2 * libqos AHCI functions
4 * Copyright (c) 2014 John Snow <jsnow@redhat.com>
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
28 #include "libqos/ahci.h"
29 #include "libqos/pci-pc.h"
31 #include "qemu-common.h"
32 #include "qemu/host-utils.h"
34 #include "hw/pci/pci_ids.h"
35 #include "hw/pci/pci_regs.h"
37 typedef struct AHCICommandProp
{
38 uint8_t cmd
; /* Command Code */
39 bool data
; /* Data transfer command? */
48 uint64_t size
; /* Static transfer size, for commands like IDENTIFY. */
49 uint32_t interrupts
; /* Expected interrupts for this command. */
52 AHCICommandProp ahci_command_properties
[] = {
53 { .cmd
= CMD_READ_PIO
, .data
= true, .pio
= true,
54 .lba28
= true, .read
= true },
55 { .cmd
= CMD_WRITE_PIO
, .data
= true, .pio
= true,
56 .lba28
= true, .write
= true },
57 { .cmd
= CMD_READ_PIO_EXT
, .data
= true, .pio
= true,
58 .lba48
= true, .read
= true },
59 { .cmd
= CMD_WRITE_PIO_EXT
, .data
= true, .pio
= true,
60 .lba48
= true, .write
= true },
61 { .cmd
= CMD_READ_DMA
, .data
= true, .dma
= true,
62 .lba28
= true, .read
= true },
63 { .cmd
= CMD_WRITE_DMA
, .data
= true, .dma
= true,
64 .lba28
= true, .write
= true },
65 { .cmd
= CMD_READ_DMA_EXT
, .data
= true, .dma
= true,
66 .lba48
= true, .read
= true },
67 { .cmd
= CMD_WRITE_DMA_EXT
, .data
= true, .dma
= true,
68 .lba48
= true, .write
= true },
69 { .cmd
= CMD_IDENTIFY
, .data
= true, .pio
= true,
70 .size
= 512, .read
= true },
71 { .cmd
= CMD_READ_MAX
, .lba28
= true },
72 { .cmd
= CMD_READ_MAX_EXT
, .lba48
= true },
73 { .cmd
= CMD_FLUSH_CACHE
, .data
= false }
77 /* Test Management Data */
85 AHCICommandProp
*props
;
86 /* Data to be transferred to the guest */
87 AHCICommandHeader header
;
93 * Allocate space in the guest using information in the AHCIQState object.
95 uint64_t ahci_alloc(AHCIQState
*ahci
, size_t bytes
)
98 g_assert(ahci
->parent
);
99 return qmalloc(ahci
->parent
, bytes
);
102 void ahci_free(AHCIQState
*ahci
, uint64_t addr
)
105 g_assert(ahci
->parent
);
106 qfree(ahci
->parent
, addr
);
110 * Locate, verify, and return a handle to the AHCI device.
112 QPCIDevice
*get_ahci_device(uint32_t *fingerprint
)
115 uint32_t ahci_fingerprint
;
118 pcibus
= qpci_init_pc();
120 /* Find the AHCI PCI device and verify it's the right one. */
121 ahci
= qpci_device_find(pcibus
, QPCI_DEVFN(0x1F, 0x02));
122 g_assert(ahci
!= NULL
);
124 ahci_fingerprint
= qpci_config_readl(ahci
, PCI_VENDOR_ID
);
126 switch (ahci_fingerprint
) {
127 case AHCI_INTEL_ICH9
:
130 /* Unknown device. */
131 g_assert_not_reached();
135 *fingerprint
= ahci_fingerprint
;
140 void free_ahci_device(QPCIDevice
*dev
)
142 QPCIBus
*pcibus
= dev
? dev
->bus
: NULL
;
144 /* libqos doesn't have a function for this, so free it manually */
146 qpci_free_pc(pcibus
);
149 /* Free all memory in-use by the AHCI device. */
150 void ahci_clean_mem(AHCIQState
*ahci
)
154 for (port
= 0; port
< 32; ++port
) {
155 if (ahci
->port
[port
].fb
) {
156 ahci_free(ahci
, ahci
->port
[port
].fb
);
157 ahci
->port
[port
].fb
= 0;
159 if (ahci
->port
[port
].clb
) {
160 for (slot
= 0; slot
< 32; slot
++) {
161 ahci_destroy_command(ahci
, port
, slot
);
163 ahci_free(ahci
, ahci
->port
[port
].clb
);
164 ahci
->port
[port
].clb
= 0;
169 /*** Logical Device Initialization ***/
172 * Start the PCI device and sanity-check default operation.
