2009-08-20 17:22:21 +04:00
|
|
|
/*
|
|
|
|
* QEMU IDE Emulation: MacIO support.
|
|
|
|
*
|
|
|
|
* Copyright (c) 2003 Fabrice Bellard
|
|
|
|
* Copyright (c) 2006 Openedhand Ltd.
|
|
|
|
*
|
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
|
|
* in the Software without restriction, including without limitation the rights
|
|
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
|
|
* furnished to do so, subject to the following conditions:
|
|
|
|
*
|
|
|
|
* The above copyright notice and this permission notice shall be included in
|
|
|
|
* all copies or substantial portions of the Software.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
|
|
* THE SOFTWARE.
|
|
|
|
*/
|
2019-05-23 17:35:07 +03:00
|
|
|
|
2016-01-26 21:17:09 +03:00
|
|
|
#include "qemu/osdep.h"
|
2013-01-24 03:03:54 +04:00
|
|
|
#include "hw/ppc/mac.h"
|
2013-02-05 20:06:20 +04:00
|
|
|
#include "hw/ppc/mac_dbdma.h"
|
2019-08-12 08:23:51 +03:00
|
|
|
#include "hw/qdev-properties.h"
|
2019-08-12 08:23:45 +03:00
|
|
|
#include "migration/vmstate.h"
|
2019-05-23 17:35:07 +03:00
|
|
|
#include "qemu/module.h"
|
2018-08-29 19:59:05 +03:00
|
|
|
#include "hw/misc/macio/macio.h"
|
2014-10-07 15:59:18 +04:00
|
|
|
#include "sysemu/block-backend.h"
|
2012-12-17 21:20:04 +04:00
|
|
|
#include "sysemu/dma.h"
|
2009-08-20 17:22:26 +04:00
|
|
|
|
2016-06-22 20:11:19 +03:00
|
|
|
#include "hw/ide/internal.h"
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2013-06-30 03:23:45 +04:00
|
|
|
/* debug MACIO */
|
|
|
|
// #define DEBUG_MACIO
|
|
|
|
|
|
|
|
#ifdef DEBUG_MACIO
|
|
|
|
static const int debug_macio = 1;
|
|
|
|
#else
|
|
|
|
static const int debug_macio = 0;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#define MACIO_DPRINTF(fmt, ...) do { \
|
|
|
|
if (debug_macio) { \
|
|
|
|
printf(fmt , ## __VA_ARGS__); \
|
|
|
|
} \
|
|
|
|
} while (0)
|
|
|
|
|
|
|
|
|
2009-08-20 17:22:21 +04:00
|
|
|
/***********************************************************/
|
|
|
|
/* MacIO based PowerPC IDE */
|
|
|
|
|
2010-03-29 23:23:57 +04:00
|
|
|
#define MACIO_PAGE_SIZE 4096
|
|
|
|
|
2015-05-22 21:13:44 +03:00
|
|
|
static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
|
|
|
|
{
|
|
|
|
DBDMA_io *io = opaque;
|
|
|
|
MACIOIDEState *m = io->opaque;
|
|
|
|
IDEState *s = idebus_active_if(&m->bus);
|
2015-06-05 00:59:34 +03:00
|
|
|
int64_t offset;
|
2015-05-22 21:13:44 +03:00
|
|
|
|
2015-06-05 00:59:36 +03:00
|
|
|
MACIO_DPRINTF("pmac_ide_atapi_transfer_cb\n");
|
2015-05-22 21:13:44 +03:00
|
|
|
|
|
|
|
if (ret < 0) {
|
2015-06-05 00:59:36 +03:00
|
|
|
MACIO_DPRINTF("DMA error: %d\n", ret);
|
2016-10-27 23:29:13 +03:00
|
|
|
qemu_sglist_destroy(&s->sg);
|
2015-05-22 21:13:44 +03:00
|
|
|
ide_atapi_io_error(s, ret);
|
|
|
|
goto done;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!m->dma_active) {
|
|
|
|
MACIO_DPRINTF("waiting for data (%#x - %#x - %x)\n",
|
|
|
|
s->nsector, io->len, s->status);
|
|
|
|
/* data not ready yet, wait for the channel to get restarted */
|
|
|
|
io->processing = false;
|
2013-06-28 15:30:01 +04:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2015-05-22 21:13:44 +03:00
|
|
|
if (s->io_buffer_size <= 0) {
|
2015-06-05 00:59:36 +03:00
|
|
|
MACIO_DPRINTF("End of IDE transfer\n");
|
2016-10-27 23:29:13 +03:00
|
|
|
qemu_sglist_destroy(&s->sg);
|
2009-08-20 17:22:21 +04:00
|
|
|
ide_atapi_cmd_ok(s);
|
2013-06-30 04:54:35 +04:00
|
|
|
m->dma_active = false;
|
2015-05-22 21:13:44 +03:00
|
|
|
goto done;
|
