aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2020-08-26hw/display/artist: Refactor artist_rop8() to avoid buffer over-runPhilippe Mathieu-Daudé
Invalid I/O writes can craft an offset out of the vram_buffer range. Instead of passing an unsafe pointer to artist_rop8(), pass the vram_buffer and the offset. We can now check if the offset is in range before accessing it. We avoid: Program terminated with signal SIGSEGV, Segmentation fault. 284 *dst &= ~plane_mask; (gdb) bt #0 0x000056367b2085c0 in artist_rop8 (s=0x56367d38b510, dst=0x7f9f972fffff <error: Cannot access memory at address 0x7f9f972fffff>, val=0 '\000') at hw/display/artist.c:284 #1 0x000056367b209325 in draw_line (s=0x56367d38b510, x1=-20480, y1=-1, x2=0, y2=17920, update_start=true, skip_pix=-1, max_pix=-1) at hw/display/artist.c:646 Reported-by: LLVM libFuzzer Buglink: https://bugs.launchpad.net/qemu/+bug/1880326 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/display/artist: Check offset in draw_line to avoid buffer over-runPhilippe Mathieu-Daudé
Invalid I/O writes can craft an offset out of the vram_buffer range. We avoid: Program terminated with signal SIGSEGV, Segmentation fault. 284 *dst &= ~plane_mask; (gdb) bt #0 0x000055d5dccdc5c0 in artist_rop8 (s=0x55d5defee510, dst=0x7f8e84ed8216 <error: Cannot access memory at address 0x7f8e84ed8216>, val=0 '\000') at hw/display/artist.c:284 #1 0x000055d5dccdcf83 in fill_window (s=0x55d5defee510, startx=22, starty=5674, width=65, height=5697) at hw/display/artist.c:551 #2 0x000055d5dccddfb9 in artist_reg_write (opaque=0x55d5defee510, addr=1051140, val=4265537, size=4) at hw/display/artist.c:902 #3 0x000055d5dcb42a7c in memory_region_write_accessor (mr=0x55d5defeea10, addr=1051140, value=0x7ffe57db08c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:483 Reported-by: LLVM libFuzzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-26hw/hppa/lasi: Don't abort on invalid IMR valueHelge Deller
NetBSD initializes the LASI IMR value with 0xffffffff to disable all LASI interrupts. This triggered an assert() and stopped the emulation. By replacing the check with a warning in the guest log we now allow NetBSD to boot again. Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-04hw/display/artist.c: fix out of bounds checkSven Schnelle
Fix the following runtime warning with artist framebuffer: "write outside bounds: wants 1256x1023, max size 1280x1024" Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-04hw/hppa: Implement proper SeaBIOS version checkHelge Deller
It's important that the SeaBIOS hppa firmware is at least at a minimal level to ensure proper interaction between qemu and firmware. Implement a proper firmware version check by telling SeaBIOS via the fw_cfg interface which minimal SeaBIOS version is required by this running qemu instance. If the firmware detects that it's too old, it will stop. Signed-off-by: Helge Deller <deller@gmx.de>
2020-08-04hw/hppa: Sync hppa_hardware.h file with SeaBIOS sourcesHelge Deller
The hppa_hardware.h file is shared with SeaBIOS. Sync it. Acked-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Helge Deller <deller@gmx.de>
2020-07-28Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20200727' into staging target-arm queue: * ACPI: Assert that we don't run out of the preallocated memory * hw/misc/aspeed_sdmc: Fix incorrect memory size * target/arm: Always pass cacheattr in S1_ptw_translate * docs/system/arm/virt: Document 'mte' machine option * hw/arm/boot: Fix PAUTH, MTE for EL3 direct kernel boot * target/arm: Improve IMPDEF algorithm for IRG # gpg: Signature made Mon 27 Jul 2020 16:18:38 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20200727: target/arm: Improve IMPDEF algorithm for IRG hw/arm/boot: Fix MTE for EL3 direct kernel boot hw/arm/boot: Fix PAUTH for EL3 direct kernel boot docs/system/arm/virt: Document 'mte' machine option target/arm: Always pass cacheattr in S1_ptw_translate hw/misc/aspeed_sdmc: Fix incorrect memory size ACPI: Assert that we don't run out of the preallocated memory Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-28virtio-net: check the existence of peer before accessing vDPA configJason Wang
We try to check whether a peer is VDPA in order to get config from there - with no peer, this leads to a NULL pointer dereference. Add a check before trying to access the peer type. No peer means not VDPA. Fixes: 108a64818e69b ("vhost-vdpa: introduce vhost-vdpa backend") Cc: Cindy Lu <lulu@redhat.com> Tested-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-28virtio-pci: fix wrong index in virtio_pci_queue_enabledYuri Benditovich
