xref: /openbmc/qemu/hw/ide/ahci.c (revision eabb9212)
1 /*
2  * QEMU AHCI Emulation
3  *
4  * Copyright (c) 2010 qiaochong@loongson.cn
5  * Copyright (c) 2010 Roland Elek <elek.roland@gmail.com>
6  * Copyright (c) 2010 Sebastian Herbszt <herbszt@gmx.de>
7  * Copyright (c) 2010 Alexander Graf <agraf@suse.de>
8  *
9  * This library is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU Lesser General Public
11  * License as published by the Free Software Foundation; either
12  * version 2.1 of the License, or (at your option) any later version.
13  *
14  * This library is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
17  * Lesser General Public License for more details.
18  *
19  * You should have received a copy of the GNU Lesser General Public
20  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21  *
22  */
23 
24 #include "qemu/osdep.h"
25 #include "hw/irq.h"
26 #include "hw/pci/msi.h"
27 #include "hw/pci/pci.h"
28 #include "hw/qdev-properties.h"
29 #include "migration/vmstate.h"
30 
31 #include "qemu/error-report.h"
32 #include "qemu/log.h"
33 #include "qemu/main-loop.h"
34 #include "qemu/module.h"
35 #include "sysemu/block-backend.h"
36 #include "sysemu/dma.h"
37 #include "hw/ide/internal.h"
38 #include "hw/ide/pci.h"
39 #include "ahci_internal.h"
40 
41 #include "trace.h"
42 
43 static void check_cmd(AHCIState *s, int port);
44 static void handle_cmd(AHCIState *s, int port, uint8_t slot);
45 static void ahci_reset_port(AHCIState *s, int port);
46 static bool ahci_write_fis_d2h(AHCIDevice *ad, bool d2h_fis_i);
47 static void ahci_clear_cmd_issue(AHCIDevice *ad, uint8_t slot);
48 static void ahci_init_d2h(AHCIDevice *ad);
49 static int ahci_dma_prepare_buf(const IDEDMA *dma, int32_t limit);
50 static bool ahci_map_clb_address(AHCIDevice *ad);
51 static bool ahci_map_fis_address(AHCIDevice *ad);
52 static void ahci_unmap_clb_address(AHCIDevice *ad);
53 static void ahci_unmap_fis_address(AHCIDevice *ad);
54 
55 static const char *AHCIHostReg_lookup[AHCI_HOST_REG__COUNT] = {
56     [AHCI_HOST_REG_CAP]        = "CAP",
57     [AHCI_HOST_REG_CTL]        = "GHC",
58     [AHCI_HOST_REG_IRQ_STAT]   = "IS",
59     [AHCI_HOST_REG_PORTS_IMPL] = "PI",
60     [AHCI_HOST_REG_VERSION]    = "VS",
61     [AHCI_HOST_REG_CCC_CTL]    = "CCC_CTL",
62     [AHCI_HOST_REG_CCC_PORTS]  = "CCC_PORTS",
63     [AHCI_HOST_REG_EM_LOC]     = "EM_LOC",
64     [AHCI_HOST_REG_EM_CTL]     = "EM_CTL",
65     [AHCI_HOST_REG_CAP2]       = "CAP2",
66     [AHCI_HOST_REG_BOHC]       = "BOHC",
67 };
68 
69 static const char *AHCIPortReg_lookup[AHCI_PORT_REG__COUNT] = {
70     [AHCI_PORT_REG_LST_ADDR]    = "PxCLB",
71     [AHCI_PORT_REG_LST_ADDR_HI] = "PxCLBU",
72     [AHCI_PORT_REG_FIS_ADDR]    = "PxFB",
73     [AHCI_PORT_REG_FIS_ADDR_HI] = "PxFBU",
74     [AHCI_PORT_REG_IRQ_STAT]    = "PxIS",
75     [AHCI_PORT_REG_IRQ_MASK]    = "PXIE",
76     [AHCI_PORT_REG_CMD]         = "PxCMD",
77     [7]                         = "Reserved",
78     [AHCI_PORT_REG_TFDATA]      = "PxTFD",
79     [AHCI_PORT_REG_SIG]         = "PxSIG",
80     [AHCI_PORT_REG_SCR_STAT]    = "PxSSTS",
81     [AHCI_PORT_REG_SCR_CTL]     = "PxSCTL",
82     [AHCI_PORT_REG_SCR_ERR]     = "PxSERR",
83     [AHCI_PORT_REG_SCR_ACT]     = "PxSACT",
84     [AHCI_PORT_REG_CMD_ISSUE]   = "PxCI",
85     [AHCI_PORT_REG_SCR_NOTIF]   = "PxSNTF",
86     [AHCI_PORT_REG_FIS_CTL]     = "PxFBS",
87     [AHCI_PORT_REG_DEV_SLEEP]   = "PxDEVSLP",
88     [18 ... 27]                 = "Reserved",
89     [AHCI_PORT_REG_VENDOR_1 ...
90      AHCI_PORT_REG_VENDOR_4]    = "PxVS",
91 };
92 
93 static const char *AHCIPortIRQ_lookup[AHCI_PORT_IRQ__COUNT] = {
94     [AHCI_PORT_IRQ_BIT_DHRS] = "DHRS",
95     [AHCI_PORT_IRQ_BIT_PSS]  = "PSS",
96     [AHCI_PORT_IRQ_BIT_DSS]  = "DSS",
97     [AHCI_PORT_IRQ_BIT_SDBS] = "SDBS",
98     [AHCI_PORT_IRQ_BIT_UFS]  = "UFS",
99     [AHCI_PORT_IRQ_BIT_DPS]  = "DPS",
100     [AHCI_PORT_IRQ_BIT_PCS]  = "PCS",
101     [AHCI_PORT_IRQ_BIT_DMPS] = "DMPS",
102     [8 ... 21]               = "RESERVED",
103     [AHCI_PORT_IRQ_BIT_PRCS] = "PRCS",
104     [AHCI_PORT_IRQ_BIT_IPMS] = "IPMS",
105     [AHCI_PORT_IRQ_BIT_OFS]  = "OFS",
106     [25]                     = "RESERVED",
107     [AHCI_PORT_IRQ_BIT_INFS] = "INFS",
108     [AHCI_PORT_IRQ_BIT_IFS]  = "IFS",
109     [AHCI_PORT_IRQ_BIT_HBDS] = "HBDS",
110     [AHCI_PORT_IRQ_BIT_HBFS] = "HBFS",
111     [AHCI_PORT_IRQ_BIT_TFES] = "TFES",
112     [AHCI_PORT_IRQ_BIT_CPDS] = "CPDS"
113 };
114 
115 static uint32_t ahci_port_read(AHCIState *s, int port, int offset)
116 {
117     uint32_t val;
118     AHCIPortRegs *pr = &s->dev[port].port_regs;
119     enum AHCIPortReg regnum = offset / sizeof(uint32_t);
120     assert(regnum < (AHCI_PORT_ADDR_OFFSET_LEN / sizeof(uint32_t)));
121 
122     switch (regnum) {
123     case AHCI_PORT_REG_LST_ADDR:
124         val = pr->lst_addr;
125         break;
126     case AHCI_PORT_REG_LST_ADDR_HI:
127         val = pr->lst_addr_hi;
128         break;
129     case AHCI_PORT_REG_FIS_ADDR:
130         val = pr->fis_addr;
131         break;
132     case AHCI_PORT_REG_FIS_ADDR_HI:
133         val = pr->fis_addr_hi;
134         break;
135     case AHCI_PORT_REG_IRQ_STAT:
136         val = pr->irq_stat;
137         break;
138     case AHCI_PORT_REG_IRQ_MASK:
139         val = pr->irq_mask;
140         break;
141     case AHCI_PORT_REG_CMD:
142         val = pr->cmd;
143         break;
144     case AHCI_PORT_REG_TFDATA:
145         val = pr->tfdata;
146         break;
147     case AHCI_PORT_REG_SIG:
148         val = pr->sig;
149         break;
150     case AHCI_PORT_REG_SCR_STAT:
151         if (s->dev[port].port.ifs[0].blk) {
152             val = SATA_SCR_SSTATUS_DET_DEV_PRESENT_PHY_UP |
153                   SATA_SCR_SSTATUS_SPD_GEN1 | SATA_SCR_SSTATUS_IPM_ACTIVE;
154         } else {
155             val = SATA_SCR_SSTATUS_DET_NODEV;
156         }
157         break;
158     case AHCI_PORT_REG_SCR_CTL:
159         val = pr->scr_ctl;
160         break;
161     case AHCI_PORT_REG_SCR_ERR:
162         val = pr->scr_err;
163         break;
164     case AHCI_PORT_REG_SCR_ACT:
165         val = pr->scr_act;
166         break;
167     case AHCI_PORT_REG_CMD_ISSUE:
168         val = pr->cmd_issue;
169         break;
170     default:
171         trace_ahci_port_read_default(s, port, AHCIPortReg_lookup[regnum],
172                                      offset);
173         val = 0;
174     }
175 
176     trace_ahci_port_read(s, port, AHCIPortReg_lookup[regnum], offset, val);
177     return val;
178 }
179 
180 static void ahci_irq_raise(AHCIState *s)
181 {
182     DeviceState *dev_state = s->container;
183     PCIDevice *pci_dev = (PCIDevice *) object_dynamic_cast(OBJECT(dev_state),
184                                                            TYPE_PCI_DEVICE);
185 
186     trace_ahci_irq_raise(s);
187 
188     if (pci_dev && msi_enabled(pci_dev)) {
189         msi_notify(pci_dev, 0);
190     } else {
191         qemu_irq_raise(s->irq);
192     }
193 }
194 
195 static void ahci_irq_lower(AHCIState *s)
196 {
197     DeviceState *dev_state = s->container;
198     PCIDevice *pci_dev = (PCIDevice *) object_dynamic_cast(OBJECT(dev_state),
199                                                            TYPE_PCI_DEVICE);
200 
201     trace_ahci_irq_lower(s);
202 
203     if (!pci_dev || !msi_enabled(pci_dev)) {
204         qemu_irq_lower(s->irq);
205     }
206 }
207 
208 static void ahci_check_irq(AHCIState *s)
209 {
210     int i;
211     uint32_t old_irq = s->control_regs.irqstatus;
212 
213     s->control_regs.irqstatus = 0;
214     for (i = 0; i < s->ports; i++) {
215         AHCIPortRegs *pr = &s->dev[i].port_regs;
216         if (pr->irq_stat & pr->irq_mask) {
217             s->control_regs.irqstatus |= (1 << i);
218         }
219     }
220     trace_ahci_check_irq(s, old_irq, s->control_regs.irqstatus);
221     if (s->control_regs.irqstatus &&
222         (s->control_regs.ghc & HOST_CTL_IRQ_EN)) {
223             ahci_irq_raise(s);
224     } else {
225         ahci_irq_lower(s);
226     }
227 }
228 
229 static void ahci_trigger_irq(AHCIState *s, AHCIDevice *d,
230                              enum AHCIPortIRQ irqbit)
231 {
232     g_assert((unsigned)irqbit < 32);
233     uint32_t irq = 1U << irqbit;
234     uint32_t irqstat = d->port_regs.irq_stat | irq;
235 
236     trace_ahci_trigger_irq(s, d->port_no,
237                            AHCIPortIRQ_lookup[irqbit], irq,
238                            d->port_regs.irq_stat, irqstat,
239                            irqstat & d->port_regs.irq_mask);
240 
241     d->port_regs.irq_stat = irqstat;
242     ahci_check_irq(s);
243 }
244 
245 static void map_page(AddressSpace *as, uint8_t **ptr, uint64_t addr,
246                      uint32_t wanted)
247 {
248     hwaddr len = wanted;
249 
250     if (*ptr) {
251         dma_memory_unmap(as, *ptr, len, DMA_DIRECTION_FROM_DEVICE, len);
252     }
253 
254     *ptr = dma_memory_map(as, addr, &len, DMA_DIRECTION_FROM_DEVICE,
255                           MEMTXATTRS_UNSPECIFIED);
256     if (len < wanted && *ptr) {
257         dma_memory_unmap(as, *ptr, len, DMA_DIRECTION_FROM_DEVICE, len);
258         *ptr = NULL;
259     }
260 }
261 
262 /**
263  * Check the cmd register to see if we should start or stop
264  * the DMA or FIS RX engines.
