summaryrefslogtreecommitdiffstats
path: root/tests/qtest
Commit message (Collapse)AuthorAgeFilesLines
* hw/sd/sdcard: Check for valid address range in SEND_WRITE_PROT (CMD30)Philippe Mathieu-Daudé2021-07-122-0/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OSS-Fuzz found sending illegal addresses when querying the write protection bits triggers an assertion: qemu-fuzz-i386: hw/sd/sd.c:824: uint32_t sd_wpbits(SDState *, uint64_t): Assertion `wpnum < sd->wpgrps_size' failed. ==11578== ERROR: libFuzzer: deadly signal #8 0x7ffff628e091 in __assert_fail #9 0x5555588f1a3c in sd_wpbits hw/sd/sd.c:824:9 #10 0x5555588dd271 in sd_normal_command hw/sd/sd.c:1383:38 #11 0x5555588d777c in sd_do_command hw/sd/sd.c #12 0x555558cb25a0 in sdbus_do_command hw/sd/core.c:100:16 #13 0x555558e02a9a in sdhci_send_command hw/sd/sdhci.c:337:12 #14 0x555558dffa46 in sdhci_write hw/sd/sdhci.c:1187:9 #15 0x5555598b9d76 in memory_region_write_accessor softmmu/memory.c:489:5 Similarly to commit 8573378e62d ("hw/sd: fix out-of-bounds check for multi block reads"), check the address range before sending the status of the write protection bits. Include the qtest reproducer provided by Alexander Bulekov: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test qemu-system-i386: ../hw/sd/sd.c:824: sd_wpbits: Assertion `wpnum < sd->wpgrps_size' failed. Reported-by: OSS-Fuzz (Issue 29225) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/450 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210702155900.148665-4-f4bug@amsat.org>
* Merge remote-tracking branch 'remotes/cminyard/tags/for-qemu-6.1-2' into stagingPeter Maydell2021-07-116-3/+786
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some qemu updates for IPMI and I2C Move some ADC file to where they belong and move some sensors to a sensor directory, since with new BMCs coming in lots of different sensors should be coming in. Keep from cluttering things up. Add support for I2C PMBus devices. Replace the confusing and error-prone i2c_send_recv and i2c_transfer with specific send and receive functions. Several errors have already been made with these, avoid any new errors. Fix the watchdog_expired field in the IPMI watchdog, it's not a bool, it's a u8. After a vmstate transfer, the new value could be wrong. # gpg: Signature made Fri 09 Jul 2021 17:25:04 BST # gpg: using RSA key FD0D5CE67CE0F59A6688268661F38C90919BFF81 # gpg: Good signature from "Corey Minyard <cminyard@mvista.com>" [unknown] # gpg: aka "Corey Minyard <minyard@acm.org>" [unknown] # gpg: aka "Corey Minyard <corey@minyard.net>" [unknown] # gpg: aka "Corey Minyard <minyard@mvista.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: FD0D 5CE6 7CE0 F59A 6688 2686 61F3 8C90 919B FF81 * remotes/cminyard/tags/for-qemu-6.1-2: (24 commits) tests/qtest: add tests for MAX34451 device model hw/misc: add MAX34451 device tests/qtest: add tests for ADM1272 device model hw/misc: add ADM1272 device hw/i2c: add support for PMBus ipmi/sim: fix watchdog_expired data type error in IPMIBmcSim struct hw/i2c: Introduce i2c_start_recv() and i2c_start_send() hw/i2c: Extract i2c_do_start_transfer() from i2c_start_transfer() hw/i2c: Make i2c_start_transfer() direction argument a boolean hw/i2c: Rename i2c_set_slave_address() -> i2c_slave_set_address() hw/i2c: Remove confusing i2c_send_recv() hw/misc/auxbus: Replace i2c_send_recv() by i2c_recv() & i2c_send() hw/misc/auxbus: Replace 'is_write' boolean by its value hw/misc/auxbus: Explode READ_I2C / WRITE_I2C_MOT cases hw/misc/auxbus: Fix MOT/classic I2C mode hw/i2c/ppc4xx_i2c: Replace i2c_send_recv() by i2c_recv() & i2c_send() hw/i2c/ppc4xx_i2c: Add reference to datasheet hw/display/sm501: Replace i2c_send_recv() by i2c_recv() & i2c_send() hw/display/sm501: Simplify sm501_i2c_write() logic hw/input/lm832x: Define TYPE_LM8323 in public header ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tests/qtest: add tests for MAX34451 device modelTitus Rwantare2021-07-082-0/+337
| | | | | | | | | | | | | | Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210708172556.1868139-6-titusr@google.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * tests/qtest: add tests for ADM1272 device modelTitus Rwantare2021-07-082-0/+446
| | | | | | | | | | | | | | Signed-off-by: Titus Rwantare <titusr@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210708172556.1868139-4-titusr@google.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
