summary refs log tree commit diff stats
path: root/hw/ide/ahci.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* ide: Correct handling of malformed/short PRDTsJohn Snow2014-11-141-7/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This impacts both BMDMA and AHCI HBA interfaces for IDE. Currently, we confuse the difference between a PRDT having "0 bytes" and a PRDT having "0 complete sectors." When we receive an incomplete sector, inconsistent error checking leads to an infinite loop wherein the call succeeds, but it didn't give us enough bytes -- leading us to re-call the DMA chain over and over again. This leads to, in the BMDMA case, leaked memory for short PRDTs, and infinite loops and resource usage in the AHCI case. The .prepare_buf() callback is reworked to return the number of bytes that it successfully prepared. 0 is a valid, non-error answer that means the table was empty and described no bytes. -1 indicates an error. Our current implementation uses the io_buffer in IDEState to ultimately describe the size of a prepared scatter-gather list. Even though the AHCI PRDT/SGList can be as large as 256GiB, the AHCI command header limits transactions to just 4GiB. ATA8-ACS3, however, defines the largest transaction to be an LBA48 command that transfers 65,536 sectors. With a 512 byte sector size, this is just 32MiB. Since our current state structures use the int type to describe the size of the buffer, and this state is migrated as int32, we are limited to describing 2GiB buffer sizes unless we change the migration protocol. For this reason, this patch begins to unify the assertions in the IDE pathways that the scatter-gather list provided by either the AHCI PRDT or the PCI BMDMA PRDs can only describe, at a maximum, 2GiB. This should be resilient enough unless we need a sector size that exceeds 32KiB. Further, the likelihood of any guest operating system actually attempting to transfer this much data in a single operation is very slim. To this end, the IDEState variables have been updated to more explicitly clarify our maximum supported size. Callers to the prepare_buf callback have been reworked to understand the new return code, and all versions of the prepare_buf callback have been adjusted accordingly. Lastly, the ahci_populate_sglist helper, relied upon by the AHCI implementation of .prepare_buf() as well as the PCI implementation of the callback have had overflow assertions added to help make clear the reasonings behind the various type changes. [Added %d -> %"PRId64" fix John sent because off_pos changed from int to int64_t. --Stefan] Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1414785819-26209-4-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: unify sglist preparationJohn Snow2014-11-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The intent of this patch is to further unify the creation and deletion of the sglist used for all AHCI transfers, including emulated PIO, ATAPI R/W, and native DMA R/W. By replacing ahci_start_transfer's call to ahci_populate_sglist with ahci_dma_prepare_buf, we reduce the number of direct calls where we manipulate the scatter-gather list in the AHCI code. To make this switch, the constant "0" passed as an offset in ahci_dma_prepare_buf is adjusted to use io_buffer_offset. For DMA pathways, this has no effect: io_buffer_offset is always updated to 0 at the beginning of a DMA transfer loop regardless. DMA pathways through ide_dma_cb() update the io_buffer_offset accordingly, and for circumstances where we might make several trips through this loop, this may actually correct a design flaw. For PIO pathways, the newly updated ahci_dma_prepare_buf will now prepare the sglist at the correct offset. It will also set io_buffer_size, but this is not used in the cmd_read_pio or cmd_write_pio pathways. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1414785819-26209-3-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: repair PIO transfers for cases where nsector > 1John Snow2014-11-141-1/+1
| | | | | | | | | | | | | | | | | | Currently, for emulated PIO transfers through the AHCI device, any attempt made to request more than a single sector's worth of data will result in the same sector being transferred over and over. For example, if we request 8 sectors via PIO READ SECTORS, the AHCI device will give us the same sector eight times. This patch adds offset tracking into the PIO pathways so that we can fulfill these requests appropriately. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1414785819-26209-2-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Fix byte count regression for ATAPI/PIOJohn Snow2014-11-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch fixes a regression caused by commit 659142ecf71a0da240ab0ff7cf929ee25c32b9bc. The problem occurs when we wish to return early from the ahci_start_transfer function, but are now updating the transferred byte count in the AHCI command header via ahci_commit_buf. This will cause problems in the Windows 8 installer. Don't update the byte count in the command header for the transmission of ATAPI packets: These commands will distort the final byte count of the actual data payload. The call to ahci_commit_buf remains in the "out" portion of the call in order to clean up the sglist. The byte count is maintained by forcing size to be 0. Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Fix SDB FIS ConstructionJohn Snow2014-11-031-9/+9
