aboutsummaryrefslogtreecommitdiff
path: root/hw/ide
AgeCommit message (Collapse)AuthorFilesLines
2022-06-28hw/ide/atapi.c: Correct typos (CD-CDROM -> CD-ROM)Lev Kujawski1-2/+2
Signed-off-by: Lev Kujawski <lkujaw@member.fsf.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220528204702.167912-1-lkujaw@member.fsf.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-06-24block: get rid of blk->guest_block_sizeStefan Hajnoczi1-1/+0
Commit 1b7fd729559c ("block: rename buffer_alignment to guest_block_size") noted: At this point, the field is set by the device emulation, but completely ignored by the block layer. The last time the value of buffer_alignment/guest_block_size was actually used was before commit 339064d50639 ("block: Don't use guest sector size for qemu_blockalign()"). This value has not been used since 2013. Get rid of it. Cc: Xie Yongji <xieyongji@bytedance.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20220518130945.2657905-1-stefanha@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Alberto Faria <afaria@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2022-06-09include/hw/ide: Unexport pci_piix3_xen_ide_unplug()Bernhard Beschow1-46/+0
This function was declared in a generic and public header, implemented in a device-specific source file but only used in xen_platform. Given its 'aux' parameter, this function is more xen-specific than piix-specific. Also, the hardcoded magic constants seem to be generic and related to PCIIDEState and IDEBus rather than piix. Therefore, move this function to xen_platform, unexport it, and drop the "piix3" in the function name as well. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Paul Durrant <paul@xen.org> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220513180957.90514-4-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2022-06-09hw/ide/piix: Add some documentation to pci_piix3_xen_ide_unplug()Bernhard Beschow1-0/+11
The comment is based on commit message ae4d2eb273b167dad748ea4249720319240b1ac2 'xen-platform: add missing disk unplug option'. Since it seems to describe design decisions and limitations that still apply it seems worth having. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20220513180957.90514-3-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2022-06-09hw/ide/piix: Remove redundant "piix3-ide-xen" device classBernhard Beschow1-7/+0
Commit 0f8445820f11a69154309863960328dda3dc1ad4 'xen: piix reuse pci generic class init function' already resolved redundant code which in turn rendered piix3-ide-xen redundant. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Message-Id: <20220513180957.90514-2-shentey@gmail.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2022-05-25ide_ioport_read: Return lower octet of data register instead of 0xFFLev Kujawski2-2/+8
Prior to this patch, the pre-GRUB Solaris x86 bootloader would fail to load on QEMU with the following screen output: SunOS Secondary Boot version 3.00 prom_panic: Could not mount filesystem. Entering boot debugger: [136419]: _ This occurs because the bootloader issues an ATA IDENTIFY DEVICE command, and then reads the resulting 256 words of parameter information using inb rather than the correct inw. As the previous behavior of QEMU was to return 0xFF and not advance the drive's sector buffer, DRQ would never be cleared and the bootloader would be blocked from selecting a secondary ATA device, such as an optical drive. Resolves: * [Bug 1639394] Unable to boot Solaris 8/9 x86 under Fedora 24 Signed-off-by: Lev Kujawski <lkujaw@member.fsf.org> Message-Id: <20220520235200.1138450-1-lkujaw@member.fsf.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-09Merge remote-tracking branch 'remotes/philmd/tags/mips-20220308' into stagingPeter Maydell1-1/+1
MIPS patches queue - Fix CP0 cycle counter timing - Fix VMState of gt64120 IRQs - Long due PIIX4 QOM cleanups - ISA IRQ QOM'ification / cleanups # gpg: Signature made Tue 08 Mar 2022 18:39:42 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd/tags/mips-20220308: tests/avocado/linux_ssh_mips_malta.py: add missing accel (tcg) tag hw/isa: Inline and remove one-line isa_init_irq() hw/isa: Drop unused attributes from ISADevice hw/isa/isa-bus: Remove isabus_dev_print() hw/input/pckbd: QOM'ify IRQ numbers hw/rtc/m48t59-isa: QOM'ify IRQ number hw/rtc/mc146818rtc: QOM'ify IRQ number hw/mips/gt64xxx_pci: Resolve gt64120_register() hw/isa/piix4: Replace some magic IRQ constants hw/isa/piix4: Resolve global instance variable hw/isa/piix4: Pass PIIX4State as opaque parameter for piix4_set_irq() hw/isa/piix4: Resolve redundant i8259[] attribute malta: Move PCI interrupt handling from gt64xxx_pci to piix4 hw/mips/gt64xxx_pci: Fix PCI IRQ levels to be preserved during migration target/mips: Remove duplicated MIPSCPU::cp0_count_rate target/mips: Fix cycle counter timing calculations Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-03-08hw/isa: Inline and remove one-line isa_init_irq()Bernhard Beschow1-1/+1
