;
79
        break;
80
    case PORT_TFDATA:
81
        val = ((uint16_t)s->dev[port].port.ifs[0].error << 8) |
82
              s->dev[port].port.ifs[0].status;
83
        break;
84
    case PORT_SIG:
85
        val = pr->sig;
86
        break;
87
    case PORT_SCR_STAT:
88
        if (s->dev[port].port.ifs[0].bs) {
89
            val = SATA_SCR_SSTATUS_DET_DEV_PRESENT_PHY_UP |
90
                  SATA_SCR_SSTATUS_SPD_GEN1 | SATA_SCR_SSTATUS_IPM_ACTIVE;
91
        } else {
92
            val = SATA_SCR_SSTATUS_DET_NODEV;
93
        }
94
        break;
95
    case PORT_SCR_CTL:
96
        val = pr->scr_ctl;
97
        break;
98
    case PORT_SCR_ERR:
99
        val = pr->scr_err;
100
        break;
101
    case PORT_SCR_ACT:
102
        pr->scr_act &= ~s->dev[port].finished;
103
        s->dev[port].finished = 0;
104
        val = pr->scr_act;
105
        break;
106
    case PORT_CMD_ISSUE:
107
        val = pr->cmd_issue;
108
        break;
109
    case PORT_RESERVED:
110
    default:
111
        val = 0;
112
    }
113
    DPRINTF(port, "offset: 0x%x val: 0x%x\n", offset, val);
114
    return val;
115

    
116
}
117

    
118
static void ahci_irq_raise(AHCIState *s, AHCIDevice *dev)
119
{
120
    struct AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
121

    
122
    DPRINTF(0, "raise irq\n");
123

    
124
    if (msi_enabled(&d->card)) {
125
        msi_notify(&d->card, 0);
126
    } else {
127
        qemu_irq_raise(s->irq);
128
    }
129
}
130

    
131
static void ahci_irq_lower(AHCIState *s, AHCIDevice *dev)
132
{
133
    struct AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
134

    
135
    DPRINTF(0, "lower irq\n");
136

    
137
    if (!msi_enabled(&d->card)) {
138
        qemu_irq_lower(s->irq);
139
    }
140
}
141

    
142
static void ahci_check_irq(AHCIState *s)
143
{
144
    int i;
145

    
146
    DPRINTF(-1, "check irq %#x\n", s->control_regs.irqstatus);
147

    
148
    for (i = 0; i < s->ports; i++) {
149
        AHCIPortRegs *pr = &s->dev[i].port_regs;
150
        if (pr->irq_stat & pr->irq_mask) {
151
            s->control_regs.irqstatus |= (1 << i);
152
        }
153
    }
154

    
155
    if (s->control_regs.irqstatus &&
156
        (s->control_regs.ghc & HOST_CTL_IRQ_EN)) {
157
            ahci_irq_raise(s, NULL);
158
    } else {
159
        ahci_irq_lower(s, NULL);
160
    }
161
}
162

    
163
static void ahci_trigger_irq(AHCIState *s, AHCIDevice *d,
164
                             int irq_type)
165
{
166
    DPRINTF(d->port_no, "trigger irq %#x -> %x\n",
167
            irq_type, d->port_regs.irq_mask & irq_type);
168

    
169
    d->port_regs.irq_stat |= irq_type;
170
    ahci_check_irq(s);
171
}
172

    
173
static void map_page(uint8_t **ptr, uint64_t addr, uint32_t wanted)
174
{
175
    target_phys_addr_t len = wanted;
176

    
177
    if (*ptr) {
178
        cpu_physical_memory_unmap(*ptr, len, 1, len);
179
    }
180

    
181
    *ptr = cpu_physical_memory_map(addr, &len, 1);
182
    if (len < wanted) {
183
        cpu_physical_memory_unmap(*ptr, len, 1, len);
184
        *ptr = NULL;
185
    }
186
}
187

    
188
static void  ahci_port_write(AHCIState *s, int port, int offset, uint32_t val)
189
{
190
    AHCIPortRegs *pr = &s->dev[port].port_regs;
191

    
192
    DPRINTF(port, "offset: 0x%x val: 0x%x\n", offset, val);
193
    switch (offset) {
194
        case PORT_LST_ADDR:
195
            pr->lst_addr = val;
196
            map_page(&s->dev[port].lst,
197
                     ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
198
            s->dev[port].cur_cmd = NULL;
199
            break;
200
        case PORT_LST_ADDR_HI:
201
            pr->lst_addr_hi = val;
202
            map_page(&s->dev[port].lst,
203
                     ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
204
            s->dev[port].cur_cmd = NULL;
205
            break;
206
        case PORT_FIS_ADDR:
207
            pr->fis_addr = val;
208
            map_page(&s->dev[port].res_fis,
209
                     ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
210
            break;
211
        case PORT_FIS_ADDR_HI:
212
            pr->fis_addr_hi = val;
213
            map_page(&s->dev[port].res_fis,
214
                     ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
215
            break;
216
        case PORT_IRQ_STAT:
217
            pr->irq_stat &= ~val;
218
            break;
219
        case PORT_IRQ_MASK:
220
            pr->irq_mask = val & 0xfdc000ff;
221
            ahci_check_irq(s);
222
            break;
223
        case PORT_CMD:
224
            pr->cmd = val & ~(PORT_CMD_LIST_ON | PORT_CMD_FIS_ON);
225

