aboutsummaryrefslogtreecommitdiff
path: root/hw/sd
AgeCommit message (Collapse)Author
2024-04-10hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is setPhilippe Mathieu-Daudé
Per "SD Host Controller Standard Specification Version 3.00": * 2.2.5 Transfer Mode Register (Offset 00Ch) Writes to this register shall be ignored when the Command Inhibit (DAT) in the Present State register is 1. Do not update the TRNMOD register when Command Inhibit (DAT) bit is set to avoid the present-status register going out of sync, leading to malicious guest using DMA mode and overflowing the FIFO buffer: $ cat << EOF | qemu-system-i386 \ -display none -nographic -nodefaults \ -machine accel=qtest -m 512M \ -device sdhci-pci,sd-spec-version=3 \ -device sd-card,drive=mydrive \ -drive if=none,index=0,file=null-co://,format=raw,id=mydrive \ -qtest stdio outl 0xcf8 0x80001013 outl 0xcfc 0x91 outl 0xcf8 0x80001001 outl 0xcfc 0x06000000 write 0x9100002c 0x1 0x05 write 0x91000058 0x1 0x16 write 0x91000005 0x1 0x04 write 0x91000028 0x1 0x08 write 0x16 0x1 0x21 write 0x19 0x1 0x20 write 0x9100000c 0x1 0x01 write 0x9100000e 0x1 0x20 write 0x9100000f 0x1 0x00 write 0x9100000c 0x1 0x00 write 0x91000020 0x1 0x00 EOF Stack trace (part): ================================================================= ==89993==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000029900 at pc 0x55d5f885700d bp 0x7ffc1e1e9470 sp 0x7ffc1e1e9468 WRITE of size 1 at 0x615000029900 thread T0 #0 0x55d5f885700c in sdhci_write_dataport hw/sd/sdhci.c:564:39 #1 0x55d5f8849150 in sdhci_write hw/sd/sdhci.c:1223:13 #2 0x55d5fa01db63 in memory_region_write_accessor system/memory.c:497:5 #3 0x55d5fa01d245 in access_with_adjusted_size system/memory.c:573:18 #4 0x55d5fa01b1a9 in memory_region_dispatch_write system/memory.c:1521:16 #5 0x55d5fa09f5c9 in flatview_write_continue system/physmem.c:2711:23 #6 0x55d5fa08f78b in flatview_write system/physmem.c:2753:12 #7 0x55d5fa08f258 in address_space_write system/physmem.c:2860:18 ... 0x615000029900 is located 0 bytes to the right of 512-byte region [0x615000029700,0x615000029900) allocated by thread T0 here: #0 0x55d5f7237b27 in __interceptor_calloc #1 0x7f9e36dd4c50 in g_malloc0 #2 0x55d5f88672f7 in sdhci_pci_realize hw/sd/sdhci-pci.c:36:5 #3 0x55d5f844b582 in pci_qdev_realize hw/pci/pci.c:2092:9 #4 0x55d5fa2ee74b in device_set_realized hw/core/qdev.c:510:13 #5 0x55d5fa325bfb in property_set_bool qom/object.c:2358:5 #6 0x55d5fa31ea45 in object_property_set qom/object.c:1472:5 #7 0x55d5fa332509 in object_property_set_qobject om/qom-qobject.c:28:10 #8 0x55d5fa31f6ed in object_property_set_bool qom/object.c:1541:15 #9 0x55d5fa2e2948 in qdev_realize hw/core/qdev.c:292:12 #10 0x55d5f8eed3f1 in qdev_device_add_from_qdict system/qdev-monitor.c:719:10 #11 0x55d5f8eef7ff in qdev_device_add system/qdev-monitor.c:738:11 #12 0x55d5f8f211f0 in device_init_func system/vl.c:1200:11 #13 0x55d5fad0877d in qemu_opts_foreach util/qemu-option.c:1135:14 #14 0x55d5f8f0df9c in qemu_create_cli_devices system/vl.c:2638:5 #15 0x55d5f8f0db24 in qmp_x_exit_preconfig system/vl.c:2706:5 #16 0x55d5f8f14dc0 in qemu_init system/vl.c:3737:9 ... SUMMARY: AddressSanitizer: heap-buffer-overflow hw/sd/sdhci.c:564:39 in sdhci_write_dataport Add assertions to ensure the fifo_buffer[] is not overflowed by malicious accesses to the Buffer Data Port register. Fixes: CVE-2024-3447 Cc: qemu-stable@nongnu.org Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <CAFEAcA9iLiv1XGTGKeopgMa8Y9+8kvptvsb8z2OBeuy+5=NUfg@mail.gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240409145524.27913-1-philmd@linaro.org>
2023-12-30hw/sd: Constify VMStateRichard Henderson
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-53-richard.henderson@linaro.org>
2023-11-07hw/sd: Declare QOM types using DEFINE_TYPES() macroPhilippe Mathieu-Daudé
