[PULL 0/3] aspeed queue

[PULL 0/3] aspeed queue

[Cédric Le Goater]

The following changes since commit de39a045bd8d2b49e4f3d07976622c29d58e0bac:

  Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200915-pull-request' into staging (2020-09-15 14:25:05 +0100)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-aspeed-20200918

for you to fetch changes up to 204dab83fe00a3e0781d93ad7899192a9409e987:

  misc: aspeed_scu: Update AST2600 silicon id register (2020-09-18 09:04:36 +0200)

----------------------------------------------------------------
Aspeed patches :

* Couple of cleanups
* New machine properties to define the flash models

----------------------------------------------------------------
Cédric Le Goater (1):
      hw/arm/aspeed: Add machine properties to define the flash models

Joel Stanley (1):
      misc: aspeed_scu: Update AST2600 silicon id register

Philippe Mathieu-Daudé (1):
      hw/arm/aspeed: Map the UART5 device unconditionally

 docs/system/arm/aspeed.rst | 18 ++++++++++++++++++
 hw/arm/aspeed.c            | 45 +++++++++++++++++++++++++++++++++++++++++++--
 hw/arm/aspeed_ast2600.c    |  8 +++-----
 hw/arm/aspeed_soc.c        |  8 +++-----
 hw/misc/aspeed_scu.c       |  7 ++++++-
 5 files changed, 73 insertions(+), 13 deletions(-)

Re: [PULL 0/3] aspeed queue

[no-reply]

Patchew URL: https://patchew.org/QEMU/20200918072703.331138-1-clg@kaod.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

N/A. Internal error while reading log file



The full log is available at
http://patchew.org/logs/20200918072703.331138-1-clg@kaod.org/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com

Re: [PULL 0/3] aspeed queue

[Peter Maydell]

On Fri, 18 Sep 2020 at 08:27, Cédric Le Goater <clg@kaod.org> wrote:
>
> The following changes since commit de39a045bd8d2b49e4f3d07976622c29d58e0bac:
>
>   Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200915-pull-request' into staging (2020-09-15 14:25:05 +0100)
>
> are available in the Git repository at:
>
>   https://github.com/legoater/qemu/ tags/pull-aspeed-20200918
>
> for you to fetch changes up to 204dab83fe00a3e0781d93ad7899192a9409e987:
>
>   misc: aspeed_scu: Update AST2600 silicon id register (2020-09-18 09:04:36 +0200)
>
> ----------------------------------------------------------------
> Aspeed patches :
>
> * Couple of cleanups
> * New machine properties to define the flash models
>
> ----------------------------------------------------------------


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/5.2
for any user-visible changes.

-- PMM

[PULL 0/3] aspeed queue

[Cédric Le Goater]

The following changes since commit afc9fcde55296b83f659de9da3cdf044812a6eeb:

  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-10-20 06:10:51 -0700)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-aspeed-20211022

for you to fetch changes up to b12fa6118f4d838d19720ec6476a1666a1b43474:

  speed/sdhci: Add trace events (2021-10-22 09:52:17 +0200)

----------------------------------------------------------------
Aspeed patches :

* New fp5280g2-bmc board (John)
* Small cleanup in Aspeed SMC model (Cedric)

----------------------------------------------------------------
Cédric Le Goater (2):
      aspeed/smc: Use a container for the flash mmio address space
      speed/sdhci: Add trace events

John Wang (1):
      aspeed: Add support for the fp5280g2-bmc board

 include/hw/ssi/aspeed_smc.h |  2 +-
 hw/arm/aspeed.c             | 74 +++++++++++++++++++++++++++++++++++++++++++++
 hw/sd/aspeed_sdhci.c        |  5 +++
 hw/ssi/aspeed_smc.c         | 11 ++++---
 hw/sd/trace-events          |  4 +++
 5 files changed, 91 insertions(+), 5 deletions(-)

Re: [PULL 0/3] aspeed queue

[Richard Henderson]

