aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2020-05-27ppc/spapr: add a POWER10 CPU modelCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20200507073855.2485680-1-clg@kaod.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-05-27ppc/pnv: Fix NMI system reset SRR1 valueNicholas Piggin
Commit a77fed5bd926 ("ppc/pnv: Add support for NMI interface") got the SRR1 setting wrong for sresets that hit outside of power-save states. Fix this, better documenting the source for the bit definitions. Fixes: 01b552b05b0f ("ppc/pnv: Add support for NMI interface") Cc: Cédric Le Goater <clg@kaod.org> Cc: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20200507114824.788942-1-npiggin@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> [dwg: Fixed up some tab indentation] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-05-26Merge remote-tracking branch 'remotes/gkurz/tags/9p-next-2020-05-26' into ↵Peter Maydell
staging - fix build with musl libc - fix potential deadlock of QEMU main event loop (cannot be hit with linux client) - revert 9pfs reply truncation (LP 1877688) - xen backend waits for client to free space on the reply ring instead of truncating or disconnecting # gpg: Signature made Tue 26 May 2020 10:36:23 BST # gpg: using RSA key B4828BAF943140CEF2A3491071D4D5E5822F73D6 # gpg: Good signature from "Greg Kurz <groug@kaod.org>" [full] # gpg: aka "Gregory Kurz <gregory.kurz@free.fr>" [full] # gpg: aka "[jpeg image of size 3330]" [full] # Primary key fingerprint: B482 8BAF 9431 40CE F2A3 4910 71D4 D5E5 822F 73D6 * remotes/gkurz/tags/9p-next-2020-05-26: xen/9pfs: increase max ring order to 9 xen/9pfs: yield when there isn't enough room on the ring Revert "9p: init_in_iov_from_pdu can truncate the size" 9p: Lock directory streams with a CoMutex 9pfs: include linux/limits.h for XATTR_SIZE_MAX Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-26hw/mips/mips_fulong2e: Remove unused 'audio/audio.h' includePhilippe Mathieu-Daudé
The Fuloong machine never had to use "audio/audio.h", remove it. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Huacai Chen <chenhc@lemote.com> Message-id: 20200515084209.9419-1-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-25xen/9pfs: increase max ring order to 9Stefano Stabellini
The max order allowed by the protocol is 9. Increase the max order supported by QEMU to 9 to increase performance. Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20200521192627.15259-3-sstabellini@kernel.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2020-05-25xen/9pfs: yield when there isn't enough room on the ringStefano Stabellini
Instead of truncating replies, which is problematic, wait until the client reads more data and frees bytes on the reply ring. Do that by calling qemu_coroutine_yield(). The corresponding qemu_coroutine_enter_if_inactive() is called from xen_9pfs_bh upon receiving the next notification from the client. We need to be careful to avoid races in case xen_9pfs_bh and the coroutine are both active at the same time. In xen_9pfs_bh, wait until either the critical section is over (ring->co == NULL) or until the coroutine becomes inactive (qemu_coroutine_yield() was called) before continuing. Then, simply wake up the coroutine if it is inactive. Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20200521192627.15259-2-sstabellini@kernel.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2020-05-25Revert "9p: init_in_iov_from_pdu can truncate the size"Stefano Stabellini
This reverts commit 16724a173049ac29c7b5ade741da93a0f46edff7. It causes https://bugs.launchpad.net/bugs/1877688. Signed-off-by: Stefano Stabellini <stefano.stabellini@xilinx.com> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20200521192627.15259-1-sstabellini@kernel.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2020-05-25hw/audio/gus: Use AUDIO_HOST_ENDIANNESS definition from 'audio/audio.h'Philippe Mathieu-Daudé
Use the generic AUDIO_HOST_ENDIANNESS definition instead of a custom one. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200505100750.27332-1-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-25es1370: check total frame count against current framePrasad J Pandit
A guest user may set channel frame count via es1370_write() such that, in es1370_transfer_audio(), total frame count 'size' is lesser than the number of frames that are processed 'cnt'. int cnt = d->frame_cnt >> 16; int size = d->frame_cnt & 0xffff; if (size < cnt), it results in incorrect calculations leading to OOB access issue(s). Add check to avoid it. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20200514200608.1744203-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-259p: Lock directory streams with a CoMutexGreg Kurz
