[Qemu-devel] [PULL 00/46] Trivial patches for 2015-02-10

[Qemu-devel] [PULL 00/46] Trivial patches for 2015-02-10

[Michael Tokarev]

This is another pull request for trivial-patches tree.
This time it is sort of huge, consisting of 46 patches in total.
There are several patches and series which aren't applied to
-trivial but should -- I decided I'll send a pull request first
and apply the leftovers later, because there are important
changes in the tree and amount of leftovers is somewhat large.
This is a 3-week collection.

This request consists of a large number of trivial fixes from
the usual heros, Marcus and Stefen, who found several new ways
to find various small defects in the code.  There are several
linux-user fixes from Chen Gang, with some grammar fixes from
me -- not all of his changes has been applied so far.  There
are several bugfixes, -- eg, the libcacard linking fix, a buffer
overflow fix in inet_parse (which does not warrant a CVE# :);
and also there are some other stuff from here and there.

Please consider applying.

Thanks,

/mjt

The following changes since commit 89db21771782fd6050335e73542064f1187c9ced:

  qmp: unbreak build for non-vnc configuration (2015-02-09 22:36:04 +0000)

are available in the git repository at:

  git://git.corpit.ru/qemu.git tags/pull-trivial-patches-2015-02-10

for you to fetch changes up to 3ff64f1f9391a9b71d4dd58c6c4bbaa1db3dd430:

  virtio: Fix warning caused by missing 'static' attribute (2015-02-10 09:27:21 +0300)

----------------------------------------------------------------
trivial patches for 2015-02-10

----------------------------------------------------------------
Chen Gang S (4):
      linux-user/syscall.c: lock_iovec: unlock vec[i] in failure processing code block
      linux-user/syscall.c: Fix typo issue for using target_vec[i].iov_len instead of target_vec[i].iov_base
      linux-user/main.c: Use TARGET_SIG* instead of SIG*
      linux-user/syscall.c: do_ioctl_dm: Need to call unlock_user() before going to failure return in default case

Christian Borntraeger (1):
      vl.c: fix memory leak spotted by valgrind

Daniel P. Berrange (1):
      libcacard: stop linking against every single 3rd party library

Don Koch (4):
      Add tracing to xenfb.
      Add trace to ps2.c.
      Add/convert trace calls in pcnet-pci.c.
      Convert some debugging printfs to trace calls in pcnet.c.

Gonglei (2):
      fw_cfg: fix typos in comments: patch -> path
      virtfs-proxy-helper: Fix possible socket leak.

Greg Kurz (2):
      QJSON: fix typo in author's email address
      Fix name error in migration stream analyzation script

Kevin Wolf (1):
      qemu-sockets: Fix buffer overflow in inet_parse()

Markus Armbruster (15):
      target-mips: Clean up switch fall through after commit fecd264
      vl: Fix bogus error message for implied mon ID clashing
      qemu-option: Replace pointless use of g_malloc0() by g_malloc()
      qemu-option: Pair g_malloc() with g_free(), not free()
      spapr_vio: Pair g_malloc() with g_free(), not free()
      usb: Pair g_malloc() with g_free(), not free()
      util/uri: uri_new() can't fail, drop dead error handling
      util/uri: realloc2n() can't fail, drop dead error handling
      util/uri: URI member path can be null, compare more carfully
      onenand: g_malloc() can't fail, bury dead error handling
      rtl8139: g_malloc() can't fail, bury dead error handling
      kvm: g_malloc() can't fail, bury dead error handling
      rdma: g_malloc0() can't fail, bury dead error handling
      vnc: g_realloc() can't fail, bury dead error handling
      translate-all: Use g_try_malloc() for dynamic translator buffer

Maxim Ostapenko (1):
      linux-user: wrong TARGET_SI_PAD_SIZE value for some targets.

Paolo Bonzini (4):
      cpu-exec: drop dead assignment
      cpu-exec: simplify icount code
      qemu-sockets: improve error reporting in unix_listen_opts
      aes: remove a dead return statement

Stefan Weil (10):
      disas/cris: Fix warning caused by missing 'static' attribute
      disas/sh4: Fix warning caused by missing 'static' attribute
      migration: Fix warning caused by missing declaration of vmstate_dummy
      migration: Fix warnings caused by missing 'static' attribute
      moxie: Fix warning caused by missing include statement
      serial: Fix warnings caused by missing 'static' attribute
      spice: Add missing 'static' attribute
      stubs: Fix warning caused by missing include statement
      vga: Fix warning caused by missing 'static' attribute
      virtio: Fix warning caused by missing 'static' attribute

Thomas Huth (1):
      qemu-log: Correct help text of 'log cpu_reset'

 cpu-exec.c                   | 12 +++------
 disas/cris.c                 |  2 +-
 disas/sh4.c                  |  2 +-
 fsdev/virtfs-proxy-helper.c  | 13 ++++++---
 hw/block/onenand.c           |  8 +-----
 hw/char/serial.c             | 14 +++++-----
 hw/char/virtio-serial-bus.c  |  2 +-
 hw/core/fw-path-provider.c   |  2 +-
 hw/display/vga.c             |  2 +-
 hw/display/xenfb.c           |  5 ++++
 hw/input/ps2.c               | 16 +++++++++++
 hw/net/pcnet-pci.c           | 49 +++++++++++++--------------------
 hw/net/pcnet.c               | 28 ++++++-------------
 hw/net/rtl8139.c             | 14 ----------
 hw/ppc/spapr.c               |  2 +-
 hw/ppc/spapr_vio.c           |  2 +-
 hw/usb/desc-msos.c           |  2 +-
 include/migration/vmstate.h  |  2 --
 kvm-all.c                    |  4 ---
 libcacard/Makefile           |  2 ++
 linux-user/main.c            | 64 ++++++++++++++++++++++----------------------
 linux-user/syscall.c         |  9 ++++++-
 linux-user/syscall_defs.h    |  9 ++++++-
 migration/rdma.c             | 11 +++-----
 qemu-log.c                   |  2 +-
 qjson.c                      |  2 +-
 scripts/analyze-migration.py |  2 +-
 spice-qemu-char.c            |  2 +-
 stubs/qtest.c                |  2 +-
 target-mips/translate.c      |  4 +++
 target-moxie/machine.c       |  1 +
 trace-events                 | 41 ++++++++++++++++++++++++++++
 translate-all.c              |  2 +-
 ui/vnc.c                     |  4 ---
 util/aes.c                   |  2 +-
 util/qemu-option.c           |  8 +++---
 util/qemu-sockets.c          | 26 +++++++++++++-----
 util/uri.c                   | 61 +++++++++--------------------------------
 vl.c                         |  7 +++--
 39 files changed, 224 insertions(+), 218 deletions(-)

[Qemu-devel] [PULL 01/46] target-mips: Clean up switch fall through after commit fecd264

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Commit fecd264 added a number of fall-throughs, but neglected to
properly document them as intentional.  Commit d922445 cleaned that up
for many, but not all cases.  Take care of the remaining ones.

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target-mips/translate.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target-mips/translate.c b/target-mips/translate.c
index e9d86b2..1faeb5d 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -18729,6 +18729,7 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
     case OPC_SWL:
     case OPC_SWR:
         check_insn_opc_removed(ctx, ISA_MIPS32R6);
+        /* fall through */
     case OPC_SB ... OPC_SH:
     case OPC_SW:
          gen_st(ctx, op, rt, rs, imm);
@@ -18817,6 +18818,7 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
         case OPC_PS_FMT:
             check_cp1_enabled(ctx);
             check_insn_opc_removed(ctx, ISA_MIPS32R6);
+            /* fall through */
         case OPC_S_FMT:
         case OPC_D_FMT:
             check_cp1_enabled(ctx);
@@ -19000,6 +19002,7 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
     case OPC_LDL ... OPC_LDR:
     case OPC_LLD:
         check_insn_opc_removed(ctx, ISA_MIPS32R6);
+        /* fall through */
     case OPC_LWU:
     case OPC_LD:
         check_insn(ctx, ISA_MIPS3);
@@ -19008,6 +19011,7 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
         break;
     case OPC_SDL ... OPC_SDR:
         check_insn_opc_removed(ctx, ISA_MIPS32R6);
+        /* fall through */
     case OPC_SD:
         check_insn(ctx, ISA_MIPS3);
         check_mips_64(ctx);
-- 
2.1.4

[Qemu-devel] [PULL 02/46] fw_cfg: fix typos in comments: patch -> path

[Michael Tokarev]

From: Gonglei <arei.gonglei@huawei.com>

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/core/fw-path-provider.c | 2 +-
 hw/ppc/spapr.c             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/core/fw-path-provider.c b/hw/core/fw-path-provider.c
index 1290c3e..7442d32 100644
--- a/hw/core/fw-path-provider.c
+++ b/hw/core/fw-path-provider.c
@@ -1,5 +1,5 @@
 /*
- *  Firmware patch provider class and helpers.
+ *  Firmware path provider class and helpers.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index b560459..812d030 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1625,7 +1625,7 @@ static int spapr_kvm_type(const char *vm_type)
 }
 
 /*
- * Implementation of an interface to adjust firmware patch
+ * Implementation of an interface to adjust firmware path
  * for the bootindex property handling.
  */
 static char *spapr_get_fw_dev_path(FWPathProvider *p, BusState *bus,
-- 
2.1.4

[Qemu-devel] [PULL 03/46] Add tracing to xenfb.

[Michael Tokarev]

From: Don Koch <dkoch@verizon.com>

Signed-off-by: Don Koch <dkoch@verizon.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/display/xenfb.c | 5 +++++
 trace-events       | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 8a61e95..5e324ef 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -45,6 +45,8 @@
 #include <xen/io/kbdif.h>
 #include <xen/io/protocols.h>
 
+#include "trace.h"
+
 #ifndef BTN_LEFT
 #define BTN_LEFT 0x110 /* from <linux/input.h> */
 #endif
@@ -324,6 +326,8 @@ static void xenfb_mouse_event(void *opaque,
     int dh = surface_height(surface);
     int i;
 
+    trace_xenfb_mouse_event(opaque, dx, dy, dz, button_state,
+                            xenfb->abs_pointer_wanted);
     if (xenfb->abs_pointer_wanted)
 	xenfb_send_position(xenfb,
 			    dx * (dw - 1) / 0x7fff,
@@ -380,6 +384,7 @@ static void input_connected(struct XenDevice *xendev)
     if (in->qmouse) {
         qemu_remove_mouse_event_handler(in->qmouse);
     }
+    trace_xenfb_input_connected(xendev, in->abs_pointer_wanted);
     in->qmouse = qemu_add_mouse_event_handler(xenfb_mouse_event, in,
 					      in->abs_pointer_wanted,
 					      "Xen PVFB Mouse");
diff --git a/trace-events b/trace-events
index 57f357f..ce1bf60 100644
--- a/trace-events
+++ b/trace-events
@@ -203,6 +203,10 @@ hd_geometry_guess(void *blk, uint32_t cyls, uint32_t heads, uint32_t secs, int t
 jazz_led_read(uint64_t addr, uint8_t val) "read addr=0x%"PRIx64": 0x%x"
 jazz_led_write(uint64_t addr, uint8_t new) "write addr=0x%"PRIx64": 0x%x"
 
+# hw/display/xenfb.c
+xenfb_mouse_event(void *opaque, int dx, int dy, int dz, int button_state, int abs_pointer_wanted) "%p x %d y %d z %d bs %#x abs %d"
+xenfb_input_connected(void *xendev, int abs_pointer_wanted) "%p abs %d"
+
 # hw/net/lance.c
 lance_mem_readw(uint64_t addr, uint32_t ret) "addr=%"PRIx64"val=0x%04x"
 lance_mem_writew(uint64_t addr, uint32_t val) "addr=%"PRIx64"val=0x%04x"
-- 
2.1.4

[Qemu-devel] [PULL 04/46] Add trace to ps2.c.

[Michael Tokarev]

From: Don Koch <dkoch@verizon.com>

Signed-off-by: Don Koch <dkoch@verizon.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/input/ps2.c | 16 ++++++++++++++++
 trace-events   | 17 +++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index a466e25..4baeea2 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -27,6 +27,8 @@
 #include "ui/input.h"
 #include "sysemu/sysemu.h"
 
+#include "trace.h"
+
 /* debug PC keyboard */
 //#define DEBUG_KBD
 
@@ -158,6 +160,7 @@ static void ps2_put_keycode(void *opaque, int keycode)
 {
     PS2KbdState *s = opaque;
 
+    trace_ps2_put_keycode(opaque, keycode);
     qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER);
     /* XXX: add support for scancode set 1 */
     if (!s->translate && keycode < 0xe0 && s->scancode_set > 1) {
@@ -194,6 +197,7 @@ uint32_t ps2_read_data(void *opaque)
     PS2Queue *q;
     int val, index;
 
+    trace_ps2_read_data(opaque);
     q = &s->queue;
     if (q->count == 0) {
         /* NOTE: if no data left, we return the last keyboard one
@@ -218,12 +222,14 @@ uint32_t ps2_read_data(void *opaque)
 
 static void ps2_set_ledstate(PS2KbdState *s, int ledstate)
 {
+    trace_ps2_set_ledstate(s, ledstate);
     s->ledstate = ledstate;
     kbd_put_ledstate(ledstate);
 }
 
 static void ps2_reset_keyboard(PS2KbdState *s)
 {
+    trace_ps2_reset_keyboard(s);
     s->scan_enabled = 1;
     s->scancode_set = 2;
     ps2_set_ledstate(s, 0);
@@ -233,6 +239,7 @@ void ps2_write_keyboard(void *opaque, int val)
 {
     PS2KbdState *s = (PS2KbdState *)opaque;
 
+    trace_ps2_write_keyboard(opaque, val);
     switch(s->common.write_cmd) {
     default:
     case -1:
@@ -319,6 +326,7 @@ void ps2_write_keyboard(void *opaque, int val)
 void ps2_keyboard_set_translation(void *opaque, int mode)
 {
     PS2KbdState *s = (PS2KbdState *)opaque;
+    trace_ps2_keyboard_set_translation(opaque, mode);
     s->translate = mode;
 }
 
@@ -364,6 +372,7 @@ static void ps2_mouse_send_packet(PS2MouseState *s)
         break;
     }
 
