hw/ide/ahci.c

   1 /*
   2  * QEMU AHCI Emulation
   3  *
   4  * Copyright (c) 2010 qiaochong@loongson.cn
   5  * Copyright (c) 2010 Roland Elek <elek.roland@gmail.com>
   6  * Copyright (c) 2010 Sebastian Herbszt <herbszt@gmx.de>
   7  * Copyright (c) 2010 Alexander Graf <agraf@suse.de>
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  21  *
  22  */
  23
  24 #include <hw/hw.h>
  25 #include <hw/pci/msi.h>
  26 #include <hw/i386/pc.h>
  27 #include <hw/pci/pci.h>
  28 #include <hw/sysbus.h>
  29
  30 #include "monitor/monitor.h"
  31 #include "sysemu/dma.h"
  32 #include "internal.h"
  33 #include <hw/ide/pci.h>
  34 #include <hw/ide/ahci.h>
  35
  36 /* #define DEBUG_AHCI */
  37
  38 #ifdef DEBUG_AHCI
  39 #define DPRINTF(port, fmt, ...) \
  40 do { fprintf(stderr, "ahci: %s: [%d] ", __FUNCTION__, port); \
  41      fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
  42 #else
  43 #define DPRINTF(port, fmt, ...) do {} while(0)
  44 #endif
  45
  46 static void check_cmd(AHCIState *s, int port);
  47 static int handle_cmd(AHCIState *s,int port,int slot);
  48 static void ahci_reset_port(AHCIState *s, int port);
  49 static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis);
  50 static void ahci_init_d2h(AHCIDevice *ad);
  51
  52 static uint32_t  ahci_port_read(AHCIState *s, int port, int offset)
  53 {
  54     uint32_t val;
  55     AHCIPortRegs *pr;
  56     pr = &s->dev[port].port_regs;
  57
  58     switch (offset) {
  59     case PORT_LST_ADDR:
  60         val = pr->lst_addr;
  61         break;
  62     case PORT_LST_ADDR_HI:
  63         val = pr->lst_addr_hi;
  64         break;
  65     case PORT_FIS_ADDR:
  66         val = pr->fis_addr;
  67         break;
  68     case PORT_FIS_ADDR_HI:
  69         val = pr->fis_addr_hi;
  70         break;
  71     case PORT_IRQ_STAT:
  72         val = pr->irq_stat;
  73         break;
  74     case PORT_IRQ_MASK:
  75         val = pr->irq_mask;
  76         break;
  77     case PORT_CMD:
  78         val = pr->cmd;
  79         break;
  80     case PORT_TFDATA:
  81         val = pr->tfdata;
  82         break;
  83     case PORT_SIG:
  84         val = pr->sig;
  85         break;
  86     case PORT_SCR_STAT:
  87         if (s->dev[port].port.ifs[0].bs) {
  88             val = SATA_SCR_SSTATUS_DET_DEV_PRESENT_PHY_UP |
  89                   SATA_SCR_SSTATUS_SPD_GEN1 | SATA_SCR_SSTATUS_IPM_ACTIVE;
  90         } else {
  91             val = SATA_SCR_SSTATUS_DET_NODEV;
  92         }
  93         break;
  94     case PORT_SCR_CTL:
  95         val = pr->scr_ctl;
  96         break;
  97     case PORT_SCR_ERR:
  98         val = pr->scr_err;
  99         break;
 100     case PORT_SCR_ACT:
 101         pr->scr_act &= ~s->dev[port].finished;
 102         s->dev[port].finished = 0;
 103         val = pr->scr_act;
 104         break;
 105     case PORT_CMD_ISSUE:
 106         val = pr->cmd_issue;
 107         break;
 108     case PORT_RESERVED:
 109     default:
 110         val = 0;
 111     }
 112     DPRINTF(port, "offset: 0x%x val: 0x%x\n", offset, val);
 113     return val;
 114
 115 }
 116
 117 static void ahci_irq_raise(AHCIState *s, AHCIDevice *dev)
 118 {
 119     AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
 120     PCIDevice *pci_dev =
 121         (PCIDevice *)object_dynamic_cast(OBJECT(d), TYPE_PCI_DEVICE);
 122
 123     DPRINTF(0, "raise irq\n");
 124
 125     if (pci_dev && msi_enabled(pci_dev)) {
 126         msi_notify(pci_dev, 0);
 127     } else {
 128         qemu_irq_raise(s->irq);
 129     }
 130 }
 131
 132 static void ahci_irq_lower(AHCIState *s, AHCIDevice *dev)
 133 {
 134     AHCIPCIState *d = container_of(s, AHCIPCIState, ahci);
 135     PCIDevice *pci_dev =
 136         (PCIDevice *)object_dynamic_cast(OBJECT(d), TYPE_PCI_DEVICE);
 137
 138     DPRINTF(0, "lower irq\n");
 139
 140     if (!pci_dev || !msi_enabled(pci_dev)) {
 141         qemu_irq_lower(s->irq);
 142     }
 143 }
 144
 145 static void ahci_check_irq(AHCIState *s)
 146 {
 147     int i;
 148
 149     DPRINTF(-1, "check irq %#x\n", s->control_regs.irqstatus);
 150
 151     s->control_regs.irqstatus = 0;
 152     for (i = 0; i < s->ports; i++) {
 153         AHCIPortRegs *pr = &s->dev[i].port_regs;
 154         if (pr->irq_stat & pr->irq_mask) {
 155             s->control_regs.irqstatus |= (1 << i);
 156         }
 157     }
 158
 159     if (s->control_regs.irqstatus &&
 160         (s->control_regs.ghc & HOST_CTL_IRQ_EN)) {
 161             ahci_irq_raise(s, NULL);
 162     } else {
 163         ahci_irq_lower(s, NULL);
 164     }
 165 }
 166
 167 static void ahci_trigger_irq(AHCIState *s, AHCIDevice *d,
 168                              int irq_type)
 169 {
 170     DPRINTF(d->port_no, "trigger irq %#x -> %x\n",
 171             irq_type, d->port_regs.irq_mask & irq_type);
 172
 173     d->port_regs.irq_stat |= irq_type;
 174     ahci_check_irq(s);
 175 }
 176
 177 static void map_page(AddressSpace *as, uint8_t **ptr, uint64_t addr,
 178                      uint32_t wanted)
 179 {
 180     hwaddr len = wanted;
 181
 182     if (*ptr) {
 183         dma_memory_unmap(as, *ptr, len, DMA_DIRECTION_FROM_DEVICE, len);
 184     }
 185
 186     *ptr = dma_memory_map(as, addr, &len, DMA_DIRECTION_FROM_DEVICE);
 187     if (len < wanted) {
 188         dma_memory_unmap(as, *ptr, len, DMA_DIRECTION_FROM_DEVICE, len);
 189         *ptr = NULL;
 190     }
 191 }
 192
 193 static void  ahci_port_write(AHCIState *s, int port, int offset, uint32_t val)
 194 {
 195     AHCIPortRegs *pr = &s->dev[port].port_regs;
 196
 197     DPRINTF(port, "offset: 0x%x val: 0x%x\n", offset, val);
 198     switch (offset) {
 199         case PORT_LST_ADDR:
 200             pr->lst_addr = val;
 201             map_page(s->as, &s->dev[port].lst,
 202                      ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
 203             s->dev[port].cur_cmd = NULL;
 204             break;
 205         case PORT_LST_ADDR_HI:
 206             pr->lst_addr_hi = val;
 207             map_page(s->as, &s->dev[port].lst,
 208                      ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
 209             s->dev[port].cur_cmd = NULL;
 210             break;
 211         case PORT_FIS_ADDR:
 212             pr->fis_addr = val;
 213             map_page(s->as, &s->dev[port].res_fis,
 214                      ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
 215             break;
 216         case PORT_FIS_ADDR_HI:
 217             pr->fis_addr_hi = val;
 218             map_page(s->as, &s->dev[port].res_fis,
 219                      ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
 220             break;
 221         case PORT_IRQ_STAT:
 222             pr->irq_stat &= ~val;
 223             ahci_check_irq(s);
 224             break;
 225         case PORT_IRQ_MASK:
 226             pr->irq_mask = val & 0xfdc000ff;
 227             ahci_check_irq(s);
 228             break;
 229         case PORT_CMD:
 230             pr->cmd = val & ~(PORT_CMD_LIST_ON | PORT_CMD_FIS_ON);
 231
 232             if (pr->cmd & PORT_CMD_START) {
 233                 pr->cmd |= PORT_CMD_LIST_ON;
 234             }
 235
 236             if (pr->cmd & PORT_CMD_FIS_RX) {
 237                 pr->cmd |= PORT_CMD_FIS_ON;
 238             }
 239
 240             /* XXX usually the FIS would be pending on the bus here and
 241                    issuing deferred until the OS enables FIS receival.