Locking was introduced in QEMU 2.7 to address the deprecation of readdir_r(3) in glibc 2.24. It turns out that the frontend code is the worst place to handle a critical section with a pthread mutex: the code runs in a coroutine on behalf of the QEMU mainloop and then yields control, waiting for the fsdev backend to process the request in a worker thread. If the client resends another readdir request for the same fid before the previous one finally unlocked the mutex, we're deadlocked. This never bit us because the linux client serializes readdir requests for the same fid, but it is quite easy to demonstrate with a custom client. A good solution could be to narrow the critical section in the worker thread code and to return a copy of the dirent to the frontend, but this causes quite some changes in both 9p.c and codir.c. So, instead of that, in order for people to easily backport the fix to older QEMU versions, let's simply use a CoMutex since all the users for this sit in coroutines. Fixes: 7cde47d4a89d ("9p: add locking to V9fsDir") Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <158981894794.109297.3530035833368944254.stgit@bahia.lan> Signed-off-by: Greg Kurz <groug@kaod.org>
2020-05-259pfs: include linux/limits.h for XATTR_SIZE_MAXDan Robertson
linux/limits.h should be included for the XATTR_SIZE_MAX definition used by v9fs_xattrcreate. Fixes: 3b79ef2cf488 ("9pfs: limit xattr size in xattrcreate") Signed-off-by: Dan Robertson <dan@dlrobertson.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20200515203015.7090-2-dan@dlrobertson.com> Signed-off-by: Greg Kurz <groug@kaod.org>
2020-05-22hw/block/pflash: Check return value of blk_pwrite()Mansour Ahmadi
When updating the PFLASH file contents, we should check for a possible failure of blk_pwrite(). Similar to commit 3a688294e. Reported-by: Coverity (CID 1357678 CHECKED_RETURN) Signed-off-by: Mansour Ahmadi <mansourweb@gmail.com> Message-Id: <20200408003552.58095-1-mansourweb@gmail.com> [PMD: Add missing "qemu/error-report.h" include and TODO comment] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-05-22hw/block/pflash_cfi01: Rename 'reset_flash' label as 'mode_read_array'Philippe Mathieu-Daudé
Rename the 'reset_flash' as 'mode_read_array' to make explicit we do not reset the device, we simply set its internal state machine in the READ_ARRAY mode. We do not reset the status register error bits, as a device reset would do. Reviewed-by: John Snow <jsnow@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190716221555.11145-5-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-05-22hw/block/pflash_cfi01: Document use of non-CFI compliant command '0x00'Philippe Mathieu-Daudé
The command 0x00 is used by this model since its origin (commit 05ee37ebf630). In this commit the command is described with a amusing '/* ??? */' comment, probably meaning 'FIXME'. switch (cmd) { case 0x00: /* ??? */ ... This comment survived 12 years because the 0x00 value is indeed not specified by the CFI open standard (as of this commit). The 'cmd' field is transfered during migration. To keep the migration feature working with older QEMU version, we have to take a lot of care with migrated field. We figured out it is too late to remove a non-specified value from this model (this would make migration review very complex). It is however not too late to improve the documentation. Add few comments to remember this is a special value related to QEMU, and we won't find information about it on the CFI spec. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190716221555.11145-3-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-05-22hw/block/pflash_cfi01: Removed an unused timerPhilippe Mathieu-Daudé
The 'CFI02' NOR flash was introduced in commit 29133e9a0fff, with timing modelled. One year later, the CFI01 model was introduced (commit 05ee37ebf630) based on the CFI02 model. As noted in the header, "It does not support timings". 12 years later, we never had to model the device timings. Time to remove the unused timer, we can still add it back if required. Suggested-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Wei Yang <richardw.yang@linux.intel.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Laszlo Ersek <lersek@redhat.com> [Laszlo Ersek: Regression tested EDK2 OVMF IA32X64, ArmVirtQemu Aarch64 https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg04373.html] Message-Id: <20190716221555.11145-2-philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-05-21ARM: PL061: Introduce N_GPIOSGeert Uytterhoeven
