aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2020-07-21hw/nvram/fw_cfg: Let fw_cfg_add_from_generator() return boolean valuePhilippe Mathieu-Daudé1-4/+6
Commits b6d7e9b66f..a43770df5d simplified the error propagation. Similarly to commit 6fd5bef10b "qom: Make functions taking Error** return bool, not void", let fw_cfg_add_from_generator() return a boolean value, not void. This allow to simplify parse_fw_cfg() and fixes the error handling issue reported by Coverity (CID 1430396): In parse_fw_cfg(): Variable assigned once to a constant guards dead code. Local variable local_err is assigned only once, to a constant value, making it effectively constant throughout its scope. If this is not the intent, examine the logic to see if there is a missing assignment that would make local_err not remain constant. It's the call of fw_cfg_add_from_generator(): Error *local_err = NULL; fw_cfg_add_from_generator(fw_cfg, name, gen_id, errp); if (local_err) { error_propagate(errp, local_err); return -1; } return 0; If it fails, parse_fw_cfg() sets an error and returns 0, which is wrong. Harmless, because the only caller passes &error_fatal. Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: Coverity CID 1430396: 'Constant' variable guards dead code (DEADCODE) Fixes: 6552d87c48 ("softmmu/vl: Let -fw_cfg option take a 'gen_id' argument") Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200721131911.27380-3-philmd@redhat.com>
2020-07-21hw/nvram/fw_cfg: Simplify fw_cfg_add_from_generator() error propagationPhilippe Mathieu-Daudé1-2/+1
Document FWCfgDataGeneratorClass::get_data() return NULL on error, and non-NULL on success. This allow us to simplify fw_cfg_add_from_generator(). Since we don't need a local variable to propagate the error, we can remove the ERRP_GUARD() macro. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200721131911.27380-2-philmd@redhat.com>
2020-07-21qom: Change object_get_canonical_path_component() not to mallocMarkus Armbruster12-33/+21
object_get_canonical_path_component() returns a malloced copy of a property name on success, null on failure. 19 of its 25 callers immediately free the returned copy. Change object_get_canonical_path_component() to return the property name directly. Since modifying the name would be wrong, adjust the return type to const char *. Drop the free from the 19 callers become simpler, add the g_strdup() to the other six. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-4-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com>
2020-07-21hw/avr/boot: Fix memory leak in avr_load_firmware()Philippe Mathieu-Daudé1-1/+1
The value returned by qemu_find_file() must be freed. This fixes Coverity issue CID 1430449, which points out that the memory returned by qemu_find_file() is leaked. Fixes: Coverity CID 1430449 (RESOURCE_LEAK) Fixes: 7dd8f6fde4 ('hw/avr: Add support for loading ELF/raw binaries') Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael Rolnik <mrolnik@gmail.com> Tested-by: Michael Rolnik <mrolnik@gmail.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200714164257.23330-5-f4bug@amsat.org>
2020-07-21hw/net/xgmac: Fix buffer overflow in xgmac_enet_send()Mauro Matteo Cascella1-2/+12
A buffer overflow issue was reported by Mr. Ziming Zhang, CC'd here. It occurs while sending an Ethernet frame due to missing break statements and improper checking of the buffer size. Reported-by: Ziming Zhang <ezrakiez@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-21hw/net: Added plen fix for IPv6Andrew2-0/+37
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1708065 With network backend with 'virtual header' - there was an issue in 'plen' field. Overall, during TSO, 'plen' would be changed, but with 'vheader' this field should be set to the size of the payload itself instead of '0'. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-21qxl: fix modular builds with dtraceGerd Hoffmann1-0/+9
Checking the enable/disable state of tracepoints via trace_event_get_state_backends() does not work for modules. qxl checks the state for a small optimization (avoid g_strndup call in case log_buf will not be used anyway), so we can just drop that check for modular builds. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20200720100352.2477-2-kraxel@redhat.com>
