aboutsummaryrefslogtreecommitdiff
path: root/hw/ide
AgeCommit message (Collapse)AuthorFilesLines
2016-02-10ide: move buffered DMA cancel to coreJohn Snow3-35/+47
Buffered DMA cancellation was added to ATAPI devices and implemented for the BMDMA HBA. Move the code over to common IDE code and allow it to be used for any HBA. Signed-off-by: John Snow <jsnow@redhat.com> Reported-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1453225191-11871-4-git-send-email-jsnow@redhat.com
2016-02-10ide: code motionJohn Snow1-58/+58
Shuffle the reset function upwards. Signed-off-by: John Snow <jsnow@redhat.com> Reported-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1453225191-11871-3-git-send-email-jsnow@redhat.com
2016-02-10ide: Prohibit RESET on IDE drivesJohn Snow1-3/+7
This command is meant for ATAPI devices only, prohibit acknowledging it with a command aborted response when an IDE device is busy. Signed-off-by: John Snow <jsnow@redhat.com> Reported-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1453225191-11871-2-git-send-email-jsnow@redhat.com
2016-02-08qom: Swap 'name' next to visitor in ObjectPropertyAccessorEric Blake1-4/+4
Similar to the previous patch, it's nice to have all functions in the tree that involve a visitor and a name for conversion to or from QAPI to consistently stick the 'name' parameter next to the Visitor parameter. Done by manually changing include/qom/object.h and qom/object.c, then running this Coccinelle script and touching up the fallout (Coccinelle insisted on adding some trailing whitespace). @ rule1 @ identifier fn; typedef Object, Visitor, Error; identifier obj, v, opaque, name, errp; @@ void fn - (Object *obj, Visitor *v, void *opaque, const char *name, + (Object *obj, Visitor *v, const char *name, void *opaque, Error **errp) { ... } @@ identifier rule1.fn; expression obj, v, opaque, name, errp; @@ fn(obj, v, - opaque, name, + name, opaque, errp) Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <1454075341-13658-20-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-02-08qapi: Swap visit_* arguments for consistent 'name' placementEric Blake1-2/+2
JSON uses "name":value, but many of our visitor interfaces were called with visit_type_FOO(v, &value, name, errp). This can be a bit confusing to have to mentally swap the parameter order to match JSON order. It's particularly bad for visit_start_struct(), where the 'name' parameter is smack in the middle of the otherwise-related group of 'obj, kind, size' parameters! It's time to do a global swap of the parameter ordering, so that the 'name' parameter is always immediately after the Visitor argument. Additional reason in favor of the swap: the existing include/qjson.h prefers listing 'name' first in json_prop_*(), and I have plans to unify that file with the qapi visitors; listing 'name' first in qapi will minimize churn to the (admittedly few) qjson.h clients. Later patches will then fix docs, object.h, visitor-impl.h, and those clients to match. Done by first patching scripts/qapi*.py by hand to make generated files do what I want, then by running the following Coccinelle script to affect the rest of the code base: $ spatch --sp-file script `git grep -l '\bvisit_' -- '**/*.[ch]'` I then had to apply some touchups (Coccinelle insisted on TAB indentation in visitor.h, and botched the signature of visit_type_enum() by rewriting 'const char *const strings[]' to the syntactically invalid 'const char*const[] strings'). The movement of parameters is sufficient to provoke compiler errors if any callers were missed. // Part 1: Swap declaration order @@ type TV, TErr, TObj, T1, T2; identifier OBJ, ARG1, ARG2; @@ void visit_start_struct -(TV v, TObj OBJ, T1 ARG1, const char *name, T2 ARG2, TErr errp) +(TV v, const char *name, TObj OBJ, T1 ARG1, T2 ARG2, TErr errp) { ... } @@ type bool, TV, T1; identifier ARG1; @@ bool visit_optional -(TV v, T1 ARG1, const char *name) +(TV v, const char *name, T1 ARG1) { ... } @@ type TV, TErr, TObj, T1; identifier OBJ, ARG1; @@ void visit_get_next_type -(TV v, TObj OBJ, T1 ARG1, const char *name, TErr errp) +(TV v, const char *name, TObj OBJ, T1 ARG1, TErr errp) { ... } @@ type TV, TErr, TObj, T1, T2; identifier OBJ, ARG1, ARG2; @@ void visit_type_enum -(TV v, TObj OBJ, T1 ARG1, T2 ARG2, const char *name, TErr errp) +(TV v, const char *name, TObj OBJ, T1 ARG1, T2 ARG2, TErr