| * sensor: Move hardware sensors from misc to a sensor directoryCorey Minyard2021-06-173-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Lots of this are expected to be coming in, create a directory for them. Also move the tmp105.h file into the include directory where it should be. Cc: Cédric Le Goater <clg@kaod.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Andrew Jeffery <andrew@aj.id.au> Cc: Joel Stanley <joel@jms.id.au> Cc: Andrzej Zaborowski <balrogg@gmail.com> Cc: qemu-arm@nongnu.org Signed-off-by: Corey Minyard <cminyard@mvista.com> Acked-by: Cédric Le Goater <clg@kaod.org>
* | Merge remote-tracking branch ↵Peter Maydell2021-07-111-0/+37
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20210709' into staging target-arm queue: * New machine type: stm32vldiscovery * hw/intc/arm_gicv3_cpuif: Fix virtual irq number check in icv_[dir|eoir]_write * hw/gpio/pl061: Honour Luminary PL061 PUR and PDR registers * virt: Fix implementation of GPIO-based powerdown/shutdown mechanism * Correct the encoding of MDCCSR_EL0 and DBGDSCRint * hw/intc: Improve formatting of MEMTX_ERROR guest error message # gpg: Signature made Fri 09 Jul 2021 17:09:10 BST # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20210709: hw/intc: Improve formatting of MEMTX_ERROR guest error message target/arm: Correct the encoding of MDCCSR_EL0 and DBGDSCRint hw/arm/stellaris: Expand comment about handling of OLED chipselect hw/gpio/pl061: Document a shortcoming in our implementation hw/gpio/pl061: Convert to 3-phase reset and assert GPIO lines correctly on reset hw/arm/virt: Make PL061 GPIO lines pulled low, not high hw/gpio/pl061: Make pullup/pulldown of outputs configurable hw/gpio/pl061: Honour Luminary PL061 PUR and PDR registers hw/gpio/pl061: Document the interface of this device hw/gpio/pl061: Add tracepoints for register read and write hw/gpio/pl061: Clean up read/write offset handling logic hw/gpio/pl061: Convert DPRINTF to tracepoints hw/intc/arm_gicv3_cpuif: Fix virtual irq number check in icv_[dir|eoir]_write tests/boot-serial-test: Add STM32VLDISCOVERY board testcase docs/system: arm: Add stm32 boards description stm32vldiscovery: Add the STM32VLDISCOVERY Machine stm32f100: Add the stm32f100 SoC Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | tests/boot-serial-test: Add STM32VLDISCOVERY board testcaseAlexandre Iooss2021-07-091-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New mini-kernel test for STM32VLDISCOVERY USART1. Signed-off-by: Alexandre Iooss <erdnaxe@crans.org> Acked-by: Thomas Huth <thuth@redhat.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20210617165647.2575955-5-erdnaxe@crans.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | | spapr: Implement Open Firmware client interfaceAlexey Kardashevskiy2021-07-091-2/+13
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PAPR platform describes an OS environment that's presented by a combination of a hypervisor and firmware. The features it specifies require collaboration between the firmware and the hypervisor. Since the beginning, the runtime component of the firmware (RTAS) has been implemented as a 20 byte shim which simply forwards it to a hypercall implemented in qemu. The boot time firmware component is SLOF - but a build that's specific to qemu, and has always needed to be updated in sync with it. Even though we've managed to limit the amount of runtime communication we need between qemu and SLOF, there's some, and it has become increasingly awkward to handle as we've implemented new features. This implements a boot time OF client interface (CI) which is enabled by a new "x-vof" pseries machine option (stands for "Virtual Open Firmware). When enabled, QEMU implements the custom H_OF_CLIENT hcall which implements Open Firmware Client Interface (OF CI). This allows using a smaller stateless firmware which does not have to manage the device tree. The new "vof.bin" firmware image is included with source code under pc-bios/. It also includes RTAS blob. This implements a handful of CI methods just to get -kernel/-initrd working. In particular, this implements the device tree fetching and simple memory allocator - "claim" (an OF CI memory allocator) and updates "/memory@0/available" to report the client about available memory. This implements changing some device tree properties which we know how to deal with, the rest is ignored. To allow changes, this skips fdt_pack() when x-vof=on as not packing the blob leaves some room for appending. In