On 10/22/21 12:57 AM, Cédric Le Goater wrote:
> The following changes since commit afc9fcde55296b83f659de9da3cdf044812a6eeb:
> 
>    Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2021-10-20 06:10:51 -0700)
> 
> are available in the Git repository at:
> 
>    https://github.com/legoater/qemu/ tags/pull-aspeed-20211022
> 
> for you to fetch changes up to b12fa6118f4d838d19720ec6476a1666a1b43474:
> 
>    speed/sdhci: Add trace events (2021-10-22 09:52:17 +0200)
> 
> ----------------------------------------------------------------
> Aspeed patches :
> 
> * New fp5280g2-bmc board (John)
> * Small cleanup in Aspeed SMC model (Cedric)
> 
> ----------------------------------------------------------------
> Cédric Le Goater (2):
>        aspeed/smc: Use a container for the flash mmio address space
>        speed/sdhci: Add trace events
> 
> John Wang (1):
>        aspeed: Add support for the fp5280g2-bmc board
> 
>   include/hw/ssi/aspeed_smc.h |  2 +-
>   hw/arm/aspeed.c             | 74 +++++++++++++++++++++++++++++++++++++++++++++
>   hw/sd/aspeed_sdhci.c        |  5 +++
>   hw/ssi/aspeed_smc.c         | 11 ++++---
>   hw/sd/trace-events          |  4 +++
>   5 files changed, 91 insertions(+), 5 deletions(-)

Applied, thanks.

r~

[PULL 0/3] aspeed queue

[Cédric Le Goater]

The following changes since commit 527dede083d3e3e5a13ee996776926e0a0c4e258:

  Merge tag 'pull-request-2025-03-19' of https://gitlab.com/thuth/qemu into staging (2025-03-20 08:41:25 -0400)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-aspeed-20250323

for you to fetch changes up to 78877b2e06464f49f777e086845e094ea7bc82ef:

  hw/misc/aspeed_hace: Fix buffer overflow in has_padding function (2025-03-23 18:42:16 +0100)

----------------------------------------------------------------
aspeed queue:

* Fix AST2700 SoC model

----------------------------------------------------------------
Jamin Lin (1):
      hw/misc/aspeed_hace: Fix buffer overflow in has_padding function

Steven Lee (1):
      hw/intc/aspeed: Fix IRQ handler mask check

Troy Lee (1):
      aspeed: Fix maximum number of spi controller

 include/hw/arm/aspeed_soc.h | 2 +-
 hw/intc/aspeed_intc.c       | 2 +-
 hw/misc/aspeed_hace.c       | 5 +++++
 3 files changed, 7 insertions(+), 2 deletions(-)

[PULL 1/3] aspeed: Fix maximum number of spi controller

[Cédric Le Goater]

From: Troy Lee <troy_lee@aspeedtech.com>

Commit 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700
A1") extends ast2700a1 spis_num to 3, but ASPEED_SPIS_NUM defines the
maximum number of spi controller to 2, result in ehci[0] is being
overwritten in runtime.

Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
Fixes: 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700 A1")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250317065938.1902272-1-troy_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index f899356ed94c..f069d17d1629 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -42,7 +42,7 @@
 #include "hw/char/serial-mm.h"
 #include "hw/intc/arm_gicv3.h"
 
-#define ASPEED_SPIS_NUM  2
+#define ASPEED_SPIS_NUM  3
 #define ASPEED_EHCIS_NUM 2
 #define ASPEED_WDTS_NUM  8
 #define ASPEED_CPUS_NUM  4
-- 
2.49.0

[PULL 2/3] hw/intc/aspeed: Fix IRQ handler mask check

[Cédric Le Goater]

From: Steven Lee <steven_lee@aspeedtech.com>

Updated the IRQ handler mask check to AND with select variable.
This ensures that the interrupt service routine is correctly triggered
for the interrupts within the same irq group.