174 void ahci_pci_enable(AHCIQState
*ahci
)
178 start_ahci_device(ahci
);
180 switch (ahci
->fingerprint
) {
181 case AHCI_INTEL_ICH9
:
182 /* ICH9 has a register at PCI 0x92 that
183 * acts as a master port enabler mask. */
184 reg
= qpci_config_readb(ahci
->dev
, 0x92);
186 qpci_config_writeb(ahci
->dev
, 0x92, reg
);
187 /* 0...0111111b -- bit significant, ports 0-5 enabled. */
188 ASSERT_BIT_SET(qpci_config_readb(ahci
->dev
, 0x92), 0x3F);
195 * Map BAR5/ABAR, and engage the PCI device.
197 void start_ahci_device(AHCIQState
*ahci
)
199 /* Map AHCI's ABAR (BAR5) */
200 ahci
->hba_base
= qpci_iomap(ahci
->dev
, 5, &ahci
->barsize
);
201 g_assert(ahci
->hba_base
);
203 /* turns on pci.cmd.iose, pci.cmd.mse and pci.cmd.bme */
204 qpci_device_enable(ahci
->dev
);
208 * Test and initialize the AHCI's HBA memory areas.
209 * Initialize and start any ports with devices attached.
210 * Bring the HBA into the idle state.
212 void ahci_hba_enable(AHCIQState
*ahci
)
214 /* Bits of interest in this section:
215 * GHC.AE Global Host Control / AHCI Enable
216 * PxCMD.ST Port Command: Start
217 * PxCMD.SUD "Spin Up Device"
218 * PxCMD.POD "Power On Device"
219 * PxCMD.FRE "FIS Receive Enable"
220 * PxCMD.FR "FIS Receive Running"
221 * PxCMD.CR "Command List Running"
223 uint32_t reg
, ports_impl
;
225 uint8_t num_cmd_slots
;
227 g_assert(ahci
!= NULL
);
229 /* Set GHC.AE to 1 */
230 ahci_set(ahci
, AHCI_GHC
, AHCI_GHC_AE
);
231 reg
= ahci_rreg(ahci
, AHCI_GHC
);
232 ASSERT_BIT_SET(reg
, AHCI_GHC_AE
);
234 /* Cache CAP and CAP2. */
235 ahci
->cap
= ahci_rreg(ahci
, AHCI_CAP
);
236 ahci
->cap2
= ahci_rreg(ahci
, AHCI_CAP2
);
238 /* Read CAP.NCS, how many command slots do we have? */
239 num_cmd_slots
= ((ahci
->cap
& AHCI_CAP_NCS
) >> ctzl(AHCI_CAP_NCS
)) + 1;
240 g_test_message("Number of Command Slots: %u", num_cmd_slots
);
242 /* Determine which ports are implemented. */
243 ports_impl
= ahci_rreg(ahci
, AHCI_PI
);
245 for (i
= 0; ports_impl
; ports_impl
>>= 1, ++i
) {
246 if (!(ports_impl
& 0x01)) {
250 g_test_message("Initializing port %u", i
);
252 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_CMD
);
253 if (BITCLR(reg
, AHCI_PX_CMD_ST
| AHCI_PX_CMD_CR
|
254 AHCI_PX_CMD_FRE
| AHCI_PX_CMD_FR
)) {
255 g_test_message("port is idle");
257 g_test_message("port needs to be idled");
258 ahci_px_clr(ahci
, i
, AHCI_PX_CMD
,
259 (AHCI_PX_CMD_ST
| AHCI_PX_CMD_FRE
));
260 /* The port has 500ms to disengage. */
262 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_CMD
);
263 ASSERT_BIT_CLEAR(reg
, AHCI_PX_CMD_CR
);
264 ASSERT_BIT_CLEAR(reg
, AHCI_PX_CMD_FR
);
265 g_test_message("port is now idle");
266 /* The spec does allow for possibly needing a PORT RESET
267 * or HBA reset if we fail to idle the port. */
270 /* Allocate Memory for the Command List Buffer & FIS Buffer */
271 /* PxCLB space ... 0x20 per command, as in 4.2.2 p 36 */
272 ahci
->port
[i
].clb
= ahci_alloc(ahci
, num_cmd_slots
* 0x20);
273 qmemset(ahci
->port
[i
].clb
, 0x00, num_cmd_slots
* 0x20);
274 g_test_message("CLB: 0x%08" PRIx64
, ahci
->port
[i
].clb
);
275 ahci_px_wreg(ahci
, i
, AHCI_PX_CLB
, ahci
->port
[i
].clb
);
276 g_assert_cmphex(ahci
->port
[i
].clb
, ==,
277 ahci_px_rreg(ahci
, i
, AHCI_PX_CLB
));
279 /* PxFB space ... 0x100, as in 4.2.1 p 35 */
280 ahci
->port
[i
].fb
= ahci_alloc(ahci
