summaryrefslogtreecommitdiffstats
path: root/hw/ide
Commit message (Collapse)AuthorAgeFilesLines
...
| * pci: Trivial device model conversions to realizeMarkus Armbruster2015-02-263-13/+8
| | | | | | | | | | | | | | | | | | | | | | Convert the device models where initialization obviously can't fail. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
* | Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' ↵Peter Maydell2015-03-021-3/+1
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging QOM infrastructure fixes and device conversions * Assertion fix for device_add with non-device types * Documentation fix * qdev_init() error reporting cleanups # gpg: Signature made Tue Feb 24 13:56:33 2015 GMT using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-devices-for-peter: parallel: parallel_hds_isa_init() shouldn't fail parallel: Factor out common parallel_hds_isa_init() serial: serial_hds_isa_init() shouldn't fail serial: Factor out common serial_hds_isa_init() etsec: Replace qdev_init() by qdev_init_nofail() leon3: Replace unchecked qdev_init() by qdev_init_nofail() ide/isa: Replace unchecked qdev_init() by qdev_init_nofail() qdev: Improve qdev_init_nofail()'s error reporting qom: Fix typo, 'my_class_init' -> 'derived_class_init' qdev: Avoid type assertion in qdev_build_hotpluggable_device_list() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ide/isa: Replace unchecked qdev_init() by qdev_init_nofail()Markus Armbruster2015-02-241-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | isa_ide_init()'s callers don't check for failure. isa_ide_init() looks like it could fail, but since isa_ide_realizefn() can't fail, it actually can't. Replace its qdev_init() by qdev_init_nofail() to make it obvious. Cc: Kevin Wolf <kwolf@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* | error: Use error_report_err() where appropriateMarkus Armbruster2015-02-181-2/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | Coccinelle semantic patch: @@ expression E; @@ - error_report("%s", error_get_pretty(E)); - error_free(E); + error_report_err(E); @@ expression E, S; @@ - error_report("%s", error_get_pretty(E)); + error_report_err(E); ( exit(S); | abort(); ) Trivial manual touch-ups in block/sheepdog.c. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
* atapi migration: Throw recoverable error to avoid recoveryDr. David Alan Gilbert2015-02-063-0/+30
| | | | | | | | | | | | | | | | | | | | | | | (With the previous atapi_dma flag recovery) If migration happens between the ATAPI command being written and the bmdma being started, the DMA is dropped. Eventually the guest times out and recovers, but that can take many seconds. (This is rare, on a pingpong reading the CD continuously I hit this about ~1/30-1/50 migrates) I don't think we've got enough state to be able to recover safely at this point, so I throw a 'medium error, no seek complete' that I'm assuming guests will try and recover from an apparently dirty CD. OK, it's a hack, the real solution is probably to push a lot of ATAPI state into the migration stream, but this is a fix that works with no stream changes. Tested only on Linux (both RHEL5 (pre-libata) and RHEL7). Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* Restore atapi_dma flag across migrationDr. David Alan Gilbert2015-02-061-0/+1
| | | | | | | | | | | | | If a migration happens just after the guest has kicked off an ATAPI command and kicked off DMA, we lose the atapi_dma flag, and the destination tries to complete the command as PIO rather than DMA. This upsets Linux; modern libata based kernels stumble and recover OK, older kernels end up passing bad data to userspace. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ide: Implement VPD response for ATAPIJohn Snow2015-01-132-12/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SCSI devices have multiple kinds of queries they need to respond to, as defined in the "cmd inquiry" section in MMC-6 and SPC-3. Relevent sections: MMC-6 revision 2g: Non-VPD response data and pointer to SPC-3; Section 6.8 "Inquiry Command" SPC-3 revision 23: Inquiry command and error handling: Section 6.4 "INQUIRY command" VPD data pages format: Section 7.6 "Vital product data parameters" We implement these Vital Product Data queries for SCSI, but not for ATAPI through IDE. The result is that if you are looking for the WWN identifier via tools such as sg3_utils, you will be unable to query our CD/DVD rom device to obtain it. This patch adds the minimum number of mandatory responses as defined by SPC-3, which include the "supported pages" response (page 0x00) and the "Device Identification" response (page 0x83). It also correctly responds when it receives a request for an illegal page to improve error output from related tools. The Device ID page contains an arbitrary list of identification strings of various formats; the ID strings included in this patch were chosen to mimic those provided by the libata driver when emulating this SCSI query (model, serial, and wwn when present.) Example: # libata emulated