aboutsummaryrefslogtreecommitdiff
path: root/hw/audio
AgeCommit message (Collapse)AuthorFilesLines
2023-10-10hw/audio/es1370: trace lost interruptsVolker Rümelin2-5/+12
It turns out that there are drivers which assume that interrupts can't be lost. E.g. the AROS sb128 driver is such a driver. Add a lost interrupt tracepoint to debug this kind of issues. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-8-vr_qemu@t-online.de>
2023-10-10hw/audio/es1370: change variable type and nameVolker Rümelin1-7/+8
Change the type of the variable temp to size_t to avoid a type cast. While at it, rename the variable name to to_transfer. This improves the readability of the code. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-7-vr_qemu@t-online.de>
2023-10-10hw/audio/es1370: block structure coding style fixesVolker Rümelin1-20/+16
Change the block structure according to the QEMU Coding Style documentation. Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-6-vr_qemu@t-online.de>
2023-10-10hw/audio/es1370: remove #ifdef ES1370_VERBOSE to avoid bit rotVolker Rümelin1-12/+13
Replace the #ifdef ES1370_VERBOSE code with code that the compiler can optimize away to avoid bit rot and fix the already rotten code. Tested-by: Rene Engel <ReneEngel80@emailn.de> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-5-vr_qemu@t-online.de>
2023-10-10hw/audio/es1370: remove #ifdef ES1370_DEBUG to avoid bit rotVolker Rümelin1-69/+66
Replace the #ifdef ES1370_DEBUG code with code that the compiler can optimize away to avoid bit rot. While at it, replace strcat() with pstrcat(). Tested-by: Rene Engel <ReneEngel80@emailn.de> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-4-vr_qemu@t-online.de>
2023-10-10hw/audio/es1370: remove unused dolog macroVolker Rümelin1-7/+0
The dolog macro is unused. Remove the macro and use the now unused ES1370_VERBOSE macro to replace its inverse ES1370_SILENT macro. Tested-by: Rene Engel <ReneEngel80@emailn.de> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-3-vr_qemu@t-online.de>
2023-10-10hw/audio/es1370: replace bit-rotted code with tracepointsVolker Rümelin2-37/+28
It seems that nobody has enabled the debug code of the ES1370 device for a long time. Since then, the code has bit-rotted. Replace the bit-rotten code with tracepoints. Tested-by: Rene Engel <ReneEngel80@emailn.de> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-2-vr_qemu@t-online.de>
2023-10-10hw/audio/es1370: reset current sample counterVolker Rümelin1-1/+1
Reset the current sample counter when writing the Channel Sample Count Register. The Linux ens1370 driver and the AROS sb128 driver expect the current sample counter counts down from sample count to 0 after a write to the Channel Sample Count Register. Currently the current sample counter starts from 0 after a reset or the last count when the counter was stopped. The current sample counter is used to raise an interrupt whenever a complete buffer was transferred. When the counter starts with a value lower than the reload value, the interrupt triggeres before the buffer was completly transferred. This may lead to corrupted audio streams. Tested-by: Rene Engel <ReneEngel80@emailn.de> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20230917065813.6692-1-vr_qemu@t-online.de>
2023-10-09Merge tag 'q800-for-8.2-pull-request' of https://github.com/vivier/qemu-m68k ↵Stefan Hajnoczi4-0/+741
into staging Pull request q800 20231008 add support for booting: - MacOS 7.1 - 8.1, with or without virtual memory enabled - A/UX 3.0.1 - NetBSD 9.3 - Linux (via EMILE) # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEEzS913cjjpNwuT1Fz8ww4vT8vvjwFAmUiSrISHGxhdXJlbnRA # dml2aWVyLmV1AAoJEPMMOL0/L748oSUQAKAm3TPYQUDDVFTi2uhzv6IgNSgOVUhK # 3I3xoNb0UR9AT3Wfg1fah5La3p0kL9Y25gvhCl6veUg39WVicv3fbqUevbJ1Nwgl # ovwS3MRRcvYhU+omcXImFfoIPyOxfSf3vZ6SedIkB24hQyXN9eFBZMfgCODU6lfo # rAd/Hm50N2jRI8aKjvN+uHFRz75wqq6rNk/4QLWihRqhtWrjUDPHOTMI9sQxWy9z # LcXxVKbWCY8/WOAandsGL94l2jfu94HM6CfwHaumdxvPBZT6WUyCv3T1rJsVJU29 # b8oTLcwKAmZ7lGLbjl6GdB8q5KAJFCAGLWuEbNIMj0orB37OpUd0Wx2SD9+aA53H # yoKGbk6N1UappTtcnZCfwzWRzNaXrRno+w+/xYjlKsXBdHV9ZXHMGD5ERxoC6MY7 # ISsCa4bafeUDes6SCetgq87ho69E8l+gAlNYPgidHaTP226BjrYWQRJIa0leczfO # aE6dAG7MQFOnOjeOHEJMDB2XpKHiVe1lyVGQH485cLW1J6LHJFWUfUUH2Zjs1v1z # eXZHBTclPO2wbuQzXG6pAz2jdF/9w4ft/aA0PQhQcFxa9RB6AoNFG/juHJN5eUiw # NXJetR2g1juNPqmMFWDNMJ7Zzce5Chjoj69XJBFYSXhgbOtwpUpoEPZUeIMcW1eJ # Va2HvyDQPp1B # =RUHg # -----END PGP SIGNATURE----- # gpg: Signature made Sun 08 Oct 2023 02:22:42 EDT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * tag 'q800-for-8.2-pull-request' of https://github.com/vivier/qemu-m68k: mac_via: extend timer calibration hack to work with A/UX q800: add alias for MacOS toolbox ROM at 0x40000000 q800: add ESCC alias at 0xc000 mac_via: always clear ADB interrupt when switching to A/UX mode mac_via: implement ADB_STATE_IDLE state if shift register in input mode mac_via: workaround NetBSD ADB bus enumeration issue mac_via: work around underflow in TimeDBRA timing loop in SETUPTIMEK swim: update IWM/ISM register block decoding swim: split into separate IWM and ISM register blocks swim: add trace events for IWM and ISM registers q800: add easc bool machine class property to switch between ASC and EASC q800: add Apple Sound Chip (ASC) audio to machine asc: generate silence if FIFO empty but engine still running audio: add Apple Sound Chip (ASC) emulation q800: allow accesses to RAM area even if less memory is available q800: add IOSB subsystem q800: implement additional machine id bits on VIA1 port A q800: add machine id register q800: add djMEMC memory controller q800-glue.c: convert to Resettable interface Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-10-06hw/audio/soundhw: Clean up global variable shadowingPhilippe Mathieu-Daudé1-3/+3
Fix: hw/audio/soundhw.c:86:33: error: declaration shadows a variable in the global scope [-Werror,-Wshadow] void select_soundhw(const char *optarg, const char *audiodev) ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/getopt.h:77:14: note: previous declaration is here extern char *optarg; /* getopt(3) external variables */ ^ Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231004120019.93101-2-philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2023-10-06asc: generate silence if FIFO empty but engine still runningMark Cave-Ayland1-0/+19
MacOS (un)helpfully leaves the FIFO engine running even when all the samples have been written to the hardware, and expects the FIFO status flags and IRQ to be updated continuously. There is an additional problem in that not all audio backends guarantee an all-zero output when there is no FIFO data available, in particular the Windows dsound backend which re-uses its internal circular buffer causing the last played sound to loop indefinitely. Whilst this is effectively a bug in the Windows dsound backend, work around it for now using a simple heuristic: if the FIFO remains empty for half a cycle (~23ms) then continuously fill the generated buffer with empty silence. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-ID: <20231004083806.757242-9-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2023-10-06audio: add Apple Sound Chip (ASC) emulationMark Cave-Ayland4-0/+722
The Apple Sound Chip was primarily used by the Macintosh II to generate sound in hardware which was previously handled by the toolbox ROM with software interrupts. Implement both the standard ASC and also the enhanced ASC (EASC) functionality which is used in the Quadra 800. Note that whilst real ASC hardware uses AUDIO_FORMAT_S8, this implementation uses AUDIO_FORMAT_U8 instead because AUDIO_FORMAT_S8 is rarely used and not supported by some audio backends like PulseAudio and DirectSound when played directly with -audiodev out.mixing-engine=off. Co-developed-by: Laurent Vivier <laurent@vivier.eu> Co-developed-by: Volker Rümelin <vr_qemu@t-online.de> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-ID: <20231004083806.757242-8-mark.cave-ayland@ilande.co.uk> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2023-10-03audio: propagate Error * out of audio_initMartin Kletzander11-20/+43