, 0x100);
281 qmemset(ahci
->port
[i
].fb
, 0x00, 0x100);
282 g_test_message("FB: 0x%08" PRIx64
, ahci
->port
[i
].fb
);
283 ahci_px_wreg(ahci
, i
, AHCI_PX_FB
, ahci
->port
[i
].fb
);
284 g_assert_cmphex(ahci
->port
[i
].fb
, ==,
285 ahci_px_rreg(ahci
, i
, AHCI_PX_FB
));
287 /* Clear PxSERR, PxIS, then IS.IPS[x] by writing '1's. */
288 ahci_px_wreg(ahci
, i
, AHCI_PX_SERR
, 0xFFFFFFFF);
289 ahci_px_wreg(ahci
, i
, AHCI_PX_IS
, 0xFFFFFFFF);
290 ahci_wreg(ahci
, AHCI_IS
, (1 << i
));
292 /* Verify Interrupts Cleared */
293 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_SERR
);
294 g_assert_cmphex(reg
, ==, 0);
296 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_IS
);
297 g_assert_cmphex(reg
, ==, 0);
299 reg
= ahci_rreg(ahci
, AHCI_IS
);
300 ASSERT_BIT_CLEAR(reg
, (1 << i
));
302 /* Enable All Interrupts: */
303 ahci_px_wreg(ahci
, i
, AHCI_PX_IE
, 0xFFFFFFFF);
304 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_IE
);
305 g_assert_cmphex(reg
, ==, ~((uint32_t)AHCI_PX_IE_RESERVED
));
307 /* Enable the FIS Receive Engine. */
308 ahci_px_set(ahci
, i
, AHCI_PX_CMD
, AHCI_PX_CMD_FRE
);
309 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_CMD
);
310 ASSERT_BIT_SET(reg
, AHCI_PX_CMD_FR
);
312 /* AHCI 1.3 spec: if !STS.BSY, !STS.DRQ and PxSSTS.DET indicates
313 * physical presence, a device is present and may be started. However,
314 * PxSERR.DIAG.X /may/ need to be cleared a priori. */
315 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_SERR
);
316 if (BITSET(reg
, AHCI_PX_SERR_DIAG_X
)) {
317 ahci_px_set(ahci
, i
, AHCI_PX_SERR
, AHCI_PX_SERR_DIAG_X
);
320 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_TFD
);
321 if (BITCLR(reg
, AHCI_PX_TFD_STS_BSY
| AHCI_PX_TFD_STS_DRQ
)) {
322 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_SSTS
);
323 if ((reg
& AHCI_PX_SSTS_DET
) == SSTS_DET_ESTABLISHED
) {
324 /* Device Found: set PxCMD.ST := 1 */
325 ahci_px_set(ahci
, i
, AHCI_PX_CMD
, AHCI_PX_CMD_ST
);
326 ASSERT_BIT_SET(ahci_px_rreg(ahci
, i
, AHCI_PX_CMD
),
328 g_test_message("Started Device %u", i
);
329 } else if ((reg
& AHCI_PX_SSTS_DET
)) {
330 /* Device present, but in some unknown state. */
331 g_assert_not_reached();
337 ahci_set(ahci
, AHCI_GHC
, AHCI_GHC_IE
);
338 reg
= ahci_rreg(ahci
, AHCI_GHC
);
339 ASSERT_BIT_SET(reg
, AHCI_GHC_IE
);
341 /* TODO: The device should now be idling and waiting for commands.
342 * In the future, a small test-case to inspect the Register D2H FIS
343 * and clear the initial interrupts might be good. */
347 * Pick the first implemented and running port
349 unsigned ahci_port_select(AHCIQState
*ahci
)
354 ports
= ahci_rreg(ahci
, AHCI_PI
);
355 for (i
= 0; i
< 32; ports
>>= 1, ++i
) {
360 if (!(ports
& 0x01)) {
364 reg
= ahci_px_rreg(ahci
, i
, AHCI_PX_CMD
);
365 if (BITSET(reg
, AHCI_PX_CMD_ST
)) {
374 * Clear a port's interrupts and status information prior to a test.
376 void ahci_port_clear(AHCIQState
*ahci
, uint8_t port
)
380 /* Clear out this port's interrupts (ignore the init register d2h fis) */
381 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_IS
);
382 ahci_px_wreg(ahci
, port
, AHCI_PX_IS
, reg
);
383 g_assert_cmphex(ahci_px_rreg(ahci
, port
, AHCI_PX_IS
), ==, 0);
385 /* Wipe the FIS-Receive Buffer */
386 qmemset(ahci
->port
[port
].fb
, 0x00, 0x100);
390 * Check a port for errors.