+    trace_ps2_mouse_send_packet(s, dx1, dy1, dz1, b);
     /* update deltas */
     s->mouse_dx -= dx1;
     s->mouse_dy -= dy1;
@@ -433,6 +442,7 @@ static void ps2_mouse_sync(DeviceState *dev)
 void ps2_mouse_fake_event(void *opaque)
 {
     PS2MouseState *s = opaque;
+    trace_ps2_mouse_fake_event(opaque);
     s->mouse_dx++;
     ps2_mouse_sync(opaque);
 }
@@ -440,6 +450,8 @@ void ps2_mouse_fake_event(void *opaque)
 void ps2_write_mouse(void *opaque, int val)
 {
     PS2MouseState *s = (PS2MouseState *)opaque;
+
+    trace_ps2_write_mouse(opaque, val);
 #ifdef DEBUG_MOUSE
     printf("kbd: write mouse 0x%02x\n", val);
 #endif
@@ -606,6 +618,7 @@ static void ps2_kbd_reset(void *opaque)
 {
     PS2KbdState *s = (PS2KbdState *) opaque;
 
+    trace_ps2_kbd_reset(opaque);
     ps2_common_reset(&s->common);
     s->scan_enabled = 0;
     s->translate = 0;
@@ -616,6 +629,7 @@ static void ps2_mouse_reset(void *opaque)
 {
     PS2MouseState *s = (PS2MouseState *) opaque;
 
+    trace_ps2_mouse_reset(opaque);
     ps2_common_reset(&s->common);
     s->mouse_status = 0;
     s->mouse_resolution = 0;
@@ -763,6 +777,7 @@ void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg)
 {
     PS2KbdState *s = (PS2KbdState *)g_malloc0(sizeof(PS2KbdState));
 
+    trace_ps2_kbd_init(s);
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
     s->scancode_set = 2;
@@ -784,6 +799,7 @@ void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg)
 {
     PS2MouseState *s = (PS2MouseState *)g_malloc0(sizeof(PS2MouseState));
 
+    trace_ps2_mouse_init(s);
     s->common.update_irq = update_irq;
     s->common.update_arg = update_arg;
     vmstate_register(NULL, 0, &vmstate_ps2_mouse, s);
diff --git a/trace-events b/trace-events
index ce1bf60..61c8a9a 100644
--- a/trace-events
+++ b/trace-events
@@ -225,6 +225,23 @@ slavio_check_interrupts(uint32_t pending, uint32_t intregm_disabled) "pending %x
 slavio_set_irq(uint32_t target_cpu, int irq, uint32_t pil, int level) "Set cpu %d irq %d -> pil %d level %d"
 slavio_set_timer_irq_cpu(int cpu, int level) "Set cpu %d local timer level %d"
 
+# hw/input/ps2.c
+ps2_put_keycode(void *opaque, int keycode) "%p keycode %d"
+ps2_read_data(void *opaque) "%p"
+ps2_set_ledstate(void *s, int ledstate) "%p ledstate %d"
+ps2_reset_keyboard(void *s) "%p"
+ps2_write_keyboard(void *opaque, int val) "%p val %d"
+ps2_keyboard_set_translation(void *opaque, int mode) "%p mode %d"
+ps2_mouse_send_packet(void *s, int dx1, int dy1, int dz1, int b) "%p x %d y %d z %d bs %#x"
+ps2_mouse_event_disabled(void *opaque, int dx, int dy, int dz, int buttons_state, int mouse_dx, int mouse_dy, int mouse_dz) "%p x %d y %d z %d bs %#x mx %d my %d mz %d "
+ps2_mouse_event(void *opaque, int dx, int dy, int dz, int buttons_state, int mouse_dx, int mouse_dy, int mouse_dz) "%p x %d y %d z %d bs %#x mx %d my %d mz %d "
+ps2_mouse_fake_event(void *opaque) "%p"
+ps2_write_mouse(void *opaque, int val) "%p val %d"
+ps2_kbd_reset(void *opaque) "%p"
+ps2_mouse_reset(void *opaque) "%p"
+ps2_kbd_init(void *s) "%p"
+ps2_mouse_init(void *s) "%p"
+
 # hw/misc/slavio_misc.c
 slavio_misc_update_irq_raise(void) "Raise IRQ"
 slavio_misc_update_irq_lower(void) "Lower IRQ"
-- 
2.1.4

[Qemu-devel] [PULL 05/46] Add/convert trace calls in pcnet-pci.c.

[Michael Tokarev]

From: Don Koch <dkoch@verizon.com>

Add trace calls. Convert some #ifdef DEBUG printfs to trace.

Signed-off-by: Don Koch <dkoch@verizon.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/net/pcnet-pci.c | 49 +++++++++++++++++++------------------------------
 trace-events       | 12 ++++++++++++
 2 files changed, 31 insertions(+), 30 deletions(-)

diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index b86bc0d..5df79f0 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -33,6 +33,7 @@
 #include "qemu/timer.h"
 #include "sysemu/dma.h"
 #include "sysemu/sysemu.h"
+#include "trace.h"
 
 #include "pcnet.h"
 
@@ -61,9 +62,8 @@ typedef struct {
 static void pcnet_aprom_writeb(void *opaque, uint32_t addr, uint32_t val)
 {
     PCNetState *s = opaque;
-#ifdef PCNET_DEBUG
-    printf("pcnet_aprom_writeb addr=0x%08x val=0x%02x\n", addr, val);
-#endif
+
+    trace_pcnet_aprom_writeb(opaque, addr, val);
     if (BCR_APROMWE(s)) {
         s->prom[addr & 15] = val;
     }
@@ -73,9 +73,8 @@ static uint32_t pcnet_aprom_readb(void *opaque, uint32_t addr)
 {
     PCNetState *s = opaque;
     uint32_t val = s->prom[addr & 15];
-#ifdef PCNET_DEBUG
-    printf("pcnet_aprom_readb addr=0x%08x val=0x%02x\n", addr, val);
-#endif
+
+    trace_pcnet_aprom_readb(opaque, addr, val);
     return val;
 }
 
@@ -84,6 +83,7 @@ static uint64_t pcnet_ioport_read(void *opaque, hwaddr addr,
 {
     PCNetState *d = opaque;
 
+    trace_pcnet_ioport_read(opaque, addr, size);
     if (addr < 0x10) {
         if (!BCR_DWIO(d) && size == 1) {
             return pcnet_aprom_readb(d, addr);
@@ -111,6 +111,7 @@ static void pcnet_ioport_write(void *opaque, hwaddr addr,
 {
     PCNetState *d = opaque;
 
+    trace_pcnet_ioport_write(opaque, addr, data, size);
     if (addr < 0x10) {
         if (!BCR_DWIO(d) && size == 1) {
             pcnet_aprom_writeb(d, addr, data);
@@ -141,10 +142,8 @@ static const MemoryRegionOps pcnet_io_ops = {
 static void pcnet_mmio_writeb(void *opaque, hwaddr addr, uint32_t val)
 {
     PCNetState *d = opaque;
-#ifdef PCNET_DEBUG_IO
-    printf("pcnet_mmio_writeb addr=0x" TARGET_FMT_plx" val=0x%02x\n", addr,
-           val);
-#endif
+
+    trace_pcnet_mmio_writeb(opaque, addr, val);
     if (!(addr & 0x10))
         pcnet_aprom_writeb(d, addr & 0x0f, val);
 }
@@ -153,22 +152,18 @@ static uint32_t pcnet_mmio_readb(void *opaque, hwaddr addr)
 {
     PCNetState *d = opaque;
     uint32_t val = -1;
+
     if (!(addr & 0x10))
         val = pcnet_aprom_readb(d, addr & 0x0f);
-#ifdef PCNET_DEBUG_IO
-    printf("pcnet_mmio_readb addr=0x" TARGET_FMT_plx " val=0x%02x\n", addr,
-           val & 0xff);
-#endif
+    trace_pcnet_mmio_readb(opaque, addr, val);
     return val;
 }
 
 static void pcnet_mmio_writew(void *opaque, hwaddr addr, uint32_t val)
 {
     PCNetState *d = opaque;
-#ifdef PCNET_DEBUG_IO
-    printf("pcnet_mmio_writew addr=0x" TARGET_FMT_plx " val=0x%04x\n", addr,
-           val);
-#endif
+
+    trace_pcnet_mmio_writew(opaque, addr, val);
     if (addr & 0x10)
         pcnet_ioport_writew(d, addr & 0x0f, val);
     else {
@@ -182,6 +177,7 @@ static uint32_t pcnet_mmio_readw(void *opaque, hwaddr addr)
 {
     PCNetState *d = opaque;
     uint32_t val = -1;
+
     if (addr & 0x10)
         val = pcnet_ioport_readw(d, addr & 0x0f);
     else {
@@ -190,20 +186,15 @@ static uint32_t pcnet_mmio_readw(void *opaque, hwaddr addr)
         val <<= 8;
         val |= pcnet_aprom_readb(d, addr);
     }
-#ifdef PCNET_DEBUG_IO
-    printf("pcnet_mmio_readw addr=0x" TARGET_FMT_plx" val = 0x%04x\n", addr,
-           val & 0xffff);
-#endif
+    trace_pcnet_mmio_readw(opaque, addr, val);
     return val;
 }
 
 static void pcnet_mmio_writel(void *opaque, hwaddr addr, uint32_t val)
 {
     PCNetState *d = opaque;
-#ifdef PCNET_DEBUG_IO
-    printf("pcnet_mmio_writel addr=0x" TARGET_FMT_plx" val=0x%08x\n", addr,
-           val);
-#endif
+
+    trace_pcnet_mmio_writel(opaque, addr, val);
     if (addr & 0x10)
         pcnet_ioport_writel(d, addr & 0x0f, val);
     else {
@@ -219,6 +210,7 @@ static uint32_t pcnet_mmio_readl(void *opaque, hwaddr addr)
 {
     PCNetState *d = opaque;
     uint32_t val;
+
     if (addr & 0x10)
         val = pcnet_ioport_readl(d, addr & 0x0f);
     else {
@@ -231,10 +223,7 @@ static uint32_t pcnet_mmio_readl(void *opaque, hwaddr addr)
         val <<= 8;
         val |= pcnet_aprom_readb(d, addr);
     }
-#ifdef PCNET_DEBUG_IO
-    printf("pcnet_mmio_readl addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr,
-           val);
-#endif
+    trace_pcnet_mmio_readl(opaque, addr, val);
     return val;
 }
 
diff --git a/trace-events b/trace-events
index 61c8a9a..ae537f7 100644
--- a/trace-events
+++ b/trace-events
@@ -1282,6 +1282,18 @@ spapr_pci_msi_retry(unsigned config_addr, unsigned req_num, unsigned max_irqs) "
 pci_update_mappings_del(void *d, uint32_t bus, uint32_t func, uint32_t slot, int bar, uint64_t addr, uint64_t size) "d=%p %02x:%02x.%x %d,%#"PRIx64"+%#"PRIx64
 pci_update_mappings_add(void *d, uint32_t bus, uint32_t func, uint32_t slot, int bar, uint64_t addr, uint64_t size) "d=%p %02x:%02x.%x %d,%#"PRIx64"+%#"PRIx64
 
+# hw/net/pcnet-pci.c
+pcnet_aprom_writeb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
+pcnet_aprom_readb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
+pcnet_ioport_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=%#"PRIx64" size=%d"
+pcnet_ioport_write(void *opaque, uint64_t addr, uint64_t data, unsigned size) "opaque=%p addr=%#"PRIx64" data=%#"PRIx64" size=%d"
+pcnet_mmio_writeb(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=%#"PRIx64" val=0x%x"
+pcnet_mmio_writew(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=%#"PRIx64" val=0x%x"
+pcnet_mmio_writel(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=%#"PRIx64" val=0x%x"
+pcnet_mmio_readb(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=%#"PRIx64" val=0x%x"
+pcnet_mmio_readw(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=%#"PRIx64" val=0x%x"
+pcnet_mmio_readl(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=%#"PRIx64" val=0x%x"
+
 # hw/intc/xics.c
 xics_icp_check_ipi(int server, uint8_t mfrr) "CPU %d can take IPI mfrr=%#x"
 xics_icp_accept(uint32_t old_xirr, uint32_t new_xirr) "icp_accept: XIRR %#"PRIx32"->%#"PRIx32
-- 
2.1.4

[Qemu-devel] [PULL 06/46] Convert some debugging printfs to trace calls in pcnet.c.

