From 118a2991bbeeb7ea641626d680f100f8ac6eff80 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Thu, 5 Sep 2024 16:12:06 +0200 Subject: vl: fix qemu_validate_options() indention MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Gerd Hoffmann Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20240905141211.1253307-2-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- system/vl.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/system/vl.c b/system/vl.c index d217b3d64d..3bb8f2db9a 100644 --- a/system/vl.c +++ b/system/vl.c @@ -2427,15 +2427,15 @@ static void qemu_validate_options(const QDict *machine_opts) const char *kernel_cmdline = qdict_get_try_str(machine_opts, "append"); if (kernel_filename == NULL) { - if (kernel_cmdline != NULL) { - error_report("-append only allowed with -kernel option"); - exit(1); - } - - if (initrd_filename != NULL) { - error_report("-initrd only allowed with -kernel option"); - exit(1); - } + if (kernel_cmdline != NULL) { + error_report("-append only allowed with -kernel option"); + exit(1); + } + + if (initrd_filename != NULL) { + error_report("-initrd only allowed with -kernel option"); + exit(1); + } } if (loadvm && incoming) { -- cgit v1.2.3 From a29a9776407e68c5560687e07828925bda710150 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Fri, 8 Nov 2024 13:56:44 +0000 Subject: hw/misc/nrf51_rng: Don't use BIT_MASK() when we mean BIT() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The BIT_MASK() macro from bitops.h provides the mask of a bit within a particular word of a multi-word bit array; it is intended to be used with its counterpart BIT_WORD() that gives the index of the word in the array. In nrf51_rng we are using it for cases where we have a bit number that we know is the index of a bit within a single word (in fact, it happens that all the bit numbers we pass to it are zero). This happens to give the right answer, but the macro that actually does the job we want here is BIT(). Use BIT() instead of BIT_MASK(). Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20241108135644.4007151-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- hw/misc/nrf51_rng.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/misc/nrf51_rng.c b/hw/misc/nrf51_rng.c index bf1eb0cf4a..2d67f3f766 100644 --- a/hw/misc/nrf51_rng.c +++ b/hw/misc/nrf51_rng.c @@ -107,25 +107,25 @@ static void rng_write(void *opaque, hwaddr offset, break; case NRF51_RNG_REG_SHORTS: s->shortcut_stop_on_valrdy = - (value & BIT_MASK(NRF51_RNG_REG_SHORTS_VALRDY_STOP)) ? 1 : 0; + (value & BIT(NRF51_RNG_REG_SHORTS_VALRDY_STOP)) ? 1 : 0; break; case NRF51_RNG_REG_INTEN: s->interrupt_enabled = - (value & BIT_MASK(NRF51_RNG_REG_INTEN_VALRDY)) ? 1 : 0; + (value & BIT(NRF51_RNG_REG_INTEN_VALRDY)) ? 1 : 0; break; case NRF51_RNG_REG_INTENSET: - if (value & BIT_MASK(NRF51_RNG_REG_INTEN_VALRDY)) { + if (value & BIT(NRF51_RNG_REG_INTEN_VALRDY)) { s->interrupt_enabled = 1; } break; case NRF51_RNG_REG_INTENCLR: - if (value & BIT_MASK(NRF51_RNG_REG_INTEN_VALRDY)) { + if (value & BIT(NRF51_RNG_REG_INTEN_VALRDY)) { s->interrupt_enabled = 0; } break; case NRF51_RNG_REG_CONFIG: s->filter_enabled = - (value & BIT_MASK(NRF51_RNG_REG_CONFIG_DECEN)) ? 1 : 0; + (value & BIT(NRF51_RNG_REG_CONFIG_DECEN)) ? 1 : 0; break; default: -- cgit v1.2.3 From 13cd9e6798536c35949440d9fc11f54cc052fce3 Mon Sep 17 00:00:00 2001 From: Sergio Lopez Date: Sat, 9 Nov 2024 06:37:48 +0100 Subject: hw/i386/elfboot: allocate "header" in heap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In x86_load_linux(), we were using a stack-allocated array as data for fw_cfg_add_bytes(). Since the latter just takes a reference to the pointer instead of copying the data, it can happen that the contents have been overridden by the time the guest attempts to access them. Instead of using the stack-allocated array, allocate some memory from the heap, copy the contents of the array, and use it for fw_cfg. Signed-off-by: Sergio Lopez Reviewed-by: Michael S. Tsirkin Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20241109053748.13183-1-slp@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/i386/x86-common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c index bc360a9ea4..dc031af662 100644 --- a/hw/i386/x86-common.c +++ b/hw/i386/x86-common.c @@ -697,9 +697,11 @@ void x86_load_linux(X86MachineState *x86ms, strlen(kernel_cmdline) + 1); fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA, kernel_cmdline); + setup = g_memdup2(header, sizeof(header)); + fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_SIZE, sizeof(header)); fw_cfg_add_bytes(fw_cfg, FW_CFG_SETUP_DATA, - header, sizeof(header)); + setup, sizeof(header)); /* load initrd */ if (initrd_filename) { -- cgit v1.2.3 From c4e1c361b342ccff11df6748198b1e0bcad9b635 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20Benn=C3=A9e?