For example, both `eth0` and the debug UART are handled in `GICINT132`.
Without this fix, the debug console may hang if the `eth0` ISR is not
handled.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support")
Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/aspeed_intc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index 3fd417084f5b..f17bf439256a 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -111,7 +111,7 @@ static void aspeed_intc_set_irq_handler(AspeedINTCState *s,
     outpin_idx = intc_irq->outpin_idx;
     inpin_idx = intc_irq->inpin_idx;
 
-    if (s->mask[inpin_idx] || s->regs[status_reg]) {
+    if ((s->mask[inpin_idx] & select) || (s->regs[status_reg] & select)) {
         /*
          * a. mask is not 0 means in ISR mode
          * sources interrupt routine are executing.
-- 
2.49.0

[PULL 3/3] hw/misc/aspeed_hace: Fix buffer overflow in has_padding function

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The maximum padding size is either 64 or 128 bytes and should always be smaller
than "req_len". If "padding_size" exceeds "req_len", then
"req_len - padding_size" underflows due to "uint32_t" data type, leading to a
large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
access, potentially leading to a buffer overflow.

Added a check to ensure "padding_size" does not exceed "req_len" before
computing "pad_offset". This prevents "req_len - padding_size" from underflowing
and avoids accessing invalid memory.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ")
Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 32a5dbded3c6..d75da3335336 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -128,6 +128,11 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
     if (*total_msg_len <= s->total_req_len) {
         uint32_t padding_size = s->total_req_len - *total_msg_len;
         uint8_t *padding = iov->iov_base;
+
+        if (padding_size > req_len) {
+            return false;
+        }
+
         *pad_offset = req_len - padding_size;
         if (padding[*pad_offset] == 0x80) {
             return true;
-- 
2.49.0

Re: [PULL 0/3] aspeed queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/10.0 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PULL 0/3] aspeed queue

[Michael Tokarev]

23.03.2025 20:45, Cédric Le Goater wrote:
> Jamin Lin (1):
>        hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
> 
> Steven Lee (1):
>        hw/intc/aspeed: Fix IRQ handler mask check
> 
> Troy Lee (1):
>        aspeed: Fix maximum number of spi controller

Is there anything in there worth to pick up for stable series?

Thanks,

/mjt

Re: [PULL 0/3] aspeed queue

[Cédric Le Goater]

On 3/24/25 21:36, Michael Tokarev wrote:
> 23.03.2025 20:45, Cédric Le Goater wrote:
>> Jamin Lin (1):
>>        hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
>>
>> Steven Lee (1):
>>        hw/intc/aspeed: Fix IRQ handler mask check
>>
>> Troy Lee (1):
>>        aspeed: Fix maximum number of spi controller
> 
> Is there anything in there worth to pick up for stable series?


you are fast !

- "aspeed: Fix maximum number of spi controller" is QEMU 10.0 material.
- "hw/intc/aspeed: Fix IRQ handler mask check" was merged in QEMU 9.1
- "hw/misc/aspeed_hace: Fix buffer overflow in has_padding function"
    was merged in QEMU 7.1

The last 2 deserve to be backported IMO. They will need some massaging.


Thanks,

C.

Re: [PULL 0/3] aspeed queue

[Michael Tokarev]

24.03.2025 23:46, Cédric Le Goater wrote:

>> Is there anything in there worth to pick up for stable series?
> 
> you are fast !

I was just about to send final announcements for a bunch of next
stable releases, and noticed another pull request has been merged.. :)


> - "aspeed: Fix maximum number of spi controller" is QEMU 10.0 material.
> - "hw/intc/aspeed: Fix IRQ handler mask check" was merged in QEMU 9.1
> - "hw/misc/aspeed_hace: Fix buffer overflow in has_padding function"
>     was merged in QEMU 7.1
> 
> The last 2 deserve to be backported IMO. They will need some massaging.

The "buffer overflow" fix seems to be okay for 9.2, 8.2 and 7.2.

The "IRQ handler mask check" seems to be this (for 9.2). Does it look sane?

