xref: /openbmc/qemu/tests/qtest/libqos/ahci.c (revision ab1b2ba9c9e9871bb622b0f14a1b2e3f4adaa68f)
1  /*
2   * libqos AHCI functions
3   *
4   * Copyright (c) 2014 John Snow <jsnow@redhat.com>
5   *
6   * Permission is hereby granted, free of charge, to any person obtaining a copy
7   * of this software and associated documentation files (the "Software"), to deal
8   * in the Software without restriction, including without limitation the rights
9   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10   * copies of the Software, and to permit persons to whom the Software is
11   * furnished to do so, subject to the following conditions:
12   *
13   * The above copyright notice and this permission notice shall be included in
14   * all copies or substantial portions of the Software.
15   *
16   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19   * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22   * THE SOFTWARE.
23   */
24  
25  #include "qemu/osdep.h"
26  
27  #include "../libqtest.h"
28  #include "ahci.h"
29  #include "pci-pc.h"
30  
31  #include "qemu/host-utils.h"
32  
33  #include "hw/pci/pci_ids.h"
34  #include "hw/pci/pci_regs.h"
35  
36  typedef struct AHCICommandProp {
37      uint8_t  cmd;        /* Command Code */
38      bool     data;       /* Data transfer command? */
39      bool     pio;
40      bool     dma;
41      bool     lba28;
42      bool     lba48;
43      bool     read;
44      bool     write;
45      bool     atapi;
46      bool     ncq;
47      uint64_t size;       /* Static transfer size, for commands like IDENTIFY. */
48      uint32_t interrupts; /* Expected interrupts for this command. */
49  } AHCICommandProp;
50  
51  AHCICommandProp ahci_command_properties[] = {
52      { .cmd = CMD_READ_PIO,       .data = true,  .pio = true,
53                                   .lba28 = true, .read = true },
54      { .cmd = CMD_WRITE_PIO,      .data = true,  .pio = true,
55                                   .lba28 = true, .write = true },
56      { .cmd = CMD_READ_PIO_EXT,   .data = true,  .pio = true,
57                                   .lba48 = true, .read = true },
58      { .cmd = CMD_WRITE_PIO_EXT,  .data = true,  .pio = true,
59                                   .lba48 = true, .write = true },
60      { .cmd = CMD_READ_DMA,       .data = true,  .dma = true,
61                                   .lba28 = true, .read = true },
62      { .cmd = CMD_WRITE_DMA,      .data = true,  .dma = true,
63                                   .lba28 = true, .write = true },
64      { .cmd = CMD_READ_DMA_EXT,   .data = true,  .dma = true,
65                                   .lba48 = true, .read = true },
66      { .cmd = CMD_WRITE_DMA_EXT,  .data = true,  .dma = true,
67                                   .lba48 = true, .write = true },
68      { .cmd = CMD_IDENTIFY,       .data = true,  .pio = true,
69                                   .size = 512,   .read = true },
70      { .cmd = READ_FPDMA_QUEUED,  .data = true,  .dma = true,
71                                   .lba48 = true, .read = true, .ncq = true },
72      { .cmd = WRITE_FPDMA_QUEUED, .data = true,  .dma = true,
73                                   .lba48 = true, .write = true, .ncq = true },
74      { .cmd = CMD_READ_MAX,       .lba28 = true },
75      { .cmd = CMD_READ_MAX_EXT,   .lba48 = true },
76      { .cmd = CMD_FLUSH_CACHE,    .data = false },
77      { .cmd = CMD_PACKET,         .data = true,  .size = 16,
78                                   .atapi = true, .pio = true },
79      { .cmd = CMD_PACKET_ID,      .data = true,  .pio = true,
80                                   .size = 512,   .read = true }
81  };
82  
83  struct AHCICommand {
84      /* Test Management Data */
85      uint8_t name;
86      uint8_t port;
87      uint8_t slot;
88      uint8_t errors;
89      uint32_t interrupts;
90      uint64_t xbytes;
91      uint32_t prd_size;
92      uint32_t sector_size;
93      uint64_t buffer;
94      AHCICommandProp *props;
95      /* Data to be transferred to the guest */
96      AHCICommandHeader header;
97      RegH2DFIS fis;
98      unsigned char *atapi_cmd;
99  };
100  
101  /**
102   * Allocate space in the guest using information in the AHCIQState object.
103   */
104  uint64_t ahci_alloc(AHCIQState *ahci, size_t bytes)
105  {
106      g_assert(ahci);
107      g_assert(ahci->parent);
108      return qmalloc(ahci->parent, bytes);
109  }
110  
111  void ahci_free(AHCIQState *ahci, uint64_t addr)
112  {
113      g_assert(ahci);
114      g_assert(ahci->parent);
115      qfree(ahci->parent, addr);
116  }
117  
118  bool is_atapi(AHCIQState *ahci, uint8_t port)
119  {
120      return ahci_px_rreg(ahci, port, AHCI_PX_SIG) == AHCI_SIGNATURE_CDROM;
121  }
122  
123  /**
124   * Locate, verify, and return a handle to the AHCI device.
125   */
126  QPCIDevice *get_ahci_device(QTestState *qts, uint32_t *fingerprint)
127  {
128      QPCIDevice *ahci;
129      uint32_t ahci_fingerprint;
130      QPCIBus *pcibus;
131  
132      pcibus = qpci_new_pc(qts, NULL);
133  
134      /* Find the AHCI PCI device and verify it's the right one. */
135      ahci = qpci_device_find(pcibus, QPCI_DEVFN(0x1F, 0x02));
136      g_assert(ahci != NULL);
137  
138      ahci_fingerprint = qpci_config_readl(ahci, PCI_VENDOR_ID);
139  
140      switch (ahci_fingerprint) {
141      case AHCI_INTEL_ICH9:
142          break;
143      default:
144          /* Unknown device. */
145          g_assert_not_reached();
146      }
147  
148      if (fingerprint) {
149          *fingerprint = ahci_fingerprint;
150      }
151      return ahci;
152  }
153  
154  void free_ahci_device(QPCIDevice *dev)
155  {
156      QPCIBus *pcibus = dev ? dev->bus : NULL;
157  
158      /* libqos doesn't have a function for this, so free it manually */
159      g_free(dev);
160      qpci_free_pc(pcibus);
161  }
162  
163  /* Free all memory in-use by the AHCI device. */
164  void ahci_clean_mem(AHCIQState *ahci)
165  {
166      uint8_t port, slot;
167  
168      for (port = 0; port < 32; ++port) {
169          if (ahci->port[port].fb) {
170              ahci_free(ahci, ahci->port[port].fb);
171              ahci->port[port].fb = 0;
172          }
173          if (ahci->port[port].clb) {
174              for (slot = 0; slot < 32; slot++) {
175                  ahci_destroy_command(ahci, port, slot);
176              }
177              ahci_free(ahci, ahci->port[port].clb);
178              ahci->port[port].clb = 0;
179          }
180      }
181  }
182  
183  /*** Logical Device Initialization ***/
184  
185  /**
186   * Start the PCI device and sanity-check default operation.
