summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
* hw/misc/max111x: Create header file for documentation, TYPE_ macrosPeter Maydell2020-07-032-24/+3
| | | | | | | | | | | | | | | | Create a header file for the hw/misc/max111x device, in the usual modern style for QOM devices: * definition of the TYPE_ constants and macros * definition of the device's state struct so that it can be embedded in other structs if desired * documentation of the interface This allows us to use TYPE_MAX_1111 in the spitz.c code rather than the string "max1111". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200628142429.17111-12-peter.maydell@linaro.org
* hw/misc/max111x: Use GPIO lines rather than max111x_set_input()Peter Maydell2020-07-032-11/+14
| | | | | | | | | | | | | | | | | The max111x ADC device model allows other code to set the level on the 8 ADC inputs using the max111x_set_input() function. Replace this with generic qdev GPIO inputs, which also allow inputs to be set to arbitrary values. Using GPIO lines will make it easier for board code to wire things up, so that if device A wants to set the ADC input it doesn't need to have a direct pointer to the max111x but can just set that value on its output GPIO, which is then wired up by the board to the appropriate max111x input. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-11-peter.maydell@linaro.org
* hw/arm/spitz: Use max111x properties to set initial valuesPeter Maydell2020-07-031-4/+7
| | | | | | | | | | | Use the new max111x qdev properties to set the initial input values rather than calling max111x_set_input(); this means that on system reset the inputs will correctly return to their initial values. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200628142429.17111-10-peter.maydell@linaro.org
* ssi: Add ssi_realize_and_unref()Peter Maydell2020-07-031-1/+6
| | | | | | | | | | | | | | Add an ssi_realize_and_unref(), for the benefit of callers who want to be able to create an SSI device, set QOM properties on it, and then do the realize-and-unref afterwards. The API works on the same principle as the recently added qdev_realize_and_undef(), sysbus_realize_and_undef(), etc. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-9-peter.maydell@linaro.org
* hw/misc/max111x: Don't use vmstate_register()Peter Maydell2020-07-031-2/+1
| | | | | | | | | | | | | | The max111x is a proper qdev device; we can use dc->vmsd rather than directly calling vmstate_register(). It's possible that this is a migration compat break, but the only boards that use this device are the spitz-family ('akita', 'borzoi', 'spitz', 'terrier'). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-8-peter.maydell@linaro.org
* hw/misc/max111x: provide QOM properties for setting initial valuesPeter Maydell2020-07-031-10/+47
| | | | | | | | | | | | | | | | Add some QOM properties to the max111x ADC device to allow the initial values to be configured. Currently this is done by board code calling max111x_set_input() after it creates the device, which doesn't work on system reset. This requires us to implement a reset method for this device, so while we're doing that make sure we reset the other parts of the device state. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-7-peter.maydell@linaro.org
* hw/arm/spitz: Implement inbound GPIO lines for bit5 and power signalsPeter Maydell2020-07-031-16/+12
| | | | | | | | | | | | | | | | | Currently the Spitz board uses a nasty hack for the GPIO lines that pass "bit5" and "power" information to the LCD controller: the lcdtg realize function sets a global variable to point to the instance it just realized, and then the functions spitz_bl_power() and spitz_bl_bit5() use that to find the device they are changing the internal state of. There is a comment reading: FIXME: Implement GPIO properly and remove this hack. which was added in 2009. Implement GPIO properly and remove this hack. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-6-peter.maydell@linaro.org
* hw/arm/spitz: Keep pointers to scp0, scp1 in SpitzMachineStatePeter Maydell2020-07-031-17/+21
| | | | | | | | | | | | Keep pointers to scp0, scp1 in SpitzMachineState, and just pass that to spitz_scoop_gpio_setup(). (We'll want to use some of the other fields in SpitzMachineState in that function in the next commit.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-5-peter.maydell@linaro.org
* hw/arm/spitz: Keep pointers to MPU and SSI devices in SpitzMachineStatePeter Maydell2020-07-031-26/+32
| | | | | | | | | | | | | | | | Keep pointers to the MPU and the SSI devices in SpitzMachineState. We're going to want to make GPIO connections between some of the SSI devices and the SCPs, so we want to keep hold of a pointer to those; putting the MPU into the struct allows us to pass just one thing to spitz_ssp_attach() rather than two. We have to retain the setting of the global "max1111" variable for the moment as it is used in spitz_adc_temp_on(); later in this series of commits we will be able to remove it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-4-peter.maydell@linaro.org