We should use the index passed by the caller instead of the queue_sel when checking the enablement of a specific virtqueue. This is reported in https://bugzilla.redhat.com/show_bug.cgi?id=1702608 Fixes: f19bcdfedd53 ("virtio-pci: implement queue_enabled method") Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-07-27Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio,pci: bugfixes Minor bugfixes all over the places, including one CVE. Additionally, a fix for an ancient bug in migration - one has to wonder how come no one noticed. The fix is also non-trivial since we dare not break all existing machine types with pci - we have a work around in the works, for now we just skip the work-around for old machine types. Great job by Hogan Wang noticing, debugging and fixing it, and thanks to Dr. David Alan Gilbert for reviewing the patches. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 27 Jul 2020 16:34:58 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-pci: fix virtio_pci_queue_enabled() MAINTAINERS: Cover the firmware JSON schema vhost-vdpa :Fix Coverity CID 1430270 / CID 1420267 libvhost-user: Report descriptor index on panic Fix vhost-user buffer over-read on ram hot-unplug hw/pci-host: save/restore pci host config register virtio-mem-pci: force virtio version 1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200727' into stagingPeter Maydell
fixes for protected virtualization and loadparm handling # gpg: Signature made Mon 27 Jul 2020 15:01:32 BST # gpg: using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF # gpg: issuer "cohuck@redhat.com" # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [marginal] # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full] # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full] # gpg: aka "Cornelia Huck <cohuck@kernel.org>" [marginal] # gpg: aka "Cornelia Huck <cohuck@redhat.com>" [marginal] # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20200727: s390x/s390-virtio-ccw: fix loadparm property getter s390x/protvirt: allow to IPL secure guests with -no-reboot Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27virtio-pci: fix virtio_pci_queue_enabled()Laurent Vivier
In legacy mode, virtio_pci_queue_enabled() falls back to virtio_queue_enabled() to know if the queue is enabled. But virtio_queue_enabled() calls again virtio_pci_queue_enabled() if k->queue_enabled is set. This ends in a crash after a stack overflow. The problem can be reproduced with "-device virtio-net-pci,disable-legacy=off,disable-modern=true -net tap,vhost=on" And a look to the backtrace is very explicit: ... #4 0x000000010029a438 in virtio_queue_enabled () #5 0x0000000100497a9c in virtio_pci_queue_enabled () ... #130902 0x000000010029a460 in virtio_queue_enabled () #130903 0x0000000100497a9c in virtio_pci_queue_enabled () #130904 0x000000010029a460 in virtio_queue_enabled () #130905 0x0000000100454a20 in vhost_net_start () ... This patch fixes the problem by introducing a new function for the legacy case and calls it from virtio_pci_queue_enabled(). It also calls it from virtio_queue_enabled() to avoid code duplication. Fixes: f19bcdfedd53 ("virtio-pci: implement queue_enabled method") Cc: Jason Wang <jasowang@redhat.com> Cc: Cindy Lu <lulu@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20200727153319.43716-1-lvivier@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-27hw/arm/boot: Fix MTE for EL3 direct kernel bootRichard Henderson
When booting an EL3 cpu with -kernel, we set up EL3 and then drop down to EL2. We need to enable access to v8.5-MemTag tag allocation at EL3 before doing so. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200724163853.504655-3-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27hw/arm/boot: Fix PAUTH for EL3 direct kernel bootRichard Henderson
When booting an EL3 cpu with -kernel, we set up EL3 and then drop down to EL2. We need to enable access to v8.3-PAuth keys and instructions at EL3 before doing so. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200724163853.504655-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27hw/misc/aspeed_sdmc: Fix incorrect memory sizePhilippe Mathieu-Daudé
The SDRAM Memory Controller has a 32-bit address bus, thus supports up to 4 GiB of DRAM. There is a signed to unsigned conversion error with the AST2600 maximum memory size: (uint64_t)(2048 << 20) = (uint64_t)(-2147483648) = 0xffffffff40000000 = 16 EiB - 2 GiB Fix by using the IEC suffixes which are usually safer, and add an assertion check to verify the memory is valid. This would have caught this bug: $ qemu-system-arm -M ast2600-evb qemu-system-arm: hw/misc/aspeed_sdmc.c:258: aspeed_sdmc_realize: Assertion `asc->max_ram_size < 4 * GiB' failed. Aborted (core dumped) Fixes: 1550d72679 ("aspeed/sdmc: Add AST2600 support") Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27ACPI: Assert that we don't run out of the preallocated memoryDongjiu Geng
