aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2020-11-12ACPI: Avoid infinite recursion when dump-vmstatePeng Liang1-1/+11
There is a field with vmstate_ghes_state as vmsd in vmstate_ghes_state, which will lead to infinite recursion in dump_vmstate_vmsd. Fixes: a08a64627b ("ACPI: Record the Generic Error Status Block address") Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Peng Liang <liangpeng10@huawei.com> Acked-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20201112020638.874515-1-liangpeng10@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-11-12macio: set user_creatable to false in macio_class_init()Mark Cave-Ayland1-0/+2
Commit 348b8d1a76 "macio: don't reference serial_hd() directly within the device" removed the setting of user_creatable to false on the basis that the restriction was due to the use of serial_hd() in macio_instance_init(). Unfortunately this isn't the full story since the PIC object property links must still be set before the device is realized. Whilst it is possible to update the macio device and Mac machines to resolve this, the fix is too invasive at this point in the release cycle. For now simply set user_creatable back to false in macio_class_init() to prevent QEMU from segfaulting in anticipation of the proper fix arriving in QEMU 6.0. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20201110103111.18395-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2020-11-11Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell2-1/+5
staging Bug fixes # gpg: Signature made Wed 11 Nov 2020 08:59:24 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: pvpanic: Advertise the PVPANIC_CRASHLOADED event support physmem: improve ram size error messages Makefile: No echoing for 'make help V=1' replay: remove some dead code fix make clean/distclean meson: Clarify the confusing vhost-user vs. vhost-kernel output Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-11hw/net/can/ctucan_core: Use stl_le_p to write to tx_buffersPeter Maydell1-4/+2
Instead of casting an address within a uint8_t array to a uint32_t*, use stl_le_p(). This handles possibly misaligned addresses which would otherwise crash on some hosts. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-11-11hw/net/can/ctucan_core: Handle big-endian hostsPeter Maydell1-2/+1
The ctucan driver defines types for its registers which are a union of a uint32_t with a struct with bitfields for the individual fields within that register. This is a bad idea, because bitfields aren't portable. The ctu_can_fd_regs.h header works around the most glaring of the portability issues by defining the fields in two different orders depending on the setting of the __LITTLE_ENDIAN_BITFIELD define. However, in ctucan_core.h this is unconditionally set to 1, which is wrong for big-endian hosts. Set it only if HOST_WORDS_BIGENDIAN is not set. There is no need for a "have we defined it already" guard, because the only place that should set it is ctucan_core.h, which has the usual double-inclusion guard. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-11-11hw/net/can/ctucan: Avoid unused value in ctucan_send_ready_buffers()Peter Maydell1-12/+3
Coverity points out that in ctucan_send_ready_buffers() we set buff_st_mask = 0xf << (i * 4) inside the loop, but then we never use it before overwriting it later. The only thing we use the mask for is as part of the code that is inserting the new buff_st field into tx_status. That is more comprehensibly written using deposit32(), so do that and drop the mask variable entirely. We also update the buff_st local variable at multiple points during this function, but nothing can ever see these intermediate values, so just drop those, write the final TXT_TOK as a fixed constant value, and collapse the only remaining set/use of buff_st down into an extract32(). Fixes: Coverity CID 1432869 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-11-11hw/net/can/ctucan: Don't allow guest to write off end of tx_bufferPeter Maydell1-2/+4
The ctucan device has 4 CAN bus cores, each of which has a set of 20 32-bit registers for writing the transmitted data. The registers are however not contiguous; each core's buffers is 0x100 bytes after the last. We got the checks on the address wrong in the ctucan_mem_write() function: * the first "is addr in range at all" check allowed addr == CTUCAN_CORE_MEM_SIZE, which is actually the first byte off the end of the range * the decode of addresses into core-number plus offset in the tx buffer for that core failed to check that the offset was in range, so the guest could write off the end of the tx_buffer[] array NB: currently the values of CTUCAN_CORE_MEM_SIZE, CTUCAN_CORE_TXBUF_NUM, etc, make "buff_num >= CTUCAN_CORE_TXBUF_NUM" impossible, but we retain this as a runtime check rather than an assertion to permit those values to be changed in future (in hardware they are configurable synthesis parameters). Fix the top level check, and check the offset is within the buffer. Fixes: Coverity CID 1432874 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-11-11pvpanic: Advertise the PVPANIC_CRASHLOADED event supportPaolo Bonzini2-1/+5
Advertise both types of events as supported when the guest OS queries the pvpanic device. Currently only PVPANIC_PANICKED is exposed; PVPANIC_CRASHLOADED must also be advertised, but only on new machine types. Fixes: 7dc58deea79a ("pvpanic: implement crashloaded event handling") Reported-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-11-11virtio-net: Set mac address to hardware if the peer is vdpaCindy Lu1-0/+6
If the peer's type is vdpa, we need to set the mac address to hardware in virtio_net_device_realize, Signed-off-by: Cindy Lu <lulu@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-11-10Merge remote-tracking branch ↵Peter Maydell8-38/+43
'remotes/pmaydell/tags/pull-target-arm-20201110' into staging target-arm queue: * hw/arm/Kconfig: ARM_V7M depends on PTIMER * Minor coding style fixes * docs: add some notes on the sbsa-ref machine * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals * target/arm: Fix neon VTBL/VTBX for len > 1 * hw/arm/armsse: Correct expansion MPC interrupt lines * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup() * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary * hw/arm/nseries: Check return value from load_image_targphys() * tests/qtest/npcm7xx_rng-test: count runs properly * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check # gpg: Signature made Tue 10 Nov 2020 11:17:45 GMT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20201110: target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check tests/qtest/npcm7xx_rng-test: count runs properly hw/arm/nseries: Check return value from load_image_targphys() hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup() hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ hw/arm/armsse: Correct expansion MPC interrupt lines target/arm: Fix neon VTBL/VTBX for len > 1 hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals docs: add some notes on the sbsa-ref machine target/arm: add space before the open parenthesis '(' target/arm: Don't use '#' flag of printf format target/arm: add spaces around operator ssi: Fix bad printf format specifiers hw/arm/Kconfig: ARM_V7M depends on PTIMER Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10Merge remote-tracking branch ↵Peter Maydell1-2/+2
'remotes/huth-gitlab/tags/pull-request-2020-11-10' into staging * Some small qtest fixes * Oss-fuzz updates * Publish the docs built during gitlab CI to the user's gitlab.io page * Update the OpenBSD VM test to v6.8 * Fix the device-crash-test script to run with the meson build system * Some small s390x fixes # gpg: Signature made Tue 10 Nov 2020 11:05:06 GMT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth-gitlab/tags/pull-request-2020-11-10: s390x: Avoid variable size warning in ipl.h s390x: fix clang 11 warnings in cpu_models.c qtest: Update references to parse_escape() in comments fuzz: add virtio-blk fuzz target docs: add "page source" link to sphinx documentation gitlab: force enable docs build in Fedora, Ubuntu, Debian gitlab: publish the docs built during CI configure: surface deprecated targets in the help output fuzz: Make fork_fuzz.ld compatible with LLVM's LLD scripts/oss-fuzz: give all fuzzers -target names docs/fuzz: update fuzzing documentation post-meson docs/fuzz: rST-ify the fuzzing documentation MAINTAINERS: Add gitlab-pipeline-status script to GitLab CI section gitlab-ci: Drop generic cache rule tests/qtest/tpm: Remove redundant check in the tpm_test_swtpm_test() qtest: Fix bad printf format specifiers device-crash-test: Check if path is actually an executable file tests/vm: update openbsd to release 6.8 meson: always include contrib/libvhost-user Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10hw/arm/nseries: Check return value from load_image_targphys()Peter Maydell1-4/+11
The nseries machines have a codepath that allows them to load a secondary bootloader. This code wasn't checking that the load_image_targphys() succeeded. Check the return value and report the error to the user. While we're in the vicinity, fix the comment style of the comment documenting what this image load is doing. Fixes: Coverity CID 1192904 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
2020-11-10hw/arm/musicpal: Only use qdev_get_gpio_in() when necessaryPhilippe Mathieu-Daudé1-12/+13
We don't need to fill the full pic[] array if we only use few of the interrupt lines. Directly call qdev_get_gpio_in() when necessary. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201107193403.436146-6-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10hw/arm/musicpal: Don't connect two qemu_irqs directly to the same inputPhilippe Mathieu-Daudé2-4/+14
The MusicPal board code connects both of the IRQ outputs of the UART to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly to the same input is not valid as it produces subtly wrong behaviour (for instance if both the IRQ lines are high, and then one goes low, the INTC input will see this as a high-to-low transition even though the second IRQ line should still be holding it high). This kind of wiring needs an explicitly created OR gate; add one. Inspired-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201107193403.436146-5-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()Philippe Mathieu-Daudé1-11/+0
omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic OMAP2 chip support") takes care of creating the 3 UARTs. Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+ extensions and attach to n8x0's UART") added n8x0_uart_setup() which create the UART and connects it to an IRQ output, overwritting the existing peripheral and its IRQ connection. This is incorrect. Fortunately we don't need to fix this, because commit 6da68df7f9b ("hw/arm/nseries: Replace the bluetooth chardev with a "null" chardev") removed the use of this peripheral. We can simply remove the code. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201107193403.436146-4-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10hw/misc/stm32f2xx_syscfg: Remove extraneous IRQPhilippe Mathieu-Daudé2-3/+0
The system configuration controller (SYSCFG) doesn't have any output IRQ (and the INTC input #71 belongs to the UART6). Remove the invalid code. Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201107193403.436146-3-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10hw/arm/armsse: Correct expansion MPC interrupt linesPhilippe Mathieu-Daudé1-1/+2
We can use one MPC per SRAM bank, but we currently only wire the IRQ from the first expansion MPC to the IRQ splitter. Fix that. Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines") Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201107193403.436146-2-f4bug@amsat.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripheralsPhilippe Mathieu-Daudé1-1/+0
When using a Cortex-A15, the Virt machine does not use any MPCore peripherals. Remove the dependency. Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig") Reported-by: Miroslav Rezanina <mrezanin@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201107114852.271922-1-philmd@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10ssi: Fix bad printf format specifiersAlexChen2-2/+2
We should use printf format specifier "%u" instead of "%d" for argument of type "unsigned int". Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Alex Chen <alex.chen@huawei.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 5FA280F5.8060902@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10hw/arm/Kconfig: ARM_V7M depends on PTIMERAndrew Jones1-0/+1
commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers") changed armv7m_systick to build on ptimers. Make sure we have ptimers in the build when building armv7m_systick. Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20201104103343.30392-1-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10Merge remote-tracking branch ↵Peter Maydell1-0/+3
'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging This fixes two bugs in the RISC-V port. One is a bug in the Ibex PLIC, the other fixes the Hypvervisor access functions. # gpg: Signature made Tue 10 Nov 2020 03:53:49 GMT # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20201109: hw/intc/ibex_plic: Clear the claim register when read target/riscv: Split the Hypervisor execute load helpers target/riscv: Remove the hyp load and store functions target/riscv: Remove the HS_TWO_STAGE flag target/riscv: Set the virtualised MMU mode when doing hyp accesses target/riscv: Add a virtualised MMU Mode Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-10s390x: Avoid variable size warning in ipl.hDaniele Buono1-2/+2
S390IPLState contains two IplParameterBlock, which may in turn have either a IPLBlockPV or a IplBlockFcp, both ending with a variable sized field (an array). This causes a warning with clang 11 or greater, which checks that variable sized type are only allocated at the end of the struct: In file included from ../qemu-cfi-v3/target/s390x/diag.c:21: ../qemu-cfi-v3/hw/s390x/ipl.h:161:23: error: field 'iplb' with variable sized type 'IplParameterBlock' (aka 'union IplParameterBlock') not at the end of a struct or class is a GNU extension [-Werror,-Wgnu-variable-sized-type-not-at-end] IplParameterBlock iplb; ^ ../qemu-cfi-v3/hw/s390x/ipl.h:162:23: error: field 'iplb_pv' with variable sized type 'IplParameterBlock' (aka 'union IplParameterBlock') not at the end of a struct or class is a GNU extension [-Werror,-Wgnu-variable-sized-type-not-at-end] IplParameterBlock iplb_pv; In this case, however, the warning is a false positive, because IPLBlockPV and IplBlockFcp are allocated in a union wrapped at 4K, making the union non-variable sized. Fix the warning by turning the two variable sized arrays into arrays of size 0. This avoids the compiler error and should produce the same code. Signed-off-by: Daniele Buono <dbuono@linux.vnet.ibm.com> Message-Id: <20201105221905.1350-5-dbuono@linux.vnet.ibm.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-11-09hw/intc/ibex_plic: Clear the claim register when readAlistair Francis1-0/+3
After claiming the interrupt by reading the claim register we want to clear the register to make sure the interrupt doesn't appear at the next read. This matches the documentation for the claim register as when an interrupt is claimed by a target the relevant bit of IP is cleared (which we already do): https://docs.opentitan.org/hw/ip/rv_plic/doc/index.html This also matches the current hardware. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 68d4575deef2559b7a747f3bda193fcf43af4558.1604629928.git.alistair.francis@wdc.com
2020-11-09hw/block/nvme: fix free of array-typed valueKlaus Jensen1-1/+0
Since 7f0f1acedf15 ("hw/block/nvme: support multiple namespaces"), the namespaces member of NvmeCtrl is no longer a dynamically allocated array. Remove the free. Fixes: 7f0f1acedf15 ("hw/block/nvme: support multiple namespaces") Reported-by: Coverity (CID 1436131) Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Message-Id: <20201104102248.32168-4-its@irrelevant.dk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-11-09hw/block/nvme: fix uint16_t use of uint32_t sgls memberKlaus Jensen1-1/+1
nvme_map_sgl_data erroneously uses the sgls member of NvmeIdNs as a uint16_t. Reported-by: Coverity (CID 1436129) Fixes: cba0a8a344fe ("hw/block/nvme: add support for scatter gather lists") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Message-Id: <20201104102248.32168-3-its@irrelevant.dk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-11-09hw/block/nvme: fix null ns in register namespaceKlaus Jensen1-2/+1
Fix dereference after NULL check. Reported-by: Coverity (CID 1436128) Fixes: b20804946bce ("hw/block/nvme: update nsid when registered") Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Message-Id: <20201104102248.32168-2-its@irrelevant.dk> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Max Reitz <mreitz@redhat.com>
2020-11-09Merge remote-tracking branch ↵Peter Maydell1-2/+1
'remotes/philmd-gitlab/tags/renesas-fixes-20201109' into staging Renesas patches queue - Demote target & hardware sections to 'Odd Fixes' - Fix memory leak (CID 1432307) CI jobs results: . https://cirrus-ci.com/build/5340929353580544 . https://gitlab.com/philmd/qemu/-/pipelines/213407241 . https://travis-ci.org/github/philmd/qemu/builds/742315021 # gpg: Signature made Sun 08 Nov 2020 23:58:37 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/renesas-fixes-20201109: hw/rx/rx-gdbsim: Fix memory leak (CID 1432307) MAINTAINERS: Demote Renesas target & hardware to 'Odd Fixes' Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-09hw/rx/rx-gdbsim: Fix memory leak (CID 1432307)Philippe Mathieu-Daudé1-2/+1
As load_device_tree() returns allocated memory, we need to free it. Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Fixes: bda19d7bb56 ("hw/rx: Add RX GDB simulator") Reported-by: Coverity (CID 1432307: RESOURCE_LEAK) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20201102104542.2064745-1-f4bug@amsat.org>
2020-11-09hw/mips/boston: Fix memory leak in boston_fdt_filter() error-handling pathsPeter Maydell1-6/+4
Coverity points out that the error-handling paths in the boston_fdt_filter() function don't free the fdt that was allocated. Fix the leak by using g_autofree. Fixes: Coverity CID 1432275 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20201106175823.1650-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2020-11-06Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20201106' into stagingPeter Maydell1-1/+1
some s390x fixes, including a bios update # gpg: Signature made Fri 06 Nov 2020 13:08:42 GMT # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [unknown] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [unknown] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20201106: s390x: fix build for --without-default-devices target/s390x: fix execution with icount pc-bios/s390: update s390-ccw bios binaries s390-bios: Skip writing iplb location to low core for ccw ipl Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-06Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20201106' ↵Peter Maydell6-25/+18
into staging 9pfs: some fixes * Fix meson build config for Xen. * Code style fixes. # gpg: Signature made Fri 06 Nov 2020 09:12:51 GMT # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * remotes/cschoenebeck/tags/pull-9p-20201106: hw/9pfs: Fix Kconfig dependency problem between 9pfs and Xen hw/9pfs : add space before the open parenthesis '(' hw/9pfs : open brace '{' following struct go on the same line hw/9pfs : add spaces around operator Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-05Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-5.2-20201105' ↵Peter Maydell2-7/+1
into staging ppc patch queue for 2020-11-05 A small PR this time, one bugfix, one removal of minor dead code, one warning suppression. # gpg: Signature made Thu 05 Nov 2020 03:44:51 GMT # gpg: using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full] # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full] # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" [full] # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" [unknown] # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dg-gitlab/tags/ppc-for-5.2-20201105: spapr: Convert hpt_prepare_thread() to use qemu_try_memalign() spapr: Drop dead code in spapr_reallocate_hpt() target/ppc/excp_helper: Add a fallthrough for fix compiler warning Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-05Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell14-35/+386
pc,pci,vhost,virtio: fixes Lots of fixes all over the place. virtio-mem and virtio-iommu patches are kind of fixes but it seems better to just make them behave sanely than try to educate users about the limitations ... Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 04 Nov 2020 18:40:03 GMT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (31 commits) contrib/vhost-user-blk: fix get_config() information leak block/export: fix vhost-user-blk get_config() information leak block/export: make vhost-user-blk config space little-endian configure: introduce --enable-vhost-user-blk-server libvhost-user: follow QEMU comment style vhost-blk: set features before setting inflight feature Revert "vhost-blk: set features before setting inflight feature" net: Add vhost-vdpa in show_netdevs() vhost-vdpa: Add qemu_close in vhost_vdpa_cleanup vfio: Don't issue full 2^64 unmap virtio-iommu: Set supported page size mask vfio: Set IOMMU page size as per host supported page size memory: Add interface to set iommu page size mask virtio-iommu: Add notify_flag_changed() memory region callback virtio-iommu: Add replay() memory region callback virtio-iommu: Call memory notifiers in attach/detach virtio-iommu: Add memory notifiers for map/unmap virtio-iommu: Store memory region in endpoint struct virtio-iommu: Fix virtio_iommu_mr() hw/smbios: Fix leaked fd in save_opt_one() error path ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-05hw/9pfs: Fix Kconfig dependency problem between 9pfs and XenPhilippe Mathieu-Daudé2-5/+1
Commit b2c00bce54c ("meson: convert hw/9pfs, cleanup") introduced CONFIG_9PFS (probably a wrong conflict resolution). This config is not used anywhere. Backends depend on CONFIG_FSDEV_9P which itself depends on CONFIG_VIRTFS. Remove the invalid CONFIG_9PFS and use CONFIG_FSDEV_9P instead, to fix the './configure --without-default-devices --enable-xen' build: /usr/bin/ld: libcommon.fa.p/hw_xen_xen-legacy-backend.c.o: in function `xen_be_register_common': hw/xen/xen-legacy-backend.c:754: undefined reference to `xen_9pfs_ops' /usr/bin/ld: libcommon.fa.p/fsdev_qemu-fsdev.c.o:(.data.rel+0x8): undefined reference to `local_ops' /usr/bin/ld: libcommon.fa.p/fsdev_qemu-fsdev.c.o:(.data.rel+0x20): undefined reference to `synth_ops' /usr/bin/ld: libcommon.fa.p/fsdev_qemu-fsdev.c.o:(.data.rel+0x38): undefined reference to `proxy_ops' collect2: error: ld returned 1 exit status Fixes: b2c00bce54c ("meson: convert hw/9pfs, cleanup") Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Greg Kurz <groug@kaod.org> Tested-by: Greg Kurz <groug@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20201104115706.3101190-3-philmd@redhat.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2020-11-05hw/9pfs : add space before the open parenthesis '('Xinhao Zhang1-1/+1
Fix code style. Space required before the open parenthesis '('. Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com> Signed-off-by: Kai Deng <dengkai1@huawei.com> Reported-by: Euler Robot <euler.robot@huawei.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20201030043515.1030223-3-zhangxinhao1@huawei.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2020-11-05hw/9pfs : open brace '{' following struct go on the same lineXinhao Zhang1-6/+3
Fix code style. Open braces for struct should go on the same line. Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com> Signed-off-by: Kai Deng <dengkai1@huawei.com> Reported-by: Euler Robot <euler.robot@huawei.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20201030043515.1030223-2-zhangxinhao1@huawei.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2020-11-05hw/9pfs : add spaces around operatorXinhao Zhang2-13/+13
Fix code style. Operator needs spaces both sides. Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com> Signed-off-by: Kai Deng <dengkai1@huawei.com> Reported-by: Euler Robot <euler.robot@huawei.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20201030043515.1030223-1-zhangxinhao1@huawei.com> Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2020-11-05Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell1-3/+11
staging Doc and bug fixes # gpg: Signature made Wed 04 Nov 2020 17:01:29 GMT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: qapi, qemu-options: make all parsing visitors parse boolean options the same qtest: escape device name in device-introspect-test ivshmem-test: do not use short-form boolean option semihosting: fix order of initialization functions fuzz: fuzz offsets within pio/mmio regions fuzz: check the MR in the DMA callback fuzz: fix writing DMA patterns tests/qtest: Fix potential NULL pointer dereference in qos_build_main_args() configure: fix gio_libs reference meson: fix warning for bad sphinx-build tests/qtest/libqos/ahci.c: Avoid NULL dereference in ahci_exec() tests/qtest/libqtest.c: Check for setsockopt() failure meson: vhost-user-gpu/virtiofsd: use absolute path meson: use b_staticpic=false for meson >=0.56.0 qtest: add a reproducer for LP#1878642 hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ scripts/oss-fuzz: rename bin/qemu-fuzz-i386 exec: Remove dead code (CID 1432876) docs: expand sourceset documentation cutils: replace strdup with g_strdup Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-05s390x: fix build for --without-default-devicesCornelia Huck1-1/+1
s390-pci-vfio.c calls into the vfio code, so we need it to be built conditionally on vfio (which implies CONFIG_LINUX). Fixes: cd7498d07fbb ("s390x/pci: Add routine to get the vfio dma available count") Reported-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Message-Id: <20201103123237.718242-1-cohuck@redhat.com> Acked-by: Greg Kurz <groug@kaod.org> Tested-by: Greg Kurz <groug@kaod.org> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-11-05spapr: Convert hpt_prepare_thread() to use qemu_try_memalign()Greg Kurz1-1/+1
HPT resizing is asynchronous: the guest first kicks off the creation of a new HPT, then it waits for that new HPT to be actually created and finally it asks the current HPT to be replaced by the new one. In the case of a userland allocated HPT, this currently relies on calling qemu_memalign() which aborts on OOM and never returns NULL. Since we seem to have path to report the failure to the guest with an H_NO_MEM return value, use qemu_try_memalign() instead of qemu_memalign(). Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <160398563636.32380.1747166034877173994.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-11-05spapr: Drop dead code in spapr_reallocate_hpt()Greg Kurz1-6/+0
Sometimes QEMU needs to allocate the HPT in userspace, namely with TCG or PR KVM. This is performed with qemu_memalign() because of alignment requirements. Like glib's allocators, its behaviour is to abort on OOM instead of returning NULL. This could be changed to qemu_try_memalign(), but in the specific case of spapr_reallocate_hpt(), the outcome would be to terminate QEMU anyway since no HPT means no MMU for the guest. Drop the dead code instead. Signed-off-by: Greg Kurz <groug@kaod.org> Message-Id: <160398562892.32380.15006707861753544263.stgit@bahia.lan> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-11-04Merge remote-tracking branch ↵Peter Maydell1-4/+6
'remotes/kraxel/tags/fixes-20201104-pull-request' into staging misc bugfixes for 5.2 # gpg: Signature made Wed 04 Nov 2020 15:46:33 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20201104-pull-request: roms/Makefile: Add qboot to .PHONY list ati: check x y display parameter values vnc: fix resource leak when websocket channel error Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-04Merge remote-tracking branch 'remotes/kraxel/tags/usb-20201104-pull-request' ↵Peter Maydell2-131/+216
into staging usb: bugfixes for usb-serial # gpg: Signature made Wed 04 Nov 2020 12:13:05 GMT # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/usb-20201104-pull-request: dev-serial: store flow control and xon/xoff characters dev-serial: add support for setting data_bits in QEMUSerialSetParams dev-serial: add always-plugged property to ensure USB device is always attached dev-serial: replace DeviceOutVendor/DeviceInVendor with equivalent macros from usb.h dev-serial: add trace-events for baud rate and data parameters dev-serial: convert from DPRINTF to trace-events dev-serial: use USB_SERIAL QOM macro for USBSerialState assignments dev-serial: style changes to improve readability and checkpatch fixes Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-04Merge remote-tracking branch ↵Peter Maydell10-340/+8
'remotes/philmd-gitlab/tags/mips-fixes-20201103' into staging MIPS patches queue - Removal of the 'r4k' machine (deprecated before 5.0) - Fix LGPL license text (Chetan Pant) - Support unaligned accesses on Loongson-3 (Huacai Chen) - Fix out-of-bound access in Loongson-3 embedded I/O interrupt controller (Alex Chen) CI jobs results: . https://cirrus-ci.com/build/6324890389184512 . https://gitlab.com/philmd/qemu/-/pipelines/211275262 . https://travis-ci.org/github/philmd/qemu/builds/741188958 # gpg: Signature made Tue 03 Nov 2020 17:30:30 GMT # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/mips-fixes-20201103: target/mips: Add unaligned access support for MIPS64R6 and Loongson-3 target/mips: Fix Lesser GPL version number hw/intc/loongson: Fix incorrect 'core' calculation in liointc_read/write hw/mips/boston: Fix Lesser GPL version number hw/mips: Fix Lesser GPL version number hw/mips: Remove the 'r4k' machine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-11-04ati: check x y display parameter valuesPrasad J Pandit1-4/+6
The source and destination x,y display parameters in ati_2d_blt() may run off the vga limits if either of s->regs.[src|dst]_[xy] is zero. Check the parameter values to avoid potential crash. Reported-by: Gaoning Pan <pgn@zju.edu.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20201021103818.1704030-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-11-04dev-serial: store flow control and xon/xoff charactersMark Cave-Ayland2-3/+37
Note that whilst the device does not do anything with these values, they are logged with trace events and stored to allow future implementation. The default flow control is set to none at reset as documented in the Linux ftdi_sio.h header file. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-id: 20201027150456.24606-9-mark.cave-ayland@ilande.co.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-11-04dev-serial: add support for setting data_bits in QEMUSerialSetParamsMark Cave-Ayland2-0/+18
Also implement the behaviour reported in Linux's ftdi_sio.c whereby if an invalid data_bits value is provided then the hardware defaults to using 8. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201027150456.24606-8-mark.cave-ayland@ilande.co.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-11-04dev-serial: add always-plugged property to ensure USB device is always attachedMark Cave-Ayland1-3/+6
Some operating systems will generate a new device ID when a USB device is unplugged and then replugged into the USB. If this is done whilst switching between multiple applications over a virtual serial port, the change of device ID requires going back into the OS/application to locate the new device accordingly. Add a new always-plugged property that if specified will ensure that the device always remains attached to the USB regardless of the state of the backend chardev. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Message-id: 20201027150456.24606-7-mark.cave-ayland@ilande.co.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-11-04dev-serial: replace DeviceOutVendor/DeviceInVendor with equivalent macros ↵Mark Cave-Ayland1-15/+10
from usb.h The DeviceOutVendor and DeviceInVendor macros can be replaced with their equivalent VendorDeviceOutRequest and VendorDeviceRequest macros from usb.h. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201027150456.24606-6-mark.cave-ayland@ilande.co.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-11-04dev-serial: add trace-events for baud rate and data parametersMark Cave-Ayland2-0/+5
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201027150456.24606-5-mark.cave-ayland@ilande.co.uk Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.1 at 2024-07-21 12:22:48 +0000