From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47177) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YVRiN-0000zz-Vs for qemu-devel@nongnu.org; Tue, 10 Mar 2015 17:29:24 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YVRiH-0002kW-QU for qemu-devel@nongnu.org; Tue, 10 Mar 2015 17:29:23 -0400 From: John Snow Date: Tue, 10 Mar 2015 17:29:04 -0400 Message-Id: <1426022944-17882-3-git-send-email-jsnow@redhat.com> In-Reply-To: <1426022944-17882-1-git-send-email-jsnow@redhat.com> References: <1426022944-17882-1-git-send-email-jsnow@redhat.com> Subject: [Qemu-devel] [PATCH 2/2] AHCI: Protect cmd register List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-block@nongnu.org Cc: pbonzini@redhat.com, John Snow , qemu-devel@nongnu.org, stefanha@redhat.com Many bits in the CMD register are supposed to be strictly read-only. We should not be deleting them on every write. As a side-effect: pay explicit attention to when a guest marks off the FIS Receive or Start bits, and disable the status bits ourselves, instead of letting them implicitly fall off. Signed-off-by: John Snow --- hw/ide/ahci.c | 26 +++++++++++++++++++++++++- hw/ide/ahci.h | 2 ++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c index 42bbf7f..b386a25 100644 --- a/hw/ide/ahci.c +++ b/hw/ide/ahci.c @@ -52,7 +52,9 @@ static void ahci_init_d2h(AHCIDevice *ad); static int ahci_dma_prepare_buf(IDEDMA *dma, int is_write); static void ahci_commit_buf(IDEDMA *dma, uint32_t tx_bytes); static void ahci_map_clb_address(AHCIDevice *ad); +static void ahci_unmap_clb_address(AHCIDevice *ad); static void ahci_map_fis_address(AHCIDevice *ad); +static void ahci_unmap_fis_address(AHCIDevice *ad); static uint32_t ahci_port_read(AHCIState *s, int port, int offset) @@ -223,16 +225,24 @@ static void ahci_port_write(AHCIState *s, int port, int offset, uint32_t val) ahci_check_irq(s); break; case PORT_CMD: - pr->cmd = val & ~(PORT_CMD_LIST_ON | PORT_CMD_FIS_ON); + /* Block any Read-only fields from being set; + * including LIST_ON and FIS_ON. */ + pr->cmd = (pr->cmd & PORT_CMD_RO_MASK) | (val & ~PORT_CMD_RO_MASK); if (pr->cmd & PORT_CMD_START) { pr->cmd |= PORT_CMD_LIST_ON; ahci_map_clb_address(&s->dev[port]); + } else if (pr->cmd & PORT_CMD_LIST_ON) { + ahci_unmap_clb_address(&s->dev[port]); + pr->cmd = pr->cmd & ~(PORT_CMD_LIST_ON); } if (pr->cmd & PORT_CMD_FIS_RX) { pr->cmd |= PORT_CMD_FIS_ON; ahci_map_fis_address(&s->dev[port]); + } else if (pr->cmd & PORT_CMD_FIS_ON) { + ahci_unmap_fis_address(&s->dev[port]); + pr->cmd = pr->cmd & ~(PORT_CMD_FIS_ON); } /* XXX usually the FIS would be pending on the bus here and @@ -566,6 +576,13 @@ static void ahci_map_fis_address(AHCIDevice *ad) ((uint64_t)pr->fis_addr_hi << 32) | pr->fis_addr, 256); } +static void ahci_unmap_fis_address(AHCIDevice *ad) +{ + dma_memory_unmap(ad->hba->as, ad->res_fis, 256, + DMA_DIRECTION_FROM_DEVICE, 256); + ad->res_fis = NULL; +} + static void ahci_map_clb_address(AHCIDevice *ad) { AHCIPortRegs *pr = &ad->port_regs; @@ -574,6 +591,13 @@ static void ahci_map_clb_address(AHCIDevice *ad) ((uint64_t)pr->lst_addr_hi << 32) | pr->lst_addr, 1024); } +static void ahci_unmap_clb_address(AHCIDevice *ad) +{ + dma_memory_unmap(ad->hba->as, ad->lst, 1024, + DMA_DIRECTION_FROM_DEVICE, 1024); + ad->lst = NULL; +} + static void ahci_write_fis_sdb(AHCIState *s, int port, uint32_t finished) { AHCIDevice *ad = &s->dev[port]; diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h index 99aa0c9..501c002 100644 --- a/hw/ide/ahci.h +++ b/hw/ide/ahci.h @@ -132,6 +132,8 @@ #define PORT_CMD_ICC_PARTIAL (0x2 << 28) /* Put i/f in partial state */ #define PORT_CMD_ICC_SLUMBER (0x6 << 28) /* Put i/f in slumber state */ +#define PORT_CMD_RO_MASK 0x007dffe0 /* Which CMD bits are read only? */ + /* ap->flags bits */ #define AHCI_FLAG_NO_NCQ (1 << 24) #define AHCI_FLAG_IGN_IRQ_IF_ERR (1 << 25) /* ignore IRQ_IF_ERR */ -- 1.9.3