response [root@localhost ~]# sg_inq --id /dev/sda VPD INQUIRY: Device Identification page Designation descriptor number 1, descriptor length: 24 designator_type: vendor specific [0x0], code_set: ASCII associated with the addressed logical unit vendor specific: QM00001 Designation descriptor number 2, descriptor length: 72 designator_type: T10 vendor identification, code_set: ASCII associated with the addressed logical unit vendor id: ATA vendor specific: QEMU HARDDISK QM00001 # QEMU generated ATAPI response, with WWN [root@localhost ~]# sg_inq --id /dev/sr0 VPD INQUIRY: Device Identification page Designation descriptor number 1, descriptor length: 24 designator_type: vendor specific [0x0], code_set: ASCII associated with the addressed logical unit vendor specific: QM00005 Designation descriptor number 2, descriptor length: 72 designator_type: T10 vendor identification, code_set: ASCII associated with the addressed logical unit vendor id: ATA vendor specific: QEMU DVD-ROM QM00005 Designation descriptor number 3, descriptor length: 12 designator_type: NAA, code_set: Binary associated with the addressed logical unit NAA 5, IEEE Company_id: 0xc50 Vendor Specific Identifier: 0x15ea71bb [0x5000c50015ea71bb] See also: hw/scsi/scsi-disk.c, scsi_disk_emulate_inquiry() Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: Check validity of logical block sizeKevin Wolf2014-12-101-0/+5
| | | | | | | | | | | | | | | Our IDE emulation can't handle logical block sizes other than 512. Check for it. The original assumption was that other values would silently be ignored (which is bad enough), but it's not quite true: The physical block size is exposed in IDENTIFY DEVICE as a multiple of the logical block size. Setting a logical block size therefore also corrupts the physical block size (4096/4096 doesn't silently downgrade to 4096/512, but 512/512). Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com>
* ahci: replace SATA FIS type magic numbers with constantsStefan Hajnoczi2014-12-102-4/+7
| | | | | | | | | | SATA 3.0 "10.3.1 FIS Type values" defines the constants used to differentiate between FIS types. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1415874281-7371-3-git-send-email-stefanha@redhat.com Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ahci: avoid #ifdef DEBUG_AHCI bitrotStefan Hajnoczi2014-12-101-10/+8
| | | | | | | | | | | | | | | | | | | | | Debug code using #ifdef is susceptible to bitrot because the compiler never checks the debug code. This is easy to avoid, change the DPRINTF() macro to use if (DEBUG_AHCI) and always give it a 0 or 1 value. This also allows us to drop an #ifdef DEBUG_AHCI in ahci_start_dma() since the compiler can now see the local variable is used. The motivation for this change is a recent DEBUG_AHCI build failure due to an outdated DPRINTF() format string. From now on the compiler will catch these errors. Cc: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 1415874281-7371-2-git-send-email-stefanha@redhat.com Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* hw/ide/core.c: Prevent SIGSEGV during migrationDon Slutz2014-11-181-1/+1
| | | | | | | | | | | | The other callers to blk_set_enable_write_cache() in this file already check for s->blk == NULL. Signed-off-by: Don Slutz <dslutz@verizon.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1416259239-13281-1-git-send-email-dslutz@verizon.com Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* ahci: factor out FIS decomposition from handle_cmdJohn Snow2014-11-141-83/+86
| | | | | | | | | | | | | | | | | | In order to make handle_cmd more readable at the macro level, the details of how to decompose particular types of FIS packets are left to helper functions. In our case, the only type of FIS packet we currently expect to see is a Register H2D FIS packet, but the gory details of its decomposition are of no particular interest in handle_cmd. This patch keeps the receipt of FIS packets and the decomposition thereof separated to two different functions. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1415058979-16604-6-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Check cmd_fis[1] more explicitlyJohn Snow2014-11-141-11/+12
| | | | | | | | | | | Instead of checking for a known byte, inspect the fields of this byte explicitly to produce more meaningful error messages and improve the readability of this section. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1415058979-16604-5-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Reorder error cases in handle_cmdJohn Snow2014-11-141-15/+14