* hw/arm/spitz: Create SpitzMachineClass abstract base classPeter Maydell2020-07-031-35/+54
| | | | | | | | | | | | | | | | | | | | | | | For the four Spitz-family machines (akita, borzoi, spitz, terrier) create a proper abstract class SpitzMachineClass which encapsulates the common behaviour, rather than having them all derive directly from TYPE_MACHINE: * instead of each machine class setting mc->init to a wrapper function which calls spitz_common_init() with parameters, put that data in the SpitzMachineClass and make spitz_common_init the SpitzMachineClass machine-init function * move the settings of mc->block_default_type and mc->ignore_memory_transaction_failures into the SpitzMachineClass class init rather than repeating them in each machine's class init (The motivation is that we're going to want to keep some state in the SpitzMachineState so we can connect GPIOs between devices created in one sub-function of the machine init to devices created in a different sub-function.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200628142429.17111-3-peter.maydell@linaro.org
* hw/arm/spitz: DetabifyPeter Maydell2020-07-031-79/+79
| | | | | | | | | | | | | The spitz board has been around a long time, and still has a fair number of hard-coded tab characters in it. We're about to do some work on this source file, so start out by expanding out the tabs. This commit is a pure whitespace only change. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-2-peter.maydell@linaro.org
* hw/display/bcm2835_fb.c: Initialize all fields of structPeter Maydell2020-07-031-0/+4
| | | | | | | | | | | | | | | | | In bcm2835_fb_mbox_push(), Coverity complains (CID 1429989) that we pass a pointer to a local struct to another function without initializing all its fields. This is a real bug: bcm2835_fb_reconfigure() copies the whole of our new BCM2385FBConfig struct into s->config, so any fields we don't initialize will corrupt the state of the device. Copy the two fields which we don't want to update (pixo and alpha) from the existing config so we don't accidentally change them. Fixes: cfb7ba983857e40e88 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200628195436.27582-1-peter.maydell@linaro.org
* hw/arm/virt-acpi-build: Only expose flash on older machine typesAndrew Jones2020-07-032-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | The flash device is exclusively for the host-controlled firmware, so we should not expose it to the OS. Exposing it risks the OS messing with it, which could break firmware runtime services and surprise the OS when all its changes disappear after reboot. As firmware needs the device and uses DT, we leave the device exposed there. It's up to firmware to remove the nodes from DT before sending it on to the OS. However, there's no need to force firmware to remove tables from ACPI (which it doesn't know how to do anyway), so we simply don't add the tables in the first place. But, as we've been adding the tables for quite some time and don't want to change the default hardware exposed to versioned machines, then we only stop exposing the flash device tables for 5.1 and later machine types. Suggested-by: Ard Biesheuvel <ard.biesheuvel@arm.com> Suggested-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200629140938.17566-4-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/virt: Let the virtio-iommu bypass MSIsEric Auger2020-07-031-0/+30
| | | | | | | | | | | | | | | | | | | | At the moment the virtio-iommu translates MSI transactions. This behavior is inherited from ARM SMMU. The virt machine code knows where the guest MSI doorbells are so we can easily declare those regions as VIRTIO_IOMMU_RESV_MEM_T_MSI. With that setting the guest will not map MSIs through the IOMMU and those transactions will be simply bypassed. Depending on which MSI controller is in use (ITS or GICV2M), we declare either: - the ITS interrupt translation space (ITS_base + 0x10000), containing the GITS_TRANSLATOR or - The GICV2M single frame, containing the MSI_SETSP_NS register. Signed-off-by: Eric Auger <eric.auger@redhat.com> Message-id: 20200629070404.10969-6-eric.auger@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* virtio-iommu-pci: Add array of Interval propertiesEric Auger2020-07-031-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The machine may need to pass reserved regions to the virtio-iommu-pci device (such as the MSI window on x86 or the MSI doorbells on ARM). So let's add an array of Interval properties. Note: if some reserved regions are already set by the machine code - which should be the case in general -, the length of the property array is already set and prevents the end-user from modifying them. For example, attempting to use: -device virtio-iommu-pci,\ len-reserved-regions=1,reserved-regions[0]=0xfee00000:0xfeefffff:1 would result in the following error message: qemu-system-aarch64: -device virtio-iommu-pci,addr=0xa, len-reserved-regions=1,reserved-regions[0]=0xfee00000:0xfeefffff:1: array size property len-reserved-regions may not be set more than once Otherwise, for example, adding two reserved regions is achieved using the following options: -device virtio-iommu-pci,addr=0xa,len-reserved-regions=2,\ reserved-regions[0]=0xfee00000:0xfeefffff:1,\ reserved-regions[1]=0x1000000:100ffff:1 Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Xu <peterx@redhat.com> Message-id: 20200629070404.10969-5-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* virtio-iommu: Handle reserved regions in the translation processEric Auger2020-07-031-0/+20