    
226
            if (pr->cmd & PORT_CMD_START) {
227
                pr->cmd |= PORT_CMD_LIST_ON;
228
            }
229

    
230
            if (pr->cmd & PORT_CMD_FIS_RX) {
231
                pr->cmd |= PORT_CMD_FIS_ON;
232
            }
233

    
234
            /* XXX usually the FIS would be pending on the bus here and
235
                   issuing deferred until the OS enables FIS receival.
236
                   Instead, we only submit it once - which works in most
237
                   cases, but is a hack. */
238
            if ((pr->cmd & PORT_CMD_FIS_ON) &&
239
                !s->dev[port].init_d2h_sent) {
240
                ahci_init_d2h(&s->dev[port]);
241
                s->dev[port].init_d2h_sent = 1;
242
            }
243

    
244
            check_cmd(s, port);
245
            break;
246
        case PORT_TFDATA:
247
            s->dev[port].port.ifs[0].error = (val >> 8) & 0xff;
248
            s->dev[port].port.ifs[0].status = val & 0xff;
249
            break;
250
        case PORT_SIG:
251
            pr->sig = val;
252
            break;
253
        case PORT_SCR_STAT:
254
            pr->scr_stat = val;
255
            break;
256
        case PORT_SCR_CTL:
257
            if (((pr->scr_ctl & AHCI_SCR_SCTL_DET) == 1) &&
258
                ((val & AHCI_SCR_SCTL_DET) == 0)) {
259
                ahci_reset_port(s, port);
260
            }
261
            pr->scr_ctl = val;
262
            break;
263
        case PORT_SCR_ERR:
264
            pr->scr_err &= ~val;
265
            break;
266
        case PORT_SCR_ACT:
267
            /* RW1 */
268
            pr->scr_act |= val;
269
            break;
270
        case PORT_CMD_ISSUE:
271
            pr->cmd_issue |= val;
272
            check_cmd(s, port);
273
            break;
274
        default:
275
            break;
276
    }
277
}
278

    
279
static uint64_t ahci_mem_read(void *opaque, target_phys_addr_t addr,
280
                              unsigned size)
281
{
282
    AHCIState *s = opaque;
283
    uint32_t val = 0;
284

    
285
    if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
286
        switch (addr) {
287
        case HOST_CAP:
288
            val = s->control_regs.cap;
289
            break;
290
        case HOST_CTL:
291
            val = s->control_regs.ghc;
292
            break;
293
        case HOST_IRQ_STAT:
294
            val = s->control_regs.irqstatus;
295
            break;
296
        case HOST_PORTS_IMPL:
297
            val = s->control_regs.impl;
298
            break;
299
        case HOST_VERSION:
300
            val = s->control_regs.version;
301
            break;
302
        }
303

    
304
        DPRINTF(-1, "(addr 0x%08X), val 0x%08X\n", (unsigned) addr, val);
305
    } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
306
               (addr < (AHCI_PORT_REGS_START_ADDR +
307
                (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
308
        val = ahci_port_read(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
309
                             addr & AHCI_PORT_ADDR_OFFSET_MASK);
310
    }
311

    
312
    return val;
313
}
314

    
315

    
316

    
317
static void ahci_mem_write(void *opaque, target_phys_addr_t addr,
318
                           uint64_t val, unsigned size)
319
{
320
    AHCIState *s = opaque;
321

    
322
    /* Only aligned reads are allowed on AHCI */
323
    if (addr & 3) {
324
        fprintf(stderr, "ahci: Mis-aligned write to addr 0x"
325
                TARGET_FMT_plx "\n", addr);
326
        return;
327
    }
328

    
329
    if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
330
        DPRINTF(-1, "(addr 0x%08X), val 0x%08X\n", (unsigned) addr, val);
331

    
332
        switch (addr) {
333
            case HOST_CAP: /* R/WO, RO */
334
                /* FIXME handle R/WO */
335
                break;
336
            case HOST_CTL: /* R/W */
337
                if (val & HOST_CTL_RESET) {
338
                    DPRINTF(-1, "HBA Reset\n");
339
                    ahci_reset(container_of(s, AHCIPCIState, ahci));
340
                } else {
341
                    s->control_regs.ghc = (val & 0x3) | HOST_CTL_AHCI_EN;
342
                    ahci_check_irq(s);
343
                }
344
                break;
345
            case HOST_IRQ_STAT: /* R/WC, RO */
346
                s->control_regs.irqstatus &= ~val;
347
                ahci_check_irq(s);
348
                break;
349
            case HOST_PORTS_IMPL: /* R/WO, RO */
350
                /* FIXME handle R/WO */
351
                break;
352
            case HOST_VERSION: /* RO */
353
                /* FIXME report write? */
354
                break;
355
            default:
356
                DPRINTF(-1, "write to unknown register 0x%x\n", (unsigned)addr);
357
        }
358
    } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
359
               (addr < (AHCI_PORT_REGS_START_ADDR +
360
                (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
361
        ahci_port_write(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
362
                        addr & AHCI_PORT_ADDR_OFFSET_MASK, val);
363
    }
364

    
365
}
366

    
367
static MemoryRegionOps ahci_mem_ops = {
368
    .read = ahci_mem_read,
369
    .write = ahci_mem_write,
370
    .endianness = DEVICE_LITTLE_ENDIAN,
371
};
372

