summary refs log tree commit diff stats
path: root/scripts/qapi/introspect.py (unfollow)
Commit message (Collapse)AuthorFilesLines
2022-04-12Update version for v7.0.0-rc4 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-08virtio-iommu: use-after-free fixWentao Liang1-0/+1
A potential Use-after-free was reported in virtio_iommu_handle_command when using virtio-iommu: > I find a potential Use-after-free in QEMU 6.2.0, which is in > virtio_iommu_handle_command() (./hw/virtio/virtio-iommu.c). > > > Specifically, in the loop body, the variable 'buf' allocated at line 639 can be > freed by g_free() at line 659. However, if the execution path enters the loop > body again and the if branch takes true at line 616, the control will directly > jump to 'out' at line 651. At this time, 'buf' is a freed pointer, which is not > assigned with an allocated memory but used at line 653. As a result, a UAF bug > is triggered. > > > > 599 for (;;) { > ... > 615 sz = iov_to_buf(iov, iov_cnt, 0, &head, sizeof(head)); > 616 if (unlikely(sz != sizeof(head))) { > 617 tail.status = VIRTIO_IOMMU_S_DEVERR; > 618 goto out; > 619 } > ... > 639 buf = g_malloc0(output_size); > ... > 651 out: > 652 sz = iov_from_buf(elem->in_sg, elem->in_num, 0, > 653 buf ? buf : &tail, output_size); > ... > 659 g_free(buf); > > We can fix it by set ‘buf‘ to NULL after freeing it: > > > 651 out: > 652 sz = iov_from_buf(elem->in_sg, elem->in_num, 0, > 653 buf ? buf : &tail, output_size); > ... > 659 g_free(buf); > +++ buf = NULL; > 660 } Fix as suggested by the reporter. Signed-off-by: Wentao Liang <Wentao_Liang_g@163.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20220407095047.50371-1-mst@redhat.com Message-ID: <20220406040445-mutt-send-email-mst@kernel.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-07ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)Mauro Matteo Cascella3-1/+16
Prevent potential integer overflow by limiting 'width' and 'height' to 512x512. Also change 'datasize' type to size_t. Refer to security advisory https://starlabs.sg/advisories/22-4206/ for more information. Fixes: CVE-2021-4206 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081712.345609-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-07display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)Mauro Matteo Cascella1-1/+1
Avoid fetching 'width' and 'height' a second time to prevent possible race condition. Refer to security advisory https://starlabs.sg/advisories/22-4207/ for more information. Fixes: CVE-2021-4207 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081106.343235-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-06Update version for v7.0.0-rc3 releasePeter Maydell1-1/+1
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-06acpi: fix acpi_index migrationDr. David Alan Gilbert5-14/+17
vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState as state but it actually received PIIX4PMState, because VMSTATE_PCI_HOTPLUG is a macro and not another struct. So it ended up accessing random pointer, which resulted in 'false' return value and acpi_index field wasn't ever sent. However in 7.0 that pointer de-references to value > 0, and destination QEMU starts to expect the field which isn't sent in migratioon stream from older QEMU (6.2 and older). As result migration fails with: qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm qemu-system-x86_64: load of migration failed: Invalid argument In addition with QEMU-6.2, destination due to not expected state, also never expects the acpi_index field in migration stream. Q35 is not affected as it always sends/expects the field as long as acpi based PCI hotplug is enabled. Fix issue by introducing compat knob to never send/expect acpi_index in migration stream for 6.2 and older PC machine types and always send it for 7.0 and newer PC machine types. Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932 Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-05qapi: Fix calc-dirty-rate exampleMarkus Armbruster1-1/+1
The example shows {"command": ...}, which is wrong. Fix it to {"execute": ...}. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20220401082028.3583296-1-armbru@redhat.com> Reviewed-by: Victor Toso <victortoso@redhat.com>
2022-04-05qapi: fix example of query-memdev commandVictor Toso1-0/+2
Example output is missing mandatory argument @share for the return JSON object. Add it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-10-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix example of query-cpus-fast commandVictor Toso1-2/+0
Example output contains member @arch that was removed in 445a5b4087 "machine: remove 'arch' field from 'query-cpus-fast' QMP command". Fix it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-9-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix example of trace-event-get-state commandVictor Toso1-1/+1
The example output is missing the mandatory member @vcpu. Fix it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-8-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix example of query-colo-status commandVictor Toso1-1/+1