= Date: Mon, 11 Nov 2024 23:00:39 +0000 Subject: hw/display: factor out the scanout blob to fb conversion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There are two identical sequences of a code doing the same thing that raise warnings with Coverity. Before fixing those issues lets factor out the common code into a helper function we can share. Signed-off-by: Alex Bennée Cc: Dmitry Osipenko Reviewed-by: Dmitry Osipenko Tested-by: Dmitry Osipenko Message-ID: <20241111230040.68470-2-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- hw/display/virtio-gpu-virgl.c | 22 +--------------- hw/display/virtio-gpu.c | 60 ++++++++++++++++++++++++++---------------- include/hw/virtio/virtio-gpu.h | 15 +++++++++++ 3 files changed, 53 insertions(+), 44 deletions(-) diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c index eedae7357f..145a0b3879 100644 --- a/hw/display/virtio-gpu-virgl.c +++ b/hw/display/virtio-gpu-virgl.c @@ -805,7 +805,6 @@ static void virgl_cmd_set_scanout_blob(VirtIOGPU *g, struct virtio_gpu_framebuffer fb = { 0 }; struct virtio_gpu_virgl_resource *res; struct virtio_gpu_set_scanout_blob ss; - uint64_t fbend; VIRTIO_GPU_FILL_CMD(ss); virtio_gpu_scanout_blob_bswap(&ss); @@ -852,26 +851,7 @@ static void virgl_cmd_set_scanout_blob(VirtIOGPU *g, return; } - fb.format = virtio_gpu_get_pixman_format(ss.format); - if (!fb.format) { - qemu_log_mask(LOG_GUEST_ERROR, "%s: pixel format not supported %d\n", - __func__, ss.format); - cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; - return; - } - - fb.bytes_pp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(fb.format), 8); - fb.width = ss.width; - fb.height = ss.height; - fb.stride = ss.strides[0]; - fb.offset = ss.offsets[0] + ss.r.x * fb.bytes_pp + ss.r.y * fb.stride; - - fbend = fb.offset; - fbend += fb.stride * (ss.r.height - 1); - fbend += fb.bytes_pp * ss.r.width; - if (fbend > res->base.blob_size) { - qemu_log_mask(LOG_GUEST_ERROR, "%s: fb end out of range\n", - __func__); + if (!virtio_gpu_scanout_blob_to_fb(&fb, &ss, res->base.blob_size)) { cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; return; } diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index c0570ef856..e7ca8fd1cf 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -721,13 +721,48 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g, &fb, res, &ss.r, &cmd->error); } +bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb, + struct virtio_gpu_set_scanout_blob *ss, + uint64_t blob_size) +{ + uint64_t fbend; + + fb->format = virtio_gpu_get_pixman_format(ss->format); + if (!fb->format) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: host couldn't handle guest format %d\n", + __func__, ss->format); + return false; + } + + fb->bytes_pp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(fb->format), 8); + fb->width = ss->width; + fb->height = ss->height; + fb->stride = ss->strides[0]; + fb->offset = ss->offsets[0] + ss->r.x * fb->bytes_pp + ss->r.y * fb->stride; + + fbend = fb->offset; + fbend += fb->stride * (ss->r.height - 1); + fbend += fb->bytes_pp * ss->r.width; + + if (fbend > blob_size) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: fb end out of range\n", + __func__); + return false; + } + + return true; +} + + + static void virtio_gpu_set_scanout_blob(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd) { struct virtio_gpu_simple_resource *res; struct virtio_gpu_framebuffer fb = { 0 }; struct virtio_gpu_set_scanout_blob ss; - uint64_t fbend; VIRTIO_GPU_FILL_CMD(ss); virtio_gpu_scanout_blob_bswap(&ss); @@ -753,28 +788,7 @@ static void virtio_gpu_set_scanout_blob(VirtIOGPU *g, return; } - fb.format = virtio_gpu_get_pixman_format(ss.format); - if (!fb.format) { - qemu_log_mask(LOG_GUEST_ERROR, - "%s: host couldn't handle guest format %d\n", - __func__, ss.format); - cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; - return; - } - - fb.bytes_pp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(fb.format), 8); - fb.width = ss.width; - fb.height = ss.height; - fb.stride = ss.strides[0]; - fb.offset = ss.offsets[0] + ss.r.x * fb.bytes_pp + ss.r.y * fb.stride; - - fbend = fb.offset; - fbend += fb.stride * (ss.r.height - 1); - fbend += fb.bytes_pp * ss.r.width; - if (fbend > res->blob_size) { - qemu_log_mask(LOG_GUEST_ERROR, - "%s: fb end out of range\n", - __func__); + if (!virtio_gpu_scanout_blob_to_fb(&fb, &ss, res->blob_size)) { cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER; return; } diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h index 553799b8cc..924eb8737e 100644 --- a/include/hw/virtio/virtio-gpu.h +++ b/include/hw/virtio/virtio-gpu.h @@ -333,6 +333,21 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g, struct virtio_gpu_scanout *s, uint32_t resource_id); +/** + * virtio_gpu_scanout_blob_to_fb() - fill out fb based on scanout data + * fb: the frame-buffer descriptor to fill out + * ss: the scanout blob data + * blob_size: size of scanout blob data + * + * This will check we have enough space for the frame taking into + * account that stride for all but the last line. + * + * Returns true on success, otherwise logs guest error and returns false + */ +bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb, + struct virtio_gpu_set_scanout_blob *ss, + uint64_t blob_size); + /* virtio-gpu-udmabuf.c */ bool virtio_gpu_have_udmabuf(void); void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res); -- cgit v1.2.3 From 7b5574225429621e7122a83c06d1b23931f152df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20Benn=C3=A9e?