data_length is a constant value, so we use assert instead of condition check. Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com> Message-id: 20200622113146.33421-1-gengdongjiu@huawei.com Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27Merge remote-tracking branch ↵Peter Maydell
'remotes/stsquad/tags/pull-fixes-for-rc2-270720-1' into staging Various fixes for rc2: - get shippable working again - semihosting bug fixes - tweak tb-size handling for low memory machines - i386 compound literal float fix - linux-user MAP_FIXED->MAP_NOREPLACE on fallback - docker binfmt_misc fixes - linux-user nanosleep fix - tests/vm drain console fixes # gpg: Signature made Mon 27 Jul 2020 09:45:31 BST # gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44 # gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>" [full] # Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44 * remotes/stsquad/tags/pull-fixes-for-rc2-270720-1: tests/vm: add shutdown timeout in basevm.py python/qemu: Change ConsoleSocket to optionally drain socket. python/qemu: Cleanup changes to ConsoleSocket linux-user, ppc: fix clock_nanosleep() for linux-user-ppc linux-user: fix clock_nanosleep() tests/docker: add support for DEB_KEYRING tests/docker: fix binfmt_misc image building tests/docker: fix update command due to python3 str/bytes distinction linux-user: don't use MAP_FIXED in pgd_find_hole_fallback target/i386: floatx80: avoid compound literals in static initializers accel/tcg: better handle memory constrained systems util/oslib-win32: add qemu_get_host_physmem implementation util: add qemu_get_host_physmem utility function semihosting: don't send the trailing '\0' semihosting: defer connect_chardevs a little more to use serialx shippable: add one more qemu to registry url Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-27vhost-vdpa :Fix Coverity CID 1430270 / CID 1420267Cindy Lu
In the function vhost_vdpa_dma_map/unmap, The struct msg was not initialized all its fields. Signed-off-by: Cindy Lu <lulu@redhat.com> Message-Id: <20200710064642.24505-1-lulu@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-27Fix vhost-user buffer over-read on ram hot-unplugRaphael Norwitz
The VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS vhost-user protocol feature introduced a shadow-table, used by the backend to dynamically determine how a vdev's memory regions have changed since the last vhost_user_set_mem_table() call. On hot-remove, a memmove() operation is used to overwrite the removed shadow region descriptor(s). The size parameter of this memmove was off by 1 such that if a VM with a backend supporting the VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS filled it's shadow-table (by performing the maximum number of supported hot-add operatons) and attempted to remove the last region, Qemu would read an out of bounds value and potentially crash. This change fixes the memmove() bounds such that this erroneous read can never happen. Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com> Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <1594799958-31356-1-git-send-email-raphael.norwitz@nutanix.com> Fixes: f1aeb14b0809 ("Transmit vhost-user memory regions individually") Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-27hw/pci-host: save/restore pci host config registerHogan Wang
The pci host config register is used to save PCI address for read/write config data. If guest writes a value to config register, and then QEMU pauses the vcpu to migrate, after the migration, the guest will continue to write pci config data, and the write data will be ignored because of new qemu process losing the config register state. To trigger the bug: 1. guest is booting in seabios. 2. guest enables the SMRAM in seabios:piix4_apmc_smm_setup, and then expects to disable the SMRAM by pci_config_writeb. 3. after guest writes the pci host config register, QEMU pauses vcpu to finish migration. 