When multiple QOM types are registered in the same file, it is simpler to use the the DEFINE_TYPES() macro. In particular because type array declared with such macro are easier to review. Mechanical transformation using the following comby script: [pattern-x1] match=''' static const TypeInfo :[i1~.*_info] = { :[body] }; static void :[rt1~.*_register_type.](void) { type_register_static(&:[i2~.*_info]); } type_init(:[rt2~.*_register_type.]) ''' rewrite=''' static const TypeInfo :[i1][] = { { :[body] }, }; DEFINE_TYPES(:[i1]) ''' rule='where :[i1] == :[i2], :[rt1] == :[rt2]' [pattern-x2] match=''' static const TypeInfo :[i1a~.*_info] = { :[body1] }; ... static const TypeInfo :[i2a~.*_info] = { :[body2] }; static void :[rt1~.*_register_type.](void) { type_register_static(&:[i1b~.*_info]); type_register_static(&:[i2b~.*_info]); } type_init(:[rt2~.*_register_type.]) ''' rewrite=''' static const TypeInfo :[i1a][] = { { :[body1] }, { :[body2] }, }; DEFINE_TYPES(:[i1a]) ''' rule=''' where :[i1a] == :[i1b], :[i2a] == :[i2b], :[rt1] == :[rt2] ''' and re-indented manually. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20231031080603.86889-2-philmd@linaro.org>
2023-10-27hw/sd/pxa2xx: Do not open-code sysbus_create_simple()Philippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20231020130331.50048-3-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-10-27hw/sd/pxa2xx: Realize sysbus device before accessing itPhilippe Mathieu-Daudé
sysbus_mmio_map() and sysbus_connect_irq() should not be called on unrealized device. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20231020130331.50048-2-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-10-19hw/sd/sdhci: Block Size Register bits [14:12] is lostLu Gao
Block Size Register bits [14:12] is SDMA Buffer Boundary, it is missed in register write, but it is needed in SDMA transfer. e.g. it will be used in sdhci_sdma_transfer_multi_blocks to calculate boundary_ variables. Missing this field will cause wrong operation for different SDMA Buffer Boundary settings. Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Fixes: dfba99f17f ("hw/sdhci: Fix DMA Transfer Block Size field") Signed-off-by: Lu Gao <lu.gao@verisilicon.com> Signed-off-by: Jianxian Wen <jianxian.wen@verisilicon.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-ID: <20220321055618.4026-1-lu.gao@verisilicon.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-09-06Merge tag 'pull-aspeed-20230901' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi
staging aspeed queue: * Fixes for the Aspeed I2C model * New SDK image for avocado tests * blockdev support for flash device definition * SD refactoring preparing ground for eMMC support # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmTxsaQACgkQUaNDx8/7 # 7KGXmg//XJNisscl/VWSBaGmH5MbQUAg/QCRalXx1V/lJ8rhE/JqwnWKuoPFd4EN # iDlh3ufpzxPhHFc9boechuM5ytlrJxpLJoCIJ4sw/4qnO3Dy3Q6BCy1t8Ma62D1u # oE7cAMHsriJ1uTJNHUTFo72VapTaH2XwFN9lFDuQW45d+WWAXtVJsqvRgFETNmw6 # YYnTTpH2gLTZZFEgOixhWpGLh4Ibc/l8U1VzL0ctQmC11xng0bqk3PAqU9NGzcM5 # MJmEGAxg43CnFu9NJI1nMqC/coi/8PFtrM7HprSwE3H8Jkwncs4ePVT+kZQC+VNQ # 7EaVkksfEGHlN8XP5+eQDrQ5yT6ve+fbHTLQhwULfeyt0GlQ8h1yewvHCDWo/zw3 # XI1ZyOcNZ2yiaenSUrTPzu0LiqZEJQnzRjPCpgTi1fU08ryEMEaPtr176YDLCguQ # cpRj4QSZHCrGl/Eo9NlkFP/2rQDKTvCcedKPkYLQtsurSiH/36Oj9YvZycNtZ574 # ortKAtru4YV/rglNX4L8JDhdI+nqvy1liifpJsiS/2KBZDpVFaP8PzGIV40HNy3G # 8/LVTnaggZaScF3ftHhkg84uQumELS9l2dhsNCL9HqdlrNXLQrVAIR6iuQlpOKBa # 5S/6h7ZXGOb1qNVQjYp4HCrB7X1KIJYksZ3GdUREf8ot5Ds1FhE= # =ymmX # -----END PGP SIGNATURE----- # gpg: Signature made Fri 01 Sep 2023 05:40:52 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [unknown] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20230901' of https://github.com/legoater/qemu: (26 commits) hw/sd: Introduce a "sd-card" SPI variant model hw/sd: Add sd_cmd_SET_BLOCK_COUNT() handler hw/sd: Add sd_cmd_SEND_TUNING_BLOCK() handler hw/sd: Add sd_cmd_SEND_RELATIVE_ADDR() handler hw/sd: Add sd_cmd_ALL_SEND_CID() handler hw/sd: Add sd_cmd_SEND_OP_CMD() handler hw/sd: Add sd_cmd_GO_IDLE_STATE() handler hw/sd: Add sd_cmd_unimplemented() handler hw/sd: Add sd_cmd_illegal() handler hw/sd: Introduce sd_cmd_handler type hw/sd: Move proto_name to SDProto structure hw/sd: When card is in wrong state, log which spec version is used hw/sd: When card is in wrong state, log which state it is hw/sd/sdcard: Return ILLEGAL for CMD19/CMD23 prior SD spec v3.01 aspeed: Get the BlockBackend of FMC0 from the flash device m25p80: Introduce an helper to retrieve the BlockBackend of a device aspeed: Create flash devices only when defaults are enabled hw/ssi: Check for duplicate CS indexes aspeed/smc: Wire CS lines at reset hw/ssi: Introduce a ssi_get_cs() helper ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-09-01hw/sd: Introduce a "sd-card" SPI variant modelCédric Le Goater
