[Qemu-devel] [PATCH] sd: Fix "info qtree" on boards with SD cards

[Qemu-devel] [PATCH] sd: Fix "info qtree" on boards with SD cards

[Peter Maydell]

The SD card object is not a SysBusDevice, so don't create it with
qdev_create() if we're not assigning it to a specific bus; use
object_new() instead.

This was causing 'info qtree' to segfault on boards with SD cards,
because qdev_create(NULL, TYPE_FOO) puts the created object on the
system bus, and then we may try to run functions like sysbus_dev_print()
on it, which fail when casting the object to SysBusDevice.

(This is the same mistake that we made with the NAND device
and fixed in commit 6749695eaaf346c1.)

Reported-by: hitmoon <zxq_yx_007@163.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
I assume that using qdev_create() for non-SysBus devices is
OK if we are passing in a specific bus pointer, because we do
this already for various things including PCI devices. The
various "properly QOMified" uses of TYPE_SD_CARD do that; only
this sd_init() function for the legacy uses doesn't.
---
 hw/sd/sd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 00c320d..1568057 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -563,17 +563,19 @@ static const VMStateDescription sd_vmstate = {
 /* Legacy initialization function for use by non-qdevified callers */
 SDState *sd_init(BlockBackend *blk, bool is_spi)
 {
+    Object *obj;
     DeviceState *dev;
     Error *err = NULL;
 
-    dev = qdev_create(NULL, TYPE_SD_CARD);
+    obj = object_new(TYPE_SD_CARD);
+    dev = DEVICE(obj);
     qdev_prop_set_drive(dev, "drive", blk, &err);
     if (err) {
         error_report("sd_init failed: %s", error_get_pretty(err));
         return NULL;
     }
     qdev_prop_set_bit(dev, "spi", is_spi);
-    object_property_set_bool(OBJECT(dev), true, "realized", &err);
+    object_property_set_bool(obj, true, "realized", &err);
     if (err) {
         error_report("sd_init failed: %s", error_get_pretty(err));
         return NULL;
-- 
1.9.1

Re: [Qemu-devel] [Qemu-arm] [PATCH] sd: Fix "info qtree" on boards with SD cards

[Thomas Hanson]

The patch looks good.

Would it also be good to update bus_add_child() so that it NULL-checks
its "bus" parameter before dereferencing it?

-Tom

On 15 March 2016 at 10:56, Peter Maydell <peter.maydell@linaro.org> wrote:
> The SD card object is not a SysBusDevice, so don't create it with
> qdev_create() if we're not assigning it to a specific bus; use
> object_new() instead.
>
> This was causing 'info qtree' to segfault on boards with SD cards,
> because qdev_create(NULL, TYPE_FOO) puts the created object on the
> system bus, and then we may try to run functions like sysbus_dev_print()
> on it, which fail when casting the object to SysBusDevice.
>
> (This is the same mistake that we made with the NAND device
> and fixed in commit 6749695eaaf346c1.)
>
> Reported-by: hitmoon <zxq_yx_007@163.com>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> I assume that using qdev_create() for non-SysBus devices is
> OK if we are passing in a specific bus pointer, because we do
> this already for various things including PCI devices. The
> various "properly QOMified" uses of TYPE_SD_CARD do that; only
> this sd_init() function for the legacy uses doesn't.
> ---
>  hw/sd/sd.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/sd/sd.c b/hw/sd/sd.c
> index 00c320d..1568057 100644
> --- a/hw/sd/sd.c
> +++ b/hw/sd/sd.c
> @@ -563,17 +563,19 @@ static const VMStateDescription sd_vmstate = {
>  /* Legacy initialization function for use by non-qdevified callers */
>  SDState *sd_init(BlockBackend *blk, bool is_spi)
>  {
> +    Object *obj;
>      DeviceState *dev;
>      Error *err = NULL;
>
> -    dev = qdev_create(NULL, TYPE_SD_CARD);
> +    obj = object_new(TYPE_SD_CARD);
> +    dev = DEVICE(obj);
>      qdev_prop_set_drive(dev, "drive", blk, &err);
>      if (err) {
>          error_report("sd_init failed: %s", error_get_pretty(err));
>          return NULL;
>      }
>      qdev_prop_set_bit(dev, "spi", is_spi);
> -    object_property_set_bool(OBJECT(dev), true, "realized", &err);
> +    object_property_set_bool(obj, true, "realized", &err);
>      if (err) {
>          error_report("sd_init failed: %s", error_get_pretty(err));
>          return NULL;
> --
> 1.9.1
>
>

Re: [Qemu-devel] [Qemu-arm] [PATCH] sd: Fix "info qtree" on boards with SD cards

[Peter Maydell]

On 15 March 2016 at 20:28, Thomas Hanson <thomas.hanson@linaro.org> wrote:
> The patch looks good.
>
> Would it also be good to update bus_add_child() so that it NULL-checks
> its "bus" parameter before dereferencing it?