errp) { ... } @@ type TV, TErr, TObj; identifier OBJ; identifier VISIT_TYPE =~ "^visit_type_"; @@ void VISIT_TYPE -(TV v, TObj OBJ, const char *name, TErr errp) +(TV v, const char *name, TObj OBJ, TErr errp) { ... } // Part 2: swap caller order @@ expression V, NAME, OBJ, ARG1, ARG2, ERR; identifier VISIT_TYPE =~ "^visit_type_"; @@ ( -visit_start_struct(V, OBJ, ARG1, NAME, ARG2, ERR) +visit_start_struct(V, NAME, OBJ, ARG1, ARG2, ERR) | -visit_optional(V, ARG1, NAME) +visit_optional(V, NAME, ARG1) | -visit_get_next_type(V, OBJ, ARG1, NAME, ERR) +visit_get_next_type(V, NAME, OBJ, ARG1, ERR) | -visit_type_enum(V, OBJ, ARG1, ARG2, NAME, ERR) +visit_type_enum(V, NAME, OBJ, ARG1, ARG2, ERR) | -VISIT_TYPE(V, OBJ, NAME, ERR) +VISIT_TYPE(V, NAME, OBJ, ERR) ) Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <1454075341-13658-19-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-01-30macio: add dma_active to VMStateDescriptionMark Cave-Ayland1-1/+2
Make sure that we include the value of dma_active in the migration stream. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Acked-by: John Snow <jsnow@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-01-30macio: use the existing IDEDMA aiocb to hold the active DMA aiocbMark Cave-Ayland1-8/+12
Currently the aiocb is held within MACIOIDEState, however the IDE core code assumes that the current actvie DMA aiocb is held in aiocb in a few places, e.g. ide_bus_reset() and ide_reset(). Switch over to using IDEDMA aiocb to store the aiocb for the current active DMA request so that bus resets and restarts are handled correctly. As a consequence we can now use ide_set_inactive() rather than handling its functionality ourselves. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-01-29ide: Clean up includesPeter Maydell13-0/+13
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-17-git-send-email-peter.maydell@linaro.org
2016-01-25ide: Correct the CHS 'cyls_max' limit to be 65535Shmulik Ladkani1-1/+1
In b7eb0c9: hw/block-common: Factor out fall back to legacy -drive cyls=... 'blkconf_geometry()' was introduced, factoring out CHS limit validation code that was repeated in ide, scsi, virtio-blk. The original IDE CHS limit prior b7eb0c9 was 65535,16,255 (as per ATA CHS addressing). However the 'cyls_max' argument passed to 'blkconf_geometry' in the ide_dev_initfn case was accidentally set to 65536 instead of 65535. Fix, providing the correct 'cyls_max'. Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1453112371-29760-1-git-send-email-shmulik.ladkani@ravellosystems.com Signed-off-by: John Snow <jsnow@redhat.com>
2016-01-13hw: Inline the qdev_prop_set_drive_nofail() wrapperMarkus Armbruster1-1/+2
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1449764955-10741-3-git-send-email-armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2016-01-11ide: ahci: reset ncq object to unused on errorPrasad J Pandit1-0/+1
When processing NCQ commands, AHCI device emulation prepares a NCQ transfer object; To which an aio control block(aiocb) object is assigned in 'execute_ncq_command'. In case, when the NCQ command is invalid, the 'aiocb' object is not assigned, and NCQ transfer object is left as 'used'. This leads to a use after free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'. Reset NCQ transfer object to 'unused' to avoid it. [Maintainer edit: s/ACHI/AHCI/ in the commit message. --js] Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2016-01-11macio: fix overflow in lba to offset conversion for ATAPI devicesMark Cave-Ayland1-1/+1
As the IDEState lba field is an int32_t, make sure we cast to int64_t before shifting to calculate the offset. Otherwise we end up with an overflow when trying to access sectors beyond 2GB as can occur when using DVD images. [Maintainer edit: fixed extraneous parentheses. --js] Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1451928613-29476-1-git-send-email-mark.cave-ayland@ilande.co.uk Signed-off-by: John Snow <jsnow@redhat.com>
2016-01-11hw/ide: Remove superfluous return statementsThomas Huth2-3/+0
The "return;" statements at the end of functions do not make much sense, so let's remove them. Cc: qemu-block@nongnu.org Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-11-24atapi: Fix code indentationAlberto Garcia1-1/+1