Starting from audio_driver_init, propagate errors via Error ** so that audio_init_audiodevs can simply pass &error_fatal, and AUD_register_card can signal faiure. Signed-off-by: Martin Kletzander <mkletzan@redhat.com> [Reworked the audio/audio.c parts, while keeping Martin's hw/ changes. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-09-22hw/audio/lm4549: Add errp error reporting to init functionMartin Kletzander3-3/+5
This will be used in future commit. Signed-off-by: Martin Kletzander <mkletzan@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <be1bf295b3c6a3dee272b4b4e8115e37c2a772b5.1650874791.git.mkletzan@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-09-22hw/audio: Simplify hda audio initMartin Kletzander3-18/+20
No return values are used anywhere, so switch the functions to be void and add support for error reporting using errp for use in next patches. Signed-off-by: Martin Kletzander <mkletzan@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <cd1df4ad2a6fae969c4a02a77955c4a8c0d430b6.1650874791.git.mkletzan@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-09-08audio: spelling fixesMichael Tokarev4-9/+9
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-06-20meson: Replace softmmu_ss -> system_ssPhilippe Mathieu-Daudé1-14/+14
We use the user_ss[] array to hold the user emulation sources, and the softmmu_ss[] array to hold the system emulation ones. Hold the latter in the 'system_ss[]' array for parity with user emulation. Mechanical change doing: $ sed -i -e s/softmmu_ss/system_ss/g $(git grep -l softmmu_ss) Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230613133347.82210-10-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-03-08hw/audio/via-ac97: Basic implementation of audio playbackBALATON Zoltan2-6/+455
Add basic implementation of the AC'97 sound part used in VIA south bridge chips. Not all features of the device is emulated, only one playback channel is supported for now but this is enough to get sound output from some guests using this device on pegasos2. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Tested-by: Rene Engel <ReneEngel80@emailn.de> Message-Id: <63b99410895312f40e7be479f581da0805e605a1.1678188711.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/audio/ac97: Split off some definitions to a headerBALATON Zoltan2-42/+66
These can be shared with other AC97 implementations. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <6f0980fdc3753624be6f3935a6ab0a2dc1df4b30.1677445307.git.balaton@eik.bme.hu> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-02-27hw/audio/ac97: Replace container_of() by AC97() QOM cast macroPhilippe Mathieu-Daudé1-1/+1
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230220131837.26292-5-philmd@linaro.org>
2023-02-27hw/audio/es1370: Replace container_of() by ES1370() QOM cast macroPhilippe Mathieu-Daudé1-1/+2
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230220131837.26292-4-philmd@linaro.org>
2023-02-27hw/audio/es1370: Avoid forward-declaring ES1370StatePhilippe Mathieu-Daudé1-4/+3
To avoid forward-declaring ES1370State, declare ES1370 QOM definitions before its use in the chan_bits structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230220131837.26292-3-philmd@linaro.org>
2023-02-27hw/audio/hda-codec: Avoid forward-declaring HDAAudioStatePhilippe Mathieu-Daudé1-4/+3
To avoid forward-declaring HDAAudioState, declare HDA_AUDIO QOM definitions before its use in the HDAAudioStream structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230220131837.26292-2-philmd@linaro.org>
2023-02-27hw: Replace isa_get_irq() by isa_bus_get_irq() when ISABus is availablePhilippe Mathieu-Daudé3-7/+10
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230215161641.32663-4-philmd@linaro.org>
2023-02-27hw/isa: Rename isa_get_dma() -> isa_bus_get_dma()Philippe Mathieu-Daudé3-4/+4
isa_get_dma() returns a DMA channel handler from an ISABus. To emphasize this, rename it as isa_bus_get_dma(). Mechanical change using: $ sed -i -e 's/isa_get_dma/isa_bus_get_dma/g' \ $(git grep -l isa_get_dma) Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230215161641.32663-2-philmd@linaro.org>
