[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 9/9] ide: cancel pending callbacks on SRST
From: |
John Snow |
Subject: |
[PULL 9/9] ide: cancel pending callbacks on SRST |
Date: |
Thu, 1 Oct 2020 13:46:49 -0400 |
The SRST implementation did not keep up with the rest of IDE; it is
possible to perform a weak reset on an IDE device to remove the BSY/DRQ
bits, and then issue writes to the control/device registers which can
cause chaos with the state machine.
Fix that by actually performing a real reset.
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: https://bugs.launchpad.net/qemu/+bug/1878253
Fixes: https://bugs.launchpad.net/qemu/+bug/1887303
Fixes: https://bugs.launchpad.net/qemu/+bug/1887309
Signed-off-by: John Snow <jsnow@redhat.com>
---
hw/ide/core.c | 58 +++++++++++++++++++++++++++++++++++----------------
1 file changed, 40 insertions(+), 18 deletions(-)
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 0d745d63a18..0e32abd7796 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -2241,6 +2241,37 @@ uint32_t ide_status_read(void *opaque, uint32_t addr)
return ret;
}
+static void ide_perform_srst(IDEState *s)
+{
+ s->status |= BUSY_STAT;
+
+ /* Halt PIO (Via register state); PIO BH remains scheduled. */
+ ide_transfer_halt(s);
+
+ /* Cancel DMA -- may drain block device and invoke callbacks */
+ ide_cancel_dma_sync(s);
+
+ /* Cancel PIO callback, reset registers/signature, etc */
+ ide_reset(s);
+
+ if (s->drive_kind == IDE_CD) {
+ /* ATAPI drives do not set READY or SEEK */
+ s->status = 0x00;
+ }
+}
+
+static void ide_bus_perform_srst(void *opaque)
+{
+ IDEBus *bus = opaque;
+ IDEState *s;
+ int i;
+
+ for (i = 0; i < 2; i++) {
+ s = &bus->ifs[i];
+ ide_perform_srst(s);
+ }
+}
+
void ide_ctrl_write(void *opaque, uint32_t addr, uint32_t val)
{
IDEBus *bus = opaque;
@@ -2249,26 +2280,17 @@ void ide_ctrl_write(void *opaque, uint32_t addr,
uint32_t val)
trace_ide_ctrl_write(addr, val, bus);
- /* common for both drives */
- if (!(bus->cmd & IDE_CTRL_RESET) &&
- (val & IDE_CTRL_RESET)) {
- /* reset low to high */
- for(i = 0;i < 2; i++) {
+ /* Device0 and Device1 each have their own control register,
+ * but QEMU models it as just one register in the controller. */
+ if ((bus->cmd & IDE_CTRL_RESET) &&
+ !(val & IDE_CTRL_RESET)) {
+ /* SRST triggers on falling edge */
+ for (i = 0; i < 2; i++) {
s = &bus->ifs[i];
- s->status = BUSY_STAT | SEEK_STAT;
- s->error = 0x01;
- }
- } else if ((bus->cmd & IDE_CTRL_RESET) &&
- !(val & IDE_CTRL_RESET)) {
- /* high to low */
- for(i = 0;i < 2; i++) {
- s = &bus->ifs[i];
- if (s->drive_kind == IDE_CD)
- s->status = 0x00; /* NOTE: READY is _not_ set */
- else
- s->status = READY_STAT | SEEK_STAT;
- ide_set_signature(s);
+ s->status |= BUSY_STAT;
}
+ aio_bh_schedule_oneshot(qemu_get_aio_context(),
+ ide_bus_perform_srst, bus);
}
bus->cmd = val;
--
2.26.2
- [PULL 0/9] Ide patches, John Snow, 2020/10/01
- [PULL 4/9] ide: don't tamper with the device register, John Snow, 2020/10/01
- [PULL 5/9] ide: model HOB correctly, John Snow, 2020/10/01
- [PULL 3/9] ide: rename cmd_write to ctrl_write, John Snow, 2020/10/01
- [PULL 1/9] MAINTAINERS: Update my git address, John Snow, 2020/10/01
- [PULL 2/9] hw/ide/ahci: Do not dma_memory_unmap(NULL), John Snow, 2020/10/01
- [PULL 8/9] ide: clear interrupt on command write, John Snow, 2020/10/01
- [PULL 7/9] ide: remove magic constants from the device register, John Snow, 2020/10/01
- [PULL 6/9] ide: reorder set/get sector functions, John Snow, 2020/10/01
- [PULL 9/9] ide: cancel pending callbacks on SRST,
John Snow <=
- Re: [PULL 0/9] Ide patches, Peter Maydell, 2020/10/01