| | | | | | | | | | | | | | | | Error checking in ahci's handle_cmd is re-ordered so that we initialize as few things as possible before we've done our sanity checking. This simplifies returning from this call in case of an error. A check to make sure the DMA memory map succeeds with the correct size is also added, and the debug print of the command fis is cleaned up with its size corrected. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1415058979-16604-4-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Fix FIS decompositionJohn Snow2014-11-141-38/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces a few changes to how FIS packets are deciphered in the AHCI virtual device. The summary of changes can be grouped into two pieces: [A] Changes to how we apply a preliminary sieve to FISes, [B] Changes in how we internalize a decomposed FIS. == Changes to how we apply a preliminary sieve to FISes == (1) Packets may now either update the Control register or the Command register, but not both. This is according to the SATA 3.2 specification which states: "...the device either initiates processing of the command indicated in the Command register or initiates processing of the control request indicated [...] depending on the state of the C bit in the FIS." See SATA 3.2 section 10.5.5.4, "Reception" in the 10.5.5 "Register Host to Device FIS" section. This change accounts for the first two regions of change within the diff. All other changes belong to the following changes. == Changes in how we internalize a decomposed FIS == (2) Instead of trying to extract the sector number out of the FIS from bytes 4-10 and setting it with ide_set_sector, we set the appropriate IDEState registers and trust that ide_get_sector can retrieve the correct sector later. By "constructing" the sector for use with ide_set_sector, we are duplicating the mechanisms of ide_get_sector. This change makes the FIS decomposition more obvious. SATA 3.2 as a specification does not make the legacy register mapping with respect to the D2H FIS obvious. However, SATA 3.2 section 10.5.5.1 "Register Host to Device FIS layout" describes all of the "cmd_fis" bytes: 0 - FIS Type (0x27) 1 - Port Multiplier Port and Command Update flag 2 - ATA Command 3 - Features_Low 4 - LBA 7:0 5 - LBA 15:8 6 - LBA 23:16 7 - Device, AKA "Drive Select." 8 - LBA 31:24 9 - LBA 39:32 10 - LBA 47:40 11 - Features_High 12 - Count Low 13 - Count High 14 - ICC 15 - Control 16-19 - Auxiliary (for NCQ, defined per-command) Most of these registers map to existing IDEState registers in obvious ways, especially features, select, hob_features, and nsector (count). ICC is reserved in older specifications but is not supported in our implementation, and remains unused here. The Control register is not valid for a command that is trying to update the command register and is to be considered reserved at this point. What is not obvious is the LBA register mappings, but SATA 1.0 can help inform of us legacy device support, see SATA 1.0 section 8.5.2 "Register - Host to Device." LBA 7:0 - Sector Number (sector) LBA 15:8 - Cyl Low (lcyl) LBA 23:16 - Cyl High (hcyl) LBA 31:24 - Sector Num Exp. (hob_sector) LBA 39:32 - Cyl Low Exp. (hob_lcyl) LBA 47:40 - Cyl High Exp. (hob_hcyl) These mappings help guide which registers the FIS should be decomposed into/towards for CHS, LBA28 and LBA48 commands. As a note: The prior confusion that can be seen in the documentation arises from the fact that CHS and LBA28 commands use the low nybble of the drive select register to store LBA 27:24, whereas LNA48 commands use the hob_sector, hob_lcyl and hob_hcyl registers as explained above. The decomposition as it stands now will correctly decompose CHS, LBA28 and LBA48 commands into their appropriate registers where the core IDE/ATAPI layers can deal with them correctly. See the below point for more information. (3) We save cmd_fis[7] as ide_state->select, which informs decisions about if we are using LBA or CHS. This corrects a bug in AHCI wherein we attempt to set and/or retrieve the sector number by using ide_set_sector and ide_get_sector, which depend on the select register to determine if we are using LBA or CHS. Without this adjustment, LBA48 read/writes are currently broken. Thanks to Eniac Zheng @ HP for pointing this out. (4) Save cmd_fis[11] as ide_state->hob_feature, as defined in SATA 3.2. (5) For several ATA commands, the sector count register set to 0 is a magic number that means 256 sectors. For LBA48 commands, this means 65,536 sectors. We drop the magic sector correction here, and trust the ide core layer to handle the conversion appropriately, in ide_cmd_lba48_transform(). As it stands, the current AHCI code is only compliant with LBA28 commands. By simply removing the magic, it will work with LBA28 and LBA48. (6) We expand FIS decomposition to include both ATAPI and IDE devices. We leave the logic of determining if the fields are valid or not to the respective layers. This change intends to make it clearer that AHCI is only a composition mechanism for the FIS packets: the meanings of the registers is best left to the implementation layers for those devices. (7) Forcefully setting the feature, hcyl and lcyl registers for ATAPI commands is removed. - The hcyl and lcyl magic present here is valid at boot only, and should not be overridden for every PACKET command. - The feature register is defined as valid for the PACKET command, so we should not suppress it. The ATAPI layer does not even currently depend on or require 0x01 as mandatory. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1415058979-16604-3-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: add is_ncq predicate helperJohn Snow2014-11-142-4/+27