and replace the SDState::spi attribute with a test checking the SDProto array of commands. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SET_BLOCK_COUNT() handlerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SEND_TUNING_BLOCK() handlerJoel Stanley
Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SEND_RELATIVE_ADDR() handlerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-11-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_ALL_SEND_CID() handlerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-10-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SEND_OP_CMD() handlerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [ clg: Update cmd_abbrev ] Message-Id: <20210624142209.1193073-9-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_GO_IDLE_STATE() handlerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-8-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_unimplemented() handlerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [ clg: Fix redundant assignment of .cmd ] Message-Id: <20210624142209.1193073-7-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_illegal() handlerPhilippe Mathieu-Daudé
Log illegal commands as GUEST_ERROR. Note: we are logging back the SDIO commands (CMD5, CMD52-54). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-6-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Introduce sd_cmd_handler typePhilippe Mathieu-Daudé
Add 2 command handler arrays in SDProto, for CMD and ACMD. Have sd_normal_command() / sd_app_command() use these arrays: if an command handler is registered, call it, otherwise fall back to current code base. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-5-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Move proto_name to SDProto structurePhilippe Mathieu-Daudé
Introduce a new structure to hold the bus protocol specific fields: SDProto. The first field is the protocol name. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-4-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: When card is in wrong state, log which spec version is usedPhilippe Mathieu-Daudé
Add the sd_version_str() helper. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: When card is in wrong state, log which state it isPhilippe Mathieu-Daudé
We report the card is in an inconsistent state, but don't precise in which state it is. Add this information, as it is useful when debugging problems. Since we will reuse this code, extract as sd_invalid_state_for_cmd() helper. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-2-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd/sdcard: Return ILLEGAL for CMD19/CMD23 prior SD spec v3.01Philippe Mathieu-Daudé
CMD19 (SEND_TUNING_BLOCK) and CMD23 (SET_BLOCK_COUNT) were added in the Physical Layer Simplified Specification v3.01. When earlier spec version is requested, we should return ILLEGAL. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220509141320.98374-1-philippe.mathieu.daude@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-08-31hw/sd: spelling fixesMichael Tokarev
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20230823065335.1919380-18-mjt@tls.msk.ru> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-25hw/sd/sdhci: Do not force sdhci_mmio_*_ops onto all SD controllersBernhard Beschow
Since commit c0a55a0c9da2 "hw/sd/sdhci: Support big endian SD host controller interfaces" sdhci_common_realize() forces all SD card controllers to use either sdhci_mmio_le_ops or sdhci_mmio_be_ops, depending on the "endianness" property. However, there are device models which use different MMIO ops: TYPE_IMX_USDHC uses usdhc_mmio_ops and TYPE_S3C_SDHCI uses sdhci_s3c_mmio_ops. Forcing sdhci_mmio_le_ops breaks SD card handling on the "sabrelite" board, for example. Fix this by defaulting the io_ops to little endian and switch to big endian in sdhci_common_realize() only if there is a matchig big endian variant available. Fixes: c0a55a0c9da2 ("hw/sd/sdhci: Support big endian SD host controller interfaces") Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-Id: <20230709080950.92489-1-shentey@gmail.com>
2023-06-20meson: Replace softmmu_ss -> system_ssPhilippe Mathieu-Daudé