187   */
188  void ahci_pci_enable(AHCIQState *ahci)
189  {
190      uint8_t reg;
191  
192      start_ahci_device(ahci);
193  
194      switch (ahci->fingerprint) {
195      case AHCI_INTEL_ICH9:
196          /* ICH9 has a register at PCI 0x92 that
197           * acts as a master port enabler mask. */
198          reg = qpci_config_readb(ahci->dev, 0x92);
199          reg |= 0x3F;
200          qpci_config_writeb(ahci->dev, 0x92, reg);
201          /* 0...0111111b -- bit significant, ports 0-5 enabled. */
202          ASSERT_BIT_SET(qpci_config_readb(ahci->dev, 0x92), 0x3F);
203          break;
204      }
205  
206  }
207  
208  /**
209   * Map BAR5/ABAR, and engage the PCI device.
210   */
211  void start_ahci_device(AHCIQState *ahci)
212  {
213      /* Map AHCI's ABAR (BAR5) */
214      ahci->hba_bar = qpci_iomap(ahci->dev, 5, &ahci->barsize);
215  
216      /* turns on pci.cmd.iose, pci.cmd.mse and pci.cmd.bme */
217      qpci_device_enable(ahci->dev);
218  }
219  
220  /**
221   * Test and initialize the AHCI's HBA memory areas.
222   * Initialize and start any ports with devices attached.
223   * Bring the HBA into the idle state.
224   */
225  void ahci_hba_enable(AHCIQState *ahci)
226  {
227      /* Bits of interest in this section:
228       * GHC.AE     Global Host Control / AHCI Enable
229       * PxCMD.ST   Port Command: Start
230       * PxCMD.SUD  "Spin Up Device"
231       * PxCMD.POD  "Power On Device"
232       * PxCMD.FRE  "FIS Receive Enable"
233       * PxCMD.FR   "FIS Receive Running"
234       * PxCMD.CR   "Command List Running"
235       */
236      uint32_t reg, ports_impl;
237      uint16_t i;
238      uint8_t num_cmd_slots;
239  
240      g_assert(ahci != NULL);
241  
242      /* Set GHC.AE to 1 */
243      ahci_set(ahci, AHCI_GHC, AHCI_GHC_AE);
244      reg = ahci_rreg(ahci, AHCI_GHC);
245      ASSERT_BIT_SET(reg, AHCI_GHC_AE);
246  
247      /* Cache CAP and CAP2. */
248      ahci->cap = ahci_rreg(ahci, AHCI_CAP);
249      ahci->cap2 = ahci_rreg(ahci, AHCI_CAP2);
250  
251      /* Read CAP.NCS, how many command slots do we have? */
252      num_cmd_slots = ((ahci->cap & AHCI_CAP_NCS) >> ctzl(AHCI_CAP_NCS)) + 1;
253      g_test_message("Number of Command Slots: %u", num_cmd_slots);
254  
255      /* Determine which ports are implemented. */
256      ports_impl = ahci_rreg(ahci, AHCI_PI);
257  
258      for (i = 0; ports_impl; ports_impl >>= 1, ++i) {
259          if (!(ports_impl & 0x01)) {
260              continue;
261          }
262  
263          g_test_message("Initializing port %u", i);
264  
265          reg = ahci_px_rreg(ahci, i, AHCI_PX_CMD);
266          if (BITCLR(reg, AHCI_PX_CMD_ST | AHCI_PX_CMD_CR |
267                     AHCI_PX_CMD_FRE | AHCI_PX_CMD_FR)) {
268              g_test_message("port is idle");
269          } else {
270              g_test_message("port needs to be idled");
271              ahci_px_clr(ahci, i, AHCI_PX_CMD,
272                          (AHCI_PX_CMD_ST | AHCI_PX_CMD_FRE));
273              /* The port has 500ms to disengage. */
274              usleep(500000);
275              reg = ahci_px_rreg(ahci, i, AHCI_PX_CMD);
276              ASSERT_BIT_CLEAR(reg, AHCI_PX_CMD_CR);
277              ASSERT_BIT_CLEAR(reg, AHCI_PX_CMD_FR);
278              g_test_message("port is now idle");
279              /* The spec does allow for possibly needing a PORT RESET
280               * or HBA reset if we fail to idle the port. */
281          }
282  
283          /* Allocate Memory for the Command List Buffer & FIS Buffer */
284          /* PxCLB space ... 0x20 per command, as in 4.2.2 p 36 */
285          ahci->port[i].clb = ahci_alloc(ahci, num_cmd_slots * 0x20);
286          qtest_memset(ahci->parent->qts, ahci->port[i].clb, 0x00,
287                       num_cmd_slots * 0x20);
288          g_test_message("CLB: 0x%08" PRIx64, ahci->port[i].clb);
289          ahci_px_wreg(ahci, i, AHCI_PX_CLB, ahci->port[i].clb);
290          g_assert_cmphex(ahci->port[i].clb, ==,
291                          ahci_px_rreg(ahci, i, AHCI_PX_CLB));
292  
293          /* PxFB space ... 0x100, as in 4.2.1 p 35 */
294          ahci->port[i].fb = ahci_alloc(ahci, 0x100);
295          qtest_memset(ahci->parent->qts, ahci->port[i].fb, 0x00, 0x100);
296          g_test_message("FB: 0x%08" PRIx64, ahci->port[i].fb);
297          ahci_px_wreg(ahci, i, AHCI_PX_FB, ahci->port[i].fb);
298          g_assert_cmphex(ahci->port[i].fb, ==,
299                          ahci_px_rreg(ahci, i, AHCI_PX_FB));
300  
301          /* Clear PxSERR, PxIS, then IS.IPS[x] by writing '1's. */
302          ahci_px_wreg(ahci, i, AHCI_PX_SERR, 0xFFFFFFFF);
303          ahci_px_wreg(ahci, i, AHCI_PX_IS, 0xFFFFFFFF);
304          ahci_wreg(ahci, AHCI_IS, (1 << i));
305  
306          /* Verify Interrupts Cleared */
307          reg = ahci_px_rreg(ahci, i, AHCI_PX_SERR);
308          g_assert_cmphex(reg, ==, 0);
309  
310          reg = ahci_px_rreg(ahci, i, AHCI_PX_IS);
311          g_assert_cmphex(reg, ==, 0);
312  
313          reg = ahci_rreg(ahci, AHCI_IS);
314          ASSERT_BIT_CLEAR(reg, (1 << i));
315  
316          /* Enable All Interrupts: */
317          ahci_px_wreg(ahci, i, AHCI_PX_IE, 0xFFFFFFFF);
318          reg = ahci_px_rreg(ahci, i, AHCI_PX_IE);
319          g_assert_cmphex(reg, ==, ~((uint32_t)AHCI_PX_IE_RESERVED));
320  
321          /* Enable the FIS Receive Engine. */
322          ahci_px_set(ahci, i, AHCI_PX_CMD, AHCI_PX_CMD_FRE);
323          reg = ahci_px_rreg(ahci, i, AHCI_PX_CMD);
324          ASSERT_BIT_SET(reg, AHCI_PX_CMD_FR);
325  
326          /* AHCI 1.3 spec: if !STS.BSY, !STS.DRQ and PxSSTS.DET indicates
327           * physical presence, a device is present and may be started. However,
328           * PxSERR.DIAG.X /may/ need to be cleared a priori. */
329          reg = ahci_px_rreg(ahci, i, AHCI_PX_SERR);
330          if (BITSET(reg, AHCI_PX_SERR_DIAG_X)) {
