From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:33915)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1YV6NK-0007zD-4S
	for qemu-devel@nongnu.org; Mon, 09 Mar 2015 18:42:14 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1YV6NG-0002g0-VM
	for qemu-devel@nongnu.org; Mon, 09 Mar 2015 18:42:14 -0400
Received: from mx1.redhat.com ([209.132.183.28]:32974)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1YV6NG-0002fr-Li
	for qemu-devel@nongnu.org; Mon, 09 Mar 2015 18:42:10 -0400
Message-ID: <54FE21BF.8060905@redhat.com>
Date: Mon, 09 Mar 2015 18:42:07 -0400
From: John Snow <jsnow@redhat.com>
MIME-Version: 1.0
References: <CAC1AzdfOy+3poMaH_4at-tfVy+fg4rpNN10zbQD4Oj28sZCuPg@mail.gmail.com>	<20150226144504.GA23124@stefanha-thinkpad.redhat.com>	<CAC1Azdc_QeAk0Q7FnCf+aVdpd9gNLZvqAxkLbmsiLAOG+SP16Q@mail.gmail.com>
	<54EF97F0.7020104@redhat.com>
In-Reply-To: <54EF97F0.7020104@redhat.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] ahci: map memory via device's address
 space instead of address_space_memory
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>, Jordan Hargrave <jharg93@gmail.com>, Stefan Hajnoczi <stefanha@gmail.com>
Cc: qemu-devel@nongnu.org



On 02/26/2015 05:02 PM, Paolo Bonzini wrote:
>
>
> On 26/02/2015 22:31, Jordan Hargrave wrote:
>>
>> My OS initializes DMAR page tables and then enables the IOMMU translation.
>> Then OS initializes AHCI driver.  Writes VIRTUAL DMA to FIS registers.
>> eg. FIS DMA address is 0x10000 (maps to some hardware physical address
>> via iommu)
>>
>> The OS writes 0x00 PORT_FIS_ADDR_HI -> qemu calls map_page (0x00 << 32)
>> | 0x7fae0000... 0x7fae0000 is stale, and is not in the IOMMU page map.
>> Causes a non-recoverable IOMMU fault.
>
> That's a bug in QEMU.  map_page must be skipped unless PORT_CMD_FIS_ON
> is set in pr->cmd (also, QEMU is never resetting PORT_CMD_FIS_ON when
> PORT_CMD_FIS_RX goes down).
>
> Paolo
>

map_page must be skipped *if* PORT_CMD_FIS_ON is set -- or rather, that 
produces undefined behavior in the AHCI spec. We can only set these 
fields when the FIS Receive Engine is off. We can only modify the CLB if 
PxCMD.ST is off.

We also never actually reset PORT_CMD_FIS_RX or PORT_CMD_FIS_ON 
ourselves, so the status bit will get reset when the user writes zeroes 
to those bits when writing PxCMD. (We always clear PORT_CMD_FIS_ON and 
PORT_CMD_LIST_ON both upon any write to PxCMD, then re-add these flags 
if we see the user has written PORT_CMD_START or PORT_CMD_FIS_RX.)

So I think I can fix this just by delaying the CLB and FB mappings to 
the PORT_CMD_LIST_ON and PORT_CMD_FIS_ON events. I'll send a patch.