 242                    Instead, we only submit it once - which works in most
 243                    cases, but is a hack. */
 244             if ((pr->cmd & PORT_CMD_FIS_ON) &&
 245                 !s->dev[port].init_d2h_sent) {
 246                 ahci_init_d2h(&s->dev[port]);
 247                 s->dev[port].init_d2h_sent = true;
 248             }
 249
 250             check_cmd(s, port);
 251             break;
 252         case PORT_TFDATA:
 253             /* Read Only. */
 254             break;
 255         case PORT_SIG:
 256             /* Read Only */
 257             break;
 258         case PORT_SCR_STAT:
 259             /* Read Only */
 260             break;
 261         case PORT_SCR_CTL:
 262             if (((pr->scr_ctl & AHCI_SCR_SCTL_DET) == 1) &&
 263                 ((val & AHCI_SCR_SCTL_DET) == 0)) {
 264                 ahci_reset_port(s, port);
 265             }
 266             pr->scr_ctl = val;
 267             break;
 268         case PORT_SCR_ERR:
 269             pr->scr_err &= ~val;
 270             break;
 271         case PORT_SCR_ACT:
 272             /* RW1 */
 273             pr->scr_act |= val;
 274             break;
 275         case PORT_CMD_ISSUE:
 276             pr->cmd_issue |= val;
 277             check_cmd(s, port);
 278             break;
 279         default:
 280             break;
 281     }
 282 }
 283
 284 static uint64_t ahci_mem_read(void *opaque, hwaddr addr,
 285                               unsigned size)
 286 {
 287     AHCIState *s = opaque;
 288     uint32_t val = 0;
 289
 290     if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
 291         switch (addr) {
 292         case HOST_CAP:
 293             val = s->control_regs.cap;
 294             break;
 295         case HOST_CTL:
 296             val = s->control_regs.ghc;
 297             break;
 298         case HOST_IRQ_STAT:
 299             val = s->control_regs.irqstatus;
 300             break;
 301         case HOST_PORTS_IMPL:
 302             val = s->control_regs.impl;
 303             break;
 304         case HOST_VERSION:
 305             val = s->control_regs.version;
 306             break;
 307         }
 308
 309         DPRINTF(-1, "(addr 0x%08X), val 0x%08X\n", (unsigned) addr, val);
 310     } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
 311                (addr < (AHCI_PORT_REGS_START_ADDR +
 312                 (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
 313         val = ahci_port_read(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
 314                              addr & AHCI_PORT_ADDR_OFFSET_MASK);
 315     }
 316
 317     return val;
 318 }
 319
 320
 321
 322 static void ahci_mem_write(void *opaque, hwaddr addr,
 323                            uint64_t val, unsigned size)
 324 {
 325     AHCIState *s = opaque;
 326
 327     /* Only aligned reads are allowed on AHCI */
 328     if (addr & 3) {
 329         fprintf(stderr, "ahci: Mis-aligned write to addr 0x"
 330                 TARGET_FMT_plx "\n", addr);
 331         return;
 332     }
 333
 334     if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
 335         DPRINTF(-1, "(addr 0x%08X), val 0x%08"PRIX64"\n", (unsigned) addr, val);
 336
 337         switch (addr) {
 338             case HOST_CAP: /* R/WO, RO */
 339                 /* FIXME handle R/WO */
 340                 break;
 341             case HOST_CTL: /* R/W */
 342                 if (val & HOST_CTL_RESET) {
 343                     DPRINTF(-1, "HBA Reset\n");
 344                     ahci_reset(s);
 345                 } else {
 346                     s->control_regs.ghc = (val & 0x3) | HOST_CTL_AHCI_EN;
 347                     ahci_check_irq(s);
 348                 }
 349                 break;
 350             case HOST_IRQ_STAT: /* R/WC, RO */
 351                 s->control_regs.irqstatus &= ~val;
 352                 ahci_check_irq(s);
 353                 break;
 354             case HOST_PORTS_IMPL: /* R/WO, RO */
 355                 /* FIXME handle R/WO */
 356                 break;
 357             case HOST_VERSION: /* RO */
 358                 /* FIXME report write? */
 359                 break;
 360             default:
 361                 DPRINTF(-1, "write to unknown register 0x%x\n", (unsigned)addr);
 362         }
 363     } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
 364                (addr < (AHCI_PORT_REGS_START_ADDR +
 365                 (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
 366         ahci_port_write(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
 367                         addr & AHCI_PORT_ADDR_OFFSET_MASK, val);
 368     }
 369
 370 }
 371
 372 static const MemoryRegionOps ahci_mem_ops = {
 373     .read = ahci_mem_read,
 374     .write = ahci_mem_write,
 375     .endianness = DEVICE_LITTLE_ENDIAN,
 376 };
 377
 378 static uint64_t ahci_idp_read(void *opaque, hwaddr addr,
 379                               unsigned size)
 380 {
 381     AHCIState *s = opaque;
 382
 383     if (addr == s->idp_offset) {
 384         /* index register */
 385         return s->idp_index;
 386     } else if (addr == s->idp_offset + 4) {
 387         /* data register - do memory read at location selected by index */
 388         return ahci_mem_read(opaque, s->idp_index, size);
 389     } else {
 390         return 0;
 391     }
 392 }
 393
 394 static void ahci_idp_write(void *opaque, hwaddr addr,
 395                            uint64_t val, unsigned size)
 396 {
 397     AHCIState *s = opaque;
 398
 399     if (addr == s->idp_offset) {
 400         /* index register - mask off reserved bits */
 401         s->idp_index = (uint32_t)val & ((AHCI_MEM_BAR_SIZE - 1) & ~3);
 402     } else if (addr == s->idp_offset + 4) {
 403         /* data register - do memory write at location selected by index */
 404         ahci_mem_write(opaque, s->idp_index, val, size);