Add a definition for the number of GPIO lines controlled by a PL061 instance, and use it instead of the hardcoded magic value 8. Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200519085143.1376-1-geert+renesas@glider.be Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/timer/exynos4210_mct: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask(). Per the datasheet "Exynos 4412 RISC Microprocessor Rev 1.00" Chapter 25 "Multi Core Timer (MCT)" figure 1 and table 4, the default value on the APB bus is 0. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200518140309.5220-5-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/char/xilinx_uartlite: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask(). Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200518140309.5220-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/pxa2xx: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200518140309.5220-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/integratorcp: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200518140309.5220-2-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/fsl-imx7: Connect watchdog interruptsGuenter Roeck
i.MX7 supports watchdog pretimeout interupts. With this commit, the watchdog in mcimx7d-sabre is fully operational, including pretimeout support. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-9-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/fsl-imx7: Instantiate various unimplemented devicesGuenter Roeck
Instantiating PWM, CAN, CAAM, and OCOTP devices is necessary to avoid crashes when booting mainline Linux. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-8-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/fsl-imx6ul: Connect watchdog interruptsGuenter Roeck
With this commit, the watchdog on mcimx6ul-evk is fully operational, including pretimeout support. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-7-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/fsl-imx6: Connect watchdog interruptsGuenter Roeck
With this patch applied, the watchdog in the sabrelite emulation is fully operational, including pretimeout support. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-6-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/fsl-imx31: Wire up watchdogGuenter Roeck
With this patch, the watchdog on i.MX31 emulations is fully operational. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-5-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/arm/fsl-imx25: Wire up watchdogGuenter Roeck
With this commit, the watchdog on imx25-pdk is fully operational, including pretimeout support. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-4-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw/watchdog: Implement full i.MX watchdog supportGuenter Roeck
Implement full support for the watchdog in i.MX systems. Pretimeout support is optional because the watchdog hardware on i.MX31 does not support pretimeouts. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-3-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added Property array terminator entry] Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-21hw: Move i.MX watchdog driver to hw/watchdogGuenter Roeck
In preparation for a full implementation, move i.MX watchdog driver from hw/misc to hw/watchdog. While at it, add the watchdog files to MAINTAINERS. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20200517162135.110364-2-linux@roeck-us.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-19Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell
Block layer patches: - Introduce real BdrvChildRole - blk/bdrv_make_empty() functions instead of calling callbacks directly - mirror: Make sure that source and target size match - block-copy: Fix uninitialized variable - block/replication: Avoid cancelling the job twice - ahci: Log lost IRQs - iotests: Run pylint and mypy in a testcase - iotests: log messages from notrun() # gpg: Signature made Mon 18 May 2020 18:05:32 BST # gpg: using RSA key DC3DEB159A9AF95D3D7456FE7F09B272C88F2FD6 # gpg: issuer "kwolf@redhat.com" # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full] # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (52 commits) hw: Use QEMU_IS_ALIGNED() on parallel flash block size iotests/030: Reduce run time by unthrottling job earlier hw/ide/ahci: Log lost IRQs iotests: log messages from notrun() block/block-copy: Simplify block_copy_do_copy() block/block-copy: Fix uninitialized variable in block_copy_task_entry block: Drop @child_class from bdrv_child_perm() block: Pass BdrvChildRole in remaining cases block: Drop child_file block: Drop bdrv_format_default_perms() block: Make bdrv_filter_default_perms() static block: Use bdrv_default_perms() tests: Use child_of_bds instead of child_file block: Use child_of_bds in remaining places block: Make filter drivers use child_of_bds block: Make format drivers use child_of_bds block: Drop child_backing block: Make backing files child_of_bds children block: Drop child_format block: Switch child_format users to child_of_bds ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-18hw: Use QEMU_IS_ALIGNED() on parallel flash block sizePhilippe Mathieu-Daudé
Use the QEMU_IS_ALIGNED() macro to verify the flash block size is properly aligned. It is quicker to process when reviewing. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200511205246.24621-1-philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-05-18hw/ide/ahci: Log lost IRQsPhilippe Mathieu-Daudé