We use the user_ss[] array to hold the user emulation sources, and the softmmu_ss[] array to hold the system emulation ones. Hold the latter in the 'system_ss[]' array for parity with user emulation. Mechanical change doing: $ sed -i -e s/softmmu_ss/system_ss/g $(git grep -l softmmu_ss) Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230613133347.82210-10-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-19hw/sd/allwinner-sdhost: Don't send non-boolean IRQ line levelsPeter Maydell
QEMU allows qemu_irq lines to transfer arbitrary integers. However the convention is that for a simple IRQ line the values transferred are always 0 and 1. The A10 SD controller device instead assumes a 0-vs-non-0 convention, which happens to work with the interrupt controller it is wired up to. Coerce the value to boolean to follow our usual convention. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20230606104609.3692557-3-peter.maydell@linaro.org
2023-06-06hw: sd: allwinner-sdhost: Add sun50i-a64 SoC supportqianfan Zhao
A64's sd register was similar to H3, and it introduced a new register named SAMP_DL_REG location at 0x144. The dma descriptor buffer size of mmc2 is only 8K and the other mmc controllers has 64K. Also fix allwinner-r40's mmc controller type. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02hw/sd/allwinner-sdhost: Correctly byteswap descriptor fieldsPeter Maydell
In allwinner_sdhost_process_desc() we just read directly from guest memory into a host TransferDescriptor struct and back. This only works on little-endian hosts. Abstract the reading and writing of descriptors into functions that handle the byte-swapping so that TransferDescriptor structs as seen by the rest of the code are always in host-order. This fixes a failure of one of the avocado tests on s390. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230424165053.1428857-2-peter.maydell@linaro.org
2023-03-20replace TABs with spacesYeqi Fu
Bring the files in line with the QEMU coding style, with spaces for indentation. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/378 Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com> Message-Id: <20230315032649.57568-1-fufuyqqqqqq@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-01-12hw/arm/omap: Drop useless casts from void * to pointerPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230109140306.23161-4-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-12-21hw/sd/sdhci: Support big endian SD host controller interfacesPhilippe Mathieu-Daudé
Some SDHCI IP can be synthetized in various endianness: https://github.com/u-boot/u-boot/blob/v2021.04/doc/README.fsl-esdhc - CONFIG_SYS_FSL_ESDHC_BE ESDHC IP is in big-endian mode. Accessing ESDHC registers can be determined by ESDHC IP's endian mode or processor's endian mode. Our current implementation is little-endian. In order to support big endianness: - Rename current MemoryRegionOps as sdhci_mmio_le_ops ('le') - Add an 'endianness' property to SDHCIState (default little endian) - Set the 'io_ops' field in realize() after checking the property - Add the sdhci_mmio_be_ops (big-endian) MemoryRegionOps. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20221101222934.52444-3-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-11-21hw/sd: Fix sun4i allwinner-sdhost for U-BootStrahinja Jankovic
Trying to run U-Boot for Cubieboard (Allwinner A10) fails because it cannot access SD card. The problem is that FIFO register in current allwinner-sdhost implementation is at the address corresponding to Allwinner H3, but not A10. Linux kernel is not affected since Linux driver uses DMA access and does not use FIFO register for reading/writing. This patch adds new class parameter `is_sun4i` and based on that parameter uses register at offset 0x100 either as FIFO register (if sun4i) or as threshold register (if not sun4i; in this case register at 0x200 is FIFO register). Tested with U-Boot and Linux kernel image built for Cubieboard and OrangePi PC. Signed-off-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221112214900.24152-1-strahinja.p.jankovic@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-10-28hw/sd/sdhci: Rename ESDHC_* defines to USDHC_*Bernhard Beschow
The device model's functions start with "usdhc_", so rename the defines accordingly for consistency. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20221018210146.193159-5-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-10-28hw/sd/sdhci-internal: Unexport ESDHC definesBernhard Beschow