 405     }
 406 }
 407
 408 static const MemoryRegionOps ahci_idp_ops = {
 409     .read = ahci_idp_read,
 410     .write = ahci_idp_write,
 411     .endianness = DEVICE_LITTLE_ENDIAN,
 412 };
 413
 414
 415 static void ahci_reg_init(AHCIState *s)
 416 {
 417     int i;
 418
 419     s->control_regs.cap = (s->ports - 1) |
 420                           (AHCI_NUM_COMMAND_SLOTS << 8) |
 421                           (AHCI_SUPPORTED_SPEED_GEN1 << AHCI_SUPPORTED_SPEED) |
 422                           HOST_CAP_NCQ | HOST_CAP_AHCI;
 423
 424     s->control_regs.impl = (1 << s->ports) - 1;
 425
 426     s->control_regs.version = AHCI_VERSION_1_0;
 427
 428     for (i = 0; i < s->ports; i++) {
 429         s->dev[i].port_state = STATE_RUN;
 430     }
 431 }
 432
 433 static void check_cmd(AHCIState *s, int port)
 434 {
 435     AHCIPortRegs *pr = &s->dev[port].port_regs;
 436     int slot;
 437
 438     if ((pr->cmd & PORT_CMD_START) && pr->cmd_issue) {
 439         for (slot = 0; (slot < 32) && pr->cmd_issue; slot++) {
 440             if ((pr->cmd_issue & (1U << slot)) &&
 441                 !handle_cmd(s, port, slot)) {
 442                 pr->cmd_issue &= ~(1U << slot);
 443             }
 444         }
 445     }
 446 }
 447
 448 static void ahci_check_cmd_bh(void *opaque)
 449 {
 450     AHCIDevice *ad = opaque;
 451
 452     qemu_bh_delete(ad->check_bh);
 453     ad->check_bh = NULL;
 454
 455     if ((ad->busy_slot != -1) &&
 456         !(ad->port.ifs[0].status & (BUSY_STAT|DRQ_STAT))) {
 457         /* no longer busy */
 458         ad->port_regs.cmd_issue &= ~(1 << ad->busy_slot);
 459         ad->busy_slot = -1;
 460     }
 461
 462     check_cmd(ad->hba, ad->port_no);
 463 }
 464
 465 static void ahci_init_d2h(AHCIDevice *ad)
 466 {
 467     uint8_t init_fis[20];
 468     IDEState *ide_state = &ad->port.ifs[0];
 469
 470     memset(init_fis, 0, sizeof(init_fis));
 471
 472     init_fis[4] = 1;
 473     init_fis[12] = 1;
 474
 475     if (ide_state->drive_kind == IDE_CD) {
 476         init_fis[5] = ide_state->lcyl;
 477         init_fis[6] = ide_state->hcyl;
 478     }
 479
 480     ahci_write_fis_d2h(ad, init_fis);
 481 }
 482
 483 static void ahci_reset_port(AHCIState *s, int port)
 484 {
 485     AHCIDevice *d = &s->dev[port];
 486     AHCIPortRegs *pr = &d->port_regs;
 487     IDEState *ide_state = &d->port.ifs[0];
 488     int i;
 489
 490     DPRINTF(port, "reset port\n");
 491
 492     ide_bus_reset(&d->port);
 493     ide_state->ncq_queues = AHCI_MAX_CMDS;
 494
 495     pr->scr_stat = 0;
 496     pr->scr_err = 0;
 497     pr->scr_act = 0;
 498     pr->tfdata = 0x7F;
 499     pr->sig = 0xFFFFFFFF;
 500     d->busy_slot = -1;
 501     d->init_d2h_sent = false;
 502
 503     ide_state = &s->dev[port].port.ifs[0];
 504     if (!ide_state->bs) {
 505         return;
 506     }
 507
 508     /* reset ncq queue */
 509     for (i = 0; i < AHCI_MAX_CMDS; i++) {
 510         NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[i];
 511         if (!ncq_tfs->used) {
 512             continue;
 513         }
 514
 515         if (ncq_tfs->aiocb) {
 516             bdrv_aio_cancel(ncq_tfs->aiocb);
 517             ncq_tfs->aiocb = NULL;
 518         }
 519
 520         /* Maybe we just finished the request thanks to bdrv_aio_cancel() */
 521         if (!ncq_tfs->used) {
 522             continue;
 523         }
 524
 525         qemu_sglist_destroy(&ncq_tfs->sglist);
 526         ncq_tfs->used = 0;
 527     }
 528
 529     s->dev[port].port_state = STATE_RUN;
 530     if (!ide_state->bs) {
 531         pr->sig = 0;
 532         ide_state->status = SEEK_STAT | WRERR_STAT;
 533     } else if (ide_state->drive_kind == IDE_CD) {
 534         pr->sig = SATA_SIGNATURE_CDROM;
 535         ide_state->lcyl = 0x14;
 536         ide_state->hcyl = 0xeb;
 537         DPRINTF(port, "set lcyl = %d\n", ide_state->lcyl);
 538         ide_state->status = SEEK_STAT | WRERR_STAT | READY_STAT;
 539     } else {
 540         pr->sig = SATA_SIGNATURE_DISK;
 541         ide_state->status = SEEK_STAT | WRERR_STAT;
 542     }
 543
 544     ide_state->error = 1;
 545     ahci_init_d2h(d);
 546 }
 547
 548 static void debug_print_fis(uint8_t *fis, int cmd_len)
 549 {
 550 #ifdef DEBUG_AHCI
 551     int i;
 552
 553     fprintf(stderr, "fis:");
 554     for (i = 0; i < cmd_len; i++) {
 555         if ((i & 0xf) == 0) {
 556             fprintf(stderr, "\n%02x:",i);
 557         }
 558         fprintf(stderr, "%02x ",fis[i]);
 559     }
 560     fprintf(stderr, "\n");
 561 #endif
 562 }
 563
 564 static void ahci_write_fis_sdb(AHCIState *s, int port, uint32_t finished)
 565 {
 566     AHCIDevice *ad = &s->dev[port];
 567     AHCIPortRegs *pr = &ad->port_regs;
 568     IDEState *ide_state;
 569     uint8_t *sdb_fis;
 570
 571     if (!s->dev[port].res_fis ||
 572         !(pr->cmd & PORT_CMD_FIS_RX)) {
 573         return;
 574     }
 575
 576     sdb_fis = &ad->res_fis[RES_FIS_SDBFIS];
 577     ide_state = &ad->port.ifs[0];
 578
 579     /* clear memory */
 580     *(uint32_t*)sdb_fis = 0;
 581
 582     /* write values */
 583     sdb_fis[0] = ide_state->error;
 584     sdb_fis[2] = ide_state->status & 0x77;
 585     s->dev[port].finished |= finished;
 586     *(uint32_t*)(sdb_fis + 4) = cpu_to_le32(ad->finished);
 587
 588     /* Update shadow registers (except BSY 0x80 and DRQ 0x08) */
 589     pr->tfdata = (ad->port.ifs[0].error << 8) |
 590         (ad->port.ifs[0].status & 0x77) |
 591         (pr->tfdata & 0x88);
 592
 593     ahci_trigger_irq(s, ad, PORT_IRQ_SDB_FIS);
 594 }
 595
 596 static void ahci_write_fis_pio(AHCIDevice *ad, uint16_t len)
 597 {
 598     AHCIPortRegs *pr = &ad->port_regs;
 599     uint8_t *pio_fis, *cmd_fis;
 600     uint64_t tbl_addr;
 601     dma_addr_t cmd_len = 0x80;
 602
 603     if (!ad->res_fis || !(pr->cmd & PORT_CMD_FIS_RX)) {
 604         return;
 605     }
 606
 607     /* map cmd_fis */