    
373
static void ahci_reg_init(AHCIState *s)
374
{
375
    int i;
376

    
377
    s->control_regs.cap = (s->ports - 1) |
378
                          (AHCI_NUM_COMMAND_SLOTS << 8) |
379
                          (AHCI_SUPPORTED_SPEED_GEN1 << AHCI_SUPPORTED_SPEED) |
380
                          HOST_CAP_NCQ | HOST_CAP_AHCI;
381

    
382
    s->control_regs.impl = (1 << s->ports) - 1;
383

    
384
    s->control_regs.version = AHCI_VERSION_1_0;
385

    
386
    for (i = 0; i < s->ports; i++) {
387
        s->dev[i].port_state = STATE_RUN;
388
    }
389
}
390

    
391
static uint32_t read_from_sglist(uint8_t *buffer, uint32_t len,
392
                                 QEMUSGList *sglist)
393
{
394
    uint32_t i = 0;
395
    uint32_t total = 0, once;
396
    ScatterGatherEntry *cur_prd;
397
    uint32_t sgcount;
398

    
399
    cur_prd = sglist->sg;
400
    sgcount = sglist->nsg;
401
    for (i = 0; len && sgcount; i++) {
402
        once = MIN(cur_prd->len, len);
403
        cpu_physical_memory_read(cur_prd->base, buffer, once);
404
        cur_prd++;
405
        sgcount--;
406
        len -= once;
407
        buffer += once;
408
        total += once;
409
    }
410

    
411
    return total;
412
}
413

    
414
static uint32_t write_to_sglist(uint8_t *buffer, uint32_t len,
415
                                QEMUSGList *sglist)
416
{
417
    uint32_t i = 0;
418
    uint32_t total = 0, once;
419
    ScatterGatherEntry *cur_prd;
420
    uint32_t sgcount;
421

    
422
    DPRINTF(-1, "total: 0x%x bytes\n", len);
423

    
424
    cur_prd = sglist->sg;
425
    sgcount = sglist->nsg;
426
    for (i = 0; len && sgcount; i++) {
427
        once = MIN(cur_prd->len, len);
428
        DPRINTF(-1, "write 0x%x bytes to 0x%lx\n", once, (long)cur_prd->base);
429
        cpu_physical_memory_write(cur_prd->base, buffer, once);
430
        cur_prd++;
431
        sgcount--;
432
        len -= once;
433
        buffer += once;
434
        total += once;
435
    }
436

    
437
    return total;
438
}
439

    
440
static void check_cmd(AHCIState *s, int port)
441
{
442
    AHCIPortRegs *pr = &s->dev[port].port_regs;
443
    int slot;
444

    
445
    if ((pr->cmd & PORT_CMD_START) && pr->cmd_issue) {
446
        for (slot = 0; (slot < 32) && pr->cmd_issue; slot++) {
447
            if ((pr->cmd_issue & (1 << slot)) &&
448
                !handle_cmd(s, port, slot)) {
449
                pr->cmd_issue &= ~(1 << slot);
450
            }
451
        }
452
    }
453
}
454

    
455
static void ahci_check_cmd_bh(void *opaque)
456
{
457
    AHCIDevice *ad = opaque;
458

    
459
    qemu_bh_delete(ad->check_bh);
460
    ad->check_bh = NULL;
461

    
462
    if ((ad->busy_slot != -1) &&
463
        !(ad->port.ifs[0].status & (BUSY_STAT|DRQ_STAT))) {
464
        /* no longer busy */
465
        ad->port_regs.cmd_issue &= ~(1 << ad->busy_slot);
466
        ad->busy_slot = -1;
467
    }
468

    
469
    check_cmd(ad->hba, ad->port_no);
470
}
471

    
472
static void ahci_init_d2h(AHCIDevice *ad)
473
{
474
    uint8_t init_fis[0x20];
475
    IDEState *ide_state = &ad->port.ifs[0];
476

    
477
    memset(init_fis, 0, sizeof(init_fis));
478

    
479
    init_fis[4] = 1;
480
    init_fis[12] = 1;
481

    
482
    if (ide_state->drive_kind == IDE_CD) {
483
        init_fis[5] = ide_state->lcyl;
484
        init_fis[6] = ide_state->hcyl;
485
    }
486

    
487
    ahci_write_fis_d2h(ad, init_fis);
488
}
489

    
490
static void ahci_reset_port(AHCIState *s, int port)
491
{
492
    AHCIDevice *d = &s->dev[port];
493
    AHCIPortRegs *pr = &d->port_regs;
494
    IDEState *ide_state = &d->port.ifs[0];
495
    int i;
496

    
497
    DPRINTF(port, "reset port\n");
498

    
499
    ide_bus_reset(&d->port);
500
    ide_state->ncq_queues = AHCI_MAX_CMDS;
501

    
502
    pr->irq_stat = 0;
503
    pr->irq_mask = 0;
504
    pr->scr_stat = 0;
505
    pr->scr_ctl = 0;
506
    pr->scr_err = 0;
507
    pr->scr_act = 0;
508
    d->busy_slot = -1;
509
    d->init_d2h_sent = 0;
510

    
511
    ide_state = &s->dev[port].port.ifs[0];
512
    if (!ide_state->bs) {
513
        return;
514
    }
515

    
516
    /* reset ncq queue */
517
    for (i = 0; i < AHCI_MAX_CMDS; i++) {
518
        NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[i];
519
        if (!ncq_tfs->used) {
520
            continue;
521
        }
522