331              ahci_px_set(ahci, i, AHCI_PX_SERR, AHCI_PX_SERR_DIAG_X);
332          }
333  
334          reg = ahci_px_rreg(ahci, i, AHCI_PX_TFD);
335          if (BITCLR(reg, AHCI_PX_TFD_STS_BSY | AHCI_PX_TFD_STS_DRQ)) {
336              reg = ahci_px_rreg(ahci, i, AHCI_PX_SSTS);
337              if ((reg & AHCI_PX_SSTS_DET) == SSTS_DET_ESTABLISHED) {
338                  /* Device Found: set PxCMD.ST := 1 */
339                  ahci_px_set(ahci, i, AHCI_PX_CMD, AHCI_PX_CMD_ST);
340                  ASSERT_BIT_SET(ahci_px_rreg(ahci, i, AHCI_PX_CMD),
341                                 AHCI_PX_CMD_CR);
342                  g_test_message("Started Device %u", i);
343              } else if ((reg & AHCI_PX_SSTS_DET)) {
344                  /* Device present, but in some unknown state. */
345                  g_assert_not_reached();
346              }
347          }
348      }
349  
350      /* Enable GHC.IE */
351      ahci_set(ahci, AHCI_GHC, AHCI_GHC_IE);
352      reg = ahci_rreg(ahci, AHCI_GHC);
353      ASSERT_BIT_SET(reg, AHCI_GHC_IE);
354  
355      ahci->enabled = true;
356      /* TODO: The device should now be idling and waiting for commands.
357       * In the future, a small test-case to inspect the Register D2H FIS
358       * and clear the initial interrupts might be good. */
359  }
360  
361  /**
362   * Pick the first implemented and running port
363   */
364  unsigned ahci_port_select(AHCIQState *ahci)
365  {
366      uint32_t ports, reg;
367      unsigned i;
368  
369      ports = ahci_rreg(ahci, AHCI_PI);
370      for (i = 0; i < 32; ports >>= 1, ++i) {
371          if (ports == 0) {
372              i = 32;
373          }
374  
375          if (!(ports & 0x01)) {
376              continue;
377          }
378  
379          reg = ahci_px_rreg(ahci, i, AHCI_PX_CMD);
380          if (BITSET(reg, AHCI_PX_CMD_ST)) {
381              break;
382          }
383      }
384      g_assert(i < 32);
385      return i;
386  }
387  
388  /**
389   * Clear a port's interrupts and status information prior to a test.
390   */
391  void ahci_port_clear(AHCIQState *ahci, uint8_t port)
392  {
393      uint32_t reg;
394  
395      /* Clear out this port's interrupts (ignore the init register d2h fis) */
396      reg = ahci_px_rreg(ahci, port, AHCI_PX_IS);
397      ahci_px_wreg(ahci, port, AHCI_PX_IS, reg);
398      g_assert_cmphex(ahci_px_rreg(ahci, port, AHCI_PX_IS), ==, 0);
399  
400      /* Wipe the FIS-Receive Buffer */
401      qtest_memset(ahci->parent->qts, ahci->port[port].fb, 0x00, 0x100);
402  }
403  
404  /**
405   * Check a port for errors.
406   */
407  void ahci_port_check_error(AHCIQState *ahci, uint8_t port,
408                             uint32_t imask, uint8_t emask)
409  {
410      uint32_t reg;
411  
412      /* The upper 9 bits of the IS register all indicate errors. */
413      reg = ahci_px_rreg(ahci, port, AHCI_PX_IS);
414      reg &= ~imask;
415      reg >>= 23;
416      g_assert_cmphex(reg, ==, 0);
417  
418      /* The Sata Error Register should be empty. */
419      reg = ahci_px_rreg(ahci, port, AHCI_PX_SERR);
420      g_assert_cmphex(reg, ==, 0);
421  
422      /* The TFD also has two error sections. */
423      reg = ahci_px_rreg(ahci, port, AHCI_PX_TFD);
424      if (!emask) {
425          ASSERT_BIT_CLEAR(reg, AHCI_PX_TFD_STS_ERR);
426      } else {
427          ASSERT_BIT_SET(reg, AHCI_PX_TFD_STS_ERR);
428      }
429      ASSERT_BIT_CLEAR(reg, AHCI_PX_TFD_ERR & (~emask << 8));
430      ASSERT_BIT_SET(reg, AHCI_PX_TFD_ERR & (emask << 8));
431  }
432  
433  void ahci_port_check_interrupts(AHCIQState *ahci, uint8_t port,
434                                  uint32_t intr_mask)
435  {
436      uint32_t reg;
437  
438      /* Check for expected interrupts */
439      reg = ahci_px_rreg(ahci, port, AHCI_PX_IS);
440      ASSERT_BIT_SET(reg, intr_mask);
441  
442      /* Clear expected interrupts and assert all interrupts now cleared. */
443      ahci_px_wreg(ahci, port, AHCI_PX_IS, intr_mask);
444      g_assert_cmphex(ahci_px_rreg(ahci, port, AHCI_PX_IS), ==, 0);
445  }
446  
447  void ahci_port_check_nonbusy(AHCIQState *ahci, uint8_t port, uint8_t slot)
448  {
449      uint32_t reg;
450  
451      /* Assert that the command slot is no longer busy (NCQ) */
452      reg = ahci_px_rreg(ahci, port, AHCI_PX_SACT);
453      ASSERT_BIT_CLEAR(reg, (1 << slot));
454  
455      /* Non-NCQ */
456      reg = ahci_px_rreg(ahci, port, AHCI_PX_CI);
457      ASSERT_BIT_CLEAR(reg, (1 << slot));
458  
459      /* And assert that we are generally not busy. */
460      reg = ahci_px_rreg(ahci, port, AHCI_PX_TFD);
461      ASSERT_BIT_CLEAR(reg, AHCI_PX_TFD_STS_BSY);
462      ASSERT_BIT_CLEAR(reg, AHCI_PX_TFD_STS_DRQ);
463  }
464  
465  void ahci_port_check_d2h_sanity(AHCIQState *ahci, uint8_t port, uint8_t slot)
466  {
467      RegD2HFIS *d2h = g_malloc0(0x20);
468      uint32_t reg;
469  
470      qtest_memread(ahci->parent->qts, ahci->port[port].fb + 0x40, d2h, 0x20);
471      g_assert_cmphex(d2h->fis_type, ==, 0x34);
472  
473      reg = ahci_px_rreg(ahci, port, AHCI_PX_TFD);
474      g_assert_cmphex((reg & AHCI_PX_TFD_ERR) >> 8, ==, d2h->error);
475      g_assert_cmphex((reg & AHCI_PX_TFD_STS), ==, d2h->status);
476  
477      g_free(d2h);
478  }
479  
480  void ahci_port_check_pio_sanity(AHCIQState *ahci, AHCICommand *cmd)
481  {
482      PIOSetupFIS *pio = g_malloc0(0x20);
483      uint8_t port = cmd->port;
484  
485      /* We cannot check the Status or E_Status registers, because
486       * the status may have again changed between the PIO Setup FIS
487       * and the conclusion of the command with the D2H Register FIS. */
488      qtest_memread(ahci->parent->qts, ahci->port[port].fb + 0x20, pio, 0x20);
489      g_assert_cmphex(pio->fis_type, ==, 0x5f);
490  
491      /* Data transferred by PIO will either be:
492       * (1) 12 or 16 bytes for an ATAPI command packet (QEMU always uses 12), or
493       * (2) Actual data from the drive.
