summary refs log tree commit diff stats
path: root/hw (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* virtio-gpu: fix crashes upon warm reboot with vga modeMarc-André Lureau2018-08-072-0/+16
| | | | | | | | | | | | | | | | | | | | | With vga=775 on the Linux command line a first boot of the VM running Linux works fine. After a warm reboot it crashes during Linux boot. Before that, valgrind points out bad memory write to console surface. The VGA code is not aware that virtio-gpu got a message surface scanout when the display is disabled. Let's reset VGA graphic mode when it is the case, so that a new display surface is created when doing further VGA operations. https://bugs.launchpad.net/qemu/+bug/1784900/ Reported-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Message-id: 20180803153235.4134-1-marcandre.lureau@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/intc/arm_gicv3_common: Move gicd shift bug handling to gicv3_post_loadPeter Maydell2018-08-061-40/+37
| | | | | | | | | | | | | | The code currently in gicv3_gicd_no_migration_shift_bug_post_load() that handles migration from older QEMU versions with a particular bug is misplaced. We need to run this after migration in all cases, not just the cases where the "arm_gicv3/gicd_no_migration_shift_bug" subsection is present, so it must go in a post_load hook for the top level VMSD, not for the subsection. Move it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20180806123445.1459-6-peter.maydell@linaro.org
* hw/intc/arm_gicv3_common: Move post_load hooks to top-level VMSDPeter Maydell2018-08-061-4/+4
| | | | | | | | | | | | | | | | | | Contrary to the the impression given in docs/devel/migration.rst, the migration code does not run the pre_load hook for a subsection unless the subsection appears on the wire, and so this is not a place where you can set the default value for state for the "subsection not present" case. Instead this needs to be done in a pre_load hook for whatever is the parent VMSD of the subsection. We got this wrong in two of the subsection definitions in the GICv3 migration structs; fix this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20180806123445.1459-5-peter.maydell@linaro.org
* hw/intc/arm_gicv3_common: Combine duplicate .subsections in vmstate_gicv3_cpuPeter Maydell2018-08-061-3/+0
| | | | | | | | | | | | | | | Commit 6692aac411199064 accidentally introduced a second initialization of the .subsections field of vmstate_gicv3_cpu, instead of adding the new subsection to the existing list. The effect of this was probably that migration of GICv3 with virtualization enabled was broken (or alternatively that migration of ICC_SRE_EL1 was broken, depending on which of the two initializers the compiler used). Combine the two into a single list. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180806123445.1459-3-peter.maydell@linaro.org
* hw/intc/arm_gicv3_common: Give no-migration-shift-bug subsection a needed ↵Peter Maydell2018-08-061-0/+6
| | | | | | | | | | | | | | | function Currently the migration code incorrectly treats a subsection with no .needed function pointer as if it was the subsection list terminator -- it is ignored and so is everything after it. Work around this by giving vmstate_gicv3_gicd_no_migration_shift_bug a 'needed' function that always returns true. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180806123445.1459-2-peter.maydell@linaro.org
* Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.0-20180801' ↵Peter Maydell2018-08-065-39/+22
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging ppc patch queue for 2018-08-01 Here are a final couple of fixes for the 3.0 release. # gpg: Signature made Wed 01 Aug 2018 04:52:57 BST # gpg: using RSA key 6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-3.0-20180801: sam460ex: Fix PCI interrupts with multiple devices hw/misc/macio: Fix device introspection problems in macio devices Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * sam460ex: Fix PCI interrupts with multiple devicesBALATON Zoltan2018-08-012-17/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The four interrupts of the PCI bus are connected to the same UIC pin on the real Sam460ex. Evidence for this can be found in the UBoot source for the Sam460ex in the Sam460ex.c file where PCI_INTERRUPT_LINE is written. Change the ppc440_pcix model to behave more like this. This fixes the problem that can be observed when adding further PCI cards that got their interrupt rotated to other interrupts than PCI INT A. In particular, the bug was observed with an additional OHCI PCI card or an ES1370 sound device. Signed-off-by: Sebastian Bauer <mail@sebastianbauer.info> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Sebastian Bauer <mail@sebastianbauer.info> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| * hw/misc/macio: Fix device