Skip to content
Snippets Groups Projects
Select Git revision
  • feature/libtcg-rebase default protected
1 result
Search by author
  • Any Author
  • Anton Anton anjo
1 author
  1. Oct 02, 2020
  3. Oct 01, 2020
    • Peter Maydell's avatar
      Merge remote-tracking branch 'remotes/jsnow-gitlab/tags/ide-pull-request' into staging · b5ce42f5
      Peter Maydell authored 
      
Pull request

# gpg: Signature made Thu 01 Oct 2020 18:41:05 BST
# gpg:                using RSA key F9B7ABDBBCACDF95BE76CBD07DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>" [full]
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jsnow-gitlab/tags/ide-pull-request:
  ide: cancel pending callbacks on SRST
  ide: clear interrupt on command write
  ide: remove magic constants from the device register
  ide: reorder set/get sector functions
  ide: model HOB correctly
  ide: don't tamper with the device register
  ide: rename cmd_write to ctrl_write
  hw/ide/ahci: Do not dma_memory_unmap(NULL)
  MAINTAINERS: Update my git address

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      b5ce42f5
    • John Snow's avatar
      ide: cancel pending callbacks on SRST · 55adb3c4
      John Snow authored 
      
The SRST implementation did not keep up with the rest of IDE; it is
possible to perform a weak reset on an IDE device to remove the BSY/DRQ
bits, and then issue writes to the control/device registers which can
cause chaos with the state machine.

Fix that by actually performing a real reset.

Reported-by: default avatarAlexander Bulekov <alxndr@bu.edu>
Fixes: https://bugs.launchpad.net/qemu/+bug/1878253
Fixes: https://bugs.launchpad.net/qemu/+bug/1887303
Fixes: https://bugs.launchpad.net/qemu/+bug/1887309


Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
      55adb3c4
    • John Snow's avatar
      ide: clear interrupt on command write · 6f52e69f
      John Snow authored 
      
Not known to fix any bug, but I couldn't help but notice that ATA
specifies that writing to this register should clear an interrupt.

ATA7: Section 5.3.3 (Command register - Effect)
ATA6: Section 7.4.4 (Command register - Effect)
ATA5: Section 7.4.4 (Command register - Effect)
ATA4: Section 7.4.4 (Command register - Effect)
ATA3: Section 5.2.2 (Command register)

Other editions: try searching for the phrase "Writing this register".

Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
      6f52e69f
    • John Snow's avatar
      ide: remove magic constants from the device register · 0c7515e1
      John Snow authored 
      
(In QEMU, we call this the "select" register.)

My memory isn't good enough to memorize what these magic runes
do. Label them to prevent mixups from happening in the future.

Side note: I assume it's safe to always set 0xA0 even though ATA2 claims
these bits are reserved, because ATA3 immediately reinstated that these
bits should be always on. ATA4 and subsequent specs only claim that the
fields are obsolete, so I assume it's safe to leave these set and that
it should work with the widest array of guests.

Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
      0c7515e1
    • John Snow's avatar
      ide: reorder set/get sector functions · 14ee9b53
      John Snow authored 
      
Reorder these just a pinch to make them more obvious at a glance what
the addressing mode is.

Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
      14ee9b53
    • John Snow's avatar
      ide: model HOB correctly · be8c9423
      John Snow authored 
      
I have been staring at this FIXME for years and I never knew what it
meant. I finally stumbled across it!

When writing to the command registers, the old value is shifted into a
HOB copy of the register and the new value is written into the primary
register. When reading registers, the value retrieved is dependent on
the HOB bit in the CONTROL register.

By setting bit 7 (0x80) in CONTROL, any register read will, if it has
one, yield the HOB value for that register instead.

Our code has a problem: We were using bit 7 of the DEVICE register to
model this. We use bus->cmd roughly as the control register already, as
it stores the value from ide_ctrl_write.

Lastly, all command register writes reset the HOB, so fix that, too.

Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
      be8c9423
    • John Snow's avatar
      ide: don't tamper with the device register · f14bc040
      John Snow authored 
      
In real ISA operation, register writes go out to an entire bus channel
and all listening devices receive the write. The devices do not toggle
the DEV bit based on their own configuration, nor does the HBA
intermediate or tamper with that value.