2013-06-30 03:23:45 +04:00
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
|
|
|
|
if (io->len == 0) {
|
2015-05-22 21:13:44 +03:00
|
|
|
MACIO_DPRINTF("End of DMA transfer\n");
|
2011-08-25 10:26:01 +04:00
|
|
|
goto done;
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
2015-05-22 21:13:44 +03:00
|
|
|
if (s->lba == -1) {
|
|
|
|
/* Non-block ATAPI transfer - just copy to RAM */
|
|
|
|
s->io_buffer_size = MIN(s->io_buffer_size, io->len);
|
2016-06-06 01:36:42 +03:00
|
|
|
dma_memory_write(&address_space_memory, io->addr, s->io_buffer,
|
|
|
|
s->io_buffer_size);
|
2016-08-05 10:30:02 +03:00
|
|
|
io->len = 0;
|
2015-05-22 21:13:44 +03:00
|
|
|
ide_atapi_cmd_ok(s);
|
|
|
|
m->dma_active = false;
|
|
|
|
goto done;
|
2013-06-28 15:30:01 +04:00
|
|
|
}
|
|
|
|
|
2015-06-05 00:59:34 +03:00
|
|
|
/* Calculate current offset */
|
2016-01-11 22:10:42 +03:00
|
|
|
offset = ((int64_t)s->lba << 11) + s->io_buffer_index;
|
2015-06-05 00:59:34 +03:00
|
|
|
|
2016-10-27 23:29:13 +03:00
|
|
|
qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
|
|
|
|
&address_space_memory);
|
|
|
|
qemu_sglist_add(&s->sg, io->addr, io->len);
|
|
|
|
s->io_buffer_size -= io->len;
|
|
|
|
s->io_buffer_index += io->len;
|
|
|
|
io->len = 0;
|
|
|
|
|
|
|
|
s->bus->dma->aiocb = dma_blk_read(s->blk, &s->sg, offset, 0x1,
|
|
|
|
pmac_ide_atapi_transfer_cb, io);
|
2011-08-25 10:26:01 +04:00
|
|
|
return;
|
|
|
|
|
|
|
|
done:
|
2016-06-10 21:26:37 +03:00
|
|
|
dma_memory_unmap(&address_space_memory, io->dma_mem, io->dma_len,
|
|
|
|
io->dir, io->dma_len);
|
|
|
|
|
2015-10-28 18:33:16 +03:00
|
|
|
if (ret < 0) {
|
|
|
|
block_acct_failed(blk_get_stats(s->blk), &s->acct);
|
|
|
|
} else {
|
|
|
|
block_acct_done(blk_get_stats(s->blk), &s->acct);
|
|
|
|
}
|
2016-01-30 15:36:52 +03:00
|
|
|
|
|
|
|
ide_set_inactive(s, false);
|
2011-08-25 10:26:01 +04:00
|
|
|
io->dma_end(opaque);
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void pmac_ide_transfer_cb(void *opaque, int ret)
|
|
|
|
{
|
|
|
|
DBDMA_io *io = opaque;
|
|
|
|
MACIOIDEState *m = io->opaque;
|
|
|
|
IDEState *s = idebus_active_if(&m->bus);
|
2015-06-05 00:59:34 +03:00
|
|
|
int64_t offset;
|
2015-05-22 21:13:44 +03:00
|
|
|
|
|
|
|
MACIO_DPRINTF("pmac_ide_transfer_cb\n");
|
2009-08-20 17:22:21 +04:00
|
|
|
|
|
|
|
if (ret < 0) {
|
2015-06-05 00:59:36 +03:00
|
|
|
MACIO_DPRINTF("DMA error: %d\n", ret);
|
2016-10-27 23:29:13 +03:00
|
|
|
qemu_sglist_destroy(&s->sg);
|
2013-06-30 03:43:17 +04:00
|
|
|
ide_dma_error(s);
|
2011-08-25 10:26:01 +04:00
|
|
|
goto done;
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
2013-06-30 04:54:35 +04:00
|
|
|
if (!m->dma_active) {
|
|
|
|
MACIO_DPRINTF("waiting for data (%#x - %#x - %x)\n",
|
|
|
|
s->nsector, io->len, s->status);
|
|
|
|
/* data not ready yet, wait for the channel to get restarted */
|
|
|
|
io->processing = false;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2015-05-22 21:13:44 +03:00
|
|
|
if (s->io_buffer_size <= 0) {
|
2015-06-05 00:59:36 +03:00
|
|
|
MACIO_DPRINTF("End of IDE transfer\n");
|
2016-10-27 23:29:13 +03:00
|
|
|
qemu_sglist_destroy(&s->sg);
|
2009-08-20 17:22:21 +04:00
|
|
|
s->status = READY_STAT | SEEK_STAT;
|
2009-08-28 18:37:42 +04:00
|
|
|
ide_set_irq(s->bus);
|
2013-06-30 04:54:35 +04:00
|
|
|
m->dma_active = false;
|
2015-05-22 21:13:44 +03:00
|
|
|
goto done;
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
if (io->len == 0) {
|
2015-05-22 21:13:44 +03:00
|
|
|
MACIO_DPRINTF("End of DMA transfer\n");