This was accidentally changed by commit 5f81724d Signed-off-by: Alberto Garcia <berto@igalia.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 93fb43522e3b8dddb6c709d568919347d9a5ba3f.1448367341.git.berto@igalia.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-24atapi: Account for failed and invalid operations in cd_read_sector()Alberto Garcia1-2/+4
Commit 5f81724d made PIO read requests async but didn't add the relevant block_acct_failed() and block_acct_invalid() calls. Signed-off-by: Alberto Garcia <berto@igalia.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 9b87e09d61019c128139b6c999ed0c07f0674170.1448367341.git.berto@igalia.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-17ide: enable buffered requests for PIO read requestsPeter Lieven1-2/+2
Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1447345846-15624-7-git-send-email-pl@kamp.de Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-17ide: enable buffered requests for ATAPI devicesPeter Lieven1-5/+5
Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1447345846-15624-6-git-send-email-pl@kamp.de Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-17ide: orphan all buffered requests on DMA cancelPeter Lieven1-0/+19
If the guests canceles a DMA request we can prematurely invoke all callbacks of buffered requests and flag all them as orphaned. Ideally this avoids the need for draining all requests. For CDROM devices this works in 100% of all cases. Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1447345846-15624-5-git-send-email-pl@kamp.de Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-17ide: add support for IDEBufferedRequestPeter Lieven2-0/+61
this patch adds a new aio readv compatible function which copies all data through a bounce buffer. These buffered requests can be flagged as orphaned which means that their original callback has already been invoked and the request has just not been completed by the backend storage. The bounce buffer guarantees that guest memory corruption is avoided when such a orphaned request is completed by the backend at a later stage. This trick only works for read requests as a write request completed at a later stage might corrupt data as there is no way to control if and what data has already been written to the storage. Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1447345846-15624-4-git-send-email-pl@kamp.de Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-17ide/atapi: make PIO read requests asyncPeter Lieven1-13/+82
PIO read requests on the ATAPI interface used to be sync blk requests. This has two significant drawbacks. First the main loop hangs util an I/O request is completed and secondly if the I/O request does not complete (e.g. due to an unresponsive storage) Qemu hangs completely. Note: Due to possible race conditions requests during an ongoing elementary transfer are still sync. Signed-off-by: Peter Lieven <pl@kamp.de> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1447345846-15624-2-git-send-email-pl@kamp.de Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-13atapi: Prioritize unknown cmd error over BCL errorJohn Snow1-10/+10
If we don't know about the command at all, we need to prioritize that failure above the zero byte-count-limit failure. This fixes a failure in the sparc64 NetBSD 7.0 installer bootup. Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: John Snow <jsnow@redhat.com> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 1447095959-10046-3-git-send-email-jsnow@redhat.com
2015-11-13atapi: add byte_count_limit helperJohn Snow1-5/+13
Signed-off-by: John Snow <jsnow@redhat.com> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-id: 1447095959-10046-2-git-send-email-jsnow@redhat.com
2015-11-12macio: Account for failed operationsAlberto Garcia1-2/+10
Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: ee6f4fde6a7c1071ca96d4ddd53e4934ff812fcd.1446044838.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-11-12ide: Account for failed and invalid operationsAlberto Garcia1-2/+8
Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: bf4d6c9c563877e699b0bf42e7eaf8b096c4a35e.1446044838.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-11-12atapi: Account for failed and invalid operationsAlberto Garcia1-12/+19
Signed-off-by: Alberto Garcia <berto@igalia.com> Message-id: 59dee4e2921b0c79d41c49b67dfb93d32db9f7f9.1446044838.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-11-12ide: Account for write operations correctlyAlberto Garcia1-1/+1