isa_init_irq() has become a trivial one-line wrapper for isa_get_irq(). It can therefore be removed. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> (tpm_tis_isa) Acked-by: Corey Minyard <cminyard@mvista.com> (isa_ipmi_bt, isa_ipmi_kcs) Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20220301220037.76555-8-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220307134353.1950-14-philippe.mathieu.daude@gmail.com> Reviewed-by: Bernhard Beschow <shentey@gmail.com>
2022-03-08Merge remote-tracking branch ↵Peter Maydell1-0/+1
'remotes/pmaydell/tags/pull-target-arm-20220307' into staging target-arm queue: * cleanups of qemu_oom_check() and qemu_memalign() * target/arm/translate-neon: UNDEF if VLD1/VST1 stride bits are non-zero * target/arm/translate-neon: Simplify align field check for VLD3 * GICv3 ITS: add more trace events * GICv3 ITS: implement 8-byte accesses properly * GICv3: fix minor issues with some trace/log messages * ui/cocoa: Use the standard about panel * target/arm: Provide cpu property for controling FEAT_LPA2 * hw/arm/virt: Disable LPA2 for -machine virt-6.2 # gpg: Signature made Mon 07 Mar 2022 16:46:06 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20220307: hw/arm/virt: Disable LPA2 for -machine virt-6.2 target/arm: Provide cpu property for controling FEAT_LPA2 ui/cocoa: Use the standard about panel hw/intc/arm_gicv3_cpuif: Fix register names in ICV_HPPIR read trace event hw/intc/arm_gicv3: Fix missing spaces in error log messages hw/intc/arm_gicv3: Specify valid and impl in MemoryRegionOps hw/intc/arm_gicv3_its: Add trace events for table reads and writes hw/intc/arm_gicv3_its: Add trace events for commands target/arm/translate-neon: Simplify align field check for VLD3 target/arm/translate-neon: UNDEF if VLD1/VST1 stride bits are non-zero osdep: Move memalign-related functions to their own header util: Put qemu_vfree() in memalign.c util: Use meson checks for valloc() and memalign() presence util: Share qemu_try_memalign() implementation between POSIX and Windows meson.build: Don't misdetect posix_memalign() on Windows util: Return valid allocation for qemu_try_memalign() with zero size util: Unify implementations of qemu_memalign() util: Make qemu_oom_check() a static function Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-03-07osdep: Move memalign-related functions to their own headerPeter Maydell1-0/+1
Move the various memalign-related functions out of osdep.h and into their own header, which we include only where they are used. While we're doing this, add some brief documentation comments. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20220226180723.1706285-10-peter.maydell@linaro.org
2022-03-07ide: Increment BB in-flight counter for TRIM BHHanna Reitz1-0/+7
When we still have an AIOCB registered for DMA operations, we try to settle the respective operation by draining the BlockBackend associated with the IDE device. However, this assumes that every DMA operation is associated with an increment of the BlockBackend’s in-flight counter (e.g. through some ongoing I/O operation), so that draining the BB until its in-flight counter reaches 0 will settle all DMA operations. That is not the case: For TRIM, the guest can issue a zero-length operation that will not result in any I/O operation forwarded to the BlockBackend, and also not increment the in-flight counter in any other way. In such a case, blk_drain() will be a no-op if no other operations are in flight. It is clear that if blk_drain() is a no-op, the value of s->bus->dma->aiocb will not change between checking it in the `if` condition and asserting that it is NULL after blk_drain(). The particular problem is that ide_issue_trim() creates a BH (ide_trim_bh_cb()) to settle the TRIM request: iocb->common.cb() is ide_dma_cb(), which will either create a new request, or find the transfer to be done and call ide_set_inactive(), which clears s->bus->dma->aiocb. Therefore, the blk_drain() must wait for ide_trim_bh_cb() to run, which currently it will not always do. To fix this issue, we increment the BlockBackend's in-flight counter when the TRIM operation begins (in ide_issue_trim(), when the ide_trim_bh_cb() BH is created) and decrement it when ide_trim_bh_cb() is done. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2029980 Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220120142259.120189-1-hreitz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Tested-by: John Snow <jsnow@redhat.com>