| | | | | | | | | | | | | | | | | | | | | | The SDB FIS creation was mangled; We were writing the error byte to byte 0, and omitting the SDB FIS magic byte. Though the SDB packet layout states that: byte 0: Must be 0xA1 to indicate SDB FIS. byte 1: Port multiplier select & other flags byte 2: status byte. byte 3: error byte. This patch adds an SDB FIS structure with human-readable names, and ensures that we are filling the structure appropriately. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412204151-18117-7-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Update byte count after DMA completionJohn Snow2014-11-031-10/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, DMA read/write operations neglect to update the byte count after a successful transfer like ATAPI DMA read or PIO read/write operations do. We correct this oversight by adding another callback into the IDEDMAOps structure. The commit callback is called whenever we are cleaning up a scatter-gather list. AHCI can register this callback in order to update post- transfer information such as byte count updates. We use this callback in AHCI to consolidate where we delete the SGlist as generated from the PRDT, as well as update the byte count after the transfer is complete. The QEMUSGList structure has an init flag added to it in order to make qemu_sglist_destroy a nop if it is called when there is no sglist, which simplifies cleanup and error paths. This patch fixes several AHCI problems, notably Non-NCQ modes of operation for Windows 7 as well as Hibernate support for Windows 7. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412204151-18117-3-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Correct PIO/D2H FIS responsesJohn Snow2014-11-031-23/+25
| | | | | | | | | | | | | | | | | | | | | | | | Currently, the D2H FIS packets AHCI generates simply parrot back the LBA that the guest sent to us in the cmd_fis. However, some commands (like READ NATIVE MAX) modify the LBA registers as a return value, through which the AHCI D2H FIS is the only response mechanism. Thus, the D2H response should use the current register values, not the initial ones. This patch adjusts the LBA and drive select register responses for PIO Setup and D2H FIS response packets. Additionally, the PIO and D2H FIS responses copy too many bytes from the command FIS that it is being generated from. Specifically, byte 11 which is the Features(15:8) field for Register Host to Device FIS packets, is instead reserved for the PIO Setup FIS and should always be 0. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412204151-18117-2-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* hw: Convert from BlockDriverState to BlockBackend, mostlyMarkus Armbruster2014-10-201-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | Device models should access their block backends only through the block-backend.h API. Convert them, and drop direct includes of inappropriate headers. Just four uses of BlockDriverState are left: * The Xen paravirtual block device backend (xen_disk.c) opens images itself when set up via xenbus, bypassing blockdev.c. I figure it should go through qmp_blockdev_add() instead. * Device model "usb-storage" prompts for keys. No other device model does, and this one probably shouldn't do it, either. * ide_issue_trim_cb() uses bdrv_aio_discard() instead of blk_aio_discard() because it fishes its backend out of a BlockAIOCB, which has only the BlockDriverState. * PC87312State has an unused BlockDriverState[] member. The next two commits take care of the latter two. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: Rename BlockDriverCompletionFunc to BlockCompletionFuncMarkus Armbruster2014-10-201-1/+1
| | | | | | | | | | I'll use it with block backends shortly, and the name is going to fit badly there. It's a block layer thing anyway, not just a block driver thing. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* q35/ahci: Pick up -cdrom and -hda optionsJohn Snow2014-10-031-0/+15
| | | | | | | | | | | | This patch implements the backend for the Q35 board for us to be able to pick up and use drives defined by the -cdrom, -hda, or -drive if=ide shorthand options. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412187569-23452-7-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: properly shadow the TFD registerJohn Snow2014-09-221-14/+28
| | | | | | | | | | | | | | | | | | | | | | | | In a real AHCI device, several S/ATA registers are mirrored or shadowed within the AHCI register set. These registers are not updated synchronously for each read access, but are instead updated after a Device-to-Host Register FIS packet is received. The D2H FIS contains the values from these registers on the device. In QEMU, by reaching directly into the device to grab these bits before they are "sent," we may introduce race conditions where unexpected values are present "before they are sent" which could cause issues for some guests, particularly if an attempt is made to read the PxTFD register prior to enabling the port, where incorrect values will be read. This patch also addresses the boot-time values for the PxTFD and PxSIG registers to bring them in line with the AHCI 1.3 specification. Lastly, several fields (PxTFD, PxSIG and PxSACT) are read-only, and any attempts to write to them should be ignored. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1408643079-30675-6-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide/ahci: Check for -ECANCELED in aio callbacksFam Zheng2014-09-221-0/+3