Signed-off-by: Alberto Garcia <berto@igalia.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 2e71323c0875c2b66a8ae22229545e0c013af8d4.1446044837.git.berto@igalia.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-11-06ahci: Add allwinner AHCIPeter Crosthwaite2-0/+111
Add a Sysbus AHCI subclass for the Allwinner AHCI. It has a few extra vendor specific registers which are used for phy and power init. Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 833b5b05ed5ade38bf69656679b0a7575e79492b.1445917756.git.crosthwaite.peter@gmail.com [resolved patch context on pull --js] Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-06ahci: split realize and initPeter Crosthwaite3-15/+34
Do the init level tasks asap and the realize later (mainly when num_ports is available). This allows sub-class realize routines to work with the device post-init. Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1a7c7b2b32e5ccf49373a5065da5ece89730d3ac.1445917756.git.crosthwaite.peter@gmail.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-06ahci: Add some MMIO debug printfsPeter Crosthwaite1-6/+15
These are useful for bringup of AHCI. Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 517ba413dce7deb4ab17c0cc1e8bbdaaace2a0db.1445917756.git.crosthwaite.peter@gmail.com Signed-off-by: John Snow <jsnow@redhat.com>
2015-11-06ide: remove hardcoded 2GiB transactional limitJohn Snow3-24/+15
Not that you can request a >2GiB transaction, but that's why checking for it makes no sense anymore. With the newer 'limit' parameter to prepare_buf, we no longer need a static limit. The maximum limit is still 2GiB, but the limit parameter is set to the current transaction size, which cannot surpass 32MiB (512 * 65536). If the PRDT surpasses the transactional size, then, we'll just carry out the normative underflow handling pathways instead of needing an extra, strange pathway that worries about hitting some logistical cap for the largest sglist we can support -- we'll never even attempt to build one that big anymore. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1445902682-20051-1-git-send-email-jsnow@redhat.com
2015-11-04osdep: Rename qemu_{get, set}_version() to qemu_{, set_}hw_version()Eduardo Habkost1-1/+1
This makes the purpose of the function clearer: it is not about the version of QEMU that's running, but the version string exposed in the emulated hardware. Cc: Andrzej Zaborowski <balrogg@gmail.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: John Snow <jsnow@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1446233769-7892-3-git-send-email-ehabkost@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-10-23macio-ide: add to storage categoryLaurent Vivier1-0/+1
macio-ide is an IDE controller, so add it to the storage category. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-10-23cmd646: add to storage categoryLaurent Vivier1-0/+1
cmd646 is an IDE controller, so add it to the storage category. Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2015-10-18hw/ide/ahci.c: Fix shift left into sign bitPeter Maydell1-1/+1
Avoid undefined behaviour from shifting left into the sign bit: hw/ide/ahci.c:551:36: runtime error: left shift of 255 by 24 places cannot be represented in type 'int' (Unfortunately C's promotion rules mean that in the expression "some_uint8_t_variable << 24" the LHS gets promoted to signed int before shifting.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: John Snow <jsnow@redhat.com>
2015-09-18ahci: clean up initial d2h semanticsJohn Snow1-11/+16
with write_fis_d2h and signature generation tidied up, let's adjust the initial d2h semantics to make more sense. The initial d2h is considered delivered if there is guest memory to save it to. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-5-git-send-email-jsnow@redhat.com
2015-09-18ahci: remove cmd_fis argument from write_fis_d2hJohn Snow1-7/+4
It's no longer used. We used to generate a D2H FIS based upon the command FIS that prompted the update, but in reality, the D2H FIS is generated purely from register state. cmd_fis is vestigial, so get rid of it. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-4-git-send-email-jsnow@redhat.com
2015-09-18ahci: fix signature generationJohn Snow1-12/+20