494       * If we do both, (2) winds up erasing any evidence of (1).
495       */
496      if (cmd->props->atapi && (cmd->xbytes == 0 || cmd->props->dma)) {
497          g_assert(le16_to_cpu(pio->tx_count) == 12 ||
498                   le16_to_cpu(pio->tx_count) == 16);
499      } else {
500          /* The AHCI test suite here does not test any PIO command that specifies
501           * a DRQ block larger than one sector (like 0xC4), so this should always
502           * be one sector or less. */
503          size_t pio_len = ((cmd->xbytes % cmd->sector_size) ?
504                            (cmd->xbytes % cmd->sector_size) : cmd->sector_size);
505          g_assert_cmphex(le16_to_cpu(pio->tx_count), ==, pio_len);
506      }
507      g_free(pio);
508  }
509  
510  void ahci_port_check_cmd_sanity(AHCIQState *ahci, AHCICommand *cmd)
511  {
512      AHCICommandHeader cmdh;
513  
514      ahci_get_command_header(ahci, cmd->port, cmd->slot, &cmdh);
515      /* Physical Region Descriptor Byte Count is not required to work for NCQ. */
516      if (!cmd->props->ncq) {
517          g_assert_cmphex(cmd->xbytes, ==, cmdh.prdbc);
518      }
519  }
520  
521  /* Get the command in #slot of port #port. */
522  void ahci_get_command_header(AHCIQState *ahci, uint8_t port,
523                               uint8_t slot, AHCICommandHeader *cmd)
524  {
525      uint64_t ba = ahci->port[port].clb;
526      ba += slot * sizeof(AHCICommandHeader);
527      qtest_memread(ahci->parent->qts, ba, cmd, sizeof(AHCICommandHeader));
528  
529      cmd->flags = le16_to_cpu(cmd->flags);
530      cmd->prdtl = le16_to_cpu(cmd->prdtl);
531      cmd->prdbc = le32_to_cpu(cmd->prdbc);
532      cmd->ctba = le64_to_cpu(cmd->ctba);
533  }
534  
535  /* Set the command in #slot of port #port. */
536  void ahci_set_command_header(AHCIQState *ahci, uint8_t port,
537                               uint8_t slot, AHCICommandHeader *cmd)
538  {
539      AHCICommandHeader tmp = { .flags = 0 };
540      uint64_t ba = ahci->port[port].clb;
541      ba += slot * sizeof(AHCICommandHeader);
542  
543      tmp.flags = cpu_to_le16(cmd->flags);
544      tmp.prdtl = cpu_to_le16(cmd->prdtl);
545      tmp.prdbc = cpu_to_le32(cmd->prdbc);
546      tmp.ctba = cpu_to_le64(cmd->ctba);
547  
548      qtest_memwrite(ahci->parent->qts, ba, &tmp, sizeof(AHCICommandHeader));
549  }
550  
551  void ahci_destroy_command(AHCIQState *ahci, uint8_t port, uint8_t slot)
552  {
553      AHCICommandHeader cmd;
554  
555      /* Obtain the Nth Command Header */
556      ahci_get_command_header(ahci, port, slot, &cmd);
557      if (cmd.ctba == 0) {
558          /* No address in it, so just return -- it's empty. */
559          goto tidy;
560      }
561  
562      /* Free the Table */
563      ahci_free(ahci, cmd.ctba);
564  
565   tidy:
566      /* NULL the header. */
567      memset(&cmd, 0x00, sizeof(cmd));
568      ahci_set_command_header(ahci, port, slot, &cmd);
569      ahci->port[port].ctba[slot] = 0;
570      ahci->port[port].prdtl[slot] = 0;
571  }
572  
573  void ahci_write_fis(AHCIQState *ahci, AHCICommand *cmd)
574  {
575      RegH2DFIS tmp = cmd->fis;
576      uint64_t addr = cmd->header.ctba;
577  
578      /* NCQ commands use exclusively 8 bit fields and needs no adjustment.
579       * Only the count field needs to be adjusted for non-NCQ commands.
580       * The auxiliary FIS fields are defined per-command and are not currently
581       * implemented in ahci.o, but may or may not need to be flipped. */
582      if (!cmd->props->ncq) {
583          tmp.count = cpu_to_le16(tmp.count);
584      }
585  
586      qtest_memwrite(ahci->parent->qts, addr, &tmp, sizeof(tmp));
587  }
588  
589  unsigned ahci_pick_cmd(AHCIQState *ahci, uint8_t port)
590  {
591      unsigned i;
592      unsigned j;
593      uint32_t reg;
594  
595      reg = ahci_px_rreg(ahci, port, AHCI_PX_CI);
596  
597      /* Pick the least recently used command slot that's available */
598      for (i = 0; i < 32; ++i) {
599          j = ((ahci->port[port].next + i) % 32);
600          if (reg & (1 << j)) {
601              continue;
602          }
603          ahci_destroy_command(ahci, port, j);
604          ahci->port[port].next = (j + 1) % 32;
605          return j;
606      }
607  
608      g_test_message("All command slots were busy.");
609      g_assert_not_reached();
610  }
611  
612  inline unsigned size_to_prdtl(unsigned bytes, unsigned bytes_per_prd)
613  {
614      /* Each PRD can describe up to 4MiB */
615      g_assert_cmphex(bytes_per_prd, <=, 4096 * 1024);
616      g_assert_cmphex(bytes_per_prd & 0x01, ==, 0x00);
617      return (bytes + bytes_per_prd - 1) / bytes_per_prd;
618  }
619  
620  const AHCIOpts default_opts = { .size = 0 };
621  
622  /**
623   * ahci_exec: execute a given command on a specific
624   * AHCI port.