[Michael Tokarev]

From: Don Koch <dkoch@verizon.com>

Signed-off-by: Don Koch <dkoch@verizon.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/net/pcnet.c | 28 ++++++++--------------------
 trace-events   |  8 ++++++++
 2 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index 8486b80..7778b9a 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -40,6 +40,7 @@
 #include "qemu/timer.h"
 #include "qemu/sockets.h"
 #include "sysemu/sysemu.h"
+#include "trace.h"
 
 #include "pcnet.h"
 
@@ -685,9 +686,7 @@ static void pcnet_bcr_writew(PCNetState *s, uint32_t rap, uint32_t val);
 
 static void pcnet_s_reset(PCNetState *s)
 {
-#ifdef PCNET_DEBUG
-    printf("pcnet_s_reset\n");
-#endif
+    trace_pcnet_s_reset(s);
 
     s->rdra = 0;
     s->tdra = 0;
@@ -760,9 +759,7 @@ static void pcnet_update_irq(PCNetState *s)
         s->csr[4] |= 0x0040;
         s->csr[0] |= 0x0080;
         isr = 1;
-#ifdef PCNET_DEBUG
-        printf("pcnet user int\n");
-#endif
+        trace_pcnet_user_int(s);
     }
 
 #if 1
@@ -777,9 +774,7 @@ static void pcnet_update_irq(PCNetState *s)
     }
 
     if (isr != s->isr) {
-#ifdef PCNET_DEBUG
-        printf("pcnet: INTA=%d\n", isr);
-#endif
+        trace_pcnet_isr_change(s, isr, s->isr);
     }
     qemu_set_irq(s->irq, isr);
     s->isr = isr;
@@ -791,9 +786,7 @@ static void pcnet_init(PCNetState *s)
     uint16_t padr[3], ladrf[4], mode;
     uint32_t rdra, tdra;
 
-#ifdef PCNET_DEBUG
-    printf("pcnet_init init_addr=0x%08x\n", PHYSADDR(s,CSR_IADR(s)));
-#endif
+    trace_pcnet_init(s, PHYSADDR(s, CSR_IADR(s)));
 
     if (BCR_SSIZE32(s)) {
         struct pcnet_initblk32 initblk;
@@ -831,9 +824,7 @@ static void pcnet_init(PCNetState *s)
         tdra &= 0x00ffffff;
     }
 
-#if defined(PCNET_DEBUG)
-    printf("rlen=%d tlen=%d\n", rlen, tlen);
-#endif
+    trace_pcnet_rlen_tlen(s, rlen, tlen);
 
     CSR_RCVRL(s) = (rlen < 9) ? (1 << rlen) : 512;
     CSR_XMTRL(s) = (tlen < 9) ? (1 << tlen) : 512;
@@ -852,11 +843,8 @@ static void pcnet_init(PCNetState *s)
     CSR_RCVRC(s) = CSR_RCVRL(s);
     CSR_XMTRC(s) = CSR_XMTRL(s);
 
-#ifdef PCNET_DEBUG
-    printf("pcnet ss32=%d rdra=0x%08x[%d] tdra=0x%08x[%d]\n",
-        BCR_SSIZE32(s),
-        s->rdra, CSR_RCVRL(s), s->tdra, CSR_XMTRL(s));
-#endif
+    trace_pcnet_ss32_rdra_tdra(s, BCR_SSIZE32(s),
+                               s->rdra, CSR_RCVRL(s), s->tdra, CSR_XMTRL(s));
 
     s->csr[0] |= 0x0101;
     s->csr[0] &= ~0x0004;       /* clear STOP bit */
diff --git a/trace-events b/trace-events
index ae537f7..f87b077 100644
--- a/trace-events
+++ b/trace-events
@@ -1282,6 +1282,14 @@ spapr_pci_msi_retry(unsigned config_addr, unsigned req_num, unsigned max_irqs) "
 pci_update_mappings_del(void *d, uint32_t bus, uint32_t func, uint32_t slot, int bar, uint64_t addr, uint64_t size) "d=%p %02x:%02x.%x %d,%#"PRIx64"+%#"PRIx64
 pci_update_mappings_add(void *d, uint32_t bus, uint32_t func, uint32_t slot, int bar, uint64_t addr, uint64_t size) "d=%p %02x:%02x.%x %d,%#"PRIx64"+%#"PRIx64
 
+# hw/net/pcnet.c
+pcnet_s_reset(void *s) "s=%p"
+pcnet_user_int(void *s) "s=%p"
+pcnet_isr_change(void *s, uint32_t isr, uint32_t isr_old) "s=%p INTA=%d<=%d"
+pcnet_init(void *s, uint64_t init_addr) "s=%p init_addr=%#"PRIx64
+pcnet_rlen_tlen(void *s, uint32_t rlen, uint32_t tlen) "s=%p rlen=%d tlen=%d"
+pcnet_ss32_rdra_tdra(void *s, uint32_t ss32, uint32_t rdra, uint32_t rcvrl, uint32_t tdra, uint32_t xmtrl) "s=%p ss32=%d rdra=0x%08x[%d] tdra=0x%08x[%d]"
+
 # hw/net/pcnet-pci.c
 pcnet_aprom_writeb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
 pcnet_aprom_readb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
-- 
2.1.4

[Qemu-devel] [PULL 07/46] vl: Fix bogus error message for implied mon ID clashing

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

monitor_parse() desugars --monitor, --qmp and -qmp-pretty to --mon.
The ID it picks can clash with a user-specified ID.  When it happens,
the error message is misleading.

Reproducer:

    $ qemu --mon id=compat_monitor0 --monitor stdio

Message before the patch:

    duplicate chardev: compat_monitor0

There's no "duplicate chardev" here.  The problem is a duplicate
monitor ID.  Moreover, the message provides no clue which option
caused the problem.  The patch changes the message to:

    qemu: --monitor stdio: Duplicate ID 'compat_monitor0' for mon

monitor_parse() is also used for creating a default monitor, but
that's not done when the user specifies a monitor, so an ID clash is
impossible then.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 vl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/vl.c b/vl.c
index 983259b..2573afd 100644
--- a/vl.c
+++ b/vl.c
@@ -2195,6 +2195,7 @@ static int mon_init_func(QemuOpts *opts, void *opaque)
 static void monitor_parse(const char *optarg, const char *mode, bool pretty)
 {
     static int monitor_device_index = 0;
+    Error *local_err = NULL;
     QemuOpts *opts;
     const char *p;
     char label[32];
@@ -2215,9 +2216,10 @@ static void monitor_parse(const char *optarg, const char *mode, bool pretty)
         }
     }
 
-    opts = qemu_opts_create(qemu_find_opts("mon"), label, 1, NULL);
+    opts = qemu_opts_create(qemu_find_opts("mon"), label, 1, &local_err);
     if (!opts) {
-        fprintf(stderr, "duplicate chardev: %s\n", label);
+        error_report("%s", error_get_pretty(local_err));
+        error_free(local_err);
         exit(1);
     }
     qemu_opt_set(opts, "mode", mode);
-- 
2.1.4

[Qemu-devel] [PULL 08/46] virtfs-proxy-helper: Fix possible socket leak.

[Michael Tokarev]

From: Gonglei <arei.gonglei@huawei.com>

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 fsdev/virtfs-proxy-helper.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
index cd291d3..c1da2d7 100644
--- a/fsdev/virtfs-proxy-helper.c
+++ b/fsdev/virtfs-proxy-helper.c
@@ -749,24 +749,29 @@ static int proxy_socket(const char *path, uid_t uid, gid_t gid)
     if (bind(sock, (struct sockaddr *)&proxy,
             sizeof(struct sockaddr_un)) < 0) {
         do_perror("bind");
-        return -1;
+        goto error;
     }
     if (chown(proxy.sun_path, uid, gid) < 0) {
         do_perror("chown");
-        return -1;
+        goto error;
     }
     if (listen(sock, 1) < 0) {
         do_perror("listen");
-        return -1;
+        goto error;
     }
 
     size = sizeof(qemu);
     client = accept(sock, (struct sockaddr *)&qemu, &size);
     if (client < 0) {
         do_perror("accept");
-        return -1;
+        goto error;
     }
+    close(sock);
     return client;
+
+error:
+    close(sock);
+    return -1;
 }
 
 static void usage(char *prog)
-- 
2.1.4

[Qemu-devel] [PULL 09/46] linux-user/syscall.c: lock_iovec: unlock vec[i] in failure processing code block

[Michael Tokarev]

From: Chen Gang S <gang.chen@sunrus.com.cn>

When failure occurs during locking of vec[i], we also need to unlock all
already locked vec[i] in failure processing code block before return.

Code in unlock_user() checks vec[i].iov_base for NULL, so there's no
need not check it .

If error is EFAULT when "i == 0", vec[i].iov_base is NULL, we can just
skip it, so can still use "while (--i >= 0)" loop condition.

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/syscall.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index d4398b9..7b6f482 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -1883,6 +1883,11 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr,
     return vec;
 
  fail:
+    while (--i >= 0) {
+        if (tswapal(target_vec[i].iov_len) > 0) {
+            unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
+        }
+    }
     unlock_user(target_vec, target_addr, 0);
  fail2:
     free(vec);
-- 
2.1.4

[Qemu-devel] [PULL 10/46] linux-user/syscall.c: Fix typo issue for using target_vec[i].iov_len instead of target_vec[i].iov_base

[Michael Tokarev]

From: Chen Gang S <gang.chen@sunrus.com.cn>

It is only a typo issue, need use tswapal(target_vec[i].iov_len) for the
len.

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/syscall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 7b6f482..310080c 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -1906,7 +1906,7 @@ static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
     if (target_vec) {
         for (i = 0; i < count; i++) {
             abi_ulong base = tswapal(target_vec[i].iov_base);
-            abi_long len = tswapal(target_vec[i].iov_base);
+            abi_long len = tswapal(target_vec[i].iov_len);
             if (len < 0) {
                 break;
             }
-- 
2.1.4

[Qemu-devel] [PULL 11/46] linux-user/main.c: Use TARGET_SIG* instead of SIG*

[Michael Tokarev]

From: Chen Gang S <gang.chen@sunrus.com.cn>

In main.c, all SIG* should be TARGET_SIG*, since the relevant functions
(queue_signal() and gdb_handlesig()) expect TARGET_SIG*.

The corresponding vi command is "1,$ s/\<SIG/TARGET_SIG/g".

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/main.c | 64 +++++++++++++++++++++++++++----------------------------
 1 file changed, 32 insertions(+), 32 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index cfa7d07..d92702a 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -315,7 +315,7 @@ void cpu_loop(CPUX86State *env)
 #endif
         case EXCP0B_NOSEG:
         case EXCP0C_STACK:
-            info.si_signo = SIGBUS;
+            info.si_signo = TARGET_SIGBUS;
             info.si_errno = 0;
             info.si_code = TARGET_SI_KERNEL;
             info._sifields._sigfault._addr = 0;
@@ -329,7 +329,7 @@ void cpu_loop(CPUX86State *env)
             } else
 #endif
             {
-                info.si_signo = SIGSEGV;
+                info.si_signo = TARGET_SIGSEGV;
                 info.si_errno = 0;
                 info.si_code = TARGET_SI_KERNEL;
                 info._sifields._sigfault._addr = 0;
@@ -337,7 +337,7 @@ void cpu_loop(CPUX86State *env)
             }
             break;
         case EXCP0E_PAGE:
-            info.si_signo = SIGSEGV;
+            info.si_signo = TARGET_SIGSEGV;
             info.si_errno = 0;
             if (!(env->error_code & 1))
                 info.si_code = TARGET_SEGV_MAPERR;
@@ -354,7 +354,7 @@ void cpu_loop(CPUX86State *env)
 #endif
             {
                 /* division by zero */
-                info.si_signo = SIGFPE;
+                info.si_signo = TARGET_SIGFPE;
                 info.si_errno = 0;
                 info.si_code = TARGET_FPE_INTDIV;
                 info._sifields._sigfault._addr = env->eip;
@@ -369,7 +369,7 @@ void cpu_loop(CPUX86State *env)
             } else
 #endif
             {
-                info.si_signo = SIGTRAP;
+                info.si_signo = TARGET_SIGTRAP;
                 info.si_errno = 0;
                 if (trapnr == EXCP01_DB) {
                     info.si_code = TARGET_TRAP_BRKPT;
@@ -389,7 +389,7 @@ void cpu_loop(CPUX86State *env)
             } else
 #endif
             {
-                info.si_signo = SIGSEGV;
+                info.si_signo = TARGET_SIGSEGV;
                 info.si_errno = 0;
                 info.si_code = TARGET_SI_KERNEL;
                 info._sifields._sigfault._addr = 0;
@@ -397,7 +397,7 @@ void cpu_loop(CPUX86State *env)
             }
             break;
         case EXCP06_ILLOP:
-            info.si_signo = SIGILL;
+            info.si_signo = TARGET_SIGILL;
             info.si_errno = 0;
             info.si_code = TARGET_ILL_ILLOPN;
             info._sifields._sigfault._addr = env->eip;
@@ -519,7 +519,7 @@ segv:
     end_exclusive();
     /* We get the PC of the entry address - which is as good as anything,
        on a real kernel what you get depends on which mode it uses. */
-    info.si_signo = SIGSEGV;
+    info.si_signo = TARGET_SIGSEGV;
     info.si_errno = 0;
     /* XXX: check env->error_code */
     info.si_code = TARGET_SEGV_MAPERR;
@@ -696,7 +696,7 @@ void cpu_loop(CPUARMState *env)
 
                 rc = EmulateAll(opcode, &ts->fpa, env);
                 if (rc == 0) { /* illegal instruction */
-                    info.si_signo = SIGILL;
+                    info.si_signo = TARGET_SIGILL;
                     info.si_errno = 0;
                     info.si_code = TARGET_ILL_ILLOPN;
                     info._sifields._sigfault._addr = env->regs[15];
@@ -720,7 +720,7 @@ void cpu_loop(CPUARMState *env)
                     //printf("fpsr 0x%x, arm_fpe 0x%x\n",fpsr,arm_fpe);
 
                     if (fpsr & (arm_fpe << 16)) { /* exception enabled? */
-                      info.si_signo = SIGFPE;
+                      info.si_signo = TARGET_SIGFPE;
                       info.si_errno = 0;
 