265  *
266  * @ad: Device to dis/engage.
267  *
268  * @return 0 on success, -1 on error.
269  */
270 static int ahci_cond_start_engines(AHCIDevice *ad)
271 {
272     AHCIPortRegs *pr = &ad->port_regs;
273     bool cmd_start = pr->cmd & PORT_CMD_START;
274     bool cmd_on    = pr->cmd & PORT_CMD_LIST_ON;
275     bool fis_start = pr->cmd & PORT_CMD_FIS_RX;
276     bool fis_on    = pr->cmd & PORT_CMD_FIS_ON;
277 
278     if (cmd_start && !cmd_on) {
279         if (!ahci_map_clb_address(ad)) {
280             pr->cmd &= ~PORT_CMD_START;
281             error_report("AHCI: Failed to start DMA engine: "
282                          "bad command list buffer address");
283             return -1;
284         }
285     } else if (!cmd_start && cmd_on) {
286         ahci_unmap_clb_address(ad);
287     }
288 
289     if (fis_start && !fis_on) {
290         if (!ahci_map_fis_address(ad)) {
291             pr->cmd &= ~PORT_CMD_FIS_RX;
292             error_report("AHCI: Failed to start FIS receive engine: "
293                          "bad FIS receive buffer address");
294             return -1;
295         }
296     } else if (!fis_start && fis_on) {
297         ahci_unmap_fis_address(ad);
298     }
299 
300     return 0;
301 }
302 
303 static void ahci_port_write(AHCIState *s, int port, int offset, uint32_t val)
304 {
305     AHCIPortRegs *pr = &s->dev[port].port_regs;
306     enum AHCIPortReg regnum = offset / sizeof(uint32_t);
307     assert(regnum < (AHCI_PORT_ADDR_OFFSET_LEN / sizeof(uint32_t)));
308     trace_ahci_port_write(s, port, AHCIPortReg_lookup[regnum], offset, val);
309 
310     switch (regnum) {
311     case AHCI_PORT_REG_LST_ADDR:
312         pr->lst_addr = val;
313         break;
314     case AHCI_PORT_REG_LST_ADDR_HI:
315         pr->lst_addr_hi = val;
316         break;
317     case AHCI_PORT_REG_FIS_ADDR:
318         pr->fis_addr = val;
319         break;
320     case AHCI_PORT_REG_FIS_ADDR_HI:
321         pr->fis_addr_hi = val;
322         break;
323     case AHCI_PORT_REG_IRQ_STAT:
324         pr->irq_stat &= ~val;
325         ahci_check_irq(s);
326         break;
327     case AHCI_PORT_REG_IRQ_MASK:
328         pr->irq_mask = val & 0xfdc000ff;
329         ahci_check_irq(s);
330         break;
331     case AHCI_PORT_REG_CMD:
332         if ((pr->cmd & PORT_CMD_START) && !(val & PORT_CMD_START)) {
333             pr->scr_act = 0;
334             pr->cmd_issue = 0;
335         }
336 
337         /* Block any Read-only fields from being set;
338          * including LIST_ON and FIS_ON.
339          * The spec requires to set ICC bits to zero after the ICC change
340          * is done. We don't support ICC state changes, therefore always
341          * force the ICC bits to zero.
342          */
343         pr->cmd = (pr->cmd & PORT_CMD_RO_MASK) |
344             (val & ~(PORT_CMD_RO_MASK | PORT_CMD_ICC_MASK));
345 
346         /* Check FIS RX and CLB engines */
347         ahci_cond_start_engines(&s->dev[port]);
348 
349         /* XXX usually the FIS would be pending on the bus here and
350            issuing deferred until the OS enables FIS receival.
351            Instead, we only submit it once - which works in most
352            cases, but is a hack. */
353         if ((pr->cmd & PORT_CMD_FIS_ON) &&
354             !s->dev[port].init_d2h_sent) {
355             ahci_init_d2h(&s->dev[port]);
356         }
357 
358         check_cmd(s, port);
359         break;
360     case AHCI_PORT_REG_TFDATA:
361     case AHCI_PORT_REG_SIG:
362     case AHCI_PORT_REG_SCR_STAT:
363         /* Read Only */
364         break;
365     case AHCI_PORT_REG_SCR_CTL:
366         if (((pr->scr_ctl & AHCI_SCR_SCTL_DET) == 1) &&
367             ((val & AHCI_SCR_SCTL_DET) == 0)) {
368             ahci_reset_port(s, port);
369         }
370         pr->scr_ctl = val;
371         break;
372     case AHCI_PORT_REG_SCR_ERR:
373         pr->scr_err &= ~val;
374         break;
375     case AHCI_PORT_REG_SCR_ACT:
376         /* RW1 */
377         pr->scr_act |= val;
378         break;
379     case AHCI_PORT_REG_CMD_ISSUE:
380         pr->cmd_issue |= val;
381         check_cmd(s, port);
382         break;
383     default:
384         trace_ahci_port_write_unimpl(s, port, AHCIPortReg_lookup[regnum],
385                                      offset, val);
386         qemu_log_mask(LOG_UNIMP, "Attempted write to unimplemented register: "
387                       "AHCI port %d register %s, offset 0x%x: 0x%"PRIx32,
388                       port, AHCIPortReg_lookup[regnum], offset, val);
389         break;
390     }
391 }
392 
393 static uint64_t ahci_mem_read_32(void *opaque, hwaddr addr)
394 {
395     AHCIState *s = opaque;
396     uint32_t val = 0;
397 
398     if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
399         enum AHCIHostReg regnum = addr / 4;
400         assert(regnum < AHCI_HOST_REG__COUNT);
401 
402         switch (regnum) {
403         case AHCI_HOST_REG_CAP:
404             val = s->control_regs.cap;
405             break;
406         case AHCI_HOST_REG_CTL:
407             val = s->control_regs.ghc;
408             break;
409         case AHCI_HOST_REG_IRQ_STAT:
410             val = s->control_regs.irqstatus;
411             break;
412         case AHCI_HOST_REG_PORTS_IMPL:
413             val = s->control_regs.impl;
414             break;
415         case AHCI_HOST_REG_VERSION:
416             val = s->control_regs.version;
417             break;
418         default:
419             trace_ahci_mem_read_32_host_default(s, AHCIHostReg_lookup[regnum],
420                                                 addr);
421         }
422         trace_ahci_mem_read_32_host(s, AHCIHostReg_lookup[regnum], addr, val);
423     } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
424                (addr < (AHCI_PORT_REGS_START_ADDR +
425                 (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
426         val = ahci_port_read(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
427                              addr & AHCI_PORT_ADDR_OFFSET_MASK);
428     } else {
429         trace_ahci_mem_read_32_default(s, addr, val);
430     }
431 
432     trace_ahci_mem_read_32(s, addr, val);
433     return val;
434 }
435 
436 
437 /**
438  * AHCI 1.3 section 3 ("HBA Memory Registers")
439  * Support unaligned 8/16/32 bit reads, and 64 bit aligned reads.
440  * Caller is responsible for masking unwanted higher order bytes.