The initial register device-to-host FIS no longer needs to specially set certain fields, as these can be handled generically by setting those fields explicitly with the signatures we want at port reset time. (1) Signatures are decomposed into their four component registers and set upon (AHCI) port reset. (2) the signature cache register is no longer set manually per-each device type, but instead just once during ahci_init_d2h. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-3-git-send-email-jsnow@redhat.com
2015-09-18ahci: remove dead reset codeJohn Snow1-4/+1
This check is dead due to an earlier conditional. AHCI does not currently support hotplugging, so checks to see if devices are present or not are useless. Remove it. Reported-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1441140641-17631-2-git-send-email-jsnow@redhat.com
2015-09-18atapi: abort transfers with 0 byte limitsJohn Snow3-6/+29
We're supposed to abort on transfers like this, unless we fill Word 125 of our IDENTIFY data with a default transfer size, which we don't currently do. This is an ATA error, not a SCSI/ATAPI one. See ATA8-ACS3 sections 7.17.6.49 or 7.21.5. If we don't do this, QEMU will loop forever trying to transfer zero bytes, which isn't particularly useful. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 1442253685-23349-2-git-send-email-jsnow@redhat.com
2015-09-18ide: fix ATAPI command permissionsJohn Snow1-15/+15
We're a little too lenient with what we'll let an ATAPI drive handle. Clamp down on the IDE command execution table to remove CD_OK permissions from commands that are not and have never been ATAPI commands. For ATAPI command validity, please see: - ATA4 Section 6.5 ("PACKET Command feature set") - ATA8/ACS Section 4.3 ("The PACKET feature set") - ACS3 Section 4.3 ("The PACKET feature set") ACS3 has a historical command validity table in Table B.4 ("Historical Command Assignments") that can be referenced to find when a command was introduced, deprecated, obsoleted, etc. The only reference for ATAPI command validity is by checking that version's PACKET feature set section. ATAPI was introduced by T13 into ATA4, all commands retired prior to ATA4 therefore are assumed to have never been ATAPI commands. Mandatory commands, as listed in ATA8-ACS3, are: - DEVICE RESET - EXECUTE DEVICE DIAGNOSTIC - IDENTIFY DEVICE - IDENTIFY PACKET DEVICE - NOP - PACKET - READ SECTOR(S) - SET FEATURES Optional commands as listed in ATA8-ACS3, are: - FLUSH CACHE - READ LOG DMA EXT - READ LOG EXT - WRITE LOG DMA EXT - WRITE LOG EXT All other commands are illegal to send to an ATAPI device and should be rejected by the device. CD_OK removal justifications: 0x06 WIN_DSM Defined in ACS2. Not valid for ATAPI. 0x21 WIN_READ_ONCE Retired in ATA5. Not ATAPI in ATA4. 0x94 WIN_STANDBYNOW2 Retired in ATA4. Did not coexist with ATAPI. 0x95 WIN_IDLEIMMEDIATE2 Retired in ATA4. Did not coexist with ATAPI. 0x96 WIN_STANDBY2 Retired in ATA4. Did not coexist with ATAPI. 0x97 WIN_SETIDLE2 Retired in ATA4. Did not coexist with ATAPI. 0x98 WIN_CHECKPOWERMODE2 Retired in ATA4. Did not coexist with ATAPI. 0x99 WIN_SLEEPNOW2 Retired in ATA4. Did not coexist with ATAPI. 0xE0 WIN_STANDBYNOW1 Not part of ATAPI in ATA4, ACS or ACS3. 0xE1 WIN_IDLEIMMDIATE Not part of ATAPI in ATA4, ACS or ACS3. 0xE2 WIN_STANDBY Not part of ATAPI in ATA4, ACS or ACS3. 0xE3 WIN_SETIDLE1 Not part of ATAPI in ATA4, ACS or ACS3. 0xE4 WIN_CHECKPOWERMODE1 Not part of ATAPI in ATA4, ACS or ACS3. 0xE5 WIN_SLEEPNOW1 Not part of ATAPI in ATA4, ACS or ACS3. 0xF8 WIN_READ_NATIVE_MAX Obsoleted in ACS3. Not ATAPI in ATA4 or ACS. This patch fixes a divide by zero fault that can be caused by sending the WIN_READ_NATIVE_MAX command to an ATAPI drive, which causes it to attempt to use zeroed CHS values to perform sector arithmetic. Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-id: 1441816082-21031-1-git-send-email-jsnow@redhat.com CC: qemu-stable@nongnu.org
2015-09-17ide: unify io_buffer_offset incrementsJohn Snow3-18/+10