                       /* ordered by priority, least first */
@@ -844,7 +844,7 @@ void cpu_loop(CPUARMState *env)
         case EXCP_DATA_ABORT:
             addr = env->exception.vaddress;
             {
-                info.si_signo = SIGSEGV;
+                info.si_signo = TARGET_SIGSEGV;
                 info.si_errno = 0;
                 /* XXX: check env->error_code */
                 info.si_code = TARGET_SEGV_MAPERR;
@@ -1030,7 +1030,7 @@ void cpu_loop(CPUARMState *env)
             /* just indicate that signals should be handled asap */
             break;
         case EXCP_UDEF:
-            info.si_signo = SIGILL;
+            info.si_signo = TARGET_SIGILL;
             info.si_errno = 0;
             info.si_code = TARGET_ILL_ILLOPN;
             info._sifields._sigfault._addr = env->pc;
@@ -1043,7 +1043,7 @@ void cpu_loop(CPUARMState *env)
             /* fall through for segv */
         case EXCP_PREFETCH_ABORT:
         case EXCP_DATA_ABORT:
-            info.si_signo = SIGSEGV;
+            info.si_signo = TARGET_SIGSEGV;
             info.si_errno = 0;
             /* XXX: check env->error_code */
             info.si_code = TARGET_SEGV_MAPERR;
@@ -1123,7 +1123,7 @@ void cpu_loop(CPUUniCore32State *env)
             break;
         case UC32_EXCP_DTRAP:
         case UC32_EXCP_ITRAP:
-            info.si_signo = SIGSEGV;
+            info.si_signo = TARGET_SIGSEGV;
             info.si_errno = 0;
             /* XXX: check env->error_code */
             info.si_code = TARGET_SEGV_MAPERR;
@@ -2672,7 +2672,7 @@ void cpu_loop(CPUOpenRISCState *env)
             break;
         case EXCP_BUSERR:
             qemu_log("\nBus error, exit, pc is %#x\n", env->pc);
-            gdbsig = SIGBUS;
+            gdbsig = TARGET_SIGBUS;
             break;
         case EXCP_DPF:
         case EXCP_IPF:
@@ -2684,11 +2684,11 @@ void cpu_loop(CPUOpenRISCState *env)
             break;
         case EXCP_ALIGN:
             qemu_log("\nAlignment pc is %#x\n", env->pc);
-            gdbsig = SIGBUS;
+            gdbsig = TARGET_SIGBUS;
             break;
         case EXCP_ILLEGAL:
             qemu_log("\nIllegal instructionpc is %#x\n", env->pc);
-            gdbsig = SIGILL;
+            gdbsig = TARGET_SIGILL;
             break;
         case EXCP_INT:
             qemu_log("\nExternal interruptpc is %#x\n", env->pc);
@@ -2699,7 +2699,7 @@ void cpu_loop(CPUOpenRISCState *env)
             break;
         case EXCP_RANGE:
             qemu_log("\nRange\n");
-            gdbsig = SIGSEGV;
+            gdbsig = TARGET_SIGSEGV;
             break;
         case EXCP_SYSCALL:
             env->pc += 4;   /* 0xc00; */
@@ -2717,7 +2717,7 @@ void cpu_loop(CPUOpenRISCState *env)
             break;
         case EXCP_TRAP:
             qemu_log("\nTrap\n");
-            gdbsig = SIGTRAP;
+            gdbsig = TARGET_SIGTRAP;
             break;
         case EXCP_NR:
             qemu_log("\nNR\n");
@@ -2787,7 +2787,7 @@ void cpu_loop(CPUSH4State *env)
             break;
 	case 0xa0:
 	case 0xc0:
-            info.si_signo = SIGSEGV;
+            info.si_signo = TARGET_SIGSEGV;
             info.si_errno = 0;
             info.si_code = TARGET_SEGV_MAPERR;
             info._sifields._sigfault._addr = env->tea;
@@ -2818,7 +2818,7 @@ void cpu_loop(CPUCRISState *env)
         switch (trapnr) {
         case 0xaa:
             {
-                info.si_signo = SIGSEGV;
+                info.si_signo = TARGET_SIGSEGV;
                 info.si_errno = 0;
                 /* XXX: check env->error_code */
                 info.si_code = TARGET_SEGV_MAPERR;
@@ -2879,7 +2879,7 @@ void cpu_loop(CPUMBState *env)
         switch (trapnr) {
         case 0xaa:
             {
-                info.si_signo = SIGSEGV;
+                info.si_signo = TARGET_SIGSEGV;
                 info.si_errno = 0;
                 /* XXX: check env->error_code */
                 info.si_code = TARGET_SEGV_MAPERR;
@@ -2917,14 +2917,14 @@ void cpu_loop(CPUMBState *env)
 
             switch (env->sregs[SR_ESR] & 31) {
                 case ESR_EC_DIVZERO:
-                    info.si_signo = SIGFPE;
+                    info.si_signo = TARGET_SIGFPE;
                     info.si_errno = 0;
                     info.si_code = TARGET_FPE_FLTDIV;
                     info._sifields._sigfault._addr = 0;
                     queue_signal(env, info.si_signo, &info);
                     break;
                 case ESR_EC_FPU:
-                    info.si_signo = SIGFPE;
+                    info.si_signo = TARGET_SIGFPE;
                     info.si_errno = 0;
                     if (env->sregs[SR_FSR] & FSR_IO) {
                         info.si_code = TARGET_FPE_FLTINV;
@@ -3003,7 +3003,7 @@ void cpu_loop(CPUM68KState *env)
         case EXCP_LINEF:
         case EXCP_UNSUPPORTED:
         do_sigill:
-            info.si_signo = SIGILL;
+            info.si_signo = TARGET_SIGILL;
             info.si_errno = 0;
             info.si_code = TARGET_ILL_ILLOPN;
             info._sifields._sigfault._addr = env->pc;
@@ -3030,7 +3030,7 @@ void cpu_loop(CPUM68KState *env)
             break;
         case EXCP_ACCESS:
             {
-                info.si_signo = SIGSEGV;
+                info.si_signo = TARGET_SIGSEGV;
                 info.si_errno = 0;
                 /* XXX: check env->error_code */
                 info.si_code = TARGET_SEGV_MAPERR;
@@ -3337,12 +3337,12 @@ void cpu_loop(CPUS390XState *env)
             switch (n) {
             case PGM_OPERATION:
             case PGM_PRIVILEGED:
-                sig = SIGILL;
+                sig = TARGET_SIGILL;
                 n = TARGET_ILL_ILLOPC;
                 goto do_signal_pc;
             case PGM_PROTECTION:
             case PGM_ADDRESSING:
-                sig = SIGSEGV;
+                sig = TARGET_SIGSEGV;
                 /* XXX: check env->error_code */
                 n = TARGET_SEGV_MAPERR;
                 addr = env->__excp_addr;
@@ -3352,16 +3352,16 @@ void cpu_loop(CPUS390XState *env)
             case PGM_SPECIAL_OP:
             case PGM_OPERAND:
             do_sigill_opn:
-                sig = SIGILL;
+                sig = TARGET_SIGILL;
                 n = TARGET_ILL_ILLOPN;
                 goto do_signal_pc;
 
             case PGM_FIXPT_OVERFLOW:
-                sig = SIGFPE;
+                sig = TARGET_SIGFPE;
                 n = TARGET_FPE_INTOVF;
                 goto do_signal_pc;
             case PGM_FIXPT_DIVIDE:
-                sig = SIGFPE;
+                sig = TARGET_SIGFPE;
                 n = TARGET_FPE_INTDIV;
                 goto do_signal_pc;
 
@@ -3386,7 +3386,7 @@ void cpu_loop(CPUS390XState *env)
                         /* ??? Quantum exception; BFP, DFP error.  */
                         goto do_sigill_opn;
                     }
-                    sig = SIGFPE;
+                    sig = TARGET_SIGFPE;
                     goto do_signal_pc;
                 }
 
-- 
2.1.4

[Qemu-devel] [PULL 12/46] linux-user/syscall.c: do_ioctl_dm: Need to call unlock_user() before going to failure return in default case

[Michael Tokarev]

From: Chen Gang S <gang.chen@sunrus.com.cn>

In abi_long do_ioctl_dm(), after lock_user() call, the code does
not call unlock_user() before going to failure return in default case.

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/syscall.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 310080c..5720195 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3576,6 +3576,7 @@ static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
     }
     default:
         ret = -TARGET_EINVAL;
+        unlock_user(argptr, guest_data, 0);
         goto out;
     }
     unlock_user(argptr, guest_data, 0);
@@ -3695,6 +3696,7 @@ static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
             break;
         }
         default:
+            unlock_user(argptr, guest_data, 0);
             ret = -TARGET_EINVAL;
             goto out;
         }
-- 
2.1.4

[Qemu-devel] [PULL 13/46] qemu-log: Correct help text of 'log cpu_reset'

[Michael Tokarev]

From: Thomas Huth <thuth@linux.vnet.ibm.com>

The logging of the CPU state during reset is done for all architectures
nowadays (see cpu_common_reset() in qom/cpu.c), so the "x86 only" text
does not apply here anymore.

Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qemu-log.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qemu-log.c b/qemu-log.c
index 05b5493..13f3813 100644
--- a/qemu-log.c
+++ b/qemu-log.c
@@ -111,7 +111,7 @@ const QEMULogItem qemu_log_items[] = {
     { CPU_LOG_PCALL, "pcall",
       "x86 only: show protected mode far calls/returns/exceptions" },
     { CPU_LOG_RESET, "cpu_reset",
-      "x86 only: show CPU state before CPU resets" },
+      "show CPU state before CPU resets" },
     { CPU_LOG_IOPORT, "ioport",
       "show all i/o ports accesses" },
     { LOG_UNIMP, "unimp",
-- 
2.1.4

[Qemu-devel] [PULL 14/46] cpu-exec: drop dead assignment

[Michael Tokarev]

From: Paolo Bonzini <pbonzini@redhat.com>

All uses of TB inside cpu_exec are dominated by "tb = tb_find_fast(env)",
and there are no uses after the switch statement.  So the assignment
is dead, as reported by Coverity.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 cpu-exec.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/cpu-exec.c b/cpu-exec.c
index fa506e6..4ff1b23 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -494,7 +494,6 @@ int cpu_exec(CPUArchState *env)
                          * interrupt_request) which we will handle
                          * next time around the loop.
                          */
-                        tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
                         next_tb = 0;
                         break;
                     case TB_EXIT_ICOUNT_EXPIRED:
-- 
2.1.4

[Qemu-devel] [PULL 15/46] cpu-exec: simplify icount code

[Michael Tokarev]

From: Paolo Bonzini <pbonzini@redhat.com>

Use MIN instead of an "if" statement.  Move "tb" assignment where
the value is actually used.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 cpu-exec.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/cpu-exec.c b/cpu-exec.c
index 4ff1b23..6738117 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -499,22 +499,17 @@ int cpu_exec(CPUArchState *env)
                     case TB_EXIT_ICOUNT_EXPIRED:
                     {
                         /* Instruction counter expired.  */
-                        int insns_left;
-                        tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
-                        insns_left = cpu->icount_decr.u32;
+                        int insns_left = cpu->icount_decr.u32;
                         if (cpu->icount_extra && insns_left >= 0) {
                             /* Refill decrementer and continue execution.  */
                             cpu->icount_extra += insns_left;
-                            if (cpu->icount_extra > 0xffff) {
-                                insns_left = 0xffff;
-                            } else {
-                                insns_left = cpu->icount_extra;
-                            }
+                            insns_left = MIN(0xffff, cpu->icount_extra);
                             cpu->icount_extra -= insns_left;
                             cpu->icount_decr.u16.low = insns_left;
                         } else {
                             if (insns_left > 0) {
                                 /* Execute remaining instructions.  */
+                                tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
                                 cpu_exec_nocache(env, insns_left, tb);
                                 align_clocks(&sc, cpu);
                             }
-- 
2.1.4

[Qemu-devel] [PULL 16/46] qemu-sockets: improve error reporting in unix_listen_opts

[Michael Tokarev]

From: Paolo Bonzini <pbonzini@redhat.com>

Coverity complains about not checking the returned value of mkstemp.  While
at it, also improve error checking for snprintf, and refine error messages
in general.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/qemu-sockets.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index a76bb3c..cf4b91f 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -694,7 +694,7 @@ int unix_listen_opts(QemuOpts *opts, Error **errp)
 
     sock = qemu_socket(PF_UNIX, SOCK_STREAM, 0);
     if (sock < 0) {
-        error_setg_errno(errp, errno, "Failed to create socket");
+        error_setg_errno(errp, errno, "Failed to create Unix socket");
         return -1;
     }
 
@@ -703,9 +703,15 @@ int unix_listen_opts(QemuOpts *opts, Error **errp)
     if (path && strlen(path)) {
         snprintf(un.sun_path, sizeof(un.sun_path), "%s", path);
     } else {
-        char *tmpdir = getenv("TMPDIR");
-        snprintf(un.sun_path, sizeof(un.sun_path), "%s/qemu-socket-XXXXXX",
-                 tmpdir ? tmpdir : "/tmp");
+        const char *tmpdir = getenv("TMPDIR");
+        tmpdir = tmpdir ? tmpdir : "/tmp";
+        if (snprintf(un.sun_path, sizeof(un.sun_path), "%s/qemu-socket-XXXXXX",
+                     tmpdir) >= sizeof(un.sun_path)) {
+            error_setg_errno(errp, errno,
+                             "TMPDIR environment variable (%s) too large", tmpdir);
+            goto err;
+        }
+
         /*
          * This dummy fd usage silences the mktemp() unsecure warning.
          * Using mkstemp() doesn't make things more secure here
@@ -713,13 +719,19 @@ int unix_listen_opts(QemuOpts *opts, Error **errp)
          * to unlink first and thus re-open the race window.  The
          * worst case possible is bind() failing, i.e. a DoS attack.
          */
-        fd = mkstemp(un.sun_path); close(fd);
+        fd = mkstemp(un.sun_path);
+        if (fd < 0) {
+            error_setg_errno(errp, errno,
+                             "Failed to make a temporary socket name in %s", tmpdir);
+            goto err;
+        }
+        close(fd);
         qemu_opt_set(opts, "path", un.sun_path);
     }
 
     unlink(un.sun_path);
     if (bind(sock, (struct sockaddr*) &un, sizeof(un)) < 0) {
-        error_setg_errno(errp, errno, "Failed to bind socket");
+        error_setg_errno(errp, errno, "Failed to bind socket to %s", un.sun_path);
         goto err;
     }
     if (listen(sock, 1) < 0) {
-- 
2.1.4

[Qemu-devel] [PULL 17/46] aes: remove a dead return statement

[Michael Tokarev]

From: Paolo Bonzini <pbonzini@redhat.com>

bits is checked to be 128, 192 or 256 at the beginning of the function.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/aes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/aes.c b/util/aes.c
index 6058f19..3d7c4be 100644
--- a/util/aes.c
+++ b/util/aes.c
@@ -1161,7 +1161,7 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 			rk += 8;
         	}
 	}
-	return 0;
+        abort();
 }
 
 /**
-- 
2.1.4

[Qemu-devel] [PULL 18/46] vl.c: fix memory leak spotted by valgrind

[Michael Tokarev]

From: Christian Borntraeger <borntraeger@de.ibm.com>

valgrind complains about:
==42062== 16 bytes in 1 blocks are definitely lost in loss record 387 of 1,048
==42062==    at 0x402DCB2: malloc (vg_replace_malloc.c:299)
==42062==    by 0x40C1BE3: g_malloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x40DA133: g_slice_alloc (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x40DB2E5: g_slist_prepend (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x801637FF: object_class_get_list_tramp (object.c:690)
==42062==    by 0x40A96C9: g_hash_table_foreach (in /usr/lib64/libglib-2.0.so.0.3800.2)
==42062==    by 0x80164885: object_class_foreach (object.c:665)
==42062==    by 0x80164975: object_class_get_list (object.c:698)
==42062==    by 0x800100A5: machine_parse (vl.c:2447)
==42062==    by 0x800100A5: main (vl.c:3756)

Lets free machines in case of mc.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 vl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/vl.c b/vl.c
index 2573afd..8c8f142 100644
--- a/vl.c
+++ b/vl.c
@@ -2452,6 +2452,7 @@ static gint machine_class_cmp(gconstpointer a, gconstpointer b)
         mc = find_machine(name);
     }
     if (mc) {
+        g_slist_free(machines);
         return mc;
     }
     if (name && !is_help_option(name)) {
-- 
2.1.4

[Qemu-devel] [PULL 19/46] qemu-sockets: Fix buffer overflow in inet_parse()

[Michael Tokarev]

From: Kevin Wolf <kwolf@redhat.com>

The size of the stack allocated host[] array didn't account for the
terminating '\0' byte that sscanf() writes. Fix the array size.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/qemu-sockets.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index cf4b91f..61fc3c1 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp)
 {
     InetSocketAddress *addr;
     const char *optstr, *h;
-    char host[64];
+    char host[65];
     char port[33];
     int to;
     int pos;
-- 
2.1.4

[Qemu-devel] [PULL 20/46] linux-user: wrong TARGET_SI_PAD_SIZE value for some targets.