These defines aren't used outside of sdhci.c, so can be defined there. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20221018210146.193159-4-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-07-12block: Change blk_{pread,pwrite}() param orderAlberto Faria
Swap 'buf' and 'bytes' around for consistency with blk_co_{pread,pwrite}(), and in preparation to implement these functions using generated_co_wrapper. Callers were updated using this Coccinelle script: @@ expression blk, offset, buf, bytes, flags; @@ - blk_pread(blk, offset, buf, bytes, flags) + blk_pread(blk, offset, bytes, buf, flags) @@ expression blk, offset, buf, bytes, flags; @@ - blk_pwrite(blk, offset, buf, bytes, flags) + blk_pwrite(blk, offset, bytes, buf, flags) It had no effect on hw/block/nand.c, presumably due to the #if, so that file was updated manually. Overly-long lines were then fixed by hand. Signed-off-by: Alberto Faria <afaria@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220705161527.1054072-4-afaria@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
2022-07-12block: Add a 'flags' param to blk_pread()Alberto Faria
For consistency with other I/O functions, and in preparation to implement it using generated_co_wrapper. Callers were updated using this Coccinelle script: @@ expression blk, offset, buf, bytes; @@ - blk_pread(blk, offset, buf, bytes) + blk_pread(blk, offset, buf, bytes, 0) It had no effect on hw/block/nand.c, presumably due to the #if, so that file was updated manually. Overly-long lines were then fixed by hand. Signed-off-by: Alberto Faria <afaria@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220705161527.1054072-3-afaria@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
2022-05-30hw/sd/allwinner-sdhost: report FIFO water level as 1 when data readyIcenowy Zheng
U-Boot queries the FIFO water level to reduce checking status register when doing PIO SD card operation. Report a FIFO water level of 1 when data is ready, to prevent the code from trying to read 0 words from the FIFO each time. Signed-off-by: Icenowy Zheng <uwu@icenowy.me> Message-id: 20220520124200.2112699-1-uwu@icenowy.me Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-06Remove qemu-common.h include from most unitsMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220323155743.1585078-33-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-21hw/sd/sdhci: Prohibit DMA accesses to devicesPhilippe Mathieu-Daudé
The issue reported by OSS-Fuzz produces the following backtrace: ==447470==ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61500002a080 thread T0 #0 0x71766d47 in sdhci_read_dataport hw/sd/sdhci.c:474:18 #1 0x7175f139 in sdhci_read hw/sd/sdhci.c:1022:19 #2 0x721b937b in memory_region_read_accessor softmmu/memory.c:440:11 #3 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 #4 0x7216f47c in memory_region_dispatch_read1 softmmu/memory.c:1424:16 #5 0x7216ebb9 in memory_region_dispatch_read softmmu/memory.c:1452:9 #6 0x7212db5d in flatview_read_continue softmmu/physmem.c:2879:23 #7 0x7212f958 in flatview_read softmmu/physmem.c:2921:12 #8 0x7212f418 in address_space_read_full softmmu/physmem.c:2934:18 #9 0x721305a9 in address_space_rw softmmu/physmem.c:2962:16 #10 0x7175a392 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 #11 0x7175a0ea in dma_memory_rw include/sysemu/dma.h:132:12 #12 0x71759684 in dma_memory_read include/sysemu/dma.h:152:12 #13 0x7175518c in sdhci_do_adma hw/sd/sdhci.c:823:27 #14 0x7174bf69 in sdhci_data_transfer hw/sd/sdhci.c:935:13 #15 0x7176aaa7 in sdhci_send_command hw/sd/sdhci.c:376:9 #16 0x717629ee in sdhci_write hw/sd/sdhci.c:1212:9 #17 0x72172513 in memory_region_write_accessor softmmu/memory.c:492:5 #18 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 #19 0x72170766 in memory_region_dispatch_write softmmu/memory.c:1504:16 #20 0x721419ee in flatview_write_continue softmmu/physmem.c:2812:23 #21 0x721301eb in flatview_write softmmu/physmem.c:2854:12 #22 0x7212fca8 in address_space_write softmmu/physmem.c:2950:18 #23 0x721d9a53 in qtest_process_command softmmu/qtest.c:727:9 A DMA descriptor is previously filled in RAM. An I/O access to the device (frames #22 to #16) start the DMA engine (frame #13). The engine fetch the descriptor and execute the request, which itself accesses the SDHCI I/O registers (frame #1 and #0), triggering a re-entrancy issue. Fix by prohibit transactions from the DMA to devices. The DMA engine is thus restricted to memories. Reported-by: OSS-Fuzz (Issue 36391) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/451 Message-Id: <20211215205656.488940-3-philmd@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-03-21hw/sd/sdhci: Honor failed DMA transactionsPhilippe Mathieu-Daudé