absence of SLOF, this assigns phandles to device tree nodes to make device tree traversing work. When x-vof=on, this adds "/chosen" every time QEMU (re)builds a tree. This adds basic instances support which are managed by a hash map ihandle -> [phandle]. Before the guest started, the used memory is: 0..e60 - the initial firmware 8000..10000 - stack 400000.. - kernel 3ea0000.. - initramdisk This OF CI does not implement "interpret". Unlike SLOF, this does not format uninitialized nvram. Instead, this includes a disk image with pre-formatted nvram. With this basic support, this can only boot into kernel directly. However this is just enough for the petitboot kernel and initradmdisk to boot from any possible source. Note this requires reasonably recent guest kernel with: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=df5be5be8735 The immediate benefit is much faster booting time which especially crucial with fully emulated early CPU bring up environments. Also this may come handy when/if GRUB-in-the-userspace sees light of the day. This separates VOF and sPAPR in a hope that VOF bits may be reused by other POWERPC boards which do not support pSeries. This assumes potential support for booting from QEMU backends such as blockdev or netdev without devices/drivers used. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Message-Id: <20210625055155.2252896-1-aik@ozlabs.ru> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> [dwg: Adjusted some includes which broke compile in some more obscure compilation setups] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* | Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into ↵Peter Maydell2021-07-061-11/+11
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging * More Meson test conversions and configure cleanups * Generalize XSAVE area offset so that it matches AMD processors on KVM * Improvements for -display and deprecation of -no-quit * Enable SMP configuration as a compound machine property ("-M smp.cpus=...") * Haiku compilation fix * Add icon on Darwin # gpg: Signature made Tue 06 Jul 2021 08:35:23 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini-gitlab/tags/for-upstream: (40 commits) config-host.mak: remove unused compiler-related lines Set icon for QEMU binary on Mac OS qemu-option: remove now-dead code machine: add smp compound property vl: switch -M parsing to keyval keyval: introduce keyval_parse_into keyval: introduce keyval_merge qom: export more functions for use with non-UserCreatable objects configure: convert compiler tests to meson, part 6 configure: convert compiler tests to meson, part 5 configure: convert compiler tests to meson, part 4 configure: convert compiler tests to meson, part 3 configure: convert compiler tests to meson, part 2 configure: convert compiler tests to meson, part 1 configure: convert HAVE_BROKEN_SIZE_MAX to meson configure, meson: move CONFIG_IVSHMEM to meson meson: store dependency('threads') in a variable meson: sort existing compiler tests configure, meson: convert libxml2 detection to meson configure, meson: convert liburing detection to meson ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | machine: add smp compound propertyPaolo Bonzini2021-07-061-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make -smp syntactic sugar for a compound property "-machine smp.{cores,threads,cpu,...}". machine_smp_parse is replaced by the setter for the property. numa-test will now cover the new syntax, while other tests still use -smp. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | | Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20210705' ↵Peter Maydell2021-07-052-0/+10
|\ \ \ | |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging 9pfs: misc patches * Add link to 9p developer docs. * Fix runtime check whether client supplied relative path is the export root. * Performance optimization of Twalk requests. * Code cleanup. # gpg: Signature made Mon 05 Jul 2021 12:13:34 BST # gpg: using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395 # gpg: issuer "qemu_oss@crudebyte.com" # gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: ECAB 1A45 4014 1413 BA38 4926 30DB 47C3 A012 D5F4 # Subkey fingerprint: 96D8 D110 CF7A F808 4F88 5901 34C2 B587 65A4 7395 * remotes/cschoenebeck/tags/pull-9p-20210705: 9pfs: reduce latency of Twalk 9pfs: drop root_qid 9pfs: replace not_same_qid() by same_stat_id() 9pfs: drop fid_to_qid() 9pfs: capture root stat 9pfs: fix not_same_qid() 9pfs: simplify v9fs_walk() 9pfs: add link to 9p developer docs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | 9pfs: add link to 9p developer docsChristian Schoenebeck2021-07-052-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To lower the entry level for new developers, add a link to the 9p developer docs (i.e. qemu wiki) to MAINTAINERS and to the beginning of 9p source files, that is to: https://wiki.qemu.org/Documentation/9p Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Acked-by: Greg Kurz <groug@kaod.org> Message-Id: <E1leeDf-0008GZ-9q@lizzy.crudebyte.com>