The reality of the matter is that DEV0/DEV1 accordingly will react to
command register writes based on whether or not the device was selected.

This does not fix a known bug, but it makes the code slightly simpler
and more obvious.

Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
      f14bc040
    • John Snow's avatar
      ide: rename cmd_write to ctrl_write · 98d98912
      John Snow authored 
      
It's the Control register, part of the Control block -- Command is
misleading here. Rename all related functions and constants.

Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
      98d98912
    • Philippe Mathieu-Daudé's avatar
      hw/ide/ahci: Do not dma_memory_unmap(NULL) · 1d1c4bdb
      Philippe Mathieu-Daudé authored 
      
libFuzzer triggered the following assertion:

  cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
    -nographic -monitor none -serial none -qtest stdio
  outl 0xcf8 0x8000fa24
  outl 0xcfc 0xe1068000
  outl 0xcf8 0x8000fa04
  outw 0xcfc 0x7
  outl 0xcf8 0x8000fb20
  write 0xe1068304 0x1 0x21
  write 0xe1068318 0x1 0x21
  write 0xe1068384 0x1 0x21
  write 0xe1068398 0x2 0x21
  EOF
  qemu-system-i386: exec.c:3621: address_space_unmap: Assertion `mr != NULL' failed.
  Aborted (core dumped)

This is because we don't check the return value from dma_memory_map()
which can return NULL, then we call dma_memory_unmap(NULL) which is
illegal. Fix by only unmap if the value is not NULL (and the size is
not the expected one).

Cc: qemu-stable@nongnu.org
Reported-by: default avatarAlexander Bulekov <alxndr@bu.edu>
Signed-off-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200718072854.7001-1-f4bug@amsat.org
Fixes: f6ad2e32 ("ahci: add ahci emulation")
BugLink: https://bugs.launchpad.net/qemu/+bug/1884693


Signed-off-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: default avatarJohn Snow <jsnow@redhat.com>
Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
      1d1c4bdb
    • John Snow's avatar
      MAINTAINERS: Update my git address · 77582e2c
      John Snow authored 
      
I am switching from github to gitlab.

Signed-off-by: default avatarJohn Snow <jsnow@redhat.com>
      77582e2c
    • Peter Maydell's avatar
      Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20201001' into staging · 625581c2
      Peter Maydell authored 
      
target-arm queue:
 * Make isar_feature_aa32_fp16_arith() handle M-profile
 * Fix SVE splice
 * Fix SVE LDR/STR
 * Remove ignore_memory_transaction_failures on the raspi2
 * raspi: Various cleanup/refactoring

# gpg: Signature made Thu 01 Oct 2020 15:46:47 BST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20201001:
  hw/arm/raspi: Remove use of the 'version' value in the board code
  hw/arm/raspi: Use RaspiProcessorId to set the firmware load address
  hw/arm/raspi: Introduce RaspiProcessorId enum
  hw/arm/raspi: Use more specific machine names
  hw/arm/raspi: Avoid using TypeInfo::class_data pointer
  hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState
  hw/arm/raspi: Load the firmware on the first core
  hw/arm/raspi: Display the board revision in the machine description
  hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
  hw/arm/bcm2835: Add more unimplemented peripherals
  hw/arm/raspi: Define various blocks base addresses
  target/arm: Fix SVE splice
  target/arm: Fix sve ldr/str
  target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile
  target/arm: Add ID register values for Cortex-M0
  hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs
  target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters
  target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      625581c2
    • Philippe Mathieu-Daudé's avatar
      hw/arm/raspi: Remove use of the 'version' value in the board code · cdfaa57d
      Philippe Mathieu-Daudé authored 
      
We expected the 'version' ID to match the board processor ID,
but this is not always true (for example boards with revision
id 0xa02042/0xa22042 are Raspberry Pi 2 with a BCM2837 SoC).
This was not important because we were not modelling them, but
since the recent refactor now allow to model these boards, it
is safer to check the processor id directly. Remove the version
check.

Suggested-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: default avatarLuc Michel <luc.michel@greensocs.com>
Signed-off-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-9-f4bug@amsat.org
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      cdfaa57d