|
2011-08-25 10:26:01 +04:00
|
|
|
goto done;
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
2015-05-22 21:13:44 +03:00
|
|
|
/* Calculate number of sectors */
|
2015-06-05 00:59:34 +03:00
|
|
|
offset = (ide_get_sector(s) << 9) + s->io_buffer_index;
|
2013-06-30 03:23:45 +04:00
|
|
|
|
2016-10-27 23:29:13 +03:00
|
|
|
qemu_sglist_init(&s->sg, DEVICE(m), io->len / MACIO_PAGE_SIZE + 1,
|
|
|
|
&address_space_memory);
|
|
|
|
qemu_sglist_add(&s->sg, io->addr, io->len);
|
|
|
|
s->io_buffer_size -= io->len;
|
|
|
|
s->io_buffer_index += io->len;
|
|
|
|
io->len = 0;
|
|
|
|
|
2011-05-19 12:58:09 +04:00
|
|
|
switch (s->dma_cmd) {
|
|
|
|
case IDE_DMA_READ:
|
2016-10-27 23:29:13 +03:00
|
|
|
s->bus->dma->aiocb = dma_blk_read(s->blk, &s->sg, offset, 0x1,
|
|
|
|
pmac_ide_atapi_transfer_cb, io);
|
2011-05-19 12:58:09 +04:00
|
|
|
break;
|
|
|
|
case IDE_DMA_WRITE:
|
2016-10-27 23:29:13 +03:00
|
|
|
s->bus->dma->aiocb = dma_blk_write(s->blk, &s->sg, offset, 0x1,
|
|
|
|
pmac_ide_transfer_cb, io);
|
2011-05-19 12:58:09 +04:00
|
|
|
break;
|
2011-05-19 12:58:19 +04:00
|
|
|
case IDE_DMA_TRIM:
|
2016-10-27 23:29:13 +03:00
|
|
|
s->bus->dma->aiocb = dma_blk_io(blk_get_aio_context(s->blk), &s->sg,
|
2018-03-27 07:38:00 +03:00
|
|
|
offset, 0x1, ide_issue_trim, s,
|
2016-10-27 23:29:13 +03:00
|
|
|
pmac_ide_transfer_cb, io,
|
|
|
|
DMA_DIRECTION_TO_DEVICE);
|
2011-05-19 12:58:19 +04:00
|
|
|
break;
|
2016-04-13 01:48:15 +03:00
|
|
|
default:
|
|
|
|
abort();
|
2011-05-19 12:58:09 +04:00
|
|
|
}
|
2014-05-26 12:27:58 +04:00
|
|
|
|
2011-08-25 10:26:01 +04:00
|
|
|
return;
|
2011-11-14 20:50:53 +04:00
|
|
|
|
2011-08-25 10:26:01 +04:00
|
|
|
done:
|
2016-06-10 21:26:37 +03:00
|
|
|
dma_memory_unmap(&address_space_memory, io->dma_mem, io->dma_len,
|
|
|
|
io->dir, io->dma_len);
|
|
|
|
|
2011-08-25 10:26:01 +04:00
|
|
|
if (s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) {
|
2015-10-28 18:33:16 +03:00
|
|
|
if (ret < 0) {
|
|
|
|
block_acct_failed(blk_get_stats(s->blk), &s->acct);
|
|
|
|
} else {
|
|
|
|
block_acct_done(blk_get_stats(s->blk), &s->acct);
|
|
|
|
}
|
2011-08-25 10:26:01 +04:00
|
|
|
}
|
2016-01-30 15:36:52 +03:00
|
|
|
|
|
|
|
ide_set_inactive(s, false);
|
2015-05-22 21:13:44 +03:00
|
|
|
io->dma_end(opaque);
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
static void pmac_ide_transfer(DBDMA_io *io)
|
|
|
|
{
|
|
|
|
MACIOIDEState *m = io->opaque;
|
|
|
|
IDEState *s = idebus_active_if(&m->bus);
|
|
|
|
|
2013-06-30 03:23:45 +04:00
|
|
|
MACIO_DPRINTF("\n");
|
|
|
|
|
2010-05-28 15:32:45 +04:00
|
|
|
if (s->drive_kind == IDE_CD) {
|
2014-10-07 15:59:18 +04:00
|
|
|
block_acct_start(blk_get_stats(s->blk), &s->acct, io->len,
|
2014-09-05 17:46:18 +04:00
|
|
|
BLOCK_ACCT_READ);
|
2015-05-22 21:13:44 +03:00
|
|
|
|
2009-08-20 17:22:21 +04:00
|
|
|
pmac_ide_atapi_transfer_cb(io, 0);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2011-08-25 10:26:01 +04:00
|
|
|
switch (s->dma_cmd) {
|
|
|
|
case IDE_DMA_READ:
|
2014-10-07 15:59:18 +04:00
|
|
|
block_acct_start(blk_get_stats(s->blk), &s->acct, io->len,
|
2014-09-05 17:46:18 +04:00
|
|
|
BLOCK_ACCT_READ);
|
2011-08-25 10:26:01 +04:00
|
|
|
break;
|
|
|
|
case IDE_DMA_WRITE:
|
2014-10-07 15:59:18 +04:00
|
|
|
block_acct_start(blk_get_stats(s->blk), &s->acct, io->len,
|
2014-09-05 17:46:18 +04:00
|
|
|
BLOCK_ACCT_WRITE);
|
2011-08-25 10:26:01 +04:00
|
|
|
break;
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2009-08-20 17:22:21 +04:00
|