 608     tbl_addr = le64_to_cpu(ad->cur_cmd->tbl_addr);
 609     cmd_fis = dma_memory_map(ad->hba->as, tbl_addr, &cmd_len,
 610                              DMA_DIRECTION_TO_DEVICE);
 611
 612     if (cmd_fis == NULL) {
 613         DPRINTF(ad->port_no, "dma_memory_map failed in ahci_write_fis_pio");
 614         ahci_trigger_irq(ad->hba, ad, PORT_IRQ_HBUS_ERR);
 615         return;
 616     }
 617
 618     if (cmd_len != 0x80) {
 619         DPRINTF(ad->port_no,
 620                 "dma_memory_map mapped too few bytes in ahci_write_fis_pio");
 621         dma_memory_unmap(ad->hba->as, cmd_fis, cmd_len,
 622                          DMA_DIRECTION_TO_DEVICE, cmd_len);
 623         ahci_trigger_irq(ad->hba, ad, PORT_IRQ_HBUS_ERR);
 624         return;
 625     }
 626
 627     pio_fis = &ad->res_fis[RES_FIS_PSFIS];
 628
 629     pio_fis[0] = 0x5f;
 630     pio_fis[1] = (ad->hba->control_regs.irqstatus ? (1 << 6) : 0);
 631     pio_fis[2] = ad->port.ifs[0].status;
 632     pio_fis[3] = ad->port.ifs[0].error;
 633
 634     pio_fis[4] = cmd_fis[4];
 635     pio_fis[5] = cmd_fis[5];
 636     pio_fis[6] = cmd_fis[6];
 637     pio_fis[7] = cmd_fis[7];
 638     pio_fis[8] = cmd_fis[8];
 639     pio_fis[9] = cmd_fis[9];
 640     pio_fis[10] = cmd_fis[10];
 641     pio_fis[11] = cmd_fis[11];
 642     pio_fis[12] = cmd_fis[12];
 643     pio_fis[13] = cmd_fis[13];
 644     pio_fis[14] = 0;
 645     pio_fis[15] = ad->port.ifs[0].status;
 646     pio_fis[16] = len & 255;
 647     pio_fis[17] = len >> 8;
 648     pio_fis[18] = 0;
 649     pio_fis[19] = 0;
 650
 651     /* Update shadow registers: */
 652     pr->tfdata = (ad->port.ifs[0].error << 8) |
 653         ad->port.ifs[0].status;
 654
 655     if (pio_fis[2] & ERR_STAT) {
 656         ahci_trigger_irq(ad->hba, ad, PORT_IRQ_TF_ERR);
 657     }
 658
 659     ahci_trigger_irq(ad->hba, ad, PORT_IRQ_PIOS_FIS);
 660
 661     dma_memory_unmap(ad->hba->as, cmd_fis, cmd_len,
 662                      DMA_DIRECTION_TO_DEVICE, cmd_len);
 663 }
 664
 665 static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis)
 666 {
 667     AHCIPortRegs *pr = &ad->port_regs;
 668     uint8_t *d2h_fis;
 669     int i;
 670     dma_addr_t cmd_len = 0x80;
 671     int cmd_mapped = 0;
 672
 673     if (!ad->res_fis || !(pr->cmd & PORT_CMD_FIS_RX)) {
 674         return;
 675     }
 676
 677     if (!cmd_fis) {
 678         /* map cmd_fis */
 679         uint64_t tbl_addr = le64_to_cpu(ad->cur_cmd->tbl_addr);
 680         cmd_fis = dma_memory_map(ad->hba->as, tbl_addr, &cmd_len,
 681                                  DMA_DIRECTION_TO_DEVICE);
 682         cmd_mapped = 1;
 683     }
 684
 685     d2h_fis = &ad->res_fis[RES_FIS_RFIS];
 686
 687     d2h_fis[0] = 0x34;
 688     d2h_fis[1] = (ad->hba->control_regs.irqstatus ? (1 << 6) : 0);
 689     d2h_fis[2] = ad->port.ifs[0].status;
 690     d2h_fis[3] = ad->port.ifs[0].error;
 691
 692     d2h_fis[4] = cmd_fis[4];
 693     d2h_fis[5] = cmd_fis[5];
 694     d2h_fis[6] = cmd_fis[6];
 695     d2h_fis[7] = cmd_fis[7];
 696     d2h_fis[8] = cmd_fis[8];
 697     d2h_fis[9] = cmd_fis[9];
 698     d2h_fis[10] = cmd_fis[10];
 699     d2h_fis[11] = cmd_fis[11];
 700     d2h_fis[12] = cmd_fis[12];
 701     d2h_fis[13] = cmd_fis[13];
 702     for (i = 14; i < 20; i++) {
 703         d2h_fis[i] = 0;
 704     }
 705
 706     /* Update shadow registers: */
 707     pr->tfdata = (ad->port.ifs[0].error << 8) |
 708         ad->port.ifs[0].status;
 709
 710     if (d2h_fis[2] & ERR_STAT) {
 711         ahci_trigger_irq(ad->hba, ad, PORT_IRQ_TF_ERR);
 712     }
 713
 714     ahci_trigger_irq(ad->hba, ad, PORT_IRQ_D2H_REG_FIS);
 715
 716     if (cmd_mapped) {
 717         dma_memory_unmap(ad->hba->as, cmd_fis, cmd_len,
 718                          DMA_DIRECTION_TO_DEVICE, cmd_len);
 719     }
 720 }
 721
 722 static int prdt_tbl_entry_size(const AHCI_SG *tbl)
 723 {
 724     return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1;
 725 }
 726
 727 static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
 728 {
 729     AHCICmdHdr *cmd = ad->cur_cmd;
 730     uint32_t opts = le32_to_cpu(cmd->opts);
 731     uint64_t prdt_addr = le64_to_cpu(cmd->tbl_addr) + 0x80;
 732     int sglist_alloc_hint = opts >> AHCI_CMD_HDR_PRDT_LEN;
 733     dma_addr_t prdt_len = (sglist_alloc_hint * sizeof(AHCI_SG));
 734     dma_addr_t real_prdt_len = prdt_len;
 735     uint8_t *prdt;
 736     int i;
 737     int r = 0;
 738     int sum = 0;
 739     int off_idx = -1;
 740     int off_pos = -1;
 741     int tbl_entry_size;
 742     IDEBus *bus = &ad->port;
 743     BusState *qbus = BUS(bus);
 744
 745     if (!sglist_alloc_hint) {
 746         DPRINTF(ad->port_no, "no sg list given by guest: 0x%08x\n", opts);
 747         return -1;
 748     }
 749
 750     /* map PRDT */
 751     if (!(prdt = dma_memory_map(ad->hba->as, prdt_addr, &prdt_len,
 752                                 DMA_DIRECTION_TO_DEVICE))){
 753         DPRINTF(ad->port_no, "map failed\n");
 754         return -1;
 755     }
 756
 757     if (prdt_len < real_prdt_len) {
 758         DPRINTF(ad->port_no, "mapped less than expected\n");
 759         r = -1;
 760         goto out;
 761     }
 762
 763     /* Get entries in the PRDT, init a qemu sglist accordingly */
 764     if (sglist_alloc_hint > 0) {
 765         AHCI_SG *tbl = (AHCI_SG *)prdt;
 766         sum = 0;
 767         for (i = 0; i < sglist_alloc_hint; i++) {
 768             /* flags_size is zero-based */
 769             tbl_entry_size = prdt_tbl_entry_size(&tbl[i]);
 770             if (offset <= (sum + tbl_entry_size)) {
 771                 off_idx = i;
 772                 off_pos = offset - sum;
 773                 break;
 774             }
 775             sum += tbl_entry_size;
 776         }
 777         if ((off_idx == -1) || (off_pos < 0) || (off_pos > tbl_entry_size)) {
 778             DPRINTF(ad->port_no, "%s: Incorrect offset! "