2022-02-21include: Move hardware version declarations to new qemu/hw-version.hPeter Maydell1-0/+1
The "hardware version" machinery (qemu_set_hw_version(), qemu_hw_version(), and the QEMU_HW_VERSION define) is used by fewer than 10 files. Move it out from osdep.h into a new qemu/hw-version.h. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220208200856.3558249-6-peter.maydell@linaro.org
2022-01-18hw/dma: Let dma_buf_read() / dma_buf_write() propagate MemTxResultPhilippe Mathieu-Daudé1-4/+4
Since commit 292e13142d2, dma_buf_rw() returns a MemTxResult type. Do not discard it, return it to the caller. Pass the previously returned value (the QEMUSGList residual size, which was rarely used) as an optional argument. With this new API, SCSIRequest::residual might now be accessed via a pointer. Since the size_t type does not have the same size on 32 and 64-bit host architectures, convert it to a uint64_t, which is big enough to hold the residual size, and the type is constant on both 32/64-bit hosts. Update the few dma_buf_read() / dma_buf_write() callers to the new API. Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Peter Xu <peterx@redhat.com> Message-Id: <20220117125130.131828-1-f4bug@amsat.org>
2022-01-18hw/dma: Fix format string issues using dma_addr_tPhilippe Mathieu-Daudé1-1/+1
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220111184309.28637-10-f4bug@amsat.org>
2021-12-31dma: Let dma_buf_read() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-2/+2
Let devices specify transaction attributes when calling dma_buf_read(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-13-philmd@redhat.com>
2021-12-31dma: Let dma_buf_write() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-2/+4
Let devices specify transaction attributes when calling dma_buf_write(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-12-philmd@redhat.com>
2021-12-30dma: Let dma_memory_map() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-3/+5
Let devices specify transaction attributes when calling dma_memory_map(). Patch created mechanically using spatch with this script: @@ expression E1, E2, E3, E4; @@ - dma_memory_map(E1, E2, E3, E4) + dma_memory_map(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-7-philmd@redhat.com>
2021-12-30dma: Let dma_memory_read/write() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-1/+1
Let devices specify transaction attributes when calling dma_memory_read() or dma_memory_write(). Patch created mechanically using spatch with this script: @@ expression E1, E2, E3, E4; @@ ( - dma_memory_read(E1, E2, E3, E4) + dma_memory_read(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) | - dma_memory_write(E1, E2, E3, E4) + dma_memory_write(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) ) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-6-philmd@redhat.com>
2021-11-02ide: Cap LBA28 capacity announcement to 2^28-1Samuel Thibault1-2/+6
The LBA28 capacity (at offsets 60/61 of identification) is supposed to express the maximum size supported by LBA28 commands. If the device is larger than this, we have to cap it to 2^28-1. At least NetBSD happens to be using this value to determine whether to use LBA28 or LBA48 for its commands, using LBA28 for sectors that don't need LBA48. This commit thus fixes NetBSD access to disks larger than 128GiB. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-Id: <20210824104344.3878849-1-samuel.thibault@ens-lyon.org> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-10-18via-ide: Avoid using isa_get_irq()BALATON Zoltan1-2/+2
Use via_isa_set_irq() which better encapsulates irq handling in the vt82xx model and avoids using isa_get_irq() that has a comment saying it should not be used. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <26cb1848c9fc0360df7a57c2c9ba5e03c4a692b5.1634259980.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-10-18via-ide: Set user_creatable to falseBALATON Zoltan1-0/+3
This model only works as a function of the via superio chip not as a standalone PCI device. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20211015092159.3E863748F57@zero.eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2021-09-30ide: Rename ide_bus_new() to ide_bus_init()Peter Maydell10-10/+10
The function ide_bus_new() does an in-place initialization. Rename it to ide_bus_init() to follow our _init vs _new convention. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: John Snow <jsnow@redhat.com> Acked-by: John Snow <jsnow@redhat.com> (Feel free to merge.) Message-id: 20210923121153.23754-7-peter.maydell@linaro.org
2021-09-30qbus: Rename qbus_create_inplace() to qbus_init()Peter Maydell1-1/+1