The example output is missing the mandatory member @last-mode in the return value. Fix it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-7-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix example of query-vnc commandVictor Toso1-0/+1
The return value is missing the mandatory member @websocket. Fix it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-6-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix example of query-spice commandVictor Toso1-0/+2
Example output is missing mandatory members @migrated and @mouse-mode. Fix it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-5-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix example of query-named-block-nodes commandVictor Toso1-0/+1
Example output is missing mandatory member @detect_zeroes. Fix it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-4-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix examples: replay-break and replay-seekVictor Toso1-2/+2
Both examples outputs are using @data member for the arguments. This is wrong. The expected member for the QMP is @arguments. Fix it. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220331190633.121077-3-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05qapi: fix example of netdev_add commandVictor Toso1-1/+1
Example output has the optional member @dnssearch as string type. It should be an array of String objects instead. Fix it. For reference, see NetdevUserOptions. Signed-off-by: Victor Toso <victortoso@redhat.com> Message-Id: <20220401110712.26911-1-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Commit message tweaked for precision] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-04-05docs/system/i386: Add measurement calculation details to amd-memory-encryptionDov Murik1-4/+50
Add a section explaining how the Guest Owner should calculate the expected guest launch measurement for SEV and SEV-ES. Also update the name and links to the SEV API Spec document. Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Suggested-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20220217110059.2320497-1-dovmurik@linux.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-05qga/vss-win32: fix compilation with clang++Helge Konetzka1-1/+2
This fixes: qga/vss-win32/install.cpp:49:24: error: cannot initialize a variable of type 'char *' with an rvalue of type 'const char *' char *msg = NULL, *nul = strchr(text, '('); ^ ~~~~~~~~~~~~~~~~~ Signed-off-by: Helge Konetzka <hk@zapateado.de> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com> Message-Id: <39400817-3dc9-516d-9096-bc1f68862531@zapateado.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-05coverity: update model for latest toolsPaolo Bonzini1-1/+2
Coverity is now rejecting incomplete types in the modeling file. Just use a random number (in the neighborhood of the actual one) for the size of a GIOChannel. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-05docs/system/devices/can.rst: correct links to CTU CAN FD IP core documentation.Pavel Pisa1-3/+3
Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20220402204523.32643-1-pisa@cmp.felk.cvut.cz Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-05xlnx-bbram: hw/nvram: Fix uninitialized Error *Tong Ho1-1/+1
This adds required initialization of Error * variable. Signed-off-by: Tong Ho <tong.ho@xilinx.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-04linux-user/ppc: Narrow type of ccr in save_user_regsRichard Henderson1-1/+1
Coverity warns that we shift a 32-bit value by N, and then accumulate it into a 64-bit type (target_ulong on ppc64). The ccr is always 8 * 4-bit fields, and thus is always a 32-bit quantity; narrow the type to avoid the warning. Fixes: Coverity CID 1487223 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220401191643.330393-1-richard.henderson@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-04-04ppc/pnv: Fix number of registers in the PCIe controller on POWER9Frederic Barrat1-1/+1
The spec defines 3 registers, even though only index 0 and 2 are valid on POWER9. The same model is used on POWER10. Register 1 is defined there but we currently don't use it in skiboot. So we can keep reporting an error on write. Reported by Coverity (CID 1487176). Fixes: 4f9924c4d4cf ("ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge") Suggested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> Message-Id: <20220401091925.770803-1-fbarrat@linux.ibm.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-04-04hw/ppc: free env->tb_env in spapr_unrealize_vcpu()Daniel Henrique Barboza3-0/+11