4. guest write of config data(0x0A) fails to disable the SMRAM because the config register state is lost. 5. guest continues to boot and crashes in ipxe option ROM due to SMRAM in enabled state. Example Reproducer: step 1. Make modifications to seabios and qemu for increase reproduction efficiency, write 0xf0 to 0x402 port notify qemu to stop vcpu after 0x0cf8 port wrote i440 configure register. qemu stop vcpu when catch 0x402 port wrote 0xf0. seabios:/src/hw/pci.c @@ -52,6 +52,11 @@ void pci_config_writeb(u16 bdf, u32 addr, u8 val) writeb(mmconfig_addr(bdf, addr), val); } else { outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD); + if (bdf == 0 && addr == 0x72 && val == 0xa) { + dprintf(1, "stop vcpu\n"); + outb(0xf0, 0x402); // notify qemu to stop vcpu + dprintf(1, "resume vcpu\n"); + } outb(val, PORT_PCI_DATA + (addr & 3)); } } qemu:hw/char/debugcon.c @@ -60,6 +61,9 @@ static void debugcon_ioport_write(void *opaque, hwaddr addr, uint64_t val, printf(" [debugcon: write addr=0x%04" HWADDR_PRIx " val=0x%02" PRIx64 "]\n", addr, val); #endif + if (ch == 0xf0) { + vm_stop(RUN_STATE_PAUSED); + } /* XXX this blocks entire thread. Rewrite to use * qemu_chr_fe_write and background I/O callbacks */ qemu_chr_fe_write_all(&s->chr, &ch, 1); step 2. start vm1 by the following command line, and then vm stopped. $ qemu-system-x86_64 -machine pc-i440fx-5.0,accel=kvm\ -netdev tap,ifname=tap-test,id=hostnet0,vhost=on,downscript=no,script=no\ -device virtio-net-pci,netdev=hostnet0,id=net0,bus=pci.0,addr=0x13,bootindex=3\ -device cirrus-vga,id=video0,vgamem_mb=16,bus=pci.0,addr=0x2\ -chardev file,id=seabios,path=/var/log/test.seabios,append=on\ -device isa-debugcon,iobase=0x402,chardev=seabios\ -monitor stdio step 3. start vm2 to accept vm1 state. $ qemu-system-x86_64 -machine pc-i440fx-5.0,accel=kvm\ -netdev tap,ifname=tap-test1,id=hostnet0,vhost=on,downscript=no,script=no\ -device virtio-net-pci,netdev=hostnet0,id=net0,bus=pci.0,addr=0x13,bootindex=3\ -device cirrus-vga,id=video0,vgamem_mb=16,bus=pci.0,addr=0x2\ -chardev file,id=seabios,path=/var/log/test.seabios,append=on\ -device isa-debugcon,iobase=0x402,chardev=seabios\ -monitor stdio \ -incoming tcp:127.0.0.1:8000 step 4. execute the following qmp command in vm1 to migrate. (qemu) migrate tcp:127.0.0.1:8000 step 5. execute the following qmp command in vm2 to resume vcpu. (qemu) cont Before this patch, we get KVM "emulation failure" error on vm2. This patch fixes it. Cc: qemu-stable@nongnu.org Signed-off-by: Hogan Wang <hogan.wang@huawei.com> Message-Id: <20200727084621.3279-1-hogan.wang@huawei.com> Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-27virtio-mem-pci: force virtio version 1David Hildenbrand
Trying to run simple virtio-mem-pci examples currently fails with qemu-system-x86_64: -device virtio-mem-pci,id=vm0,memdev=mem0,node=0, requested-size=300M: device is modern-only, use disable-legacy=on due to the added safety checks in 9b3a35ec8236 ("virtio: verify that legacy support is not accidentally on"). As noted by Conny, we have to force virtio version 1. While at it, use qdev_realize() to set the parent bus and realize - like most other virtio-*-pci implementations. Fixes: 0b9a2443a48b ("virtio-pci: Proxy for virtio-mem") Reviewed-by: Cornelia Huck <cohuck@redhat.com> Cc: Cornelia Huck <cohuck@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Signed-off-by: David Hildenbrand <david@redhat.com> Message-Id: <20200727115905.129397-1-david@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-27semihosting: don't send the trailing '\0'KONRAD Frederic
Don't send the trailing 0 from the string. Signed-off-by: KONRAD Frederic <frederic.konrad@adacore.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <1592215252-26742-2-git-send-email-frederic.konrad@adacore.com> Message-Id: <20200724064509.331-4-alex.bennee@linaro.org>
2020-07-27pseries: fix kvmppc_set_fwnmi()Laurent Vivier
QEMU issues the ioctl(KVM_CAP_PPC_FWNMI) on the first vCPU. If the first vCPU is currently running, the vCPU mutex is held and the ioctl() cannot be done and waits until the mutex is released. This never happens and the VM is stuck. To avoid this deadlock, issue the ioctl on the same vCPU doing the RTAS call. The problem can be reproduced by booting a guest with several vCPUs (the probability to have the problem is (n - 1) / n, n = # of CPUs), and then by triggering a kernel crash with "echo c >/proc/sysrq-trigger". On the reboot, the kernel hangs after: ... [ 0.000000] ----------------------------------------------------- [ 0.000000] ppc64_pft_size = 0x0 [ 0.000000] phys_mem_size = 0x48000000 [ 0.000000] dcache_bsize = 0x80 [ 0.000000] icache_bsize = 0x80 [ 0.000000] cpu_features = 0x0001c06f8f4f91a7 [ 0.000000] possible = 0x0003fbffcf5fb1a7 [ 0.000000] always = 0x00000003800081a1 [ 0.000000] cpu_user_features = 0xdc0065c2 0xaee00000 [ 0.000000] mmu_features = 0x3c006041 [ 0.000000] firmware_features = 0x00000085455a445f [ 0.000000] physical_start = 0x8000000 [ 0.000000] ----------------------------------------------------- [ 0.000000] numa: NODE_DATA [mem 0x47f33c80-0x47f3ffff] Fixes: ec010c00665b ("ppc/spapr: KVM FWNMI should not be enabled until guest requests it") Cc: npiggin@gmail.com Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-Id: <20200724083533.281700-1-lvivier@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2020-07-25Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-20200724-pull-request' into staging bugfixes: virtio-input, usb-dwc2, pixman. # gpg: Signature made Fri 24 Jul 2020 17:42:43 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20200724-pull-request: configure: Allow to build tools without pixman hw/input/virtio-input-hid.c: Don't undef CONFIG_CURSES hw: Only compile the usb-dwc2 controller if it is really needed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-24hw/input/virtio-input-hid.c: Don't undef CONFIG_CURSESPeter Maydell