* | | tests: migration-test: Add dirty ring testPeter Xu2021-07-051-3/+55
|/ / | | | | | | | | | | | | | | | | | | | | | | Add dirty ring test if kernel supports it. Add the dirty ring parameter on source should be mostly enough, but let's change the dest too to make them match always. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <20210615175523.439830-3-peterx@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* | Merge remote-tracking branch ↵Peter Maydell2021-06-251-0/+17
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/kraxel/tags/audio-20210624-pull-request' into staging audio: bugfixes # gpg: Signature made Thu 24 Jun 2021 13:16:16 BST # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/audio-20210624-pull-request: hw/audio/sb16: Restrict I/O sampling rate range for command 41h/42h coreaudio: Lock only the buffer Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/audio/sb16: Restrict I/O sampling rate range for command 41h/42hQiang Liu2021-06-241-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The I/O sampling rate range is enforced to 5000 to 45000HZ according to commit a2cd86a9. Setting I/O sampling rate with command 41h/42h, a guest user can break this assumption and trigger an assertion in audio_calloc via command 0xd4. This patch restricts the I/O sampling rate range for command 41h/42h. Fixes: 85571bc7415 ("audio merge (malc)") Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Message-Id: <1624502687-5214-1-git-send-email-cyruscyliu@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | | fuzz: Display hexadecimal value with '0x' prefixPhilippe Mathieu-Daudé2021-06-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use memory_region_size() to get the MemoryRegion size, and display it with the '0x' prefix. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210612195842.1595999-1-f4bug@amsat.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | | Remove leading underscores from QEMU definesAhmed Abouzied2021-06-211-2/+2
|/ / | | | | | | | | | | | | | | | | | | | | Leading underscores followed by a capital letter or underscore are reserved by the C standard. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/369 Signed-off-by: Ahmed Abouzied <email@aabouzied.com> Message-Id: <20210605174938.13782-1-email@aabouzied.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* / hw/audio/sb16: Avoid assertion by restricting I/O sampling rate rangePhilippe Mathieu-Daudé2021-06-172-0/+53
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While the SB16 seems to work up to 48000 Hz, the "Sound Blaster Series Hardware Programming Guide" limit the sampling range from 4000 Hz to 44100 Hz (Section 3-9, 3-10: Digitized Sound I/O Programming, tables 3-2 and 3-3). Later, section 6-15 (DSP Commands) is more specific regarding the 41h / 42h registers (Set digitized sound output sampling rate): Valid sampling rates range from 5000 to 45000 Hz inclusive. There is no comment regarding error handling if the register is filled with an out-of-range value. (See also section 3-28 "8-bit or 16-bit Auto-initialize Transfer"). Assume limits are enforced in hardware. This fixes triggering an assertion in audio_calloc(): #1 abort #2 audio_bug audio/audio.c:119:9 #3 audio_calloc audio/audio.c:154:9 #4 audio_pcm_sw_alloc_resources_out audio/audio_template.h:116:15 #5 audio_pcm_sw_init_out audio/audio_template.h:175:11 #6 audio_pcm_create_voice_pair_out audio/audio_template.h:410:9 #7 AUD_open_out audio/audio_template.h:503:14 #8 continue_dma8 hw/audio/sb16.c:216:20 #9 dma_cmd8 hw/audio/sb16.c:276:5 #10 command hw/audio/sb16.c:0 #11 dsp_write hw/audio/sb16.c:949:13 #12 portio_write softmmu/ioport.c:205:13 #13 memory_region_write_accessor softmmu/memory.c:491:5 #14 access_with_adjusted_size softmmu/memory.c:552:18 #15 memory_region_dispatch_write softmmu/memory.c:0:13 #16 flatview_write_continue softmmu/physmem.c:2759:23 #17 flatview_write softmmu/physmem.c:2799:14 #18 address_space_write softmmu/physmem.c:2891:18 #19 cpu_outw softmmu/ioport.c:70:5 [*] http://www.baudline.com/solutions/full_duplex/sb16_pci/index.html OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29174 Fixes: 85571bc7415 ("audio merge (malc)") Buglink: https://bugs.launchpad.net/bugs/1910603 Tested-by: Qiang Liu <cyruscyliu@gmail.com> Reviewed-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210616104349.2398060-1-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* tests/qtest/virtio-scsi-test: add unmap large LBA with 4k blocks testKit Westneat2021-06-041-0/+51