Rename qbus_create_inplace() to qbus_init(); this is more in line with our usual naming convention for functions that in-place initialize objects. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20210923121153.23754-5-peter.maydell@linaro.org
2021-07-20hw/ide/Kconfig: Add missing dependency PCI -> IDE_QDEVPhilippe Mathieu-Daudé1-1/+1
The pci_ide_create_devs() function is declared i hw/ide/qdev.c: $ git grep ide_create_drive hw/ide/pci.c:491: ide_create_drive(d->bus + bus[i], unit[i], hd_table[i]); hw/ide/qdev.c:127:IDEDevice *ide_create_drive(IDEBus *bus, int unit, DriveInfo *drive) include/hw/ide/internal.h:653:IDEDevice *ide_create_drive(IDEBus *bus, int unit, DriveInfo *drive); Fix the correct symbol dependency to avoid build failure when deselecting some machines: /usr/bin/ld: libcommon.fa.p/hw_ide_pci.c.o: in function `pci_ide_create_devs': hw/ide/pci.c:491: undefined reference to `ide_create_drive' Fixes: 8f01b41e109 ("ide: express dependencies with Kconfig") Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210515173716.358295-3-philmd@redhat.com> Acked-by: John Snow <jsnow@redhat.com>
2021-07-19hw/ide: Fix crash when plugging a piix3-ide device into the x-remote machineThomas Huth2-11/+27
QEMU currently crashes when the user tries to do something like: qemu-system-x86_64 -M x-remote -device piix3-ide This happens because the "isabus" variable is not initialized with the x-remote machine yet. Add a proper check for this condition and propagate the error to the caller, so we can fail there gracefully. Message-Id: <20210416125256.2039734-1-thuth@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-06-02docs: fix references to docs/devel/tracing.rstStefano Garzarella1-1/+1
Commit e50caf4a5c ("tracing: convert documentation to rST") converted docs/devel/tracing.txt to docs/devel/tracing.rst. We still have several references to the old file, so let's fix them with the following command: sed -i s/tracing.txt/tracing.rst/ $(git grep -l docs/devel/tracing.txt) Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210517151702.109066-2-sgarzare@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2021-05-02hw: Do not include hw/sysbus.h if it is not necessaryThomas Huth1-1/+0
Many files include hw/sysbus.h without needing it. Remove the superfluous include statements. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210327082804.2259480-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-05-02hw/ide: Add Kconfig dependency MICRODRIVE -> PCMCIAPhilippe Mathieu-Daudé1-0/+1
The Microdrive Compact Flash can be plugged on a PCMCIA bus. Express the dependency using the 'depends on' Kconfig expression. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Warner Losh <imp@bsdimp.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20210424222057.3434459-3-f4bug@amsat.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-03-18hw/ide: remove 'ide-drive' deviceDaniel P. Berrangé1-38/+0
The 'ide-hd' and 'ide-cd' devices provide suitable alternatives. Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2021-03-09sysemu: Let VMChangeStateHandler take boolean 'running' argumentPhilippe Mathieu-Daudé1-1/+1
The 'running' argument from VMChangeStateHandler does not require other value than 0 / 1. Make it a plain boolean. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20210111152020.1422021-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-02-15hw/ide/ahci: map cmd_fis as DMA_DIRECTION_TO_DEVICEAlexander Bulekov1-6/+6
cmd_fis is mapped as DMA_DIRECTION_FROM_DEVICE, however, it is read from, and not written to anywhere. Fix the DMA_DIRECTION and mark cmd_fis as read-only in the code. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210119164051.89268-1-alxndr@bu.edu> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-01-27block: Separate blk_is_writable() and blk_supports_write_perm()Kevin Wolf1-1/+1
Currently, blk_is_read_only() tells whether a given BlockBackend can only be used in read-only mode because its root node is read-only. Some callers actually try to answer a slightly different question: Is the BlockBackend configured to be writable, by taking write permissions on the root node? This can differ, for example, for CD-ROM devices which don't take write permissions, but may be backed by a writable image file. scsi-cd allows write requests to the drive if blk_is_read_only() returns false. However, the write request will immediately run into an assertion failure because the write permission is missing. This patch introduces separate functions for both questions. blk_supports_write_perm() answers the question whether the block node/image file can support writable devices, whereas blk_is_writable() tells whether the BlockBackend is currently configured to be writable. All calls of blk_is_read_only() are converted to one of the two new functions. Fixes: https://bugs.launchpad.net/bugs/1906693 Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210118123448.307825-2-kwolf@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2021-01-23ide: atapi: check logical block address and read size (CVE-2020-29443)Prasad J Pandit1-6/+24