| | | | | | | | | | | | | | | | | | Before, bdrv_aio_cancel will either complete the request (like normal) and call CB with an actual return code, or skip calling the request (for example when the IO req is not submitted by thread pool yet). We will change bdrv_aio_cancel to do it differently: always call CB before return, with either [1] a normal req completion ret code, or [2] ret == -ECANCELED. So the callers' callback must accept both cases. The existing logic works with case [1], but not [2]. The simplest transition of callback code is do nothing in case [2], just as if the CB is not called by the bdrv_aio_cancel() call. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* block: Make the block accounting functions operate on BlockAcctStatsBenoît Canet2014-09-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the next step for decoupling block accounting functions from BlockDriverState. In a future commit the BlockAcctStats structure will be moved from BlockDriverState to the device models structures. Note that bdrv_get_stats was introduced so device models can retrieve the BlockAcctStats structure of a BlockDriverState without being aware of it's layout. This function should go away when BlockAcctStats will be embedded in the device models structures. CC: Kevin Wolf <kwolf@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Keith Busch <keith.busch@intel.com> CC: Anthony Liguori <aliguori@amazon.com> CC: "Michael S. Tsirkin" <mst@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> CC: Eric Blake <eblake@redhat.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Michael Tokarev <mjt@tls.msk.ru> CC: John Snow <jsnow@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Alexander Graf <agraf@suse.de> CC: Max Reitz <mreitz@redhat.com> Signed-off-by: Benoît Canet <benoit.canet@nodalink.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: rename BlockAcctType members to start with BLOCK_ instead of BDRV_Benoît Canet2014-09-101-2/+2
| | | | | | | | | | | | | | | | | | | | The middle term goal is to move the BlockAcctStats structure in the device models. (Capturing I/O accounting statistics in the device models is good for billing) This patch make a small step in this direction by removing a reference to BDRV. CC: Kevin Wolf <kwolf@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Keith Busch <keith.busch@intel.com> CC: Anthony Liguori <aliguori@amazon.com> CC: "Michael S. Tsirkin" <mst@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> CC: John Snow <jsnow@redhat.com> CC: Richard Henderson <rth@twiddle.net> CC: Markus Armbruster <armbru@redhat.com> CC: Alexander Graf <agraf@suse.de>i Signed-off-by: Benoît Canet <benoit.canet@nodalink.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: Use g_new() & friends where that makes obvious senseMarkus Armbruster2014-08-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. Patch created with Coccinelle, with two manual changes on top: * Add const to bdrv_iterate_format() to keep the types straight * Convert the allocation in bdrv_drop_intermediate(), which Coccinelle inexplicably misses Coccinelle semantic patch: @@ type T; @@ -g_malloc(sizeof(T)) +g_new(T, 1) @@ type T; @@ -g_try_malloc(sizeof(T)) +g_try_new(T, 1) @@ type T; @@ -g_malloc0(sizeof(T)) +g_new0(T, 1) @@ type T; @@ -g_try_malloc0(sizeof(T)) +g_try_new0(T, 1) @@ type T; expression n; @@ -g_malloc(sizeof(T) * (n)) +g_new(T, n) @@ type T; expression n; @@ -g_try_malloc(sizeof(T) * (n)) +g_try_new(T, n) @@ type T; expression n; @@ -g_malloc0(sizeof(T) * (n)) +g_new0(T, n) @@ type T; expression n; @@ -g_try_malloc0(sizeof(T) * (n)) +g_try_new0(T, n) @@ type T; expression p, n; @@ -g_realloc(p, sizeof(T) * (n)) +g_renew(T, p, n) @@ type T; expression p, n; @@ -g_try_realloc(p, sizeof(T) * (n)) +g_try_renew(T, p, n) Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Jeff Cody <jcody@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2014-08-191-2/+0
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SCSI changes that enable sending vendor-specific commands via virtio-scsi. Memory changes for QOMification and automatic tracking of MR lifetime. # gpg: Signature made Mon 18 Aug 2014 13:03:09 BST using RSA key ID 9B4D86F2 # gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>" # gpg: aka "Paolo Bonzini <bonzini@gnu.org>" * remotes/bonzini/tags/for-upstream: mtree: remove write-only field memory: Use canonical path component as the name memory: Use memory_region_name for name access memory: constify memory_region_name exec: Abstract away ref to memory region names loader: Abstract away ref to memory region names tpm_tis: remove instance_finalize callback memory: remove memory_region_destroy memory: convert memory_region_destroy to object_unparent ioport: split deletion and destruction nic: do not destroy memory regions in cleanup functions vga: do not dynamically allocate chain4_alias sysbus: remove unused function sysbus_del_io qom: object: move unparenting to the child property's release callback qom: object: delete properties before calling instance_finalize virtio-scsi: implement parse_cdb scsi-block, scsi-generic: implement parse_cdb scsi-block: extract scsi_block_is_passthrough scsi-bus: introduce parse_cdb in SCSIDeviceClass and SCSIBusInfo scsi-bus: prepare scsi_req_new for introduction of parse_cdb Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * memory: remove memory_region_destroyPaolo Bonzini2014-08-181-2/+0