| | | | | | | | Add test for issue #345 Signed-off-by: Kit Westneat <kit.westneat@gmail.com> Message-Id: <20210603142022.676395-1-kit.westneat@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* tests/qtest/tpm-tests: Remove unnecessary NULL checksPeter Maydell2021-06-031-8/+4Star
| | | | | | | | | | | | | | | Coverity points out that in tpm_test_swtpm_migration_test() we assume that src_tpm_addr and dst_tpm_addr are non-NULL (we pass them to tpm_util_migration_start_qemu() which will unconditionally dereference them) but then later explicitly check them for NULL. Remove the pointless checks. Fixes: Coverity CID 1432367, 1432359 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20210525134458.6675-6-peter.maydell@linaro.org
* tests/qtest/pflash-cfi02-test: Avoid potential integer overflowPeter Maydell2021-06-031-1/+1
| | | | | | | | | | | | Coverity points out that we calculate a 64-bit value using 32-bit arithmetic; add the cast to force the multiply to be done as 64-bits. (The overflow will never happen with the current test data.) Fixes: Coverity CID 1432320 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20210525134458.6675-5-peter.maydell@linaro.org
* tests/qtest/hd-geo-test: Fix checks on mkstemp() return valuePeter Maydell2021-06-031-2/+2
| | | | | | | | | | | | | Coverity notices that the checks against mkstemp() failing in create_qcow2_with_mbr() are wrong: mkstemp returns -1 on failure but the check is just "g_assert(fd)". Fix to use "g_assert(fd >= 0)", matching the correct check in create_test_img(). Fixes: Coverity CID 1432274 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20210525134458.6675-4-peter.maydell@linaro.org
* tests/qtest/e1000e-test: Check qemu_recv() succeededPeter Maydell2021-06-031-1/+2
| | | | | | | | | | | | | | The e1000e_send_verify() test calls qemu_recv() but doesn't check that the call succeeded, which annoys Coverity. Add an explicit test check for the length of the data. (This is a test check, not a "we assume this syscall always succeeds", so we use g_assert_cmpint() rather than g_assert().) Fixes: Coverity CID 1432324 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20210525134458.6675-3-peter.maydell@linaro.org
* tests/qtest/bios-tables-test: Check for dup2() failurePeter Maydell2021-06-031-2/+6
| | | | | | | | | | | | Coverity notes that we don't check for dup2() failing. Add some assertions so that if it does ever happen we get some indication. (This is similar to how we handle other "don't expect this syscall to fail" checks in this test code.) Fixes: Coverity CID 1432346 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Message-id: 20210525134458.6675-2-peter.maydell@linaro.org
* tests/qtest/fuzz: Fix build failurePhilippe Mathieu-Daudé2021-05-261-0/+1
| | | | | | | | | | | | | | | On Fedora 32, using clang (version 10.0.1-3.fc32) we get: tests/qtest/fuzz/fuzz.c:237:5: error: implicit declaration of function 'qemu_init' is invalid in C99 [-Werror,-Wimplicit-function-declaration] qemu_init(result.we_wordc, result.we_wordv, NULL); ^ qemu_init() is declared in "sysemu/sysemu.h", include this header to fix. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210513162008.3922223-1-philmd@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vhost-user-blk-test: test discard/write zeroes invalid inputsStefan Hajnoczi2021-05-181-0/+124
| | | | | | | | | | | Exercise input validation code paths in block/export/vhost-user-blk-server.c. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210309094106.196911-5-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210322092327.150720-4-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* tests/qtest: add multi-queue test case to vhost-user-blk-testStefan Hajnoczi2021-05-181-5/+76
| | | | | | | | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210309094106.196911-4-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210322092327.150720-3-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* test: new qTest case to test the vhost-user-blk-serverCoiby Xu2021-05-185-0/+977
| | | | | | | | | | | | | | | This test case has the same tests as tests/virtio-blk-test.c except for tests have block_resize. Since the vhost-user-blk export only serves one client one time, two exports are started by qemu-storage-daemon for the hotplug test. Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Coiby Xu <coiby.xu@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210309094106.196911-3-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-Id: <20210322092327.150720-2-stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* tests/qtest/migration-test: Use g_autofree to avoid leaks on error pathsPeter Maydell2021-05-141-41/+20Star
| | | | | | | | | | | | | | | | | | | Coverity notices that several places in the migration-test code fail to free memory in error-exit paths. This is pretty unimportant in test case code, but we can avoid having to manually free the memory entirely by using g_autofree. The places where Coverity spotted a leak were relating to early exits not freeing 'uri' in test_precopy_unix(), do_test_validate_uuid(), migrate_postcopy_prepare() and test_migrate_auto_converge(). This patch converts all the string-allocation in the test code to g_autofree for consistency. Fixes: Coverity CID 1432313, 1432315, 1432352, 1432364 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20210506185819.9010-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests: Avoid side effects inside g_assert() argumentsPeter Maydell2021-05-142-3/+6
| | | | | | | | | | | | | | For us, assertions are always enabled, but side-effect expressions inside the argument to g_assert() are bad style anyway. Fix three occurrences in IPMI related tests, which will silence some Coverity nits. Fixes: CID 1432322, CID 1432287, CID 1432291 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210503165525.26221-4-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest/rtc-test: Remove pointless NULL checkPeter Maydell2021-05-141-4/+2Star
| | | | | | | | | | | | | | | In rtc-test.c we know that s is non-NULL because qtest_start() will return a non-NULL value, and we assume this when we pass s to qtest_irq_intercept_in(). So we can drop the initial assignment of NULL and the "if (s)" condition at the end of the function. Fixes: Coverity CID 1432353 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210503165525.26221-3-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest/tpm-util.c: Free memory with correct free functionPeter Maydell2021-05-141-2/+2
| | | | | | | | | | | | | tpm_util_migration_start_qemu() allocates memory with g_strdup_printf() but frees it with free() rather than g_free(), which provokes Coverity complaints (CID 1432379, 1432350). Use the correct free function. Fixes: Coverity CID 1432379, CID 1432350 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210503165525.26221-2-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/migration-test: Fix "true" vs trueDr. David Alan Gilbert2021-05-141-7/+7
| | | | | | | | | | | | | | | Accidental use of "true" as a boolean; spotted by coverity and Peter. Fixes: b99784ef6c3 Fixes: d795f47466e Reported-by: Peter Maydell <peter.maydell@linaro.org> Reported-by: Coverity (CID 1432373, 1432292, 1432288) Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210504100545.112213-1-dgilbert@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest/npcm7xx_pwm-test.c: Avoid g_assert_true() for non-test assertionsPeter Maydell2021-05-141-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In the glib API, the distinction between g_assert() and g_assert_true() is that the former is for "bug, terminate the application" and the latter is for "test check, on failure either terminate or just mark the testcase as failed". For QEMU, g_assert() is always fatal, so code can assume that if the assertion fails execution does not proceed, but this is not true of g_assert_true(). In npcm7xx_pwm-test, the pwm_index() and pwm_module_index() functions include some assertions that are just guarding against possible bugs in the test code that might lead us to out-of-bounds array accesses. These should use g_assert() because they aren't part of what the test is testing and the code does not correctly handle the case where the condition was false. This fixes some Coverity issues where Coverity knows that g_assert_true() can continue when the condition is false and complains about the possible array overrun at various callsites. Fixes: Coverity CID 1442340, 1442341, 1442343, 1442344, 1442345, 1442346 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com> Message-Id: <20210505135516.21097-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest/ahci-test.c: Calculate iso_size with 64-bit arithmeticPeter Maydell2021-05-141-2/+2