One might find interesting to look at AHCI IRQs. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200504094858.5975-1-f4bug@amsat.org> Reviewed-by: John Snow <jsnow@redhat.com> Acked-by: John Snow <jsnow@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-05-18ramfb: fix size calculationGerd Hoffmann
size calculation isn't correct with guest-supplied stride, the last display line isn't accounted for correctly. For the typical case of stride > linesize (add padding) we error on the safe side (calculated size is larger than actual size). With stride < linesize (scanlines overlap) the calculated size is smaller than the actual size though so our guest memory mapping might end up being too small. While being at it also fix ramfb_create_display_surface to use hwaddr for the parameters. That way all calculation are done with hwaddr type and we can't get funny effects from type castings. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-7-kraxel@redhat.com
2020-05-18ramfb: add sanity checks to ramfb_create_display_surfaceGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-6-kraxel@redhat.com
2020-05-18ramfb: don't update RAMFBState on errorsGerd Hoffmann
Store width & height & surface in local variables. Update RAMFBState with the new values only in case the ramfb_create_display_surface() call succeeds. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-5-kraxel@redhat.com
2020-05-18ramfb: drop leftover debug messageGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-4-kraxel@redhat.com
2020-05-18Revert "hw/display/ramfb: lock guest resolution after it's set"Gerd Hoffmann
This reverts commit a9e0cb67b7f4c485755659f9b764c38b5f970de4. This breaks OVMF. Reproducer: Just hit 'ESC' at early boot to enter firmware setup. OVMF wants switch from (default) 800x600 to 640x480 for that, and this patch blocks it. Cc: Hou Qiming <hqm03ster@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-3-kraxel@redhat.com
2020-05-18Revert "hw/display/ramfb: initialize fw-config space with xres/ yres"Gerd Hoffmann
This reverts commit f79081b4b71b72640bedd40a7cd76f864c8287f1. Patch has broken byteorder handling: RAMFBCfg fields are in bigendian byteorder, the reset function doesn't care so native byteorder is used instead. Given this went unnoticed so far the feature is obviously unused, so just revert the patch. Cc: Hou Qiming <hqm03ster@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-2-kraxel@redhat.com
2020-05-18hw/display: Include local 'framebuffer.h'Philippe Mathieu-Daudé
The "framebuffer.h" header is not an exported include. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <huth@tuxfamily.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200504082003.16298-2-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-18ati-vga: Do not allow unaligned access via index registerBALATON Zoltan
According to docs bits 1 and 0 of MM_INDEX are hard coded to 0 so unaligned access via this register should not be possible. This also fixes problems reported in bug #1878134. Buglink: https://bugs.launchpad.net/qemu/+bug/1878134 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Alexander Bulekov <alxndr@bu.edu> Acked-by: Alexander Bulekov <alxndr@bu.edu> Message-id: 20200516132352.39E9374594E@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-15hw: Remove unnecessary DEVICE() castPhilippe Mathieu-Daudé
The DEVICE() macro is defined as: #define DEVICE(obj) OBJECT_CHECK(DeviceState, (obj), TYPE_DEVICE) which expands to: ((DeviceState *)object_dynamic_cast_assert((Object *)(obj), (name), __FILE__, __LINE__, __func__)) This assertion can only fail when @obj points to something other than its stated type, i.e. when we're in undefined behavior country. Remove the unnecessary DEVICE() casts when we already know the pointer is of DeviceState type. Patch created mechanically using spatch with this script: @@ typedef DeviceState; DeviceState *s; @@ - DEVICE(s) + s Acked-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Paul Durrant <paul@xen.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: John Snow <jsnow@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200512070020.22782-4-f4bug@amsat.org>
2020-05-15various: Remove unnecessary OBJECT() castPhilippe Mathieu-Daudé
The OBJECT() macro is defined as: #define OBJECT(obj) ((Object *)(obj)) Remove the unnecessary OBJECT() casts when we already know the pointer is of Object type. Patch created mechanically using spatch with this script: @@ typedef Object; Object *o; @@ - OBJECT(o) + o Acked-by: Cornelia Huck <cohuck@redhat.com> Acked-by: Corey Minyard <cminyard@mvista.com> Acked-by: John Snow <jsnow@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200512070020.22782-3-f4bug@amsat.org> [Trivial rebase conflict in hw/s390x/sclp.c resolved]