392 void ahci_port_check_error(AHCIQState
*ahci
, uint8_t port
)
396 /* The upper 9 bits of the IS register all indicate errors. */
397 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_IS
);
399 g_assert_cmphex(reg
, ==, 0);
401 /* The Sata Error Register should be empty. */
402 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_SERR
);
403 g_assert_cmphex(reg
, ==, 0);
405 /* The TFD also has two error sections. */
406 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_TFD
);
407 ASSERT_BIT_CLEAR(reg
, AHCI_PX_TFD_STS_ERR
);
408 ASSERT_BIT_CLEAR(reg
, AHCI_PX_TFD_ERR
);
411 void ahci_port_check_interrupts(AHCIQState
*ahci
, uint8_t port
,
416 /* Check for expected interrupts */
417 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_IS
);
418 ASSERT_BIT_SET(reg
, intr_mask
);
420 /* Clear expected interrupts and assert all interrupts now cleared. */
421 ahci_px_wreg(ahci
, port
, AHCI_PX_IS
, intr_mask
);
422 g_assert_cmphex(ahci_px_rreg(ahci
, port
, AHCI_PX_IS
), ==, 0);
425 void ahci_port_check_nonbusy(AHCIQState
*ahci
, uint8_t port
, uint8_t slot
)
429 /* Assert that the command slot is no longer busy (NCQ) */
430 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_SACT
);
431 ASSERT_BIT_CLEAR(reg
, (1 << slot
));
434 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_CI
);
435 ASSERT_BIT_CLEAR(reg
, (1 << slot
));
437 /* And assert that we are generally not busy. */
438 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_TFD
);
439 ASSERT_BIT_CLEAR(reg
, AHCI_PX_TFD_STS_BSY
);
440 ASSERT_BIT_CLEAR(reg
, AHCI_PX_TFD_STS_DRQ
);
443 void ahci_port_check_d2h_sanity(AHCIQState
*ahci
, uint8_t port
, uint8_t slot
)
445 RegD2HFIS
*d2h
= g_malloc0(0x20);
448 memread(ahci
->port
[port
].fb
+ 0x40, d2h
, 0x20);
449 g_assert_cmphex(d2h
->fis_type
, ==, 0x34);
451 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_TFD
);
452 g_assert_cmphex((reg
& AHCI_PX_TFD_ERR
) >> 8, ==, d2h
->error
);
453 g_assert_cmphex((reg
& AHCI_PX_TFD_STS
), ==, d2h
->status
);
458 void ahci_port_check_pio_sanity(AHCIQState
*ahci
, uint8_t port
,
459 uint8_t slot
, size_t buffsize
)
461 PIOSetupFIS
*pio
= g_malloc0(0x20);
463 /* We cannot check the Status or E_Status registers, because
464 * the status may have again changed between the PIO Setup FIS
465 * and the conclusion of the command with the D2H Register FIS. */
466 memread(ahci
->port
[port
].fb
+ 0x20, pio
, 0x20);
467 g_assert_cmphex(pio
->fis_type
, ==, 0x5f);
469 /* BUG: PIO Setup FIS as utilized by QEMU tries to fit the entire
470 * transfer size in a uint16_t field. The maximum transfer size can
471 * eclipse this; the field is meant to convey the size of data per
472 * each Data FIS, not the entire operation as a whole. For now,
473 * we will sanity check the broken case where applicable. */
474 if (buffsize
<= UINT16_MAX
) {
475 g_assert_cmphex(le16_to_cpu(pio
->tx_count
), ==, buffsize
);
481 void ahci_port_check_cmd_sanity(AHCIQState
*ahci
, AHCICommand
*cmd
)
483 AHCICommandHeader cmdh
;
485 ahci_get_command_header(ahci
, cmd
->port
, cmd
->slot
, &cmdh
);
486 /* Physical Region Descriptor Byte Count is not required to work for NCQ. */
487 if (!cmd
->props
->ncq
) {
488 g_assert_cmphex(cmd
->xbytes
, ==, cmdh