|
|
pmac_ide_transfer_cb(io, 0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void pmac_ide_flush(DBDMA_io *io)
|
|
|
|
{
|
|
|
|
MACIOIDEState *m = io->opaque;
|
2016-01-30 15:36:52 +03:00
|
|
|
IDEState *s = idebus_active_if(&m->bus);
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2016-01-30 15:36:52 +03:00
|
|
|
if (s->bus->dma->aiocb) {
|
2016-06-27 21:28:31 +03:00
|
|
|
blk_drain(s->blk);
|
2011-11-30 16:23:43 +04:00
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
/* PowerMac IDE memory IO */
|
2017-09-20 09:20:01 +03:00
|
|
|
static uint64_t pmac_ide_read(void *opaque, hwaddr addr, unsigned size)
|
2009-08-20 17:22:21 +04:00
|
|
|
{
|
|
|
|
MACIOIDEState *d = opaque;
|
2017-09-20 09:20:01 +03:00
|
|
|
uint64_t retval = 0xffffffff;
|
|
|
|
int reg = addr >> 4;
|
|
|
|
|
|
|
|
switch (reg) {
|
|
|
|
case 0x0:
|
|
|
|
if (size == 2) {
|
|
|
|
retval = ide_data_readw(&d->bus, 0);
|
|
|
|
} else if (size == 4) {
|
|
|
|
retval = ide_data_readl(&d->bus, 0);
|
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
break;
|
2017-09-20 09:20:01 +03:00
|
|
|
case 0x1 ... 0x7:
|
|
|
|
if (size == 1) {
|
|
|
|
retval = ide_ioport_read(&d->bus, reg);
|
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
break;
|
2017-09-20 09:20:01 +03:00
|
|
|
case 0x8:
|
|
|
|
case 0x16:
|
|
|
|
if (size == 1) {
|
|
|
|
retval = ide_status_read(&d->bus, 0);
|
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
break;
|
2017-09-20 09:20:01 +03:00
|
|
|
case 0x20:
|
|
|
|
if (size == 4) {
|
|
|
|
retval = d->timing_reg;
|
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
break;
|
2017-09-20 09:20:01 +03:00
|
|
|
case 0x30:
|
|
|
|
/* This is an interrupt state register that only exists
|
|
|
|
* in the KeyLargo and later variants. Bit 0x8000_0000
|
|
|
|
* latches the DMA interrupt and has to be written to
|
|
|
|
* clear. Bit 0x4000_0000 is an image of the disk
|
|
|
|
* interrupt. MacOS X relies on this and will hang if
|
|
|
|
* we don't provide at least the disk interrupt
|
|
|
|
*/
|
|
|
|
if (size == 4) {
|
|
|
|
retval = d->irq_reg;
|
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return retval;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2017-09-20 09:20:01 +03:00
|
|
|
static void pmac_ide_write(void *opaque, hwaddr addr, uint64_t val,
|
|
|
|
unsigned size)
|
2009-08-20 17:22:21 +04:00
|
|
|
{
|
|
|
|
MACIOIDEState *d = opaque;
|
2017-09-20 09:20:01 +03:00
|
|
|
int reg = addr >> 4;
|
|
|
|
|
|
|
|
switch (reg) {
|
|
|
|
case 0x0:
|
|
|
|
if (size == 2) {
|
|
|
|
ide_data_writew(&d->bus, 0, val);
|
|
|
|
} else if (size == 4) {
|
|
|
|
ide_data_writel(&d->bus, 0, val);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 0x1 ... 0x7:
|
|
|
|
if (size == 1) {
|
|
|
|
ide_ioport_write(&d->bus, reg, val);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 0x8:
|
|
|
|
case 0x16:
|
|
|
|
if (size == 1) {
|
|
|
|
ide_cmd_write(&d->bus, 0, val);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 0x20:
|
|
|
|
if (size == 4) {
|
|
|
|
d->timing_reg = val;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 0x30:
|
|
|
|
if (size == 4) {
|
|
|
|
if (val & 0x80000000u) {
|
|
|
|
d->irq_reg &= 0x7fffffff;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-02-05 14:19:07 +04:00
|
|
|
static const MemoryRegionOps pmac_ide_ops = {
|
2017-09-20 09:20:01 +03:00
|
|
|
.read = pmac_ide_read,
|
|
|
|
.write = pmac_ide_write,
|
|
|
|
.valid.min_access_size = 1,
|
|
|
|
.valid.max_access_size = 4,
|
|