2020-05-15qom: Drop @errp parameter of object_property_del()Markus Armbruster
Same story as for object_property_add(): the only way object_property_del() can fail is when the property with this name does not exist. Since our property names are all hardcoded, failure is a programming error, and the appropriate way to handle it is passing &error_abort. Most callers do that, the commit before previous fixed one that didn't (and got the error handling wrong), and the two remaining exceptions ignore errors. Drop the @errp parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-19-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-05-15spapr_pci: Drop some dead error handlingMarkus Armbruster
chassis_from_bus() uses object_property_get_uint() to get property "chassis_nr" of the bridge device. Failure would be a programming error. Pass &error_abort, and simplify its callers. Cc: David Gibson <david@gibson.dropbear.id.au> Cc: qemu-ppc@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-18-armbru@redhat.com>
2020-05-15qdev: Unrealize must not failMarkus Armbruster
Devices may have component devices and buses. Device realization may fail. Realization is recursive: a device's realize() method realizes its components, and device_set_realized() realizes its buses (which should in turn realize the devices on that bus, except bus_set_realized() doesn't implement that, yet). When realization of a component or bus fails, we need to roll back: unrealize everything we realized so far. If any of these unrealizes failed, the device would be left in an inconsistent state. Must not happen. device_set_realized() lets it happen: it ignores errors in the roll back code starting at label child_realize_fail. Since realization is recursive, unrealization must be recursive, too. But how could a partly failed unrealize be rolled back? We'd have to re-realize, which can fail. This design is fundamentally broken. device_set_realized() does not roll back at all. Instead, it keeps unrealizing, ignoring further errors. It can screw up even for a device with no buses: if the lone dc->unrealize() fails, it still unregisters vmstate, and calls listeners' unrealize() callback. bus_set_realized() does not roll back either. Instead, it stops unrealizing. Fortunately, no unrealize method can fail, as we'll see below. To fix the design error, drop parameter @errp from all the unrealize methods. Any unrealize method that uses @errp now needs an update. This leads us to unrealize() methods that can fail. Merely passing it to another unrealize method cannot cause failure, though. Here are the ones that do other things with @errp: * virtio_serial_device_unrealize() Fails when qbus_set_hotplug_handler() fails, but still does all the other work. On failure, the device would stay realized with its resources completely gone. Oops. Can't happen, because qbus_set_hotplug_handler() can't actually fail here. Pass &error_abort to qbus_set_hotplug_handler() instead. * hw/ppc/spapr_drc.c's unrealize() Fails when object_property_del() fails, but all the other work is already done. On failure, the device would stay realized with its vmstate registration gone. Oops. Can't happen, because object_property_del() can't actually fail here. Pass &error_abort to object_property_del() instead. * spapr_phb_unrealize() Fails and bails out when remove_drcs() fails, but other work is already done. On failure, the device would stay realized with some of its resources gone. Oops. remove_drcs() fails only when chassis_from_bus()'s object_property_get_uint() fails, and it can't here. Pass &error_abort to remove_drcs() instead. Therefore, no unrealize method can fail before this patch. device_set_realized()'s recursive unrealization via bus uses object_property_set_bool(). Can't drop @errp there, so pass &error_abort. We similarly unrealize with object_property_set_bool() elsewhere, always ignoring errors. Pass &error_abort instead. Several unrealize methods no longer handle errors from other unrealize methods: virtio_9p_device_unrealize(), virtio_input_device_unrealize(), scsi_qdev_unrealize(), ... Much of the deleted error handling looks wrong anyway. One unrealize methods no longer ignore such errors: usb_ehci_pci_exit(). Several realize methods no longer ignore errors when rolling back: v9fs_device_realize_common(), pci_qdev_unrealize(), spapr_phb_realize(), usb_qdev_realize(), vfio_ccw_realize(), virtio_device_realize(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-17-armbru@redhat.com>
2020-05-15Drop more @errp parameters after previous commitMarkus Armbruster
Several functions can't fail anymore: ich9_pm_add_properties(), device_add_bootindex_property(), ppc_compat_add_property(), spapr_caps_add_properties(), PropertyInfo.create(). Drop their @errp parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-16-armbru@redhat.com>