introspection problems in macio devicesThomas Huth2018-08-013-22/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Valgrind reports an error when introspecting the macio devices, e.g.: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'macio-newworld'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q ppc64-softmmu/qemu-system-ppc64 -M none,accel=qtest -qmp stdio [...] ==30768== Invalid read of size 8 ==30768== at 0x5BC1EA: qdev_print (qdev-monitor.c:686) ==30768== by 0x5BC1EA: qbus_print (qdev-monitor.c:719) ==30768== by 0x43E458: handle_hmp_command (monitor.c:3446) [...] Use the new function sysbus_init_child_obj() to initialize the objects here, to get the reference counting of the objects right, so that they are cleaned up correctly when the parent gets removed. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | pc: acpi: fix memory hotplug regression by reducing stub SRAT entry sizeIgor Mammedov2018-08-031-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 848a1cc1e (hw/acpi-build: build SRAT memory affinity structures for DIMM devices) broke the first dimm hotplug in following cases: 1: there is no coldplugged dimm in the last numa node but there is a coldplugged dimm in another node -m 4096,slots=4,maxmem=32G \ -object memory-backend-ram,id=m0,size=2G \ -device pc-dimm,memdev=m0,node=0 \ -numa node,nodeid=0 \ -numa node,nodeid=1 2: if order of dimms on CLI is: 1st plugged dimm in node1 2nd plugged dimm in node0 -m 4096,slots=4,maxmem=32G \ -object memory-backend-ram,size=2G,id=m0 \ -device pc-dimm,memdev=m0,node=1 \ -object memory-backend-ram,id=m1,size=2G \ -device pc-dimm,memdev=m1,node=0 \ -numa node,nodeid=0 \ -numa node,nodeid=1 (qemu) object_add memory-backend-ram,id=m2,size=1G (qemu) device_add pc-dimm,memdev=m2,node=0 the first DIMM hotplug to any node except the last one fails (Windows is unable to online it). Length reduction of stub hotplug memory SRAT entry, fixes issue for some reason. RHBZ: 1609234 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | hw/acpi-build: Add a check for memory-less NUMA nodesDou Liyang2018-08-031-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, Qemu ACPI builder doesn't consider the memory-less NUMA nodes, eg: -m 4G,slots=4,maxmem=8G \ -numa node,nodeid=0 \ -numa node,nodeid=1,mem=2G \ -numa node,nodeid=2,mem=2G \ -numa node,nodeid=3\ Guest Linux will report [ 0.000000] ACPI: SRAT: Node 0 PXM 0 [mem 0x00000000-0xffffffffffffffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00000000-0x0009ffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00100000-0x7fffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x80000000-0xbfffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x100000000-0x13fffffff] [ 0.000000] ACPI: SRAT: Node 3 PXM 3 [mem 0x140000000-0x13fffffff] [ 0.000000] ACPI: SRAT: Node 3 PXM 3 [mem 0x140000000-0x33fffffff] hotplug [mem 0x00000000-0xffffffffffffffff] and [mem 0x140000000-0x13fffffff] are bogus. Add a check to avoid building srat memory for memory-less NUMA nodes, also update the test file. Now the info in guest linux will be [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00000000-0x0009ffff] [ 0.000000] ACPI: SRAT: Node 1 PXM 1 [mem 0x00100000-0x7fffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x80000000-0xbfffffff] [ 0.000000] ACPI: SRAT: Node 2 PXM 2 [mem 0x100000000-0x13fffffff] [ 0.000000] ACPI: SRAT: Node 3 PXM 3 [mem 0x140000000-0x33fffffff] hotplug Signed-off-by: Dou Liyang <douly.fnst@cn.fujitsu.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | vhost: check region type before castingTiwei Bie2018-08-031-1/+3
|/ | | | | | | | | | | | | | | | Check region type first before casting the memory region to IOMMUMemoryRegion. Otherwise QEMU will abort with below error message when casting non-IOMMU memory region: vhost_iommu_region_add: Object 0x561f28bce4f0 is not an instance of type qemu:iommu-memory-region Fixes: cb1efcf462a2 ("iommu: Add IOMMU index argument to notifier APIs") Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Tiwei Bie <tiwei.bie@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20180731' into stagingPeter Maydell2018-07-311-0/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fix large guests on s390x # gpg: Signature made Tue 31 Jul 2018 07:47:38 BST # gpg: using RSA key DECF6B93C6F02FAF # gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" # gpg: aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" # gpg: aka "Cornelia Huck <cornelia.huck@de.ibm.com>" # gpg: aka "Cornelia Huck <cohuck@kernel.org>" # gpg: aka "Cornelia Huck <cohuck@redhat.com>" # Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0 18CE DECF 6B93 C6F0 2FAF * remotes/cohuck/tags/s390x-20180731: s390x/sclp: fix maxram calculation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * s390x/sclp: fix maxram calculationChristian Borntraeger2018-07-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We clamp down ram_size to match the sclp increment size. We do not do the same for maxram_size, which means for large guests with some sizes (e.g. -m 50000) maxram_size differs from ram_size. This can break other code (e.g. CMMA migration) which uses maxram_size to calculate the number of pages and then throws some errors. Fixes: 82fab5c5b90e468f3e9d54c ("s390x/sclp: remove memory hotplug support") Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> CC: qemu-stable@nongnu.org CC: David Hildenbrand <david@redhat.com> Message-Id: <1532959766-53343-1-git-send-email-borntraeger@de.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
* | hw/misc/tz-mpc: Zero the LUT on initialization, not just resetPeter Maydell2018-07-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the tz-mpc device we allocate a data block for the LUT, which we then clear to zero in the device's reset method. This is conceptually fine, but unfortunately results in a valgrind complaint about use of uninitialized data on startup: ==30906== Conditional jump or move depends on uninitialised value(s) ==30906== at 0x503609: tz_mpc_translate (tz-mpc.c:439) ==30906== by 0x3F3D90: address_space_translate_iommu (exec.c:511) ==30906== by 0x3F3FF8: flatview_do_translate (exec.c:584) ==30906== by 0x3F4292: flatview_translate (exec.c:644) ==30906== by 0x3F2120: address_space_translate (memory.h:1962) ==30906== by 0x3FB753: address_space_ldl_internal (memory_ldst.inc.c:36) ==30906== by 0x3FB8A6: address_space_ldl (memory_ldst.inc.c:80) ==30906== by 0x619037: ldl_phys (memory_ldst_phys.inc.h:25) ==30906== by 0x61985D: arm_cpu_reset (cpu.c:255) ==30906== by 0x98791B: cpu_reset (cpu.c:249) ==30906== by 0x57FFDB: armv7m_reset (armv7m.c:265) ==30906== by 0x7B1775: qemu_devices_reset (reset.c:69) This is because of a reset ordering problem -- the TZ MPC resets after the CPU, but an M-profile CPU's reset function includes memory loads to get the initial PC and SP, which then go through an MPC that hasn't yet been reset. The simplest fix for this is to zero the LUT when we initialize the data, which will result in the MPC's translate function giving the right answers for these early memory accesses. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Thomas Huth <thuth@redhat.com> Message-id: 20180724153616.32352-1-peter.maydell@linaro.org
* | hw/arm/iotkit: Fix IRQ number for timer1Peter Maydell2018-07-301-1/+1
| | | | | | | | | | | | | | | | | | | | A cut-and-paste error meant we were incorrectly wiring up the timer1 IRQ to IRQ3. IRQ3 is the interrupt for timer0 -- move timer0 to IRQ4 where it belongs. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180727113854.20283-3-peter.maydell@linaro.org
* | armv7m_nvic: Fix m-security subsection namePeter Maydell2018-07-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The vmstate save/load code insists that subsections of a VMState must have names which include their parent VMState's name as a leading substring. Unfortunately it neither documents this nor checks it on device init or state save, but instead fails state load with a confusing error message ("Missing section footer for armv7m_nvic"). Fix the name of the m-security subsection of the NVIC, so that state save/load works correctly for the security-enabled NVIC. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180727113854.20283-2-peter.maydell@linaro.org
* | hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host()Geert Uytterhoeven2018-07-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When copy_properties_from_host() ignores the error for an optional property, it frees the error, but fails to reset it. Hence if two or more optional properties are missing, an assertion is triggered: util/error.c:57: error_setv: Assertion `*errp == NULL' failed. Fis this by resetting err to NULL after ignoring the error. Fixes: 9481cf2e5f2f2bb6 ("hw/arm/sysbus-fdt: helpers for clock node generation") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Message-id: 20180725113000.11014-1-geert+renesas@glider.be Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | arm/smmuv3: Fix missing VMSD terminatorDr. David Alan Gilbert2018-07-301-0/+1
|/ | | | | | | | | | | The 'vmstate_smmuv3_queue' is missing the end-of-list marker. Fixes: 10a83cb9887 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20180727135406.15132-1-dgilbert@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: dropped stray blank line] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* audio/hda: Fix migrationDr. David Alan Gilbert2018-07-241-1/+1
| | | | | | | | | | | | | | | Fix outgoing migration which was crashing in vmstate_hda_audio_stream_buf_needed, I think the problem is that we have room for upto 4 streams in the array but only use 2, when we come to try and save the state of the unused streams we hit st->state == NULL. Fixes: 280c1e1cdb24d80ecdfc Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20180724102215.31866-1-dgilbert@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* target/arm: Escalate to correct HardFault when AIRCR.BFHFNMINS is setPeter Maydell2018-07-242-3/+7
| | | | | | | | | | | | | | | | | | When we escalate a v8M exception to HardFault, if AIRCR.BFHFNMINNS is set then we need to decide whether it should become a secure HardFault or a nonsecure HardFault. We should always escalate to the same target security state as the original exception. The current code tries to test this using the 'secure' bool, which is not right because that flag indicates whether the target security state only for banked exceptions; the effect was that we were incorrectly escalating always-secure exceptions like SecureFault to a nonsecure HardFault. Fix this by defining, logging and using a new 'targets_secure' bool which tracks the condition we actually want. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180723123457.2038-1-peter.maydell@linaro.org
* hw/intc/arm_gicv3: Check correct HCR_EL2 bit when routing IRQPeter Maydell2018-07-241-1/+1
| | | | | | | | | | | In icc_dir_write() we were incorrectly checking HCR_EL2.FMO when determining whether IRQ should be routed to EL2; this should be HCR_EL2.IMO (compare the GICv3 pseudocode ICC_DIR_EL1[]). Use the correct mask. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180723180337.17378-1-peter.maydell@linaro.org
* hw/intc/exynos4210_gic: Turn instance_init into realize functionThomas Huth2018-07-231-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | The instance_init function of the "exynos4210.gic" device creates a new "arm_gic" device and immediately realizes it with qdev_init_nofail(). This will leave a lot of object in the QOM tree during introspection of the "exynos4210.gic" device, e.g. reproducible by starting QEMU like this: qemu-system-aarch64 -M none -nodefaults -nographic -monitor stdio And then by running "info qom-tree" at the HMP monitor, followed by "device_add exynos4210.gic,help" and finally checking "info qom-tree" again. Also note that qdev_init_nofail() can exit QEMU in case of errors - and this must never happen during an instance_init function, otherwise QEMU could terminate unexpectedly during introspection of a device. Since most of the code that follows the qdev_init_nofail() depends on the realized "gicbusdev", the easiest solution to the problem is to turn the whole instance_init function into a realize function instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1532337784-334-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/arm/spitz: Move problematic nand_init() code to realize functionThomas Huth2018-07-231-4/+11
| | | | | | | | | | | | | | | nand_init() does not only create the NAND device, it also realizes the device with qdev_init_nofail() already. So we must not call nand_init() from an instance_init function like sl_nand_init(), otherwise we get superfluous NAND devices in the QOM tree after introspecting the 'sl-nand' device. So move the nand_init() to the realize function of 'sl-nand' instead. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1532006134-7701-1-git-send-email-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/sd/bcm2835_sdhost: Fix PIO mode writesGuenter Roeck2018-07-231-4/+16
| | | | | | | | | | | | | | | | | Writes in PIO mode have two requirements: - A data interrupt must be generated after a write command has been issued to indicate that the chip is ready to receive data. - A block interrupt must be generated after each block to indicate that the chip is ready to receive the next data block. Rearrange the code to make this happen. Tested on raspi3 (in PIO mode) and raspi2 (in DMA mode). Signed-off-by: Guenter Roeck <linux@roeck-us.net> Message-id: 1531779837-20557-1-git-send-email-linux@roeck-us.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, ↵Thomas Huth2018-07-231-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | zynqmp-pmu-soc' Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'xlnx,zynqmp-pmu-soc'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q microblazeel-softmmu/qemu-system-microblazeel -M none,accel=qtest -qmp stdio [...] ==13605== Invalid read of size 8 ==13605== at 0x2AC69A: qdev_print (qdev-monitor.c:686) ==13605== by 0x2AC69A: qbus_print (qdev-monitor.c:719) ==13605== by 0x2591E8: handle_hmp_command (monitor.c:3446) Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1531839343-13828-1-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* e1000e: Prevent MSI/MSI-X stormsJan Kiszka2018-07-202-0/+13
| | | | | | | | | | | | | Only signal MSI/MSI-X events on rising edges. So far we re-triggered the interrupt sources even if the guest did no consumed the pending one, easily causing interrupt storms. Issue was observable with Linux 4.16 e1000e driver when MSI-X was used. Vector 2 was causing interrupt storms after the driver activated the device. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* spike: Fix crash when introspecting the deviceAlistair Francis2018-07-191-6/+4
| | | | | | | | | | Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
* riscv_hart: Fix crash when introspecting the deviceAlistair Francis2018-07-191-4/+3
| | | | | | | | | | Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
* virt: Fix crash when introspecting the deviceAlistair Francis2018-07-191-3/+2
| | | | | | | | | | | | Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* sifive_u: Fix crash when introspecting the deviceAlistair Francis2018-07-191-8/+7
| | | | | | | | | | | | Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* sifive_e: Fix crash when introspecting the deviceAlistair Francis2018-07-191-6/+6
| | | | | | | | | | | | Use the new object_initialize_child() and sysbus_init_child_obj() to fix the issue. Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Suggested-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Michael Clark <mjc@sifive.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2018-07-177-47/+80
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bug fixes. # gpg: Signature made Tue 17 Jul 2018 16:06:07 BST # gpg: using RSA key BFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: Document command line options with single dash opts: remove redundant check for NULL parameter i386: only parse the initrd_filename once for multiboot modules i386: fix regression parsing multiboot initrd modules virtio-scsi: fix hotplug ->reset() vs event race qdev: add HotplugHandler->post_plug() callback hw/char/serial: retry write if EAGAIN PC Chipset: Improve serial divisor calculation vhost-user-test: added proper TestServer *dest initialization in test_migrate() hyperv: ensure VP index equal to QEMU cpu_index hyperv: rename vcpu_id to vp_index accel: Fix typo and grammar in comment dump: add kernel_gs_base to QEMU CPU state Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * i386: only parse the initrd_filename once for multiboot modulesDaniel P. Berrangé2018-07-171-17/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The multiboot code parses the initrd_filename twice, first to count how many entries there are, and second to process each entry. This changes the first loop to store the parse module names in a list, and the second loop can now use these names. This avoids having to pass NULL to the get_opt_value() method which means it can safely assume a non-NULL param. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-3-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * i386: fix regression parsing multiboot initrd modulesDaniel P. Berrangé2018-07-171-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The logic for parsing the multiboot initrd modules was messed up in commit 950c4e6c94b15cd0d8b63891dddd7a8dbf458e6a Author: Daniel P. Berrangé <berrange@redhat.com> Date: Mon Apr 16 12:17:43 2018 +0100 opts: don't silently truncate long option values Causing the length to be undercounter, and the number of modules over counted. It also passes NULL to get_opt_value() which was not robust at accepting a NULL value. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180514171913.17664-2-berrange@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * virtio-scsi: fix hotplug ->reset() vs event raceStefan Hajnoczi2018-07-161-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a race condition during hotplug when iothread is used. It occurs because virtio-scsi may be processing command queues in the iothread while the monitor performs SCSI device hotplug. When a SCSI device is hotplugged the HotplugHandler->plug() callback is invoked and virtio-scsi emits a rescan event to the guest. If the guest submits a SCSI command at this point then it may be cancelled before hotplug completes. This happens because ->reset() is called by hw/core/qdev.c:device_set_realized() after HotplugHandler->plug() has been called and hw/scsi/scsi-disk.c:scsi_disk_reset() purges all requests. This patch uses the new HotplugHandler->post_plug() callback to emit the rescan event after ->reset(). This eliminates the race conditions where requests could be cancelled. Reported-by: l00284672 <lizhengui@huawei.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20180716083732.3347-3-stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * qdev: add HotplugHandler->post_plug() callbackStefan Hajnoczi2018-07-162-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The ->pre_plug() callback is invoked before the device is realized. The ->plug() callback is invoked when the device is being realized but before it is reset. This patch adds a ->post_plug() callback which is invoked after the device has been reset. This callback is needed by HotplugHandlers that need to wait until after ->reset(). Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20180716083732.3347-2-stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * hw/char/serial: retry write if EAGAINMarc-André Lureau2018-07-161-9/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | If the chardev returns -1 with EAGAIN errno on write(), it should try to send it again (EINTR is handled by the chardev itself). This fixes commit 019288bf137183bf3407c9824655b753bfafc99f "hw/char/serial: Only retry if qemu_chr_fe_write returns 0" Tested-by: Igor Mammedov <imammedo@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180716110755.12499-1-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * PC Chipset: Improve serial divisor calculationCalvin Lee2018-07-161-10/+13
| | | | | | | | | | | | | | | | | | | | | | This fixes several problems I found in the UART serial implementation. Now all divisor values are allowed, while before divisor values of zero and below the base baud rate were rejected. All changes are in reference to http://www.sci.muni.cz/docs/pc/serport.txt Signed-off-by: Calvin Lee <cyrus296@gmail.com> Message-Id: <20180512000545.966-2-cyrus296@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * hyperv: ensure VP index equal to QEMU cpu_indexRoman Kagan2018-07-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hyper-V identifies vCPUs by Virtual Processor (VP) index which can be queried by the guest via HV_X64_MSR_VP_INDEX msr. It is defined by the spec as a sequential number which can't exceed the maximum number of vCPUs per VM. It has to be owned by QEMU in order to preserve it across migration. However, the initial implementation in KVM didn't allow to set this msr, and KVM used its own notion of VP index. Fortunately, the way vCPUs are created in QEMU/KVM makes it likely that the KVM value is equal to QEMU cpu_index. So choose cpu_index as the value for vp_index, and push that to KVM on kernels that support setting the msr. On older ones that don't, query the kernel value and assert that it's in sync with QEMU. Besides, since handling errors from vCPU init at hotplug time is impossible, disable vCPU hotplug. This patch also introduces accessor functions to encapsulate the mapping between a vCPU and its vp_index. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-Id: <20180702134156.13404-3-rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| * hyperv: rename vcpu_id to vp_indexRoman Kagan2018-07-161-8/+8
| | | | | | | | | | | | | | | | | | | | | | In Hyper-V-related code, vCPUs are identified by their VP (virtual processor) index. Since it's customary for "vcpu_id" in QEMU to mean APIC id, rename the respective variables to "vp_index" to make the distinction clear. Signed-off-by: Roman Kagan <rkagan@virtuozzo.com> Message-Id: <20180702134156.13404-2-rkagan@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | hw/arm/xlnx-zynqmp: Fix crash when introspecting the "xlnx, zynqmp" deviceThomas Huth2018-07-171-33/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | QEMU currently crashes when e.g. doing something like this: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'xlnx,zynqmp'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" \ | aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio Use the new object_initialize_child() and sysbus_init_child_obj() functions to get the refernce counting of the child objects right, so that they are properly cleaned up when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-18-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/display/xlnx_dp: Move problematic code from instance_init to realizePaolo Bonzini2018-07-172-7/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | aux_create_slave() calls qdev_init_nofail() which in turn "realizes" the corresponding object. This is unlike qdev_create(), and it is wrong because qdev_init_nofail() must not be called from an instance_init function. Move qdev_init_nofail() and the subsequent aux_map_slave into the caller's realize function. There are two more bugs that needs to be fixed here, too, where the objects are created but not added as children. Therefore when you call object_unparent on them, nothing happens. In particular dpcd and edid give you an infinite loop in bus_unparent, because device_unparent is not called and does not remove them from the list of devices on the bus. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-17-git-send-email-thuth@redhat.com [thuth: Added Paolo's fixup for the dpcd and edid unparenting] Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/arm/stm32f205_soc: Fix introspection problem with 'stm32f205-soc' deviceThomas Huth2018-07-171-16/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'stm32f205-soc'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==28531== Invalid read of size 8 ==28531== at 0x6185BA: qdev_print (qdev-monitor.c:686) ==28531== by 0x6185BA: qbus_print (qdev-monitor.c:719) ==28531== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Fix it with the new sysbus_init_child_obj() function. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-16-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/arm/allwinner-a10: Fix introspection problem with 'allwinner-a10'Thomas Huth2018-07-171-10/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Valgrind complains: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'allwinner-a10'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==32519== Invalid read of size 8 ==32519== at 0x61869A: qdev_print (qdev-monitor.c:686) ==32519== by 0x61869A: qbus_print (qdev-monitor.c:719) ==32519== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use object_initialize_child() and sysbus_init_child_obj() to fix the issue. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-15-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/*/realview: Fix introspection problem with 'realview_mpcore' & 'realview_gic'Thomas Huth2018-07-172-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'realview_mpcore'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==2654== Invalid read of size 8 ==2654== at 0x61878A: qdev_print (qdev-monitor.c:686) ==2654== by 0x61878A: qbus_print (qdev-monitor.c:719) ==2654== by 0x452B38: handle_hmp_command (monitor.c:3446) ==2654== by 0x452D70: qmp_human_monitor_command (monitor.c:821) [...] Use sysbus_init_child_obj() to fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-14-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/cpu/arm11mpcore: Fix introspection problem with 'arm11mpcore_priv'Thomas Huth2018-07-171-8/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Valgrind reports an error here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'arm11mpcore_priv'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==3145== Invalid read of size 8 ==3145== at 0x61873A: qdev_print (qdev-monitor.c:686) ==3145== by 0x61873A: qbus_print (qdev-monitor.c:719) [...] Use sysbus_init_child_obj() to fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 1531745974-17187-13-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/arm/fsl-imx31: Fix introspection problem with the "fsl, imx31" deviceThomas Huth2018-07-171-14/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx31'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==26172== Invalid read of size 8 ==26172== at 0x6191FA: qdev_print (qdev-monitor.c:686) ==26172== by 0x6191FA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-12-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/arm/fsl-imx25: Fix introspection problem with the "fsl, imx25" deviceThomas Huth2018-07-171-16/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx25'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==26724== Invalid read of size 8 ==26724== at 0x6190DA: qdev_print (qdev-monitor.c:686) ==26724== by 0x6190DA: qbus_print (qdev-monitor.c:719) [...] Use the new sysbus_init_child_obj() to make sure that the objects are cleaned up correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-11-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/arm/fsl-imx7: Fix introspection problems with the "fsl, imx7" deviceThomas Huth2018-07-171-64/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx7'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==27284== Invalid read of size 8 ==27284== at 0x618F7A: qdev_print (qdev-monitor.c:686) ==27284== by 0x618F7A: qbus_print (qdev-monitor.c:719) ==27284== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() and object_initialize_child() to make sure that the objects are removed correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-10-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | hw/arm/fsl-imx6: Fix introspection problems with the "fsl, imx6" deviceThomas Huth2018-07-171-36/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running QEMU with valgrind indicates a problem here: echo "{'execute':'qmp_capabilities'} {'execute':'device-list-properties'," \ "'arguments':{'typename':'fsl,imx6'}}" \ "{'execute': 'human-monitor-command', " \ "'arguments': {'command-line': 'info qtree'}}" | \ valgrind -q aarch64-softmmu/qemu-system-aarch64 -M none,accel=qtest -qmp stdio [...] ==32417== Invalid read of size 8 ==32417== at 0x618A7A: qdev_print (qdev-monitor.c:686) ==32417== by 0x618A7A: qbus_print (qdev-monitor.c:719) ==32417== by 0x452B38: handle_hmp_command (monitor.c:3446) [...] Use the new sysbus_init_child_obj() and object_initialize_child() to make sure that the objects are removed correctly when the parent gets destroyed. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 1531745974-17187-9-git-send-email-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>