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
2009-08-20 17:22:21 +04:00
|
|
|
};
|
|
|
|
|
2009-10-07 21:04:46 +04:00
|
|
|
static const VMStateDescription vmstate_pmac = {
|
|
|
|
.name = "ide",
|
2017-09-30 19:49:35 +03:00
|
|
|
.version_id = 5,
|
2009-10-07 21:04:46 +04:00
|
|
|
.minimum_version_id = 0,
|
2014-04-16 18:01:33 +04:00
|
|
|
.fields = (VMStateField[]) {
|
2009-10-07 21:04:46 +04:00
|
|
|
VMSTATE_IDE_BUS(bus, MACIOIDEState),
|
|
|
|
VMSTATE_IDE_DRIVES(bus.ifs, MACIOIDEState),
|
2016-01-06 23:37:24 +03:00
|
|
|
VMSTATE_BOOL(dma_active, MACIOIDEState),
|
2017-09-30 19:49:35 +03:00
|
|
|
VMSTATE_UINT32(timing_reg, MACIOIDEState),
|
|
|
|
VMSTATE_UINT32(irq_reg, MACIOIDEState),
|
2009-10-07 21:04:46 +04:00
|
|
|
VMSTATE_END_OF_LIST()
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
2009-10-07 21:04:46 +04:00
|
|
|
};
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2013-01-24 03:04:01 +04:00
|
|
|
static void macio_ide_reset(DeviceState *dev)
|
2009-08-20 17:22:21 +04:00
|
|
|
{
|
2013-01-24 03:04:01 +04:00
|
|
|
MACIOIDEState *d = MACIO_IDE(dev);
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2009-11-07 17:13:05 +03:00
|
|
|
ide_bus_reset(&d->bus);
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
|
|
|
|
2020-02-19 21:08:49 +03:00
|
|
|
static int ide_nop_int(IDEDMA *dma, bool is_write)
|
2013-06-30 04:36:14 +04:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
ide: add limit to .prepare_buf()
prepare_buf should not always grab as many descriptors
as it can, sometimes it should self-limit.
For example, an NCQ transfer of 1 sector with a PRDT that
describes 4GiB of data should not copy 4GiB of data, it
should just transfer that first 512 bytes.
PIO is not affected, because the dma_buf_rw dma helpers
already have a byte limit built-in to them, but DMA/NCQ
will exhaust the entire list regardless of requested size.
AHCI 1.3 specifies in section 6.1.6 Command List Underflow that
NCQ is not required to detect underflow conditions. Non-NCQ
pathways signal underflow by writing to the PRDBC field, which
will already occur by writing the actual transferred byte count
to the PRDBC, signaling the underflow.
Our NCQ pathways aren't required to detect underflow, but since our DMA
backend uses the size of the PRDT to determine the size of the transer,
if our PRDT is bigger than the transaction (the underflow condition) it
doesn't cost us anything to detect it and truncate the PRDT.
This is a recoverable error and is not signaled to the guest, in either
NCQ or normal DMA cases.
For BMDMA, the existing pathways should see no guest-visible difference,
but any bytes described in the overage will no longer be transferred
before indicating to the guest that there was an underflow.
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1435767578-32743-2-git-send-email-jsnow@redhat.com
2015-07-04 09:06:04 +03:00
|
|
|
static int32_t ide_nop_int32(IDEDMA *dma, int32_t l)
|
ide: Correct handling of malformed/short PRDTs
This impacts both BMDMA and AHCI HBA interfaces for IDE.
Currently, we confuse the difference between a PRDT having
"0 bytes" and a PRDT having "0 complete sectors."
When we receive an incomplete sector, inconsistent error checking
leads to an infinite loop wherein the call succeeds, but it
didn't give us enough bytes -- leading us to re-call the
DMA chain over and over again. This leads to, in the BMDMA case,
leaked memory for short PRDTs, and infinite loops and resource
usage in the AHCI case.