    
523
        if (ncq_tfs->aiocb) {
524
            bdrv_aio_cancel(ncq_tfs->aiocb);
525
            ncq_tfs->aiocb = NULL;
526
        }
527

    
528
        qemu_sglist_destroy(&ncq_tfs->sglist);
529
        ncq_tfs->used = 0;
530
    }
531

    
532
    s->dev[port].port_state = STATE_RUN;
533
    if (!ide_state->bs) {
534
        s->dev[port].port_regs.sig = 0;
535
        ide_state->status = SEEK_STAT | WRERR_STAT;
536
    } else if (ide_state->drive_kind == IDE_CD) {
537
        s->dev[port].port_regs.sig = SATA_SIGNATURE_CDROM;
538
        ide_state->lcyl = 0x14;
539
        ide_state->hcyl = 0xeb;
540
        DPRINTF(port, "set lcyl = %d\n", ide_state->lcyl);
541
        ide_state->status = SEEK_STAT | WRERR_STAT | READY_STAT;
542
    } else {
543
        s->dev[port].port_regs.sig = SATA_SIGNATURE_DISK;
544
        ide_state->status = SEEK_STAT | WRERR_STAT;
545
    }
546

    
547
    ide_state->error = 1;
548
    ahci_init_d2h(d);
549
}
550

    
551
static void debug_print_fis(uint8_t *fis, int cmd_len)
552
{
553
#ifdef DEBUG_AHCI
554
    int i;
555

    
556
    fprintf(stderr, "fis:");
557
    for (i = 0; i < cmd_len; i++) {
558
        if ((i & 0xf) == 0) {
559
            fprintf(stderr, "\n%02x:",i);
560
        }
561
        fprintf(stderr, "%02x ",fis[i]);
562
    }
563
    fprintf(stderr, "\n");
564
#endif
565
}
566

    
567
static void ahci_write_fis_sdb(AHCIState *s, int port, uint32_t finished)
568
{
569
    AHCIPortRegs *pr = &s->dev[port].port_regs;
570
    IDEState *ide_state;
571
    uint8_t *sdb_fis;
572

    
573
    if (!s->dev[port].res_fis ||
574
        !(pr->cmd & PORT_CMD_FIS_RX)) {
575
        return;
576
    }
577

    
578
    sdb_fis = &s->dev[port].res_fis[RES_FIS_SDBFIS];
579
    ide_state = &s->dev[port].port.ifs[0];
580

    
581
    /* clear memory */
582
    *(uint32_t*)sdb_fis = 0;
583

    
584
    /* write values */
585
    sdb_fis[0] = ide_state->error;
586
    sdb_fis[2] = ide_state->status & 0x77;
587
    s->dev[port].finished |= finished;
588
    *(uint32_t*)(sdb_fis + 4) = cpu_to_le32(s->dev[port].finished);
589

    
590
    ahci_trigger_irq(s, &s->dev[port], PORT_IRQ_STAT_SDBS);
591
}
592

    
593
static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis)
594
{
595
    AHCIPortRegs *pr = &ad->port_regs;
596
    uint8_t *d2h_fis;
597
    int i;
598
    target_phys_addr_t cmd_len = 0x80;
599
    int cmd_mapped = 0;
600

    
601
    if (!ad->res_fis || !(pr->cmd & PORT_CMD_FIS_RX)) {
602
        return;
603
    }
604

    
605
    if (!cmd_fis) {
606
        /* map cmd_fis */
607
        uint64_t tbl_addr = le64_to_cpu(ad->cur_cmd->tbl_addr);
608
        cmd_fis = cpu_physical_memory_map(tbl_addr, &cmd_len, 0);
609
        cmd_mapped = 1;
610
    }
611

    
612
    d2h_fis = &ad->res_fis[RES_FIS_RFIS];
613

    
614
    d2h_fis[0] = 0x34;
615
    d2h_fis[1] = (ad->hba->control_regs.irqstatus ? (1 << 6) : 0);
616
    d2h_fis[2] = ad->port.ifs[0].status;
617
    d2h_fis[3] = ad->port.ifs[0].error;
618

    
619
    d2h_fis[4] = cmd_fis[4];
620
    d2h_fis[5] = cmd_fis[5];
621
    d2h_fis[6] = cmd_fis[6];
622
    d2h_fis[7] = cmd_fis[7];
623
    d2h_fis[8] = cmd_fis[8];
624
    d2h_fis[9] = cmd_fis[9];
625
    d2h_fis[10] = cmd_fis[10];
626
    d2h_fis[11] = cmd_fis[11];
627
    d2h_fis[12] = cmd_fis[12];
628
    d2h_fis[13] = cmd_fis[13];
629
    for (i = 14; i < 0x20; i++) {
630
        d2h_fis[i] = 0;
631
    }
632

    
633
    if (d2h_fis[2] & ERR_STAT) {
634
        ahci_trigger_irq(ad->hba, ad, PORT_IRQ_STAT_TFES);
635
    }
636

    
637
    ahci_trigger_irq(ad->hba, ad, PORT_IRQ_D2H_REG_FIS);
638

    
639
    if (cmd_mapped) {
640
        cpu_physical_memory_unmap(cmd_fis, cmd_len, 0, cmd_len);
641
    }
642
}
643