| | | | | | | | | | | | | | Coverity notes that when calculating the 64-bit iso_size value in ahci_test_cdrom() we actually only do it with 32-bit arithmetic. This doesn't matter for the current test code because nsectors is always small; but adding the cast avoids the coverity complaints. Fixes: Coverity CID 1432343 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-Id: <20210506194358.3925-1-peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* libqtest: refuse QTEST_QEMU_BINARY=qemu-kvmStefan Hajnoczi2021-05-141-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | Some downstreams rename the QEMU binary to "qemu-kvm". This breaks qtest_get_arch(), which attempts to parse the target architecture from the QTEST_QEMU_BINARY environment variable. Print an error instead of returning the architecture "kvm". Things fail in weird ways when the architecture string is bogus. Arguably qtests should always be run in a build directory instead of against an installed QEMU. In any case, printing a clear error when this happens is helpful. Since this is an error that is triggered by the user and not a test failure, use exit(1) instead of abort(). Change the existing abort() call in qtest_get_arch() to exit(1) too for the same reason and to be consistent. Reported-by: Qin Wang <qinwang@rehdat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Cc: Emanuele Giuseppe Esposito <eesposit@redhat.com> Message-Id: <20210412143050.725918-1-stefanha@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* libqos/qgraph: fix "UNAVAILBLE" typoStefan Hajnoczi2021-05-141-1/+1
| | | | | | | | Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20210412143437.727560-2-stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* Drop the deprecated unicore32 targetMarkus Armbruster2021-05-121-1/+0Star
| | | | | | | | | | Target unicore32 was deprecated in commit 8e4ff4a8d2b, v5.2.0. See there for rationale. Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210503084034.3804963-3-armbru@redhat.com> Acked-by: Thomas Huth <thuth@redhat.com>
* Drop the deprecated lm32 targetMarkus Armbruster2021-05-121-1/+0Star
| | | | | | | | | | | | | | Target lm32 was deprecated in commit d8498005122, v5.2.0. See there for rationale. Some of its code lives on in device models derived from milkymist ones: hw/char/digic-uart.c and hw/display/bcm2835_fb.c. Cc: Michael Walle <michael@walle.cc> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20210503084034.3804963-2-armbru@redhat.com> Acked-by: Michael Walle <michael@walle.cc> [Trivial conflicts resolved, reST markup fixed]
* Remove the deprecated moxie targetThomas Huth2021-05-123-11/+0Star
| | | | | | | | | | | | | | | There are no known users of this CPU anymore, and there are no binaries available online which could be used for regression tests, so the code has likely completely bit-rotten already. It's been marked as deprecated since two releases now and nobody spoke up that there is still a need to keep it, thus let's remove it now. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210430160355.698194-1-thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [Commit message typos fixed, trivial conflicts resolved] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* Merge remote-tracking branch ↵Peter Maydell2021-05-053-5/+0Star