DMA transactions might fail. The DMA API returns a MemTxResult, indicating such failures. Do not ignore it. On failure, raise the ADMA error flag and eventually triggering an IRQ (see spec chapter 1.13.5: "ADMA2 States"). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20211215205656.488940-2-philmd@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-02-21Mark remaining global TypeInfo instances as constBernhard Beschow
More than 1k of TypeInfo instances are already marked as const. Mark the remaining ones, too. This commit was created with: git grep -z -l 'static TypeInfo' -- '*.c' | \ xargs -0 sed -i 's/static TypeInfo/static const TypeInfo/' Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Acked-by: Corey Minyard <cminyard@mvista.com> Message-id: 20220117145805.173070-2-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-01-04hw/sd: Add SDHC support for SD card SPI-modeFrank Chang
In SPI-mode, SD card's OCR register: Card Capacity Status (CCS) bit is not set to 1 correclty when the assigned SD image size is larger than 2GB (SDHC). This will cause the SD card to be indentified as SDSC incorrectly. CCS bit should be set to 1 if we are using SDHC. Also, as there's no power up emulation in SPI-mode. The OCR register: Card power up status bit bit (busy) should also be set to 1 when reset. (busy bit is set to LOW if the card has not finished the power up routine.) Signed-off-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Jim Shu <jim.shu@sifive.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20211228125719.14712-1-frank.chang@sifive.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-01-04hw/sd/sdcard: Rename Write Protect Group variablesPhilippe Mathieu-Daudé
'wp_groups' holds a bitmap, rename it as 'wp_group_bmap'. 'wpgrps_size' is the bitmap size (in bits), rename it as 'wp_group_bits'. Patch created mechanically using: $ sed -i -e s/wp_groups/wp_group_bmap/ \ -e s/wpgrps_size/wp_group_bits/ hw/sd/sd.c Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210728181728.2012952-4-f4bug@amsat.org> Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
2021-12-30dma: Let dma_memory_read/write() take MemTxAttrs argumentPhilippe Mathieu-Daudé
Let devices specify transaction attributes when calling dma_memory_read() or dma_memory_write(). Patch created mechanically using spatch with this script: @@ expression E1, E2, E3, E4; @@ ( - dma_memory_read(E1, E2, E3, E4) + dma_memory_read(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) | - dma_memory_write(E1, E2, E3, E4) + dma_memory_write(E1, E2, E3, E4, MEMTXATTRS_UNSPECIFIED) ) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20211223115554.3155328-6-philmd@redhat.com>
2021-12-15hw/sd/ssi-sd: Do not create SD card within controller's realizeMarkus Armbruster
ssi_sd_realize() creates an "sd-card" device. This is inappropriate, and marked FIXME. Move it to the boards that create these devices. Prior art: commit eb4f566bbb for device "generic-sdhci", and commit 26c607b86b for device "pl181". The device remains not user-creatable, because its users should (and do) wire up its GPIO chip-select line. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Alistair Francis <Alistair.Francis@wdc.com> Cc: Bin Meng <bin.meng@windriver.com> Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: "Philippe Mathieu-Daudé" <f4bug@amsat.org> Cc: qemu-arm@nongnu.org Cc: qemu-riscv@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20211117163409.3587705-2-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
2021-11-02hw/sd: add nuvoton MMCShengtan Mao