    
644
static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist)
645
{
646
    AHCICmdHdr *cmd = ad->cur_cmd;
647
    uint32_t opts = le32_to_cpu(cmd->opts);
648
    uint64_t prdt_addr = le64_to_cpu(cmd->tbl_addr) + 0x80;
649
    int sglist_alloc_hint = opts >> AHCI_CMD_HDR_PRDT_LEN;
650
    target_phys_addr_t prdt_len = (sglist_alloc_hint * sizeof(AHCI_SG));
651
    target_phys_addr_t real_prdt_len = prdt_len;
652
    uint8_t *prdt;
653
    int i;
654
    int r = 0;
655

    
656
    if (!sglist_alloc_hint) {
657
        DPRINTF(ad->port_no, "no sg list given by guest: 0x%08x\n", opts);
658
        return -1;
659
    }
660

    
661
    /* map PRDT */
662
    if (!(prdt = cpu_physical_memory_map(prdt_addr, &prdt_len, 0))){
663
        DPRINTF(ad->port_no, "map failed\n");
664
        return -1;
665
    }
666

    
667
    if (prdt_len < real_prdt_len) {
668
        DPRINTF(ad->port_no, "mapped less than expected\n");
669
        r = -1;
670
        goto out;
671
    }
672

    
673
    /* Get entries in the PRDT, init a qemu sglist accordingly */
674
    if (sglist_alloc_hint > 0) {
675
        AHCI_SG *tbl = (AHCI_SG *)prdt;
676

    
677
        qemu_sglist_init(sglist, sglist_alloc_hint);
678
        for (i = 0; i < sglist_alloc_hint; i++) {
679
            /* flags_size is zero-based */
680
            qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
681
                            le32_to_cpu(tbl[i].flags_size) + 1);
682
        }
683
    }
684

    
685
out:
686
    cpu_physical_memory_unmap(prdt, prdt_len, 0, prdt_len);
687
    return r;
688
}
689

    
690
static void ncq_cb(void *opaque, int ret)
691
{
692
    NCQTransferState *ncq_tfs = (NCQTransferState *)opaque;
693
    IDEState *ide_state = &ncq_tfs->drive->port.ifs[0];
694

    
695
    /* Clear bit for this tag in SActive */
696
    ncq_tfs->drive->port_regs.scr_act &= ~(1 << ncq_tfs->tag);
697

    
698
    if (ret < 0) {
699
        /* error */
700
        ide_state->error = ABRT_ERR;
701
        ide_state->status = READY_STAT | ERR_STAT;
702
        ncq_tfs->drive->port_regs.scr_err |= (1 << ncq_tfs->tag);
703
    } else {
704
        ide_state->status = READY_STAT | SEEK_STAT;
705
    }
706

    
707
    ahci_write_fis_sdb(ncq_tfs->drive->hba, ncq_tfs->drive->port_no,
708
                       (1 << ncq_tfs->tag));
709

    
710
    DPRINTF(ncq_tfs->drive->port_no, "NCQ transfer tag %d finished\n",
711
            ncq_tfs->tag);
712

    
713
    qemu_sglist_destroy(&ncq_tfs->sglist);
714
    ncq_tfs->used = 0;
715
}
716

    
717
static void process_ncq_command(AHCIState *s, int port, uint8_t *cmd_fis,
718
                                int slot)
719
{
720
    NCQFrame *ncq_fis = (NCQFrame*)cmd_fis;
721
    uint8_t tag = ncq_fis->tag >> 3;
722
    NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[tag];
723

    
724
    if (ncq_tfs->used) {
725
        /* error - already in use */
726
        fprintf(stderr, "%s: tag %d already used\n", __FUNCTION__, tag);
727
        return;
728
    }
729

    
730
    ncq_tfs->used = 1;
731
    ncq_tfs->drive = &s->dev[port];
732
    ncq_tfs->slot = slot;
733
    ncq_tfs->lba = ((uint64_t)ncq_fis->lba5 << 40) |
734
                   ((uint64_t)ncq_fis->lba4 << 32) |
735
                   ((uint64_t)ncq_fis->lba3 << 24) |
736
                   ((uint64_t)ncq_fis->lba2 << 16) |
737
                   ((uint64_t)ncq_fis->lba1 << 8) |
738
                   (uint64_t)ncq_fis->lba0;
739

    
740
    /* Note: We calculate the sector count, but don't currently rely on it.
741
     * The total size of the DMA buffer tells us the transfer size instead. */
742
    ncq_tfs->sector_count = ((uint16_t)ncq_fis->sector_count_high << 8) |
743
                                ncq_fis->sector_count_low;
744

    
745
    DPRINTF(port, "NCQ transfer LBA from %ld to %ld, drive max %ld\n",
746
            ncq_tfs->lba, ncq_tfs->lba + ncq_tfs->sector_count - 2,
747
            s->dev[port].port.ifs[0].nb_sectors - 1);
748

    
749
    ahci_populate_sglist(&s->dev[port], &ncq_tfs->sglist);
750
    ncq_tfs->tag = tag;
751

    
752
    switch(ncq_fis->command) {
753
        case READ_FPDMA_QUEUED:
754
            DPRINTF(port, "NCQ reading %d sectors from LBA %ld, tag %d\n",
755
                    ncq_tfs->sector_count-1, ncq_tfs->lba, ncq_tfs->tag);
756
            ncq_tfs->is_read = 1;
757