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/vivier2/tags/trivial-branch-for-6.1-pull-request' into staging Trivial patches pull request 20210503 # gpg: Signature made Mon 03 May 2021 09:34:56 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-for-6.1-pull-request: (23 commits) hw/rx/rx-gdbsim: Do not accept invalid memory size docs: More precisely describe memory-backend-*::id's user scripts: fix generation update-binfmts templates docs/system: Document the removal of "compat" property for POWER CPUs mc146818rtc: put it into the 'misc' category Do not include exec/address-spaces.h if it's not really necessary Do not include cpu.h if it's not really necessary Do not include hw/boards.h if it's not really necessary Do not include sysemu/sysemu.h if it's not really necessary hw: Do not include qemu/log.h if it is not necessary hw: Do not include hw/irq.h if it is not necessary hw: Do not include hw/sysbus.h if it is not necessary hw: Remove superfluous includes of hw/hw.h ui: Fix memory leak in qemu_xkeymap_mapping_table() hw/usb: Constify VMStateDescription hw/display/qxl: Constify VMStateDescription hw/arm: Constify VMStateDescription vmstate: Constify some VMStateDescriptions Fix typo in CFI build documentation hw/pcmcia: Do not register PCMCIA type if not required ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * Do not include exec/address-spaces.h if it's not really necessaryThomas Huth2021-05-022-3/+0Star
| | | | | | | | | | | | | | | | Stop including exec/address-spaces.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-5-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
| * Do not include sysemu/sysemu.h if it's not really necessaryThomas Huth2021-05-022-2/+0Star
| | | | | | | | | | | | | | | | Stop including sysemu/sysemu.h in files that don't need it. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20210416171314.2074665-2-thuth@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
* | tests/qtest: Rename m25p80 test in aspeed_smc testCédric Le Goater2021-05-012-8/+8
| | | | | | | | | | | | | | | | | | | | The m25p80 test depends on the Aspeed SMC controller to test our SPI-NOR flash support. Reflect this dependency by changing the name. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210407171637.777743-17-clg@kaod.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
* | tests/qtest: Add test for Aspeed HACEJoel Stanley2021-05-012-0/+472
|/ | | | | | | | | | | | | | | | | | This adds a test for the Aspeed Hash and Crypto (HACE) engine. It tests the currently implemented behavior of the hash functionality. The tests are similar, but are cut/pasted instead of broken out into a common function so the assert machinery produces useful output when a test fails. Co-developed-by: Cédric Le Goater <clg@kaod.org> Co-developed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com> Acked-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Joel Stanley <joel@jms.id.au> Message-Id: <20210409000253.1475587-4-joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org>
* tests/qtest: add tests for am53c974 deviceMark Cave-Ayland2021-04-122-0/+219
| | | | | | | | | Use the autogenerated fuzzer test cases as the basis for a set of am53c974 regression tests. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-13-mark.cave-ayland@ilande.co.uk>
* Revert "tests: Add tests for query-netdev command"Jason Wang2021-04-082-123/+0Star
| | | | | | | | Several issues has been reported for query-netdev series. Consider it's late in the rc, this reverts commit 3c3b656885473ef0d699290ba966177f17839aa5. Signed-off-by: Jason Wang <jasowang@redhat.com>
* x86: rename oem-id and oem-table-id propertiesPaolo Bonzini2021-04-041-1/+1
| | | | | | | | | | | | | | | After introducing non-scalar machine properties, it would be preferrable to have a single acpitable property which includes both generic information (such as the OEM ids) and custom tables currently passed via -acpitable. Do not saddle ourselves with legacy oem-id and oem-table-id properties, instead mark them as experimental. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20210402082128.13854-1-pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* net/npcm7xx_emc.c: Fix handling of receiving packets when RSDR not setDoug Evans2021-03-301-9/+21
| | | | | | | | | Turning REG_MCMDR_RXON is enough to start receiving packets. Signed-off-by: Doug Evans <dje@google.com> Message-id: 20210319195044.741821-1-dje@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* memory: Add offset_in_region to flatview_cb argumentsPeter Maydell2021-03-231-1/+4
| | | | | | | | | | | | | The function flatview_for_each_range() calls a callback for each range in a FlatView. Currently the callback gets the start and length of the range and the MemoryRegion involved, but not the offset within the MemoryRegion. Add this to the callback's arguments; we're going to want it for a new use in the next commit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210318174823.18066-4-peter.maydell@linaro.org
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-12-12 07:31:51 +0100