 779                             "off_idx: %d, off_pos: %d\n",
 780                             __func__, off_idx, off_pos);
 781             r = -1;
 782             goto out;
 783         }
 784
 785         qemu_sglist_init(sglist, qbus->parent, (sglist_alloc_hint - off_idx),
 786                          ad->hba->as);
 787         qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos),
 788                         prdt_tbl_entry_size(&tbl[off_idx]) - off_pos);
 789
 790         for (i = off_idx + 1; i < sglist_alloc_hint; i++) {
 791             /* flags_size is zero-based */
 792             qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
 793                             prdt_tbl_entry_size(&tbl[i]));
 794         }
 795     }
 796
 797 out:
 798     dma_memory_unmap(ad->hba->as, prdt, prdt_len,
 799                      DMA_DIRECTION_TO_DEVICE, prdt_len);
 800     return r;
 801 }
 802
 803 static void ncq_cb(void *opaque, int ret)
 804 {
 805     NCQTransferState *ncq_tfs = (NCQTransferState *)opaque;
 806     IDEState *ide_state = &ncq_tfs->drive->port.ifs[0];
 807
 808     if (ret == -ECANCELED) {
 809         return;
 810     }
 811     /* Clear bit for this tag in SActive */
 812     ncq_tfs->drive->port_regs.scr_act &= ~(1 << ncq_tfs->tag);
 813
 814     if (ret < 0) {
 815         /* error */
 816         ide_state->error = ABRT_ERR;
 817         ide_state->status = READY_STAT | ERR_STAT;
 818         ncq_tfs->drive->port_regs.scr_err |= (1 << ncq_tfs->tag);
 819     } else {
 820         ide_state->status = READY_STAT | SEEK_STAT;
 821     }
 822
 823     ahci_write_fis_sdb(ncq_tfs->drive->hba, ncq_tfs->drive->port_no,
 824                        (1 << ncq_tfs->tag));
 825
 826     DPRINTF(ncq_tfs->drive->port_no, "NCQ transfer tag %d finished\n",
 827             ncq_tfs->tag);
 828
 829     block_acct_done(bdrv_get_stats(ncq_tfs->drive->port.ifs[0].bs),
 830                     &ncq_tfs->acct);
 831     qemu_sglist_destroy(&ncq_tfs->sglist);
 832     ncq_tfs->used = 0;
 833 }
 834
 835 static void process_ncq_command(AHCIState *s, int port, uint8_t *cmd_fis,
 836                                 int slot)
 837 {
 838     NCQFrame *ncq_fis = (NCQFrame*)cmd_fis;
 839     uint8_t tag = ncq_fis->tag >> 3;
 840     NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[tag];
 841
 842     if (ncq_tfs->used) {
 843         /* error - already in use */
 844         fprintf(stderr, "%s: tag %d already used\n", __FUNCTION__, tag);
 845         return;
 846     }
 847
 848     ncq_tfs->used = 1;
 849     ncq_tfs->drive = &s->dev[port];
 850     ncq_tfs->slot = slot;
 851     ncq_tfs->lba = ((uint64_t)ncq_fis->lba5 << 40) |
 852                    ((uint64_t)ncq_fis->lba4 << 32) |
 853                    ((uint64_t)ncq_fis->lba3 << 24) |
 854                    ((uint64_t)ncq_fis->lba2 << 16) |
 855                    ((uint64_t)ncq_fis->lba1 << 8) |
 856                    (uint64_t)ncq_fis->lba0;
 857
 858     /* Note: We calculate the sector count, but don't currently rely on it.
 859      * The total size of the DMA buffer tells us the transfer size instead. */
 860     ncq_tfs->sector_count = ((uint16_t)ncq_fis->sector_count_high << 8) |
 861                                 ncq_fis->sector_count_low;
 862
 863     DPRINTF(port, "NCQ transfer LBA from %"PRId64" to %"PRId64", "
 864             "drive max %"PRId64"\n",
 865             ncq_tfs->lba, ncq_tfs->lba + ncq_tfs->sector_count - 2,
 866             s->dev[port].port.ifs[0].nb_sectors - 1);
 867
 868     ahci_populate_sglist(&s->dev[port], &ncq_tfs->sglist, 0);
 869     ncq_tfs->tag = tag;
 870
 871     switch(ncq_fis->command) {
 872         case READ_FPDMA_QUEUED:
 873             DPRINTF(port, "NCQ reading %d sectors from LBA %"PRId64", "
 874                     "tag %d\n",
 875                     ncq_tfs->sector_count-1, ncq_tfs->lba, ncq_tfs->tag);
 876
 877             DPRINTF(port, "tag %d aio read %"PRId64"\n",
 878                     ncq_tfs->tag, ncq_tfs->lba);
 879
 880             dma_acct_start(ncq_tfs->drive->port.ifs[0].bs, &ncq_tfs->acct,
 881                            &ncq_tfs->sglist, BLOCK_ACCT_READ);
 882             ncq_tfs->aiocb = dma_bdrv_read(ncq_tfs->drive->port.ifs[0].bs,
 883                                            &ncq_tfs->sglist, ncq_tfs->lba,
 884                                            ncq_cb, ncq_tfs);
 885             break;
 886         case WRITE_FPDMA_QUEUED:
 887             DPRINTF(port, "NCQ writing %d sectors to LBA %"PRId64", tag %d\n",
 888                     ncq_tfs->sector_count-1, ncq_tfs->lba, ncq_tfs->tag);
 889
 890             DPRINTF(port, "tag %d aio write %"PRId64"\n",
 891                     ncq_tfs->tag, ncq_tfs->lba);
 892
 893             dma_acct_start(ncq_tfs->drive->port.ifs[0].bs, &ncq_tfs->acct,
 894                            &ncq_tfs->sglist, BLOCK_ACCT_WRITE);
 895             ncq_tfs->aiocb = dma_bdrv_write(ncq_tfs->drive->port.ifs[0].bs,
 896                                             &ncq_tfs->sglist, ncq_tfs->lba,
 897                                             ncq_cb, ncq_tfs);
 898             break;
 899         default:
 900             DPRINTF(port, "error: tried to process non-NCQ command as NCQ\n");
 901             qemu_sglist_destroy(&ncq_tfs->sglist);
 902             break;
 903     }
 904 }
 905
 906 static int handle_cmd(AHCIState *s, int port, int slot)
 907 {
 908     IDEState *ide_state;
 909     uint32_t opts;
 910     uint64_t tbl_addr;
 911     AHCICmdHdr *cmd;
 912     uint8_t *cmd_fis;
 913     dma_addr_t cmd_len;
 914
 915     if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) {
 916         /* Engine currently busy, try again later */
 917         DPRINTF(port, "engine busy\n");
 918         return -1;
 919     }
 920
 921     cmd = &((AHCICmdHdr *)s->dev[port].lst)[slot];
 922
 923     if (!s->dev[port].lst) {
 924         DPRINTF(port, "error: lst not given but cmd handled");
