bwlp/qemu.git/hw/sd, branch spice_video_codecs

hw/sd: Fix sun4i allwinner-sdhost for U-Boot

2022-11-21T11:45:12+00:00

Trying to run U-Boot for Cubieboard (Allwinner A10) fails because it cannot access SD card. The problem is that FIFO register in current allwinner-sdhost implementation is at the address corresponding to Allwinner H3, but not A10. Linux kernel is not affected since Linux driver uses DMA access and does not use FIFO register for reading/writing. This patch adds new class parameter `is_sun4i` and based on that parameter uses register at offset 0x100 either as FIFO register (if sun4i) or as threshold register (if not sun4i; in this case register at 0x200 is FIFO register). Tested with U-Boot and Linux kernel image built for Cubieboard and OrangePi PC. Signed-off-by: Strahinja Jankovic Reviewed-by: Peter Maydell Message-id: 20221112214900.24152-1-strahinja.p.jankovic@gmail.com Signed-off-by: Peter Maydell

hw/sd/sdhci: Rename ESDHC_* defines to USDHC_*

2022-10-28T16:26:20+00:00

The device model's functions start with "usdhc_", so rename the defines accordingly for consistency. Signed-off-by: Bernhard Beschow Reviewed-by: Bin Meng Message-Id: <20221018210146.193159-5-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza

hw/sd/sdhci-internal: Unexport ESDHC defines

2022-10-28T16:26:20+00:00

These defines aren't used outside of sdhci.c, so can be defined there. Signed-off-by: Bernhard Beschow Reviewed-by: Bin Meng Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20221018210146.193159-4-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza

block: Change blk_{pread,pwrite}() param order

2022-07-12T10:14:56+00:00

Swap 'buf' and 'bytes' around for consistency with blk_co_{pread,pwrite}(), and in preparation to implement these functions using generated_co_wrapper. Callers were updated using this Coccinelle script: @@ expression blk, offset, buf, bytes, flags; @@ - blk_pread(blk, offset, buf, bytes, flags) + blk_pread(blk, offset, bytes, buf, flags) @@ expression blk, offset, buf, bytes, flags; @@ - blk_pwrite(blk, offset, buf, bytes, flags) + blk_pwrite(blk, offset, bytes, buf, flags) It had no effect on hw/block/nand.c, presumably due to the #if, so that file was updated manually. Overly-long lines were then fixed by hand. Signed-off-by: Alberto Faria Reviewed-by: Eric Blake Reviewed-by: Hanna Reitz Message-Id: <20220705161527.1054072-4-afaria@redhat.com> Signed-off-by: Hanna Reitz

block: Add a 'flags' param to blk_pread()

2022-07-12T10:14:56+00:00

For consistency with other I/O functions, and in preparation to implement it using generated_co_wrapper. Callers were updated using this Coccinelle script: @@ expression blk, offset, buf, bytes; @@ - blk_pread(blk, offset, buf, bytes) + blk_pread(blk, offset, buf, bytes, 0) It had no effect on hw/block/nand.c, presumably due to the #if, so that file was updated manually. Overly-long lines were then fixed by hand. Signed-off-by: Alberto Faria Reviewed-by: Paolo Bonzini Reviewed-by: Greg Kurz Reviewed-by: Hanna Reitz Message-Id: <20220705161527.1054072-3-afaria@redhat.com> Signed-off-by: Hanna Reitz

hw/sd/allwinner-sdhost: report FIFO water level as 1 when data ready

2022-05-30T11:34:46+00:00

U-Boot queries the FIFO water level to reduce checking status register when doing PIO SD card operation. Report a FIFO water level of 1 when data is ready, to prevent the code from trying to read 0 words from the FIFO each time. Signed-off-by: Icenowy Zheng Message-id: 20220520124200.2112699-1-uwu@icenowy.me Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell

Remove qemu-common.h include from most units

2022-04-06T12:31:55+00:00

Signed-off-by: Marc-André Lureau Message-Id: <20220323155743.1585078-33-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini

hw/sd/sdhci: Prohibit DMA accesses to devices

2022-03-21T09:25:21+00:00

The issue reported by OSS-Fuzz produces the following backtrace: ==447470==ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61500002a080 thread T0 #0 0x71766d47 in sdhci_read_dataport hw/sd/sdhci.c:474:18 #1 0x7175f139 in sdhci_read hw/sd/sdhci.c:1022:19 #2 0x721b937b in memory_region_read_accessor softmmu/memory.c:440:11 #3 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 #4 0x7216f47c in memory_region_dispatch_read1 softmmu/memory.c:1424:16 #5 0x7216ebb9 in memory_region_dispatch_read softmmu/memory.c:1452:9 #6 0x7212db5d in flatview_read_continue softmmu/physmem.c:2879:23 #7 0x7212f958 in flatview_read softmmu/physmem.c:2921:12 #8 0x7212f418 in address_space_read_full softmmu/physmem.c:2934:18 #9 0x721305a9 in address_space_rw softmmu/physmem.c:2962:16 #10 0x7175a392 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 #11 0x7175a0ea in dma_memory_rw include/sysemu/dma.h:132:12 #12 0x71759684 in dma_memory_read include/sysemu/dma.h:152:12 #13 0x7175518c in sdhci_do_adma hw/sd/sdhci.c:823:27 #14 0x7174bf69 in sdhci_data_transfer hw/sd/sdhci.c:935:13 #15 0x7176aaa7 in sdhci_send_command hw/sd/sdhci.c:376:9 #16 0x717629ee in sdhci_write hw/sd/sdhci.c:1212:9 #17 0x72172513 in memory_region_write_accessor softmmu/memory.c:492:5 #18 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 #19 0x72170766 in memory_region_dispatch_write softmmu/memory.c:1504:16 #20 0x721419ee in flatview_write_continue softmmu/physmem.c:2812:23 #21 0x721301eb in flatview_write softmmu/physmem.c:2854:12 #22 0x7212fca8 in address_space_write softmmu/physmem.c:2950:18 #23 0x721d9a53 in qtest_process_command softmmu/qtest.c:727:9 A DMA descriptor is previously filled in RAM. An I/O access to the device (frames #22 to #16) start the DMA engine (frame #13). The engine fetch the descriptor and execute the request, which itself accesses the SDHCI I/O registers (frame #1 and #0), triggering a re-entrancy issue. Fix by prohibit transactions from the DMA to devices. The DMA engine is thus restricted to memories. Reported-by: OSS-Fuzz (Issue 36391) Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Resolves: https://gitlab.com/qemu-project/qemu/-/issues/451 Message-Id: <20211215205656.488940-3-philmd@redhat.com> Signed-off-by: Thomas Huth

hw/sd/sdhci: Honor failed DMA transactions

2022-03-21T09:25:21+00:00

DMA transactions might fail. The DMA API returns a MemTxResult, indicating such failures. Do not ignore it. On failure, raise the ADMA error flag and eventually triggering an IRQ (see spec chapter 1.13.5: "ADMA2 States"). Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth Message-Id: <20211215205656.488940-2-philmd@redhat.com> Signed-off-by: Thomas Huth

Mark remaining global TypeInfo instances as const

2022-02-21T13:30:20+00:00

More than 1k of TypeInfo instances are already marked as const. Mark the remaining ones, too. This commit was created with: git grep -z -l 'static TypeInfo' -- '*.c' | \ xargs -0 sed -i 's/static TypeInfo/static const TypeInfo/' Signed-off-by: Bernhard Beschow Reviewed-by: Alistair Francis Reviewed-by: Thomas Huth Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Cédric Le Goater Reviewed-by: Igor Mammedov Acked-by: Corey Minyard Message-id: 20220117145805.173070-2-shentey@gmail.com Signed-off-by: Peter Maydell