No, I think it's just a programming error to call qdev_set_parent_bus()
with a NULL bus parameter, so crashing is fine.

(The problem fixed by this patch doesn't involve calling bus_add_child()
with a NULL pointer, in any case -- qdev_try_create() will handle
a NULL bus pointer as "use the default system bus", so by the time
it gets to bus_add_child() the bus pointer is never NULL. It's
using the default bus at all that causes things to go wrong much
later on down the line.)

thanks
-- PMM

Re: [Qemu-devel] [Qemu-arm] [PATCH] sd: Fix "info qtree" on boards with SD cards

[Peter Maydell]

On 15 March 2016 at 20:33, Peter Maydell <peter.maydell@linaro.org> wrote:
> On 15 March 2016 at 20:28, Thomas Hanson <thomas.hanson@linaro.org> wrote:
>> The patch looks good.
>>
>> Would it also be good to update bus_add_child() so that it NULL-checks
>> its "bus" parameter before dereferencing it?
>
> No, I think it's just a programming error to call qdev_set_parent_bus()
> with a NULL bus parameter, so crashing is fine.

...but it might be helpful to assert in qdev_try_create() that
if we're using the default bus then the object is a sysbus
device object. At least then the problem will be immediately
clear rather than only showing up if you run a monitor command
later.

thanks
-- PMM

Re: [Qemu-devel] [Qemu-arm] [PATCH] sd: Fix "info qtree" on boards with SD cards

[Thomas Hanson]

Sounds like a good idea.  Much easier to fix a problem with an
explicit error than to chase a seg fault.

On 15 March 2016 at 14:41, Peter Maydell <peter.maydell@linaro.org> wrote:
> On 15 March 2016 at 20:33, Peter Maydell <peter.maydell@linaro.org> wrote:
>> On 15 March 2016 at 20:28, Thomas Hanson <thomas.hanson@linaro.org> wrote:
>>> The patch looks good.
>>>
>>> Would it also be good to update bus_add_child() so that it NULL-checks
>>> its "bus" parameter before dereferencing it?
>>
>> No, I think it's just a programming error to call qdev_set_parent_bus()
>> with a NULL bus parameter, so crashing is fine.
>
> ...but it might be helpful to assert in qdev_try_create() that
> if we're using the default bus then the object is a sysbus
> device object. At least then the problem will be immediately
> clear rather than only showing up if you run a monitor command
> later.
>
> thanks
> -- PMM

Re: [Qemu-devel] [PATCH] sd: Fix "info qtree" on boards with SD cards

[hitmoon]

在 2016年03月16日 00:56, Peter Maydell 写道:
> The SD card object is not a SysBusDevice, so don't create it with
> qdev_create() if we're not assigning it to a specific bus; use
> object_new() instead.
>
> This was causing 'info qtree' to segfault on boards with SD cards,
> because qdev_create(NULL, TYPE_FOO) puts the created object on the
> system bus, and then we may try to run functions like sysbus_dev_print()
> on it, which fail when casting the object to SysBusDevice.
>
> (This is the same mistake that we made with the NAND device
> and fixed in commit 6749695eaaf346c1.)
>
> Reported-by: hitmoon <zxq_yx_007@163.com>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> I assume that using qdev_create() for non-SysBus devices is
> OK if we are passing in a specific bus pointer, because we do
> this already for various things including PCI devices. The
> various "properly QOMified" uses of TYPE_SD_CARD do that; only
> this sd_init() function for the legacy uses doesn't.
> ---
>   hw/sd/sd.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/sd/sd.c b/hw/sd/sd.c
> index 00c320d..1568057 100644
> --- a/hw/sd/sd.c
> +++ b/hw/sd/sd.c
> @@ -563,17 +563,19 @@ static const VMStateDescription sd_vmstate = {
>   /* Legacy initialization function for use by non-qdevified callers */
>   SDState *sd_init(BlockBackend *blk, bool is_spi)
>   {
> +    Object *obj;
>       DeviceState *dev;
>       Error *err = NULL;
>   
> -    dev = qdev_create(NULL, TYPE_SD_CARD);
> +    obj = object_new(TYPE_SD_CARD);
> +    dev = DEVICE(obj);
>       qdev_prop_set_drive(dev, "drive", blk, &err);
>       if (err) {
>           error_report("sd_init failed: %s", error_get_pretty(err));
>           return NULL;
>       }
>       qdev_prop_set_bit(dev, "spi", is_spi);
> -    object_property_set_bool(OBJECT(dev), true, "realized", &err);
> +    object_property_set_bool(obj, true, "realized", &err);
>       if (err) {
>           error_report("sd_init failed: %s", error_get_pretty(err));
>           return NULL;

Nice patch !

Reviewed-by: xiaoqiang.zhao <zxq_yx_007@163.com>