441  */
442 static uint64_t ahci_mem_read(void *opaque, hwaddr addr, unsigned size)
443 {
444     hwaddr aligned = addr & ~0x3;
445     int ofst = addr - aligned;
446     uint64_t lo = ahci_mem_read_32(opaque, aligned);
447     uint64_t hi;
448     uint64_t val;
449 
450     /* if < 8 byte read does not cross 4 byte boundary */
451     if (ofst + size <= 4) {
452         val = lo >> (ofst * 8);
453     } else {
454         g_assert(size > 1);
455 
456         /* If the 64bit read is unaligned, we will produce undefined
457          * results. AHCI does not support unaligned 64bit reads. */
458         hi = ahci_mem_read_32(opaque, aligned + 4);
459         val = (hi << 32 | lo) >> (ofst * 8);
460     }
461 
462     trace_ahci_mem_read(opaque, size, addr, val);
463     return val;
464 }
465 
466 
467 static void ahci_mem_write(void *opaque, hwaddr addr,
468                            uint64_t val, unsigned size)
469 {
470     AHCIState *s = opaque;
471 
472     trace_ahci_mem_write(s, size, addr, val);
473 
474     /* Only aligned reads are allowed on AHCI */
475     if (addr & 3) {
476         qemu_log_mask(LOG_GUEST_ERROR,
477                       "ahci: Mis-aligned write to addr 0x%03" HWADDR_PRIX "\n",
478                       addr);
479         return;
480     }
481 
482     if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {
483         enum AHCIHostReg regnum = addr / 4;
484         assert(regnum < AHCI_HOST_REG__COUNT);
485 
486         switch (regnum) {
487         case AHCI_HOST_REG_CAP: /* R/WO, RO */
488             /* FIXME handle R/WO */
489             break;
490         case AHCI_HOST_REG_CTL: /* R/W */
491             if (val & HOST_CTL_RESET) {
492                 ahci_reset(s);
493             } else {
494                 s->control_regs.ghc = (val & 0x3) | HOST_CTL_AHCI_EN;
495                 ahci_check_irq(s);
496             }
497             break;
498         case AHCI_HOST_REG_IRQ_STAT: /* R/WC, RO */
499             s->control_regs.irqstatus &= ~val;
500             ahci_check_irq(s);
501             break;
502         case AHCI_HOST_REG_PORTS_IMPL: /* R/WO, RO */
503             /* FIXME handle R/WO */
504             break;
505         case AHCI_HOST_REG_VERSION: /* RO */
506             /* FIXME report write? */
507             break;
508         default:
509             qemu_log_mask(LOG_UNIMP,
510                           "Attempted write to unimplemented register: "
511                           "AHCI host register %s, "
512                           "offset 0x%"PRIx64": 0x%"PRIx64,
513                           AHCIHostReg_lookup[regnum], addr, val);
514             trace_ahci_mem_write_host_unimpl(s, size,
515                                              AHCIHostReg_lookup[regnum], addr);
516         }
517         trace_ahci_mem_write_host(s, size, AHCIHostReg_lookup[regnum],
518                                      addr, val);
519     } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&
520                (addr < (AHCI_PORT_REGS_START_ADDR +
521                         (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {
522         ahci_port_write(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,
523                         addr & AHCI_PORT_ADDR_OFFSET_MASK, val);
524     } else {
525         qemu_log_mask(LOG_UNIMP, "Attempted write to unimplemented register: "
526                       "AHCI global register at offset 0x%"PRIx64": 0x%"PRIx64,
527                       addr, val);
528         trace_ahci_mem_write_unimpl(s, size, addr, val);
529     }
530 }
531 
532 static const MemoryRegionOps ahci_mem_ops = {
533     .read = ahci_mem_read,
534     .write = ahci_mem_write,
535     .endianness = DEVICE_LITTLE_ENDIAN,
536 };
537 
538 static uint64_t ahci_idp_read(void *opaque, hwaddr addr,
539                               unsigned size)
540 {
541     AHCIState *s = opaque;
542 
543     if (addr == s->idp_offset) {
544         /* index register */
545         return s->idp_index;
546     } else if (addr == s->idp_offset + 4) {
547         /* data register - do memory read at location selected by index */
548         return ahci_mem_read(opaque, s->idp_index, size);
549     } else {
550         return 0;
551     }
552 }
553 
554 static void ahci_idp_write(void *opaque, hwaddr addr,
555                            uint64_t val, unsigned size)
556 {
557     AHCIState *s = opaque;
558 
559     if (addr == s->idp_offset) {
560         /* index register - mask off reserved bits */
561         s->idp_index = (uint32_t)val & ((AHCI_MEM_BAR_SIZE - 1) & ~3);
562     } else if (addr == s->idp_offset + 4) {
563         /* data register - do memory write at location selected by index */
564         ahci_mem_write(opaque, s->idp_index, val, size);
565     }
566 }
567 
568 static const MemoryRegionOps ahci_idp_ops = {
569     .read = ahci_idp_read,
570     .write = ahci_idp_write,
571     .endianness = DEVICE_LITTLE_ENDIAN,
572 };
573 
574 
575 static void ahci_reg_init(AHCIState *s)
576 {
577     int i;
578 
579     s->control_regs.cap = (s->ports - 1) |
580                           (AHCI_NUM_COMMAND_SLOTS << 8) |
581                           (AHCI_SUPPORTED_SPEED_GEN1 << AHCI_SUPPORTED_SPEED) |
582                           HOST_CAP_NCQ | HOST_CAP_AHCI | HOST_CAP_64;
583 
584     s->control_regs.impl = (1 << s->ports) - 1;
585 
586     s->control_regs.version = AHCI_VERSION_1_0;
587 
588     for (i = 0; i < s->ports; i++) {
589         s->dev[i].port_state = STATE_RUN;
590     }
591 }
592 
593 static void check_cmd(AHCIState *s, int port)
594 {
595     AHCIPortRegs *pr = &s->dev[port].port_regs;
596     uint8_t slot;
597 
598     if ((pr->cmd & PORT_CMD_START) && pr->cmd_issue) {
599         for (slot = 0; (slot < 32) && pr->cmd_issue; slot++) {
600             if (pr->cmd_issue & (1U << slot)) {
601                 handle_cmd(s, port, slot);
602             }
603         }
604     }
605 }
606 
607 static void ahci_check_cmd_bh(void *opaque)
608 {
609     AHCIDevice *ad = opaque;
610 
611     qemu_bh_delete(ad->check_bh);
612     ad->check_bh = NULL;
613 
614     check_cmd(ad->hba, ad->port_no);
615 }
616 
617 static void ahci_init_d2h(AHCIDevice *ad)
618 {
619     IDEState *ide_state = &ad->port.ifs[0];
620     AHCIPortRegs *pr = &ad->port_regs;
621 
622     if (ad->init_d2h_sent) {
623         return;
624     }
625 
626     /*
627      * For simplicity, do not call ahci_clear_cmd_issue() for this
628      * ahci_write_fis_d2h(). (The reset value for PxCI is 0.)
629      */
630     if (ahci_write_fis_d2h(ad, true)) {
631         ad->init_d2h_sent = true;
632         /* We're emulating receiving the first Reg D2H FIS from the device;
633          * Update the SIG register, but otherwise proceed as normal. */
634         pr->sig = ((uint32_t)ide_state->hcyl << 24) |
635             (ide_state->lcyl << 16) |
636             (ide_state->sector << 8) |
637             (ide_state->nsector & 0xFF);
638     }
639 }
640 
641 static void ahci_set_signature(AHCIDevice *ad, uint32_t sig)
642 {
643     IDEState *s = &ad->port.ifs[0];
644     s->hcyl = sig >> 24 & 0xFF;
645     s->lcyl = sig >> 16 & 0xFF;
646     s->sector = sig >> 8 & 0xFF;
647     s->nsector = sig & 0xFF;
648 
649     trace_ahci_set_signature(ad->hba, ad->port_no, s->nsector, s->sector,
650                              s->lcyl, s->hcyl, sig);
651 }
652 
653 static void ahci_reset_port(AHCIState *s, int port)
654 {
655     AHCIDevice *d = &s->dev[port];
656     AHCIPortRegs *pr = &d->port_regs;
657     IDEState *ide_state = &d->port.ifs[0];
658     int i;
659 
660     trace_ahci_reset_port(s, port);
661 
662     ide_bus_reset(&d->port);
663     ide_state->ncq_queues = AHCI_MAX_CMDS;
664 
665     pr->scr_stat = 0;
666     pr->scr_err = 0;
667     pr->scr_act = 0;
668     pr->tfdata = 0x7F;
669     pr->sig = 0xFFFFFFFF;
670     pr->cmd_issue = 0;
671     d->busy_slot = -1;
672     d->init_d2h_sent = false;
673 
674     ide_state = &s->dev[port].port.ifs[0];
675     if (!ide_state->blk) {
676         return;
677     }
678 
679     /* reset ncq queue */
680     for (i = 0; i < AHCI_MAX_CMDS; i++) {
681         NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[i];
682         ncq_tfs->halt = false;
683         if (!ncq_tfs->used) {
684             continue;
685         }
686 
687         if (ncq_tfs->aiocb) {
688             blk_aio_cancel(ncq_tfs->aiocb);
689             ncq_tfs->aiocb = NULL;
690         }
691 
692         /* Maybe we just finished the request thanks to blk_aio_cancel() */
693         if (!ncq_tfs->used) {
694             continue;
695         }
696 
697         qemu_sglist_destroy(&ncq_tfs->sglist);
698         ncq_tfs->used = 0;
699     }
700 
701     s->dev[port].port_state = STATE_RUN;
702     if (ide_state->drive_kind == IDE_CD) {
703         ahci_set_signature(d, SATA_SIGNATURE_CDROM);
704         ide_state->status = SEEK_STAT | WRERR_STAT | READY_STAT;
705     } else {
706         ahci_set_signature(d, SATA_SIGNATURE_DISK);
707         ide_state->status = SEEK_STAT | WRERR_STAT;
708     }
709 
710     ide_state->error = 1;
711     ahci_init_d2h(d);
712 }
713 
714 /* Buffer pretty output based on a raw FIS structure. */
715 static char *ahci_pretty_buffer_fis(const uint8_t *fis, int cmd_len)
716 {
717     int i;
718     GString *s = g_string_new("FIS:");
719 
720     for (i = 0; i < cmd_len; i++) {
721         if ((i & 0xf) == 0) {
722             g_string_append_printf(s, "\n0x%02x: ", i);
723         }
724         g_string_append_printf(s, "%02x ", fis[i]);
725     }
726     g_string_append_c(s, '\n');
727 
728     return g_string_free(s, FALSE);
729 }
730 
731 static bool ahci_map_fis_address(AHCIDevice *ad)
732 {
733     AHCIPortRegs *pr = &ad->port_regs;
734     map_page(ad->hba->as, &ad->res_fis,
735              ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256);
736     if (ad->res_fis != NULL) {
737         pr->cmd |= PORT_CMD_FIS_ON;
738         return true;
739     }
740 
741     pr->cmd &= ~PORT_CMD_FIS_ON;
742     return false;
743 }
744 
745 static void ahci_unmap_fis_address(AHCIDevice *ad)
746 {
747     if (ad->res_fis == NULL) {
748         trace_ahci_unmap_fis_address_null(ad->hba, ad->port_no);
749         return;
750     }
751     ad->port_regs.cmd &= ~PORT_CMD_FIS_ON;
752     dma_memory_unmap(ad->hba->as, ad->res_fis, 256,
753                      DMA_DIRECTION_FROM_DEVICE, 256);
754     ad->res_fis = NULL;
755 }
756 
757 static bool ahci_map_clb_address(AHCIDevice *ad)
758 {
759     AHCIPortRegs *pr = &ad->port_regs;
760     ad->cur_cmd = NULL;
761     map_page(ad->hba->as, &ad->lst,
762              ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024);
763     if (ad->lst != NULL) {
764         pr->cmd |= PORT_CMD_LIST_ON;
765         return true;
766     }
767 
768     pr->cmd &= ~PORT_CMD_LIST_ON;
769     return false;
770 }
771 
772 static void ahci_unmap_clb_address(AHCIDevice *ad)
773 {
774     if (ad->lst == NULL) {
775         trace_ahci_unmap_clb_address_null(ad->hba, ad->port_no);
776         return;
777     }
778     ad->port_regs.cmd &= ~PORT_CMD_LIST_ON;
779     dma_memory_unmap(ad->hba->as, ad->lst, 1024,
780                      DMA_DIRECTION_FROM_DEVICE, 1024);
781     ad->lst = NULL;
782 }
783 
784 static void ahci_write_fis_sdb(AHCIState *s, NCQTransferState *ncq_tfs)
785 {
786     AHCIDevice *ad = ncq_tfs->drive;
787     AHCIPortRegs *pr = &ad->port_regs;
788     IDEState *ide_state;
789     SDBFIS *sdb_fis;
790 
791     if (!ad->res_fis ||
792         !(pr->cmd & PORT_CMD_FIS_RX)) {
793         return;
794     }
795 
796     sdb_fis = (SDBFIS *)&ad->res_fis[RES_FIS_SDBFIS];
797     ide_state = &ad->port.ifs[0];
798 
799     sdb_fis->type = SATA_FIS_TYPE_SDB;
800     /* Interrupt pending & Notification bit */
801     sdb_fis->flags = 0x40; /* Interrupt bit, always 1 for NCQ */
802     sdb_fis->status = ide_state->status & 0x77;
803     sdb_fis->error = ide_state->error;
804     /* update SAct field in SDB_FIS */
805     sdb_fis->payload = cpu_to_le32(ad->finished);
806 
807     /* Update shadow registers (except BSY 0x80 and DRQ 0x08) */
808     pr->tfdata = (ad->port.ifs[0].error << 8) |
809         (ad->port.ifs[0].status & 0x77) |
810         (pr->tfdata & 0x88);
811     pr->scr_act &= ~ad->finished;
812     ad->finished = 0;
813 
814     /*
815      * TFES IRQ is always raised if ERR_STAT is set, regardless of I bit.