 925         return -1;
 926     }
 927
 928     /* remember current slot handle for later */
 929     s->dev[port].cur_cmd = cmd;
 930
 931     opts = le32_to_cpu(cmd->opts);
 932     tbl_addr = le64_to_cpu(cmd->tbl_addr);
 933
 934     cmd_len = 0x80;
 935     cmd_fis = dma_memory_map(s->as, tbl_addr, &cmd_len,
 936                              DMA_DIRECTION_FROM_DEVICE);
 937
 938     if (!cmd_fis) {
 939         DPRINTF(port, "error: guest passed us an invalid cmd fis\n");
 940         return -1;
 941     }
 942
 943     /* The device we are working for */
 944     ide_state = &s->dev[port].port.ifs[0];
 945
 946     if (!ide_state->bs) {
 947         DPRINTF(port, "error: guest accessed unused port");
 948         goto out;
 949     }
 950
 951     debug_print_fis(cmd_fis, 0x90);
 952     //debug_print_fis(cmd_fis, (opts & AHCI_CMD_HDR_CMD_FIS_LEN) * 4);
 953
 954     switch (cmd_fis[0]) {
 955         case SATA_FIS_TYPE_REGISTER_H2D:
 956             break;
 957         default:
 958             DPRINTF(port, "unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "
 959                           "cmd_fis[2]=%02x\n", cmd_fis[0], cmd_fis[1],
 960                           cmd_fis[2]);
 961             goto out;
 962             break;
 963     }
 964
 965     switch (cmd_fis[1]) {
 966         case SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER:
 967             break;
 968         case 0:
 969             break;
 970         default:
 971             DPRINTF(port, "unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "
 972                           "cmd_fis[2]=%02x\n", cmd_fis[0], cmd_fis[1],
 973                           cmd_fis[2]);
 974             goto out;
 975             break;
 976     }
 977
 978     switch (s->dev[port].port_state) {
 979         case STATE_RUN:
 980             if (cmd_fis[15] & ATA_SRST) {
 981                 s->dev[port].port_state = STATE_RESET;
 982             }
 983             break;
 984         case STATE_RESET:
 985             if (!(cmd_fis[15] & ATA_SRST)) {
 986                 ahci_reset_port(s, port);
 987             }
 988             break;
 989     }
 990
 991     if (cmd_fis[1] == SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER) {
 992
 993         /* Check for NCQ command */
 994         if ((cmd_fis[2] == READ_FPDMA_QUEUED) ||
 995             (cmd_fis[2] == WRITE_FPDMA_QUEUED)) {
 996             process_ncq_command(s, port, cmd_fis, slot);
 997             goto out;
 998         }
 999
1000         /* Decompose the FIS  */
1001         ide_state->nsector = (int64_t)((cmd_fis[13] << 8) | cmd_fis[12]);
1002         ide_state->feature = cmd_fis[3];
1003         if (!ide_state->nsector) {
1004             ide_state->nsector = 256;
1005         }
1006
1007         if (ide_state->drive_kind != IDE_CD) {
1008             /*
1009              * We set the sector depending on the sector defined in the FIS.
1010              * Unfortunately, the spec isn't exactly obvious on this one.
1011              *
1012              * Apparently LBA48 commands set fis bytes 10,9,8,6,5,4 to the
1013              * 48 bit sector number. ATA_CMD_READ_DMA_EXT is an example for
1014              * such a command.
1015              *
1016              * Non-LBA48 commands however use 7[lower 4 bits],6,5,4 to define a
1017              * 28-bit sector number. ATA_CMD_READ_DMA is an example for such
1018              * a command.
1019              *
1020              * Since the spec doesn't explicitly state what each field should
1021              * do, I simply assume non-used fields as reserved and OR everything
1022              * together, independent of the command.
1023              */
1024             ide_set_sector(ide_state, ((uint64_t)cmd_fis[10] << 40)
1025                                     | ((uint64_t)cmd_fis[9] << 32)
1026                                     /* This is used for LBA48 commands */
1027                                     | ((uint64_t)cmd_fis[8] << 24)
1028                                     /* This is used for non-LBA48 commands */
1029                                     | ((uint64_t)(cmd_fis[7] & 0xf) << 24)
1030                                     | ((uint64_t)cmd_fis[6] << 16)
1031                                     | ((uint64_t)cmd_fis[5] << 8)
1032                                     | cmd_fis[4]);
1033         }
1034
1035         /* Copy the ACMD field (ATAPI packet, if any) from the AHCI command
1036          * table to ide_state->io_buffer
1037          */
1038         if (opts & AHCI_CMD_ATAPI) {
1039             memcpy(ide_state->io_buffer, &cmd_fis[AHCI_COMMAND_TABLE_ACMD], 0x10);
1040             ide_state->lcyl = 0x14;
1041             ide_state->hcyl = 0xeb;
1042             debug_print_fis(ide_state->io_buffer, 0x10);
1043             ide_state->feature = IDE_FEATURE_DMA;
1044             s->dev[port].done_atapi_packet = false;
1045             /* XXX send PIO setup FIS */
1046         }
1047
1048         ide_state->error = 0;
1049
1050         /* Reset transferred byte counter */
1051         cmd->status = 0;
1052
1053         /* We're ready to process the command in FIS byte 2. */
1054         ide_exec_cmd(&s->dev[port].port, cmd_fis[2]);
1055     }
1056
1057 out:
1058     dma_memory_unmap(s->as, cmd_fis, cmd_len, DMA_DIRECTION_FROM_DEVICE,
1059                      cmd_len);
1060
1061     if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) {
1062         /* async command, complete later */
1063         s->dev[port].busy_slot = slot;
1064         return -1;
1065     }
1066
1067     /* done handling the command */
1068     return 0;
1069 }
1070
1071 /* DMA dev <-> ram */
1072 static void ahci_start_transfer(IDEDMA *dma)
1073 {
1074     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1075     IDEState *s = &ad->port.ifs[0];
1076     uint32_t size = (uint32_t)(s->data_end - s->data_ptr);