| | | | | | | | | | | | | | The function is empty after the previous patch, so remove it. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | ahci: construct PIO Setup FIS for PIO commandsPaolo Bonzini2014-08-151-0/+70
| | | | | | | | | | | | | | | | | | | | PIO commands should put a PIO Setup FIS in the receive area when data transfer ends. Currently QEMU does not do this and only places the D2H FIS at the end of the operation. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ide: make all commands go through cmd_donePaolo Bonzini2014-08-151-13/+3
| | | | | | | | | | | | | | | | | | | | AHCI has code to fill in the D2H FIS trigger the IRQ all over the place. Centralize this in a single cmd_done callback by generalizing the existing async_cmd_done callback. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ahci: remove duplicate PORT_IRQ_* constantsPaolo Bonzini2014-08-151-3/+3
| | | | | | | | | | | | | | | | These are defined twice, just use one set consistently. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ide: fold add_status callback into set_inactivePaolo Bonzini2014-08-151-9/+0
| | | | | | | | | | | | | | | | It is now called only after the set_inactive callback. Put the two together. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ide: remove wrong setting of BM_STATUS_INTPaolo Bonzini2014-08-151-4/+0
| | | | | | | | | | | | | | | | | | | | | | Similar to the case removed in commit 69c38b8 (ide/core: Remove explicit setting of BM_STATUS_INT, 2011-05-19), the only remaining use of add_status(..., BM_STATUS_INT) is for short PRDs. The flag should not be raised in this case. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ide: simplify start_transfer callbacksPaolo Bonzini2014-08-151-3/+1
| | | | | | | | | | | | | | | | Drop the unused return value and make the callback optional. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ide: simplify async_cmd_done callbacksPaolo Bonzini2014-08-151-3/+1
| | | | | | | | | | | | | | | | Drop the unused return value. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ide: simplify set_inactive callbacksPaolo Bonzini2014-08-151-6/+0
| | | | | | | | | | | | | | | | Drop the unused return value and make the callback optional. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | ide: simplify reset callbacksPaolo Bonzini2014-08-151-6/+0
|/ | | | | | | | Drop the unused return value and make the callback optional. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: map memory via device's address space instead of address_space_memoryLe Tan2014-07-071-10/+11
| | | | | | | | | | | | In map_page() in hw/ide/ahci.c, replace cpu_physical_memory_map() and cpu_physical_memory_unmap() with dma_memory_map() and dma_memory_unmap(), because ahci devices should not access memory directly but via their address space. Add an AddressSpace parameter to map_page(). In order to call map_page(), we should pass the AHCIState.as as the AddressSpace argument. Signed-off-by: Le Tan <tamlokveer@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci.c: mask unused flags when reading size PRDT DBCReza Jelveh2014-07-071-3/+8
| | | | | | | | | | | | | | | | The data byte count(DBC) read from the description information is defined for bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion (I) flag. Completion interrupts are triggered after every transaction instead of on I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the DBC leads to a negative offset that causes sglist allocation to fail. Signed-off-by: Reza Jelveh <reza.jelveh@tuhh.de> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela2014-06-161-3/+3
| | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* ahci: fix buffer overrun on invalid state loadMichael S. Tsirkin2014-05-051-1/+1
| | | | | | | | | | | | | | | | CVE-2013-4526 Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded. So we use the old version of ports to read the array but then allow any value for ports. This can cause the code to overflow. There's no reason to migrate ports - it never changes. So just make sure it matches. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
* hw/ide/ahci.c: Avoid shift left into sign bitPeter Maydell2014-04-181-2/+2
| | | | | | | | Add U suffix to avoid shifting left into the sign bit, which is undefined behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* ahci: fix sysbus supportRob Herring2014-03-181-5/+8
| | | | | | | | | | | | | | | | | | | Non-PCI AHCI support is broken due to assertion failures when trying to convert AHCIState to a PCIDevice pointer as AHCIState can have different container structs. Fix this by using the non-asserting object cast and checking the returned pointer is not NULL. The AddressSpace pointer is also being initialized to NULL and causing dma_memory_map call to fail. Fix this by initializing to address_space_memory for sysbus instances. Also correct AHCI_VMSTATE to use the correct container SysbusAHCIState for sysbus instances. Signed-off-by: Rob Herring <rob.herring@linaro.org> Message-id: 1392073373-3295-1-git-send-email-robherring2@gmail.com [PMM: added linebreaks to fix overlong lines] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* ahci: fix win7 hang on bootAlexander Graf2013-10-291-1/+2