816      * If ERR_STAT is not set, trigger SDBS IRQ if interrupt bit is set
817      * (which currently, it always is).
818      */
819     if (sdb_fis->status & ERR_STAT) {
820         ahci_trigger_irq(s, ad, AHCI_PORT_IRQ_BIT_TFES);
821     } else if (sdb_fis->flags & 0x40) {
822         ahci_trigger_irq(s, ad, AHCI_PORT_IRQ_BIT_SDBS);
823     }
824 }
825 
826 static void ahci_write_fis_pio(AHCIDevice *ad, uint16_t len, bool pio_fis_i)
827 {
828     AHCIPortRegs *pr = &ad->port_regs;
829     uint8_t *pio_fis;
830     IDEState *s = &ad->port.ifs[0];
831 
832     if (!ad->res_fis || !(pr->cmd & PORT_CMD_FIS_RX)) {
833         return;
834     }
835 
836     pio_fis = &ad->res_fis[RES_FIS_PSFIS];
837 
838     pio_fis[0] = SATA_FIS_TYPE_PIO_SETUP;
839     pio_fis[1] = (pio_fis_i ? (1 << 6) : 0);
840     pio_fis[2] = s->status;
841     pio_fis[3] = s->error;
842 
843     pio_fis[4] = s->sector;
844     pio_fis[5] = s->lcyl;
845     pio_fis[6] = s->hcyl;
846     pio_fis[7] = s->select;
847     pio_fis[8] = s->hob_sector;
848     pio_fis[9] = s->hob_lcyl;
849     pio_fis[10] = s->hob_hcyl;
850     pio_fis[11] = 0;
851     pio_fis[12] = s->nsector & 0xFF;
852     pio_fis[13] = (s->nsector >> 8) & 0xFF;
853     pio_fis[14] = 0;
854     pio_fis[15] = s->status;
855     pio_fis[16] = len & 255;
856     pio_fis[17] = len >> 8;
857     pio_fis[18] = 0;
858     pio_fis[19] = 0;
859 
860     /* Update shadow registers: */
861     pr->tfdata = (ad->port.ifs[0].error << 8) |
862         ad->port.ifs[0].status;
863 
864     if (pio_fis[2] & ERR_STAT) {
865         ahci_trigger_irq(ad->hba, ad, AHCI_PORT_IRQ_BIT_TFES);
866     }
867 }
868 
869 static bool ahci_write_fis_d2h(AHCIDevice *ad, bool d2h_fis_i)
870 {
871     AHCIPortRegs *pr = &ad->port_regs;
872     uint8_t *d2h_fis;
873     int i;
874     IDEState *s = &ad->port.ifs[0];
875 
876     if (!ad->res_fis || !(pr->cmd & PORT_CMD_FIS_RX)) {
877         return false;
878     }
879 
880     d2h_fis = &ad->res_fis[RES_FIS_RFIS];
881 
882     d2h_fis[0] = SATA_FIS_TYPE_REGISTER_D2H;
883     d2h_fis[1] = d2h_fis_i ? (1 << 6) : 0; /* interrupt bit */
884     d2h_fis[2] = s->status;
885     d2h_fis[3] = s->error;
886 
887     d2h_fis[4] = s->sector;
888     d2h_fis[5] = s->lcyl;
889     d2h_fis[6] = s->hcyl;
890     d2h_fis[7] = s->select;
891     d2h_fis[8] = s->hob_sector;
892     d2h_fis[9] = s->hob_lcyl;
893     d2h_fis[10] = s->hob_hcyl;
894     d2h_fis[11] = 0;
895     d2h_fis[12] = s->nsector & 0xFF;
896     d2h_fis[13] = (s->nsector >> 8) & 0xFF;
897     for (i = 14; i < 20; i++) {
898         d2h_fis[i] = 0;
899     }
900 
901     /* Update shadow registers: */
902     pr->tfdata = (ad->port.ifs[0].error << 8) |
903         ad->port.ifs[0].status;
904 
905     /* TFES IRQ is always raised if ERR_STAT is set, regardless of I bit. */
906     if (d2h_fis[2] & ERR_STAT) {
907         ahci_trigger_irq(ad->hba, ad, AHCI_PORT_IRQ_BIT_TFES);
908     } else if (d2h_fis_i) {
909         ahci_trigger_irq(ad->hba, ad, AHCI_PORT_IRQ_BIT_DHRS);
910     }
911 
912     return true;
913 }
914 
915 static int prdt_tbl_entry_size(const AHCI_SG *tbl)
916 {
917     /* flags_size is zero-based */
918     return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1;
919 }
920 
921 /**
922  * Fetch entries in a guest-provided PRDT and convert it into a QEMU SGlist.
923  * @ad: The AHCIDevice for whom we are building the SGList.
924  * @sglist: The SGList target to add PRD entries to.
925  * @cmd: The AHCI Command Header that describes where the PRDT is.
926  * @limit: The remaining size of the S/ATA transaction, in bytes.
927  * @offset: The number of bytes already transferred, in bytes.
928  *
929  * The AHCI PRDT can describe up to 256GiB. S/ATA only support transactions of
930  * up to 32MiB as of ATA8-ACS3 rev 1b, assuming a 512 byte sector size. We stop
931  * building the sglist from the PRDT as soon as we hit @limit bytes,
932  * which is <= INT32_MAX/2GiB.