virtio-input-hid.c undefines CONFIG_CURSES before including ui/console.h. However since commits e2f82e924d057935 and b0766612d16da18 that header does not have behaviour dependent on CONFIG_CURSES. Remove the now-unneeded undef. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20200723192457.28136-1-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-07-24hw: Only compile the usb-dwc2 controller if it is really neededThomas Huth
The USB_DWC2 switch is currently "default y", so it is included in all qemu-system-* builds, even if it is not needed. Even worse, it does a "select USB", so USB devices are now showing up as available on targets that do not support USB at all. This sysbus device should only be included by the boards that need it, i.e. by the Raspi machines. Fixes: 153ef1662c ("dwc-hsotg (dwc2) USB host controller emulation") Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Paul Zimmerman <pauldzim@gmail.com> Message-id: 20200722154719.10130-1-thuth@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-07-24sd/milkymist-memcard: Fix format stringStefan Weil
Fixes: b98e8d1230ff7023bb34ddeb7194424dfcbaf789 Signed-off-by: Stefan Weil <sw@weilnetz.de> Message-Id: <20200722204054.1400555-1-sw@weilnetz.de> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2020-07-24error: Strip trailing '\n' from error string arguments (again)Markus Armbruster
Tracked down with scripts/coccinelle/err-bad-newline.cocci. Cc: Peter Xu <peterx@redhat.com> Cc: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200722084048.1726105-3-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Peter Xu <peterx@redhat.com>
2020-07-24s390x/s390-virtio-ccw: fix loadparm property getterHalil Pasic
The function machine_get_loadparm() is supposed to produce a C-string, that is a NUL-terminated one, but it does not. ElectricFence can detect this problem if the loadparm machine property is used. Let us make the returned string a NUL-terminated one. Fixes: 7104bae9de ("hw/s390x: provide loadparm property for the machine") Signed-off-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20200723162717.88485-1-pasic@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-07-24s390x/protvirt: allow to IPL secure guests with -no-rebootChristian Borntraeger
Right now, -no-reboot prevents secure guests from running. This is correct from an implementation point of view, as we have modeled the transition from non-secure to secure as a program directed IPL. From a user perspective, this is not the behavior of least surprise. We should implement the IPL into protected mode similar to the functions that we use for kdump/kexec. In other words, we do not stop here when -no-reboot is specified on the command line. Like function 0 or function 1, function 10 is not a classic reboot. For example, it can only be called once. Before calling it a second time, a real reboot/reset must happen in-between. So function code 10 is more or less a state transition reset, but not a "standard" reset or reboot. Fixes: 4d226deafc44 ("s390x: protvirt: Support unpack facility") Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com> Message-Id: <20200721103202.30610-1-borntraeger@de.ibm.com> [CH: tweaked description] Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2020-07-23Merge remote-tracking branch ↵Peter Maydell
'remotes/alistair/tags/pull-riscv-to-apply-20200722-1' into staging This PR contains a few RISC-V fixes. The main fix is the correction of the goldfish RTC time. On top of that some small fixes to the recently added vector extensions have been added (including an assert that fixed a coverity report). There is a change in the SiFive E debug memory size to match hardware. Finally there is a fix for PMP accesses. # gpg: Signature made Wed 22 Jul 2020 17:43:59 BST # gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full] # Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054 * remotes/alistair/tags/pull-riscv-to-apply-20200722-1: target/riscv: Fix the range of pmpcfg of CSR funcion table hw/riscv: sifive_e: Correct debug block size target/riscv: fix vector index load/store constraints target/riscv: Quiet Coverity complains about vamo* goldfish_rtc: Fix non-atomic read behaviour of TIME_LOW/TIME_HIGH Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-23Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
acpi,virtio,pc: bugfixes Fix bug in ACPI which were tripping up guests. Fix a use-after-free with hotplug of virtio devices. Block ability to create legacy devices which shouldn't have been there in the first place. Fix migration error handling with balloon. Drop some dead code in virtio. vtd emulation fixup. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 22 Jul 2020 13:07:26 BST # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [full] # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: virtio-pci: Changed vdev to proxy for VirtIO PCI BAR callbacks. intel_iommu: Use correct shift for 256 bits qi descriptor virtio: verify that legacy support is not accidentally on virtio: list legacy-capable devices virtio-balloon: Replace free page hinting references to 'report' with 'hint' virtio-balloon: Add locking to prevent possible race when starting hinting virtio-balloon: Prevent guest from starting a report when we didn't request one virtio: Drop broken and superfluous object_property_set_link() acpi: accept byte and word access to core ACPI registers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-23Merge remote-tracking branch 'remotes/philmd-gitlab/tags/avr-20200721' into ↵Peter Maydell
staging AVR patches Fixes a memory leak reported by Coverity (CID 1430449). CI jobs result: . https://gitlab.com/philmd/qemu/-/pipelines/168722631 # gpg: Signature made Tue 21 Jul 2020 19:00:03 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/avr-20200721: hw/avr/boot: Fix memory leak in avr_load_firmware() qemu-common: Document qemu_find_file() qemu/osdep: Reword qemu_get_exec_dir() documentation qemu/osdep: Document os_find_datadir() return value Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-22hw/riscv: sifive_e: Correct debug block sizeBin Meng
Currently the debug region size is set to 0x100, but according to FE310-G000 and FE310-G002 manuals: FE310-G000: 0x100 - 0xFFF FE310-G002: 0x0 - 0xFFF Change the size to 0x1000 that applies to both. Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <1594891856-15474-1-git-send-email-bmeng.cn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22goldfish_rtc: Fix non-atomic read behaviour of TIME_LOW/TIME_HIGHJessica Clarke
The specification says: 0x00 TIME_LOW R: Get current time, then return low-order 32-bits. 0x04 TIME_HIGH R: Return high 32-bits from previous TIME_LOW read. ... To read the value, the kernel must perform an IO_READ(TIME_LOW), which returns an unsigned 32-bit value, before an IO_READ(TIME_HIGH), which returns a signed 32-bit value, corresponding to the higher half of the full value. However, we were just returning the current time for both. If the guest is unlucky enough to read TIME_LOW and TIME_HIGH either side of an overflow of the lower half, it will see time be in the future, before jumping backwards on the next read, and Linux currently relies on the atomicity guaranteed by the spec so is affected by this. Fix this violation of the spec by caching the correct value for TIME_HIGH whenever TIME_LOW is read, and returning that value for any TIME_HIGH read. Signed-off-by: Jessica Clarke <jrtc27@jrtc27.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200718004934.83174-1-jrtc27@jrtc27.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2020-07-22virtio-pci: Changed vdev to proxy for VirtIO PCI BAR callbacks.Andrew Melnychenko
There is an issue when callback may be called with invalid vdev. It happens on unplug when vdev already deleted and VirtIOPciProxy is not. So now, callbacks accept proxy device, and vdev retrieved from it. Technically memio callbacks should be removed during the flatview update, but memoryregions remain til PCI device(and it's address space) completely deleted. Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1716352 Signed-off-by: Andrew Melnychenko <andrew@daynix.com> Message-Id: <20200706112123.971087-1-andrew@daynix.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22intel_iommu: Use correct shift for 256 bits qi descriptorLiu Yi L
In chapter 10.4.23 of VT-d spec 3.0, Descriptor Width bit was introduced in VTD_IQA_REG. Software could set this bit to tell VT-d the QI descriptor from software would be 256 bits. Accordingly, the VTD_IQH_QH_SHIFT should be 5 when descriptor size is 256 bits. This patch adds the DW bit check when deciding the shift used to update VTD_IQH_REG. Signed-off-by: Liu Yi L <yi.l.liu@intel.com> Message-Id: <1593850035-35483-1-git-send-email-yi.l.liu@intel.com> Reviewed-by: Peter Xu <peterx@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio: verify that legacy support is not accidentally onCornelia Huck