[Michael Tokarev]

From: Maxim Ostapenko <m.ostapenko@partner.samsung.com>

Fix TARGET_SI_PAD_SIZE calculation to match the way the kernel does it.
Use different TARGET_SI_PREAMBLE_SIZE for 32-bit and 64-bit targets.

Signed-off-by: Maxim Ostapenko <m.ostapenko@partner.samsung.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/syscall_defs.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index ebb3be1..9ed6de8 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -655,7 +655,14 @@ typedef struct {
 #endif
 
 #define TARGET_SI_MAX_SIZE	128
-#define TARGET_SI_PAD_SIZE	((TARGET_SI_MAX_SIZE/sizeof(int)) - 3)
+
+#if TARGET_ABI_BITS == 32
+#define TARGET_SI_PREAMBLE_SIZE (3 * sizeof(int))
+#else
+#define TARGET_SI_PREAMBLE_SIZE (4 * sizeof(int))
+#endif
+
+#define TARGET_SI_PAD_SIZE ((TARGET_SI_MAX_SIZE - TARGET_SI_PREAMBLE_SIZE) / sizeof(int))
 
 typedef struct target_siginfo {
 #ifdef TARGET_MIPS
-- 
2.1.4

[Qemu-devel] [PULL 21/46] libcacard: stop linking against every single 3rd party library

[Michael Tokarev]

From: "Daniel P. Berrange" <berrange@redhat.com>

Building QEMU results in a libcacard.so that links against
practically the entire world

	linux-vdso.so.1 =>  (0x00007fff71e99000)
	libssl3.so => /usr/lib64/libssl3.so (0x00007f49f94b6000)
	libsmime3.so => /usr/lib64/libsmime3.so (0x00007f49f928e000)
	libnss3.so => /usr/lib64/libnss3.so (0x00007f49f8f67000)
	libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f49f8d3b000)
	libplds4.so => /usr/lib64/libplds4.so (0x00007f49f8b36000)
	libplc4.so => /usr/lib64/libplc4.so (0x00007f49f8931000)
	libnspr4.so => /usr/lib64/libnspr4.so (0x00007f49f86f2000)
	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f49f84ed000)
	libm.so.6 => /usr/lib64/libm.so.6 (0x00007f49f81e5000)
	libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f49f7fe3000)
	librt.so.1 => /usr/lib64/librt.so.1 (0x00007f49f7dda000)
	libz.so.1 => /usr/lib64/libz.so.1 (0x00007f49f7bc4000)
	libcap-ng.so.0 => /usr/lib64/libcap-ng.so.0 (0x00007f49f79be000)
	libuuid.so.1 => /usr/lib64/libuuid.so.1 (0x00007f49f77b8000)
	libgnutls.so.28 => /usr/lib64/libgnutls.so.28 (0x00007f49f749a000)
	libSDL-1.2.so.0 => /usr/lib64/libSDL-1.2.so.0 (0x00007f49f71fd000)
	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f49f6fe0000)
	libvte.so.9 => /usr/lib64/libvte.so.9 (0x00007f49f6d3f000)
	libXext.so.6 => /usr/lib64/libXext.so.6 (0x00007f49f6b2d000)
	libgtk-x11-2.0.so.0 => /usr/lib64/libgtk-x11-2.0.so.0 (0x00007f49f64a0000)
	libgdk-x11-2.0.so.0 => /usr/lib64/libgdk-x11-2.0.so.0 (0x00007f49f61de000)
	libpangocairo-1.0.so.0 => /usr/lib64/libpangocairo-1.0.so.0 (0x00007f49f5fd1000)
	libatk-1.0.so.0 => /usr/lib64/libatk-1.0.so.0 (0x00007f49f5daa000)
	libcairo.so.2 => /usr/lib64/libcairo.so.2 (0x00007f49f5a9d000)
	libgdk_pixbuf-2.0.so.0 => /usr/lib64/libgdk_pixbuf-2.0.so.0 (0x00007f49f5878000)
	libgio-2.0.so.0 => /usr/lib64/libgio-2.0.so.0 (0x00007f49f5500000)
	libpangoft2-1.0.so.0 => /usr/lib64/libpangoft2-1.0.so.0 (0x00007f49f52eb000)
	libpango-1.0.so.0 => /usr/lib64/libpango-1.0.so.0 (0x00007f49f50a0000)
	libgobject-2.0.so.0 => /usr/lib64/libgobject-2.0.so.0 (0x00007f49f4e4e000)
	libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f49f4b15000)
	libfontconfig.so.1 => /usr/lib64/libfontconfig.so.1 (0x00007f49f48d6000)
	libfreetype.so.6 => /usr/lib64/libfreetype.so.6 (0x00007f49f462b000)
	libX11.so.6 => /usr/lib64/libX11.so.6 (0x00007f49f42e8000)
	libxenstore.so.3.0 => /usr/lib64/libxenstore.so.3.0 (0x00007f49f40de000)
	libxenctrl.so.4.4 => /usr/lib64/libxenctrl.so.4.4 (0x00007f49f3eb6000)
	libxenguest.so.4.4 => /usr/lib64/libxenguest.so.4.4 (0x00007f49f3c8b000)
	libseccomp.so.2 => /usr/lib64/libseccomp.so.2 (0x00007f49f3a74000)
	librdmacm.so.1 => /usr/lib64/librdmacm.so.1 (0x00007f49f385d000)
	libibverbs.so.1 => /usr/lib64/libibverbs.so.1 (0x00007f49f364a000)
	libutil.so.1 => /usr/lib64/libutil.so.1 (0x00007f49f3447000)
	libc.so.6 => /usr/lib64/libc.so.6 (0x00007f49f3089000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f49f9902000)
	libp11-kit.so.0 => /usr/lib64/libp11-kit.so.0 (0x00007f49f2e23000)
	libtspi.so.1 => /usr/lib64/libtspi.so.1 (0x00007f49f2bb2000)
	libtasn1.so.6 => /usr/lib64/libtasn1.so.6 (0x00007f49f299f000)
	libnettle.so.4 => /usr/lib64/libnettle.so.4 (0x00007f49f276d000)
	libhogweed.so.2 => /usr/lib64/libhogweed.so.2 (0x00007f49f2545000)
	libgmp.so.10 => /usr/lib64/libgmp.so.10 (0x00007f49f22cd000)
	libncurses.so.5 => /usr/lib64/libncurses.so.5 (0x00007f49f20a5000)
	libtinfo.so.5 => /usr/lib64/libtinfo.so.5 (0x00007f49f1e7a000)
	libgmodule-2.0.so.0 => /usr/lib64/libgmodule-2.0.so.0 (0x00007f49f1c76000)
	libXfixes.so.3 => /usr/lib64/libXfixes.so.3 (0x00007f49f1a6f000)
	libXrender.so.1 => /usr/lib64/libXrender.so.1 (0x00007f49f1865000)
	libXinerama.so.1 => /usr/lib64/libXinerama.so.1 (0x00007f49f1662000)
	libXi.so.6 => /usr/lib64/libXi.so.6 (0x00007f49f1452000)
	libXrandr.so.2 => /usr/lib64/libXrandr.so.2 (0x00007f49f1247000)
	libXcursor.so.1 => /usr/lib64/libXcursor.so.1 (0x00007f49f103c000)
	libXcomposite.so.1 => /usr/lib64/libXcomposite.so.1 (0x00007f49f0e39000)
	libXdamage.so.1 => /usr/lib64/libXdamage.so.1 (0x00007f49f0c35000)
	libharfbuzz.so.0 => /usr/lib64/libharfbuzz.so.0 (0x00007f49f09dd000)
	libpixman-1.so.0 => /usr/lib64/libpixman-1.so.0 (0x00007f49f072f000)
	libEGL.so.1 => /usr/lib64/libEGL.so.1 (0x00007f49f0505000)
	libpng16.so.16 => /usr/lib64/libpng16.so.16 (0x00007f49f02d2000)
	libxcb-shm.so.0 => /usr/lib64/libxcb-shm.so.0 (0x00007f49f00cd000)
	libxcb-render.so.0 => /usr/lib64/libxcb-render.so.0 (0x00007f49efec3000)
	libxcb.so.1 => /usr/lib64/libxcb.so.1 (0x00007f49efca1000)
	libGL.so.1 => /usr/lib64/libGL.so.1 (0x00007f49efa06000)
	libffi.so.6 => /usr/lib64/libffi.so.6 (0x00007f49ef7fe000)
	libselinux.so.1 => /usr/lib64/libselinux.so.1 (0x00007f49ef5d8000)
	libresolv.so.2 => /usr/lib64/libresolv.so.2 (0x00007f49ef3be000)
	libexpat.so.1 => /usr/lib64/libexpat.so.1 (0x00007f49ef193000)
	libbz2.so.1 => /usr/lib64/libbz2.so.1 (0x00007f49eef83000)
	libgcc_s.so.1 => /usr/lib64/libgcc_s.so.1 (0x00007f49eed6c000)
	liblzma.so.5 => /usr/lib64/liblzma.so.5 (0x00007f49eeb46000)
	libnl-route-3.so.200 => /usr/lib64/libnl-route-3.so.200 (0x00007f49ee8e2000)
	libnl-3.so.200 => /usr/lib64/libnl-3.so.200 (0x00007f49ee6c4000)
	libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007f49ee2d6000)
	libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007f49ee067000)
	libgraphite2.so.3 => /usr/lib64/libgraphite2.so.3 (0x00007f49ede48000)
	libX11-xcb.so.1 => /usr/lib64/libX11-xcb.so.1 (0x00007f49edc46000)
	libxcb-dri2.so.0 => /usr/lib64/libxcb-dri2.so.0 (0x00007f49eda41000)
	libxcb-xfixes.so.0 => /usr/lib64/libxcb-xfixes.so.0 (0x00007f49ed838000)
	libxcb-shape.so.0 => /usr/lib64/libxcb-shape.so.0 (0x00007f49ed634000)
	libgbm.so.1 => /usr/lib64/libgbm.so.1 (0x00007f49ed426000)
	libwayland-client.so.0 => /usr/lib64/libwayland-client.so.0 (0x00007f49ed217000)
	libwayland-server.so.0 => /usr/lib64/libwayland-server.so.0 (0x00007f49ed005000)
	libglapi.so.0 => /usr/lib64/libglapi.so.0 (0x00007f49ecddb000)
	libdrm.so.2 => /usr/lib64/libdrm.so.2 (0x00007f49ecbce000)
	libXau.so.6 => /usr/lib64/libXau.so.6 (0x00007f49ec9ca000)
	libxcb-glx.so.0 => /usr/lib64/libxcb-glx.so.0 (0x00007f49ec7b0000)
	libxcb-dri3.so.0 => /usr/lib64/libxcb-dri3.so.0 (0x00007f49ec5ad000)
	libxcb-present.so.0 => /usr/lib64/libxcb-present.so.0 (0x00007f49ec3aa000)
	libxcb-randr.so.0 => /usr/lib64/libxcb-randr.so.0 (0x00007f49ec19b000)
	libxcb-sync.so.1 => /usr/lib64/libxcb-sync.so.1 (0x00007f49ebf94000)
	libxshmfence.so.1 => /usr/lib64/libxshmfence.so.1 (0x00007f49ebd91000)
	libXxf86vm.so.1 => /usr/lib64/libXxf86vm.so.1 (0x00007f49ebb8a000)
	libpcre.so.1 => /usr/lib64/libpcre.so.1 (0x00007f49eb91d000)
	libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x00007f49eb6cf000)
	libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x00007f49eb3ec000)
	libcom_err.so.2 => /usr/lib64/libcom_err.so.2 (0x00007f49eb1e8000)
	libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x00007f49eafb4000)
	libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 (0x00007f49eada5000)
	libkeyutils.so.1 => /usr/lib64/libkeyutils.so.1 (0x00007f49eaba0000)

All libcacard actually needs are the NSS libs. Linking against the entire
world is a regression caused by

  commit 9d171bd9375e4d08feff9adda15163e0811f5f42
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   Thu May 8 16:48:27 2014 +0400

    libcacard: remove libcacard-specific CFLAGS and LIBS from global vars

Which removed the setting of the LIBS variable in libcacard/Makefile.