2020-05-15qom: Drop parameter @errp of object_property_add() & friendsMarkus Armbruster
The only way object_property_add() can fail is when a property with the same name already exists. Since our property names are all hardcoded, failure is a programming error, and the appropriate way to handle it is passing &error_abort. Same for its variants, except for object_property_add_child(), which additionally fails when the child already has a parent. Parentage is also under program control, so this is a programming error, too. We have a bit over 500 callers. Almost half of them pass &error_abort, slightly fewer ignore errors, one test case handles errors, and the remaining few callers pass them to their own callers. The previous few commits demonstrated once again that ignoring programming errors is a bad idea. Of the few ones that pass on errors, several violate the Error API. The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. ich9_pm_add_properties(), sparc32_ledma_realize(), sparc32_dma_realize(), xilinx_axidma_realize(), xilinx_enet_realize() are wrong that way. When the one appropriate choice of argument is &error_abort, letting users pick the argument is a bad idea. Drop parameter @errp and assert the preconditions instead. There's one exception to "duplicate property name is a programming error": the way object_property_add() implements the magic (and undocumented) "automatic arrayification". Don't drop @errp there. Instead, rename object_property_add() to object_property_try_add(), and add the obvious wrapper object_property_add(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-15-armbru@redhat.com> [Two semantic rebase conflicts resolved]
2020-05-15qdev: Clean up qdev_connect_gpio_out_named()Markus Armbruster
Both qdev_connect_gpio_out_named() and device_set_realized() put objects without a parent into the "/machine/unattached/" orphanage. qdev_connect_gpio_out_named() needs a lengthy comment to explain how it works. It exploits that object_property_add_child() can fail only when we got a parent already, and ignoring that error does what we want. True. If it failed due to "duplicate property", we'd be in trouble, but that would be a programming error. device_set_realized() is cleaner: it checks whether we need a parent, then calls object_property_add_child(), aborting on failure. No need for a comment, and programming errors get caught. Change qdev_connect_gpio_out_named() to match. Cc: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200505152926.18877-14-armbru@redhat.com>
2020-05-15hw/arm/bcm2835: Drop futile attempts at QOM-adopting memoryMarkus Armbruster
The "bcm2835-peripherals" device's .instance_init() method bcm2835_peripherals_init() attempts to make two memory regions QOM children of the device. This is futile, because memory_region_init() already did. The errors are ignored (a later commit will change that). Drop the useless calls. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Andrew Baumann <Andrew.Baumann@microsoft.com> Cc: "Philippe Mathieu-Daudé" <philmd@redhat.com> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Eric Blake <eblake@redhat.com> Message-Id: <20200505152926.18877-13-armbru@redhat.com>
2020-05-15e1000: Don't run e1000_instance_init() twiceMarkus Armbruster
QOM object initialization runs .instance_init() for the type and all its supertypes; see object_init_with_type(). Both TYPE_E1000_BASE and its concrete subtypes set .instance_init() to e1000_instance_init(). For the concrete subtypes, it duly gets run twice. The second run fails, but the error gets ignored (a later commit will change that). Remove it from the subtypes. Cc: Jason Wang <jasowang@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-12-armbru@redhat.com>
2020-05-15hw/isa/superio: Make the components QOM childrenMarkus Armbruster
isa_superio_realize() attempts to make isa-parallel and isa-serial QOM children, but this does not work, because it calls object_property_add_child() after realizing with qdev_init_nofail(). Realizing a device without a parent gives it one: it gets put into the "/machine/unattached/" orphanage. The extra object_property_add_child() fails, and isa_superio_realize() ignores the error. Move the object_property_add_child() before qdev_init_nofail(), and pass &error_abort. For the other components, isa_superio_realize() doesn't even try. Add object_property_add_child() there. This affects machines 40p, clipper and fulong2e. For instance, fulong2e has its vt82c686b-superio (which is an isa-superio) at /machine/unattached/device[9]. Before the patch, its components are at /machine/unattached/device[10] .. [14]. Afterwards, they are at /machine/unattached/device[9]/{parallel0,serial0,serial1,isa-fdc,i8042}. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-11-armbru@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-14 10:58:00 +0000