    
758
            DPRINTF(port, "tag %d aio read %ld\n", ncq_tfs->tag, ncq_tfs->lba);
759
            ncq_tfs->aiocb = dma_bdrv_read(ncq_tfs->drive->port.ifs[0].bs,
760
                                           &ncq_tfs->sglist, ncq_tfs->lba,
761
                                           ncq_cb, ncq_tfs);
762
            break;
763
        case WRITE_FPDMA_QUEUED:
764
            DPRINTF(port, "NCQ writing %d sectors to LBA %ld, tag %d\n",
765
                    ncq_tfs->sector_count-1, ncq_tfs->lba, ncq_tfs->tag);
766
            ncq_tfs->is_read = 0;
767

    
768
            DPRINTF(port, "tag %d aio write %ld\n", ncq_tfs->tag, ncq_tfs->lba);
769
            ncq_tfs->aiocb = dma_bdrv_write(ncq_tfs->drive->port.ifs[0].bs,
770
                                            &ncq_tfs->sglist, ncq_tfs->lba,
771
                                            ncq_cb, ncq_tfs);
772
            break;
773
        default:
774
            DPRINTF(port, "error: tried to process non-NCQ command as NCQ\n");
775
            qemu_sglist_destroy(&ncq_tfs->sglist);
776
            break;
777
    }
778
}
779

    
780
static int handle_cmd(AHCIState *s, int port, int slot)
781
{
782
    IDEState *ide_state;
783
    uint32_t opts;
784
    uint64_t tbl_addr;
785
    AHCICmdHdr *cmd;
786
    uint8_t *cmd_fis;
787
    target_phys_addr_t cmd_len;
788

    
789
    if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) {
790
        /* Engine currently busy, try again later */
791
        DPRINTF(port, "engine busy\n");
792
        return -1;
793
    }
794

    
795
    cmd = &((AHCICmdHdr *)s->dev[port].lst)[slot];
796

    
797
    if (!s->dev[port].lst) {
798
        DPRINTF(port, "error: lst not given but cmd handled");
799
        return -1;
800
    }
801

    
802
    /* remember current slot handle for later */
803
    s->dev[port].cur_cmd = cmd;
804

    
805
    opts = le32_to_cpu(cmd->opts);
806
    tbl_addr = le64_to_cpu(cmd->tbl_addr);
807

    
808
    cmd_len = 0x80;
809
    cmd_fis = cpu_physical_memory_map(tbl_addr, &cmd_len, 1);
810

    
811
    if (!cmd_fis) {
812
        DPRINTF(port, "error: guest passed us an invalid cmd fis\n");
813
        return -1;
814
    }
815

    
816
    /* The device we are working for */
817
    ide_state = &s->dev[port].port.ifs[0];
818

    
819
    if (!ide_state->bs) {
820
        DPRINTF(port, "error: guest accessed unused port");
821
        goto out;
822
    }
823

    
824
    debug_print_fis(cmd_fis, 0x90);
825
    //debug_print_fis(cmd_fis, (opts & AHCI_CMD_HDR_CMD_FIS_LEN) * 4);
826

    
827
    switch (cmd_fis[0]) {
828
        case SATA_FIS_TYPE_REGISTER_H2D:
829
            break;
830
        default:
831
            DPRINTF(port, "unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "
832
                          "cmd_fis[2]=%02x\n", cmd_fis[0], cmd_fis[1],
833
                          cmd_fis[2]);
834
            goto out;
835
            break;
836
    }
837

    
838
    switch (cmd_fis[1]) {
839
        case SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER:
840
            break;
841
        case 0:
842
            break;
843
        default:
844
            DPRINTF(port, "unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "
845
                          "cmd_fis[2]=%02x\n", cmd_fis[0], cmd_fis[1],
846
                          cmd_fis[2]);
847
            goto out;
848
            break;
849
    }
850

    
851
    switch (s->dev[port].port_state) {
852
        case STATE_RUN:
853
            if (cmd_fis[15] & ATA_SRST) {
854
                s->dev[port].port_state = STATE_RESET;
855
            }
856
            break;
857
        case STATE_RESET:
858
            if (!(cmd_fis[15] & ATA_SRST)) {
859
                ahci_reset_port(s, port);
860
            }
861
            break;
862
    }
863

    
864
    if (cmd_fis[1] == SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER) {
865

    
866
        /* Check for NCQ command */
867
        if ((cmd_fis[2] == READ_FPDMA_QUEUED) ||
868
            (cmd_fis[2] == WRITE_FPDMA_QUEUED)) {
869
            process_ncq_command(s, port, cmd_fis, slot);
870
            goto out;
871
        }
872

    
873
        /* Decompose the FIS  */
874
        ide_state->nsector = (int64_t)((cmd_fis[13] << 8) | cmd_fis[12]);
875
        ide_state->feature = cmd_fis[3];
876
        if (!ide_state->nsector) {
877
            ide_state->nsector = 256;
878
        }
879