Adding it back as an empty assignment brings the linked libs back to a more
reasonable set

	linux-vdso.so.1 =>  (0x00007fff575c1000)
	libssl3.so => /usr/lib64/libssl3.so (0x00007f7f753b1000)
	libsmime3.so => /usr/lib64/libsmime3.so (0x00007f7f75189000)
	libnss3.so => /usr/lib64/libnss3.so (0x00007f7f74e62000)
	libnssutil3.so => /usr/lib64/libnssutil3.so (0x00007f7f74c36000)
	libplds4.so => /usr/lib64/libplds4.so (0x00007f7f74a31000)
	libplc4.so => /usr/lib64/libplc4.so (0x00007f7f7482c000)
	libnspr4.so => /usr/lib64/libnspr4.so (0x00007f7f745ed000)
	libpthread.so.0 => /usr/lib64/libpthread.so.0 (0x00007f7f743d0000)
	libdl.so.2 => /usr/lib64/libdl.so.2 (0x00007f7f741cc000)
	libgthread-2.0.so.0 => /usr/lib64/libgthread-2.0.so.0 (0x00007f7f73fca000)
	libglib-2.0.so.0 => /usr/lib64/libglib-2.0.so.0 (0x00007f7f73c90000)
	libc.so.6 => /usr/lib64/libc.so.6 (0x00007f7f738d3000)
	libz.so.1 => /usr/lib64/libz.so.1 (0x00007f7f736bd000)
	librt.so.1 => /usr/lib64/librt.so.1 (0x00007f7f734b4000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f7f757fd000)

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Cc: <qemu-stable@nongnu.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 libcacard/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libcacard/Makefile b/libcacard/Makefile
index 0e7903f..b5eddff 100644
--- a/libcacard/Makefile
+++ b/libcacard/Makefile
@@ -19,6 +19,8 @@ vscclient$(EXESUF): libcacard/vscclient.o libcacard.la
 
 libcacard.la: LDFLAGS += -rpath $(libdir) -no-undefined \
 	-export-symbols $(SRC_PATH)/libcacard/libcacard.syms
+# Prevent libcacard.so linking against the entire world of 3rd party libs
+libcacard.la: LIBS =
 libcacard.la: $(libcacard-lobj-y)
 	$(call LINK,$^)
 
-- 
2.1.4

[Qemu-devel] [PULL 22/46] qemu-option: Replace pointless use of g_malloc0() by g_malloc()

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

get_opt_value() takes a write-only buffer, so zeroing it is pointless.
We don't do it elsewhere, either.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/qemu-option.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/util/qemu-option.c b/util/qemu-option.c
index a708241..c779150 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -213,7 +213,7 @@ void parse_option_size(const char *name, const char *value,
 bool has_help_option(const char *param)
 {
     size_t buflen = strlen(param) + 1;
-    char *buf = g_malloc0(buflen);
+    char *buf = g_malloc(buflen);
     const char *p = param;
     bool result = false;
 
@@ -237,7 +237,7 @@ out:
 bool is_valid_option_list(const char *param)
 {
     size_t buflen = strlen(param) + 1;
-    char *buf = g_malloc0(buflen);
+    char *buf = g_malloc(buflen);
     const char *p = param;
     bool result = true;
 
-- 
2.1.4

[Qemu-devel] [PULL 23/46] qemu-option: Pair g_malloc() with g_free(), not free()

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
and my "coverity: Model g_free() isn't necessarily free()" model patch
applied.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/qemu-option.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/util/qemu-option.c b/util/qemu-option.c
index c779150..d3ab65d 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -230,7 +230,7 @@ bool has_help_option(const char *param)
     }
 
 out:
-    free(buf);
+    g_free(buf);
     return result;
 }
 
@@ -255,7 +255,7 @@ bool is_valid_option_list(const char *param)
     }
 
 out:
-    free(buf);
+    g_free(buf);
     return result;
 }
 
-- 
2.1.4

[Qemu-devel] [PULL 24/46] spapr_vio: Pair g_malloc() with g_free(), not free()

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
and my "coverity: Model g_free() isn't necessarily free()" model patch
applied.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/ppc/spapr_vio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index dc9e46a..032ee1a 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -648,7 +648,7 @@ int spapr_populate_vdevice(VIOsPAPRBus *bus, void *fdt)
 
     ret = 0;
 out:
-    free(qdevs);
+    g_free(qdevs);
 
     return ret;
 }
-- 
2.1.4

[Qemu-devel] [PULL 25/46] usb: Pair g_malloc() with g_free(), not free()

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Spotted by Coverity with preview checker ALLOC_FREE_MISMATCH enabled
and my "coverity: Model g_free() isn't necessarily free()" model patch
applied.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/usb/desc-msos.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/desc-msos.c b/hw/usb/desc-msos.c
index 334d1ae..32c3600 100644
--- a/hw/usb/desc-msos.c
+++ b/hw/usb/desc-msos.c
@@ -231,7 +231,7 @@ int usb_desc_msos(const USBDesc *desc,  USBPacket *p,
         length = len;
     }
     memcpy(dest, buf, length);
-    free(buf);
+    g_free(buf);
 
     p->actual_length = length;
     return 0;
-- 
2.1.4

[Qemu-devel] [PULL 26/46] util/uri: uri_new() can't fail, drop dead error handling

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/uri.c | 36 +++++++++++-------------------------
 1 file changed, 11 insertions(+), 25 deletions(-)

diff --git a/util/uri.c b/util/uri.c
index 918d235..aa39694 100644
--- a/util/uri.c
+++ b/util/uri.c
@@ -928,12 +928,10 @@ uri_parse(const char *str) {
     if (str == NULL)
 	return(NULL);
     uri = uri_new();
-    if (uri != NULL) {
-	ret = rfc3986_parse_uri_reference(uri, str);
-        if (ret) {
-	    uri_free(uri);
-	    return(NULL);
-	}
+    ret = rfc3986_parse_uri_reference(uri, str);
+    if (ret) {
+        uri_free(uri);
+        return(NULL);
     }
     return(uri);
 }
@@ -974,15 +972,13 @@ uri_parse_raw(const char *str, int raw) {
     if (str == NULL)
 	return(NULL);
     uri = uri_new();
-    if (uri != NULL) {
-        if (raw) {
-	    uri->cleanup |= 2;
-	}
-	ret = uri_parse_into(uri, str);
-        if (ret) {
-	    uri_free(uri);
-	    return(NULL);
-	}
+    if (raw) {
+        uri->cleanup |= 2;
+    }
+    ret = uri_parse_into(uri, str);
+    if (ret) {
+        uri_free(uri);
+        return(NULL);
     }
     return(uri);
 }
@@ -1675,8 +1671,6 @@ uri_resolve(const char *uri, const char *base) {
     else {
 	if (*uri) {
 	    ref = uri_new();
-	    if (ref == NULL)
-		goto done;
 	    ret = uri_parse_into(ref, uri);
 	}
 	else
@@ -1695,8 +1689,6 @@ uri_resolve(const char *uri, const char *base) {
 	ret = -1;
     else {
 	bas = uri_new();
-	if (bas == NULL)
-	    goto done;
 	ret = uri_parse_into(bas, base);
     }
     if (ret != 0) {
@@ -1727,8 +1719,6 @@ uri_resolve(const char *uri, const char *base) {
      *    document.
      */
     res = uri_new();
-    if (res == NULL)
-	goto done;
     if ((ref->scheme == NULL) && (ref->path == NULL) &&
 	((ref->authority == NULL) && (ref->server == NULL))) {
         res->scheme = g_strdup(bas->scheme);
@@ -1933,8 +1923,6 @@ uri_resolve_relative (const char *uri, const char * base)
      * First parse URI into a standard form
      */
     ref = uri_new ();
-    if (ref == NULL)
-	return NULL;
     /* If URI not already in "relative" form */
     if (uri[0] != '.') {
 	ret = uri_parse_into (ref, uri);
@@ -1951,8 +1939,6 @@ uri_resolve_relative (const char *uri, const char * base)
 	goto done;
     }
     bas = uri_new ();
-    if (bas == NULL)
-	goto done;
     if (base[0] != '.') {
 	ret = uri_parse_into (bas, base);
 	if (ret != 0)
-- 
2.1.4

[Qemu-devel] [PULL 27/46] util/uri: realloc2n() can't fail, drop dead error handling

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/uri.c | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/util/uri.c b/util/uri.c
index aa39694..b9a7b54 100644
--- a/util/uri.c
+++ b/util/uri.c
@@ -1049,14 +1049,12 @@ uri_to_string(URI *uri) {
 	while (*p != 0) {
 	    if (len >= max) {
                 temp = realloc2n(ret, &max);
-                if (temp == NULL) goto mem_error;
 		ret = temp;
 	    }
 	    ret[len++] = *p++;
 	}
 	if (len >= max) {
             temp = realloc2n(ret, &max);
-            if (temp == NULL) goto mem_error;
             ret = temp;
 	}
 	ret[len++] = ':';
@@ -1066,7 +1064,6 @@ uri_to_string(URI *uri) {
 	while (*p != 0) {
 	    if (len + 3 >= max) {
                 temp = realloc2n(ret, &max);
-                if (temp == NULL) goto mem_error;
                 ret = temp;
 	    }
 	    if (IS_RESERVED(*(p)) || IS_UNRESERVED(*(p)))
@@ -1083,7 +1080,6 @@ uri_to_string(URI *uri) {
 	if (uri->server != NULL) {
 	    if (len + 3 >= max) {
                 temp = realloc2n(ret, &max);
-                if (temp == NULL) goto mem_error;
                 ret = temp;
 	    }
 	    ret[len++] = '/';
@@ -1093,7 +1089,6 @@ uri_to_string(URI *uri) {
 		while (*p != 0) {
 		    if (len + 3 >= max) {
                         temp = realloc2n(ret, &max);
-                        if (temp == NULL) goto mem_error;
                         ret = temp;
 		    }
 		    if ((IS_UNRESERVED(*(p))) ||
@@ -1112,7 +1107,6 @@ uri_to_string(URI *uri) {
 		}
 		if (len + 3 >= max) {
                     temp = realloc2n(ret, &max);
-                    if (temp == NULL) goto mem_error;
                     ret = temp;
 		}
 		ret[len++] = '@';
@@ -1121,7 +1115,6 @@ uri_to_string(URI *uri) {
 	    while (*p != 0) {
 		if (len >= max) {
                     temp = realloc2n(ret, &max);
-                    if (temp == NULL) goto mem_error;
                     ret = temp;
 		}
 		ret[len++] = *p++;
@@ -1129,7 +1122,6 @@ uri_to_string(URI *uri) {
 	    if (uri->port > 0) {
 		if (len + 10 >= max) {
                     temp = realloc2n(ret, &max);
-                    if (temp == NULL) goto mem_error;
                     ret = temp;
 		}
 		len += snprintf(&ret[len], max - len, ":%d", uri->port);
@@ -1137,7 +1129,6 @@ uri_to_string(URI *uri) {
 	} else if (uri->authority != NULL) {
 	    if (len + 3 >= max) {
                 temp = realloc2n(ret, &max);
-                if (temp == NULL) goto mem_error;
                 ret = temp;
 	    }
 	    ret[len++] = '/';
@@ -1146,7 +1137,6 @@ uri_to_string(URI *uri) {
 	    while (*p != 0) {
 		if (len + 3 >= max) {
                     temp = realloc2n(ret, &max);
-                    if (temp == NULL) goto mem_error;
                     ret = temp;
 		}
 		if ((IS_UNRESERVED(*(p))) ||
@@ -1165,7 +1155,6 @@ uri_to_string(URI *uri) {
 	} else if (uri->scheme != NULL) {
 	    if (len + 3 >= max) {
                 temp = realloc2n(ret, &max);
-                if (temp == NULL) goto mem_error;
                 ret = temp;
 	    }
 	    ret[len++] = '/';
@@ -1185,7 +1174,6 @@ uri_to_string(URI *uri) {
 	        (!strcmp(uri->scheme, "file"))) {
 		if (len + 3 >= max) {
                     temp = realloc2n(ret, &max);
-                    if (temp == NULL) goto mem_error;
                     ret = temp;
 		}
 		ret[len++] = *p++;
@@ -1195,7 +1183,6 @@ uri_to_string(URI *uri) {
 	    while (*p != 0) {
 		if (len + 3 >= max) {
                     temp = realloc2n(ret, &max);
-                    if (temp == NULL) goto mem_error;
                     ret = temp;
 		}
 		if ((IS_UNRESERVED(*(p))) || ((*(p) == '/')) ||
@@ -1215,7 +1202,6 @@ uri_to_string(URI *uri) {
 	if (uri->query != NULL) {
 	    if (len + 1 >= max) {
                 temp = realloc2n(ret, &max);
-                if (temp == NULL) goto mem_error;
                 ret = temp;
 	    }
 	    ret[len++] = '?';
@@ -1223,7 +1209,6 @@ uri_to_string(URI *uri) {
 	    while (*p != 0) {
 		if (len + 1 >= max) {
                     temp = realloc2n(ret, &max);
-                    if (temp == NULL) goto mem_error;
                     ret = temp;
 		}
 		ret[len++] = *p++;
@@ -1233,7 +1218,6 @@ uri_to_string(URI *uri) {
     if (uri->fragment != NULL) {
 	if (len + 3 >= max) {
             temp = realloc2n(ret, &max);
-            if (temp == NULL) goto mem_error;
             ret = temp;
 	}
 	ret[len++] = '#';
@@ -1241,7 +1225,6 @@ uri_to_string(URI *uri) {
 	while (*p != 0) {
 	    if (len + 3 >= max) {
                 temp = realloc2n(ret, &max);
-                if (temp == NULL) goto mem_error;
                 ret = temp;
 	    }
 	    if ((IS_UNRESERVED(*(p))) || (IS_RESERVED(*(p))))
@@ -1257,15 +1240,10 @@ uri_to_string(URI *uri) {
     }
     if (len >= max) {
         temp = realloc2n(ret, &max);
-        if (temp == NULL) goto mem_error;
         ret = temp;
     }
     ret[len] = 0;
     return(ret);
-
-mem_error:
-    g_free(ret);
-    return(NULL);
 }
 
 /**
-- 
2.1.4

[Qemu-devel] [PULL 28/46] util/uri: URI member path can be null, compare more carfully

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

uri_resolve_relative() calls strcmp(bas->path, ref->path).  However,
either argument could be null!  Evidence: the code checks for null
after the comparison.  Spotted by Coverity.