.prdbc
);
492 /* Get the command in #slot of port #port. */
493 void ahci_get_command_header(AHCIQState
*ahci
, uint8_t port
,
494 uint8_t slot
, AHCICommandHeader
*cmd
)
496 uint64_t ba
= ahci
->port
[port
].clb
;
497 ba
+= slot
* sizeof(AHCICommandHeader
);
498 memread(ba
, cmd
, sizeof(AHCICommandHeader
));
500 cmd
->flags
= le16_to_cpu(cmd
->flags
);
501 cmd
->prdtl
= le16_to_cpu(cmd
->prdtl
);
502 cmd
->prdbc
= le32_to_cpu(cmd
->prdbc
);
503 cmd
->ctba
= le64_to_cpu(cmd
->ctba
);
506 /* Set the command in #slot of port #port. */
507 void ahci_set_command_header(AHCIQState
*ahci
, uint8_t port
,
508 uint8_t slot
, AHCICommandHeader
*cmd
)
510 AHCICommandHeader tmp
= { .flags
= 0 };
511 uint64_t ba
= ahci
->port
[port
].clb
;
512 ba
+= slot
* sizeof(AHCICommandHeader
);
514 tmp
.flags
= cpu_to_le16(cmd
->flags
);
515 tmp
.prdtl
= cpu_to_le16(cmd
->prdtl
);
516 tmp
.prdbc
= cpu_to_le32(cmd
->prdbc
);
517 tmp
.ctba
= cpu_to_le64(cmd
->ctba
);
519 memwrite(ba
, &tmp
, sizeof(AHCICommandHeader
));
522 void ahci_destroy_command(AHCIQState
*ahci
, uint8_t port
, uint8_t slot
)
524 AHCICommandHeader cmd
;
526 /* Obtain the Nth Command Header */
527 ahci_get_command_header(ahci
, port
, slot
, &cmd
);
529 /* No address in it, so just return -- it's empty. */
534 ahci_free(ahci
, cmd
.ctba
);
537 /* NULL the header. */
538 memset(&cmd
, 0x00, sizeof(cmd
));
539 ahci_set_command_header(ahci
, port
, slot
, &cmd
);
540 ahci
->port
[port
].ctba
[slot
] = 0;
541 ahci
->port
[port
].prdtl
[slot
] = 0;
544 void ahci_write_fis(AHCIQState
*ahci
, RegH2DFIS
*fis
, uint64_t addr
)
546 RegH2DFIS tmp
= *fis
;
548 /* The auxiliary FIS fields are defined per-command and are not
549 * currently implemented in libqos/ahci.o, but may or may not need
552 /* All other FIS fields are 8 bit and do not need to be flipped. */
553 tmp
.count
= cpu_to_le16(tmp
.count
);
555 memwrite(addr
, &tmp
, sizeof(tmp
));
558 unsigned ahci_pick_cmd(AHCIQState
*ahci
, uint8_t port
)
564 reg
= ahci_px_rreg(ahci
, port
, AHCI_PX_CI
);
566 /* Pick the least recently used command slot that's available */
567 for (i
= 0; i
< 32; ++i
) {
568 j
= ((ahci
->port
[port
].next
+ i
) % 32);
569 if (reg
& (1 << j
)) {
572 ahci_destroy_command(ahci
, port
, j
);
573 ahci
->port
[port
].next
= (j
+ 1) % 32;
577 g_test_message("All command slots were busy.");
578 g_assert_not_reached();
581 inline unsigned size_to_prdtl(unsigned bytes
, unsigned bytes_per_prd
)
583 /* Each PRD can describe up to 4MiB */
584 g_assert_cmphex(bytes_per_prd
, <=, 4096 * 1024);
585 g_assert_cmphex(bytes_per_prd
& 0x01, ==, 0x00);
586 return (bytes
+ bytes_per_prd
- 1) / bytes_per_prd
;
589 /* Issue a command, expecting it to fail and STOP the VM */
590 AHCICommand
*ahci_guest_io_halt(AHCIQState
*ahci
, uint8_t port
,
591 uint8_t ide_cmd
, uint64_t buffer
,
592 size_t bufsize
, uint64_t sector
)
596 cmd
= ahci_command_create(ide_cmd
);
597 ahci_command_adjust(cmd
, sector
, buffer
, bufsize
, 0);
598 ahci_command_commit(ahci
, cmd
, port
);
599 ahci_command_issue_async(ahci
, cmd
);
600 qmp_eventwait("STOP");
605 /* Resume a previously failed command and verify/finalize */
606 void ahci_guest_io_resume(AHCIQState
*ahci
, AHCICommand
*cmd
)