= Date: Mon, 11 Nov 2024 23:00:40 +0000 Subject: hw/display: check frame buffer can hold blob MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coverity reports (CID 1564769, 1564770) that we potentially overflow by doing some 32x32 multiplies for something that ends up in a 64 bit value. Fix this by first using stride for all lines and casting input to uint64_t to ensure a 64 bit multiply is used. Signed-off-by: Alex Bennée Cc: Dmitry Osipenko Reviewed-by: Dmitry Osipenko Tested-by: Dmitry Osipenko Message-ID: <20241111230040.68470-3-alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- hw/display/virtio-gpu.c | 3 +-- include/hw/virtio/virtio-gpu.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index e7ca8fd1cf..7d22d03bbf 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -742,8 +742,7 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb, fb->offset = ss->offsets[0] + ss->r.x * fb->bytes_pp + ss->r.y * fb->stride; fbend = fb->offset; - fbend += fb->stride * (ss->r.height - 1); - fbend += fb->bytes_pp * ss->r.width; + fbend += (uint64_t) fb->stride * ss->r.height; if (fbend > blob_size) { qemu_log_mask(LOG_GUEST_ERROR, diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h index 924eb8737e..8c977beebd 100644 --- a/include/hw/virtio/virtio-gpu.h +++ b/include/hw/virtio/virtio-gpu.h @@ -340,7 +340,7 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g, * blob_size: size of scanout blob data * * This will check we have enough space for the frame taking into - * account that stride for all but the last line. + * account that stride. * * Returns true on success, otherwise logs guest error and returns false */ -- cgit v1.2.3 From fdc2294ac91c24d22ee58b12be803011a94e84c6 Mon Sep 17 00:00:00 2001 From: Zhang Chen Date: Tue, 12 Nov 2024 16:40:38 +0800 Subject: MAINTAINERS: Update my email address for COLO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Zhang Chen Reviewed-by: Li Zhijian Message-ID: <20241112084038.6352-1-chen.zhang@intel.com> Signed-off-by: Philippe Mathieu-Daudé --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 095420f8b0..3f10529d9c 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3559,7 +3559,7 @@ F: include/migration/failover.h F: docs/COLO-FT.txt COLO Proxy -M: Zhang Chen +M: Zhang Chen M: Li Zhijian S: Supported F: docs/colo-proxy.txt -- cgit v1.2.3 From b2cc69997924b651c0c6f4037782e25f2e438715 Mon Sep 17 00:00:00 2001 From: Guenter Roeck Date: Tue, 12 Nov 2024 09:01:52 -0800 Subject: usb-hub: Fix handling port power control messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ClearPortFeature control message fails for PORT_POWER because there is no break; at the end of the case statement, causing it to fall through to the failure handler. Add the missing break; to solve the problem. Fixes: 1cc403eb21 ("usb-hub: emulate per port power switching") Signed-off-by: Guenter Roeck Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20241112170152.217664-11-linux@roeck-us.net> Signed-off-by: Philippe Mathieu-Daudé --- hw/usb/dev-hub.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c index 06e9537d03..2c3640c705 100644 --- a/hw/usb/dev-hub.c +++ b/hw/usb/dev-hub.c @@ -479,6 +479,7 @@ static void usb_hub_handle_control(USBDevice *dev, USBPacket *p, usb_hub_port_clear(port, PORT_STAT_SUSPEND); port->wPortChange = 0; } + break; default: goto fail; } -- cgit v1.2.3 From 19e566162cbac0fd2051b31636207a3c88192e2b Mon Sep 17 00:00:00 2001 From: Fabiano Rosas Date: Wed, 13 Nov 2024 16:46:09 -0300 Subject: tests/qtest/migration: Fix indentations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Select all the code and hit tab. I'll be moving functions around quite a lot in the next patches, so make sure all indentation is correct now. Add parentheses around some expressions to preserve readability. Reviewed-by: Daniel P. Berrangé Signed-off-by: Fabiano Rosas Message-ID: <20241113194630.3385-2-farosas@suse.de> Signed-off-by: Philippe Mathieu-Daudé --- tests/qtest/migration-helpers.c | 4 +-- tests/qtest/migration-test.c | 59 +++++++++++++++++++++++------------------ 2 files changed, 35 insertions(+), 28 deletions(-) diff --git a/tests/qtest/migration-helpers.c b/tests/qtest/migration-helpers.c index 0025933883..3f8ba7fa8e 100644 --- a/tests/qtest/migration-helpers.c +++ b/tests/qtest/migration-helpers.c @@ -140,8 +140,8 @@ static void migrate_set_ports(QTestState *to, QList *channel_list) if (qdict_haskey(addrdict, "port") && qdict_haskey(addr, "port") && (strcmp(qdict_get_str(addrdict, "port"), "0") == 0)) { - addr_port = qdict_get_str(addr, "port"); - qdict_put_str(addrdict, "port", addr_port); + addr_port = qdict_get_str(addr, "port"); + qdict_put_str(addrdict, "port", addr_port); } } diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c index e6a2803e71..74d3000198 100644 --- a/tests/qtest/migration-test.c +++ b/tests/qtest/migration-test.c @@ -113,8 +113,8 @@ static bool ufd_version_check(void) } uffd_feature_thread_id = api_struct.features & UFFD_FEATURE_THREAD_ID; - ioctl_mask = 1ULL << _UFFDIO_REGISTER | - 1ULL << _UFFDIO_UNREGISTER; + ioctl_mask = (1ULL << _UFFDIO_REGISTER | + 1ULL << _UFFDIO_UNREGISTER); if ((api_struct.ioctls & ioctl_mask) != ioctl_mask) { g_test_message("Skipping test: Missing userfault feature"); return false; @@ -423,7 +423,7 @@ static void migrate_set_parameter_str(QTestState *who, const char *parameter, } static long long migrate_get_parameter_bool(QTestState *who, - const char *parameter) + const char *parameter) { QDict *rsp; int result; @@ -436,7 +436,7 @@ static long long migrate_get_parameter_bool(QTestState *who, } static void migrate_check_parameter_bool(QTestState *who, const char *parameter, - int value) + int value) { int result; @@ -445,7 +445,7 @@ static void migrate_check_parameter_bool(QTestState *who, const char *parameter, } static void migrate_set_parameter_bool(QTestState *who, const char *parameter, - int value) + int value) { qtest_qmp_assert_success(who, "{ 'execute': 'migrate-set-parameters'," @@ -1384,8 +1384,10 @@ static void test_postcopy_preempt_tls_psk(void) static void wait_for_postcopy_status(QTestState *one, const char *status) { wait_for_migration_status(one, status, - (const char * []) { "failed", "active", - "completed", NULL }); + (const char * []) { + "failed", "active", + "completed", NULL + }); } static void postcopy_recover_fail(QTestState *from, QTestState *to, @@ -2575,15 +2577,17 @@ static void test_migrate_fd_finish_hook(QTestState *from, /* Test closing fds */ /* We assume, that QEMU removes named fd from its list, * so this should fail */ - rsp = qtest_qmp(from, "{ 'execute': 'closefd'," - " 'arguments': { 'fdname': 'fd-mig' }}"); + rsp = qtest_qmp(from, + "{ 'execute': 'closefd'," + " 'arguments': { 'fdname': 'fd-mig' }}"); g_assert_true(qdict_haskey(rsp, "error")); error_desc = qdict_get_str(qdict_get_qdict(rsp, "error"), "desc"); g_assert_cmpstr(error_desc, ==, "File descriptor named 'fd-mig' not found"); qobject_unref(rsp); - rsp = qtest_qmp(to, "{ 'execute': 'closefd'," - " 'arguments': { 'fdname': 'fd-mig' }}"); + rsp = qtest_qmp(to, + "{ 'execute': 'closefd'," + " 'arguments': { 'fdname': 'fd-mig' }}"); g_assert_true(qdict_haskey(rsp, "error")); error_desc = qdict_get_str(qdict_get_qdict(rsp, "error"), "desc"); g_assert_cmpstr(error_desc, ==, "File descriptor named 'fd-mig' not found"); @@ -2741,11 +2745,11 @@ static void test_validate_uri_channels_both_set(void) }, .listen_uri = "defer", .connect_uri = "tcp:127.0.0.1:0", - .connect_channels = "[ { 'channel-type': 'main'," - " 'addr': { 'transport': 'socket'," - " 'type': 'inet'," - " 'host': '127.0.0.1'," - " 'port': '0' } } ]", + .connect_channels = ("[ { ""'channel-type': 'main'," + " 'addr': { 'transport': 'socket'," + " 'type': 'inet'," + " 'host': '127.0.0.1'," + " 'port': '0' } } ]"), }; do_test_validate_uri_channel(&args); @@ -2967,7 +2971,7 @@ test_migrate_precopy_tcp_multifd_qatzip_start(QTestState *from, #ifdef CONFIG_QPL static void * test_migrate_precopy_tcp_multifd_qpl_start(QTestState *from, - QTestState *to) + QTestState *to) { return test_migrate_precopy_tcp_multifd_start_common(from, to, "qpl"); } @@ -3032,11 +3036,11 @@ static void test_multifd_tcp_channels_none(void) .listen_uri = "defer", .start_hook = test_migrate_precopy_tcp_multifd_start, .live = true, - .connect_channels = "[ { 'channel-type': 'main'," - " 'addr': { 'transport': 'socket'," - " 'type': 'inet'," - " 'host': '127.0.0.1'," - " 'port': '0' } } ]", + .connect_channels = ("[ { 'channel-type': 'main'," + " 'addr': { 'transport': 'socket'," + " 'type': 'inet'," + " 'host': '127.0.0.1'," + " 'port': '0' } } ]"), }; test_precopy_common(&args); } @@ -3668,7 +3672,8 @@ static void test_migrate_dirty_limit(void) throttle_us_per_full = 0; while (throttle_us_per_full == 0) { throttle_us_per_full = - read_migrate_property_int(from, "dirty-limit-throttle-time-per-round"); + read_migrate_property_int(from, + "dirty-limit-throttle-time-per-round"); usleep(100); g_assert_false(src_state.stop_seen); } @@ -3680,7 +3685,8 @@ static void test_migrate_dirty_limit(void) /* Check if dirty limit throttle switched off, set timeout 1ms */ do { throttle_us_per_full = - read_migrate_property_int(from, "dirty-limit-throttle-time-per-round"); + read_migrate_property_int(from, + "dirty-limit-throttle-time-per-round"); usleep(100); g_assert_false(src_state.stop_seen); } while (throttle_us_per_full != 0 && --max_try_count); @@ -3709,7 +3715,8 @@ static void test_migrate_dirty_limit(void) throttle_us_per_full = 0; while (throttle_us_per_full == 0) { throttle_us_per_full = - read_migrate_property_int(from, "dirty-limit-throttle-time-per-round"); + read_migrate_property_int(from, + "dirty-limit-throttle-time-per-round"); usleep(100); g_assert_false(src_state.stop_seen); } @@ -3989,7 +3996,7 @@ int main(int argc, char **argv) #endif #ifdef CONFIG_QATZIP migration_test_add("/migration/multifd/tcp/plain/qatzip", - test_multifd_tcp_qatzip); + test_multifd_tcp_qatzip); #endif #ifdef CONFIG_QPL migration_test_add("/migration/multifd/tcp/plain/qpl", -- cgit v1.2.3 From 2df42919569ccacb255068e5230f43060cf66dfc Mon Sep 17 00:00:00 2001 From: Jamin Lin Date: Thu, 14 Nov 2024 17:48:37 +0800 Subject: hw/sd/sdhci: Fix coding style MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix coding style issues from checkpatch.pl Signed-off-by: Jamin Lin Reviewed-by: Cédric Le Goater Message-ID: <20241114094839.4128404-2-jamin_lin@aspeedtech.