I suspect this was screwed up when we stole the code from libxml2.
There the conditional reads

    xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path)

with

    int
    xmlStrEqual(const xmlChar *str1, const xmlChar *str2) {
	if (str1 == str2) return(1);
	if (str1 == NULL) return(0);
	if (str2 == NULL) return(0);
	do {
	    if (*str1++ != *str2) return(0);
	} while (*str2++);
	return(1);
    }

Fix by replicating libxml2's logic faithfully.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 util/uri.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/util/uri.c b/util/uri.c
index b9a7b54..1cfd78b 100644
--- a/util/uri.c
+++ b/util/uri.c
@@ -1935,7 +1935,8 @@ uri_resolve_relative (const char *uri, const char * base)
 	val = g_strdup (uri);
 	goto done;
     }
-    if (!strcmp(bas->path, ref->path)) {
+    if (bas->path == ref->path ||
+        (bas->path && ref->path && !strcmp(bas->path, ref->path))) {
 	val = g_strdup("");
 	goto done;
     }
-- 
2.1.4

[Qemu-devel] [PULL 29/46] QJSON: fix typo in author's email address

[Michael Tokarev]

From: Greg Kurz <gkurz@linux.vnet.ibm.com>

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qjson.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qjson.c b/qjson.c
index b242222..0cda269 100644
--- a/qjson.c
+++ b/qjson.c
@@ -4,7 +4,7 @@
  * Copyright Alexander Graf
  *
  * Authors:
- *  Alexander Graf <agraf@suse.de
+ *  Alexander Graf <agraf@suse.de>
  *
  * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
  * See the COPYING.LIB file in the top-level directory.
-- 
2.1.4

[Qemu-devel] [PULL 30/46] Fix name error in migration stream analyzation script

[Michael Tokarev]

From: Greg Kurz <gkurz@linux.vnet.ibm.com>

It fixes the following error:

Traceback (most recent call last):
  File "./scripts/analyze-migration.py", line 584, in <module>
    dump.read(dump_memory = args.memory)
  File "./scripts/analyze-migration.py", line 528, in read
    self.sections[section_id].read()
  File "./scripts/analyze-migration.py", line 250, in read
    self.file.readvar(n_valid * HASH_PTE_SIZE_64)
NameError: global name 'HASH_PTE_SIZE_64' is not defined

Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 scripts/analyze-migration.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/analyze-migration.py b/scripts/analyze-migration.py
index b8b9968..0c8b22f 100755
--- a/scripts/analyze-migration.py
+++ b/scripts/analyze-migration.py
@@ -247,7 +247,7 @@ class HTABSection(object):
             if index == 0 and n_valid == 0 and n_invalid == 0:
                 break
 
-            self.file.readvar(n_valid * HASH_PTE_SIZE_64)
+            self.file.readvar(n_valid * self.HASH_PTE_SIZE_64)
 
     def getDict(self):
         return ""
-- 
2.1.4

[Qemu-devel] [PULL 31/46] onenand: g_malloc() can't fail, bury dead error handling

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/block/onenand.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index 348630d..1b2c893 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -346,15 +346,9 @@ static inline int onenand_prog_spare(OneNANDState *s, int sec, int secn,
 static inline int onenand_erase(OneNANDState *s, int sec, int num)
 {
     uint8_t *blankbuf, *tmpbuf;
+
     blankbuf = g_malloc(512);
-    if (!blankbuf) {
-        return 1;
-    }
     tmpbuf = g_malloc(512);
-    if (!tmpbuf) {
-        g_free(blankbuf);
-        return 1;
-    }
     memset(blankbuf, 0xff, 512);
     for (; num > 0; num--, sec++) {
         if (s->blk_cur) {
-- 
2.1.4

[Qemu-devel] [PULL 32/46] rtl8139: g_malloc() can't fail, bury dead error handling

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/net/rtl8139.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index b7b87a6..2d1be06 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -2075,20 +2075,6 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
                 "length to %d\n", txsize);
     }
 
-    if (!s->cplus_txbuffer)
-    {
-        /* out of memory */
-
-        DPRINTF("+++ C+ mode transmiter failed to reallocate %d bytes\n",
-            s->cplus_txbuffer_len);
-
-        /* update tally counter */
-        ++s->tally_counters.TxERR;
-        ++s->tally_counters.TxAbt;
-
-        return 0;
-    }
-
     /* append more data to the packet */
 
     DPRINTF("+++ C+ mode transmit reading %d bytes from host memory at "
-- 
2.1.4

[Qemu-devel] [PULL 33/46] kvm: g_malloc() can't fail, bury dead error handling

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 kvm-all.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/kvm-all.c b/kvm-all.c
index 2f21a4e..05a79c2 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -2070,10 +2070,6 @@ int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
         }
 
         bp = g_malloc(sizeof(struct kvm_sw_breakpoint));
-        if (!bp) {
-            return -ENOMEM;
-        }
-
         bp->pc = addr;
         bp->use_count = 1;
         err = kvm_arch_insert_sw_breakpoint(cpu, bp);
-- 
2.1.4

[Qemu-devel] [PULL 34/46] rdma: g_malloc0() can't fail, bury dead error handling

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 migration/rdma.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/migration/rdma.c b/migration/rdma.c
index fc351ea..29285e6 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -1121,9 +1121,6 @@ static int qemu_rdma_register_and_get_keys(RDMAContext *rdma,
     /* allocate memory to store chunk MRs */
     if (!block->pmr) {
         block->pmr = g_malloc0(block->nb_chunks * sizeof(struct ibv_mr *));
-        if (!block->pmr) {
-            return -1;
-        }
     }
 
     /*
-- 
2.1.4

[Qemu-devel] [PULL 35/46] vnc: g_realloc() can't fail, bury dead error handling

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 ui/vnc.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index a742c90..02552ee 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -659,10 +659,6 @@ void buffer_reserve(Buffer *buffer, size_t len)
     if ((buffer->capacity - buffer->offset) < len) {
         buffer->capacity += (len + 1024);
         buffer->buffer = g_realloc(buffer->buffer, buffer->capacity);
-        if (buffer->buffer == NULL) {
-            fprintf(stderr, "vnc: out of memory\n");
-            exit(1);
-        }
     }
 }
 
-- 
2.1.4

[Qemu-devel] [PULL 36/46] translate-all: Use g_try_malloc() for dynamic translator buffer

[Michael Tokarev]

From: Markus Armbruster <armbru@redhat.com>

The USE_MMAP code can fail, and the caller handles the failure
already.  Let the !USE_MMAP code fail as well, for consistency.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 translate-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/translate-all.c b/translate-all.c
index 4a1b64f..9f47ce7 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -631,7 +631,7 @@ static inline void *alloc_code_gen_buffer(void)
 #else
 static inline void *alloc_code_gen_buffer(void)
 {
-    void *buf = g_malloc(tcg_ctx.code_gen_buffer_size);
+    void *buf = g_try_malloc(tcg_ctx.code_gen_buffer_size);
 
     if (buf == NULL) {
         return NULL;
-- 
2.1.4

[Qemu-devel] [PULL 37/46] disas/cris: Fix warning caused by missing 'static' attribute

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warning from the Sparse static analysis tool:

disas/cris.c:1218:26: warning:
 symbol 'cris_cond15s' was not declared. Should it be static?

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 disas/cris.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/disas/cris.c b/disas/cris.c
index 9dfb4e3..a034dba 100644
--- a/disas/cris.c
+++ b/disas/cris.c
@@ -1215,7 +1215,7 @@ cris_cc_strings[] =
 };
 
 /* Different names and semantics for condition 1111 (0xf).  */
-const struct cris_cond15 cris_cond15s[] =
+static const struct cris_cond15 cris_cond15s[] =
 {
   /* FIXME: In what version did condition "ext" disappear?  */
   {"ext", cris_ver_v0_3},
-- 
2.1.4

[Qemu-devel] [PULL 38/46] disas/sh4: Fix warning caused by missing 'static' attribute

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warning from the Sparse static analysis tool:

disas/sh4.c:335:22: warning:
 symbol 'sh_table' was not declared. Should it be static?

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 disas/sh4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/disas/sh4.c b/disas/sh4.c
index f6cadd5..020f5eb 100644
--- a/disas/sh4.c
+++ b/disas/sh4.c
@@ -332,7 +332,7 @@ typedef struct
 
 #ifdef DEFINE_TABLE
 
-const sh_opcode_info sh_table[] =
+static const sh_opcode_info sh_table[] =
   {
 /* 0111nnnni8*1.... add #<imm>,<REG_N>  */{"add",{A_IMM,A_REG_N},{HEX_7,REG_N,IMM0_8}, arch_sh1_up},
 
-- 
2.1.4

[Qemu-devel] [PULL 39/46] migration: Fix warning caused by missing declaration of vmstate_dummy

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warning from the Sparse static analysis tool:

stubs/vmstate.c:4:26: warning:
 symbol 'vmstate_dummy' was not declared. Should it be static?

Cc: Juan Quintela <quintela@redhat.com>
Cc: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 include/migration/vmstate.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 0b26bc6..c20f2d1 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -139,9 +139,7 @@ struct VMStateDescription {
     const VMStateSubsection *subsections;
 };
 
-#ifdef CONFIG_USER_ONLY
 extern const VMStateDescription vmstate_dummy;
-#endif
 
 extern const VMStateInfo vmstate_info_bool;
 
-- 
2.1.4

[Qemu-devel] [PULL 40/46] migration: Fix warnings caused by missing 'static' attribute

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warnings from the Sparse static analysis tool:

migration-rdma.c:151:12: warning:
 symbol 'wrid_desc' was not declared. Should it be static?
migration-rdma.c:190:12: warning:
 symbol 'control_desc' was not declared. Should it be static?
migration-rdma.c:3301:19: warning:
 symbol 'rdma_read_ops' was not declared. Should it be static?
migration-rdma.c:3308:19: warning:
 symbol 'rdma_write_ops' was not declared. Should it be static?

Cc: Juan Quintela <quintela@redhat.com>
Cc: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 migration/rdma.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/migration/rdma.c b/migration/rdma.c
index 29285e6..6bee30c 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -121,7 +121,7 @@ enum {
     RDMA_WRID_RECV_CONTROL = 4000,
 };
 
-const char *wrid_desc[] = {
+static const char *wrid_desc[] = {
     [RDMA_WRID_NONE] = "NONE",
     [RDMA_WRID_RDMA_WRITE] = "WRITE RDMA",
     [RDMA_WRID_SEND_CONTROL] = "CONTROL SEND",
@@ -160,7 +160,7 @@ enum {
     RDMA_CONTROL_UNREGISTER_FINISHED, /* unpinning finished */
 };
 
-const char *control_desc[] = {
+static const char *control_desc[] = {
     [RDMA_CONTROL_NONE] = "NONE",
     [RDMA_CONTROL_ERROR] = "ERROR",
     [RDMA_CONTROL_READY] = "READY",
@@ -3250,14 +3250,14 @@ static int qemu_rdma_get_fd(void *opaque)
     return rdma->comp_channel->fd;
 }
 
-const QEMUFileOps rdma_read_ops = {
+static const QEMUFileOps rdma_read_ops = {
     .get_buffer    = qemu_rdma_get_buffer,
     .get_fd        = qemu_rdma_get_fd,
     .close         = qemu_rdma_close,
     .hook_ram_load = qemu_rdma_registration_handle,
 };
 
-const QEMUFileOps rdma_write_ops = {
+static const QEMUFileOps rdma_write_ops = {
     .put_buffer         = qemu_rdma_put_buffer,
     .close              = qemu_rdma_close,
     .before_ram_iterate = qemu_rdma_registration_start,
-- 
2.1.4

[Qemu-devel] [PULL 41/46] moxie: Fix warning caused by missing include statement

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warning from the Sparse static analysis tool:

target-moxie/machine.c:4:26:
 warning: symbol 'vmstate_moxie_cpu' was not declared. Should it be static?

machine.h includes the missing declaration.

Cc: Anthony Green <green@moxielogic.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target-moxie/machine.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target-moxie/machine.c b/target-moxie/machine.c
index da1a857..b9316f0 100644
--- a/target-moxie/machine.c
+++ b/target-moxie/machine.c
@@ -1,5 +1,6 @@
 #include "hw/hw.h"
 #include "hw/boards.h"
+#include "machine.h"
 
 const VMStateDescription vmstate_moxie_cpu = {
     .name = "cpu",
-- 
2.1.4

[Qemu-devel] [PULL 42/46] serial: Fix warnings caused by missing 'static' attribute

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warnings from the Sparse static analysis tool:

hw/char/serial.c:630:26: warning: symbol
 'vmstate_serial_thr_ipending' was not declared. Should it be static?
hw/char/serial.c:646:26: warning: symbol
 'vmstate_serial_tsr' was not declared. Should it be static?
hw/char/serial.c:665:26: warning: symbol
 'vmstate_serial_recv_fifo' was not declared. Should it be static?
hw/char/serial.c:681:26: warning: symbol
 'vmstate_serial_xmit_fifo' was not declared. Should it be static?
hw/char/serial.c:697:26: warning: symbol
 'vmstate_serial_fifo_timeout_timer' was not declared. Should it be static?
hw/char/serial.c:713:26: warning: symbol
 'vmstate_serial_timeout_ipending' was not declared. Should it be static?
hw/char/serial.c:729:26: warning: symbol
 'vmstate_serial_poll' was not declared. Should it be static?

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/char/serial.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/char/serial.c b/hw/char/serial.c
index bd25c03..0491897 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -658,7 +658,7 @@ static bool serial_thr_ipending_needed(void *opaque)
     }
 }
 
-const VMStateDescription vmstate_serial_thr_ipending = {
+static const VMStateDescription vmstate_serial_thr_ipending = {
     .name = "serial/thr_ipending",
     .version_id = 1,
     .minimum_version_id = 1,
@@ -674,7 +674,7 @@ static bool serial_tsr_needed(void *opaque)
     return s->tsr_retry != 0;
 }
 
-const VMStateDescription vmstate_serial_tsr = {
+static const VMStateDescription vmstate_serial_tsr = {
     .name = "serial/tsr",
     .version_id = 1,
     .minimum_version_id = 1,
@@ -693,7 +693,7 @@ static bool serial_recv_fifo_needed(void *opaque)
 
 }
 
-const VMStateDescription vmstate_serial_recv_fifo = {
+static const VMStateDescription vmstate_serial_recv_fifo = {
     .name = "serial/recv_fifo",
     .version_id = 1,
     .minimum_version_id = 1,
@@ -709,7 +709,7 @@ static bool serial_xmit_fifo_needed(void *opaque)
     return !fifo8_is_empty(&s->xmit_fifo);
 }
 
-const VMStateDescription vmstate_serial_xmit_fifo = {
+static const VMStateDescription vmstate_serial_xmit_fifo = {
     .name = "serial/xmit_fifo",
     .version_id = 1,
     .minimum_version_id = 1,
@@ -725,7 +725,7 @@ static bool serial_fifo_timeout_timer_needed(void *opaque)
     return timer_pending(s->fifo_timeout_timer);
 }
 
-const VMStateDescription vmstate_serial_fifo_timeout_timer = {
+static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
     .name = "serial/fifo_timeout_timer",
     .version_id = 1,
     .minimum_version_id = 1,
@@ -741,7 +741,7 @@ static bool serial_timeout_ipending_needed(void *opaque)
     return s->timeout_ipending != 0;
 }
 
-const VMStateDescription vmstate_serial_timeout_ipending = {
+static const VMStateDescription vmstate_serial_timeout_ipending = {
     .name = "serial/timeout_ipending",
     .version_id = 1,
     .minimum_version_id = 1,
@@ -757,7 +757,7 @@ static bool serial_poll_needed(void *opaque)
     return s->poll_msl >= 0;
 }
 
-const VMStateDescription vmstate_serial_poll = {
+static const VMStateDescription vmstate_serial_poll = {
     .name = "serial/poll",
     .version_id = 1,
     .minimum_version_id = 1,
-- 
2.1.4

[Qemu-devel] [PULL 43/46] spice: Add missing 'static' attribute

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 spice-qemu-char.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spice-qemu-char.c b/spice-qemu-char.c
index 7e0d300..a4f4e57 100644
--- a/spice-qemu-char.c
+++ b/spice-qemu-char.c
@@ -158,7 +158,7 @@ static gboolean spice_char_source_dispatch(GSource *source,
     return func(NULL, G_IO_OUT, user_data);
 }
 
-GSourceFuncs SpiceCharSourceFuncs = {
+static GSourceFuncs SpiceCharSourceFuncs = {
     .prepare  = spice_char_source_prepare,
     .check    = spice_char_source_check,
     .dispatch = spice_char_source_dispatch,
-- 
2.1.4

[Qemu-devel] [PULL 44/46] stubs: Fix warning caused by missing include statement

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warning from the Sparse static analysis tool:

stubs/qtest.c:14:6:
 warning: symbol 'qtest_allowed' was not declared. Should it be static?