Signed-off-by: Shengtan Mao <stmao@google.com> Signed-off-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Chris Rauer <crauer@google.com> Reviewed-by: Tyrone Ting <kfting@nuvoton.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20211008002628.1958285-2-wuhaotsh@google.com> [rth: Fix typos of "nonexistent"] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2021-10-22speed/sdhci: Add trace eventsCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-Id: <20211018132609.160008-6-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2021-09-30qbus: Rename qbus_create_inplace() to qbus_init()Peter Maydell
Rename qbus_create_inplace() to qbus_init(); this is more in line with our usual naming convention for functions that in-place initialize objects. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20210923121153.23754-5-peter.maydell@linaro.org
2021-08-03hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30Philippe Mathieu-Daudé
OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers the assertion added in commit 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group"): qemu-fuzz-i386-target-generic-fuzz-sdhci-v3: ../hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. #3 0x7f62a8b22c91 in __assert_fail #4 0x5569adcec405 in sd_wpbits hw/sd/sd.c:824:9 #5 0x5569adce5f6d in sd_normal_command hw/sd/sd.c:1389:38 #6 0x5569adce3870 in sd_do_command hw/sd/sd.c:1737:17 #7 0x5569adcf1566 in sdbus_do_command hw/sd/core.c:100:16 #8 0x5569adcfc192 in sdhci_send_command hw/sd/sdhci.c:337:12 #9 0x5569adcfa3a3 in sdhci_write hw/sd/sdhci.c:1186:9 #10 0x5569adfb3447 in memory_region_write_accessor softmmu/memory.c:492:5 It is legal for the CMD30 to query for out-of-range addresses. Such invalid addresses are simply ignored in the response (write protection bits set to 0). In commit 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group") we misplaced the assertion *before* we test the address is in range. Move it *after*. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Cc: qemu-stable@nongnu.org Reported-by: OSS-Fuzz (Issue 29225) Suggested-by: Peter Maydell <peter.maydell@linaro.org> Fixes: 84816fb63e5 ("hw/sd/sdcard: Assert if accessing an illegal group") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/495 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210802235524.3417739-3-f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu>
2021-08-03hw/sd/sdcard: Document out-of-range addresses for SEND_WRITE_PROTPhilippe Mathieu-Daudé
Per the 'Physical Layer Simplified Specification Version 3.01', Table 4-22: 'Block Oriented Write Protection Commands' SEND_WRITE_PROT (CMD30) If the card provides write protection features, this command asks the card to send the status of the write protection bits [1]. [1] 32 write protection bits (representing 32 write protect groups starting at the specified address) [...] The last (least significant) bit of the protection bits corresponds to the first addressed group. If the addresses of the last groups are outside the valid range, then the corresponding write protection bits shall be set to 0. Split the if() statement (without changing the behaviour of the code) to better position the description comment. Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210802235524.3417739-2-f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Alexander Bulekov <alxndr@bu.edu>
2021-07-12hw/sd/sdcard: Check for valid address range in SEND_WRITE_PROT (CMD30)Philippe Mathieu-Daudé
OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers an assertion: qemu-fuzz-i386: hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. ==11578== ERROR: libFuzzer: deadly signal #8 0x7ffff628e091 in __assert_fail #9 0x5555588f1a3c in sd_wpbits hw/sd/sd.c:824:9 #10 0x5555588dd271 in sd_normal_command hw/sd/sd.c:1383:38 #11 0x5555588d777c in sd_do_command hw/sd/sd.c #12 0x555558cb25a0 in sdbus_do_command hw/sd/core.c:100:16 #13 0x555558e02a9a in sdhci_send_command hw/sd/sdhci.c:337:12 #14 0x555558dffa46 in sdhci_write hw/sd/sdhci.c:1187:9 #15 0x5555598b9d76 in memory_region_write_accessor softmmu/memory.c:489:5 Similarly to commit 8573378e62d ("hw/sd: fix out-of-bounds check for multi block reads"), check the address range before sending the status of the write protection bits. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Reported-by: OSS-Fuzz (Issue 29225) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/450 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210702155900.148665-4-f4bug@amsat.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-24 19:26:01 +0000