933  */
934 static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist,
935                                 AHCICmdHdr *cmd, int64_t limit, uint64_t offset)
936 {
937     uint16_t opts = le16_to_cpu(cmd->opts);
938     uint16_t prdtl = le16_to_cpu(cmd->prdtl);
939     uint64_t cfis_addr = le64_to_cpu(cmd->tbl_addr);
940     uint64_t prdt_addr = cfis_addr + 0x80;
941     dma_addr_t prdt_len = (prdtl * sizeof(AHCI_SG));
942     dma_addr_t real_prdt_len = prdt_len;
943     uint8_t *prdt;
944     int i;
945     int r = 0;
946     uint64_t sum = 0;
947     int off_idx = -1;
948     int64_t off_pos = -1;
949     int tbl_entry_size;
950     IDEBus *bus = &ad->port;
951     BusState *qbus = BUS(bus);
952 
953     trace_ahci_populate_sglist(ad->hba, ad->port_no);
954 
955     if (!prdtl) {
956         trace_ahci_populate_sglist_no_prdtl(ad->hba, ad->port_no, opts);
957         return -1;
958     }
959 
960     /* map PRDT */
961     if (!(prdt = dma_memory_map(ad->hba->as, prdt_addr, &prdt_len,
962                                 DMA_DIRECTION_TO_DEVICE,
963                                 MEMTXATTRS_UNSPECIFIED))){
964         trace_ahci_populate_sglist_no_map(ad->hba, ad->port_no);
965         return -1;
966     }
967 
968     if (prdt_len < real_prdt_len) {
969         trace_ahci_populate_sglist_short_map(ad->hba, ad->port_no);
970         r = -1;
971         goto out;
972     }
973 
974     /* Get entries in the PRDT, init a qemu sglist accordingly */
975     if (prdtl > 0) {
976         AHCI_SG *tbl = (AHCI_SG *)prdt;
977         sum = 0;
978         for (i = 0; i < prdtl; i++) {
979             tbl_entry_size = prdt_tbl_entry_size(&tbl[i]);
980             if (offset < (sum + tbl_entry_size)) {
981                 off_idx = i;
982                 off_pos = offset - sum;
983                 break;
984             }
985             sum += tbl_entry_size;
986         }
987         if ((off_idx == -1) || (off_pos < 0) || (off_pos > tbl_entry_size)) {
988             trace_ahci_populate_sglist_bad_offset(ad->hba, ad->port_no,
989                                                   off_idx, off_pos);
990             r = -1;
991             goto out;
992         }
993 
994         qemu_sglist_init(sglist, qbus->parent, (prdtl - off_idx),
995                          ad->hba->as);
996         qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr) + off_pos,
997                         MIN(prdt_tbl_entry_size(&tbl[off_idx]) - off_pos,
998                             limit));
999 
1000         for (i = off_idx + 1; i < prdtl && sglist->size < limit; i++) {
1001             qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
1002                             MIN(prdt_tbl_entry_size(&tbl[i]),
1003                                 limit - sglist->size));
1004         }
1005     }
1006 
1007 out:
1008     dma_memory_unmap(ad->hba->as, prdt, prdt_len,
1009                      DMA_DIRECTION_TO_DEVICE, prdt_len);
1010     return r;
1011 }
1012 
1013 static void ncq_err(NCQTransferState *ncq_tfs)
1014 {
1015     IDEState *ide_state = &ncq_tfs->drive->port.ifs[0];
1016 
1017     ide_state->error = ABRT_ERR;
1018     ide_state->status = READY_STAT | ERR_STAT;
1019     qemu_sglist_destroy(&ncq_tfs->sglist);
1020     ncq_tfs->used = 0;
1021 }
1022 
1023 static void ncq_finish(NCQTransferState *ncq_tfs)
1024 {
1025     /* If we didn't error out, set our finished bit. Errored commands
1026      * do not get a bit set for the SDB FIS ACT register, nor do they
1027      * clear the outstanding bit in scr_act (PxSACT). */
1028     if (ncq_tfs->used) {
1029         ncq_tfs->drive->finished |= (1 << ncq_tfs->tag);
1030     }
1031 
1032     ahci_write_fis_sdb(ncq_tfs->drive->hba, ncq_tfs);
1033 
1034     trace_ncq_finish(ncq_tfs->drive->hba, ncq_tfs->drive->port_no,
1035                      ncq_tfs->tag);
1036 
1037     block_acct_done(blk_get_stats(ncq_tfs->drive->port.ifs[0].blk),
1038                     &ncq_tfs->acct);
1039     qemu_sglist_destroy(&ncq_tfs->sglist);
1040     ncq_tfs->used = 0;
1041 }
1042 
1043 static void ncq_cb(void *opaque, int ret)
1044 {
1045     NCQTransferState *ncq_tfs = (NCQTransferState *)opaque;
1046     IDEState *ide_state = &ncq_tfs->drive->port.ifs[0];
1047 
1048     ncq_tfs->aiocb = NULL;
1049 
1050     if (ret < 0) {
1051         bool is_read = ncq_tfs->cmd == READ_FPDMA_QUEUED;
1052         BlockErrorAction action = blk_get_error_action(ide_state->blk,
1053                                                        is_read, -ret);
1054         if (action == BLOCK_ERROR_ACTION_STOP) {
1055             ncq_tfs->halt = true;
1056             ide_state->bus->error_status = IDE_RETRY_HBA;
1057         } else if (action == BLOCK_ERROR_ACTION_REPORT) {
1058             ncq_err(ncq_tfs);
1059         }
1060         blk_error_action(ide_state->blk, action, is_read, -ret);
1061     } else {
1062         ide_state->status = READY_STAT | SEEK_STAT;
1063     }
1064 
1065     if (!ncq_tfs->halt) {
1066         ncq_finish(ncq_tfs);
1067     }
1068 }
1069 
1070 static int is_ncq(uint8_t ata_cmd)
1071 {
1072     /* Based on SATA 3.2 section 13.6.3.2 */
1073     switch (ata_cmd) {
1074     case READ_FPDMA_QUEUED:
1075     case WRITE_FPDMA_QUEUED:
1076     case NCQ_NON_DATA:
1077     case RECEIVE_FPDMA_QUEUED:
1078     case SEND_FPDMA_QUEUED:
1079         return 1;
1080     default:
1081         return 0;
1082     }
1083 }
1084 
1085 static void execute_ncq_command(NCQTransferState *ncq_tfs)
1086 {
1087     AHCIDevice *ad = ncq_tfs->drive;
1088     IDEState *ide_state = &ad->port.ifs[0];
1089     int port = ad->port_no;
1090 
1091     g_assert(is_ncq(ncq_tfs->cmd));
1092     ncq_tfs->halt = false;
1093 
1094     switch (ncq_tfs->cmd) {
1095     case READ_FPDMA_QUEUED:
1096         trace_execute_ncq_command_read(ad->hba, port, ncq_tfs->tag,
1097                                        ncq_tfs->sector_count, ncq_tfs->lba);
1098         dma_acct_start(ide_state->blk, &ncq_tfs->acct,
1099                        &ncq_tfs->sglist, BLOCK_ACCT_READ);
1100         ncq_tfs->aiocb = dma_blk_read(ide_state->blk, &ncq_tfs->sglist,
1101                                       ncq_tfs->lba << BDRV_SECTOR_BITS,
1102                                       BDRV_SECTOR_SIZE,
1103                                       ncq_cb, ncq_tfs);
1104         break;
1105     case WRITE_FPDMA_QUEUED:
1106         trace_execute_ncq_command_write(ad->hba, port, ncq_tfs->tag,
1107                                         ncq_tfs->sector_count, ncq_tfs->lba);
1108         dma_acct_start(ide_state->blk, &ncq_tfs->acct,
1109                        &ncq_tfs->sglist, BLOCK_ACCT_WRITE);
1110         ncq_tfs->aiocb = dma_blk_write(ide_state->blk, &ncq_tfs->sglist,
1111                                        ncq_tfs->lba << BDRV_SECTOR_BITS,
1112                                        BDRV_SECTOR_SIZE,
1113                                        ncq_cb, ncq_tfs);
1114         break;
1115     default:
1116         trace_execute_ncq_command_unsup(ad->hba, port,
1117                                         ncq_tfs->tag, ncq_tfs->cmd);
1118         ncq_err(ncq_tfs);
1119     }
1120 }
1121 
1122 
1123 static void process_ncq_command(AHCIState *s, int port, const uint8_t *cmd_fis,
1124                                 uint8_t slot)
1125 {
1126     AHCIDevice *ad = &s->dev[port];
1127     const NCQFrame *ncq_fis = (NCQFrame *)cmd_fis;
1128     uint8_t tag = ncq_fis->tag >> 3;
1129     NCQTransferState *ncq_tfs = &ad->ncq_tfs[tag];
1130     size_t size;
1131 
1132     g_assert(is_ncq(ncq_fis->command));
1133     if (ncq_tfs->used) {
1134         /* error - already in use */
1135         qemu_log_mask(LOG_GUEST_ERROR, "%s: tag %d already used\n",
1136                       __func__, tag);
1137         return;
1138     }
1139 
1140     /*
1141      * A NCQ command clears the bit in PxCI after the command has been QUEUED
1142      * successfully (ERROR not set, BUSY and DRQ cleared).
1143      *
1144      * For NCQ commands, PxCI will always be cleared here.
1145      *
1146      * (Once the NCQ command is COMPLETED, the device will send a SDB FIS with
1147      * the interrupt bit set, which will clear PxSACT and raise an interrupt.)
1148      */
1149     ahci_clear_cmd_issue(ad, slot);
1150 
1151     /*
1152      * In reality, for NCQ commands, PxCI is cleared after receiving a D2H FIS
1153      * without the interrupt bit set, but since ahci_write_fis_d2h() can raise
1154      * an IRQ on error, we need to call them in reverse order.
1155      */
1156     ahci_write_fis_d2h(ad, false);
1157 
1158     ncq_tfs->used = 1;
1159     ncq_tfs->drive = ad;
1160     ncq_tfs->slot = slot;
1161     ncq_tfs->cmdh = &((AHCICmdHdr *)ad->lst)[slot];
1162     ncq_tfs->cmd = ncq_fis->command;
1163     ncq_tfs->lba = ((uint64_t)ncq_fis->lba5 << 40) |
1164                    ((uint64_t)ncq_fis->lba4 << 32) |
1165                    ((uint64_t)ncq_fis->lba3 << 24) |
1166                    ((uint64_t)ncq_fis->lba2 << 16) |
1167                    ((uint64_t)ncq_fis->lba1 << 8) |
1168                    (uint64_t)ncq_fis->lba0;
1169     ncq_tfs->tag = tag;
1170 
1171     /* Sanity-check the NCQ packet */
1172     if (tag != slot) {
1173         trace_process_ncq_command_mismatch(s, port, tag, slot);
1174     }
1175 
1176     if (ncq_fis->aux0 || ncq_fis->aux1 || ncq_fis->aux2 || ncq_fis->aux3) {
1177         trace_process_ncq_command_aux(s, port, tag);
1178     }
1179     if (ncq_fis->prio || ncq_fis->icc) {
1180         trace_process_ncq_command_prioicc(s, port, tag);
1181     }
1182     if (ncq_fis->fua & NCQ_FIS_FUA_MASK) {
1183         trace_process_ncq_command_fua(s, port, tag);
1184     }
1185     if (ncq_fis->tag & NCQ_FIS_RARC_MASK) {
1186         trace_process_ncq_command_rarc(s, port, tag);
1187     }
1188 
1189     ncq_tfs->sector_count = ((ncq_fis->sector_count_high << 8) |
1190                              ncq_fis->sector_count_low);
1191     if (!ncq_tfs->sector_count) {
1192         ncq_tfs->sector_count = 0x10000;
1193     }
1194     size = ncq_tfs->sector_count * BDRV_SECTOR_SIZE;
1195     ahci_populate_sglist(ad, &ncq_tfs->sglist, ncq_tfs->cmdh, size, 0);
1196 
1197     if (ncq_tfs->sglist.size < size) {
1198         error_report("ahci: PRDT length for NCQ command (0x" DMA_ADDR_FMT ") "
1199                      "is smaller than the requested size (0x%zx)",
1200                      ncq_tfs->sglist.size, size);
1201         ncq_err(ncq_tfs);
1202         ahci_trigger_irq(ad->hba, ad, AHCI_PORT_IRQ_BIT_OFS);
1203         return;
1204     } else if (ncq_tfs->sglist.size != size) {
1205         trace_process_ncq_command_large(s, port, tag,
1206                                         ncq_tfs->sglist.size, size);
1207     }
1208 
1209     trace_process_ncq_command(s, port, tag,
1210                               ncq_fis->command,
1211                               ncq_tfs->lba,
1212                               ncq_tfs->lba + ncq_tfs->sector_count - 1);
1213     execute_ncq_command(ncq_tfs);
1214 }
1215 
1216 static AHCICmdHdr *get_cmd_header(AHCIState *s, uint8_t port, uint8_t slot)
1217 {
1218     if (port >= s->ports || slot >= AHCI_MAX_CMDS) {
1219         return NULL;
1220     }
1221 
1222     return s->dev[port].lst ? &((AHCICmdHdr *)s->dev[port].lst)[slot] : NULL;
1223 }
1224 
1225 static void handle_reg_h2d_fis(AHCIState *s, int port,
1226                                uint8_t slot, const uint8_t *cmd_fis)
1227 {
1228     IDEState *ide_state = &s->dev[port].port.ifs[0];
1229     AHCICmdHdr *cmd = get_cmd_header(s, port, slot);
1230     AHCIDevice *ad = &s->dev[port];
1231     uint16_t opts = le16_to_cpu(cmd->opts);
1232 
1233     if (cmd_fis[1] & 0x0F) {
1234         trace_handle_reg_h2d_fis_pmp(s, port, cmd_fis[1],
1235                                      cmd_fis[2], cmd_fis[3]);
1236         return;
1237     }
1238 
1239     if (cmd_fis[1] & 0x70) {
1240         trace_handle_reg_h2d_fis_res(s, port, cmd_fis[1],
1241                                      cmd_fis[2], cmd_fis[3]);
1242         return;
1243     }
1244 
1245     if (!(cmd_fis[1] & SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER)) {
1246         switch (s->dev[port].port_state) {
1247         case STATE_RUN:
1248             if (cmd_fis[15] & ATA_SRST) {
1249                 s->dev[port].port_state = STATE_RESET;
1250                 /*
1251                  * When setting SRST in the first H2D FIS in the reset sequence,
1252                  * the device does not send a D2H FIS. Host software thus has to
1253                  * set the "Clear Busy upon R_OK" bit such that PxCI (and BUSY)
1254                  * gets cleared. See AHCI 1.3.1, section 10.4.1 Software Reset.