| | | | | | | | | | | | | | | | | | | | | A small helper to determine which S/ATA commands are destined to be routed to the NCQ pathways. This references SATA 3.2 section 13.6, Native Command Queueing. See sections 13.6.4, 13.6.5, 13.6.6, 13.6.7 and 13.6.8 for all SATA commands considered to be part of the NCQ feature set. This is summarized in a small list in section 13.6.3.1 and again in 13.6.3.2. Not all of these NCQ commands are currently supported, so the error pathways are adjusted slightly to be more informative in the case they are encountered. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1415058979-16604-2-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: Correct handling of malformed/short PRDTsJohn Snow2014-11-145-22/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This impacts both BMDMA and AHCI HBA interfaces for IDE. Currently, we confuse the difference between a PRDT having "0 bytes" and a PRDT having "0 complete sectors." When we receive an incomplete sector, inconsistent error checking leads to an infinite loop wherein the call succeeds, but it didn't give us enough bytes -- leading us to re-call the DMA chain over and over again. This leads to, in the BMDMA case, leaked memory for short PRDTs, and infinite loops and resource usage in the AHCI case. The .prepare_buf() callback is reworked to return the number of bytes that it successfully prepared. 0 is a valid, non-error answer that means the table was empty and described no bytes. -1 indicates an error. Our current implementation uses the io_buffer in IDEState to ultimately describe the size of a prepared scatter-gather list. Even though the AHCI PRDT/SGList can be as large as 256GiB, the AHCI command header limits transactions to just 4GiB. ATA8-ACS3, however, defines the largest transaction to be an LBA48 command that transfers 65,536 sectors. With a 512 byte sector size, this is just 32MiB. Since our current state structures use the int type to describe the size of the buffer, and this state is migrated as int32, we are limited to describing 2GiB buffer sizes unless we change the migration protocol. For this reason, this patch begins to unify the assertions in the IDE pathways that the scatter-gather list provided by either the AHCI PRDT or the PCI BMDMA PRDs can only describe, at a maximum, 2GiB. This should be resilient enough unless we need a sector size that exceeds 32KiB. Further, the likelihood of any guest operating system actually attempting to transfer this much data in a single operation is very slim. To this end, the IDEState variables have been updated to more explicitly clarify our maximum supported size. Callers to the prepare_buf callback have been reworked to understand the new return code, and all versions of the prepare_buf callback have been adjusted accordingly. Lastly, the ahci_populate_sglist helper, relied upon by the AHCI implementation of .prepare_buf() as well as the PCI implementation of the callback have had overflow assertions added to help make clear the reasonings behind the various type changes. [Added %d -> %"PRId64" fix John sent because off_pos changed from int to int64_t. --Stefan] Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1414785819-26209-4-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: unify sglist preparationJohn Snow2014-11-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The intent of this patch is to further unify the creation and deletion of the sglist used for all AHCI transfers, including emulated PIO, ATAPI R/W, and native DMA R/W. By replacing ahci_start_transfer's call to ahci_populate_sglist with ahci_dma_prepare_buf, we reduce the number of direct calls where we manipulate the scatter-gather list in the AHCI code. To make this switch, the constant "0" passed as an offset in ahci_dma_prepare_buf is adjusted to use io_buffer_offset. For DMA pathways, this has no effect: io_buffer_offset is always updated to 0 at the beginning of a DMA transfer loop regardless. DMA pathways through ide_dma_cb() update the io_buffer_offset accordingly, and for circumstances where we might make several trips through this loop, this may actually correct a design flaw. For PIO pathways, the newly updated ahci_dma_prepare_buf will now prepare the sglist at the correct offset. It will also set io_buffer_size, but this is not used in the cmd_read_pio or cmd_write_pio pathways. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1414785819-26209-3-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: repair PIO transfers for cases where nsector > 1John Snow2014-11-142-1/+5