Author: Steven Lee <steven_lee@aspeedtech.com>
Date:   Thu Mar 20 17:25:43 2025 +0800

     hw/intc/aspeed: Fix IRQ handler mask check

     Updated the IRQ handler mask check to AND with select variable.
     This ensures that the interrupt service routine is correctly triggered
     for the interrupts within the same irq group.

     For example, both `eth0` and the debug UART are handled in `GICINT132`.
     Without this fix, the debug console may hang if the `eth0` ISR is not
     handled.

     Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
     Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709
     Reviewed-by: Cédric Le Goater <clg@redhat.com>
     Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support")
     Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com
     Signed-off-by: Cédric Le Goater <clg@redhat.com>
     (cherry picked from commit 7b8cbe5162e69ad629c5326bf3c158b81857955d)
     (Mjt: update for before v9.2.0-2466-g5824e8bf6beb
      "hw/intc/aspeed: Introduce IRQ handler function to reduce code duplication")
     Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index 126b711b94..495fd2bdfa 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -92,7 +92,7 @@ static void aspeed_intc_set_irq(void *opaque, int irq, int level)

      trace_aspeed_intc_select(select);

-    if (s->mask[irq] || s->regs[status_addr]) {
+    if ((s->mask[irq] & select) || (s->regs[status_addr] & select)) {
          /*
           * a. mask is not 0 means in ISR mode
           * sources interrupt routine are executing.

Re: [PULL 0/3] aspeed queue

[Cédric Le Goater]

On 3/24/25 22:08, Michael Tokarev wrote:
> 24.03.2025 23:46, Cédric Le Goater wrote:
> 
>>> Is there anything in there worth to pick up for stable series?
>>
>> you are fast !
> 
> I was just about to send final announcements for a bunch of next
> stable releases, and noticed another pull request has been merged.. :)
> 
> 
>> - "aspeed: Fix maximum number of spi controller" is QEMU 10.0 material.
>> - "hw/intc/aspeed: Fix IRQ handler mask check" was merged in QEMU 9.1
>> - "hw/misc/aspeed_hace: Fix buffer overflow in has_padding function"
>>     was merged in QEMU 7.1
>>
>> The last 2 deserve to be backported IMO. They will need some massaging.
> 
> The "buffer overflow" fix seems to be okay for 9.2, 8.2 and 7.2.
> 
> The "IRQ handler mask check" seems to be this (for 9.2). Does it look sane?

It does.

Thanks,

C.




> Author: Steven Lee <steven_lee@aspeedtech.com>
> Date:   Thu Mar 20 17:25:43 2025 +0800
> 
>      hw/intc/aspeed: Fix IRQ handler mask check
> 
>      Updated the IRQ handler mask check to AND with select variable.
>      This ensures that the interrupt service routine is correctly triggered
>      for the interrupts within the same irq group.
> 
>      For example, both `eth0` and the debug UART are handled in `GICINT132`.
>      Without this fix, the debug console may hang if the `eth0` ISR is not
>      handled.
> 
>      Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
>      Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709
>      Reviewed-by: Cédric Le Goater <clg@redhat.com>
>      Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support")
>      Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com
>      Signed-off-by: Cédric Le Goater <clg@redhat.com>
>      (cherry picked from commit 7b8cbe5162e69ad629c5326bf3c158b81857955d)
>      (Mjt: update for before v9.2.0-2466-g5824e8bf6beb
>       "hw/intc/aspeed: Introduce IRQ handler function to reduce code duplication")
>      Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> 
> diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
> index 126b711b94..495fd2bdfa 100644
> --- a/hw/intc/aspeed_intc.c
> +++ b/hw/intc/aspeed_intc.c
> @@ -92,7 +92,7 @@ static void aspeed_intc_set_irq(void *opaque, int irq, int level)
> 
>       trace_aspeed_intc_select(select);
> 
> -    if (s->mask[irq] || s->regs[status_addr]) {
> +    if ((s->mask[irq] & select) || (s->regs[status_addr] & select)) {
>           /*
>            * a. mask is not 0 means in ISR mode
>            * sources interrupt routine are executing.
>