2023-01-08include/hw/pci: Split pci_device.h off pci.hMarkus Armbruster3-3/+3
PCIDeviceClass and PCIDevice are defined in pci.h. Many users of the header don't actually need them. Similar structs live in their own headers: PCIBusClass and PCIBus in pci_bus.h, PCIBridge in pci_bridge.h, PCIHostBridgeClass and PCIHostState in pci_host.h, PCIExpressHost in pcie_host.h, and PCIERootPortClass, PCIEPort, and PCIESlot in pcie_port.h. Move PCIDeviceClass and PCIDeviceClass to new pci_device.h, along with the code that needs them. Adjust include directives. This also enables the next commit. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20221222100330.380143-6-armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-11-23hw/audio/intel-hda: Drop unnecessary prototypePeter Maydell1-2/+0
The only use of intel_hda_reset() is after its definition, so we don't need to separately declare its prototype at the top of the file; drop the unnecessary line. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20221014142632.2092404-3-peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-11-23hw/audio/intel-hda: don't reset codecs twicePeter Maydell1-3/+1
Currently the intel-hda device has a reset method which manually resets all the codecs by calling device_legacy_reset() on them. This means they get reset twice, once because child devices on a qbus get reset before the parent device's reset method is called, and then again because we're manually resetting them. Drop the manual reset call, and ensure that codecs are still reset when the guest does a reset via ICH6_GCTL_RESET by using device_cold_reset() (which resets all the devices on the qbus as well as the device itself) instead of a direct call to the reset function. This is a slight ordering change because the (only) codec reset now happens before the controller registers etc are reset, rather than once before and then once after, but the codec reset function hda_audio_reset() doesn't care. This lets us drop a use of device_legacy_reset(), which is deprecated. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20221014142632.2092404-2-peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-11hw/audio/cs4231a: Const'ify global tablesBernhard Beschow1-4/+4
The tables contain spcifically crafted constants for algorithms, so make them immutable. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220520180109.8224-3-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-05-25hw/audio/ac97: Remove unneeded local variablesBALATON Zoltan1-53/+49
Several functions have a local variable that is just a copy of one of the function parameters. This is unneeded complication so just get rid of these. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <d959aa0b267eb139a994e41ca0b7ba87d9cef7a9.1650706617.git.balaton@eik.bme.hu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-25hw/audio/ac97: Remove unimplemented reset functionsBALATON Zoltan1-16/+1
The warm_reset() and cold_reset() functions are not implemented and do nothing so no point in calling them or keep around as dead code. Therefore remove them for now. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Víctor Colombo <victor.colombo@eldorado.org.br> Message-Id: <cc6e99fd498a9ae358ebce787fc04ab6e8201879.1650706617.git.balaton@eik.bme.hu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-25hw/audio/ac97: Coding style fixes to avoid checkpatch errorsBALATON Zoltan1-373/+360
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Víctor Colombo <victor.colombo@eldorado.org.br> Message-Id: <62862a057e9c9ec0bb45248b2b9a3a1babb346a6.1650706617.git.balaton@eik.bme.hu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-14introduce -audio as a replacement for -soundhwPaolo Bonzini2-7/+10
-audio is used like "-audio pa,model=sb16". It is almost as simple as -soundhw, but it reuses the -audiodev parsing machinery and attaches an audiodev to the newly-created device. The main 'feature' is that it knows about adding the codec device for model=intel-hda, and adding the audiodev to the codec device. In the future, it could be extended to support default models or builtin devices, just like -nic, or even a default backend. For now, keep it simple. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-14soundhw: move help handling to vl.cPaolo Bonzini1-15/+9
This will allow processing "-audio model=help" even if the backend part of the option is missing. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-14soundhw: unify initialization for ISA and PCI soundhwPaolo Bonzini1-9/+14
Use qdev_new instead of distinguishing isa_create_simple/pci_create_simple. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-14soundhw: extract soundhw help to a separate functionPaolo Bonzini1-14/+19
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-14soundhw: remove ability to create multiple soundcardsPaolo Bonzini1-56/+32
The usefulness of enabling a dozen soundcards is dubious. Simplify the code by allowing a single instance of -soundhw, with no support for parsing either comma-separated values or 'soundhw all'. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-07pc: remove -soundhw pcspkPaolo Bonzini2-33/+4
The pcspk device is the only user of the init_isa function, and the only -soundhw option which does not create a new device (it hacks into the PCSpkState by hand). Remove it, since it was deprecated. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-22Merge tag 'pull-request-2022-03-21' of https://gitlab.com/thuth/qemu into ↵Peter Maydell1-3/+8
staging * Fix stack-overflow due to recursive DMA in intel-hda (CVE-2021-3611) * Fix heap overflow due to recursive DMA in sdhci code # gpg: Signature made Mon 21 Mar 2022 16:14:36 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2022-03-21' of https://gitlab.com/thuth/qemu: tests/qtest/fuzz-sdcard-test: Add reproducer for OSS-Fuzz (Issue 29225) hw/sd/sdhci: Prohibit DMA accesses to devices hw/sd/sdhci: Honor failed DMA transactions tests/qtest/intel-hda-test: Add reproducer for issue #542 hw/audio/intel-hda: Restrict DMA engine to memories (not MMIO devices) hw/audio/intel-hda: Do not ignore DMA overrun errors softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR softmmu/physmem: Simplify flatview_write and address_space_access_valid Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-03-21Use g_new() & friends where that makes obvious senseMarkus Armbruster1-1/+1
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Patch created mechanically with: $ spatch --in-place --sp-file scripts/coccinelle/use-g_new-etc.cocci \ --macro-file scripts/cocci-macro-file.h FILES... Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20220315144156.1595462-4-armbru@redhat.com> Reviewed-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
2022-03-21hw/audio/intel-hda: Restrict DMA engine to memories (not MMIO devices)Philippe Mathieu-Daudé1-1/+1
Issue #542 reports a reentrancy problem when the DMA engine accesses the HDA controller I/O registers. Fix by restricting the DMA engine to memories regions (forbidding MMIO devices such the HDA controller). Reported-by: OSS-Fuzz (Issue 28435) Reported-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/542 CVE: CVE-2021-3611 Message-Id: <20211218160912.1591633-3-philmd@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-03-21hw/audio/intel-hda: Do not ignore DMA overrun errorsPhilippe Mathieu-Daudé1-2/+7
Per the "High Definition Audio Specification" manual (rev. 1.0a), section "3.3.30 Offset 5Dh: RIRBSTS - RIRB Status": Response Overrun Interrupt Status (RIRBOIS): Hardware sets this bit to a 1 when an overrun occurs in the RIRB. An interrupt may be generated if the Response Overrun Interrupt Control bit is set. This bit will be set if the RIRB DMA engine is not able to write the incoming responses to memory before additional incoming responses overrun the internal FIFO. When hardware detects an overrun, it will drop the responses which overrun the buffer and set the RIRBOIS status bit to indicate the error condition. Optionally, if the RIRBOIC is set, the hardware will also generate an error to alert software to the problem. QEMU emulates the DMA engine with the stl_le_pci_dma() calls. This function returns a MemTxResult indicating whether the DMA access was successful. Handle any MemTxResult error as "DMA engine is not able to write the incoming responses to memory" and raise the Overrun Interrupt flag when this case occurs. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211218160912.1591633-2-philmd@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-03-08hw/isa: Inline and remove one-line isa_init_irq()Bernhard Beschow3-3/+3
isa_init_irq() has become a trivial one-line wrapper for isa_get_irq(). It can therefore be removed. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> (tpm_tis_isa) Acked-by: Corey Minyard <cminyard@mvista.com> (isa_ipmi_bt, isa_ipmi_kcs) Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20220301220037.76555-8-shentey@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220307134353.1950-14-philippe.mathieu.daude@gmail.com> Reviewed-by: Bernhard Beschow <shentey@gmail.com>
2022-01-28Remove unnecessary minimum_version_id_old fieldsPeter Maydell1-1/+0
The migration code will not look at a VMStateDescription's minimum_version_id_old field unless that VMSD has set the load_state_old field to something non-NULL. (The purpose of minimum_version_id_old is to specify what migration version is needed for the code in the function pointed to by load_state_old to be able to handle it on incoming migration.) We have exactly one VMSD which still has a load_state_old, in the PPC CPU; every other VMSD which sets minimum_version_id_old is doing so unnecessarily. Delete all the unnecessary ones. Commit created with: sed -i '/\.minimum_version_id_old/d' $(git grep -l '\.minimum_version_id_old') with the one legitimate use then hand-edited back in. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> --- It missed vmstate_ppc_cpu.
2022-01-20hw: Move MARVELL_88W8618 Kconfig from audio/ to arm/Philippe Mathieu-Daudé1-3/+0
The Marvell 88W8618 is a system-on-chip with an ARM core. We implement its audio codecs and network interface. Homogeneous SoC Kconfig are usually defined in the hw/$ARCH directory. Move it there. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20220107184429.423572-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-01-13hw/audio/intel-hda: fix stream resetVolker Rümelin1-1/+1
Quote from: High Definition Audio Specification 1.0a, section 3.3.35 Offset 80: {IOB}SDnCTL Stream Reset (SRST): Writing a 1 causes the corresponding stream to be reset. The Stream Descriptor registers (except the SRST bit itself) ... are reset. Change the code to reset the Stream Descriptor Control and Status registers except the SRST bit. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/757 Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20211226154017.6067-3-vr_qemu@t-online.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-12-31pci: Let ld*_pci_dma() propagate MemTxResultPhilippe Mathieu-Daudé1-1/+1
ld*_dma() returns a MemTxResult type. Do not discard it, return it to the caller. Update the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-24-philmd@redhat.com>
2021-12-31pci: Let ld*_pci_dma() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-1/+1
Let devices specify transaction attributes when calling ld*_pci_dma(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-22-philmd@redhat.com>
2021-12-31pci: Let st*_pci_dma() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-4/+6
Let devices specify transaction attributes when calling st*_pci_dma(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-21-philmd@redhat.com>
2021-12-31pci: Let pci_dma_rw() take MemTxAttrs argumentPhilippe Mathieu-Daudé1-1/+2
Let devices specify transaction attributes when calling pci_dma_rw(). Keep the default MEMTXATTRS_UNSPECIFIED in the few callers. Reviewed-by: Klaus Jensen <k.jensen@samsung.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20211223115554.3155328-10-philmd@redhat.com>
generated by cgit v1.1 at 2025-01-16 11:06:34 +0000