The .prepare_buf() callback is reworked to return the number of
bytes that it successfully prepared. 0 is a valid, non-error
answer that means the table was empty and described no bytes.
-1 indicates an error.
Our current implementation uses the io_buffer in IDEState to
ultimately describe the size of a prepared scatter-gather list.
Even though the AHCI PRDT/SGList can be as large as 256GiB, the
AHCI command header limits transactions to just 4GiB. ATA8-ACS3,
however, defines the largest transaction to be an LBA48 command
that transfers 65,536 sectors. With a 512 byte sector size, this
is just 32MiB.
Since our current state structures use the int type to describe
the size of the buffer, and this state is migrated as int32, we
are limited to describing 2GiB buffer sizes unless we change the
migration protocol.
For this reason, this patch begins to unify the assertions in the
IDE pathways that the scatter-gather list provided by either the
AHCI PRDT or the PCI BMDMA PRDs can only describe, at a maximum,
2GiB. This should be resilient enough unless we need a sector
size that exceeds 32KiB.
Further, the likelihood of any guest operating system actually
attempting to transfer this much data in a single operation is
very slim.
To this end, the IDEState variables have been updated to more
explicitly clarify our maximum supported size. Callers to the
prepare_buf callback have been reworked to understand the new
return code, and all versions of the prepare_buf callback have
been adjusted accordingly.
Lastly, the ahci_populate_sglist helper, relied upon by the
AHCI implementation of .prepare_buf() as well as the PCI
implementation of the callback have had overflow assertions
added to help make clear the reasonings behind the various
type changes.
[Added %d -> %"PRId64" fix John sent because off_pos changed from int to
int64_t.
--Stefan]
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1414785819-26209-4-git-send-email-jsnow@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-10-31 23:03:39 +03:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2013-06-30 04:36:14 +04:00
|
|
|
static void ide_dbdma_start(IDEDMA *dma, IDEState *s,
|
2014-10-07 15:59:15 +04:00
|
|
|
BlockCompletionFunc *cb)
|
2013-06-30 04:36:14 +04:00
|
|
|
{
|
|
|
|
MACIOIDEState *m = container_of(dma, MACIOIDEState, dma);
|
2015-05-22 21:13:44 +03:00
|
|
|
|
2015-05-22 21:13:44 +03:00
|
|
|
s->io_buffer_index = 0;
|
2015-05-22 21:13:44 +03:00
|
|
|
if (s->drive_kind == IDE_CD) {
|
|
|
|
s->io_buffer_size = s->packet_transfer_size;
|
2015-05-22 21:13:44 +03:00
|
|
|
} else {
|
2015-06-05 00:59:36 +03:00
|
|
|
s->io_buffer_size = s->nsector * BDRV_SECTOR_SIZE;
|
2015-05-22 21:13:44 +03:00
|
|
|
}
|
2015-05-22 21:13:44 +03:00
|
|
|
|
2015-05-22 21:13:44 +03:00
|
|
|
MACIO_DPRINTF("\n\n------------ IDE transfer\n");
|
|
|
|
MACIO_DPRINTF("buffer_size: %x buffer_index: %x\n",
|
|
|
|
s->io_buffer_size, s->io_buffer_index);
|
|
|
|
MACIO_DPRINTF("lba: %x size: %x\n", s->lba, s->io_buffer_size);
|
|
|
|
MACIO_DPRINTF("-------------------------\n");
|
2015-05-22 21:13:44 +03:00
|
|
|
|
2013-06-30 04:54:35 +04:00
|
|
|
m->dma_active = true;
|
2013-06-30 04:36:14 +04:00
|
|
|
DBDMA_kick(m->dbdma);
|
|
|
|
}
|
|
|
|
|
|
|
|
static const IDEDMAOps dbdma_ops = {
|
|
|
|
.start_dma = ide_dbdma_start,
|
ide: Correct handling of malformed/short PRDTs
This impacts both BMDMA and AHCI HBA interfaces for IDE.
Currently, we confuse the difference between a PRDT having
"0 bytes" and a PRDT having "0 complete sectors."
When we receive an incomplete sector, inconsistent error checking
leads to an infinite loop wherein the call succeeds, but it
didn't give us enough bytes -- leading us to re-call the
DMA chain over and over again. This leads to, in the BMDMA case,
leaked memory for short PRDTs, and infinite loops and resource
usage in the AHCI case.
The .prepare_buf() callback is reworked to return the number of
bytes that it successfully prepared. 0 is a valid, non-error
answer that means the table was empty and described no bytes.
-1 indicates an error.
Our current implementation uses the io_buffer in IDEState to
ultimately describe the size of a prepared scatter-gather list.
Even though the AHCI PRDT/SGList can be as large as 256GiB, the
AHCI command header limits transactions to just 4GiB. ATA8-ACS3,
however, defines the largest transaction to be an LBA48 command
that transfers 65,536 sectors. With a 512 byte sector size, this
is just 32MiB.