The timebase is allocated during spapr_realize_vcpu() and it's not freed. This results in memory leaks when doing vcpu unplugs: ==636935== ==636935== 144 (96 direct, 48 indirect) bytes in 1 blocks are definitely lost in loss record 6 ,461 of 8,135 ==636935== at 0x4897468: calloc (vg_replace_malloc.c:760) ==636935== by 0x5077213: g_malloc0 (in /usr/lib64/libglib-2.0.so.0.6400.4) ==636935== by 0x507757F: g_malloc0_n (in /usr/lib64/libglib-2.0.so.0.6400.4) ==636935== by 0x93C3FB: cpu_ppc_tb_init (ppc.c:1066) ==636935== by 0x97BC2B: spapr_realize_vcpu (spapr_cpu_core.c:268) ==636935== by 0x97C01F: spapr_cpu_core_realize (spapr_cpu_core.c:337) ==636935== by 0xD4626F: device_set_realized (qdev.c:531) ==636935== by 0xD55273: property_set_bool (object.c:2273) ==636935== by 0xD523DF: object_property_set (object.c:1408) ==636935== by 0xD588B7: object_property_set_qobject (qom-qobject.c:28) ==636935== by 0xD52897: object_property_set_bool (object.c:1477) ==636935== by 0xD4579B: qdev_realize (qdev.c:333) ==636935== This patch adds a cpu_ppc_tb_free() helper in hw/ppc/ppc.c to allow us to free the timebase. This leak is then solved by calling cpu_ppc_tb_free() in spapr_unrealize_vcpu(). Fixes: 6f4b5c3ec590 ("spapr: CPU hot unplug support") Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20220329124545.529145-2-danielhb413@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-04-01target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegenPeter Maydell1-1/+6
In gen_store_exclusive(), if the host does not have a cmpxchg128 primitive then we generate bad code for STXP for storing two 64-bit values. We generate a call to the exit_atomic helper, which never returns, and set is_jmp to DISAS_NORETURN. However, this is forgetting that we have already emitted a brcond that jumps over this call for the case where we don't hold the exclusive. The effect is that we don't generate any code to end the TB for the exclusive-not-held execution path, which falls into the "exit with TB_EXIT_REQUESTED" code that gen_tb_end() emits. This then causes an assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB return that wasn't for an interrupt or icount. In particular, you can hit this case when using the clang sanitizers and trying to run the xlnx-versal-virt acceptance test in 'make check-acceptance'. This bug was masked until commit 848126d11e93ff ("meson: move int128 checks from configure") because we used to set CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we do not. Fix the bug by not setting is_jmp. The code after the exit_atomic call up to the fail_label is dead, but TCG is smart enough to eliminate it. We do need to set 'tmp' to some valid value, though (in the same way the exit_atomic-using code in tcg/tcg-op.c does). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
2022-04-01MAINTAINERS: change Fred Konrad's email addressFrederic Konrad2-2/+3
frederic.konrad@adacore.com and konrad@adacore.com will stop working starting 2022-04-01. Use my personal email instead. Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com> Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-01target/arm: Determine final stage 2 output PA space based on original IPAIdan Horowitz1-3/+5
As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final decision as to the output address's PA space based on the SA/SW/NSA/NSW bits needs to take the input IPA's PA space into account, and not the PA space of the result of the stage 2 walk itself. Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com [PMM: fixed commit message typo] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-01target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walkIdan Horowitz1-0/+10
As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the initial PA space used for stage 2 table walks is assigned based on the SW and NSW bits of the VSTCR and VTCR registers. This was already implemented for the recursive stage 2 page table walks in S1_ptw_translate(), but was missing for the final stage 2 walk. Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-01target/arm: Check VSTCR.SW when assigning the stage 2 output PA spaceIdan Horowitz1-1/+1
As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the PA space of the IPA is non secure, the output PA space is secure if and only if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set. Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-01target/arm: Fix MTE access checks for disabled SEL2Idan Horowitz2-2/+2
While not mentioned anywhere in the actual specification text, the HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current security state. This can be observed in the psuedo-code implementation of AArch64.AllocationTagAccessIsEnabled(). Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-04-01trace: fix compilation with lttng-ust >= 2.13Marc-André Lureau2-4/+4
On Fedora 36, with lttng-ust 2.13.1, compilation fails with: In file included from trace/trace-ust-all.h:49085, from trace/trace-ust-all.c:13: /usr/include/lttng/tracepoint-event.h:67:10: error: #include expects "FILENAME" or <FILENAME> 67 | #include LTTNG_UST_TRACEPOINT_INCLUDE | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In lttng-ust commit 41858e2b6e8 ("Fix: don't do macro expansion in tracepoint file name") from 2012, starting from lttng-ust 2.1, the API was changed to expect TRACEPOINT_INCLUDE to be defined as a string. In lttng-ust commit d2966b4b0b2 ("Remove TRACEPOINT_INCLUDE_FILE macro"), in 2021, the compatibility macro was removed. Use the "new" API from 2012, and bump the version requirement to 2.1 to fix compilation with >= 2.13. According to repology, all distributions we support have >= 2.1 (centos 8 has oldest with 2.8.1 afaict) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20220328084717.367993-2-marcandre.lureau@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-019p: move P9_XATTR_SIZE_MAX from 9p.h to 9p.cWill Cohen2-23/+23