While processing ATAPI cmd_read/cmd_read_cd commands, Logical Block Address (LBA) maybe invalid OR closer to the last block, leading to an OOB access issues. Add range check to avoid it. Fixes: CVE-2020-29443 Reported-by: Wenxiang Qian <leonwxqian@gmail.com> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <20210118115130.457044-1-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-01-18hw/ide/ahci: Replace fprintf() by qemu_log_mask(GUEST_ERROR)Philippe Mathieu-Daudé1-3/+5
Replace fprintf() calls by qemu_log_mask(LOG_GUEST_ERROR). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210112112955.1849212-1-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2021-01-08Remove superfluous timer_del() callsPeter Maydell1-1/+0
This commit is the result of running the timer-del-timer-free.cocci script on the whole source tree. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Corey Minyard <cminyard@mvista.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201215154107.3255-4-peter.maydell@linaro.org
2020-12-18qdev: Move softmmu properties to qdev-properties-system.hEduardo Habkost1-0/+1
Move the property types and property macros implemented in qdev-properties-system.c to a new qdev-properties-system.h header. Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20201211220529.2290218-16-ehabkost@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2020-12-01ide: atapi: assert that the buffer pointer is in rangePaolo Bonzini1-0/+2
A case was reported where s->io_buffer_index can be out of range. The report skimped on the details but it seems to be triggered by s->lba == -1 on the READ/READ CD paths (e.g. by sending an ATAPI command with LBA = 0xFFFFFFFF). For now paper over it with assertions. The first one ensures that there is no overflow when incrementing s->io_buffer_index, the second checks for the buffer overrun. Note that the buffer overrun is only a read, so I am not sure if the assertion failure is actually less harmful than the overrun. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20201201120926.56559-1-pbonzini@redhat.com Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-15nomaintainer: Fix Lesser GPL version numberChetan Pant4-4/+4
There is no "version 2" of the "Lesser" General Public License. It is either "GPL version 2.0" or "Lesser GPL version 2.1". This patch replaces all occurrences of "Lesser GPL version 2" with "Lesser GPL version 2.1" in comment section. This patch contains all the files, whose maintainer I could not get from ‘get_maintainer.pl’ script. Signed-off-by: Chetan Pant <chetan4windows@gmail.com> Message-Id: <20201023124424.20177-1-chetan4windows@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> [thuth: Adapted exec.c and qdev-monitor.c to new location] Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-11-02xen: rework pci_piix3_xen_ide_unplugAnthony PERARD1-14/+13
This is to allow IDE disks to be unplugged when adding to QEMU via: -drive file=/root/disk_file,if=none,id=ide-disk0,format=raw -device ide-hd,drive=ide-disk0,bus=ide.0,unit=0 as the current code only works for disk added with: -drive file=/root/disk_file,if=ide,index=0,media=disk,format=raw Since the code already have the IDE controller as `dev`, we don't need to use the legacy DriveInfo to find all the drive we want to unplug. We can simply use `blk` from the controller, as it kind of was already assume to be the same, by setting it to NULL. Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Acked-by: John Snow <jsnow@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20201027154058.495112-1-anthony.perard@citrix.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
2020-10-27ide: clear SRST after SRST finishesJohn Snow1-0/+2
The SRST protocol states that after diagnostics are complete and the status is posted, we should clear the SRST bit if it should so happen to be set. The reset method itself should handle this, but just in case -- make our intention explicit here. Signed-off-by: John Snow <jsnow@redhat.com> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 20201020200242.1497705-4-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-27ide: perform SRST as early as possibleJohn Snow1-3/+1