If a virtio device does not have legacy support, make sure that it is actually off, and bail out if not. For virtio-pci, this means that any device without legacy support that has been specified to modern-only (or that has been forced to it) will work. For virtio-ccw, this duplicates the check that is currently done prior to realization for any device that explicitly specified no support for legacy. This catches devices that have not been fenced properly. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200707105446.677966-3-cohuck@redhat.com> Cc: qemu-stable@nongnu.org Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio: list legacy-capable devicesCornelia Huck
Several types of virtio devices had already been around before the virtio standard was specified. These devices support virtio in legacy (and transitional) mode. Devices that have been added in the virtio standard are considered non-transitional (i.e. with no support for legacy virtio). Provide a helper function so virtio transports can figure that out easily. Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-Id: <20200707105446.677966-2-cohuck@redhat.com> Cc: qemu-stable@nongnu.org Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio-balloon: Replace free page hinting references to 'report' with 'hint'Alexander Duyck
Recently a feature named Free Page Reporting was added to the virtio balloon. In order to avoid any confusion we should drop the use of the word 'report' when referring to Free Page Hinting. So what this patch does is go through and replace all instances of 'report' with 'hint" when we are referring to free page hinting. Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200720175128.21935.93927.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio-balloon: Add locking to prevent possible race when starting hintingAlexander Duyck
There is already locking in place when we are stopping free page hinting but there is not similar protections in place when we start. I can only assume this was overlooked as in most cases the page hinting should not be occurring when we are starting the hinting, however there is still a chance we could be processing hints by the time we get back around to restarting the hinting so we are better off making sure to protect the state with the mutex lock rather than just updating the value with no protections. Based on feedback from Peter Maydell this issue had also been spotted by Coverity: CID 1430269 Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200720175122.21935.78013.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio-balloon: Prevent guest from starting a report when we didn't request oneAlexander Duyck
Based on code review it appears possible for the driver to force the device out of a stopped state when hinting by repeating the last ID it was provided. Prevent this by only allowing a transition to the start state when we are in the requested state. This way the driver is only allowed to send one descriptor that will transition the device into the start state. All others will leave it in the stop state once it has finished. Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Acked-by: David Hildenbrand <david@redhat.com> Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com> Message-Id: <20200720175115.21935.99563.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22virtio: Drop broken and superfluous object_property_set_link()Markus Armbruster
virtio_crypto_pci_realize() and copies the value of vcrypto->vdev's property "cryptodev" to vcrypto's property: object_property_set_link(OBJECT(vrng), "rng", OBJECT(vrng->vdev.conf.rng), NULL); Since it does so only after realize, this always fails, but the error is ignored. It's actually superfluous: vcrypto's property is an alias of vcrypto->vdev's property, created by virtio_instance_init_common(). Drop the call. Same for virtio_ccw_crypto_realize(), virtio_rng_pci_realize(), virtio_ccw_rng_realize(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200721121153.1128844-1-armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22acpi: accept byte and word access to core ACPI registersMichael Tokarev