1077     /* write == ram -> device */
1078     uint32_t opts = le32_to_cpu(ad->cur_cmd->opts);
1079     int is_write = opts & AHCI_CMD_WRITE;
1080     int is_atapi = opts & AHCI_CMD_ATAPI;
1081     int has_sglist = 0;
1082
1083     if (is_atapi && !ad->done_atapi_packet) {
1084         /* already prepopulated iobuffer */
1085         ad->done_atapi_packet = true;
1086         goto out;
1087     }
1088
1089     if (!ahci_populate_sglist(ad, &s->sg, 0)) {
1090         has_sglist = 1;
1091     }
1092
1093     DPRINTF(ad->port_no, "%sing %d bytes on %s w/%s sglist\n",
1094             is_write ? "writ" : "read", size, is_atapi ? "atapi" : "ata",
1095             has_sglist ? "" : "o");
1096
1097     if (has_sglist && size) {
1098         if (is_write) {
1099             dma_buf_write(s->data_ptr, size, &s->sg);
1100         } else {
1101             dma_buf_read(s->data_ptr, size, &s->sg);
1102         }
1103     }
1104
1105     /* update number of transferred bytes */
1106     ad->cur_cmd->status = cpu_to_le32(le32_to_cpu(ad->cur_cmd->status) + size);
1107
1108 out:
1109     /* declare that we processed everything */
1110     s->data_ptr = s->data_end;
1111
1112     if (has_sglist) {
1113         qemu_sglist_destroy(&s->sg);
1114     }
1115
1116     s->end_transfer_func(s);
1117
1118     if (!(s->status & DRQ_STAT)) {
1119         /* done with PIO send/receive */
1120         ahci_write_fis_pio(ad, le32_to_cpu(ad->cur_cmd->status));
1121     }
1122 }
1123
1124 static void ahci_start_dma(IDEDMA *dma, IDEState *s,
1125                            BlockCompletionFunc *dma_cb)
1126 {
1127 #ifdef DEBUG_AHCI
1128     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1129 #endif
1130     DPRINTF(ad->port_no, "\n");
1131     s->io_buffer_offset = 0;
1132     dma_cb(s, 0);
1133 }
1134
1135 static int ahci_dma_prepare_buf(IDEDMA *dma, int is_write)
1136 {
1137     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1138     IDEState *s = &ad->port.ifs[0];
1139
1140     ahci_populate_sglist(ad, &s->sg, 0);
1141     s->io_buffer_size = s->sg.size;
1142
1143     DPRINTF(ad->port_no, "len=%#x\n", s->io_buffer_size);
1144     return s->io_buffer_size != 0;
1145 }
1146
1147 static int ahci_dma_rw_buf(IDEDMA *dma, int is_write)
1148 {
1149     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1150     IDEState *s = &ad->port.ifs[0];
1151     uint8_t *p = s->io_buffer + s->io_buffer_index;
1152     int l = s->io_buffer_size - s->io_buffer_index;
1153
1154     if (ahci_populate_sglist(ad, &s->sg, s->io_buffer_offset)) {
1155         return 0;
1156     }
1157
1158     if (is_write) {
1159         dma_buf_read(p, l, &s->sg);
1160     } else {
1161         dma_buf_write(p, l, &s->sg);
1162     }
1163
1164     /* free sglist that was created in ahci_populate_sglist() */
1165     qemu_sglist_destroy(&s->sg);
1166
1167     /* update number of transferred bytes */
1168     ad->cur_cmd->status = cpu_to_le32(le32_to_cpu(ad->cur_cmd->status) + l);
1169     s->io_buffer_index += l;
1170     s->io_buffer_offset += l;
1171
1172     DPRINTF(ad->port_no, "len=%#x\n", l);
1173
1174     return 1;
1175 }
1176
1177 static int ahci_dma_set_unit(IDEDMA *dma, int unit)
1178 {
1179     /* only a single unit per link */
1180     return 0;
1181 }
1182
1183 static void ahci_cmd_done(IDEDMA *dma)
1184 {
1185     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1186
1187     DPRINTF(ad->port_no, "cmd done\n");
1188
1189     /* update d2h status */
1190     ahci_write_fis_d2h(ad, NULL);
1191
1192     if (!ad->check_bh) {
1193         /* maybe we still have something to process, check later */
1194         ad->check_bh = qemu_bh_new(ahci_check_cmd_bh, ad);
1195         qemu_bh_schedule(ad->check_bh);
1196     }
1197 }
1198
1199 static void ahci_irq_set(void *opaque, int n, int level)
1200 {
1201 }
1202
1203 static void ahci_dma_restart_cb(void *opaque, int running, RunState state)
1204 {
1205 }
1206
1207 static const IDEDMAOps ahci_dma_ops = {
1208     .start_dma = ahci_start_dma,
1209     .start_transfer = ahci_start_transfer,
1210     .prepare_buf = ahci_dma_prepare_buf,
1211     .rw_buf = ahci_dma_rw_buf,
1212     .set_unit = ahci_dma_set_unit,
1213     .cmd_done = ahci_cmd_done,
1214     .restart_cb = ahci_dma_restart_cb,
1215 };
1216
1217 void ahci_init(AHCIState *s, DeviceState *qdev, AddressSpace *as, int ports)
1218 {
1219     qemu_irq *irqs;
1220     int i;
1221
1222     s->as = as;
1223     s->ports = ports;
1224     s->dev = g_new0(AHCIDevice, ports);
1225     ahci_reg_init(s);
1226     /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
1227     memory_region_init_io(&s->mem, OBJECT(qdev), &ahci_mem_ops, s,
1228                           "ahci", AHCI_MEM_BAR_SIZE);
1229     memory_region_init_io(&s->idp, OBJECT(qdev), &ahci_idp_ops, s,
1230                           "ahci-idp", 32);
1231
1232     irqs = qemu_allocate_irqs(ahci_irq_set, s, s->ports);
1233
1234     for (i = 0; i < s->ports; i++) {
1235         AHCIDevice *ad = &s->dev[i];
1236
1237         ide_bus_new(&ad->port, sizeof(ad->port), qdev, i, 1);
1238         ide_init2(&ad->port, irqs[i]);
1239
1240         ad->hba = s;
1241         ad->port_no = i;
1242         ad->port.dma = &ad->dma;
1243         ad->port.dma->ops = &ahci_dma_ops;
1244     }
1245 }
1246
1247 void ahci_uninit(AHCIState *s)
1248 {
1249     g_free(s->dev);
1250 }
1251
1252 void ahci_reset(AHCIState *s)
1253 {
1254     AHCIPortRegs *pr;
1255     int i;
1256
1257     s->control_regs.irqstatus = 0;
1258     /* AHCI Enable (AE)
1259      * The implementation of this bit is dependent upon the value of the
1260      * CAP.SAM bit. If CAP.SAM is '0', then GHC.AE shall be read-write and
1261      * shall have a reset value of '0'. If CAP.SAM is '1', then AE shall be
1262      * read-only and shall have a reset value of '1'.
1263      *
1264      * We set HOST_CAP_AHCI so we must enable AHCI at reset.