| | | | | | | | | | | | | | | | | | When translating an address we need to check if it belongs to a reserved virtual address range. If it does, there are 2 cases: - it belongs to a RESERVED region: the guest should neither use this address in a MAP not instruct the end-point to DMA on them. We report an error - It belongs to an MSI region: we bypass the translation. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20200629070404.10969-4-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* virtio-iommu: Implement RESV_MEM probe requestEric Auger2020-07-032-4/+91
| | | | | | | | | | | | | | | | | | | This patch implements the PROBE request. At the moment, only THE RESV_MEM property is handled. The first goal is to report iommu wide reserved regions such as the MSI regions set by the machine code. On x86 this will be the IOAPIC MSI region, [0xFEE00000 - 0xFEEFFFFF], on ARM this may be the ITS doorbell. In the future we may introduce per device reserved regions. This will be useful when protecting host assigned devices which may expose their own reserved regions Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20200629070404.10969-3-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* qdev: Introduce DEFINE_PROP_RESERVED_REGIONEric Auger2020-07-031-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a new property defining a reserved region: <low address>:<high address>:<type>. This will be used to encode reserved IOVA regions. For instance, in virtio-iommu use case, reserved IOVA regions will be passed by the machine code to the virtio-iommu-pci device (an array of those). The type of the reserved region will match the virtio_iommu_probe_resv_mem subtype value: - VIRTIO_IOMMU_RESV_MEM_T_RESERVED (0) - VIRTIO_IOMMU_RESV_MEM_T_MSI (1) on PC/Q35 machine, this will be used to inform the virtio-iommu-pci device it should bypass the MSI region. The reserved region will be: 0xfee00000:0xfeefffff:1. On ARM, we can declare the ITS MSI doorbell as an MSI region to prevent MSIs from being mapped on guest side. Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20200629070404.10969-2-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Select MDIO device 2 and 1 as PHY devices for i.MX6UL EVK board.Jean-Christophe Dubois2020-07-031-0/+2
| | | | | | | | | | | The i.MX6UL EVK 14x14 board uses: - PHY 2 for FEC 1 - PHY 1 for FEC 2 Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: fb41992126c091a71d76ab3d1898959091f60583.1593296112.git.jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Add the ability to select a different PHY for each i.MX6UL FEC interfaceJean-Christophe Dubois2020-07-031-0/+10
| | | | | | | | | | Add properties to the i.MX6UL processor to be able to select a particular PHY on the MDIO bus for each FEC device. Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: ea1d604198b6b73ea6521676e45bacfc597aba53.1593296112.git.jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Add a phy-num property to the i.MX FEC emulatorJean-Christophe Dubois2020-07-032-9/+19
| | | | | | | | | | | | | | We need a solution to use an Ethernet PHY that is not the first device on the MDIO bus (device 0 on MDIO bus). As an example with the i.MX6UL the NXP SOC has 2 Ethernet devices but only one MDIO bus on which the 2 related PHY are connected but at unique addresses. Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Message-id: a1a5c0e139d1c763194b8020573dcb6025daeefa.1593296112.git.jcd@tribudubois.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2020-07-02' ↵Peter Maydell2020-07-0247-232/+151
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Error reporting patches patches for 2020-07-02 # gpg: Signature made Thu 02 Jul 2020 10:55:48 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2020-07-02: (28 commits) migration/rdma: Plug memory leaks in qemu_rdma_registration_stop() arm/{bcm2835,fsl-imx25,fsl-imx6}: Fix realize error API violations hw/arm/armsse: Fix armsse_realize() error API violation aspeed: Fix realize error API violation arm/stm32f205 arm/stm32f405: Fix realize error API violation amd_iommu: Fix amdvi_realize() error API violation x86: Fix x86_cpu_new() error handling mips/cps: Fix mips_cps_realize() error API violations riscv_hart: Fix riscv_harts_realize() error API violations riscv/sifive_u: Fix sifive_u_soc_realize() error API violations hw/arm: Drop useless object_property_set_link() error handling hw: Fix error API violation around object_property_set_link() qdev: Drop qbus_set_hotplug_handler() parameter @errp qdev: Drop qbus_set_bus_hotplug_handler() parameter @errp aspeed: Clean up roundabout error propagation vnc: Plug minor memory leak in vnc_display_open() test-util-filemonitor: Plug unlikely memory leak sd/milkymist-memcard: Plug minor memory leak in realize qga: Plug unlikely memory leak in guest-set-memory-blocks spapr: Plug minor memory leak in spapr_machine_init() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * arm/{bcm2835,fsl-imx25,fsl-imx6}: Fix realize error API violationsMarkus Armbruster2020-07-023-22/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. bcm2835_peripherals_realize(), fsl_imx25_realize() and fsl_imx6_realize() are wrong that way: they pass &err to object_property_set_uint() and object_property_set_bool() without checking it, and then to sysbus_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Andrew Baumann <Andrew.Baumann@microsoft.com> Cc: "Philippe Mathieu-Daudé" <philmd@redhat.com> Cc: Jean-Christophe Dubois <jcd@tribudubois.net> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-26-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * hw/arm/armsse: Fix armsse_realize() error API violationMarkus Armbruster2020-07-021-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. armsse_realize() is wrong that way: it passes &err to object_property_set_int() multiple times without checking it, and then to sysbus_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-25-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * aspeed: Fix realize error API violationMarkus Armbruster2020-07-022-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. aspeed_soc_ast2600_realize() and aspeed_soc_realize() are wrong that way: they pass &err to object_property_set_int() and object_property_set_bool() without checking it, and then to sysbus_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: "Cédric Le Goater" <clg@kaod.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Andrew Jeffery <andrew@aj.id.au> Cc: Joel Stanley <joel@jms.id.au> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-24-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * arm/stm32f205 arm/stm32f405: Fix realize error API violationMarkus Armbruster2020-07-022-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. stm32f205_soc_realize() and stm32f405_soc_realize() are wrong that way: they pass &err to object_property_set_int() without checking it, and then to qdev_realize(). Harmless, because the former can't actually fail here. Fix by passing &error_abort instead. Cc: Alistair Francis <alistair@alistair23.me> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-23-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * amd_iommu: Fix amdvi_realize() error API violationMarkus Armbruster2020-07-021-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. amdvi_realize() is wrong that way: it passes @errp to qdev_realize(), object_property_get_int(), and msi_init() without checking it. I can't tell offhand whether qdev_realize() can fail here. Fix by checking it for failure. object_property_get_int() can't. Fix by passing &error_abort instead. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-22-armbru@redhat.com>
| * x86: Fix x86_cpu_new() error handlingMarkus Armbruster2020-07-021-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. x86_cpu_new() is wrong that way: it passes &local_err to object_property_set_uint() without checking it, and then to qdev_realize(). If both fail, we'll trip error_setv()'s assertion. To assess the bug's impact, we'd need to figure out how to make both calls fail. Too much work for ignorant me, sorry. Fix by checking for failure right away. Cc: Igor Mammedov <imammedo@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-21-armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
| * mips/cps: Fix mips_cps_realize() error API violationsMarkus Armbruster2020-07-021-10/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. mips_cps_realize() is wrong that way: it passes &err to multiple object_property_set_FOO() without checking for failure, and then to sysbus_realize(). Harmless, because the object_property_set_FOO() can't actually fail here. Fix by passing &error_abort instead. Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-20-armbru@redhat.com>
| * riscv_hart: Fix riscv_harts_realize() error API violationsMarkus Armbruster2020-07-021-9/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. riscv_harts_realize() is wrong that way: it passes @errp to riscv_hart_realize() in a loop. I can't tell offhand whether this can fail. Fix by checking for failure in each iteration. Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Alistair Francis <Alistair.Francis@wdc.com> Cc: Sagar Karandikar <sagark@eecs.berkeley.edu> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Bin Meng <bmeng.cn@gmail.com> Cc: qemu-riscv@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-19-armbru@redhat.com>