608 /* Complete the command */
609 qmp_async("{'execute':'cont' }");
610 qmp_eventwait("RESUME");
611 ahci_command_wait(ahci
, cmd
);
612 ahci_command_verify(ahci
, cmd
);
613 ahci_command_free(cmd
);
616 /* Given a guest buffer address, perform an IO operation */
617 void ahci_guest_io(AHCIQState
*ahci
, uint8_t port
, uint8_t ide_cmd
,
618 uint64_t buffer
, size_t bufsize
, uint64_t sector
)
621 cmd
= ahci_command_create(ide_cmd
);
622 ahci_command_set_buffer(cmd
, buffer
);
623 ahci_command_set_size(cmd
, bufsize
);
625 ahci_command_set_offset(cmd
, sector
);
627 ahci_command_commit(ahci
, cmd
, port
);
628 ahci_command_issue(ahci
, cmd
);
629 ahci_command_verify(ahci
, cmd
);
630 ahci_command_free(cmd
);
633 static AHCICommandProp
*ahci_command_find(uint8_t command_name
)
637 for (i
= 0; i
< ARRAY_SIZE(ahci_command_properties
); i
++) {
638 if (ahci_command_properties
[i
].cmd
== command_name
) {
639 return &ahci_command_properties
[i
];
646 /* Given a HOST buffer, create a buffer address and perform an IO operation. */
647 void ahci_io(AHCIQState
*ahci
, uint8_t port
, uint8_t ide_cmd
,
648 void *buffer
, size_t bufsize
, uint64_t sector
)
651 AHCICommandProp
*props
;
653 props
= ahci_command_find(ide_cmd
);
655 ptr
= ahci_alloc(ahci
, bufsize
);
657 qmemset(ptr
, 0x00, bufsize
);
660 bufwrite(ptr
, buffer
, bufsize
);
663 ahci_guest_io(ahci
, port
, ide_cmd
, ptr
, bufsize
, sector
);
666 bufread(ptr
, buffer
, bufsize
);
669 ahci_free(ahci
, ptr
);
673 * Initializes a basic command header in memory.
674 * We assume that this is for an ATA command using RegH2DFIS.
676 static void command_header_init(AHCICommand
*cmd
)
678 AHCICommandHeader
*hdr
= &cmd
->header
;
679 AHCICommandProp
*props
= cmd
->props
;
681 hdr
->flags
= 5; /* RegH2DFIS is 5 DW long. Must be < 32 */
682 hdr
->flags
|= CMDH_CLR_BSY
; /* Clear the BSY bit when done */
684 hdr
->flags
|= CMDH_WRITE
;
687 hdr
->flags
|= CMDH_ATAPI
;
689 /* Other flags: PREFETCH, RESET, and BIST */
690 hdr
->prdtl
= size_to_prdtl(cmd
->xbytes
, cmd
->prd_size
);
695 static void command_table_init(AHCICommand
*cmd
)
697 RegH2DFIS
*fis
= &(cmd
->fis
);
698 uint16_t sect_count
= (cmd
->xbytes
/ AHCI_SECTOR_SIZE
);
700 fis
->fis_type
= REG_H2D_FIS
;
701 fis
->flags
= REG_H2D_FIS_CMD
; /* "Command" bit */
702 fis
->command
= cmd
->name
;
704 if (cmd
->props
->ncq
) {
705 NCQFIS
*ncqfis
= (NCQFIS
*)fis
;
706 /* NCQ is weird and re-uses FIS frames for unrelated data.
707 * See SATA 3.2, 13.6.4.1 READ FPDMA QUEUED for an example. */
708 ncqfis
->sector_low
= sect_count
& 0xFF;
709 ncqfis
->sector_hi
= (sect_count
>> 8) & 0xFF;
710 ncqfis
->device
= NCQ_DEVICE_MAGIC
;
711 /* Force Unit Access is bit 7 in the device register */
712 ncqfis
->tag
= 0; /* bits 3-7 are the NCQ tag */
713 ncqfis
->prio
= 0; /* bits 6,7 are a prio tag */
714 /* RARC bit is bit 0 of TAG field */
716 fis
->feature_low
= 0x00;
717 fis
->feature_high
= 0x00;
718 if (cmd
->props
->lba28
|| cmd
->props
->lba48
) {
719 fis
->device
= ATA_DEVICE_LBA
;
721 fis
->count
= (cmd
->xbytes
/ AHCI_SECTOR_SIZE
);
725 memset(fis
->aux
, 0x00, ARRAY_SIZE(fis
->aux
));
728 AHCICommand
*ahci_command_create(uint8_t command_name
)
730 AHCICommandProp
*props
= ahci_command_find(command_name