2020-07-21xhci: fix valid.max_access_size to access address registersLaurent Vivier1-2/+2
QEMU XHCI advertises AC64 (64-bit addressing) but doesn't allow 64-bit mode access in "runtime" and "operational" MemoryRegionOps. Set the max_access_size based on sizeof(dma_addr_t) as AC64 is set. XHCI specs: "If the xHC supports 64-bit addressing (AC64 = ‘1’), then software should write 64-bit registers using only Qword accesses. If a system is incapable of issuing Qword accesses, then writes to the 64-bit address fields shall be performed using 2 Dword accesses; low Dword-first, high-Dword second. If the xHC supports 32-bit addressing (AC64 = ‘0’), then the high Dword of registers containing 64-bit address fields are unused and software should write addresses using only Dword accesses" The problem has been detected with SLOF, as linux kernel always accesses registers using 32-bit access even if AC64 is set and revealed by 5d971f9e6725 ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"") Suggested-by: Alexey Kardashevskiy <aik@au1.ibm.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-id: 20200721083322.90651-1-lvivier@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-07-21hw: Mark nd_table[] misuse in realize methods FIXMEMarkus Armbruster5-0/+5
nd_table[] contains NIC configuration for boards to pick up. Device code has no business looking there. Several devices do it anyway. Two of them already have a suitable FIXME comment: "allwinner-a10" and "msf2-soc". Copy it to the others: "allwinner-h3", "xlnx-versal", "xlnx,zynqmp", "sparc32-ledma", "riscv.sifive.u.soc". Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200715140440.3540942-3-armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-07-21msf2: Unbreak device-list-properties for "msf-soc"Markus Armbruster1-4/+5
Watch this: $ qemu-system-aarch64 -M ast2600-evb -S -display none -qmp stdio {"QMP": {"version": {"qemu": {"micro": 50, "minor": 0, "major": 5}, "package": "v5.0.0-2464-g3a9163af4e"}, "capabilities": ["oob"]}} {"execute": "qmp_capabilities"} {"return": {}} {"execute": "device-list-properties", "arguments": {"typename": "msf2-soc"}} Unsupported NIC model: ftgmac100 armbru@dusky:~/work/images$ echo $? 1 This is what breaks "make check SPEED=slow". Root cause is m2sxxx_soc_initfn()'s messing with nd_table[] via qemu_check_nic_model(). That's wrong. We fixed the exact same bug for device "allwinner-a10" in commit 8aabc5437b "hw/arm/allwinner-a10: Do not use nd_table in instance_init function". Fix this instance the same way: move the offending code to m2sxxx_soc_realize(), where it's less wrong, and add a FIXME comment. Fixes: 05b7374a58 ("msf2: Add EMAC block to SmartFusion2 SoC") Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200715140440.3540942-2-armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-07-20Merge remote-tracking branch ↵Peter Maydell3-38/+47
'remotes/pmaydell/tags/pull-target-arm-20200720' into staging target-arm queue: * virt: Don't enable MTE emulation by default * virt: Diagnose attempts to use MTE with memory-hotplug or KVM (rather than silently not working correctly) * util: Implement qemu_get_thread_id() for OpenBSD * qdev: Add doc comments for qdev_unrealize and GPIO functions, and standardize on doc-comments-in-header-file * hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize() * docs/system: Document canon-a1100, collie, gumstix, virt boards # gpg: Signature made Mon 20 Jul 2020 13:55:36 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200720: docs/system: Document the arm virt board docs/system: Briefly document gumstix boards docs/system: Briefly document collie board docs/system: Briefly document canon-a1100 board hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize() qdev: Document GPIO related functions qdev: Document qdev_unrealize() qdev: Move doc comments from qdev.c to qdev-core.h util: Implement qemu_get_thread_id() for OpenBSD hw/arm/virt: Disable memory hotplug when MTE is enabled hw/arm/virt: Error for MTE enabled with KVM hw/arm/virt: Enable MTE via a machine property Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize()Peter Maydell1-0/+2