Add the missing include statement which declares qtest_allowed.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 stubs/qtest.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stubs/qtest.c b/stubs/qtest.c
index e671ed8..dc17594 100644
--- a/stubs/qtest.c
+++ b/stubs/qtest.c
@@ -8,7 +8,7 @@
  * See the COPYING file in the top-level directory.
  */
 
-#include "qemu-common.h"
+#include "sysemu/qtest.h"
 
 /* Needed for qtest_allowed() */
 bool qtest_allowed;
-- 
2.1.4

[Qemu-devel] [PULL 45/46] vga: Fix warning caused by missing 'static' attribute

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warning from the Sparse static analysis tool:

hw/display/vga.c:2012:26: warning:
 symbol 'vmstate_vga_endian' was not declared. Should it be static?

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/display/vga.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/vga.c b/hw/display/vga.c
index ffcfce3..9c62fbf 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2032,7 +2032,7 @@ static bool vga_endian_state_needed(void *opaque)
     return s->default_endian_fb != s->big_endian_fb;
 }
 
-const VMStateDescription vmstate_vga_endian = {
+static const VMStateDescription vmstate_vga_endian = {
     .name = "vga.endian",
     .version_id = 1,
     .minimum_version_id = 1,
-- 
2.1.4

[Qemu-devel] [PULL 46/46] virtio: Fix warning caused by missing 'static' attribute

[Michael Tokarev]

From: Stefan Weil <sw@weilnetz.de>

Warning from the Sparse static analysis tool:

hw/char/virtio-serial-bus.c:31:3:
 warning: symbol 'vserdevices' was not declared. Should it be static?

Cc: Amit Shah <amit.shah@redhat.com>
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/char/virtio-serial-bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 37a6f44..47fbb34 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -26,7 +26,7 @@
 #include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-access.h"
 
-struct VirtIOSerialDevices {
+static struct VirtIOSerialDevices {
     QLIST_HEAD(, VirtIOSerial) devices;
 } vserdevices;
 
-- 
2.1.4

Re: [Qemu-devel] [PULL 00/46] Trivial patches for 2015-02-10

[Peter Maydell]

On 10 February 2015 at 06:33, Michael Tokarev <mjt@tls.msk.ru> wrote:
> This is another pull request for trivial-patches tree.
> This time it is sort of huge, consisting of 46 patches in total.
> There are several patches and series which aren't applied to
> -trivial but should -- I decided I'll send a pull request first
> and apply the leftovers later, because there are important
> changes in the tree and amount of leftovers is somewhat large.
> This is a 3-week collection.
>
> This request consists of a large number of trivial fixes from
> the usual heros, Marcus and Stefen, who found several new ways
> to find various small defects in the code.  There are several
> linux-user fixes from Chen Gang, with some grammar fixes from
> me -- not all of his changes has been applied so far.  There
> are several bugfixes, -- eg, the libcacard linking fix, a buffer
> overflow fix in inet_parse (which does not warrant a CVE# :);
> and also there are some other stuff from here and there.
>
> Please consider applying.
>
> Thanks,
>
> /mjt
>
> The following changes since commit 89db21771782fd6050335e73542064f1187c9ced:
>
>   qmp: unbreak build for non-vnc configuration (2015-02-09 22:36:04 +0000)
>
> are available in the git repository at:
>
>   git://git.corpit.ru/qemu.git tags/pull-trivial-patches-2015-02-10
>
> for you to fetch changes up to 3ff64f1f9391a9b71d4dd58c6c4bbaa1db3dd430:
>
>   virtio: Fix warning caused by missing 'static' attribute (2015-02-10 09:27:21 +0300)
>

Hi. I'm afraid this introduces a new compiler warning under clang:

disas/cris.c:1218:33: warning: unused variable 'cris_cond15s'
[-Wunused-const-variable]
static const struct cris_cond15 cris_cond15s[] =

-- PMM

Re: [Qemu-devel] [PULL 00/46] Trivial patches for 2015-02-10

[Michael Tokarev]

10.02.2015 10:14, Peter Maydell wrote:
>> The following changes since commit 89db21771782fd6050335e73542064f1187c9ced:
>>
>>   qmp: unbreak build for non-vnc configuration (2015-02-09 22:36:04 +0000)
>>
>> are available in the git repository at:
>>
>>   git://git.corpit.ru/qemu.git tags/pull-trivial-patches-2015-02-10
>>
>> for you to fetch changes up to 3ff64f1f9391a9b71d4dd58c6c4bbaa1db3dd430:
>>
>>   virtio: Fix warning caused by missing 'static' attribute (2015-02-10 09:27:21 +0300)
> 
> Hi. I'm afraid this introduces a new compiler warning under clang:
> 
> disas/cris.c:1218:33: warning: unused variable 'cris_cond15s'
> [-Wunused-const-variable]
> static const struct cris_cond15 cris_cond15s[] =

Yes.  This variable/array is actually completely unused. I dropped
the patch in question from my pull request, and re-tagged it.  We'll
deal with this unused var later.  Here's a new pull request, now
with only 45 patches.

The following changes since commit 89db21771782fd6050335e73542064f1187c9ced:

  qmp: unbreak build for non-vnc configuration (2015-02-09 22:36:04 +0000)

are available in the git repository at:

  git://git.corpit.ru/qemu.git tags/pull-trivial-patches-2015-02-10

for you to fetch changes up to 43d735547b2a29cafd7d9529ac38734950b235f7:

  virtio: Fix warning caused by missing 'static' attribute (2015-02-10 10:26:05 +0300)

----------------------------------------------------------------
trivial patches for 2015-02-10

----------------------------------------------------------------
Chen Gang S (4):
      linux-user/syscall.c: lock_iovec: unlock vec[i] in failure processing code block
      linux-user/syscall.c: Fix typo issue for using target_vec[i].iov_len instead of target_vec[i].iov_base
      linux-user/main.c: Use TARGET_SIG* instead of SIG*
      linux-user/syscall.c: do_ioctl_dm: Need to call unlock_user() before going to failure return in default case

Christian Borntraeger (1):
      vl.c: fix memory leak spotted by valgrind

Daniel P. Berrange (1):
      libcacard: stop linking against every single 3rd party library

Don Koch (4):
      Add tracing to xenfb.
      Add trace to ps2.c.
      Add/convert trace calls in pcnet-pci.c.
      Convert some debugging printfs to trace calls in pcnet.c.

Gonglei (2):
      fw_cfg: fix typos in comments: patch -> path
      virtfs-proxy-helper: Fix possible socket leak.

Greg Kurz (2):
      QJSON: fix typo in author's email address
      Fix name error in migration stream analyzation script

Kevin Wolf (1):
      qemu-sockets: Fix buffer overflow in inet_parse()

Markus Armbruster (15):
      target-mips: Clean up switch fall through after commit fecd264
      vl: Fix bogus error message for implied mon ID clashing
      qemu-option: Replace pointless use of g_malloc0() by g_malloc()
      qemu-option: Pair g_malloc() with g_free(), not free()
      spapr_vio: Pair g_malloc() with g_free(), not free()
      usb: Pair g_malloc() with g_free(), not free()
      util/uri: uri_new() can't fail, drop dead error handling
      util/uri: realloc2n() can't fail, drop dead error handling
      util/uri: URI member path can be null, compare more carfully
      onenand: g_malloc() can't fail, bury dead error handling
      rtl8139: g_malloc() can't fail, bury dead error handling
      kvm: g_malloc() can't fail, bury dead error handling
      rdma: g_malloc0() can't fail, bury dead error handling
      vnc: g_realloc() can't fail, bury dead error handling
      translate-all: Use g_try_malloc() for dynamic translator buffer

Maxim Ostapenko (1):
      linux-user: wrong TARGET_SI_PAD_SIZE value for some targets.

Paolo Bonzini (4):
      cpu-exec: drop dead assignment
      cpu-exec: simplify icount code
      qemu-sockets: improve error reporting in unix_listen_opts
      aes: remove a dead return statement

Stefan Weil (9):
      disas/sh4: Fix warning caused by missing 'static' attribute
      migration: Fix warning caused by missing declaration of vmstate_dummy
      migration: Fix warnings caused by missing 'static' attribute
      moxie: Fix warning caused by missing include statement
      serial: Fix warnings caused by missing 'static' attribute
      spice: Add missing 'static' attribute
      stubs: Fix warning caused by missing include statement
      vga: Fix warning caused by missing 'static' attribute
      virtio: Fix warning caused by missing 'static' attribute

Thomas Huth (1):
      qemu-log: Correct help text of 'log cpu_reset'

 cpu-exec.c                   | 12 +++------
 disas/sh4.c                  |  2 +-
 fsdev/virtfs-proxy-helper.c  | 13 ++++++---
 hw/block/onenand.c           |  8 +-----
 hw/char/serial.c             | 14 +++++-----
 hw/char/virtio-serial-bus.c  |  2 +-
 hw/core/fw-path-provider.c   |  2 +-
 hw/display/vga.c             |  2 +-
 hw/display/xenfb.c           |  5 ++++
 hw/input/ps2.c               | 16 +++++++++++
 hw/net/pcnet-pci.c           | 49 +++++++++++++--------------------
 hw/net/pcnet.c               | 28 ++++++-------------
 hw/net/rtl8139.c             | 14 ----------
 hw/ppc/spapr.c               |  2 +-
 hw/ppc/spapr_vio.c           |  2 +-
 hw/usb/desc-msos.c           |  2 +-
 include/migration/vmstate.h  |  2 --
 kvm-all.c                    |  4 ---
 libcacard/Makefile           |  2 ++
 linux-user/main.c            | 64 ++++++++++++++++++++++----------------------
 linux-user/syscall.c         |  9 ++++++-
 linux-user/syscall_defs.h    |  9 ++++++-
 migration/rdma.c             | 11 +++-----
 qemu-log.c                   |  2 +-
 qjson.c                      |  2 +-
 scripts/analyze-migration.py |  2 +-
 spice-qemu-char.c            |  2 +-
 stubs/qtest.c                |  2 +-
 target-mips/translate.c      |  4 +++
 target-moxie/machine.c       |  1 +
 trace-events                 | 41 ++++++++++++++++++++++++++++
 translate-all.c              |  2 +-
 ui/vnc.c                     |  4 ---
 util/aes.c                   |  2 +-
 util/qemu-option.c           |  8 +++---
 util/qemu-sockets.c          | 26 +++++++++++++-----
 util/uri.c                   | 61 +++++++++--------------------------------
 vl.c                         |  7 +++--
 38 files changed, 223 insertions(+), 217 deletions(-)


Thanks,

/mjt

Re: [Qemu-devel] [PULL 14/46] cpu-exec: drop dead assignment

[Peter Maydell]

On 10 February 2015 at 06:34, Michael Tokarev <mjt@tls.msk.ru> wrote:
> From: Paolo Bonzini <pbonzini@redhat.com>
>
> All uses of TB inside cpu_exec are dominated by "tb = tb_find_fast(env)",
> and there are no uses after the switch statement.  So the assignment
> is dead, as reported by Coverity.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> ---
>  cpu-exec.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/cpu-exec.c b/cpu-exec.c
> index fa506e6..4ff1b23 100644
> --- a/cpu-exec.c
> +++ b/cpu-exec.c
> @@ -494,7 +494,6 @@ int cpu_exec(CPUArchState *env)
>                           * interrupt_request) which we will handle
>                           * next time around the loop.
>                           */
> -                        tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
>                          next_tb = 0;
>                          break;
>                      case TB_EXIT_ICOUNT_EXPIRED:

True, I guess, but presumably this means we're doing unnecessary
work in the next time round the loop re-finding the tb which we
already had...

(Also, why do we have a variable 'next_tb' which holds the
address of the *previous* TB? :-) I think the documentation
of the return value of tcg_qemu_tb_exec() is wrong too. Or
I've misunderstood the code.)

-- PMM

Re: [Qemu-devel] [PULL 14/46] cpu-exec: drop dead assignment

[Paolo Bonzini]

On 10/02/2015 10:15, Peter Maydell wrote:
> > -                        tb = (TranslationBlock *)(next_tb & ~TB_EXIT_MASK);
> >                          next_tb = 0;
> >                          break;
> >                      case TB_EXIT_ICOUNT_EXPIRED:
>
> True, I guess, but presumably this means we're doing unnecessary
> work in the next time round the loop re-finding the tb which we
> already had...

This is the TB_EXIT_REQUESTED case though: once the iothread runs who
knows what happens.  You might get an interrupt or a system reset that
diverts execution away from tb.

Paolo

Re: [Qemu-devel] [PULL 00/46] Trivial patches for 2015-02-10

[Peter Maydell]

On 10 February 2015 at 07:29, Michael Tokarev <mjt@tls.msk.ru> wrote:
> The following changes since commit 89db21771782fd6050335e73542064f1187c9ced:
>
>   qmp: unbreak build for non-vnc configuration (2015-02-09 22:36:04 +0000)
>
> are available in the git repository at:
>
>   git://git.corpit.ru/qemu.git tags/pull-trivial-patches-2015-02-10
>
> for you to fetch changes up to 43d735547b2a29cafd7d9529ac38734950b235f7:
>
>   virtio: Fix warning caused by missing 'static' attribute (2015-02-10 10:26:05 +0300)
>
> ----------------------------------------------------------------
> trivial patches for 2015-02-10
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM