From a62ee00aa063b8fa27076ec5100b2475fcd677ed Mon Sep 17 00:00:00 2001 From: Doug Evans Date: Tue, 30 Mar 2021 14:05:33 +0100 Subject: net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not set Turning REG_MCMDR_RXON is enough to start receiving packets. Signed-off-by: Doug Evans Message-id: 20210319195044.741821-1-dje@google.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/net/npcm7xx_emc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'hw') diff --git a/hw/net/npcm7xx_emc.c b/hw/net/npcm7xx_emc.c index 714a742ba7..7c892f820f 100644 --- a/hw/net/npcm7xx_emc.c +++ b/hw/net/npcm7xx_emc.c @@ -702,7 +702,9 @@ static void npcm7xx_emc_write(void *opaque, hwaddr offset, !(value & REG_MCMDR_RXON)) { emc->regs[REG_MGSTA] |= REG_MGSTA_RXHA; } - if (!(value & REG_MCMDR_RXON)) { + if (value & REG_MCMDR_RXON) { + emc->rx_active = true; + } else { emc_halt_rx(emc, 0); } break; -- cgit v1.2.3 From c8aaa24537cb87ebe5a2a6a1ea9cfff337e98bb4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Tue, 30 Mar 2021 14:05:33 +0100 Subject: hw/display/xlnx_dp: Free FIFOs adding xlnx_dp_finalize() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When building with --enable-sanitizers we get: Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x5618479ec7cf in malloc (qemu-system-aarch64+0x233b7cf) #1 0x7f675745f958 in g_malloc (/lib64/libglib-2.0.so.0+0x58958) #2 0x561847c2dcc9 in xlnx_dp_init hw/display/xlnx_dp.c:1259:5 #3 0x56184a5bdab8 in object_init_with_type qom/object.c:375:9 #4 0x56184a5a2bda in object_initialize_with_type qom/object.c:517:5 #5 0x56184a5a24d5 in object_initialize qom/object.c:536:5 #6 0x56184a5a2f6c in object_initialize_child_with_propsv qom/object.c:566:5 #7 0x56184a5a2e60 in object_initialize_child_with_props qom/object.c:549:10 #8 0x56184a5a3a1e in object_initialize_child_internal qom/object.c:603:5 #9 0x5618495aa431 in xlnx_zynqmp_init hw/arm/xlnx-zynqmp.c:273:5 The RX/TX FIFOs are created in xlnx_dp_init(), add xlnx_dp_finalize() to destroy them. Fixes: 58ac482a66d ("introduce xlnx-dp") Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-id: 20210323182958.277654-1-f4bug@amsat.org Signed-off-by: Peter Maydell --- hw/display/xlnx_dp.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'hw') diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c index c56e6ec593..4fd6aeb18b 100644 --- a/hw/display/xlnx_dp.c +++ b/hw/display/xlnx_dp.c @@ -1260,6 +1260,14 @@ static void xlnx_dp_init(Object *obj) fifo8_create(&s->tx_fifo, 16); } +static void xlnx_dp_finalize(Object *obj) +{ + XlnxDPState *s = XLNX_DP(obj); + + fifo8_destroy(&s->tx_fifo); + fifo8_destroy(&s->rx_fifo); +} + static void xlnx_dp_realize(DeviceState *dev, Error **errp) { XlnxDPState *s = XLNX_DP(dev); @@ -1359,6 +1367,7 @@ static const TypeInfo xlnx_dp_info = { .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(XlnxDPState), .instance_init = xlnx_dp_init, + .instance_finalize = xlnx_dp_finalize, .class_init = xlnx_dp_class_init, }; -- cgit v1.2.3 From 6c1bd93954cbdd70d8bdcd67b1f01d759747d895 Mon Sep 17 00:00:00 2001 From: Zenghui Yu Date: Tue, 30 Mar 2021 14:05:33 +0100 Subject: hw/arm/smmuv3: Drop unused CDM_VALID() and is_cd_valid() They were introduced in commit 9bde7f0674fe ("hw/arm/smmuv3: Implement translate callback") but never actually used. Drop them. Signed-off-by: Zenghui Yu Acked-by: Eric Auger Message-id: 20210325142702.790-1-yuzenghui@huawei.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/arm/smmuv3-internal.h | 7 ------- 1 file changed, 7 deletions(-) (limited to 'hw') diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h index b6f7e53b7c..3dac5766ca 100644 --- a/hw/arm/smmuv3-internal.h +++ b/hw/arm/smmuv3-internal.h @@ -595,13 +595,6 @@ static inline int pa_range(STE *ste) #define CD_A(x) extract32((x)->word[1], 14, 1) #define CD_AARCH64(x) extract32((x)->word[1], 9 , 1) -#define CDM_VALID(x) ((x)->word[0] & 0x1) - -static inline int is_cd_valid(SMMUv3State *s, STE *ste, CD *cd) -{ - return CD_VALID(cd); -} - /** * tg2granule - Decodes the CD translation granule size field according * to the ttbr in use -- cgit v1.2.3 From b9e3f1579a4b06fc63dfa8cdb68df1c58eeb0cf1 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Tue, 30 Mar 2021 14:05:34 +0100 Subject: hw/timer/renesas_tmr: Add default-case asserts in read_tcnt() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In commit 81b3ddaf8772ec we fixed a use of uninitialized data in read_tcnt(). However this change wasn't enough to placate Coverity, which is not smart enough to see that if we read a 2 bit field and then handle cases 0, 1, 2 and 3 then there cannot be a flow of execution through the switch default. Add explicit default cases which assert that they can't be reached, which should help silence Coverity. Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 20210319162458.13760-1-peter.maydell@linaro.org --- hw/timer/renesas_tmr.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'hw') diff --git a/hw/timer/renesas_tmr.c b/hw/timer/renesas_tmr.c index eed39917fe..d96002e1ee 100644 --- a/hw/timer/renesas_tmr.c +++ b/hw/timer/renesas_tmr.c @@ -146,6 +146,8 @@ static uint16_t read_tcnt(RTMRState *tmr, unsigned size, int ch) case CSS_CASCADING: tcnt[1] = tmr->tcnt[1]; break; + default: + g_assert_not_reached(); } switch (FIELD_EX8(tmr->tccr[0], TCCR, CSS)) { case CSS_INTERNAL: @@ -159,6 +161,8 @@ static uint16_t read_tcnt(RTMRState *tmr, unsigned size, int ch) case CSS_EXTERNAL: /* QEMU doesn't implement this */ tcnt[0] = tmr->tcnt[0]; break; + default: + g_assert_not_reached(); } } else { tcnt[0] = tmr->tcnt[0]; -- cgit v1.2.3