1265      */
1266     s->control_regs.ghc = HOST_CTL_AHCI_EN;
1267
1268     for (i = 0; i < s->ports; i++) {
1269         pr = &s->dev[i].port_regs;
1270         pr->irq_stat = 0;
1271         pr->irq_mask = 0;
1272         pr->scr_ctl = 0;
1273         pr->cmd = PORT_CMD_SPIN_UP | PORT_CMD_POWER_ON;
1274         ahci_reset_port(s, i);
1275     }
1276 }
1277
1278 static const VMStateDescription vmstate_ahci_device = {
1279     .name = "ahci port",
1280     .version_id = 1,
1281     .fields = (VMStateField[]) {
1282         VMSTATE_IDE_BUS(port, AHCIDevice),
1283         VMSTATE_UINT32(port_state, AHCIDevice),
1284         VMSTATE_UINT32(finished, AHCIDevice),
1285         VMSTATE_UINT32(port_regs.lst_addr, AHCIDevice),
1286         VMSTATE_UINT32(port_regs.lst_addr_hi, AHCIDevice),
1287         VMSTATE_UINT32(port_regs.fis_addr, AHCIDevice),
1288         VMSTATE_UINT32(port_regs.fis_addr_hi, AHCIDevice),
1289         VMSTATE_UINT32(port_regs.irq_stat, AHCIDevice),
1290         VMSTATE_UINT32(port_regs.irq_mask, AHCIDevice),
1291         VMSTATE_UINT32(port_regs.cmd, AHCIDevice),
1292         VMSTATE_UINT32(port_regs.tfdata, AHCIDevice),
1293         VMSTATE_UINT32(port_regs.sig, AHCIDevice),
1294         VMSTATE_UINT32(port_regs.scr_stat, AHCIDevice),
1295         VMSTATE_UINT32(port_regs.scr_ctl, AHCIDevice),
1296         VMSTATE_UINT32(port_regs.scr_err, AHCIDevice),
1297         VMSTATE_UINT32(port_regs.scr_act, AHCIDevice),
1298         VMSTATE_UINT32(port_regs.cmd_issue, AHCIDevice),
1299         VMSTATE_BOOL(done_atapi_packet, AHCIDevice),
1300         VMSTATE_INT32(busy_slot, AHCIDevice),
1301         VMSTATE_BOOL(init_d2h_sent, AHCIDevice),
1302         VMSTATE_END_OF_LIST()
1303     },
1304 };
1305
1306 static int ahci_state_post_load(void *opaque, int version_id)
1307 {
1308     int i;
1309     struct AHCIDevice *ad;
1310     AHCIState *s = opaque;
1311
1312     for (i = 0; i < s->ports; i++) {
1313         ad = &s->dev[i];
1314         AHCIPortRegs *pr = &ad->port_regs;
1315
1316         map_page(s->as, &ad->lst,
1317                  ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
1318         map_page(s->as, &ad->res_fis,
1319                  ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
1320         /*
1321          * All pending i/o should be flushed out on a migrate. However,
1322          * we might not have cleared the busy_slot since this is done
1323          * in a bh. Also, issue i/o against any slots that are pending.
1324          */
1325         if ((ad->busy_slot != -1) &&
1326             !(ad->port.ifs[0].status & (BUSY_STAT|DRQ_STAT))) {
1327             pr->cmd_issue &= ~(1 << ad->busy_slot);
1328             ad->busy_slot = -1;
1329         }
1330         check_cmd(s, i);
1331     }
1332
1333     return 0;
1334 }
1335
1336 const VMStateDescription vmstate_ahci = {
1337     .name = "ahci",
1338     .version_id = 1,
1339     .post_load = ahci_state_post_load,
1340     .fields = (VMStateField[]) {
1341         VMSTATE_STRUCT_VARRAY_POINTER_INT32(dev, AHCIState, ports,
1342                                      vmstate_ahci_device, AHCIDevice),
1343         VMSTATE_UINT32(control_regs.cap, AHCIState),
1344         VMSTATE_UINT32(control_regs.ghc, AHCIState),
1345         VMSTATE_UINT32(control_regs.irqstatus, AHCIState),
1346         VMSTATE_UINT32(control_regs.impl, AHCIState),
1347         VMSTATE_UINT32(control_regs.version, AHCIState),
1348         VMSTATE_UINT32(idp_index, AHCIState),
1349         VMSTATE_INT32_EQUAL(ports, AHCIState),
1350         VMSTATE_END_OF_LIST()
1351     },
1352 };
1353
1354 #define TYPE_SYSBUS_AHCI "sysbus-ahci"
1355 #define SYSBUS_AHCI(obj) OBJECT_CHECK(SysbusAHCIState, (obj), TYPE_SYSBUS_AHCI)
1356
1357 typedef struct SysbusAHCIState {
1358     /*< private >*/
1359     SysBusDevice parent_obj;
1360     /*< public >*/
1361
1362     AHCIState ahci;
1363     uint32_t num_ports;
1364 } SysbusAHCIState;
1365
1366 static const VMStateDescription vmstate_sysbus_ahci = {
1367     .name = "sysbus-ahci",
1368     .unmigratable = 1, /* Still buggy under I/O load */
1369     .fields = (VMStateField[]) {
1370         VMSTATE_AHCI(ahci, SysbusAHCIState),
1371         VMSTATE_END_OF_LIST()
1372     },
1373 };
1374
1375 static void sysbus_ahci_reset(DeviceState *dev)
1376 {
1377     SysbusAHCIState *s = SYSBUS_AHCI(dev);
1378
1379     ahci_reset(&s->ahci);
1380 }
1381
1382 static void sysbus_ahci_realize(DeviceState *dev, Error **errp)
1383 {
1384     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1385     SysbusAHCIState *s = SYSBUS_AHCI(dev);
1386
1387     ahci_init(&s->ahci, dev, &address_space_memory, s->num_ports);
1388
1389     sysbus_init_mmio(sbd, &s->ahci.mem);
1390     sysbus_init_irq(sbd, &s->ahci.irq);
1391 }
1392
1393 static Property sysbus_ahci_properties[] = {
1394     DEFINE_PROP_UINT32("num-ports", SysbusAHCIState, num_ports, 1),
1395     DEFINE_PROP_END_OF_LIST(),
1396 };
1397
1398 static void sysbus_ahci_class_init(ObjectClass *klass, void *data)
1399 {
1400     DeviceClass *dc = DEVICE_CLASS(klass);
1401
1402     dc->realize = sysbus_ahci_realize;
1403     dc->vmsd = &vmstate_sysbus_ahci;
1404     dc->props = sysbus_ahci_properties;
1405     dc->reset = sysbus_ahci_reset;
1406     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1407 }
1408
1409 static const TypeInfo sysbus_ahci_info = {
1410     .name          = TYPE_SYSBUS_AHCI,
1411     .parent        = TYPE_SYS_BUS_DEVICE,
1412     .instance_size = sizeof(SysbusAHCIState),
1413     .class_init    = sysbus_ahci_class_init,
1414 };
1415
1416 static void sysbus_ahci_register_types(void)
1417 {
1418     type_register_static(&sysbus_ahci_info);
1419 }
1420
1421 type_init(sysbus_ahci_register_types)
1422
1423 void ahci_ide_create_devs(PCIDevice *dev, DriveInfo **hd)
1424 {
1425     AHCIPCIState *d = ICH_AHCI(dev);
1426     AHCIState *ahci = &d->ahci;
1427     int i;
1428
1429     for (i = 0; i < ahci->ports; i++) {
1430         if (hd[i] == NULL) {
1431             continue;
1432         }
1433         ide_create_drive(&ahci->dev[i].port, 0, hd[i]);
1434     }
1435
1436 }