);
734 cmd
= g_malloc0(sizeof(AHCICommand
));
735 g_assert(!(props
->dma
&& props
->pio
));
736 g_assert(!(props
->lba28
&& props
->lba48
));
737 g_assert(!(props
->read
&& props
->write
));
738 g_assert(!props
->size
|| props
->data
);
739 g_assert(!props
->ncq
|| (props
->ncq
&& props
->lba48
));
741 /* Defaults and book-keeping */
743 cmd
->name
= command_name
;
744 cmd
->xbytes
= props
->size
;
745 cmd
->prd_size
= 4096;
746 cmd
->buffer
= 0xabad1dea;
748 if (!cmd
->props
->ncq
) {
749 cmd
->interrupts
= AHCI_PX_IS_DHRS
;
751 /* BUG: We expect the DPS interrupt for data commands */
752 /* cmd->interrupts |= props->data ? AHCI_PX_IS_DPS : 0; */
753 /* BUG: We expect the DMA Setup interrupt for DMA commands */
754 /* cmd->interrupts |= props->dma ? AHCI_PX_IS_DSS : 0; */
755 cmd
->interrupts
|= props
->pio
? AHCI_PX_IS_PSS
: 0;
756 cmd
->interrupts
|= props
->ncq
? AHCI_PX_IS_SDBS
: 0;
758 command_header_init(cmd
);
759 command_table_init(cmd
);
764 void ahci_command_free(AHCICommand
*cmd
)
769 void ahci_command_set_flags(AHCICommand
*cmd
, uint16_t cmdh_flags
)
771 cmd
->header
.flags
|= cmdh_flags
;
774 void ahci_command_clr_flags(AHCICommand
*cmd
, uint16_t cmdh_flags
)
776 cmd
->header
.flags
&= ~cmdh_flags
;
779 void ahci_command_set_offset(AHCICommand
*cmd
, uint64_t lba_sect
)
781 RegH2DFIS
*fis
= &(cmd
->fis
);
782 if (cmd
->props
->lba28
) {
783 g_assert_cmphex(lba_sect
, <=, 0xFFFFFFF);
784 } else if (cmd
->props
->lba48
|| cmd
->props
->ncq
) {
785 g_assert_cmphex(lba_sect
, <=, 0xFFFFFFFFFFFF);
787 /* Can't set offset if we don't know the format. */
788 g_assert_not_reached();
791 /* LBA28 uses the low nibble of the device/control register for LBA24:27 */
792 fis
->lba_lo
[0] = (lba_sect
& 0xFF);
793 fis
->lba_lo
[1] = (lba_sect
>> 8) & 0xFF;
794 fis
->lba_lo
[2] = (lba_sect
>> 16) & 0xFF;
795 if (cmd
->props
->lba28
) {
796 fis
->device
= (fis
->device
& 0xF0) | ((lba_sect
>> 24) & 0x0F);
798 fis
->lba_hi
[0] = (lba_sect
>> 24) & 0xFF;
799 fis
->lba_hi
[1] = (lba_sect
>> 32) & 0xFF;
800 fis
->lba_hi
[2] = (lba_sect
>> 40) & 0xFF;
803 void ahci_command_set_buffer(AHCICommand
*cmd
, uint64_t buffer
)
805 cmd
->buffer
= buffer
;
808 void ahci_command_set_sizes(AHCICommand
*cmd
, uint64_t xbytes
,
813 /* Each PRD can describe up to 4MiB, and must not be odd. */
814 g_assert_cmphex(prd_size
, <=, 4096 * 1024);
815 g_assert_cmphex(prd_size
& 0x01, ==, 0x00);
817 cmd
->prd_size
= prd_size
;
819 cmd
->xbytes
= xbytes
;
820 sect_count
= (cmd
->xbytes
/ AHCI_SECTOR_SIZE
);
822 if (cmd
->props
->ncq
) {
823 NCQFIS
*nfis
= (NCQFIS
*)&(cmd
->fis
);
824 nfis
->sector_low
= sect_count
& 0xFF;
825 nfis
->sector_hi
= (sect_count
>> 8) & 0xFF;
827 cmd
->fis
.count
= sect_count
;
829 cmd
->header
.prdtl
= size_to_prdtl(cmd
->xbytes
, cmd
->prd_size
);
832 void ahci_command_set_size(AHCICommand
*cmd
, uint64_t xbytes
)
834 ahci_command_set_sizes(cmd
, xbytes
, cmd
->prd_size
);
837 void ahci_command_set_prd_size(AHCICommand
*cmd
, unsigned prd_size
)
839 ahci_command_set_sizes(cmd
, cmd
->xbytes
, prd_size
);
842 void ahci_command_adjust(AHCICommand
*cmd
, uint64_t offset
, uint64_t buffer
,
843 uint64_t xbytes
, unsigned prd_size
)
845 ahci_command_set_sizes(cmd