The patch set adding 9p functionality to darwin introduced an issue where limits.h, which defines XATTR_SIZE_MAX, is included in 9p.c, though the referenced constant is needed in 9p.h. This commit fixes that issue by moving the definition of P9_XATTR_SIZE_MAX, which uses XATTR_SIZE_MAX, to also be in 9p.c. Additionally, this commit moves the location of the system headers include in 9p.c to occur before the project headers (except osdep.h). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/950 Fixes: 38d7fd68b0 ("9p: darwin: Move XATTR_SIZE_MAX->P9_XATTR_SIZE_MAX") Signed-off-by: Will Cohen <wwcohen@gmail.com> Message-Id: <20220331182651.887-1-wwcohen@gmail.com> [thuth: Adjusted placement of osdep.h] Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-01meson.build: Fix dependency of page-vary-common.c to config-poison.hThomas Huth1-1/+1
Before compiling page-vary-common.c, we have to make sure that config-poison.h has been generated (which is in the "genh" list). Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/948 Message-Id: <20220330114808.942933-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-01target/s390x: Fix determination of overflow condition code after subtractionBruno Haible1-2/+2
Reported by Paul Eggert in https://lists.gnu.org/archive/html/bug-gnulib/2021-09/msg00050.html This program currently prints different results when run with TCG instead of running on real s390x hardware: #include <stdio.h> int overflow_32 (int x, int y) { int sum; return __builtin_sub_overflow (x, y, &sum); } int overflow_64 (long long x, long long y) { long sum; return __builtin_sub_overflow (x, y, &sum); } int a1 = 0; int b1 = -2147483648; long long a2 = 0L; long long b2 = -9223372036854775808L; int main () { { int a = a1; int b = b1; printf ("a = 0x%x, b = 0x%x\n", a, b); printf ("no_overflow = %d\n", ! overflow_32 (a, b)); } { long long a = a2; long long b = b2; printf ("a = 0x%llx, b = 0x%llx\n", a, b); printf ("no_overflow = %d\n", ! overflow_64 (a, b)); } } Signed-off-by: Bruno Haible <bruno@clisp.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/618 Message-Id: <20220323162621.139313-3-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-01target/s390x: Fix determination of overflow condition code after additionBruno Haible1-2/+2
This program currently prints different results when run with TCG instead of running on real s390x hardware: #include <stdio.h> int overflow_32 (int x, int y) { int sum; return ! __builtin_add_overflow (x, y, &sum); } int overflow_64 (long long x, long long y) { long sum; return ! __builtin_add_overflow (x, y, &sum); } int a1 = -2147483648; int b1 = -2147483648; long long a2 = -9223372036854775808L; long long b2 = -9223372036854775808L; int main () { { int a = a1; int b = b1; printf ("a = 0x%x, b = 0x%x\n", a, b); printf ("no_overflow = %d\n", overflow_32 (a, b)); } { long long a = a2; long long b = b2; printf ("a = 0x%llx, b = 0x%llx\n", a, b); printf ("no_overflow = %d\n", overflow_64 (a, b)); } } Signed-off-by: Bruno Haible <bruno@clisp.org> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/616 Message-Id: <20220323162621.139313-2-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-01misc: Fixes MAINTAINERS's path .github/workflows/lockdown.ymlYonggang Luo1-1/+1
Signed-off-by: Yonggang Luo <luoyonggang@gmail.com> Message-Id: <20220323080755.156-4-luoyonggang@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-04-01target/riscv: rvv: Add missing early exit condition for whole register ↵Yueh-Ting (eop) Chen1-0/+5
load/store According to v-spec (section 7.9): The instructions operate with an effective vector length, evl=NFIELDS*VLEN/EEW, regardless of current settings in vtype and vl. The usual property that no elements are written if vstart ≥ vl does not apply to these instructions. Instead, no elements are written if vstart ≥ evl. Signed-off-by: eop Chen <eop.chen@sifive.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <164762720573.18409.3931931227997483525-0@git.sr.ht> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-04-01target/riscv: Avoid leaking "no translation" TLB entriesPalmer Dabbelt1-6/+8
The ISA doesn't allow bare mappings to be cached, as the caches are translations and bare mppings are not translated. We cache these translations in QEMU in order to utilize the TLB code, but that leaks out to the guest. Suggested-by: phantom@zju.edu.cn # no name in the From field Fixes: 1e0d985fa9 ("target/riscv: Only flush TLB if SATP.ASID changes") Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20220330165913.8836-1-palmer@rivosinc.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