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/sd/sdhci.c | 64 +++++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 42 insertions(+), 22 deletions(-) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index dbe5c2340c..37875c02c3 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -233,7 +233,7 @@ static void sdhci_raise_insertion_irq(void *opaque) if (s->norintsts & SDHC_NIS_REMOVE) { timer_mod(s->insert_timer, - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY); + qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY); } else { s->prnsts = 0x1ff0000; if (s->norintstsen & SDHC_NISEN_INSERT) { @@ -251,7 +251,7 @@ static void sdhci_set_inserted(DeviceState *dev, bool level) if ((s->norintsts & SDHC_NIS_REMOVE) && level) { /* Give target some time to notice card ejection */ timer_mod(s->insert_timer, - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY); + qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_INSERTION_DELAY); } else { if (level) { s->prnsts = 0x1ff0000; @@ -289,9 +289,11 @@ static void sdhci_reset(SDHCIState *s) timer_del(s->insert_timer); timer_del(s->transfer_timer); - /* Set all registers to 0. Capabilities/Version registers are not cleared + /* + * Set all registers to 0. Capabilities/Version registers are not cleared * and assumed to always preserve their value, given to them during - * initialization */ + * initialization + */ memset(&s->sdmasysad, 0, (uintptr_t)&s->capareg - (uintptr_t)&s->sdmasysad); /* Reset other state based on current card insertion/readonly status */ @@ -305,7 +307,8 @@ static void sdhci_reset(SDHCIState *s) static void sdhci_poweron_reset(DeviceState *dev) { - /* QOM (ie power-on) reset. This is identical to reset + /* + * QOM (ie power-on) reset. This is identical to reset * commanded via device register apart from handling of the * 'pending insert on powerup' quirk. */ @@ -445,8 +448,10 @@ static void sdhci_read_block_from_card(SDHCIState *s) s->prnsts &= ~SDHC_DAT_LINE_ACTIVE; } - /* If stop at block gap request was set and it's not the last block of - * data - generate Block Event interrupt */ + /* + * If stop at block gap request was set and it's not the last block of + * data - generate Block Event interrupt + */ if (s->stopped_state == sdhc_gap_read && (s->trnmod & SDHC_TRNS_MULTI) && s->blkcnt != 1) { s->prnsts &= ~SDHC_DAT_LINE_ACTIVE; @@ -548,8 +553,10 @@ static void sdhci_write_block_to_card(SDHCIState *s) sdhci_update_irq(s); } -/* Write @size bytes of @value data to host controller @s Buffer Data Port - * register */ +/* + * Write @size bytes of @value data to host controller @s Buffer Data Port + * register + */ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size) { unsigned i; @@ -594,9 +601,11 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) return; } - /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for + /* + * XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for * possible stop at page boundary if initial address is not page aligned, - * allow them to work properly */ + * allow them to work properly + */ if ((s->sdmasysad % boundary_chk) == 0) { page_aligned = true; } @@ -702,7 +711,8 @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr) dma_memory_read(s->dma_as, entry_addr, &adma2, sizeof(adma2), MEMTXATTRS_UNSPECIFIED); adma2 = le64_to_cpu(adma2); - /* The spec does not specify endianness of descriptor table. + /* + * The spec does not specify endianness of descriptor table. * We currently assume that it is LE. */ dscr->addr = (hwaddr)extract64(adma2, 32, 32) & ~0x3ull; @@ -977,8 +987,10 @@ static bool sdhci_can_issue_command(SDHCIState *s) return true; } -/* The Buffer Data Port register must be accessed in sequential and - * continuous manner */ +/* + * The Buffer Data Port register must be accessed in sequential and + * continuous manner + */ static inline bool sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num) { @@ -1206,8 +1218,10 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) MASKED_WRITE(s->argument, mask, value); break; case SDHC_TRNMOD: - /* DMA can be enabled only if it is supported as indicated by - * capabilities register */ + /* + * DMA can be enabled only if it is supported as indicated by + * capabilities register + */ if (!