IDEState's io_buffer_offset was originally added to keep track of offsets in AHCI rather exclusively, but it was added to IDEState instead of an AHCI-specific structure. AHCI fakes all PIO transfers using DMA and a scatter-gather list. When the core or atapi layers invoke HBA-specific mechanisms for transfers, they do not always know that it is being backed by DMA or a sglist, so this offset is not always updated by the HBA code everywhere. If we modify it in dma_buf_commit, however, any HBA that needs to use this offset to manage operating on only part of a sglist will have access to it. This will fix ATAPI PIO transfers performed through the AHCI HBA, which were previously not modifying this value appropriately. This will fix ATAPI PIO transfers larger than one sector. Reported-by: Hannes Reinecke <hare@suse.de> Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1440546331-29087-2-git-send-email-jsnow@redhat.com CC: qemu-stable@nongnu.org
2015-09-11trivial: remove trailing newline from error_reportJohn Snow1-1/+1
Minor cleanup. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-09-08ahci.c: Don't assume AHCIState's parent is AHCIPCIStateAlistair Francis2-6/+9
The AHCIState struct can either have AHCIPCIState or SysbusAHCIState as a parent. The ahci_irq_lower() and ahci_irq_raise() functions assume that it is always AHCIPCIState, which is not always the case, which causes a seg fault. Verify what the container of AHCIState is before setting the PCIDevice struct. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Acked-by: John Snow <jsnow@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-09-08ahci: Separate the AHCI state structure into the headerAlistair Francis2-13/+14
Pull the AHCI state structure out into the header. This allows other containers to access the struct. This is required to add the device to modern SoC containers. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Sai Pavan Boddu <saipava@xilinx.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-08-03Fix release_drive on unplugged devices (pci_piix3_xen_ide_unplug)Stefano Stabellini1-0/+7
pci_piix3_xen_ide_unplug should completely unhook the unplugged IDEDevice from the corresponding BlockBackend, otherwise the next call to release_drive will try to detach the drive again. Suggested-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-07-31ahci: fix ICC mask definitionJohn Snow1-1/+1
There are likely others that could be updated, but we'll go with a light touch for 2.4 for now. Without the Unsigned specifier, this shifts bits into the signed bit, which makes clang unhappy and could cause unwanted behavior. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1437501721-24495-1-git-send-email-jsnow@redhat.com
2015-07-31macio: re-add TRIM supportAurelien Jarno1-0/+28
Commit bd4214fc dropped TRIM support by mistake. Given it is still advertised to the host when using a drive with discard=on, this cause the IDE bus to hang when the host issues a TRIM command. This patch fixes that by re-adding the TRIM code, ported to the new new DMA implementation. Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: John Snow <jsnow@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 1438198068-32428-1-git-send-email-aurelien@aurel32.net Signed-off-by: John Snow <jsnow@redhat.com>
2015-07-26ide: Clear DRQ after handling all expected accessesKevin Wolf1-4/+12
This is additional hardening against an end_transfer_func that fails to clear the DRQ status bit. The bit must be unset as soon as the PIO transfer has completed, so it's better to do this in a central place instead of duplicating the code in all commands (and forgetting it in some). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2015-07-26ide/atapi: Fix START STOP UNIT command completionKevin Wolf1-0/+1
The command must be completed on all code paths. START STOP UNIT with pwrcnd set should succeed without doing anything. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
2015-07-26ide: Check array bounds before writing to io_buffer (CVE-2015-5154)Kevin Wolf1-0/+16
If the end_transfer_func of a command is called because enough data has been read or written for the current PIO transfer, and it fails to correctly call the command completion functions, the DRQ bit in the status register and s->end_transfer_func may remain set. This allows the guest to access further bytes in s->io_buffer beyond s->data_end, and eventually overflowing the io_buffer. One case where this currently happens is emulation of the ATAPI command START STOP UNIT. This patch fixes the problem by adding explicit array bounds checks before accessing the buffer instead of relying on end_transfer_func to function correctly. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
generated by cgit v1.1 at 2024-07-21 09:22:28 +0000