2022-03-31tests/lcitool: Do not use a hard-coded /usr/bin/python3 as python interpreterThomas Huth2-2/+2
When running "make lcitool-refresh", this currently uses the hard-coded /usr/bin/python3 from the script's shebang line for running Python. That's bad, since neither /usr/bin/python3 is guaranteed to exist, nor does it honor the python interpreter that the user might have chosen while running the "configure" script. Thus let's rather use $(PYTHON) in the Makefile, and improve the shebang line in the script in case someone runs this directly. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220329063958.262669-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-03-31vhost-vdpa: fix typo in a commentStefano Garzarella1-1/+1
Replace vpda with vdpa. Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220328152022.73245-1-sgarzare@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-03-31target/sh4: Remove old README.sh4 fileThomas Huth1-150/+0
This file didn't have any non-trivial update since it was initially added in 2006, and looking at the content, it seems incredibly outdated, saying e.g. "The sh4 target is not ready at all yet for integration in qemu" or "A sh4 user-mode has also somewhat started but will be worked on afterwards"... Sounds like nobody is interested in this README file anymore, so let's simply remove it now. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp> Message-Id: <20220329151955.472306-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-03-31linux-user/sh4/termbits: Silence warning about TIOCSER_TEMT double definitionThomas Huth1-1/+1
Seen while compiling on Alpine: In file included from ../linux-user/strace.c:17: In file included from ../linux-user/qemu.h:11: In file included from ../linux-user/syscall_defs.h:1247: ../linux-user/sh4/termbits.h:276:10: warning: 'TIOCSER_TEMT' macro redefined [-Wmacro-redefined] # define TIOCSER_TEMT 0x01 /* Transmitter physically empty */ ^ /usr/include/sys/ioctl.h:50:9: note: previous definition is here #define TIOCSER_TEMT 1 ^ 1 warning generated. Add the TARGET_ prefix here, too, like we do it on the other architectures. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp> Message-Id: <20220330134302.979686-1-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-03-31tcg/aarch64: Use 'ull' suffix to force 64-bit constantRichard Henderson1-2/+2
Typo used only 'ul' suffix, which is still 32-bits for windows host. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/947 Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-03-31qapi: fix example of dump-guest-memoryVictor Toso1-1/+1
Example output lacks mandatory member @paging. Provide it. Signed-off-by: Victor Toso <victortoso@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20220328140604.41484-15-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-03-31qapi: fix example of ACPI_DEVICE_OST eventVictor Toso1-2/+3
Example output lacks mandatory member @timestamp. Provide it. Event's @data member is missing @info object. Provide it. Signed-off-by: Victor Toso <victortoso@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20220328140604.41484-14-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-03-31qapi: ui examples: add missing @websocket memberVictor Toso1-6/+6
The examples were missing mandatory member @websocket. Provide it. Signed-off-by: Victor Toso <victortoso@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20220328140604.41484-13-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-03-31qapi: fix example of MEMORY_FAILUREVictor Toso1-1/+3
Example output lacks mandatory member @timestamp. Provide it. Example output lacks mandatory member flags.recursive. Provide it. Minor: Change quotes from '' to "" in @action-required member. Signed-off-by: Victor Toso <victortoso@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20220328140604.41484-12-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Commit message fixed up] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-03-31qapi: run-state examples: add missing @timestampVictor Toso1-2/+4
The changed examples were lacking mandatory member @timestamp. Provide it. Signed-off-by: Victor Toso <victortoso@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20220328140604.41484-11-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-03-31qapi: fix examples: SHUTDOWN and RESET eventsVictor Toso1-2/+4
Example output lacks mandatory member @reason. Provide it. Signed-off-by: Victor Toso <victortoso@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20220328140604.41484-10-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2022-03-31qapi: fix example of FAILOVER_NEGOTIATED eventVictor Toso1-2/+4
Example output lacks mandatory member @timestamp. Provide it. Event's documentation is not properly formatted. Fix it by: - Adding @ to "device-id" - Adding extra line for "Since" section Signed-off-by: Victor Toso <victortoso@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20220328140604.41484-9-victortoso@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>