| | | | | | | | | | | | | | | | | | Currently, for emulated PIO transfers through the AHCI device, any attempt made to request more than a single sector's worth of data will result in the same sector being transferred over and over. For example, if we request 8 sectors via PIO READ SECTORS, the AHCI device will give us the same sector eight times. This patch adds offset tracking into the PIO pathways so that we can fulfill these requests appropriately. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1414785819-26209-2-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Fix byte count regression for ATAPI/PIOJohn Snow2014-11-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch fixes a regression caused by commit 659142ecf71a0da240ab0ff7cf929ee25c32b9bc. The problem occurs when we wish to return early from the ahci_start_transfer function, but are now updating the transferred byte count in the AHCI command header via ahci_commit_buf. This will cause problems in the Windows 8 installer. Don't update the byte count in the command header for the transmission of ATAPI packets: These commands will distort the final byte count of the actual data payload. The call to ahci_commit_buf remains in the "out" portion of the call in order to clean up the sglist. The byte count is maintained by forcing size to be 0. Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Fix SDB FIS ConstructionJohn Snow2014-11-032-9/+17
| | | | | | | | | | | | | | | | | | | | | | The SDB FIS creation was mangled; We were writing the error byte to byte 0, and omitting the SDB FIS magic byte. Though the SDB packet layout states that: byte 0: Must be 0xA1 to indicate SDB FIS. byte 1: Port multiplier select & other flags byte 2: status byte. byte 3: error byte. This patch adds an SDB FIS structure with human-readable names, and ensures that we are filling the structure appropriately. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412204151-18117-7-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Update byte count after DMA completionJohn Snow2014-11-033-14/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, DMA read/write operations neglect to update the byte count after a successful transfer like ATAPI DMA read or PIO read/write operations do. We correct this oversight by adding another callback into the IDEDMAOps structure. The commit callback is called whenever we are cleaning up a scatter-gather list. AHCI can register this callback in order to update post- transfer information such as byte count updates. We use this callback in AHCI to consolidate where we delete the SGlist as generated from the PRDT, as well as update the byte count after the transfer is complete. The QEMUSGList structure has an init flag added to it in order to make qemu_sglist_destroy a nop if it is called when there is no sglist, which simplifies cleanup and error paths. This patch fixes several AHCI problems, notably Non-NCQ modes of operation for Windows 7 as well as Hibernate support for Windows 7. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412204151-18117-3-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: Correct PIO/D2H FIS responsesJohn Snow2014-11-031-23/+25
| | | | | | | | | | | | | | | | | | | | | | | | Currently, the D2H FIS packets AHCI generates simply parrot back the LBA that the guest sent to us in the cmd_fis. However, some commands (like READ NATIVE MAX) modify the LBA registers as a return value, through which the AHCI D2H FIS is the only response mechanism. Thus, the D2H response should use the current register values, not the initial ones. This patch adjusts the LBA and drive select register responses for PIO Setup and D2H FIS response packets. Additionally, the PIO and D2H FIS responses copy too many bytes from the command FIS that it is being generated from. Specifically, byte 11 which is the Features(15:8) field for Register Host to Device FIS packets, is instead reserved for the PIO Setup FIS and should always be 0. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412204151-18117-2-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fix off-by-one error in pci_piix3_xen_ide_unplugJames Harper2014-10-301-2/+2
| | | | | | | Fix off-by-one error when unplugging disks, which would otherwise leave the last ATA disk plugged, with obvious consequences. Also rewrite loop to be more readable. Signed-off-by: James Harper <james.harper@ejbdigital.com.au> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* hmp: Remove "info pcmcia"Markus Armbruster2014-10-241-1/+0
| | | | | | | | | | | | | | | | | | | | This command lists PCMCIA sockets and cards. Only a few ARM boards have sockets (akita, borzoi, connex, mainstone, spitz, terrier, tosa, verdex, z2), the only card is the DSCM-1xxxx Hitachi Microdrive (qdev "microdrive"), and it is only inserted during machine init, if ever. So this command doesn't really tell anybody anything new so far. Moreover, pcmcia_socket_unregister() has a use-after-free bug, flagged by Coverity. Has never been used, because there has never been code to eject a PCMCIA card. Not worth fixing & converting to QMP. Remove it. Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Luiz Capitulino <lcapitulino@redhat.com> Acked-by: Andreas Färber <afaerber@suse.de> Message-id: 1411144812-22958-1-git-send-email-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* blockdev: Fix blockdev-add not to create DriveInfoMarkus Armbruster2014-10-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | blockdev_init() always creates a DriveInfo, but only drive_new() fills it in. qmp_blockdev_add() leaves it blank. This results in a drive with type = IF_IDE, bus = 0, unit = 0. Screwed up in commit ee13ed1c. Board initialization code looking for IDE drive (0,0) can pick up one of these bogus drives. The QMP command has to execute really early to be visible. Not sure how likely that is in practice. Fix by creating DriveInfo in drive_new(). Block backends created by blockdev-add don't get one. Breaks the test for "has been created by qmp_blockdev_add()" in blockdev_mark_auto_del() and do_drive_del(), because it changes the value of dinfo && !dinfo->enable_auto_del from true to false. Simply test !dinfo instead. Leaves DriveInfo member enable_auto_del unused. Drop it. A few places assume a block backend always has a DriveInfo. Fix them up. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ide: Complete conversion from BlockDriverState to BlockBackendMarkus Armbruster2014-10-201-2/+4
| | | | | | | | | | Add a BlockBackend member to TrimAIOCB, so ide_issue_trim_cb() can use blk_aio_discard() instead of bdrv_aio_discard(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* hw: Convert from BlockDriverState to BlockBackend, mostlyMarkus Armbruster2014-10-2014-164/+173
| | | | | | | | | | | | | | | | | | | | | | | | | | | Device models should access their block backends only through the block-backend.h API. Convert them, and drop direct includes of inappropriate headers. Just four uses of BlockDriverState are left: * The Xen paravirtual block device backend (xen_disk.c) opens images itself when set up via xenbus, bypassing blockdev.c. I figure it should go through qmp_blockdev_add() instead. * Device model "usb-storage" prompts for keys. No other device model does, and this one probably shouldn't do it, either. * ide_issue_trim_cb() uses bdrv_aio_discard() instead of blk_aio_discard() because it fishes its backend out of a BlockAIOCB, which has only the BlockDriverState. * PC87312State has an unused BlockDriverState[] member. The next two commits take care of the latter two. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: Rename BlockDriverCompletionFunc to BlockCompletionFuncMarkus Armbruster2014-10-206-9/+9
| | | | | | | | | | I'll use it with block backends shortly, and the name is going to fit badly there. It's a block layer thing anyway, not just a block driver thing. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: Rename BlockDriverAIOCB* to BlockAIOCB*Markus Armbruster2014-10-203-8/+8
| | | | | | | | | | I'll use BlockDriverAIOCB with block backends shortly, and the name is going to fit badly there. It's a block layer thing anyway, not just a block driver thing. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: Eliminate DriveInfo member bdrv, use blk_by_legacy_dinfo()Markus Armbruster2014-10-202-3/+6
| | | | | | | | | | | | | | | | | | | | | | | The patch is big, but all it really does is replacing dinfo->bdrv by blk_bs(blk_by_legacy_dinfo(dinfo)) The replacement is repetitive, but the conversion of device models to BlockBackend is imminent, and will shorten it to just blk_legacy_dinfo(dinfo). Line wrapping muddies the waters a bit. I also omit tests whether dinfo->bdrv is null, because it never is. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoît Canet <benoit.canet@nodalink.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* blockdev: Eliminate drive_del()Markus Armbruster2014-10-201-1/+3
| | | | | | | | | drive_del() has become a trivial wrapper around blk_unref(). Get rid of it. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ide: add calling add_boot_device_patch in bootindex setter functionGonglei2014-10-151-0/+5
| | | | | | | | | | | | | | | | | On this way, we can assure the new bootindex take effect during vm rebooting. Meanwhile set the initial value of bootindex to -1. Because ide devcies's unit property maybe do not initialize when set_bootindex function is called, so that we don't know its suffix. So we have to save the call add_boot_device_path() on ide realize/init function. When we want to change bootindex during vm rebooting, we can call it in setter function. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ide: add bootindex to qom propertyGonglei2014-10-151-0/+42
| | | | | | | | | | | Add a qom property with the same name 'bootindex', when we remove it form qdev property, things will continue to work just fine, and we can use qom features which are not supported by qdev property. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* q35/ahci: Pick up -cdrom and -hda optionsJohn Snow2014-10-032-0/+17
| | | | | | | | | | | | This patch implements the backend for the Q35 board for us to be able to pick up and use drives defined by the -cdrom, -hda, or -drive if=ide shorthand options. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412187569-23452-7-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: Update ide_drive_get to be HBA agnosticJohn Snow2014-10-031-5/+17
| | | | | | | | | | | | | | | | | | | | | | | Instead of duplicating the logic for the if_ide (bus,unit) mappings, rely on the blockdev layer for managing those mappings for us, and use the drive_get_by_index call instead. This allows ide_drive_get to work for AHCI HBAs as well, and can be used in the Q35 initialization. Lastly, change the nature of the argument to ide_drive_get so that represents the number of total drives we can support, and not the total number of buses. This will prevent array overflows if the units-per-default-bus property ever needs to be adjusted for compatibility reasons. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1412187569-23452-5-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: properly shadow the TFD registerJohn Snow2014-09-221-14/+28
| | | | | | | | | | | | | | | | | | | | | | | | In a real AHCI device, several S/ATA registers are mirrored or shadowed within the AHCI register set. These registers are not updated synchronously for each read access, but are instead updated after a Device-to-Host Register FIS packet is received. The D2H FIS contains the values from these registers on the device. In QEMU, by reaching directly into the device to grab these bits before they are "sent," we may introduce race conditions where unexpected values are present "before they are sent" which could cause issues for some guests, particularly if an attempt is made to read the PxTFD register prior to enabling the port, where incorrect values will be read. This patch also addresses the boot-time values for the PxTFD and PxSIG registers to bring them in line with the AHCI 1.3 specification. Lastly, several fields (PxTFD, PxSIG and PxSACT) are read-only, and any attempts to write to them should be ignored. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1408643079-30675-6-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ahci: MSI capability should be at 0x80, not 0x50.John Snow2014-09-221-1/+6
| | | | | | | | | | | | | | | | In the Intel ICH9 data sheet, the MSI capability offset in the PCI configuration space for ICH9 AHCI devices is specified to be 0x80. Further, the PCI capability pointer should always point to 0x80 in ICH9 devices, despite the fact that AHCI 1.3 specifies that it should be pointing to PMCAP (Which in this instance would be 0x70) to maintain adherence to the Intel data sheet specifications and real observed behavior. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1408643079-30675-3-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* block: Rename qemu_aio_release -> qemu_aio_unrefFam Zheng2014-09-221-1/+1
| | | | | | Suggested-by: Benoît Canet <benoit.canet@irqsave.net> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: Convert trim_aiocb_info.cancel to .cancel_asyncFam Zheng2014-09-221-7/+5
| | | | | | | | | | | | We know that either bh is scheduled or ide_issue_trim_cb will be called again, so we just set i, j and ret to the right values. In both cases, ide_trim_bh_cb will be called. Also forward the cancellation to the iocb->aiocb which we get from bdrv_aio_discard. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide/ahci: Check for -ECANCELED in aio callbacksFam Zheng2014-09-222-0/+15
| | | | | | | | | | | | | | | | | | Before, bdrv_aio_cancel will either complete the request (like normal) and call CB with an actual return code, or skip calling the request (for example when the IO req is not submitted by thread pool yet). We will change bdrv_aio_cancel to do it differently: always call CB before return, with either [1] a normal req completion ret code, or [2] ret == -ECANCELED. So the callers' callback must accept both cases. The existing logic works with case [1], but not [2]. The simplest transition of callback code is do nothing in case [2], just as if the CB is not called by the bdrv_aio_cancel() call. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide/atapi: Mark non-data commands as completeJohn Snow2014-09-221-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the command completion code in IDE and AHCI was unified to put all command completion inside of a callback, "cmd_done," we neglected to ensure that all AHCI/ATAPI command paths would eventually register as finished. for the PCI interface to IDE this is not a problem because cmd_done is a nop, but the AHCI implementation needs to send a D2H_REG_FIS and interrupt back to the guest to inform of completion. This patch adds calls to ide_stop_transfer, which calls ide_cmd_done, inside of ide_atapi_cmd_ok and ide_atapi_cmd_error. This fixes regressions observed by trying to boot QEMU with a Fedora 20 live CD under Q35/AHCI, which uses ATAPI command 0x00, which is a status check that may cause a hang because we never complete, and ATAPI command 0x56, which is unsupported by our current implementation and results in an error that we never report back to the guest. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* block: Make the block accounting functions operate on BlockAcctStatsBenoît Canet2014-09-104-27/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the next step for decoupling block accounting functions from BlockDriverState. In a future commit the BlockAcctStats structure will be moved from BlockDriverState to the device models structures. Note that bdrv_get_stats was introduced so device models can retrieve the BlockAcctStats structure of a BlockDriverState without being aware of it's layout. This function should go away when BlockAcctStats will be embedded in the device models structures. CC: Kevin Wolf <kwolf@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Keith Busch <keith.busch@intel.com> CC: Anthony Liguori <aliguori@amazon.com> CC: "Michael S. Tsirkin" <mst@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> CC: Eric Blake <eblake@redhat.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Michael Tokarev <mjt@tls.msk.ru> CC: John Snow <jsnow@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Alexander Graf <agraf@suse.de> CC: Max Reitz <mreitz@redhat.com> Signed-off-by: Benoît Canet <benoit.canet@nodalink.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* block: rename BlockAcctType members to start with BLOCK_ instead of BDRV_Benoît Canet2014-09-104-15/+15
| | | | | | | | | | | | | | | | | | | | The middle term goal is to move the BlockAcctStats structure in the device models. (Capturing I/O accounting statistics in the device models is good for billing) This patch make a small step in this direction by removing a reference to BDRV. CC: Kevin Wolf <kwolf@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Keith Busch <keith.busch@intel.com> CC: Anthony Liguori <aliguori@amazon.com> CC: "Michael S. Tsirkin" <mst@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> CC: John Snow <jsnow@redhat.com> CC: Richard Henderson <rth@twiddle.net> CC: Markus Armbruster <armbru@redhat.com> CC: Alexander Graf <agraf@suse.de>i Signed-off-by: Benoît Canet <benoit.canet@nodalink.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* IDE: MMIO IDE device control should be little endianValentin Manea2014-09-101-2/+2
| | | | | | | | | | Set the IDE MMIO memory type to little endian. The ATA specs identify words part of the control commands encoded as little endian. While this has no impact on little endian systems, it's required for big endian systems(eg OpenRisc). Signed-off-by: Valentin Manea <valentin.manea@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* xen: Drop redundant bdrv_close() from pci_piix3_xen_ide_unplug()Markus Armbruster2014-09-101-1/+0
| | | | | | | drive_del() closes just fine. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* ide: Add resize callback to ide/coreJohn Snow2014-09-081-10/+59
| | | | | | | | | | | | | | | | | | Currently, if the block device backing the IDE drive is resized, the information about the device as cached inside of the IDEState structure is not updated, thus when a guest OS re-queries the drive, it is unable to see the expanded size. This patch adds a resize callback that updates the IDENTIFY data buffer in order to correct this. Lastly, a Linux guest as-is cannot resize a libata drive while in-use, but it can see the expanded size as part of a bus rescan event. This patch also allows guests such as Linux to see the new drive size after a soft reboot event, without having to exit the QEMU process. Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* IDE: Fill the IDENTIFY request consistentlyJohn Snow2014-09-081-13/+15
| | | | | | | | | | | | | IDE-HD, IDE-ATAPI and IDE-CFATA all fill the identify buffer in slightly different ways, this is a relatively minor patch to make them uniform, to emphasize that: (1) We build the s->identify_data cache first, then (2) We copy it to s->io_buffer to fulfill the request. Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: Add wwn support to IDE-ATAPI driveJohn Snow2014-09-081-0/+14
| | | | | | | | | | | | | | | Although it is possible to specify the wwn property for cdrom devices on the command line, the underlying driver fails to relay this information to the guest operating system via IDENTIFY. This is a simple patch to correct that. See ATA8-ACS, Table 22 parts 5, 6, and 9. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* ide: Fix bootindex for bus_id > 9Markus Armbruster2014-08-291-1/+1
| | | | | | | | | | | | | | | | | | | We identify devices by their Open Firmware device paths. The encoding of bus numbers is incorrect: idebus_get_fw_dev_path() formats them in decimal, while SeaBIOS uses hexadecimal. With bus number > 9, SeaBIOS will miss the bootindex (lucky case), or apply it to another device (unlucky case). Bug can't bite right now: ich9-ahci has six ports, and the sysbus-ahci created by Calxeda Highbank has just one. Fix it anyway, by changing %d to %x. I couldn't find an Open Firmware spec covering this. For what it's worth, OVMF agrees with SeaBIOS. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
OpenPOWER on IntegriCloud