In armsse_realize() we have a loop over [0, info->num_cpus), which indexes into various fixed-size arrays in the ARMSSE struct. This confuses Coverity, which warns that we might overrun those arrays (CID 1430326, 1430337, 1430371, 1430414, 1430430). This can't actually happen, because the info struct is always one of the entries in the armsse_variants[] array and num_cpus is either 1 or 2; we also already assert in armsse_init() that num_cpus is not too large. However, adding an assert to armsse_realize() like the one in armsse_init() should help Coverity figure out that these code paths aren't possible. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200713143716.9881-1-peter.maydell@linaro.org
2020-07-20qdev: Move doc comments from qdev.c to qdev-core.hPeter Maydell1-33/+0
The doc-comments which document the qdev API are split between the header file and the C source files, because as a project we haven't been consistent about where we put them. Move all the doc-comments in qdev.c to the header files, so that users of the APIs don't have to look at the implementation files for this information. In the process, unify them into our doc-comment format and expand on them in some cases to clarify expected use cases. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200711142425.16283-2-peter.maydell@linaro.org
2020-07-20hw/arm/virt: Disable memory hotplug when MTE is enabledRichard Henderson1-0/+5
When MTE is enabled, tag memory must exist for all RAM. It might be possible to simultaneously hot plug tag memory alongside the corresponding normal memory, but for now just disable hotplug. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200713213341.590275-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20hw/arm/virt: Error for MTE enabled with KVMRichard Henderson1-0/+6
While we expect KVM to support MTE at some future point, it certainly won't be ready in time for qemu 5.1. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200713213341.590275-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20hw/arm/virt: Enable MTE via a machine propertyRichard Henderson1-5/+34
Control this cpu feature via a machine property, much as we do with secure=on, since both require specialized support in the machine setup to be functional. Default MTE to off, since this feature implies extra overhead. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200713213341.590275-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.1-20200720' ↵Peter Maydell4-5/+86
into staging ppc patch queue 20200720 Here are some assorted fixes for qemu-5.1: * SLOF update with improved TPM handling, and fix for possible stack overflows on many-vcpu machines * Fix for NUMA distances on NVLink2 attached GPU memory nodes * Fixes to fail more gracefully on attempting to plug unsupported PCI bridge types * Don't allow pnv-psi device to be user created # gpg: Signature made Mon 20 Jul 2020 06:29:21 BST # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-5.1-20200720: pseries: Update SLOF firmware image spapr: Add a new level of NUMA for GPUs spapr_pci: Robustify support of PCI bridges ppc/pnv: Make PSI device types not user creatable Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20Merge remote-tracking branch 'remotes/cminyard/tags/for-qemu-i2c-5' into stagingPeter Maydell18-73/+79
Minor changes to: Add an SMBus config entry Cleanup/simplify/document some I2C interfaces # gpg: Signature made Thu 16 Jul 2020 18:46:55 BST # gpg: using RSA key FD0D5CE67CE0F59A6688268661F38C90919BFF81 # gpg: Good signature from "Corey Minyard <cminyard@mvista.com>" [unknown] # gpg: aka "Corey Minyard <minyard@acm.org>" [unknown] # gpg: aka "Corey Minyard <corey@minyard.net>" [unknown] # gpg: aka "Corey Minyard <minyard@mvista.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FD0D 5CE6 7CE0 F59A 6688 2686 61F3 8C90 919B FF81 * remotes/cminyard/tags/for-qemu-i2c-5: hw/i2c: Document the I2C qdev helpers hw/i2c: Rename i2c_create_slave() as i2c_slave_create_simple() hw/i2c: Rename i2c_realize_and_unref() as i2c_slave_realize_and_unref() hw/i2c: Rename i2c_try_create_slave() as i2c_slave_new() hw/i2c/aspeed_i2c: Simplify aspeed_i2c_get_bus() hw/i2c/Kconfig: Add an entry for the SMBus Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-20spapr: Add a new level of NUMA for GPUsReza Arbab3-5/+31