| | | | | | | | | | | | | | | | | | | | | When AHCI executes an asynchronous IDE command, it checked DRDY without checking either DRQ or BSY. This sometimes caused interrupt to be sent before command is actually completed. This resulted in a race condition: if guest then managed to access the device before command has completed, it would hang waiting for an interrupt. This was observed with windows 7 guests. To fix, check for DRQ or BSY in additiona to DRDY, if set, the command is asynchronous so delay the interrupt until asynchronous done callback is invoked. Reported-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ahci: set ahci mode on resetMichael S. Tsirkin2013-10-111-1/+9
| | | | | | | | ATM we set AHCI mode on 1st GHC write. Spec says we should set it on reset. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ide: Pass size to ide_bus_new()Andreas Färber2013-08-301-1/+1
| | | | | | | To be passed to qbus_create_inplace(). Reviewed-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* devices: Associate devices to their logical categoryMarcel Apfelbaum2013-07-291-0/+1
| | | | | | | | | The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* ahci: Use QOM realize for ahciHu Tao2013-07-231-7/+7
| | | | | | Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> [AF: Avoided repeated SYS_BUS_DEVICE() casts] Signed-off-by: Andreas Färber <afaerber@suse.de>
* ahci: QOM'ify some moreHu Tao2013-07-231-5/+11
| | | | | | | | Introduce type constant and avoid DO_UPCAST(). Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> [AF: Renamed parent field] Signed-off-by: Andreas Färber <afaerber@suse.de>
* ide/ich: QOM parent field cleanupAndreas Färber2013-07-231-5/+6
| | | | | | | | Replace direct uses of AHCIPCIState::card with QOM casts and rename it to parent_obj. Acked-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* ahci: Fix FLUSH commandKevin Wolf2013-07-151-1/+7
| | | | | | | | | | | | | | | | | AHCI couldn't cope with asynchronous commands that aren't doing DMA, it simply wouldn't complete them. Due to the bug fixed in commit f68ec837, FLUSH commands would seem to have completed immediately even if they were still running on the host. After the commit, they would simply hang and never unset the BSY bit, rendering AHCI unusable on any OS sending flushes. This patch adds another callback for the completion of asynchronous commands. This is what AHCI really wants to use for its command completion logic rather than an DMA completion callback. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
* hw/i*: pass owner to memory_region_init* functionsPaolo Bonzini2013-07-041-2/+4
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* memory: add owner argument to initialization functionsPaolo Bonzini2013-07-041-2/+2
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* dma: keep a device alive while it has SGListsPaolo Bonzini2013-07-041-1/+4
| | | | | Reviewed-by: Anthony Liguori <aliguori@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* dma: eliminate DMAContextPaolo Bonzini2013-06-201-9/+9
| | | | | | | | | The DMAContext is a simple pointer to an AddressSpace that is now always already available. Make everyone hold the address space directly, and clean up the DMA API to use the AddressSpace directly. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* ahci: Don't allow creating slave drivesKevin Wolf2013-05-081-1/+1
| | | | | | | | An IDE bus provided by AHCI can only take a single IDE drive. If you add a drive as slave, qemu used to accept the command line but the device wouldn't be actually usable. Catch the situation instead and error out. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* include: avoid useless includes of exec/ headersPaolo Bonzini2013-04-151-1/+0
| | | | | | | Headers in include/exec/ are for the deepest innards of QEMU, they should almost never be included directly. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw: move headers to include/Paolo Bonzini2013-04-081-1/+1
| | | | | | | | | Many of these should be cleaned up with proper qdev-/QOM-ification. Right now there are many catch-all headers in include/hw/ARCH depending on cpu.h, and this makes it necessary to compile these files per-target. However, fixing this does not belong in these patches. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* ahci: Add migration supportJason Baron2013-01-251-1/+81
| | | | | | | | | | Jason tested these patches by migrating Windows 7 and Fedora 17 guests (while under I/O) on both piix with ahci attached and on q35 (which has a built-in AHCI controller). Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Jason Baron <jbaron@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ahci: Change data types in preparation for migrationKevin Wolf2013-01-251-4/+4
| | | | | | | | The size of an int depends on the host, so in order to be able to migrate these fields, make them either int32_t or bool, depending on the use. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ahci: Remove unused AHCIDevice fieldsJason Baron2013-01-251-6/+2
| | | | | | | | | 'dma_status' and 'dma_cb' are written to, but never read. Remove these fields in preparation for AHCI migration bits. Signed-off-by: Jason Baron <jbaron@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>