1255                  */
1256                 if (opts & AHCI_CMD_CLR_BUSY) {
1257                     ahci_clear_cmd_issue(ad, slot);
1258                 }
1259             }
1260             break;
1261         case STATE_RESET:
1262             if (!(cmd_fis[15] & ATA_SRST)) {
1263                 /*
1264                  * When clearing SRST in the second H2D FIS in the reset
1265                  * sequence, the device will execute diagnostics. When this is
1266                  * done, the device will send a D2H FIS with the good status.
1267                  * See SATA 3.5a Gold, section 11.4 Software reset protocol.
1268                  *
1269                  * This D2H FIS is the first D2H FIS received from the device,
1270                  * and is received regardless if the reset was performed by a
1271                  * COMRESET or by setting and clearing the SRST bit. Therefore,
1272                  * the logic for this is found in ahci_init_d2h() and not here.
1273                  */
1274                 ahci_reset_port(s, port);
1275             }
1276             break;
1277         }
1278         return;
1279     }
1280 
1281     /* Check for NCQ command */
1282     if (is_ncq(cmd_fis[2])) {
1283         process_ncq_command(s, port, cmd_fis, slot);
1284         return;
1285     }
1286 
1287     /* Decompose the FIS:
1288      * AHCI does not interpret FIS packets, it only forwards them.
1289      * SATA 1.0 describes how to decode LBA28 and CHS FIS packets.
1290      * Later specifications, e.g, SATA 3.2, describe LBA48 FIS packets.
1291      *
1292      * ATA4 describes sector number for LBA28/CHS commands.
1293      * ATA6 describes sector number for LBA48 commands.
1294      * ATA8 deprecates CHS fully, describing only LBA28/48.
1295      *
1296      * We dutifully convert the FIS into IDE registers, and allow the
1297      * core layer to interpret them as needed. */
1298     ide_state->feature = cmd_fis[3];
1299     ide_state->sector = cmd_fis[4];      /* LBA 7:0 */
1300     ide_state->lcyl = cmd_fis[5];        /* LBA 15:8  */
1301     ide_state->hcyl = cmd_fis[6];        /* LBA 23:16 */
1302     ide_state->select = cmd_fis[7];      /* LBA 27:24 (LBA28) */
1303     ide_state->hob_sector = cmd_fis[8];  /* LBA 31:24 */
1304     ide_state->hob_lcyl = cmd_fis[9];    /* LBA 39:32 */
1305     ide_state->hob_hcyl = cmd_fis[10];   /* LBA 47:40 */
1306     ide_state->hob_feature = cmd_fis[11];
1307     ide_state->nsector = (int64_t)((cmd_fis[13] << 8) | cmd_fis[12]);
1308     /* 14, 16, 17, 18, 19: Reserved (SATA 1.0) */
1309     /* 15: Only valid when UPDATE_COMMAND not set. */
1310 
1311     /* Copy the ACMD field (ATAPI packet, if any) from the AHCI command
1312      * table to ide_state->io_buffer */
1313     if (opts & AHCI_CMD_ATAPI) {
1314         memcpy(ide_state->io_buffer, &cmd_fis[AHCI_COMMAND_TABLE_ACMD], 0x10);
1315         if (trace_event_get_state_backends(TRACE_HANDLE_REG_H2D_FIS_DUMP)) {
1316             char *pretty_fis = ahci_pretty_buffer_fis(ide_state->io_buffer, 0x10);
1317             trace_handle_reg_h2d_fis_dump(s, port, pretty_fis);
1318             g_free(pretty_fis);
1319         }
1320     }
1321 
1322     ide_state->error = 0;
1323     s->dev[port].done_first_drq = false;
1324     /* Reset transferred byte counter */
1325     cmd->status = 0;
1326 
1327     /*
1328      * A non-NCQ command clears the bit in PxCI after the command has COMPLETED
1329      * successfully (ERROR not set, BUSY and DRQ cleared).
1330      *
1331      * For non-NCQ commands, PxCI will always be cleared by ahci_cmd_done().
1332      */
1333     ad->busy_slot = slot;
1334 
1335     /* We're ready to process the command in FIS byte 2. */
1336     ide_bus_exec_cmd(&s->dev[port].port, cmd_fis[2]);
1337 }
1338 
1339 static void handle_cmd(AHCIState *s, int port, uint8_t slot)
1340 {
1341     IDEState *ide_state;
1342     uint64_t tbl_addr;
1343     AHCICmdHdr *cmd;
1344     uint8_t *cmd_fis;
1345     dma_addr_t cmd_len;
1346 
1347     if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) {
1348         /* Engine currently busy, try again later */
1349         trace_handle_cmd_busy(s, port);
1350         return;
1351     }
1352 
1353     if (!s->dev[port].lst) {
1354         trace_handle_cmd_nolist(s, port);
1355         return;
1356     }
1357     cmd = get_cmd_header(s, port, slot);
1358     /* remember current slot handle for later */
1359     s->dev[port].cur_cmd = cmd;
1360 
1361     /* The device we are working for */
1362     ide_state = &s->dev[port].port.ifs[0];
1363     if (!ide_state->blk) {
1364         trace_handle_cmd_badport(s, port);
1365         return;
1366     }
1367 
1368     tbl_addr = le64_to_cpu(cmd->tbl_addr);
1369     cmd_len = 0x80;
1370     cmd_fis = dma_memory_map(s->as, tbl_addr, &cmd_len,
1371                              DMA_DIRECTION_TO_DEVICE, MEMTXATTRS_UNSPECIFIED);
1372     if (!cmd_fis) {
1373         trace_handle_cmd_badfis(s, port);
1374         return;
1375     } else if (cmd_len != 0x80) {
1376         ahci_trigger_irq(s, &s->dev[port], AHCI_PORT_IRQ_BIT_HBFS);
1377         trace_handle_cmd_badmap(s, port, cmd_len);
1378         goto out;
1379     }
1380     if (trace_event_get_state_backends(TRACE_HANDLE_CMD_FIS_DUMP)) {
1381         char *pretty_fis = ahci_pretty_buffer_fis(cmd_fis, 0x80);
1382         trace_handle_cmd_fis_dump(s, port, pretty_fis);
1383         g_free(pretty_fis);
1384     }
1385     switch (cmd_fis[0]) {
1386         case SATA_FIS_TYPE_REGISTER_H2D:
1387             handle_reg_h2d_fis(s, port, slot, cmd_fis);
1388             break;
1389         default:
1390             trace_handle_cmd_unhandled_fis(s, port,
1391                                            cmd_fis[0], cmd_fis[1], cmd_fis[2]);
1392             break;
1393     }
1394 
1395 out:
1396     dma_memory_unmap(s->as, cmd_fis, cmd_len, DMA_DIRECTION_TO_DEVICE,
1397                      cmd_len);
1398 }
1399 
1400 /* Transfer PIO data between RAM and device */
1401 static void ahci_pio_transfer(const IDEDMA *dma)
1402 {
1403     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1404     IDEState *s = &ad->port.ifs[0];
1405     uint32_t size = (uint32_t)(s->data_end - s->data_ptr);
1406     /* write == ram -> device */
1407     uint16_t opts = le16_to_cpu(ad->cur_cmd->opts);
1408     int is_write = opts & AHCI_CMD_WRITE;
1409     int is_atapi = opts & AHCI_CMD_ATAPI;
1410     int has_sglist = 0;
1411     bool pio_fis_i;
1412 
1413     /* The PIO Setup FIS is received prior to transfer, but the interrupt
1414      * is only triggered after data is received.
1415      *
1416      * The device only sets the 'I' bit in the PIO Setup FIS for device->host
1417      * requests (see "DPIOI1" in the SATA spec), or for host->device DRQs after
1418      * the first (see "DPIOO1").  The latter is consistent with the spec's
1419      * description of the PACKET protocol, where the command part of ATAPI requests
1420      * ("DPKT0") has the 'I' bit clear, while the data part of PIO ATAPI requests
1421      * ("DPKT4a" and "DPKT7") has the 'I' bit set for both directions for all DRQs.