Since our current state structures use the int type to describe
the size of the buffer, and this state is migrated as int32, we
are limited to describing 2GiB buffer sizes unless we change the
migration protocol.
For this reason, this patch begins to unify the assertions in the
IDE pathways that the scatter-gather list provided by either the
AHCI PRDT or the PCI BMDMA PRDs can only describe, at a maximum,
2GiB. This should be resilient enough unless we need a sector
size that exceeds 32KiB.
Further, the likelihood of any guest operating system actually
attempting to transfer this much data in a single operation is
very slim.
To this end, the IDEState variables have been updated to more
explicitly clarify our maximum supported size. Callers to the
prepare_buf callback have been reworked to understand the new
return code, and all versions of the prepare_buf callback have
been adjusted accordingly.
Lastly, the ahci_populate_sglist helper, relied upon by the
AHCI implementation of .prepare_buf() as well as the PCI
implementation of the callback have had overflow assertions
added to help make clear the reasonings behind the various
type changes.
[Added %d -> %"PRId64" fix John sent because off_pos changed from int to
int64_t.
--Stefan]
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 1414785819-26209-4-git-send-email-jsnow@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-10-31 23:03:39 +03:00
|
|
|
.prepare_buf = ide_nop_int32,
|
2013-06-30 04:36:14 +04:00
|
|
|
.rw_buf = ide_nop_int,
|
|
|
|
};
|
|
|
|
|
2013-01-24 03:04:01 +04:00
|
|
|
static void macio_ide_realizefn(DeviceState *dev, Error **errp)
|
2009-08-20 17:22:21 +04:00
|
|
|
{
|
2013-01-24 03:04:01 +04:00
|
|
|
MACIOIDEState *s = MACIO_IDE(dev);
|
|
|
|
|
2017-09-20 09:20:00 +03:00
|
|
|
ide_init2(&s->bus, s->ide_irq);
|
2013-06-30 04:36:14 +04:00
|
|
|
|
|
|
|
/* Register DMA callbacks */
|
|
|
|
s->dma.ops = &dbdma_ops;
|
|
|
|
s->bus.dma = &s->dma;
|
2013-01-24 03:04:01 +04:00
|
|
|
}
|
|
|
|
|
2017-09-20 09:20:00 +03:00
|
|
|
static void pmac_ide_irq(void *opaque, int n, int level)
|
|
|
|
{
|
|
|
|
MACIOIDEState *s = opaque;
|
|
|
|
uint32_t mask = 0x80000000u >> n;
|
|
|
|
|
|
|
|
/* We need to reflect the IRQ state in the irq register */
|
|
|
|
if (level) {
|
|
|
|
s->irq_reg |= mask;
|
|
|
|
} else {
|
|
|
|
s->irq_reg &= ~mask;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (n) {
|
|
|
|
qemu_set_irq(s->real_ide_irq, level);
|
|
|
|
} else {
|
|
|
|
qemu_set_irq(s->real_dma_irq, level);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-01-24 03:04:01 +04:00
|
|
|
static void macio_ide_initfn(Object *obj)
|
|
|
|
{
|
|
|
|
SysBusDevice *d = SYS_BUS_DEVICE(obj);
|
|
|
|
MACIOIDEState *s = MACIO_IDE(obj);
|
|
|
|
|
2013-08-23 22:18:50 +04:00
|
|
|
ide_bus_new(&s->bus, sizeof(s->bus), DEVICE(obj), 0, 2);
|
2013-06-07 05:25:08 +04:00
|
|
|
memory_region_init_io(&s->mem, obj, &pmac_ide_ops, s, "pmac-ide", 0x1000);
|
2013-01-24 03:04:01 +04:00
|
|
|
sysbus_init_mmio(d, &s->mem);
|
2017-09-20 09:20:00 +03:00
|
|
|
sysbus_init_irq(d, &s->real_ide_irq);
|
|
|
|
sysbus_init_irq(d, &s->real_dma_irq);
|
|
|
|
s->dma_irq = qemu_allocate_irq(pmac_ide_irq, s, 0);
|
|
|
|
s->ide_irq = qemu_allocate_irq(pmac_ide_irq, s, 1);
|
2017-09-24 17:47:44 +03:00
|
|
|
|
|
|
|
object_property_add_link(obj, "dbdma", TYPE_MAC_DBDMA,
|
|
|
|
(Object **) &s->dbdma,
|
qom: Drop parameter @errp of object_property_add() & friends
The only way object_property_add() can fail is when a property with
the same name already exists. Since our property names are all
hardcoded, failure is a programming error, and the appropriate way to
handle it is passing &error_abort.
Same for its variants, except for object_property_add_child(), which
additionally fails when the child already has a parent. Parentage is
also under program control, so this is a programming error, too.