NUMA nodes corresponding to GPU memory currently have the same affinity/distance as normal memory nodes. Add a third NUMA associativity reference point enabling us to give GPU nodes more distance. This is guest visible information, which shouldn't change under a running guest across migration between different qemu versions, so make the change effective only in new (pseries > 5.0) machine types. Before, `numactl -H` output in a guest with 4 GPUs (nodes 2-5): node distances: node 0 1 2 3 4 5 0: 10 40 40 40 40 40 1: 40 10 40 40 40 40 2: 40 40 10 40 40 40 3: 40 40 40 10 40 40 4: 40 40 40 40 10 40 5: 40 40 40 40 40 10 After: node distances: node 0 1 2 3 4 5 0: 10 40 80 80 80 80 1: 40 10 80 80 80 80 2: 80 80 10 80 80 80 3: 80 80 80 10 80 80 4: 80 80 80 80 10 80 5: 80 80 80 80 80 10 These are the same distances as on the host, mirroring the change made to host firmware in skiboot commit f845a648b8cb ("numa/associativity: Add a new level of NUMA for GPU's"). Signed-off-by: Reza Arbab <arbab@linux.ibm.com> Message-Id: <20200716225655.24289-1-arbab@linux.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-07-20spapr_pci: Robustify support of PCI bridgesGreg Kurz1-0/+54
Some recent error handling cleanups unveiled issues with our support of PCI bridges: 1) QEMU aborts when using non-standard PCI bridge types, unveiled by commit 7ef1553dac "spapr_pci: Drop some dead error handling" $ qemu-system-ppc64 -M pseries -device pcie-pci-bridge Unexpected error in object_property_find() at qom/object.c:1240: qemu-system-ppc64: -device pcie-pci-bridge: Property '.chassis_nr' not found Aborted (core dumped) This happens because we assume all PCI bridge types to have a "chassis_nr" property. This property only exists with the standard PCI bridge type "pci-bridge" actually. We could possibly revert 7ef1553dac but it seems much simpler to check the presence of "chassis_nr" earlier. 2) QEMU abort if same "chassis_nr" value is used several times, unveiled by commit d2623129a7de "qom: Drop parameter @errp of object_property_add() & friends" $ qemu-system-ppc64 -M pseries -device pci-bridge,chassis_nr=1 \ -device pci-bridge,chassis_nr=1 Unexpected error in object_property_try_add() at qom/object.c:1167: qemu-system-ppc64: -device pci-bridge,chassis_nr=1: attempt to add duplicate property '40000100' to object (type 'container') Aborted (core dumped) This happens because we assume that "chassis_nr" values are unique, but nobody enforces that and we end up generating duplicate DRC ids. The PCI code doesn't really care for duplicate "chassis_nr" properties since it is only used to initialize the "Chassis Number Register" of the bridge, with no functional impact on QEMU. So, even if passing the same value several times might look weird, it never broke anything before, so I guess we don't necessarily want to enforce strict checking in the PCI code now. Workaround both issues in the PAPR code: check that the bridge has a unique and non null "chassis_nr" when plugging it into its parent bus. Fixes: 05929a6c5dfe ("spapr: Don't use bus number for building DRC ids") Fixes: 7ef1553dac ("spapr_pci: Drop some dead error handling") Fixes: d2623129a7de ("qom: Drop parameter @errp of object_property_add() & friends") Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159431476748.407044.16711294833569014964.stgit@bahia.lan> [dwg: Move check slightly to a better place] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-07-20ppc/pnv: Make PSI device types not user creatableGreg Kurz1-0/+1
QEMU aborts with -device pnv-psi-POWER8: $ qemu-system-ppc64 -device pnv-psi-POWER8 qemu-system-ppc64: hw/intc/xics.c:605: ics_realize: Assertion `ics->xics' failed. Aborted (core dumped) The Processor Service Interface Controller is an internal device. It should only be instantiated by the chip, which takes care of configuring the link required by the ICS object in the case of POWER8. It doesn't make sense for a user to specify it on the command line. Note that the PSI model for POWER8 was added 3 yrs ago but the devices weren't available on the command line because of a bug that was fixed by recent commit 2f35254aa0 ("pnv/psi: Correct the pnv-psi* devices not to be sysbus devices"). Fixes: 54f59d786c ("ppc/pnv: Add cut down PSI bridge model and hookup external interrupt") Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <159413975752.169116.5808968580649255382.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-07-17ipmi: add SET_SENSOR_READING commandCédric Le Goater1-0/+223
SET_SENSOR_READING is a complex IPMI command (see IPMI spec 35.17) which enables the host software to set the reading value and the event status of sensors supporting it. Below is a proposal for all the operations (reading, assert, deassert, event data) with the following limitations : - No event are generated for threshold-based sensors. - The case in which the BMC needs to generate its own events is not supported. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Corey Minyard <cminyard@mvista.com> Message-Id: <20191118092429.16149-1-clg@kaod.org> [Moved the break statement for case SENSOR_GEN_EVENT_DATA above the closing brace to keep the indention consistent.] Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16Merge remote-tracking branch ↵Peter Maydell2-2/+2
'remotes/kraxel/tags/fixes-20200716-pull-request' into staging fixes: usb storage regression, vfio display ramfb bug # gpg: Signature made Thu 16 Jul 2020 10:30:58 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20200716-pull-request: usb: fix storage regression vfio: fix use-after-free in display Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-16hw/i2c: Rename i2c_create_slave() as i2c_slave_create_simple()Philippe Mathieu-Daudé15-52/+53
We use "create_simple" names for functions that allocate, initialize, configure and realize device objects: pci_create_simple(), isa_create_simple(), usb_create_simple(). For consistency, rename i2c_create_slave() as i2c_slave_create_simple(). Since we have to update all the callers, also let it return a I2CSlave object. Suggested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-5-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c: Rename i2c_realize_and_unref() as i2c_slave_realize_and_unref()Philippe Mathieu-Daudé2-7/+9
The other i2c functions are called i2c_slave_FOO(). Rename as i2c_slave_realize_and_unref() to be consistent. Suggested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-4-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c: Rename i2c_try_create_slave() as i2c_slave_new()Philippe Mathieu-Daudé2-8/+7
We use "new" names for functions that allocate and initialize device objects: pci_new(), isa_new(), usb_new(). Let's call this one i2c_slave_new(). Since we have to update all the callers, also let it return a I2CSlave object. Suggested-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-3-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c/aspeed_i2c: Simplify aspeed_i2c_get_bus()Philippe Mathieu-Daudé2-37/+36
All the callers of aspeed_i2c_get_bus() have a AspeedI2CState and cast it to a DeviceState with DEVICE(), then aspeed_i2c_get_bus() cast the DeviceState to an AspeedI2CState with ASPEED_I2C()... Simplify aspeed_i2c_get_bus() callers by using AspeedI2CState argument. Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200705224154.16917-2-f4bug@amsat.org> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16hw/i2c/Kconfig: Add an entry for the SMBusPhilippe Mathieu-Daudé2-3/+8
The System Management Bus is more or less a derivative of the I2C bus, thus the Kconfig entry depends of I2C. Not all boards providing an I2C bus support SMBus. Use two different Kconfig entries to be able to select I2C without selecting SMBus. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20191231183216.6781-6-philmd@redhat.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
2020-07-16Merge remote-tracking branch ↵Peter Maydell1-1/+4
'remotes/stefanberger/tags/pull-tpm-2020-07-15-1' into staging Merge tpm 2020/07/15 v1 # gpg: Signature made Wed 15 Jul 2020 20:16:21 BST # gpg: using RSA key B818B9CADF9089C2D5CEC66B75AD65802A0B4211 # gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B818 B9CA DF90 89C2 D5CE C66B 75AD 6580 2A0B 4211 * remotes/stefanberger/tags/pull-tpm-2020-07-15-1: tests: tpm: Skip over pcrUpdateCounter byte in result comparison tpm: tpm_spapr: Exit on TPM backend failures Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-16usb: fix storage regressionGerd Hoffmann1-2/+1
Fix the contition to figure whenever we need to wait for more data or not. Simply check the mode, if we are not in DATAIN state any more we are done already and don't need to go ASYNC. Fixes: 7ad3d51ebb8a ("usb: add short-packet handling to usb-storage driver") Reported-by: Sai Pavan Boddu <saipava@xilinx.com> Tested-by: Paul Zimmerman <pauldzim@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20200713062712.1476-1-kraxel@redhat.com
2020-07-16vfio: fix use-after-free in displayGerd Hoffmann1-0/+1
Calling ramfb_display_update() might replace the DisplaySurface with the boot display, which in turn will free the currently active DisplaySurface. So clear our DisplaySurface pinter (dpy->region.surface pointer) to (a) avoid use-after-free and (b) force replacing the boot display with the real display when switching back. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Acked-by: Alex Williamson <alex.williamson@redhat.com> Message-id: 20200713124520.23266-1-kraxel@redhat.com
2020-07-15tpm: tpm_spapr: Exit on TPM backend failuresStefan Berger1-1/+4
Exit on TPM backend failures in the same way as the TPM CRB and TIS device models do. With this change we now get an error report when the backend did not start up properly: error: internal error: qemu unexpectedly closed the monitor: 2020-07-07T12:49:28.333928Z qemu-system-ppc64: tpm-emulator: \ TPM result for CMD_INIT: 0x101 operation failed Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20200707201625.4177419-2-stefanb@linux.vnet.ibm.com
2020-07-15ftgmac100: fix dblac write testerik-smit1-6/+8
The test of the write of the dblac register was testing the old value instead of the new value. This would accept the write of an invalid value but subsequently refuse any following valid writes. Signed-off-by: erik-smit <erik.lucas.smit@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-15hw/net: Added CSO for IPv6Andrew1-3/+12
Added fix for checksum offload for IPv6 if a backend doesn't have a virtual header. This patch is a part of IPv6 fragmentation. Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-15virtio-net: fix removal of failover deviceJuan Quintela1-0/+1
If you have a networking device and its virtio failover device, and you remove them in this order: - virtio device - the real device You get qemu crash. See bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1820120 Bug exist on qemu 4.2 and 5.0. But in 5.0 don't shows because commit 77b06bba62034a87cc61a9c8de1309ae3e527d97 somehow papers over it. CC: Jason Wang <jasowang@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-15Merge remote-tracking branch ↵Peter Maydell1-19/+67
'remotes/philmd-gitlab/tags/sdcard-CVE-2020-13253-pull-request' into staging Fix CVE-2020-13253 By using invalidated address, guest can do out-of-bounds accesses. These patches fix the issue by only allowing SD card image sizes power of 2, and not switching to SEND_DATA state when the address is invalid (out of range). This issue was found using QEMU fuzzing mode (using --enable-fuzzing, see docs/devel/fuzzing.txt) and reported by Alexander Bulekov. Reproducer: https://bugs.launchpad.net/qemu/+bug/1880822/comments/1 CI jobs results: . https://cirrus-ci.com/build/5157142548185088 . https://gitlab.com/philmd/qemu/-/pipelines/166381731 . https://travis-ci.org/github/philmd/qemu/builds/707956535 # gpg: Signature made Tue 14 Jul 2020 14:54:44 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/sdcard-CVE-2020-13253-pull-request: hw/sd/sdcard: Do not switch to ReceivingData if address is invalid hw/sd/sdcard: Update coding style to make checkpatch.pl happy hw/sd/sdcard: Do not allow invalid SD card sizes hw/sd/sdcard: Simplify realize() a bit hw/sd/sdcard: Restrict Class 6 commands to SCSD cards tests/acceptance/boot_linux: Expand SD card image to power of 2 tests/acceptance/boot_linux: Tag tests using a SD card with 'device:sd' docs/orangepi: Add instructions for resizing SD image to power of two MAINTAINERS: Cc qemu-block mailing list Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-14hw/sd/sdcard: Do not switch to ReceivingData if address is invalidPhilippe Mathieu-Daudé1-14/+24
Only move the state machine to ReceivingData if there is no pending error. This avoids later OOB access while processing commands queued. "SD Specifications Part 1 Physical Layer Simplified Spec. v3.01" 4.3.3 Data Read Read command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR occurred and no data transfer is performed. 4.3.4 Data Write Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR occurred and no data transfer is performed. WP_VIOLATION errors are not modified: the error bit is set, we stay in receive-data state, wait for a stop command. All further data transfer is ignored. See the check on sd->card_status at the beginning of sd_read_data() and sd_write_data(). Fixes: CVE-2020-13253 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> Buglink: https://bugs.launchpad.net/qemu/+bug/1880822 Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630133912.9428-6-f4bug@amsat.org>
2020-07-14hw/sd/sdcard: Update coding style to make checkpatch.pl happyPhilippe Mathieu-Daudé1-8/+16
To make the next commit easier to review, clean this code first. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200630133912.9428-3-f4bug@amsat.org>
2020-07-14hw/sd/sdcard: Do not allow invalid SD card sizesPhilippe Mathieu-Daudé1-0/+25
QEMU allows to create SD card with unrealistic sizes. This could work, but some guests (at least Linux) consider sizes that are not a power of 2 as a firmware bug and fix the card size to the next power of 2. While the possibility to use small SD card images has been seen as a feature, it became a bug with CVE-2020-13253, where the guest is able to do OOB read/write accesses past the image size end. In a pair of commits we will fix CVE-2020-13253 as: Read command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR occurred and no data transfer is performed. Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR occurred and no data transfer is performed. WP_VIOLATION errors are not modified: the error bit is set, we stay in receive-data state, wait for a stop command. All further data transfer is ignored. See the check on sd->card_status at the beginning of sd_read_data() and sd_write_data(). While this is the correct behavior, in case QEMU create smaller SD cards, guests still try to access past the image size end, and QEMU considers this is an invalid address, thus "all further data transfer is ignored". This is wrong and make the guest looping until eventually timeouts. Fix by not allowing invalid SD card sizes (suggesting the expected size as a hint): $ qemu-system-arm -M orangepi-pc -drive file=rootfs.ext2,if=sd,format=raw qemu-system-arm: Invalid SD card size: 60 MiB SD card size has to be a power of 2, e.g. 64 MiB. You can resize disk images with 'qemu-img resize <imagefile> <new-size>' (note that this will lose data if you make the image smaller than it currently is). Cc: qemu-stable@nongnu.org Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20200713183209.26308-8-f4bug@amsat.org>
2020-07-14hw/sd/sdcard: Simplify realize() a bitPhilippe Mathieu-Daudé1-5/+5
We don't need to check if sd->blk is set twice. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630133912.9428-18-f4bug@amsat.org>
2020-07-14hw/sd/sdcard: Restrict Class 6 commands to SCSD cardsPhilippe Mathieu-Daudé1-0/+5
Only SCSD cards support Class 6 (Block Oriented Write Protection) commands. "SD Specifications Part 1 Physical Layer Simplified Spec. v3.01" 4.3.14 Command Functional Difference in Card Capacity Types * Write Protected Group SDHC and SDXC do not support write-protected groups. Issuing CMD28, CMD29 and CMD30 generates the ILLEGAL_COMMAND error. Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630133912.9428-7-f4bug@amsat.org>
2020-07-13hw/char: Convert the Ibex UART to use the registerfields APIAlistair Francis1-65/+65
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 06372c9cdeec715077899e71c858d9f0a2a3395b.1594332223.git.alistair.francis@wdc.com Message-Id: <06372c9cdeec715077899e71c858d9f0a2a3395b.1594332223.git.alistair.francis@wdc.com>
2020-07-13hw/char: Convert the Ibex UART to use the qdev Clock modelAlistair Francis1-3/+27
Conver the Ibex UART to use the recently added qdev-clock functions. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: b0136fad870a29049959ec161c1217b967d7e19d.1594332223.git.alistair.francis@wdc.com Message-Id: <b0136fad870a29049959ec161c1217b967d7e19d.1594332223.git.alistair.francis@wdc.com>
2020-07-13hw/riscv: Modify MROM size to end at 0x10000Bin Meng3-3/+3
At present the size of Mask ROM for sifive_u / spike / virt machines is set to 0x11000, which ends at an unusual address. This changes the size to 0xf000 so that it ends at 0x10000. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <1594289144-24723-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-13RISC-V: Support 64 bit start addressAtish Patra2-2/+10
Even though the start address in ROM code is declared as a 64 bit address for RV64, it can't be used as upper bits are set to zero in ROM code. Update the ROM code correctly to reflect the 64bit value. Signed-off-by: Atish Patra <atish.patra@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20200701183949.398134-5-atish.patra@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-13riscv: Add opensbi firmware dynamic supportAtish Patra4-15/+72
OpenSBI is the default firmware in Qemu and has various firmware loading options. Currently, qemu loader uses fw_jump which has a compile time pre-defined address where fdt & kernel image must reside. This puts a constraint on image size of the Linux kernel depending on the fdt location and available memory. However, fw_dynamic allows the loader to specify the next stage location (i.e. Linux kernel/U-Boot) in memory and other configurable boot options available in OpenSBI. Add support for OpenSBI dynamic firmware loading support. This doesn't break existing setup and fw_jump will continue to work as it is. Any other firmware will continue to work without any issues as long as it doesn't expect anything specific from loader in "a2" register. Signed-off-by: Atish Patra <atish.patra@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20200701183949.398134-4-atish.patra@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-13RISC-V: Copy the fdt in dram instead of ROMAtish Patra4-32/+63
Currently, the fdt is copied to the ROM after the reset vector. The firmware has to copy it to DRAM. Instead of this, directly copy the device tree to a pre-computed dram address. The device tree load address should be as far as possible from kernel and initrd images. That's why it is kept at the end of the DRAM or 4GB whichever is lesser. Signed-off-by: Atish Patra <atish.patra@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20200701183949.398134-3-atish.patra@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-13riscv: Unify Qemu's reset vector code pathAtish Patra4-76/+52
Currently, all riscv machines except sifive_u have identical reset vector code implementations with memory addresses being different for all machines. They can be easily combined into a single function in common code. Move it to common function and let all the machines use the common function. Signed-off-by: Atish Patra <atish.patra@wdc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Bin Meng <bin.meng@windriver.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20200701183949.398134-2-atish.patra@wdc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-13hw/riscv: virt: Sort the SoC memmap table entriesBin Meng1-3/+3
Adjust the PCIe memory maps to follow the order. Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <1593746511-19517-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-13Merge remote-tracking branch ↵Peter Maydell1-2/+2
'remotes/kraxel/tags/fixes-20200713-pull-request' into staging bugfixes for audio, usb, ui and docs. # gpg: Signature made Mon 13 Jul 2020 15:10:35 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20200713-pull-request: usb: fix usb-host build on windows. ui: fix vc_chr_write call in text_console_do_init docs/qdev-device-use: Clean up the sentences related to -usbdevice ossaudio: fix out of bounds write Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-01-08 16:53:27 +0000