(s->capareg & R_SDHC_CAPAB_SDMA_MASK)) { value &= ~SDHC_TRNS_DMA; } @@ -1279,8 +1293,10 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) } else { s->norintsts &= ~SDHC_NIS_ERR; } - /* Quirk for Raspberry Pi: pending card insert interrupt - * appears when first enabled after power on */ + /* + * Quirk for Raspberry Pi: pending card insert interrupt + * appears when first enabled after power on + */ if ((s->norintstsen & SDHC_NISEN_INSERT) && s->pending_insert_state) { assert(s->pending_insert_quirk); s->norintsts |= SDHC_NIS_INSERT; @@ -1396,8 +1412,10 @@ void sdhci_initfn(SDHCIState *s) { qbus_init(&s->sdbus, sizeof(s->sdbus), TYPE_SDHCI_BUS, DEVICE(s), "sd-bus"); - s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_raise_insertion_irq, s); - s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_data_transfer, s); + s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, + sdhci_raise_insertion_irq, s); + s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, + sdhci_data_transfer, s); s->io_ops = &sdhci_mmio_le_ops; } @@ -1445,11 +1463,13 @@ void sdhci_common_realize(SDHCIState *s, Error **errp) void sdhci_common_unrealize(SDHCIState *s) { - /* This function is expected to be called only once for each class: + /* + * This function is expected to be called only once for each class: * - SysBus: via DeviceClass->unrealize(), * - PCI: via PCIDeviceClass->exit(). * However to avoid double-free and/or use-after-free we still nullify - * this variable (better safe than sorry!). */ + * this variable (better safe than sorry!). + */ g_free(s->fifo_buffer); s->fifo_buffer = NULL; } -- cgit v1.2.3 From c3d7c18b0d616cf7fb3c1f325503e1462307209d Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Thu, 14 Nov 2024 11:46:53 +0100 Subject: hw/misc/mos6522: Fix bad class definition of the MOS6522 device MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When compiling QEMU with --enable-cfi, the "q800" m68k machine currently crashes very early, when the q800_machine_init() function tries to wire the interrupts of the "via1" device. This happens because TYPE_MOS6522_Q800_VIA1 is supposed to be a proper SysBus device, but its parent (TYPE_MOS6522) has a mistake in its class definition where it is only derived from DeviceClass, and not from SysBusDeviceClass, so we end up in funny memory access issues here. Using the right class hierarchy for the MOS6522 device fixes the problem. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2675 Signed-off-by: Thomas Huth Fixes: 51f233ec92 ("misc: introduce new mos6522 VIA device") Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Mark Cave-Ayland Message-ID: <20241114104653.963812-1-thuth@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- include/hw/misc/mos6522.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/hw/misc/mos6522.h b/include/hw/misc/mos6522.h index fba45668ab..920871a598 100644 --- a/include/hw/misc/mos6522.h +++ b/include/hw/misc/mos6522.h @@ -154,7 +154,7 @@ struct MOS6522State { OBJECT_DECLARE_TYPE(MOS6522State, MOS6522DeviceClass, MOS6522) struct MOS6522DeviceClass { - DeviceClass parent_class; + SysBusDeviceClass parent_class; ResettablePhases parent_phases; void (*portB_write)(MOS6522State *dev); -- cgit v1.2.3 From e125d9835b89545b09c0367404dcf69f18ae6de1 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Thu, 14 Nov 2024 13:53:17 +0100 Subject: Revert "hw/audio/hda: fix memory leak on audio setup" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 6d03242a7e47815ed56687ecd13f683d8da3f2fe, which causes SPICE audio to break. While arguably this is a SPICE bug, it is possible to fix the leak in a less heavy-handed way. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2639 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini Reviewed-by: Michael Tokarev Message-ID: <20241114125318.1707590-2-pbonzini@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/audio/hda-codec.c | 33 +++++++++++++-------------------- 1 file changed, 13 insertions(+), 20 deletions(-) diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c index bc661504cf..74c0292284 100644 --- a/hw/audio/hda-codec.c +++ b/hw/audio/hda-codec.c @@ -472,24 +472,6 @@ static void hda_audio_set_amp(HDAAudioStream *st) } } -static void hda_close_stream(HDAAudioState *a, HDAAudioStream *st) -{ - if (st->node == NULL) { - return; - } - if (a->use_timer) { - timer_free(st->buft); - st->buft = NULL; - } - if (st->output) { - AUD_close_out(&a->card, st->voice.out); - st->voice.out = NULL; - } else { - AUD_close_in(&a->card, st->voice.in); - st->voice.in = NULL; - } -} - static void hda_audio_setup(HDAAudioStream *st) { bool use_timer = st->state->use_timer; @@ -502,7 +484,6 @@ static void hda_audio_setup(HDAAudioStream *st) trace_hda_audio_format(st->node->name, st->as.nchannels, fmt2name[st->as.fmt], st->as.freq); - hda_close_stream(st->state, st); if (st->output) { if (use_timer) { cb = hda_audio_output_cb; @@ -760,11 +741,23 @@ static void hda_audio_init(HDACodecDevice *hda, static void hda_audio_exit(HDACodecDevice *hda) { HDAAudioState *a = HDA_AUDIO(hda); + HDAAudioStream *st; int i; dprint(a, 1, "%s\n", __func__); for (i = 0; i < ARRAY_SIZE(a->st); i++) { - hda_close_stream(a, a->st + i); + st = a->st + i; + if (st->node == NULL) { + continue; + } + if (a->use_timer) { + timer_free(st->buft); + } + if (st->output) { + AUD_close_out(&a->card, st->voice.out); + } else { + AUD_close_in(&a->card, st->voice.in); + } } AUD_remove_card(&a->card); } -- cgit v1.2.3 From 626b39006d2f9b1378a04cb88a2187bb852cb055 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Thu, 14 Nov 2024 13:53:18 +0100 Subject: hw/audio/hda: fix memory leak on audio setup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When SET_STREAM_FORMAT is called, the st->buft timer is overwritten, thus causing a memory leak. This was originally fixed in commit 816139ae6a5 ("hw/audio/hda: fix memory leak on audio setup", 2024-11-14) but that caused the audio to break in SPICE. Fortunately, a simpler fix is possible. The timer only needs to be reset, because the callback is always the same (st->output is set at realize time in hda_audio_init); call to timer_new_ns overkill. Replace it with timer_del and only initialize the timer once; for simplicity, do it even if use_timer is false. An even simpler fix would be to free the old time in hda_audio_setup(). However, it seems better to place the initialization of the timer close to that of st->ouput. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini Reviewed-by: Michael Tokarev Message-ID: <20241114125318.1707590-3-pbonzini@redhat.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/audio/hda-codec.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c index 74c0292284..c340a9481d 100644 --- a/hw/audio/hda-codec.c +++ b/hw/audio/hda-codec.c @@ -487,8 +487,7 @@ static void hda_audio_setup(HDAAudioStream *st) if (st->output) { if (use_timer) { cb = hda_audio_output_cb; - st->buft = timer_new_ns(QEMU_CLOCK_VIRTUAL, - hda_audio_output_timer, st); + timer_del(st->buft); } else { cb = hda_audio_compat_output_cb; } @@ -497,8 +496,7 @@ static void hda_audio_setup(HDAAudioStream *st) } else { if (use_timer) { cb = hda_audio_input_cb; - st->buft = timer_new_ns(QEMU_CLOCK_VIRTUAL, - hda_audio_input_timer, st); + timer_del(st->buft); } else { cb = hda_audio_compat_input_cb; } @@ -726,8 +724,12 @@ static void hda_audio_init(HDACodecDevice *hda, st->gain_right = QEMU_HDA_AMP_STEPS; st->compat_bpos = sizeof(st->compat_buf); st->output = true; + st->buft = timer_new_ns(QEMU_CLOCK_VIRTUAL, + hda_audio_output_timer, st); } else { st->output = false; + st->buft = timer_new_ns(QEMU_CLOCK_VIRTUAL, + hda_audio_input_timer, st); } st->format = AC_FMT_TYPE_PCM | AC_FMT_BITS_16 | (1 << AC_FMT_CHAN_SHIFT); @@ -750,9 +752,7 @@ static void hda_audio_exit(HDACodecDevice *hda) if (st->node == NULL) { continue; } - if (a->use_timer) { - timer_free(st->buft); - } + timer_free(st->buft); if (st->output) { AUD_close_out(&a->card, st->voice.out); } else { -- cgit v1.2.3 From 5814c08467937154745c6cb2b3400800b98ff897 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Nov 2024 14:16:18 +0000 Subject: hw/net/virtio-net.c: Don't assume IP length field is aligned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In virtio-net.c we assume that the IP length field in the packet is aligned, and we copy its address into a uint16_t* in the VirtioNetRscUnit struct which we then dereference later. This isn't a safe assumption; it will also result in compilation failures if we mark the ip_header struct as QEMU_PACKED because the compiler will not let you take the address of an unaligned struct field. Make the ip_plen field in VirtioNetRscUnit a void*, and make all the places where we read or write through that pointer instead use some new accessor functions read_unit_ip_len() and write_unit_ip_len() which account for the pointer being potentially unaligned and also do the network-byte-order conversion we were previously using htons() to perform. Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20241114141619.806652-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- hw/net/virtio-net.c | 23 +++++++++++++++++++---- include/hw/virtio/virtio-net.h | 2 +- 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index f2104ed364..75b4a28fb3 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -2049,6 +2049,21 @@ static ssize_t virtio_net_do_receive(NetClientState *nc, const uint8_t *buf, return virtio_net_receive_rcu(nc, buf, size, false); } +/* + * Accessors to read and write the IP packet data length field. This + * is a potentially unaligned network-byte-order 16 bit unsigned integer + * pointed to by unit->ip_len. + */ +static uint16_t read_unit_ip_len(VirtioNetRscUnit *unit) +{ + return lduw_be_p(unit->ip_plen); +} + +static void write_unit_ip_len(VirtioNetRscUnit *unit, uint16_t l) +{ + stw_be_p(unit->ip_plen, l); +} + static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain, const uint8_t *buf, VirtioNetRscUnit *unit) @@ -2063,7 +2078,7 @@ static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain, unit->ip_plen = &ip->ip_len; unit->tcp = (struct tcp_header *)(((uint8_t *)unit->ip) + ip_hdrlen); unit->tcp_hdrlen = (htons(unit->tcp->th_offset_flags) & 0xF000) >> 10; - unit->payload = htons(*unit->ip_plen) - ip_hdrlen - unit->tcp_hdrlen; + unit->payload = read_unit_ip_len(unit) - ip_hdrlen - unit->tcp_hdrlen; } static