We have a bit over 500 callers. Almost half of them pass
&error_abort, slightly fewer ignore errors, one test case handles
errors, and the remaining few callers pass them to their own callers.
The previous few commits demonstrated once again that ignoring
programming errors is a bad idea.
Of the few ones that pass on errors, several violate the Error API.
The Error ** argument must be NULL, &error_abort, &error_fatal, or a
pointer to a variable containing NULL. Passing an argument of the
latter kind twice without clearing it in between is wrong: if the
first call sets an error, it no longer points to NULL for the second
call. ich9_pm_add_properties(), sparc32_ledma_realize(),
sparc32_dma_realize(), xilinx_axidma_realize(), xilinx_enet_realize()
are wrong that way.
When the one appropriate choice of argument is &error_abort, letting
users pick the argument is a bad idea.
Drop parameter @errp and assert the preconditions instead.
There's one exception to "duplicate property name is a programming
error": the way object_property_add() implements the magic (and
undocumented) "automatic arrayification". Don't drop @errp there.
Instead, rename object_property_add() to object_property_try_add(),
and add the obvious wrapper object_property_add().
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20200505152926.18877-15-armbru@redhat.com>
[Two semantic rebase conflicts resolved]
2020-05-05 18:29:22 +03:00
|
|
|
qdev_prop_allow_set_link_before_realize, 0);
|
2013-01-24 03:04:01 +04:00
|
|
|
}
|
|
|
|
|
2017-09-24 17:47:43 +03:00
|
|
|
static Property macio_ide_properties[] = {
|
|
|
|
DEFINE_PROP_UINT32("channel", MACIOIDEState, channel, 0),
|
2018-08-29 19:59:07 +03:00
|
|
|
DEFINE_PROP_UINT32("addr", MACIOIDEState, addr, -1),
|
2017-09-24 17:47:43 +03:00
|
|
|
DEFINE_PROP_END_OF_LIST(),
|
|
|
|
};
|
|
|
|
|
2013-01-24 03:04:01 +04:00
|
|
|
static void macio_ide_class_init(ObjectClass *oc, void *data)
|
|
|
|
{
|
|
|
|
DeviceClass *dc = DEVICE_CLASS(oc);
|
|
|
|
|
|
|
|
dc->realize = macio_ide_realizefn;
|
|
|
|
dc->reset = macio_ide_reset;
|
2020-01-10 18:30:32 +03:00
|
|
|
device_class_set_props(dc, macio_ide_properties);
|
2013-01-24 03:04:01 +04:00
|
|
|
dc->vmsd = &vmstate_pmac;
|
2015-09-26 19:22:08 +03:00
|
|
|
set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
|
2013-01-24 03:04:01 +04:00
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2013-01-24 03:04:01 +04:00
|
|
|
static const TypeInfo macio_ide_type_info = {
|
|
|
|
.name = TYPE_MACIO_IDE,
|
|
|
|
.parent = TYPE_SYS_BUS_DEVICE,
|
|
|
|
.instance_size = sizeof(MACIOIDEState),
|
|
|
|
.instance_init = macio_ide_initfn,
|
|
|
|
.class_init = macio_ide_class_init,
|
|
|
|
};
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2013-01-24 03:04:01 +04:00
|
|
|
static void macio_ide_register_types(void)
|
|
|
|
{
|
|
|
|
type_register_static(&macio_ide_type_info);
|
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2013-06-24 23:40:50 +04:00
|
|
|
/* hd_table must contain 2 block drivers */
|
2013-01-24 03:04:01 +04:00
|
|
|
void macio_ide_init_drives(MACIOIDEState *s, DriveInfo **hd_table)
|
|
|
|
{
|
|
|
|
int i;
|
2009-08-20 17:22:21 +04:00
|
|
|
|
2013-01-24 03:04:01 +04:00
|
|
|
for (i = 0; i < 2; i++) {
|
|
|
|
if (hd_table[i]) {
|
|
|
|
ide_create_drive(&s->bus, i, hd_table[i]);
|
|
|
|
}
|
|
|
|
}
|
2009-08-20 17:22:21 +04:00
|
|
|
}
|
2013-01-24 03:04:01 +04:00
|
|
|
|
2017-09-24 17:47:44 +03:00
|
|
|
void macio_ide_register_dma(MACIOIDEState *s)
|
2013-01-24 03:04:01 +04:00
|
|
|
{
|
2017-09-24 17:47:44 +03:00
|
|
|
DBDMA_register_channel(s->dbdma, s->channel, s->dma_irq,
|
2013-01-24 03:04:01 +04:00
|
|
|
pmac_ide_transfer, pmac_ide_flush, s);
|
|
|
|
}
|
|
|
|
|
|
|
|
type_init(macio_ide_register_types)
|