We don't need to wait for the falling edge. We can set BSY as soon as possible and begin immediately resetting the drive. Devices don't appear to need to take any specific action on the falling edge. Signed-off-by: John Snow <jsnow@redhat.com> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 20201020200242.1497705-3-jsnow@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-27ide: run diagnostic after SRSTJohn Snow1-4/+2
Software reset (SRST) should cause the diagnostic command to be run. Make an explicit call to that routine. Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 20201020200242.1497705-2-jsnow@redhat.com Fixes: 55adb3c45620c31f29978f209e2a44a08d34e2da Fixes: https://bugs.launchpad.net/bugs/1900155 Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-09hw/ide: restore replay support of IDEAlex Bennée1-2/+2
A recent change to weak reset handling broke replay due to the use of aio_bh_schedule_oneshot instead of the replay aware replay_bh_schedule_oneshot_event. Fixes: 55adb3c456 ("ide: cancel pending callbacks on SRST") Suggested-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: John Snow <jsnow@redhat.com> Acked-by: John Snow <jsnow@redhat.com> Message-Id: <20201007160038.26953-4-alex.bennee@linaro.org>
2020-10-01ide: cancel pending callbacks on SRSTJohn Snow1-18/+40
The SRST implementation did not keep up with the rest of IDE; it is possible to perform a weak reset on an IDE device to remove the BSY/DRQ bits, and then issue writes to the control/device registers which can cause chaos with the state machine. Fix that by actually performing a real reset. Reported-by: Alexander Bulekov <alxndr@bu.edu> Fixes: https://bugs.launchpad.net/qemu/+bug/1878253 Fixes: https://bugs.launchpad.net/qemu/+bug/1887303 Fixes: https://bugs.launchpad.net/qemu/+bug/1887309 Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: clear interrupt on command writeJohn Snow1-0/+1
Not known to fix any bug, but I couldn't help but notice that ATA specifies that writing to this register should clear an interrupt. ATA7: Section 5.3.3 (Command register - Effect) ATA6: Section 7.4.4 (Command register - Effect) ATA5: Section 7.4.4 (Command register - Effect) ATA4: Section 7.4.4 (Command register - Effect) ATA3: Section 5.2.2 (Command register) Other editions: try searching for the phrase "Writing this register". Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: remove magic constants from the device registerJohn Snow1-12/+14
(In QEMU, we call this the "select" register.) My memory isn't good enough to memorize what these magic runes do. Label them to prevent mixups from happening in the future. Side note: I assume it's safe to always set 0xA0 even though ATA2 claims these bits are reserved, because ATA3 immediately reinstated that these bits should be always on. ATA4 and subsequent specs only claim that the fields are obsolete, so I assume it's safe to leave these set and that it should work with the widest array of guests. Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: reorder set/get sector functionsJohn Snow1-11/+15
Reorder these just a pinch to make them more obvious at a glance what the addressing mode is. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-10-01ide: model HOB correctlyJohn Snow1-8/+7
I have been staring at this FIXME for years and I never knew what it meant. I finally stumbled across it! When writing to the command registers, the old value is shifted into a HOB copy of the register and the new value is written into the primary register. When reading registers, the value retrieved is dependent on the HOB bit in the CONTROL register. By setting bit 7 (0x80) in CONTROL, any register read will, if it has one, yield the HOB value for that register instead. Our code has a problem: We were using bit 7 of the DEVICE register to model this. We use bus->cmd roughly as the control register already, as it stores the value from ide_ctrl_write. Lastly, all command register writes reset the HOB, so fix that, too. Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: don't tamper with the device registerJohn Snow1-2/+2
In real ISA operation, register writes go out to an entire bus channel and all listening devices receive the write. The devices do not toggle the DEV bit based on their own configuration, nor does the HBA intermediate or tamper with that value. The reality of the matter is that DEV0/DEV1 accordingly will react to command register writes based on whether or not the device was selected. This does not fix a known bug, but it makes the code slightly simpler and more obvious. Signed-off-by: John Snow <jsnow@redhat.com>
2020-10-01ide: rename cmd_write to ctrl_writeJohn Snow6-19/+19
It's the Control register, part of the Control block -- Command is misleading here. Rename all related functions and constants. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
generated by cgit v1.1 at 2024-09-29 19:48:50 +0000