From 9feb8adeaa850d15b930c30f22c1ed2f2f695172 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Wed, 10 Dec 2014 10:17:36 +0100 Subject: vt82c686: avoid out-of-bounds read superio_ioport_readb can read the 256th element of the array. Coverity reports an out-of-bounds write in superio_ioport_writeb, but it does not show the corresponding out-of-bounds read because it cannot prove that it can happen. Fix the root cause of the problem (zhanghailang's patch instead fixes the logic in superio_ioport_writeb). Signed-off-by: Paolo Bonzini Reviewed-by: zhanghailiang Signed-off-by: Michael Tokarev Cc: qemu-stable@nongnu.org --- hw/isa/vt82c686.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c index 223b947..2f53bf8 100644 --- a/hw/isa/vt82c686.c +++ b/hw/isa/vt82c686.c @@ -36,7 +36,7 @@ typedef struct SuperIOConfig { - uint8_t config[0xff]; + uint8_t config[0x100]; uint8_t index; uint8_t data; } SuperIOConfig; -- cgit v1.1 From 9c6d5c1ade0b681b6f93c3d9d214389355cc563c Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Tue, 23 Dec 2014 22:26:53 +0000 Subject: tests/hd-geo-test.c: Remove unused test_image variable Remove unused variable test_image; this silences a clang warning. Signed-off-by: Peter Maydell Signed-off-by: Michael Tokarev --- tests/hd-geo-test.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/tests/hd-geo-test.c b/tests/hd-geo-test.c index 7cc8dff..00afc20 100644 --- a/tests/hd-geo-test.c +++ b/tests/hd-geo-test.c @@ -22,8 +22,6 @@ #include "qemu-common.h" #include "libqtest.h" -static const char test_image[] = "/tmp/qtest.XXXXXX"; - static char *create_test_img(int secs) { char *template = strdup("/tmp/qtest.XXXXXX"); -- cgit v1.1 From 2d8ac5eb7a7e72e0877cca2b3705eebeaf5526e7 Mon Sep 17 00:00:00 2001 From: SeokYeon Hwang Date: Tue, 23 Dec 2014 22:26:54 +0000 Subject: translate-all: Mark map_exec() with the 'unused' attribute Mark map_exec() with the 'unused' attribute to avoid '-Wunused-function' warnings on clang 3.4 or later. This means we don't need to mark it 'inline', which is what we were previously using to suppress the warning (a trick which only works with gcc, not clang). Signed-off-by: SeokYeon Hwang Reviewed-by: Paolo Bonzini [PMM: tweaked comment message a little] Signed-off-by: Peter Maydell Signed-off-by: Michael Tokarev --- translate-all.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/translate-all.c b/translate-all.c index 8fa4378..687ba7d 100644 --- a/translate-all.c +++ b/translate-all.c @@ -276,14 +276,14 @@ bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr) } #ifdef _WIN32 -static inline void map_exec(void *addr, long size) +static __attribute__((unused)) void map_exec(void *addr, long size) { DWORD old_protect; VirtualProtect(addr, size, PAGE_EXECUTE_READWRITE, &old_protect); } #else -static inline void map_exec(void *addr, long size) +static __attribute__((unused)) void map_exec(void *addr, long size) { unsigned long start, end, page_size; -- cgit v1.1 From 90d6a6730b4dbe7d0ada9900aba8263d61376812 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Tue, 23 Dec 2014 22:26:55 +0000 Subject: migration/qemu-file.c: Don't shift left into sign bit Add a cast in qemu_get_be32() to avoid shifting left into the sign bit of a signed integer (which is undefined behaviour in C). Signed-off-by: Peter Maydell Signed-off-by: Michael Tokarev --- migration/qemu-file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/migration/qemu-file.c b/migration/qemu-file.c index d2d4007..a7f2a34 100644 --- a/migration/qemu-file.c +++ b/migration/qemu-file.c @@ -503,7 +503,7 @@ unsigned int qemu_get_be16(QEMUFile *f) unsigned int qemu_get_be32(QEMUFile *f) { unsigned int v; - v = qemu_get_byte(f) << 24; + v = (unsigned int)qemu_get_byte(f) << 24; v |= qemu_get_byte(f) << 16; v |= qemu_get_byte(f) << 8; v |= qemu_get_byte(f); -- cgit v1.1 From 37097418be0a722342fc0ef77c2e773359d2cd05 Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Sat, 3 Jan 2015 14:41:37 +0100 Subject: target-tricore: Fix new typos adress -> address managment -> management Cc: Bastian Koppelmann Signed-off-by: Stefan Weil Signed-off-by: Michael Tokarev --- target-tricore/csfr.def | 2 +- target-tricore/translate.c | 2 +- target-tricore/tricore-opcodes.h | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/target-tricore/csfr.def b/target-tricore/csfr.def index 5b219b4..05c45dd 100644 --- a/target-tricore/csfr.def +++ b/target-tricore/csfr.def @@ -90,7 +90,7 @@ A(0xE200, CPM0, TRICORE_FEATURE_13) A(0xE280, CPM1, TRICORE_FEATURE_13) A(0xE300, CPM2, TRICORE_FEATURE_13) A(0xE380, CPM3, TRICORE_FEATURE_13) -/* memory Managment Registers */ +/* memory management registers */ A(0x8000, MMU_CON, TRICORE_FEATURE_13) A(0x8004, MMU_ASI, TRICORE_FEATURE_13) A(0x800C, MMU_TVA, TRICORE_FEATURE_13) diff --git a/target-tricore/translate.c b/target-tricore/translate.c index 3b83782..def7f4a 100644 --- a/target-tricore/translate.c +++ b/target-tricore/translate.c @@ -5022,7 +5022,7 @@ static void decode_32Bit_opc(CPUTriCoreState *env, DisasContext *ctx) case OPCM_32_RR_LOGICAL_SHIFT: decode_rr_logical_shift(env, ctx); break; - case OPCM_32_RR_ADRESS: + case OPCM_32_RR_ADDRESS: decode_rr_address(env, ctx); break; case OPCM_32_RR_IDIRECT: diff --git a/target-tricore/tricore-opcodes.h b/target-tricore/tricore-opcodes.h index 919063e..82bd161 100644 --- a/target-tricore/tricore-opcodes.h +++ b/target-tricore/tricore-opcodes.h @@ -503,7 +503,7 @@ enum { /* RR Format */ OPCM_32_RR_LOGICAL_SHIFT = 0x0f, OPCM_32_RR_ACCUMULATOR = 0x0b, - OPCM_32_RR_ADRESS = 0x01, + OPCM_32_RR_ADDRESS = 0x01, OPCM_32_RR_DIVIDE = 0x4b, OPCM_32_RR_IDIRECT = 0x2d, /* RR1 Format */ @@ -1082,7 +1082,7 @@ enum { OPC2_32_RR_XOR_LT_U = 0x32, OPC2_32_RR_XOR_NE = 0x30, }; -/* OPCM_32_RR_ADRESS */ +/* OPCM_32_RR_ADDRESS */ enum { OPC2_32_RR_ADD_A = 0x01, OPC2_32_RR_ADDSC_A = 0x60, -- cgit v1.1 From 1281f8e3085b9149b8704419534f0e6f23c1fa64 Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Sat, 3 Jan 2015 14:41:38 +0100 Subject: target-arm: Fix typo in comment (seperately -> separately) Cc: Peter Maydell Cc: Greg Bellows Signed-off-by: Stefan Weil Signed-off-by: Michael Tokarev --- target-arm/helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index 3ef0f1f..1a5e067 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -972,7 +972,7 @@ static const ARMCPRegInfo v7_cp_reginfo[] = { * The override is necessary because of the overly-broad TLB_LOCKDOWN * definition. */ - /* MAIR0/1 are defined seperately from their 64-bit counterpart which + /* MAIR0/1 are defined separately from their 64-bit counterpart which * allows them to assign the correct fieldoffset based on the endianness * handled in the field definitions. */ -- cgit v1.1 From b4952c3677170139541bc6bc14e9c2cfdc056181 Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Sat, 3 Jan 2015 14:41:39 +0100 Subject: misc: Fix new typos in comments recieve -> receive suprise -> surprise Cc: Igor Mammedov Cc: John Snow Signed-off-by: Stefan Weil Reviewed-by: John Snow Signed-off-by: Michael Tokarev --- include/hw/hotplug.h | 2 +- tests/ahci-test.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/hw/hotplug.h b/include/hw/hotplug.h index 050d2f0..2db025d 100644 --- a/include/hw/hotplug.h +++ b/include/hw/hotplug.h @@ -52,7 +52,7 @@ typedef void (*hotplug_fn)(HotplugHandler *plug_handler, * require asynchronous unplug handling. * @unplug: unplug callback. * Used for device removal with devices that implement - * asynchronous and synchronous (suprise) removal. + * asynchronous and synchronous (surprise) removal. */ typedef struct HotplugHandlerClass { /* */ diff --git a/tests/ahci-test.c b/tests/ahci-test.c index e77fa3a..b1a59f2 100644 --- a/tests/ahci-test.c +++ b/tests/ahci-test.c @@ -1289,7 +1289,7 @@ static void ahci_test_identify(QPCIDevice *ahci, void *hba_base) PX_WREG(i, AHCI_PX_IS, reg); g_assert_cmphex(PX_RREG(i, AHCI_PX_IS), ==, 0); - /* Wipe the FIS-Recieve Buffer */ + /* Wipe the FIS-Receive Buffer */ fb = PX_RREG(i, AHCI_PX_FB); g_assert_cmphex(fb, !=, 0); qmemset(fb, 0x00, 0x100); -- cgit v1.1 From fac6688a18574b6f2caa8c699a936e729ed53ece Mon Sep 17 00:00:00 2001 From: Don Slutz Date: Mon, 22 Dec 2014 10:04:00 -0500 Subject: Do not hang on full PTY Signed-off-by: Don Slutz Reviewed-by: Paolo Bonzini Signed-off-by: Michael Tokarev --- qemu-char.c | 1 + 1 file changed, 1 insertion(+) diff --git a/qemu-char.c b/qemu-char.c index 5430b87..98d4342 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -1402,6 +1402,7 @@ static CharDriverState *qemu_chr_open_pty(const char *id, } close(slave_fd); + qemu_set_nonblock(master_fd); chr = qemu_chr_alloc(); -- cgit v1.1 From 3d59b6808bc5e0efbf1aee48d7f9ea96d19df05d Mon Sep 17 00:00:00 2001 From: David Morrison Date: Tue, 6 Jan 2015 09:06:18 -0800 Subject: target-openrisc: bugfix for dec_sys to decode instructions correctly Fixed the decoding of "system" instructions (starting with 0x2) in dec_sys() in translate.c. In particular, the l.trap instruction is now correctly decoded, which enables for singlestepping and breakpoints to be set in GDB. Signed-off-by: David R. Morrison Acked-by: Jia Liu Signed-off-by: Michael Tokarev --- target-openrisc/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target-openrisc/translate.c b/target-openrisc/translate.c index 7dea405..b90181d 100644 --- a/target-openrisc/translate.c +++ b/target-openrisc/translate.c @@ -1320,7 +1320,7 @@ static void dec_sys(DisasContext *dc, uint32_t insn) #ifdef OPENRISC_DISAS uint32_t K16; #endif - op0 = extract32(insn, 16, 8); + op0 = extract32(insn, 16, 10); #ifdef OPENRISC_DISAS K16 = extract32(insn, 0, 16); #endif -- cgit v1.1 From ae21935924365efecf5c5ba998cb6cb8c85a499b Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Mon, 15 Dec 2014 11:19:46 +0100 Subject: Makefile: Remove config.status and common.env during 'make distclean' config.status and tests/qemu-iotests/common.env are generated files that should be deleted during 'make distclean'. Signed-off-by: Thomas Huth Signed-off-by: Michael Tokarev --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index f505202..6817c6f 100644 --- a/Makefile +++ b/Makefile @@ -313,8 +313,8 @@ qemu-%.tar.bz2: distclean: clean rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi - rm -f config-all-devices.mak config-all-disas.mak - rm -f po/*.mo + rm -f config-all-devices.mak config-all-disas.mak config.status + rm -f po/*.mo tests/qemu-iotests/common.env rm -f roms/seabios/config.mak roms/vgabios/config.mak rm -f qemu-doc.info qemu-doc.aux qemu-doc.cp qemu-doc.cps qemu-doc.dvi rm -f qemu-doc.fn qemu-doc.fns qemu-doc.info qemu-doc.ky qemu-doc.kys -- cgit v1.1 From 31fc97c3145d428751f8bc4d5666a525d5c3dc2f Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Fri, 9 Jan 2015 10:59:49 +0100 Subject: blizzard: do not depend on VGA internals There is nothing that is used by this ARM-specific device. Signed-off-by: Paolo Bonzini Signed-off-by: Michael Tokarev --- hw/display/blizzard.c | 1 - 1 file changed, 1 deletion(-) diff --git a/hw/display/blizzard.c b/hw/display/blizzard.c index 92b1fac..5019bbb 100644 --- a/hw/display/blizzard.c +++ b/hw/display/blizzard.c @@ -21,7 +21,6 @@ #include "qemu-common.h" #include "ui/console.h" #include "hw/devices.h" -#include "vga_int.h" #include "ui/pixel_ops.h" typedef void (*blizzard_fn_t)(uint8_t *, const uint8_t *, unsigned int); -- cgit v1.1 From 99efa84d5c02e33bcca7be83dd7cabc4b0f22f14 Mon Sep 17 00:00:00 2001 From: Marcel Apfelbaum Date: Sun, 11 Jan 2015 12:56:51 +0200 Subject: vl.c: fix some alignment issues The misalignment was caused by tabs which were used instead of spaces. Signed-off-by: Marcel Apfelbaum Reviewed-by: Stefan Weil Signed-off-by: Michael Tokarev --- vl.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/vl.c b/vl.c index 6adb36e..fbf4240 100644 --- a/vl.c +++ b/vl.c @@ -2873,7 +2873,7 @@ int main(int argc, char **argv, char **envp) if (optind >= argc) break; if (argv[optind][0] != '-') { - hda_opts = drive_add(IF_DEFAULT, 0, argv[optind++], HD_OPTS); + hda_opts = drive_add(IF_DEFAULT, 0, argv[optind++], HD_OPTS); } else { const QEMUOption *popt; @@ -2918,15 +2918,15 @@ int main(int argc, char **argv, char **envp) if (drive_def(optarg) == NULL) { exit(1); } - break; + break; case QEMU_OPTION_set: if (qemu_set_option(optarg) != 0) exit(1); - break; + break; case QEMU_OPTION_global: if (qemu_global_option(optarg) != 0) exit(1); - break; + break; case QEMU_OPTION_mtdblock: drive_add(IF_MTD, -1, optarg, MTD_OPTS); break; @@ -2978,7 +2978,7 @@ int main(int argc, char **argv, char **envp) fprintf(stderr, "qemu: invalid physical CHS format\n"); exit(1); } - if (hda_opts != NULL) { + if (hda_opts != NULL) { char num[16]; snprintf(num, sizeof(num), "%d", cyls); qemu_opt_set(hda_opts, "cyls", num); @@ -3152,9 +3152,9 @@ int main(int argc, char **argv, char **envp) case QEMU_OPTION_S: autostart = 0; break; - case QEMU_OPTION_k: - keyboard_layout = optarg; - break; + case QEMU_OPTION_k: + keyboard_layout = optarg; + break; case QEMU_OPTION_localtime: rtc_utc = 0; break; @@ -3362,9 +3362,9 @@ int main(int argc, char **argv, char **envp) case QEMU_OPTION_debugcon: add_device_config(DEV_DEBUGCON, optarg); break; - case QEMU_OPTION_loadvm: - loadvm = optarg; - break; + case QEMU_OPTION_loadvm: + loadvm = optarg; + break; case QEMU_OPTION_full_screen: full_screen = 1; break; @@ -3476,7 +3476,7 @@ int main(int argc, char **argv, char **envp) exit(1); } break; - case QEMU_OPTION_vnc: + case QEMU_OPTION_vnc: #ifdef CONFIG_VNC display_remote++; vnc_display = optarg; @@ -3514,11 +3514,11 @@ int main(int argc, char **argv, char **envp) } qemu_uuid_set = true; break; - case QEMU_OPTION_option_rom: - if (nb_option_roms >= MAX_OPTION_ROMS) { - fprintf(stderr, "Too many option ROMs\n"); - exit(1); - } + case QEMU_OPTION_option_rom: + if (nb_option_roms >= MAX_OPTION_ROMS) { + fprintf(stderr, "Too many option ROMs\n"); + exit(1); + } opts = qemu_opts_parse(qemu_find_opts("option-rom"), optarg, 1); if (!opts) { exit(1); @@ -3530,8 +3530,8 @@ int main(int argc, char **argv, char **envp) fprintf(stderr, "Option ROM file is not specified\n"); exit(1); } - nb_option_roms++; - break; + nb_option_roms++; + break; case QEMU_OPTION_semihosting: semihosting_enabled = 1; semihosting_target = SEMIHOSTING_TARGET_AUTO; -- cgit v1.1