625   *
626   * @ahci: The device to send the command to
627   * @port: The port number of the SATA device we wish
628   *        to have execute this command
629   * @op:   The S/ATA command to execute, or if opts.atapi
630   *        is true, the SCSI command code.
631   * @opts: Optional arguments to modify execution behavior.
632   */
633  void ahci_exec(AHCIQState *ahci, uint8_t port,
634                 uint8_t op, const AHCIOpts *opts_in)
635  {
636      AHCICommand *cmd;
637      int rc;
638      AHCIOpts *opts;
639      uint64_t buffer_in;
640  
641      opts = g_memdup2((opts_in == NULL ? &default_opts : opts_in),
642                       sizeof(AHCIOpts));
643  
644      buffer_in = opts->buffer;
645  
646      /* No guest buffer provided, create one. */
647      if (opts->size && !opts->buffer) {
648          opts->buffer = ahci_alloc(ahci, opts->size);
649          g_assert(opts->buffer);
650          qtest_memset(ahci->parent->qts, opts->buffer, 0x00, opts->size);
651      }
652  
653      /* Command creation */
654      if (opts->atapi) {
655          uint16_t bcl = opts->set_bcl ? opts->bcl : ATAPI_SECTOR_SIZE;
656          cmd = ahci_atapi_command_create(op, bcl, opts->atapi_dma);
657      } else {
658          cmd = ahci_command_create(op);
659      }
660      ahci_command_adjust(cmd, opts->lba, opts->buffer,
661                          opts->size, opts->prd_size);
662  
663      if (opts->pre_cb) {
664          rc = opts->pre_cb(ahci, cmd, opts);
665          g_assert_cmpint(rc, ==, 0);
666      }
667  
668      /* Write command to memory and issue it */
669      ahci_command_commit(ahci, cmd, port);
670      ahci_command_issue_async(ahci, cmd);
671      if (opts->error) {
672          qtest_qmp_eventwait(ahci->parent->qts, "STOP");
673      }
674      if (opts->mid_cb) {
675          rc = opts->mid_cb(ahci, cmd, opts);
676          g_assert_cmpint(rc, ==, 0);
677      }
678      if (opts->error) {
679          qtest_qmp_send(ahci->parent->qts, "{'execute':'cont' }");
680          qtest_qmp_eventwait(ahci->parent->qts, "RESUME");
681      }
682  
683      /* Wait for command to complete and verify sanity */
684      ahci_command_wait(ahci, cmd);
685      ahci_command_verify(ahci, cmd);
686      if (opts->post_cb) {
687          rc = opts->post_cb(ahci, cmd, opts);
688          g_assert_cmpint(rc, ==, 0);
689      }
690      ahci_command_free(cmd);
691      if (opts->buffer != buffer_in) {
692          ahci_free(ahci, opts->buffer);
693      }
694      g_free(opts);
695  }
696  
697  /* Issue a command, expecting it to fail and STOP the VM */
698  AHCICommand *ahci_guest_io_halt(AHCIQState *ahci, uint8_t port,
699                                  uint8_t ide_cmd, uint64_t buffer,
700                                  size_t bufsize, uint64_t sector)
701  {
702      AHCICommand *cmd;
703  
704      cmd = ahci_command_create(ide_cmd);
705      ahci_command_adjust(cmd, sector, buffer, bufsize, 0);
706      ahci_command_commit(ahci, cmd, port);
707      ahci_command_issue_async(ahci, cmd);
708      qtest_qmp_eventwait(ahci->parent->qts, "STOP");
709  
710      return cmd;
711  }
712  
713  /* Resume a previously failed command and verify/finalize */
714  void ahci_guest_io_resume(AHCIQState *ahci, AHCICommand *cmd)
715  {
716      /* Complete the command */
717      qtest_qmp_send(ahci->parent->qts, "{'execute':'cont' }");
718      qtest_qmp_eventwait(ahci->parent->qts, "RESUME");
719      ahci_command_wait(ahci, cmd);
720      ahci_command_verify(ahci, cmd);
721      ahci_command_free(cmd);
722  }
723  
724  /* Given a guest buffer address, perform an IO operation */
725  void ahci_guest_io(AHCIQState *ahci, uint8_t port, uint8_t ide_cmd,
726                     uint64_t buffer, size_t bufsize, uint64_t sector)
727  {
728      AHCICommand *cmd;
729      cmd = ahci_command_create(ide_cmd);
730      ahci_command_set_buffer(cmd, buffer);
731      ahci_command_set_size(cmd, bufsize);
732      if (sector) {
733          ahci_command_set_offset(cmd, sector);
734      }
735      ahci_command_commit(ahci, cmd, port);
736      ahci_command_issue(ahci, cmd);
737      ahci_command_verify(ahci, cmd);
738      ahci_command_free(cmd);
739  }
740  
741  static AHCICommandProp *ahci_command_find(uint8_t command_name)
742  {
743      int i;
744  
745      for (i = 0; i < ARRAY_SIZE(ahci_command_properties); i++) {
746          if (ahci_command_properties[i].cmd == command_name) {
747              return &ahci_command_properties[i];
748          }
749      }
750  
751      return NULL;
752  }
753  
754  /* Given a HOST buffer, create a buffer address and perform an IO operation. */
755  void ahci_io(AHCIQState *ahci, uint8_t port, uint8_t ide_cmd,
756               void *buffer, size_t bufsize, uint64_t sector)
757  {
758      uint64_t ptr;
759      AHCICommandProp *props;
760  
761      props = ahci_command_find(ide_cmd);
762      g_assert(props);
763      ptr = ahci_alloc(ahci, bufsize);
764      g_assert(!bufsize || ptr);
765      qtest_memset(ahci->parent->qts, ptr, 0x00, bufsize);
766  
767      if (bufsize && props->write) {
768          qtest_bufwrite(ahci->parent->qts, ptr, buffer, bufsize);
769      }
770  
771      ahci_guest_io(ahci, port, ide_cmd, ptr, bufsize, sector);
772  
773      if (bufsize && props->read) {
774          qtest_bufread(ahci->parent->qts, ptr, buffer, bufsize);
775      }
776  
777      ahci_free(ahci, ptr);
778  }
779  
780  /**
781   * Initializes a basic command header in memory.
782   * We assume that this is for an ATA command using RegH2DFIS.
783   */
784  static void command_header_init(AHCICommand *cmd)
785  {
786      AHCICommandHeader *hdr = &cmd->header;
787      AHCICommandProp *props = cmd->props;
788  
789      hdr->flags = 5;             /* RegH2DFIS is 5 DW long. Must be < 32 */
790      hdr->flags |= CMDH_CLR_BSY; /* Clear the BSY bit when done */
791      if (props->write) {
792          hdr->flags |= CMDH_WRITE;
793      }
794      if (props->atapi) {
795          hdr->flags |= CMDH_ATAPI;
796      }
797      /* Other flags: PREFETCH, RESET, and BIST */
798      hdr->prdtl = size_to_prdtl(cmd->xbytes, cmd->prd_size);
799      hdr->prdbc = 0;
800      hdr->ctba = 0;
801  }
802  
803  static void command_table_init(AHCICommand *cmd)
804  {
805      RegH2DFIS *fis = &(cmd->fis);
806      uint16_t sect_count = (cmd->xbytes / cmd->sector_size);
807  
808      fis->fis_type = REG_H2D_FIS;
809      fis->flags = REG_H2D_FIS_CMD; /* "Command" bit */
810      fis->command = cmd->name;
811  
812      if (cmd->props->ncq) {
813          NCQFIS *ncqfis = (NCQFIS *)fis;
814          /* NCQ is weird and re-uses FIS frames for unrelated data.
815           * See SATA 3.2, 13.6.4.1 READ FPDMA QUEUED for an example. */
816          ncqfis->sector_low = sect_count & 0xFF;
817          ncqfis->sector_hi = (sect_count >> 8) & 0xFF;
818          ncqfis->device = NCQ_DEVICE_MAGIC;
819          /* Force Unit Access is bit 7 in the device register */
820          ncqfis->tag = 0;  /* bits 3-7 are the NCQ tag */
821          ncqfis->prio = 0; /* bits 6,7 are a prio tag */
822          /* RARC bit is bit 0 of TAG field */
823      } else {
824          fis->feature_low = 0x00;
825          fis->feature_high = 0x00;
826          if (cmd->props->lba28 || cmd->props->lba48) {
827              fis->device = ATA_DEVICE_LBA;
828          }
829          fis->count = (cmd->xbytes / cmd->sector_size);
830      }
831      fis->icc = 0x00;
832      fis->control = 0x00;
833      memset(fis->aux, 0x00, ARRAY_SIZE(fis->aux));
834  }
835  
836  void ahci_command_enable_atapi_dma(AHCICommand *cmd)
837  {
838      RegH2DFIS *fis = &(cmd->fis);
839      g_assert(cmd->props->atapi);
840      fis->feature_low |= 0x01;
841      /* PIO is still used to transfer the ATAPI command */
842      g_assert(cmd->props->pio);
843      cmd->props->dma = true;
844      /* BUG: We expect the DMA Setup interrupt for DMA commands */
845      /* cmd->interrupts |= AHCI_PX_IS_DSS; */
846  }
847  
848  AHCICommand *ahci_command_create(uint8_t command_name)
849  {
850      AHCICommandProp *props = ahci_command_find(command_name);
851      AHCICommand *cmd;
852  
853      g_assert(props);
854      cmd = g_new0(AHCICommand, 1);
855      g_assert(!(props->dma && props->pio) || props->atapi);
856      g_assert(!(props->lba28 && props->lba48));
857      g_assert(!(props->read && props->write));
858      g_assert(!props->size || props->data);
859      g_assert(!props->ncq || props->lba48);
860  
861      /* Defaults and book-keeping */
862      cmd->props = g_memdup2(props, sizeof(AHCICommandProp));
863      cmd->name = command_name;
864      cmd->xbytes = props->size;
865      cmd->prd_size = 4096;
866      cmd->buffer = 0xabad1dea;
867      cmd->sector_size = props->atapi ? ATAPI_SECTOR_SIZE : AHCI_SECTOR_SIZE;
868  
869      if (!cmd->props->ncq) {
870          cmd->interrupts = AHCI_PX_IS_DHRS;
871      }
872      /* BUG: We expect the DPS interrupt for data commands */
873      /* cmd->interrupts |= props->data ? AHCI_PX_IS_DPS : 0; */
874      /* BUG: We expect the DMA Setup interrupt for DMA commands */
875      /* cmd->interrupts |= props->dma ? AHCI_PX_IS_DSS : 0; */
876      cmd->interrupts |= props->ncq ? AHCI_PX_IS_SDBS : 0;
877  
878      command_header_init(cmd);
879      command_table_init(cmd);
880  
881      return cmd;
882  }
883  
884  AHCICommand *ahci_atapi_command_create(uint8_t scsi_cmd, uint16_t bcl, bool dma)
885  {
886      AHCICommand *cmd = ahci_command_create(CMD_PACKET);
887      cmd->atapi_cmd = g_malloc0(16);
888      cmd->atapi_cmd[0] = scsi_cmd;
889      stw_le_p(&cmd->fis.lba_lo[1], bcl);
890      if (dma) {
891          ahci_command_enable_atapi_dma(cmd);
892      } else {
893          cmd->interrupts |= bcl ? AHCI_PX_IS_PSS : 0;
894      }
895      return cmd;
896  }
897  
898  void ahci_atapi_test_ready(AHCIQState *ahci, uint8_t port,
899                             bool ready, uint8_t expected_sense)
900  {
901      AHCICommand *cmd = ahci_atapi_command_create(CMD_ATAPI_TEST_UNIT_READY, 0, false);
902      ahci_command_set_size(cmd, 0);
903      if (!ready) {
904          cmd->interrupts |= AHCI_PX_IS_TFES;
905          cmd->errors |= expected_sense << 4;
906      }
907      ahci_command_commit(ahci, cmd, port);
908      ahci_command_issue(ahci, cmd);
909      ahci_command_verify(ahci, cmd);
910      ahci_command_free(cmd);
911  }
912  
913  static int copy_buffer(AHCIQState *ahci, AHCICommand *cmd,
914                          const AHCIOpts *opts)
915  {
916      unsigned char *rx = opts->opaque;
917      qtest_bufread(ahci->parent->qts, opts->buffer, rx, opts->size);
918      return 0;
919  }
920  
921  void ahci_atapi_get_sense(AHCIQState *ahci, uint8_t port,
922                            uint8_t *sense, uint8_t *asc)
923  {
924      unsigned char *rx;
925      AHCIOpts opts = {
926          .size = 18,
927          .atapi = true,
928          .post_cb = copy_buffer,
929      };
930      rx = g_malloc(18);
931      opts.opaque = rx;
932  
933      ahci_exec(ahci, port, CMD_ATAPI_REQUEST_SENSE, &opts);
934  
935      *sense = rx[2];
936      *asc = rx[12];
937  
938      g_free(rx);
939  }
940  
941  void ahci_atapi_eject(AHCIQState *ahci, uint8_t port)
942  {
943      AHCICommand *cmd = ahci_atapi_command_create(CMD_ATAPI_START_STOP_UNIT, 0, false);
944      ahci_command_set_size(cmd, 0);
945  
946      cmd->atapi_cmd[4] = 0x02; /* loej = true */
947      ahci_command_commit(ahci, cmd, port);
948      ahci_command_issue(ahci, cmd);
949      ahci_command_verify(ahci, cmd);
950      ahci_command_free(cmd);
951  }
952  
953  void ahci_atapi_load(AHCIQState *ahci, uint8_t port)
954  {
955      AHCICommand *cmd = ahci_atapi_command_create(CMD_ATAPI_START_STOP_UNIT, 0, false);
956      ahci_command_set_size(cmd, 0);
957  
958      cmd->atapi_cmd[4] = 0x03; /* loej,start = true */
959      ahci_command_commit(ahci, cmd, port);
960      ahci_command_issue(ahci, cmd);
961      ahci_command_verify(ahci, cmd);
962      ahci_command_free(cmd);
963  }
964  
965  void ahci_command_free(AHCICommand *cmd)
966  {
967      g_free(cmd->atapi_cmd);
968      g_free(cmd->props);
969      g_free(cmd);
970  }
971  
972  void ahci_command_set_flags(AHCICommand *cmd, uint16_t cmdh_flags)
973  {
974      cmd->header.flags |= cmdh_flags;
975  }
976  
977  void ahci_command_clr_flags(AHCICommand *cmd, uint16_t cmdh_flags)
978  {
979      cmd->header.flags &= ~cmdh_flags;
980  }
981  
982  static void ahci_atapi_command_set_offset(AHCICommand *cmd, uint64_t lba)
983  {
984      unsigned char *cbd = cmd->atapi_cmd;
985      g_assert(cbd);
986  
987      switch (cbd[0]) {
988      case CMD_ATAPI_READ_10:
989      case CMD_ATAPI_READ_CD:
990          g_assert_cmpuint(lba, <=, UINT32_MAX);
991          stl_be_p(&cbd[2], lba);
992          break;
993      case CMD_ATAPI_REQUEST_SENSE:
994      case CMD_ATAPI_TEST_UNIT_READY:
995      case CMD_ATAPI_START_STOP_UNIT:
996          g_assert_cmpuint(lba, ==, 0x00);
997          break;
998      default:
999          /* SCSI doesn't have uniform packet formats,
1000           * so you have to add support for it manually. Sorry! */
1001          fprintf(stderr, "The Libqos AHCI driver does not support the "
1002                  "set_offset operation for ATAPI command 0x%02x, "
1003                  "please add support.\n",
1004                  cbd[0]);
1005          g_assert_not_reached();
1006      }
1007  }
1008  
1009  void ahci_command_set_offset(AHCICommand *cmd, uint64_t lba_sect)
1010  {
1011      RegH2DFIS *fis = &(cmd->fis);
1012  
1013      if (cmd->props->atapi) {
1014          ahci_atapi_command_set_offset(cmd, lba_sect);
1015          return;
1016      } else if (!cmd->props->data && !lba_sect) {
1017          /* Not meaningful, ignore. */
1018          return;
1019      } else if (cmd->props->lba28) {
1020          g_assert_cmphex(lba_sect, <=, 0xFFFFFFF);
1021      } else if (cmd->props->lba48 || cmd->props->ncq) {
1022          g_assert_cmphex(lba_sect, <=, 0xFFFFFFFFFFFF);
1023      } else {
1024          /* Can't set offset if we don't know the format. */
1025          g_assert_not_reached();
1026      }
1027  
1028      /* LBA28 uses the low nibble of the device/control register for LBA24:27 */
1029      fis->lba_lo[0] = (lba_sect & 0xFF);
1030      fis->lba_lo[1] = (lba_sect >> 8) & 0xFF;
1031      fis->lba_lo[2] = (lba_sect >> 16) & 0xFF;
1032      if (cmd->props->lba28) {
1033          fis->device = (fis->device & 0xF0) | ((lba_sect >> 24) & 0x0F);
1034      }
1035      fis->lba_hi[0] = (lba_sect >> 24) & 0xFF;
1036      fis->lba_hi[1] = (lba_sect >> 32) & 0xFF;
1037      fis->lba_hi[2] = (lba_sect >> 40) & 0xFF;
1038  }
1039  
1040  void ahci_command_set_buffer(AHCICommand *cmd, uint64_t buffer)
1041  {
1042      cmd->buffer = buffer;
1043  }
1044  
1045  static void ahci_atapi_set_size(AHCICommand *cmd, uint64_t xbytes)
1046  {
1047      unsigned char *cbd = cmd->atapi_cmd;
1048      uint64_t nsectors = xbytes / ATAPI_SECTOR_SIZE;
1049      uint32_t tmp;
1050      g_assert(cbd);
1051  
1052      switch (cbd[0]) {
1053      case CMD_ATAPI_READ_10:
1054          g_assert_cmpuint(nsectors, <=, UINT16_MAX);
1055          stw_be_p(&cbd[7], nsectors);
1056          break;
1057      case CMD_ATAPI_READ_CD:
1058          /* 24bit BE store */
1059          g_assert_cmpuint(nsectors, <, 1ULL << 24);
1060          tmp = nsectors;
1061          cbd[6] = (tmp & 0xFF0000) >> 16;
1062          cbd[7] = (tmp & 0xFF00) >> 8;
1063          cbd[8] = (tmp & 0xFF);
1064          break;
1065      case CMD_ATAPI_REQUEST_SENSE:
1066          g_assert_cmpuint(xbytes, <=, UINT8_MAX);
1067          cbd[4] = (uint8_t)xbytes;
1068          break;
1069      case CMD_ATAPI_TEST_UNIT_READY:
1070      case CMD_ATAPI_START_STOP_UNIT:
1071          g_assert_cmpuint(xbytes, ==, 0);
1072          break;
1073      default:
1074          /* SCSI doesn't have uniform packet formats,
1075           * so you have to add support for it manually. Sorry! */
1076          fprintf(stderr, "The Libqos AHCI driver does not support the set_size "
1077                  "operation for ATAPI command 0x%02x, please add support.\n",
1078                  cbd[0]);
1079          g_assert_not_reached();
1080      }
1081  }
1082  
1083  void ahci_command_set_sizes(AHCICommand *cmd, uint64_t xbytes,
1084                              unsigned prd_size)
1085  {
1086      uint16_t sect_count;
1087  
1088      /* Each PRD can describe up to 4MiB, and must not be odd. */
1089      g_assert_cmphex(prd_size, <=, 4096 * 1024);
1090      g_assert_cmphex(prd_size & 0x01, ==, 0x00);
1091      if (prd_size) {
1092          cmd->prd_size = prd_size;
1093      }
1094      cmd->xbytes = xbytes;
1095      sect_count = (cmd->xbytes / cmd->sector_size);
1096  
1097      if (cmd->props->ncq) {
1098          NCQFIS *nfis = (NCQFIS *)&(cmd->fis);
1099          nfis->sector_low = sect_count & 0xFF;
1100          nfis->sector_hi = (sect_count >> 8) & 0xFF;
1101      } else if (cmd->props->atapi) {
1102          ahci_atapi_set_size(cmd, xbytes);
1103      } else {
1104          /* For writes, the PIO Setup FIS interrupt only comes from DRQs
1105           * after the first.