| * riscv/sifive_u: Fix sifive_u_soc_realize() error API violationsMarkus Armbruster2020-07-021-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. sifive_u_soc_realize() is wrong that way: it passes &err to sysbus_realize() four times before checking it. Harmless, because the first three can't actually fail (I think). Fix by checking for failure right away. Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Alistair Francis <Alistair.Francis@wdc.com> Cc: Sagar Karandikar <sagark@eecs.berkeley.edu> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Bin Meng <bmeng.cn@gmail.com> Cc: qemu-riscv@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-18-armbru@redhat.com>
| * hw/arm: Drop useless object_property_set_link() error handlingMarkus Armbruster2020-07-025-76/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | object_property_set_link() fails when the property doesn't exist, is not settable, or its .check() method fails. These are all programming errors here, so passing it &error_abort is appropriate. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: "Cédric Le Goater" <clg@kaod.org> Cc: Andrew Jeffery <andrew@aj.id.au> Cc: Joel Stanley <joel@jms.id.au> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20200630090351.1247703-17-armbru@redhat.com>
| * hw: Fix error API violation around object_property_set_link()Markus Armbruster2020-07-028-29/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. virtio_gpu_pci_base_realize(), virtio_vga_base_realize(), sparc32_ledma_device_realize(), sparc32_dma_realize(), sparc32_dma_realize() xilinx_axidma_realize(), mips_cps_realize(), macio_realize_ide(), xilinx_enet_realize(), and virtio_iommu_pci_realize() are wrong that way: they reuse the argument they pass to object_property_set_link() for another call. Harmless, because object_property_set_link() can't actually fail for them: it fails when the property doesn't exist, is not settable, or its .check() method fails. Fix by passing &error_abort instead. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Alistair Francis <alistair@alistair23.me> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> Cc: Eric Auger <eric.auger@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-16-armbru@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
| * qdev: Drop qbus_set_hotplug_handler() parameter @errpMarkus Armbruster2020-07-0214-31/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | qbus_set_hotplug_handler() is a simple wrapper around object_property_set_link(). object_property_set_link() fails when the property doesn't exist, is not settable, or its .check() method fails. These are all programming errors here, so passing &error_abort to qbus_set_hotplug_handler() is appropriate. Most of its callers do. Exceptions: * pcie_cap_slot_init(), shpc_init(), spapr_phb_realize() pass NULL, i.e. they ignore errors. * spapr_machine_init() passes &error_fatal. * s390_pcihost_realize(), virtio_serial_device_realize(), s390_pcihost_plug() pass the error to their callers. The latter two keep going after the error, which looks wrong. Drop the @errp parameter, and instead pass &error_abort to object_property_set_link(). Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-15-armbru@redhat.com>
| * qdev: Drop qbus_set_bus_hotplug_handler() parameter @errpMarkus Armbruster2020-07-025-6/+6
| | | | | | | | | | | | | | | | | | | | All callers pass &error_abort. Drop the parameter. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-14-armbru@redhat.com>
| * aspeed: Clean up roundabout error propagationMarkus Armbruster2020-07-022-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), &local_err); error_propagate(&err, local_err); if (err) { error_propagate(errp, err); return; } by sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), &err); if (err) { error_propagate(errp, err); return; } Cc: Cédric Le Goater <clg@kaod.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20200630090351.1247703-13-armbru@redhat.com>
| * sd/milkymist-memcard: Plug minor memory leak in realizeMarkus Armbruster2020-07-021-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | milkymist_memcard_realize() leaks an Error object when realization of its "sd-card" device fails. Quite harmless, since we only ever realize this once, in milkymist_init() via milkymist_memcard_create(). Plug the leak. Fixes: 3d0369ba499866cc6a839f71212d97876500762d Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-10-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
| * spapr: Plug minor memory leak in spapr_machine_init()Markus Armbruster2020-07-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | spapr_machine_init() leaks an Error object when kvmppc_check_papr_resize_hpt() fails and spapr->resize_hpt is SPAPR_RESIZE_HPT_DISABLED, i.e. when the host doesn't support hash page table resizing, and the user didn't ask for it. As harmless as memory leaks can possibly be. Plug it. Fixes: 30f4b05bd090564181554d0890605eb2c143e4ea Cc: David Gibson <dgibson@redhat.com> Cc: qemu-ppc@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200630090351.1247703-8-armbru@redhat.com>
