| Message ID | 20191217044322.351838-2-david@gibson.dropbear.id.au (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [PULL,01/88] ppc/pnv: Add a PNOR model | expand |
On Tue, 17 Dec 2019 at 04:43, David Gibson <david@gibson.dropbear.id.au> wrote: > > From: Cédric Le Goater <clg@fr.ibm.com> > > On a POWERPC PowerNV system, the host firmware is stored in a PNOR > flash chip which contents is mapped on the LPC bus. This model adds a > simple dummy device to map the contents of a block device in the host > address space. > > Signed-off-by: Cédric Le Goater <clg@kaod.org> > Message-Id: <20191021131215.3693-2-clg@kaod.org> > Signed-off-by: David Gibson <david@gibson.dropbear.id.au> > --- > hw/ppc/Makefile.objs | 4 +- > hw/ppc/pnv.c | 14 ++++ > hw/ppc/pnv_pnor.c | 135 ++++++++++++++++++++++++++++++++++++++ > include/hw/ppc/pnv.h | 3 + > include/hw/ppc/pnv_pnor.h | 25 +++++++ > 5 files changed, 180 insertions(+), 1 deletion(-) > create mode 100644 hw/ppc/pnv_pnor.c > create mode 100644 include/hw/ppc/pnv_pnor.h Hi; Coverity finds some issues in this patch: > +static void pnv_pnor_update(PnvPnor *s, int offset, int size) > +{ > + int offset_end; > + > + if (s->blk) { > + return; > + } > + > + offset_end = offset + size; > + offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE); > + offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE); > + > + blk_pwrite(s->blk, offset, s->storage + offset, > + offset_end - offset, 0); Here we call blk_pwrite() but don't check whether it succeeded or failed. (CID 1412228) > +static void pnv_pnor_realize(DeviceState *dev, Error **errp) > +{ > + PnvPnor *s = PNV_PNOR(dev); > + int ret; > + > + if (s->blk) { > + uint64_t perm = BLK_PERM_CONSISTENT_READ | > + (blk_is_read_only(s->blk) ? 0 : BLK_PERM_WRITE); > + ret = blk_set_perm(s->blk, perm, BLK_PERM_ALL, errp); > + if (ret < 0) { > + return; > + } > + > + s->size = blk_getlength(s->blk); > + if (s->size <= 0) { blk_getlength() returns an int64_t, but s->size is a uint32_t. This means that this attempt to check for <= 0 doesn't actually catch the negative values which are errors... > + error_setg(errp, "failed to get flash size"); > + return; > + } > + > + s->storage = blk_blockalign(s->blk, s->size); ...so we'll pass a very large positive number to blk_blockalign() (since it takse a size_t argument), which Coverity correctly identifies as doing the wrong thing. (CID 1412226) Side note: the blk functions here seem a bit inconsistent: blk_getlength() returns int64_t blk_blockalign() takes size_t blk_pread() takes int > + > + if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) { > + error_setg(errp, "failed to read the initial flash content"); > + return; > + } > + } else { > + s->storage = blk_blockalign(NULL, s->size); > + memset(s->storage, 0xFF, s->size); > + } > + > + memory_region_init_io(&s->mmio, OBJECT(s), &pnv_pnor_ops, s, > + TYPE_PNV_PNOR, s->size); > +} thanks -- PMM
On 1/7/20 3:43 PM, Peter Maydell wrote: > On Tue, 17 Dec 2019 at 04:43, David Gibson <david@gibson.dropbear.id.au> wrote: >> >> From: Cédric Le Goater <clg@fr.ibm.com> >> >> On a POWERPC PowerNV system, the host firmware is stored in a PNOR >> flash chip which contents is mapped on the LPC bus. This model adds a >> simple dummy device to map the contents of a block device in the host >> address space. >> >> Signed-off-by: Cédric Le Goater <clg@kaod.org> >> Message-Id: <20191021131215.3693-2-clg@kaod.org> >> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> >> --- >> hw/ppc/Makefile.objs | 4 +- >> hw/ppc/pnv.c | 14 ++++ >> hw/ppc/pnv_pnor.c | 135 ++++++++++++++++++++++++++++++++++++++ >> include/hw/ppc/pnv.h | 3 + >> include/hw/ppc/pnv_pnor.h | 25 +++++++ >> 5 files changed, 180 insertions(+), 1 deletion(-) >> create mode 100644 hw/ppc/pnv_pnor.c >> create mode 100644 include/hw/ppc/pnv_pnor.h > > Hi; Coverity finds some issues in this patch: > >> +static void pnv_pnor_update(PnvPnor *s, int offset, int size) >> +{ >> + int offset_end; >> + >> + if (s->blk) { >> + return; >> + } >> + >> + offset_end = offset + size; >> + offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE); >> + offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE); >> + >> + blk_pwrite(s->blk, offset, s->storage + offset, >> + offset_end - offset, 0); > > Here we call blk_pwrite() but don't check whether it > succeeded or failed. (CID 1412228) Yes. I will send fixes for both issues. Thanks, C. >> +static void pnv_pnor_realize(DeviceState *dev, Error **errp) >> +{ >> + PnvPnor *s = PNV_PNOR(dev); >> + int ret; >> + >> + if (s->blk) { >> + uint64_t perm = BLK_PERM_CONSISTENT_READ | >> + (blk_is_read_only(s->blk) ? 0 : BLK_PERM_WRITE); >> + ret = blk_set_perm(s->blk, perm, BLK_PERM_ALL, errp); >> + if (ret < 0) { >> + return; >> + } >> + >> + s->size = blk_getlength(s->blk); >> + if (s->size <= 0) { > > blk_getlength() returns an int64_t, but s->size is a uint32_t. > This means that this attempt to check for <= 0 doesn't > actually catch the negative values which are errors... > >> + error_setg(errp, "failed to get flash size"); >> + return; >> + } >> + >> + s->storage = blk_blockalign(s->blk, s->size); > > ...so we'll pass a very large positive number to > blk_blockalign() (since it takse a size_t argument), which > Coverity correctly identifies as doing the wrong thing. > (CID 1412226) > > Side note: the blk functions here seem a bit inconsistent: > blk_getlength() returns int64_t > blk_blockalign() takes size_t > blk_pread() takes int > >> + >> + if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) { >> + error_setg(errp, "failed to read the initial flash content"); >> + return; >> + } >> + } else { >> + s->storage = blk_blockalign(NULL, s->size); >> + memset(s->storage, 0xFF, s->size); >> + } >> + >> + memory_region_init_io(&s->mmio, OBJECT(s), &pnv_pnor_ops, s, >> + TYPE_PNV_PNOR, s->size); >> +} > > thanks > -- PMM >
diff --git a/hw/ppc/Makefile.objs b/hw/ppc/Makefile.objs index 580bb4f0dd..101e9fc591 100644 --- a/hw/ppc/Makefile.objs +++ b/hw/ppc/Makefile.objs @@ -9,7 +9,9 @@ obj-$(CONFIG_PSERIES) += spapr_tpm_proxy.o obj-$(CONFIG_SPAPR_RNG) += spapr_rng.o # IBM PowerNV obj-$(CONFIG_POWERNV) += pnv.o pnv_xscom.o pnv_core.o pnv_lpc.o pnv_psi.o pnv_occ.o pnv_bmc.o -obj-$(CONFIG_POWERNV) += pnv_homer.o +obj-$(CONFIG_POWERNV) += pnv_homer.o pnv_pnor.o + + ifeq ($(CONFIG_PCI)$(CONFIG_PSERIES)$(CONFIG_LINUX), yyy) obj-y += spapr_pci_vfio.o spapr_pci_nvlink2.o endif diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c index 627c08e5b9..d0c1d42277 100644 --- a/hw/ppc/pnv.c +++ b/hw/ppc/pnv.c @@ -44,6 +44,7 @@ #include "hw/ppc/xics.h" #include "hw/qdev-properties.h" #include "hw/ppc/pnv_xscom.h" +#include "hw/ppc/pnv_pnor.h" #include "hw/isa/isa.h" #include "hw/boards.h" @@ -633,6 +634,8 @@ static void pnv_init(MachineState *machine) long fw_size; int i; char *chip_typename; + DriveInfo *pnor = drive_get(IF_MTD, 0, 0); + DeviceState *dev; /* allocate RAM */ if (machine->ram_size < (1 * GiB)) { @@ -644,6 +647,17 @@ static void pnv_init(MachineState *machine) machine->ram_size); memory_region_add_subregion(get_system_memory(), 0, ram); + /* + * Create our simple PNOR device + */ + dev = qdev_create(NULL, TYPE_PNV_PNOR); + if (pnor) { + qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(pnor), + &error_abort); + } + qdev_init_nofail(dev); + pnv->pnor = PNV_PNOR(dev); + /* load skiboot firmware */ if (bios_name == NULL) { bios_name = FW_FILE_NAME; diff --git a/hw/ppc/pnv_pnor.c b/hw/ppc/pnv_pnor.c new file mode 100644 index 0000000000..bfb1e92b03 --- /dev/null +++ b/hw/ppc/pnv_pnor.c @@ -0,0 +1,135 @@ +/* + * QEMU PowerNV PNOR simple model + * + * Copyright (c) 2015-2019, IBM Corporation. + * + * This code is licensed under the GPL version 2 or later. See the + * COPYING file in the top-level directory. + */ + +#include "qemu/osdep.h" +#include "qapi/error.h" +#include "qemu/error-report.h" +#include "qemu/log.h" +#include "sysemu/block-backend.h" +#include "sysemu/blockdev.h" +#include "hw/loader.h" +#include "hw/ppc/pnv_pnor.h" +#include "hw/qdev-properties.h" + +static uint64_t pnv_pnor_read(void *opaque, hwaddr addr, unsigned size) +{ + PnvPnor *s = PNV_PNOR(opaque); + uint64_t ret = 0; + int i; + + for (i = 0; i < size; i++) { + ret |= (uint64_t) s->storage[addr + i] << (8 * (size - i - 1)); + } + + return ret; +} + +static void pnv_pnor_update(PnvPnor *s, int offset, int size) +{ + int offset_end; + + if (s->blk) { + return; + } + + offset_end = offset + size; + offset = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE); + offset_end = QEMU_ALIGN_UP(offset_end, BDRV_SECTOR_SIZE); + + blk_pwrite(s->blk, offset, s->storage + offset, + offset_end - offset, 0); +} + +static void pnv_pnor_write(void *opaque, hwaddr addr, uint64_t data, + unsigned size) +{ + PnvPnor *s = PNV_PNOR(opaque); + int i; + + for (i = 0; i < size; i++) { + s->storage[addr + i] = (data >> (8 * (size - i - 1))) & 0xFF; + } + pnv_pnor_update(s, addr, size); +} + +/* + * TODO: Check endianness: skiboot is BIG, Aspeed AHB is LITTLE, flash + * is BIG. + */ +static const MemoryRegionOps pnv_pnor_ops = { + .read = pnv_pnor_read, + .write = pnv_pnor_write, + .endianness = DEVICE_BIG_ENDIAN, + .valid = { + .min_access_size = 1, + .max_access_size = 4, + }, +}; + +static void pnv_pnor_realize(DeviceState *dev, Error **errp) +{ + PnvPnor *s = PNV_PNOR(dev); + int ret; + + if (s->blk) { + uint64_t perm = BLK_PERM_CONSISTENT_READ | + (blk_is_read_only(s->blk) ? 0 : BLK_PERM_WRITE); + ret = blk_set_perm(s->blk, perm, BLK_PERM_ALL, errp); + if (ret < 0) { + return; + } + + s->size = blk_getlength(s->blk); + if (s->size <= 0) { + error_setg(errp, "failed to get flash size"); + return; + } + + s->storage = blk_blockalign(s->blk, s->size); + + if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) { + error_setg(errp, "failed to read the initial flash content"); + return; + } + } else { + s->storage = blk_blockalign(NULL, s->size); + memset(s->storage, 0xFF, s->size); + } + + memory_region_init_io(&s->mmio, OBJECT(s), &pnv_pnor_ops, s, + TYPE_PNV_PNOR, s->size); +} + +static Property pnv_pnor_properties[] = { + DEFINE_PROP_UINT32("size", PnvPnor, size, 128 << 20), + DEFINE_PROP_DRIVE("drive", PnvPnor, blk), + DEFINE_PROP_END_OF_LIST(), +}; + +static void pnv_pnor_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + + dc->realize = pnv_pnor_realize; + dc->props = pnv_pnor_properties; +} + +static const TypeInfo pnv_pnor_info = { + .name = TYPE_PNV_PNOR, + .parent = TYPE_SYS_BUS_DEVICE, + .instance_size = sizeof(PnvPnor), + .class_init = pnv_pnor_class_init, +}; + +static void pnv_pnor_register_types(void) +{ + type_register_static(&pnv_pnor_info); +} + +type_init(pnv_pnor_register_types) diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h index 0b4c722e6b..5ecd3ba6ed 100644 --- a/include/hw/ppc/pnv.h +++ b/include/hw/ppc/pnv.h @@ -24,6 +24,7 @@ #include "hw/sysbus.h" #include "hw/ipmi/ipmi.h" #include "hw/ppc/pnv_lpc.h" +#include "hw/ppc/pnv_pnor.h" #include "hw/ppc/pnv_psi.h" #include "hw/ppc/pnv_occ.h" #include "hw/ppc/pnv_homer.h" @@ -175,6 +176,8 @@ typedef struct PnvMachineState { IPMIBmc *bmc; Notifier powerdown_notifier; + + PnvPnor *pnor; } PnvMachineState; static inline bool pnv_chip_is_power9(const PnvChip *chip) diff --git a/include/hw/ppc/pnv_pnor.h b/include/hw/ppc/pnv_pnor.h new file mode 100644 index 0000000000..dec811695c --- /dev/null +++ b/include/hw/ppc/pnv_pnor.h @@ -0,0 +1,25 @@ +/* + * QEMU PowerNV PNOR simple model + * + * Copyright (c) 2019, IBM Corporation. + * + * This code is licensed under the GPL version 2 or later. See the + * COPYING file in the top-level directory. + */ +#ifndef _PPC_PNV_PNOR_H +#define _PPC_PNV_PNOR_H + +#define TYPE_PNV_PNOR "pnv-pnor" +#define PNV_PNOR(obj) OBJECT_CHECK(PnvPnor, (obj), TYPE_PNV_PNOR) + +typedef struct PnvPnor { + SysBusDevice parent_obj; + + BlockBackend *blk; + + uint8_t *storage; + uint32_t size; + MemoryRegion mmio; +} PnvPnor; + +#endif /* _PPC_PNV_PNOR_H */