1106           */
1107          if (cmd->props->pio && sect_count > (cmd->props->read ? 0 : 1)) {
1108              cmd->interrupts |= AHCI_PX_IS_PSS;
1109          }
1110          cmd->fis.count = sect_count;
1111      }
1112      cmd->header.prdtl = size_to_prdtl(cmd->xbytes, cmd->prd_size);
1113  }
1114  
1115  void ahci_command_set_size(AHCICommand *cmd, uint64_t xbytes)
1116  {
1117      ahci_command_set_sizes(cmd, xbytes, cmd->prd_size);
1118  }
1119  
1120  void ahci_command_set_prd_size(AHCICommand *cmd, unsigned prd_size)
1121  {
1122      ahci_command_set_sizes(cmd, cmd->xbytes, prd_size);
1123  }
1124  
1125  void ahci_command_adjust(AHCICommand *cmd, uint64_t offset, uint64_t buffer,
1126                           uint64_t xbytes, unsigned prd_size)
1127  {
1128      ahci_command_set_sizes(cmd, xbytes, prd_size);
1129      ahci_command_set_buffer(cmd, buffer);
1130      ahci_command_set_offset(cmd, offset);
1131  }
1132  
1133  void ahci_command_commit(AHCIQState *ahci, AHCICommand *cmd, uint8_t port)
1134  {
1135      uint16_t i, prdtl;
1136      uint64_t table_size, table_ptr, remaining;
1137      PRD prd;
1138  
1139      /* This command is now tied to this port/command slot */
1140      cmd->port = port;
1141      cmd->slot = ahci_pick_cmd(ahci, port);
1142  
1143      if (cmd->props->ncq) {
1144          NCQFIS *nfis = (NCQFIS *)&cmd->fis;
1145          nfis->tag = (cmd->slot << 3) & 0xFC;
1146      }
1147  
1148      /* Create a buffer for the command table */
1149      prdtl = size_to_prdtl(cmd->xbytes, cmd->prd_size);
1150      table_size = CMD_TBL_SIZ(prdtl);
1151      table_ptr = ahci_alloc(ahci, table_size);
1152      g_assert(table_ptr);
1153      /* AHCI 1.3: Must be aligned to 0x80 */
1154      g_assert((table_ptr & 0x7F) == 0x00);
1155      cmd->header.ctba = table_ptr;
1156  
1157      /* Commit the command header (part of the Command List Buffer) */
1158      ahci_set_command_header(ahci, port, cmd->slot, &(cmd->header));
1159      /* Now, write the command table (FIS, ACMD, and PRDT) -- FIS first, */
1160      ahci_write_fis(ahci, cmd);
1161      /* Then ATAPI CMD, if needed */
1162      if (cmd->props->atapi) {
1163          qtest_memwrite(ahci->parent->qts, table_ptr + 0x40, cmd->atapi_cmd, 16);
1164      }
1165  
1166      /* Construct and write the PRDs to the command table */
1167      g_assert_cmphex(prdtl, ==, cmd->header.prdtl);
1168      remaining = cmd->xbytes;
1169      for (i = 0; i < prdtl; ++i) {
1170          prd.dba = cpu_to_le64(cmd->buffer + (cmd->prd_size * i));
1171          prd.res = 0;
1172          if (remaining > cmd->prd_size) {
1173              /* Note that byte count is 0-based. */
1174              prd.dbc = cpu_to_le32(cmd->prd_size - 1);
1175              remaining -= cmd->prd_size;
1176          } else {
1177              /* Again, dbc is 0-based. */
1178              prd.dbc = cpu_to_le32(remaining - 1);
1179              remaining = 0;
1180          }
1181          prd.dbc |= cpu_to_le32(0x80000000); /* Request DPS Interrupt */
1182  
1183          /* Commit the PRD entry to the Command Table */
1184          qtest_memwrite(ahci->parent->qts, table_ptr + 0x80 + (i * sizeof(PRD)),
1185                         &prd, sizeof(PRD));
1186      }
1187  
1188      /* Bookmark the PRDTL and CTBA values */
1189      ahci->port[port].ctba[cmd->slot] = table_ptr;
1190      ahci->port[port].prdtl[cmd->slot] = prdtl;
1191  }
1192  
1193  void ahci_command_issue_async(AHCIQState *ahci, AHCICommand *cmd)
1194  {
1195      if (cmd->props->ncq) {
1196          ahci_px_wreg(ahci, cmd->port, AHCI_PX_SACT, (1 << cmd->slot));
1197      }
1198  
1199      ahci_px_wreg(ahci, cmd->port, AHCI_PX_CI, (1 << cmd->slot));
1200  }
1201  
1202  void ahci_command_wait(AHCIQState *ahci, AHCICommand *cmd)
1203  {
1204      /* We can't rely on STS_BSY until the command has started processing.
1205       * Therefore, we also use the Command Issue bit as indication of
1206       * a command in-flight. */
1207  
1208  #define RSET(REG, MASK) (BITSET(ahci_px_rreg(ahci, cmd->port, (REG)), (MASK)))
1209  
1210      while (RSET(AHCI_PX_TFD, AHCI_PX_TFD_STS_BSY) ||
1211             RSET(AHCI_PX_CI, 1 << cmd->slot) ||
1212             (cmd->props->ncq && RSET(AHCI_PX_SACT, 1 << cmd->slot))) {
1213          usleep(50);
1214      }
1215  
1216  }
1217  
1218  void ahci_command_issue(AHCIQState *ahci, AHCICommand *cmd)
1219  {
1220      ahci_command_issue_async(ahci, cmd);
1221      ahci_command_wait(ahci, cmd);
1222  }
1223  
1224  void ahci_command_verify(AHCIQState *ahci, AHCICommand *cmd)
1225  {
1226      uint8_t slot = cmd->slot;
1227      uint8_t port = cmd->port;
1228  
1229      ahci_port_check_error(ahci, port, cmd->interrupts, cmd->errors);
1230      ahci_port_check_interrupts(ahci, port, cmd->interrupts);
1231      ahci_port_check_nonbusy(ahci, port, slot);
1232      ahci_port_check_cmd_sanity(ahci, cmd);
1233      if (cmd->interrupts & AHCI_PX_IS_DHRS) {
1234          ahci_port_check_d2h_sanity(ahci, port, slot);
1235      }
1236      if (cmd->props->pio) {
1237          ahci_port_check_pio_sanity(ahci, cmd);
1238      }
1239  }
1240  
1241  uint8_t ahci_command_slot(AHCICommand *cmd)
1242  {
1243      return cmd->slot;
1244  }
1245