    
880
        if (ide_state->drive_kind != IDE_CD) {
881
            /*
882
             * We set the sector depending on the sector defined in the FIS.
883
             * Unfortunately, the spec isn't exactly obvious on this one.
884
             *
885
             * Apparently LBA48 commands set fis bytes 10,9,8,6,5,4 to the
886
             * 48 bit sector number. ATA_CMD_READ_DMA_EXT is an example for
887
             * such a command.
888
             *
889
             * Non-LBA48 commands however use 7[lower 4 bits],6,5,4 to define a
890
             * 28-bit sector number. ATA_CMD_READ_DMA is an example for such
891
             * a command.
892
             *
893
             * Since the spec doesn't explicitly state what each field should
894
             * do, I simply assume non-used fields as reserved and OR everything
895
             * together, independent of the command.
896
             */
897
            ide_set_sector(ide_state, ((uint64_t)cmd_fis[10] << 40)
898
                                    | ((uint64_t)cmd_fis[9] << 32)
899
                                    /* This is used for LBA48 commands */
900
                                    | ((uint64_t)cmd_fis[8] << 24)
901
                                    /* This is used for non-LBA48 commands */
902
                                    | ((uint64_t)(cmd_fis[7] & 0xf) << 24)
903
                                    | ((uint64_t)cmd_fis[6] << 16)
904
                                    | ((uint64_t)cmd_fis[5] << 8)
905
                                    | cmd_fis[4]);
906
        }
907

    
908
        /* Copy the ACMD field (ATAPI packet, if any) from the AHCI command
909
         * table to ide_state->io_buffer
910
         */
911
        if (opts & AHCI_CMD_ATAPI) {
912
            memcpy(ide_state->io_buffer, &cmd_fis[AHCI_COMMAND_TABLE_ACMD], 0x10);
913
            ide_state->lcyl = 0x14;
914
            ide_state->hcyl = 0xeb;
915
            debug_print_fis(ide_state->io_buffer, 0x10);
916
            ide_state->feature = IDE_FEATURE_DMA;
917
            s->dev[port].done_atapi_packet = 0;
918
            /* XXX send PIO setup FIS */
919
        }
920

    
921
        ide_state->error = 0;
922

    
923
        /* Reset transferred byte counter */
924
        cmd->status = 0;
925

    
926
        /* We're ready to process the command in FIS byte 2. */
927
        ide_exec_cmd(&s->dev[port].port, cmd_fis[2]);
928

    
929
        if (s->dev[port].port.ifs[0].status & READY_STAT) {
930
            ahci_write_fis_d2h(&s->dev[port], cmd_fis);
931
        }
932
    }
933

    
934
out:
935
    cpu_physical_memory_unmap(cmd_fis, cmd_len, 1, cmd_len);
936

    
937
    if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) {
938
        /* async command, complete later */
939
        s->dev[port].busy_slot = slot;
940
        return -1;
941
    }
942

    
943
    /* done handling the command */
944
    return 0;
945
}
946

    
947
/* DMA dev <-> ram */
948
static int ahci_start_transfer(IDEDMA *dma)
949
{
950
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
951
    IDEState *s = &ad->port.ifs[0];
952
    uint32_t size = (uint32_t)(s->data_end - s->data_ptr);
953
    /* write == ram -> device */
954
    uint32_t opts = le32_to_cpu(ad->cur_cmd->opts);
955
    int is_write = opts & AHCI_CMD_WRITE;
956
    int is_atapi = opts & AHCI_CMD_ATAPI;
957
    int has_sglist = 0;
958

    
959
    if (is_atapi && !ad->done_atapi_packet) {
960
        /* already prepopulated iobuffer */
961
        ad->done_atapi_packet = 1;
962
        goto out;
963
    }
964

    
965
    if (!ahci_populate_sglist(ad, &s->sg)) {
966
        has_sglist = 1;
967
    }
968

    
969
    DPRINTF(ad->port_no, "%sing %d bytes on %s w/%s sglist\n",
970
            is_write ? "writ" : "read", size, is_atapi ? "atapi" : "ata",
971
            has_sglist ? "" : "o");
972

    
973
    if (is_write && has_sglist && (s->data_ptr < s->data_end)) {
974
        read_from_sglist(s->data_ptr, size, &s->sg);
975
    }
976

    
977
    if (!is_write && has_sglist && (s->data_ptr < s->data_end)) {
978
        write_to_sglist(s->data_ptr, size, &s->sg);
979
    }
980

    
981
    /* update number of transferred bytes */
982
    ad->cur_cmd->status = cpu_to_le32(le32_to_cpu(ad->cur_cmd->status) + size);
983

    
984
out:
985
    /* declare that we processed everything */
986
    s->data_ptr = s->data_end;
987

    
988
    if (has_sglist) {
989
        qemu_sglist_destroy(&s->sg);
990
    }
991

    
992
    s->end_transfer_func(s);
993

    
994
    if (!(s->status & DRQ_STAT)) {
995
        /* done with DMA */
996
        ahci_trigger_irq(ad->hba, ad, PORT_IRQ_STAT_DSS);
997
    }
998

    
999
    return 0;
1000
}
1001

    
1002
static void ahci_start_dma(IDEDMA *dma, IDEState *s,
1003
                           BlockDriverCompletionFunc *dma_cb)
1004
{
1005
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1006

    
1007
    DPRINTF(ad->port_no, "\n");
1008
    ad->dma_cb = dma_cb;
1009
    ad->dma_status |= BM_STATUS_DMAING;
1010
    dma_cb(s, 0);
1011
}
1012

    
1013
static int ahci_dma_prepare_buf(IDEDMA *dma, int is_write)
1014
{
1015
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1016
    IDEState *s = &ad->port.ifs[0];
1017
    int i;
1018

