Repository navigation
allwinner: V831/V833 machine -- YI camera boots from its NOR dump, with Ethernet, SD and a coded picture - #203
Merged
Merged
Conversation
…, with Ethernet, SD and a coded picture A new machine (-M v831 / v833) that runs a Xiaoyi (y291ga) SPI NOR dump through boot0, OP-TEE, U-Boot and Linux to the vendor application: - SoC devices: CCU, DRAMC, DMA, SPI + NOR, watchdog, PIO, TWI, IOMMU, audio capture FIFOs; upstream timers, sdhost, i2c, sun8i EMAC. - Video: cedar VE (aw-ve) with the H.264 encoder coding the input picture in CABAC (I_16x16 DC, P_Skip/I_PCM, exact reconstruction tracking); CSI DMA (aw-vinc) painting a test pattern, and in LBC mode a private block-average stand-in (aw-qlbc.h) the encoder reads; G2D (aw-g2d) running the register queue's scale/convert task. - Patches for upstream sdhost, i2c, EMAC MDIO and SD CMD11. - qemu-boot/test-v831-boot.sh (boot + Ethernet milestones) and qemu-boot/yi-v831-prepare.sh (a copy that runs as if paired). - docs/allwinner-v83x.md.
PR Summary by QodoAdd Allwinner V831/V833 machines with NOR boot and camera media support
AI Description
Diagram
High-Level Assessment
Files changed (28)
|
Code Review by Qodo
1. Camera peripherals become inaccessible
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
|
|
||
| sysbus_create_simple("aw-ccu", AW_CCU_BASE, NULL); | ||
| sysbus_create_simple("aw-dramc", AW_DRAM_CTL_BASE, NULL); | ||
| create_unimplemented_device("aw-periph", 0x01000000, 0x09000000); |
There was a problem hiding this comment.
1. Camera peripherals become inaccessible 🐞 Bug ≡ Correctness
aw_v83x_common_init() adds a catch-all unimplemented region after mapping the modeled peripherals at the same overlap priority. Because its address range includes the UART, storage, network, and media registers, guest accesses can resolve to the catch-all region instead of those devices.
Agent Prompt
## Issue description
The catch-all unimplemented MMIO region overlaps modeled peripherals and is installed after them without lower priority.
## Fix Focus Areas
- qemu/hw/arm/allwinner-v83x.c[520-525]
## Recommended Fix
Map the catch-all with lower overlap priority, or explicitly give every modeled region higher priority, and verify accesses reach representative devices.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+679
to
+681
| p->y = g_malloc0(mbw * mbh * 16); | ||
| p->u = g_malloc0(mbw * mbh * 4); | ||
| p->v = g_malloc0(mbw * mbh * 4); |
There was a problem hiding this comment.
5. Guest-chosen frame size can crash the ve 🐞 Bug ⛨ Security
aw_ve_encode() derives macroblock counts of up to 32768x32768 from register 0xA00. aw_h264_pic_alloc() then computes mbw * mbh * 16 in unsigned, which wraps (2^34 becomes 0), or else asks for gigabytes. aw_ve_input() likewise sizes its buffer as bw * bh + 2 * cw * ch from 16-bit header fields, and that sum can wrap. aw_ve_blocks() then reads and writes with the unwrapped dimensions, so a guest can overflow QEMU's heap or make g_malloc abort.
Agent Prompt
## Issue description
Guest-controlled picture dimensions in the VE encoder overflow the size calculations, which leads to undersized allocations and out-of-bounds accesses, or to huge allocations that abort QEMU.
## Fix Focus Areas
- qemu/hw/misc/aw-ve.c[675-682]
- qemu/hw/misc/aw-ve.c[1113-1139]
- qemu/hw/misc/aw-ve.c[1141-1172]
## Recommended Fix
In `aw_ve_encode`, reject (log LOG_GUEST_ERROR and return) when `w` or `h` is 0 or above the hardware maximum (e.g. 4096x4096 pixels, i.e. 256 MBs per side). In `aw_ve_input`, bound bw/bh/cw/ch (e.g. <= 4096) and compute the buffer size in size_t/uint64_t before allocating.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
…eset lines, SD S18A - aw-dma: memory-to-memory moves in 4 KiB chunks; a run moves at most 4 MiB (a descriptor counts 64 bytes) and leaves the rest to its bottom half, so a huge length or a looping chain cannot hold the vCPU. - aw-g2d: pitches must hold the width (chroma pairs included), planes are bounded, the RCQ length is capped. - aw-ve: pictures up to 256x256 MBs; a reused stream slot drops its reference; a P frame that would wrap over itself in the bitstream buffer is sent all-skipped; PutBits counts above 32 put zeros. - aw-spi: an exchange needs GCR.EN; full-duplex exchanges wait for RX to drain instead of dropping bytes. - aw-twi: TX/RX request interrupts when a packet waits on the FIFOs; reset ends an open bus transfer. - DMA, SPI, TWI, audio, watchdog: reset exit lowers their lines. - aw-vinc: no stale byte at the end of an odd chroma line. - patch 0010: S18A is masked in the ACMD41 response only, not cleared from the card's OCR. - yi-v831-prepare.sh quotes the SSID in the wpa_cli stand-in; test-v831-boot.sh requires the milestones in order.
… ready (bridged tap received nothing) On a bridged tap the host sends traffic before the guest's interface is up; that frame was queued while RX was off, the tap stopped being read, and the model flushed only on BASIC_CTL1/RX_CTL1 writes, not on RX_CTL0, which Linux enables reception with last. The camera's ARP requests went out and no reply ever came in. Patch 0011 flushes after any register write that leaves the receiver ready. Reproduced with a UDP socket netdev and a peer that chatters from power-on: 3 ARP requests, no ping before; 3/3 pings after.
… motion The colour bars give way to the OpenIPC logo (from OpenIPC/.github assets/openipc-logo-white.svg), white on a navy gradient, centred and still, with a round dot sliding to and fro beneath it so the YI application's motion detection (and with it the recorder) still has something to see. The logo is kept as a 3x bitmap's run lengths (base64 varints, 23 KiB of source), averaged into 4-bit-and-better coverage once at start-up. A moving logo would change ~400 macroblocks a frame, all sent raw in P frames; the dot costs a few. Both YI streams decode with no errors.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New machine
-M v831/-M v833(Allwinner sun8iw19). A Xiaoyi (YI, y291ga) SPI NOR dump boots unmodified through boot0, OP-TEE, U-Boot 2018.05 and Linux 4.9 to a root shell and the vendor application.What works
/debug_ttyon the SD card.aw-qlbc.h), since the real LBC format isn't public.qemu-boot/yi-v831-prepare.shmakes a copy of the dump that behaves as paired: a Wi-Fi config, pluseth0renamed towlan0with awpa_clistand-in.Not modelled
USB Wi-Fi, the real LBC/FBC formats, JPEG, ISP statistics, NNA (person detection), G2D blending/rotation, CE. Event recording by mp4record was not checked.
Testing
bash qemu-boot/test-v831-boot.sh --flash full.binpasses all milestones, including shell and Ethernet, in about 15 s.Docs:
docs/allwinner-v83x.md.