void virtio_net_rsc_extract_unit6(VirtioNetRscChain *chain, @@ -2082,7 +2097,7 @@ static void virtio_net_rsc_extract_unit6(VirtioNetRscChain *chain, /* There is a difference between payload length in ipv4 and v6, ip header is excluded in ipv6 */ - unit->payload = htons(*unit->ip_plen) - unit->tcp_hdrlen; + unit->payload = read_unit_ip_len(unit) - unit->tcp_hdrlen; } static size_t virtio_net_rsc_drain_seg(VirtioNetRscChain *chain, @@ -2231,7 +2246,7 @@ static int32_t virtio_net_rsc_coalesce_data(VirtioNetRscChain *chain, VirtioNetRscUnit *o_unit; o_unit = &seg->unit; - o_ip_len = htons(*o_unit->ip_plen); + o_ip_len = read_unit_ip_len(o_unit); nseq = htonl(n_unit->tcp->th_seq); oseq = htonl(o_unit->tcp->th_seq); @@ -2267,7 +2282,7 @@ coalesce: o_unit->payload += n_unit->payload; /* update new data len */ /* update field in ip header */ - *o_unit->ip_plen = htons(o_ip_len + n_unit->payload); + write_unit_ip_len(o_unit, o_ip_len + n_unit->payload); /* Bring 'PUSH' big, the whql test guide says 'PUSH' can be coalesced for windows guest, while this may change the behavior for linux diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h index 060c23c04d..b9ea9e824e 100644 --- a/include/hw/virtio/virtio-net.h +++ b/include/hw/virtio/virtio-net.h @@ -102,7 +102,7 @@ typedef struct VirtioNetRscStat { /* Rsc unit general info used to checking if can coalescing */ typedef struct VirtioNetRscUnit { void *ip; /* ip header */ - uint16_t *ip_plen; /* data len pointer in ip header field */ + void *ip_plen; /* pointer to unaligned uint16_t data len in ip header */ struct tcp_header *tcp; /* tcp header */ uint16_t tcp_hdrlen; /* tcp header len */ uint16_t payload; /* pure payload without virtio/eth/ip/tcp */ -- cgit v1.2.3 From f8b94b4c520126ab2745dbcf0e93cf8642b127fb Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Nov 2024 14:16:19 +0000 Subject: net: mark struct ip_header as QEMU_PACKED MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ip_header is not actually guaranteed to be aligned. We attempt to deal with this in some places such as net_checksum_calculate() by using stw_be_p and so on to access the fields, but this is not sufficient to be correct, because even accessing a byte member within an unaligned struct is undefined behaviour. The clang sanitizer will emit warnings like these if net_checksum_calculate() is called: Stopping network: ../../net/checksum.c:106:9: runtime error: member access within misaligned address 0x556aad9b502e for type 'struct ip_header', which requires 4 byte alignment 0x556aad9b502e: note: pointer points here 34 56 08 00 45 00 01 48 a5 09 40 00 40 11 7c 8b 0a 00 02 0f 0a 00 02 02 00 44 00 43 01 34 19 56 ^ SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../net/checksum.c:106:9 in ../../net/checksum.c:106:9: runtime error: load of misaligned address 0x556aad9b502e for type 'uint8_t' (aka 'unsigned char'), which requires 4 byte alignment 0x556aad9b502e: note: pointer points here 34 56 08 00 45 00 01 48 a5 09 40 00 40 11 7c 8b 0a 00 02 0f 0a 00 02 02 00 44 00 43 01 34 19 56 ^ Fix this by marking the ip_header struct as QEMU_PACKED, so that the compiler knows that it might be unaligned and will generate the right code for accessing fields. Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20241114141619.806652-3-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé --- include/net/eth.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/eth.h b/include/net/eth.h index 3b80b6e07f..14c34f530f 100644 --- a/include/net/eth.h +++ b/include/net/eth.h @@ -56,7 +56,7 @@ struct ip_header { uint8_t ip_p; /* protocol */ uint16_t ip_sum; /* checksum */ uint32_t ip_src, ip_dst; /* source and destination address */ -}; +} QEMU_PACKED; typedef struct tcp_header { uint16_t th_sport; /* source port */ -- cgit v1.2.3 From b6db70bc0a9e53e7aa04cc940db1ddbee17fa700 Mon Sep 17 00:00:00 2001 From: Roque Arcudia Hernandez Date: Fri, 15 Nov 2024 16:03:24 +0000 Subject: hw/watchdog/cmsdk_apb_watchdog: Fix broken link MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch changes the comments to point to the latest Design Kit Technical Reference Manual. Signed-off-by: Roque Arcudia Hernandez Tested-by: Philippe Mathieu-Daudé Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20241115160328.1650269-2-roqueh@google.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/watchdog/cmsdk-apb-watchdog.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c index 7ad46f9410..e4d25a25f7 100644 --- a/hw/watchdog/cmsdk-apb-watchdog.c +++ b/hw/watchdog/cmsdk-apb-watchdog.c @@ -12,8 +12,8 @@ /* * This is a model of the "APB watchdog" which is part of the Cortex-M * System Design Kit (CMSDK) and documented in the Cortex-M System - * Design Kit Technical Reference Manual (ARM DDI0479C): - * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit + * Design Kit Technical Reference Manual (ARM DDI0479): + * https://developer.arm.com/documentation/ddi0479/ * * We also support the variant of this device found in the TI * Stellaris/Luminary boards and documented in: -- cgit v1.2.3