All ISA registers should be accessible as bytes, words or dwords (if wide enough). Fix the access constraints for acpi-pm-evt, acpi-pm-tmr & acpi-cnt registers. Fixes: 5d971f9e67 (memory: Revert "memory: accept mismatching sizes in memory_region_access_valid") Fixes: afafe4bbe0 (apci: switch cnt to memory api) Fixes: 77d58b1e47 (apci: switch timer to memory api) Fixes: b5a7c024d2 (apci: switch evt to memory api) Buglink: https://lore.kernel.org/xen-devel/20200630170913.123646-1-anthony.perard@citrix.com/T/ Buglink: https://bugs.debian.org/964793 BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964247 BugLink: https://bugs.launchpad.net/bugs/1886318 Reported-By: Simon John <git@the-jedi.co.uk> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Message-Id: <20200720160627.15491-1-mjt@msgid.tls.msk.ru> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-07-22Merge remote-tracking branch 'remotes/philmd-gitlab/tags/fw_cfg-20200721' ↵Peter Maydell
into staging fw_cfg patches Fixes the DEADCODE issue reported by Coverity (CID 1430396). CI jobs result: . https://gitlab.com/philmd/qemu/-/pipelines/169086301 # gpg: Signature made Tue 21 Jul 2020 18:52:46 BST # gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE # gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full] # Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE * remotes/philmd-gitlab/tags/fw_cfg-20200721: hw/nvram/fw_cfg: Let fw_cfg_add_from_generator() return boolean value hw/nvram/fw_cfg: Simplify fw_cfg_add_from_generator() error propagation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-21Merge remote-tracking branch 'remotes/armbru/tags/pull-qom-2020-07-21' into ↵Peter Maydell
staging QOM patches for 2020-07-21 # gpg: Signature made Tue 21 Jul 2020 16:40:27 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-qom-2020-07-21: qom: Make info qom-tree sort children more efficiently qom: Document object_get_canonical_path() returns malloced string qom: Change object_get_canonical_path_component() not to malloc Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-21Merge remote-tracking branch ↵Peter Maydell
'remotes/kraxel/tags/fixes-20200721-pull-request' into staging fixes for xhci and modular builds. # gpg: Signature made Tue 21 Jul 2020 15:02:33 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/fixes-20200721-pull-request: module: ignore NULL type qxl: fix modular builds with dtrace xhci: fix valid.max_access_size to access address registers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-07-21hw/nvram/fw_cfg: Let fw_cfg_add_from_generator() return boolean valuePhilippe Mathieu-Daudé
Commits b6d7e9b66f..a43770df5d simplified the error propagation. Similarly to commit 6fd5bef10b "qom: Make functions taking Error** return bool, not void", let fw_cfg_add_from_generator() return a boolean value, not void. This allow to simplify parse_fw_cfg() and fixes the error handling issue reported by Coverity (CID 1430396): In parse_fw_cfg(): Variable assigned once to a constant guards dead code. Local variable local_err is assigned only once, to a constant value, making it effectively constant throughout its scope. If this is not the intent, examine the logic to see if there is a missing assignment that would make local_err not remain constant. It's the call of fw_cfg_add_from_generator(): Error *local_err = NULL; fw_cfg_add_from_generator(fw_cfg, name, gen_id, errp); if (local_err) { error_propagate(errp, local_err); return -1; } return 0; If it fails, parse_fw_cfg() sets an error and returns 0, which is wrong. Harmless, because the only caller passes &error_fatal. Reported-by: Peter Maydell <peter.maydell@linaro.org> Fixes: Coverity CID 1430396: 'Constant' variable guards dead code (DEADCODE) Fixes: 6552d87c48 ("softmmu/vl: Let -fw_cfg option take a 'gen_id' argument") Reviewed-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200721131911.27380-3-philmd@redhat.com>
2020-07-21hw/nvram/fw_cfg: Simplify fw_cfg_add_from_generator() error propagationPhilippe Mathieu-Daudé
Document FWCfgDataGeneratorClass::get_data() return NULL on error, and non-NULL on success. This allow us to simplify fw_cfg_add_from_generator(). Since we don't need a local variable to propagate the error, we can remove the ERRP_GUARD() macro. Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200721131911.27380-2-philmd@redhat.com>
2020-07-21qom: Change object_get_canonical_path_component() not to mallocMarkus Armbruster
object_get_canonical_path_component() returns a malloced copy of a property name on success, null on failure. 19 of its 25 callers immediately free the returned copy. Change object_get_canonical_path_component() to return the property name directly. Since modifying the name would be wrong, adjust the return type to const char *. Drop the free from the 19 callers become simpler, add the g_strdup() to the other six. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200714160202.3121879-4-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-27 17:37:41 +0000