    
1019
    ahci_populate_sglist(ad, &s->sg);
1020

    
1021
    s->io_buffer_size = 0;
1022
    for (i = 0; i < s->sg.nsg; i++) {
1023
        s->io_buffer_size += s->sg.sg[i].len;
1024
    }
1025

    
1026
    DPRINTF(ad->port_no, "len=%#x\n", s->io_buffer_size);
1027
    return s->io_buffer_size != 0;
1028
}
1029

    
1030
static int ahci_dma_rw_buf(IDEDMA *dma, int is_write)
1031
{
1032
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1033
    IDEState *s = &ad->port.ifs[0];
1034
    uint8_t *p = s->io_buffer + s->io_buffer_index;
1035
    int l = s->io_buffer_size - s->io_buffer_index;
1036

    
1037
    if (ahci_populate_sglist(ad, &s->sg)) {
1038
        return 0;
1039
    }
1040

    
1041
    if (is_write) {
1042
        write_to_sglist(p, l, &s->sg);
1043
    } else {
1044
        read_from_sglist(p, l, &s->sg);
1045
    }
1046

    
1047
    /* update number of transferred bytes */
1048
    ad->cur_cmd->status = cpu_to_le32(le32_to_cpu(ad->cur_cmd->status) + l);
1049
    s->io_buffer_index += l;
1050

    
1051
    DPRINTF(ad->port_no, "len=%#x\n", l);
1052

    
1053
    return 1;
1054
}
1055

    
1056
static int ahci_dma_set_unit(IDEDMA *dma, int unit)
1057
{
1058
    /* only a single unit per link */
1059
    return 0;
1060
}
1061

    
1062
static int ahci_dma_add_status(IDEDMA *dma, int status)
1063
{
1064
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1065
    ad->dma_status |= status;
1066
    DPRINTF(ad->port_no, "set status: %x\n", status);
1067

    
1068
    if (status & BM_STATUS_INT) {
1069
        ahci_trigger_irq(ad->hba, ad, PORT_IRQ_STAT_DSS);
1070
    }
1071

    
1072
    return 0;
1073
}
1074

    
1075
static int ahci_dma_set_inactive(IDEDMA *dma)
1076
{
1077
    AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1078

    
1079
    DPRINTF(ad->port_no, "dma done\n");
1080

    
1081
    /* update d2h status */
1082
    ahci_write_fis_d2h(ad, NULL);
1083

    
1084
    ad->dma_cb = NULL;
1085

    
1086
    if (!ad->check_bh) {
1087
        /* maybe we still have something to process, check later */
1088
        ad->check_bh = qemu_bh_new(ahci_check_cmd_bh, ad);
1089
        qemu_bh_schedule(ad->check_bh);
1090
    }
1091

    
1092
    return 0;
1093
}
1094

    
1095
static void ahci_irq_set(void *opaque, int n, int level)
1096
{
1097
}
1098

    
1099
static void ahci_dma_restart_cb(void *opaque, int running, int reason)
1100
{
1101
}
1102

    
1103
static int ahci_dma_reset(IDEDMA *dma)
1104
{
1105
    return 0;
1106
}
1107

    
1108
static const IDEDMAOps ahci_dma_ops = {
1109
    .start_dma = ahci_start_dma,
1110
    .start_transfer = ahci_start_transfer,
1111
    .prepare_buf = ahci_dma_prepare_buf,
1112
    .rw_buf = ahci_dma_rw_buf,
1113
    .set_unit = ahci_dma_set_unit,
1114
    .add_status = ahci_dma_add_status,
1115
    .set_inactive = ahci_dma_set_inactive,
1116
    .restart_cb = ahci_dma_restart_cb,
1117
    .reset = ahci_dma_reset,
1118
};
1119

    
1120
void ahci_init(AHCIState *s, DeviceState *qdev, int ports)
1121
{
1122
    qemu_irq *irqs;
1123
    int i;
1124

    
1125
    s->ports = ports;
1126
    s->dev = g_malloc0(sizeof(AHCIDevice) * ports);
1127
    ahci_reg_init(s);
1128
    /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
1129
    memory_region_init_io(&s->mem, &ahci_mem_ops, s, "ahci", 0x1000);
1130
    irqs = qemu_allocate_irqs(ahci_irq_set, s, s->ports);
1131

    
1132
    for (i = 0; i < s->ports; i++) {
1133
        AHCIDevice *ad = &s->dev[i];
1134

    
1135
        ide_bus_new(&ad->port, qdev, i);
1136
        ide_init2(&ad->port, irqs[i]);
1137

    
1138
        ad->hba = s;
1139
        ad->port_no = i;
1140
        ad->port.dma = &ad->dma;
1141
        ad->port.dma->ops = &ahci_dma_ops;
1142
        ad->port_regs.cmd = PORT_CMD_SPIN_UP | PORT_CMD_POWER_ON;
1143
    }
1144
}
1145

    
1146
void ahci_uninit(AHCIState *s)
1147
{
1148
    memory_region_destroy(&s->mem);
1149
    g_free(s->dev);
1150
}
1151

    
1152
void ahci_reset(void *opaque)
1153
{
1154
    struct AHCIPCIState *d = opaque;
1155
    int i;
1156

    
1157
    d->ahci.control_regs.irqstatus = 0;
1158
    d->ahci.control_regs.ghc = 0;
1159

    
1160
    for (i = 0; i < d->ahci.ports; i++) {
1161
        ahci_reset_port(&d->ahci, i);
1162
    }
1163
}