1422      */
1423     pio_fis_i = ad->done_first_drq || (!is_atapi && !is_write);
1424     ahci_write_fis_pio(ad, size, pio_fis_i);
1425 
1426     if (is_atapi && !ad->done_first_drq) {
1427         /* already prepopulated iobuffer */
1428         goto out;
1429     }
1430 
1431     if (ahci_dma_prepare_buf(dma, size)) {
1432         has_sglist = 1;
1433     }
1434 
1435     trace_ahci_pio_transfer(ad->hba, ad->port_no, is_write ? "writ" : "read",
1436                             size, is_atapi ? "atapi" : "ata",
1437                             has_sglist ? "" : "o");
1438 
1439     if (has_sglist && size) {
1440         const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
1441 
1442         if (is_write) {
1443             dma_buf_write(s->data_ptr, size, NULL, &s->sg, attrs);
1444         } else {
1445             dma_buf_read(s->data_ptr, size, NULL, &s->sg, attrs);
1446         }
1447     }
1448 
1449     /* Update number of transferred bytes, destroy sglist */
1450     dma_buf_commit(s, size);
1451 
1452 out:
1453     /* declare that we processed everything */
1454     s->data_ptr = s->data_end;
1455 
1456     ad->done_first_drq = true;
1457     if (pio_fis_i) {
1458         ahci_trigger_irq(ad->hba, ad, AHCI_PORT_IRQ_BIT_PSS);
1459     }
1460 }
1461 
1462 static void ahci_start_dma(const IDEDMA *dma, IDEState *s,
1463                            BlockCompletionFunc *dma_cb)
1464 {
1465     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1466     trace_ahci_start_dma(ad->hba, ad->port_no);
1467     s->io_buffer_offset = 0;
1468     dma_cb(s, 0);
1469 }
1470 
1471 static void ahci_restart_dma(const IDEDMA *dma)
1472 {
1473     /* Nothing to do, ahci_start_dma already resets s->io_buffer_offset.  */
1474 }
1475 
1476 /**
1477  * IDE/PIO restarts are handled by the core layer, but NCQ commands
1478  * need an extra kick from the AHCI HBA.
1479  */
1480 static void ahci_restart(const IDEDMA *dma)
1481 {
1482     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1483     int i;
1484 
1485     for (i = 0; i < AHCI_MAX_CMDS; i++) {
1486         NCQTransferState *ncq_tfs = &ad->ncq_tfs[i];
1487         if (ncq_tfs->halt) {
1488             execute_ncq_command(ncq_tfs);
1489         }
1490     }
1491 }
1492 
1493 /**
1494  * Called in DMA and PIO R/W chains to read the PRDT.
1495  * Not shared with NCQ pathways.
1496  */
1497 static int32_t ahci_dma_prepare_buf(const IDEDMA *dma, int32_t limit)
1498 {
1499     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1500     IDEState *s = &ad->port.ifs[0];
1501 
1502     if (ahci_populate_sglist(ad, &s->sg, ad->cur_cmd,
1503                              limit, s->io_buffer_offset) == -1) {
1504         trace_ahci_dma_prepare_buf_fail(ad->hba, ad->port_no);
1505         return -1;
1506     }
1507     s->io_buffer_size = s->sg.size;
1508 
1509     trace_ahci_dma_prepare_buf(ad->hba, ad->port_no, limit, s->io_buffer_size);
1510     return s->io_buffer_size;
1511 }
1512 
1513 /**
1514  * Updates the command header with a bytes-read value.
1515  * Called via dma_buf_commit, for both DMA and PIO paths.
1516  * sglist destruction is handled within dma_buf_commit.
1517  */
1518 static void ahci_commit_buf(const IDEDMA *dma, uint32_t tx_bytes)
1519 {
1520     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1521 
1522     tx_bytes += le32_to_cpu(ad->cur_cmd->status);
1523     ad->cur_cmd->status = cpu_to_le32(tx_bytes);
1524 }
1525 
1526 static int ahci_dma_rw_buf(const IDEDMA *dma, bool is_write)
1527 {
1528     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1529     IDEState *s = &ad->port.ifs[0];
1530     uint8_t *p = s->io_buffer + s->io_buffer_index;
1531     int l = s->io_buffer_size - s->io_buffer_index;
1532 
1533     if (ahci_populate_sglist(ad, &s->sg, ad->cur_cmd, l, s->io_buffer_offset)) {
1534         return 0;
1535     }
1536 
1537     if (is_write) {
1538         dma_buf_read(p, l, NULL, &s->sg, MEMTXATTRS_UNSPECIFIED);
1539     } else {
1540         dma_buf_write(p, l, NULL, &s->sg, MEMTXATTRS_UNSPECIFIED);
1541     }
1542 
1543     /* free sglist, update byte count */
1544     dma_buf_commit(s, l);
1545     s->io_buffer_index += l;
1546 
1547     trace_ahci_dma_rw_buf(ad->hba, ad->port_no, l);
1548     return 1;
1549 }
1550 
1551 static void ahci_clear_cmd_issue(AHCIDevice *ad, uint8_t slot)
1552 {
1553     IDEState *ide_state = &ad->port.ifs[0];
1554 
1555     if (!(ide_state->status & ERR_STAT) &&
1556         !(ide_state->status & (BUSY_STAT | DRQ_STAT))) {
1557         ad->port_regs.cmd_issue &= ~(1 << slot);
1558     }
1559 }
1560 
1561 /* Non-NCQ command is done - This function is never called for NCQ commands. */
1562 static void ahci_cmd_done(const IDEDMA *dma)
1563 {
1564     AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
1565     IDEState *ide_state = &ad->port.ifs[0];
1566 
1567     trace_ahci_cmd_done(ad->hba, ad->port_no);
1568 
1569     /* no longer busy */
1570     if (ad->busy_slot != -1) {
1571         ahci_clear_cmd_issue(ad, ad->busy_slot);
1572         ad->busy_slot = -1;
1573     }
1574 
1575     /*
1576      * In reality, for non-NCQ commands, PxCI is cleared after receiving a D2H
1577      * FIS with the interrupt bit set, but since ahci_write_fis_d2h() will raise
1578      * an IRQ, we need to call them in reverse order.
1579      */
1580     ahci_write_fis_d2h(ad, true);
1581 
1582     if (!(ide_state->status & ERR_STAT) &&
1583         ad->port_regs.cmd_issue && !ad->check_bh) {
1584         ad->check_bh = qemu_bh_new_guarded(ahci_check_cmd_bh, ad,
1585                                            &ad->mem_reentrancy_guard);
1586         qemu_bh_schedule(ad->check_bh);
1587     }
1588 }
1589 
1590 static void ahci_irq_set(void *opaque, int n, int level)
1591 {
1592     qemu_log_mask(LOG_UNIMP, "ahci: IRQ#%d level:%d\n", n, level);
1593 }
1594 
1595 static const IDEDMAOps ahci_dma_ops = {
1596     .start_dma = ahci_start_dma,
1597     .restart = ahci_restart,
1598     .restart_dma = ahci_restart_dma,
1599     .pio_transfer = ahci_pio_transfer,
1600     .prepare_buf = ahci_dma_prepare_buf,
1601     .commit_buf = ahci_commit_buf,
1602     .rw_buf = ahci_dma_rw_buf,
1603     .cmd_done = ahci_cmd_done,
1604 };
1605 
1606 void ahci_init(AHCIState *s, DeviceState *qdev)
1607 {
1608     s->container = qdev;
1609     /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */
1610     memory_region_init_io(&s->mem, OBJECT(qdev), &ahci_mem_ops, s,
1611                           "ahci", AHCI_MEM_BAR_SIZE);
1612     memory_region_init_io(&s->idp, OBJECT(qdev), &ahci_idp_ops, s,
1613                           "ahci-idp", 32);
1614 }
1615 
1616 void ahci_realize(AHCIState *s, DeviceState *qdev, AddressSpace *as, int ports)
1617 {
1618     qemu_irq *irqs;
1619     int i;
1620 
1621     s->as = as;
1622     s->ports = ports;
1623     s->dev = g_new0(AHCIDevice, ports);
1624     ahci_reg_init(s);
1625     irqs = qemu_allocate_irqs(ahci_irq_set, s, s->ports);
1626     for (i = 0; i < s->ports; i++) {
1627         AHCIDevice *ad = &s->dev[i];
1628 
1629         ide_bus_init(&ad->port, sizeof(ad->port), qdev, i, 1);
1630         ide_bus_init_output_irq(&ad->port, irqs[i]);
1631 
1632         ad->hba = s;
1633         ad->port_no = i;
1634         ad->port.dma = &ad->dma;
1635         ad->port.dma->ops = &ahci_dma_ops;
1636         ide_bus_register_restart_cb(&ad->port);
1637     }
1638     g_free(irqs);
1639 }
1640 
1641 void ahci_uninit(AHCIState *s)
1642 {
1643     int i, j;
1644 
1645     for (i = 0; i < s->ports; i++) {
1646         AHCIDevice *ad = &s->dev[i];
1647 
1648         for (j = 0; j < 2; j++) {
1649             ide_exit(&ad->port.ifs[j]);
1650         }
1651         object_unparent(OBJECT(&ad->port));
1652     }
1653 
1654     g_free(s->dev);
1655 }
1656 
1657 void ahci_reset(AHCIState *s)
1658 {
1659     AHCIPortRegs *pr;
1660     int i;
1661 
1662     trace_ahci_reset(s);
1663 
1664     s->control_regs.irqstatus = 0;
1665     /* AHCI Enable (AE)
1666      * The implementation of this bit is dependent upon the value of the
1667      * CAP.SAM bit. If CAP.SAM is '0', then GHC.AE shall be read-write and
1668      * shall have a reset value of '0'. If CAP.SAM is '1', then AE shall be
1669      * read-only and shall have a reset value of '1'.
1670      *
1671      * We set HOST_CAP_AHCI so we must enable AHCI at reset.