| * usb/dev-mtp: Fix Error double free after inotify failureMarkus Armbruster2020-07-021-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | error_report_err() frees its first argument. Freeing it again is wrong. Don't. Fixes: 47287c27d0c367a89f7b2851e23a7f8b2d499dd6 Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200630090351.1247703-7-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
| * Clean up some calls to ignore Error objects the right wayMarkus Armbruster2020-07-023-10/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Receiving the error in a local variable only to free it is less clear (and also less efficient) than passing NULL. Clean up. Cc: Daniel P. Berrange <berrange@redhat.com> Cc: Jerome Forissier <jerome@forissier.org> CC: Greg Kurz <groug@kaod.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20200630090351.1247703-4-armbru@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
| * pci: Delete useless error_propagate()Markus Armbruster2020-07-021-3/+0
| | | | | | | | | | | | | | | | | | | | Cc: Jens Freimann <jfreimann@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Jens Freimann <jfreimann@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20200630090351.1247703-3-armbru@redhat.com>
| * net/virtio: Fix failover_replug_primary() return value regressionMarkus Armbruster2020-07-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 150ab54aa6 "net/virtio: fix re-plugging of primary device" fixed failover_replug_primary() to return false on failure. Commit 5a0948d36c "net/virtio: Fix failover error handling crash bugs" broke it again for hotplug_handler_plug() failure. Unbreak it. Commit 5a0948d36c4cbc1c5534afac6fee99de55245d12 Fixes: 5a0948d36c4cbc1c5534afac6fee99de55245d12 Cc: Jens Freimann <jfreimann@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Jens Freimann <jfreimann@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20200630090351.1247703-2-armbru@redhat.com>
| * hw/virtio/virtio-iommu-pci.c: Fix typo in error messagePeter Maydell2020-07-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Fix a typo in an error message in virtio_iommu_pci_realize(): "Check you machine" should be "Check your machine". Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20200625100811.12690-1-peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* | ati-vga: Add dummy MEM_SDRAM_MODE_REGBALATON Zoltan2020-06-303-0/+7
| | | | | | | | | | | | | | | | | | | | Radeon chips have an SDRAM mode reg that is accessed by some drivers. We don't emulate the memory controller but provide some default value to prevent drivers getting unexpected 0. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: cc1324b9ef06beb8ae233ddc77dedd8bab9b8624.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | ati-vga: Do not assert on errorBALATON Zoltan2020-06-301-1/+1
| | | | | | | | | | | | | | | | | | | | Do not abort on unsupported value just print log and continue. While display will likely be broken this prevents malicious guest to crash QEMU causing denial of service. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 0c13dab5d8e3b7e7479c3edbf53aeac8c09de6de.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | ati-vga: Support unaligned access to hardware cursor registersBALATON Zoltan2020-06-301-29/+58
| | | | | | | | | | | | | | | | | | | | | | This fixes horizontal mouse movement and pointer color with MacOS that writes these registers with access size less than 4 so previously only the last portion of access was effective overwriting previous partial writes. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: ba1d5ba97f246e8807f86f1243c2bdc6497dc8f2.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Fix and optimize overlap checkBALATON Zoltan2020-06-301-10/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | When doing reverse blit we need to check if source and dest overlap but it is not trivial due to possible different base and pitch of source and dest. Do rectangle overlap if base and pitch match, otherwise just check if memory area containing the rects overlaps so rects could possibly overlap. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20200624164737.A941374633D@zero.eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Convert debug printfs to tracesBALATON Zoltan2020-06-302-37/+25
| | | | | | | | | | | | | | Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: caf97bf0c84a440896ddf020e84c312fa5c15076.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Do not allow guest to set invalid formatBALATON Zoltan2020-06-301-0/+3
| | | | | | | | | | | | | | | | | | | | Prevent guest setting invalid format value that might trip checks in sm501_2d_operation(). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 26d4fa9b8ce81e2723e98d592ccba7550042752c.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Use stn_he_p/ldn_he_p instead of switch/caseBALATON Zoltan2020-06-301-11/+1
| | | | | | | | | | | | | | | | | | | | | | Instead of open coding op with different sizes using a switch and type casting it can be written more compactly using stn_he_p/ldn_he_p. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: e2f649cb286f0735a10ec87c1b36a7ae081acb61.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>