, xbytes
, prd_size
);
846 ahci_command_set_buffer(cmd
, buffer
);
847 ahci_command_set_offset(cmd
, offset
);
850 void ahci_command_commit(AHCIQState
*ahci
, AHCICommand
*cmd
, uint8_t port
)
853 uint64_t table_size
, table_ptr
, remaining
;
856 /* This command is now tied to this port/command slot */
858 cmd
->slot
= ahci_pick_cmd(ahci
, port
);
860 if (cmd
->props
->ncq
) {
861 NCQFIS
*nfis
= (NCQFIS
*)&cmd
->fis
;
862 nfis
->tag
= (cmd
->slot
<< 3) & 0xFC;
865 /* Create a buffer for the command table */
866 prdtl
= size_to_prdtl(cmd
->xbytes
, cmd
->prd_size
);
867 table_size
= CMD_TBL_SIZ(prdtl
);
868 table_ptr
= ahci_alloc(ahci
, table_size
);
870 /* AHCI 1.3: Must be aligned to 0x80 */
871 g_assert((table_ptr
& 0x7F) == 0x00);
872 cmd
->header
.ctba
= table_ptr
;
874 /* Commit the command header and command FIS */
875 ahci_set_command_header(ahci
, port
, cmd
->slot
, &(cmd
->header
));
876 ahci_write_fis(ahci
, &(cmd
->fis
), table_ptr
);
878 /* Construct and write the PRDs to the command table */
879 g_assert_cmphex(prdtl
, ==, cmd
->header
.prdtl
);
880 remaining
= cmd
->xbytes
;
881 for (i
= 0; i
< prdtl
; ++i
) {
882 prd
.dba
= cpu_to_le64(cmd
->buffer
+ (cmd
->prd_size
* i
));
884 if (remaining
> cmd
->prd_size
) {
885 /* Note that byte count is 0-based. */
886 prd
.dbc
= cpu_to_le32(cmd
->prd_size
- 1);
887 remaining
-= cmd
->prd_size
;
889 /* Again, dbc is 0-based. */
890 prd
.dbc
= cpu_to_le32(remaining
- 1);
893 prd
.dbc
|= cpu_to_le32(0x80000000); /* Request DPS Interrupt */
895 /* Commit the PRD entry to the Command Table */
896 memwrite(table_ptr
+ 0x80 + (i
* sizeof(PRD
)),
900 /* Bookmark the PRDTL and CTBA values */
901 ahci
->port
[port
].ctba
[cmd
->slot
] = table_ptr
;
902 ahci
->port
[port
].prdtl
[cmd
->slot
] = prdtl
;
905 void ahci_command_issue_async(AHCIQState
*ahci
, AHCICommand
*cmd
)
907 if (cmd
->props
->ncq
) {
908 ahci_px_wreg(ahci
, cmd
->port
, AHCI_PX_SACT
, (1 << cmd
->slot
));
911 ahci_px_wreg(ahci
, cmd
->port
, AHCI_PX_CI
, (1 << cmd
->slot
));
914 void ahci_command_wait(AHCIQState
*ahci
, AHCICommand
*cmd
)
916 /* We can't rely on STS_BSY until the command has started processing.
917 * Therefore, we also use the Command Issue bit as indication of
918 * a command in-flight. */
920 #define RSET(REG, MASK) (BITSET(ahci_px_rreg(ahci, cmd->port, (REG)), (MASK)))
922 while (RSET(AHCI_PX_TFD
, AHCI_PX_TFD_STS_BSY
) ||
923 RSET(AHCI_PX_CI
, 1 << cmd
->slot
) ||
924 (cmd
->props
->ncq
&& RSET(AHCI_PX_SACT
, 1 << cmd
->slot
))) {
930 void ahci_command_issue(AHCIQState
*ahci
, AHCICommand
*cmd
)
932 ahci_command_issue_async(ahci
, cmd
);
933 ahci_command_wait(ahci
, cmd
);
936 void ahci_command_verify(AHCIQState
*ahci
, AHCICommand
*cmd
)
938 uint8_t slot
= cmd
->slot
;
939 uint8_t port
= cmd
->port
;
941 ahci_port_check_error(ahci
, port
);
942 ahci_port_check_interrupts(ahci
, port
, cmd
->interrupts
);
943 ahci_port_check_nonbusy(ahci
, port
, slot
);
944 ahci_port_check_cmd_sanity(ahci
, cmd
);
945 if (cmd
->interrupts
& AHCI_PX_IS_DHRS
) {
946 ahci_port_check_d2h_sanity(ahci
, port
, slot
);
948 if (cmd
->props
->pio
) {
949 ahci_port_check_pio_sanity(ahci
, port
, slot
, cmd
->xbytes
);
953 uint8_t ahci_command_slot(AHCICommand
*cmd
)