1672      */
1673     s->control_regs.ghc = HOST_CTL_AHCI_EN;
1674 
1675     for (i = 0; i < s->ports; i++) {
1676         pr = &s->dev[i].port_regs;
1677         pr->irq_stat = 0;
1678         pr->irq_mask = 0;
1679         pr->scr_ctl = 0;
1680         pr->cmd = PORT_CMD_SPIN_UP | PORT_CMD_POWER_ON;
1681         ahci_reset_port(s, i);
1682     }
1683 }
1684 
1685 static const VMStateDescription vmstate_ncq_tfs = {
1686     .name = "ncq state",
1687     .version_id = 1,
1688     .fields = (VMStateField[]) {
1689         VMSTATE_UINT32(sector_count, NCQTransferState),
1690         VMSTATE_UINT64(lba, NCQTransferState),
1691         VMSTATE_UINT8(tag, NCQTransferState),
1692         VMSTATE_UINT8(cmd, NCQTransferState),
1693         VMSTATE_UINT8(slot, NCQTransferState),
1694         VMSTATE_BOOL(used, NCQTransferState),
1695         VMSTATE_BOOL(halt, NCQTransferState),
1696         VMSTATE_END_OF_LIST()
1697     },
1698 };
1699 
1700 static const VMStateDescription vmstate_ahci_device = {
1701     .name = "ahci port",
1702     .version_id = 1,
1703     .fields = (VMStateField[]) {
1704         VMSTATE_IDE_BUS(port, AHCIDevice),
1705         VMSTATE_IDE_DRIVE(port.ifs[0], AHCIDevice),
1706         VMSTATE_UINT32(port_state, AHCIDevice),
1707         VMSTATE_UINT32(finished, AHCIDevice),
1708         VMSTATE_UINT32(port_regs.lst_addr, AHCIDevice),
1709         VMSTATE_UINT32(port_regs.lst_addr_hi, AHCIDevice),
1710         VMSTATE_UINT32(port_regs.fis_addr, AHCIDevice),
1711         VMSTATE_UINT32(port_regs.fis_addr_hi, AHCIDevice),
1712         VMSTATE_UINT32(port_regs.irq_stat, AHCIDevice),
1713         VMSTATE_UINT32(port_regs.irq_mask, AHCIDevice),
1714         VMSTATE_UINT32(port_regs.cmd, AHCIDevice),
1715         VMSTATE_UINT32(port_regs.tfdata, AHCIDevice),
1716         VMSTATE_UINT32(port_regs.sig, AHCIDevice),
1717         VMSTATE_UINT32(port_regs.scr_stat, AHCIDevice),
1718         VMSTATE_UINT32(port_regs.scr_ctl, AHCIDevice),
1719         VMSTATE_UINT32(port_regs.scr_err, AHCIDevice),
1720         VMSTATE_UINT32(port_regs.scr_act, AHCIDevice),
1721         VMSTATE_UINT32(port_regs.cmd_issue, AHCIDevice),
1722         VMSTATE_BOOL(done_first_drq, AHCIDevice),
1723         VMSTATE_INT32(busy_slot, AHCIDevice),
1724         VMSTATE_BOOL(init_d2h_sent, AHCIDevice),
1725         VMSTATE_STRUCT_ARRAY(ncq_tfs, AHCIDevice, AHCI_MAX_CMDS,
1726                              1, vmstate_ncq_tfs, NCQTransferState),
1727         VMSTATE_END_OF_LIST()
1728     },
1729 };
1730 
1731 static int ahci_state_post_load(void *opaque, int version_id)
1732 {
1733     int i, j;
1734     struct AHCIDevice *ad;
1735     NCQTransferState *ncq_tfs;
1736     AHCIPortRegs *pr;
1737     AHCIState *s = opaque;
1738 
1739     for (i = 0; i < s->ports; i++) {
1740         ad = &s->dev[i];
1741         pr = &ad->port_regs;
1742 
1743         if (!(pr->cmd & PORT_CMD_START) && (pr->cmd & PORT_CMD_LIST_ON)) {
1744             error_report("AHCI: DMA engine should be off, but status bit "
1745                          "indicates it is still running.");
1746             return -1;
1747         }
1748         if (!(pr->cmd & PORT_CMD_FIS_RX) && (pr->cmd & PORT_CMD_FIS_ON)) {
1749             error_report("AHCI: FIS RX engine should be off, but status bit "
1750                          "indicates it is still running.");
1751             return -1;
1752         }
1753 
1754         /* After a migrate, the DMA/FIS engines are "off" and
1755          * need to be conditionally restarted */
1756         pr->cmd &= ~(PORT_CMD_LIST_ON | PORT_CMD_FIS_ON);
1757         if (ahci_cond_start_engines(ad) != 0) {
1758             return -1;
1759         }
1760 
1761         for (j = 0; j < AHCI_MAX_CMDS; j++) {
1762             ncq_tfs = &ad->ncq_tfs[j];
1763             ncq_tfs->drive = ad;
1764 
1765             if (ncq_tfs->used != ncq_tfs->halt) {
1766                 return -1;
1767             }
1768             if (!ncq_tfs->halt) {
1769                 continue;
1770             }
1771             if (!is_ncq(ncq_tfs->cmd)) {
1772                 return -1;
1773             }
1774             if (ncq_tfs->slot != ncq_tfs->tag) {
1775                 return -1;
1776             }
1777             /* If ncq_tfs->halt is justly set, the engine should be engaged,
1778              * and the command list buffer should be mapped. */
1779             ncq_tfs->cmdh = get_cmd_header(s, i, ncq_tfs->slot);
1780             if (!ncq_tfs->cmdh) {
1781                 return -1;
1782             }
1783             ahci_populate_sglist(ncq_tfs->drive, &ncq_tfs->sglist,
1784                                  ncq_tfs->cmdh,
1785                                  ncq_tfs->sector_count * BDRV_SECTOR_SIZE,
1786                                  0);
1787             if (ncq_tfs->sector_count != ncq_tfs->sglist.size >> 9) {
1788                 return -1;
1789             }
1790         }
1791 
1792 
1793         /*
1794          * If an error is present, ad->busy_slot will be valid and not -1.
1795          * In this case, an operation is waiting to resume and will re-check
1796          * for additional AHCI commands to execute upon completion.
1797          *
1798          * In the case where no error was present, busy_slot will be -1,
1799          * and we should check to see if there are additional commands waiting.
1800          */
1801         if (ad->busy_slot == -1) {
1802             check_cmd(s, i);
1803         } else {
1804             /* We are in the middle of a command, and may need to access
1805              * the command header in guest memory again. */
1806             if (ad->busy_slot < 0 || ad->busy_slot >= AHCI_MAX_CMDS) {
1807                 return -1;
1808             }
1809             ad->cur_cmd = get_cmd_header(s, i, ad->busy_slot);
1810         }
1811     }
1812 
1813     return 0;
1814 }
1815 
1816 const VMStateDescription vmstate_ahci = {
1817     .name = "ahci",
1818     .version_id = 1,
1819     .post_load = ahci_state_post_load,
1820     .fields = (VMStateField[]) {
1821         VMSTATE_STRUCT_VARRAY_POINTER_INT32(dev, AHCIState, ports,
1822                                      vmstate_ahci_device, AHCIDevice),
1823         VMSTATE_UINT32(control_regs.cap, AHCIState),
1824         VMSTATE_UINT32(control_regs.ghc, AHCIState),
1825         VMSTATE_UINT32(control_regs.irqstatus, AHCIState),
1826         VMSTATE_UINT32(control_regs.impl, AHCIState),
1827         VMSTATE_UINT32(control_regs.version, AHCIState),
1828         VMSTATE_UINT32(idp_index, AHCIState),
1829         VMSTATE_INT32_EQUAL(ports, AHCIState, NULL),
1830         VMSTATE_END_OF_LIST()
1831     },
1832 };
1833 
1834 static const VMStateDescription vmstate_sysbus_ahci = {
1835     .name = "sysbus-ahci",
1836     .fields = (VMStateField[]) {
1837         VMSTATE_AHCI(ahci, SysbusAHCIState),
1838         VMSTATE_END_OF_LIST()
1839     },
1840 };
1841 
1842 static void sysbus_ahci_reset(DeviceState *dev)
1843 {
1844     SysbusAHCIState *s = SYSBUS_AHCI(dev);
1845 
1846     ahci_reset(&s->ahci);
1847 }
1848 
1849 static void sysbus_ahci_init(Object *obj)
1850 {
1851     SysbusAHCIState *s = SYSBUS_AHCI(obj);
1852     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1853 
1854     ahci_init(&s->ahci, DEVICE(obj));
1855 
1856     sysbus_init_mmio(sbd, &s->ahci.mem);
1857     sysbus_init_irq(sbd, &s->ahci.irq);
1858 }
1859 
1860 static void sysbus_ahci_realize(DeviceState *dev, Error **errp)
1861 {
1862     SysbusAHCIState *s = SYSBUS_AHCI(dev);
1863 
1864     ahci_realize(&s->ahci, dev, &address_space_memory, s->num_ports);
1865 }
1866 
1867 static Property sysbus_ahci_properties[] = {
1868     DEFINE_PROP_UINT32("num-ports", SysbusAHCIState, num_ports, 1),
1869     DEFINE_PROP_END_OF_LIST(),
1870 };
1871 
1872 static void sysbus_ahci_class_init(ObjectClass *klass, void *data)
1873 {
1874     DeviceClass *dc = DEVICE_CLASS(klass);
1875 
1876     dc->realize = sysbus_ahci_realize;
1877     dc->vmsd = &vmstate_sysbus_ahci;
1878     device_class_set_props(dc, sysbus_ahci_properties);
1879     dc->reset = sysbus_ahci_reset;
1880     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
1881 }
1882 
1883 static const TypeInfo sysbus_ahci_info = {
1884     .name          = TYPE_SYSBUS_AHCI,
1885     .parent        = TYPE_SYS_BUS_DEVICE,
1886     .instance_size = sizeof(SysbusAHCIState),
1887     .instance_init = sysbus_ahci_init,
1888     .class_init    = sysbus_ahci_class_init,
1889 };
1890 
1891 static void sysbus_ahci_register_types(void)
1892 {
1893     type_register_static(&sysbus_ahci_info);
1894 }
1895 
1896 type_init(sysbus_ahci_register_types)
1897 
1898 int32_t ahci_get_num_ports(PCIDevice *dev)
1899 {
1900     AHCIPCIState *d = ICH9_AHCI(dev);
1901     AHCIState *ahci = &d->ahci;
1902 
1903     return ahci->ports;
1904 }
1905 
1906 void ahci_ide_create_devs(PCIDevice *dev, DriveInfo **hd)
1907 {
1908     AHCIPCIState *d = ICH9_AHCI(dev);
1909     AHCIState *ahci = &d->ahci;
1910     int i;
1911 
1912     for (i = 0; i < ahci->ports; i++) {
1913         if (hd[i] == NULL) {
1914             continue;
1915         }
1916         ide_bus_create_drive(&ahci->dev[i].port, 0, hd[i]);
1917     }
1918 
1919 }
1920