[V4,4/7] CAN bus Kvaser PCI CAN-S (single SJA1000 channel) emulation added.

From: Pavel Pisa <pisa@cmp.felk.cvut.cz>

Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
---
 default-configs/pci.mak |   1 +
 hw/can/Makefile.objs    |   1 +
 hw/can/can_kvaser_pci.c | 375 ++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 377 insertions(+)
 create mode 100644 hw/can/can_kvaser_pci.c

On 01/14/2018 05:14 PM, pisa@cmp.felk.cvut.cz wrote:
> From: Pavel Pisa <pisa@cmp.felk.cvut.cz>
> 
> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
> ---
>  default-configs/pci.mak |   1 +
>  hw/can/Makefile.objs    |   1 +
>  hw/can/can_kvaser_pci.c | 375 ++++++++++++++++++++++++++++++++++++++++++++++++
>  3 files changed, 377 insertions(+)
>  create mode 100644 hw/can/can_kvaser_pci.c
> 
> diff --git a/default-configs/pci.mak b/default-configs/pci.mak
> index 979b649fe5..72c0802ced 100644
> --- a/default-configs/pci.mak
> +++ b/default-configs/pci.mak
> @@ -33,6 +33,7 @@ CONFIG_SERIAL_ISA=y
>  CONFIG_SERIAL_PCI=y
>  CONFIG_CAN_CORE=y
>  CONFIG_CAN_SJA1000=y
> +CONFIG_CAN_PCI=y
>  CONFIG_IPACK=y
>  CONFIG_WDT_IB6300ESB=y
>  CONFIG_PCI_TESTDEV=y
> diff --git a/hw/can/Makefile.objs b/hw/can/Makefile.objs
> index 3c4bf3bfc1..c9d07b9b16 100644
> --- a/hw/can/Makefile.objs
> +++ b/hw/can/Makefile.objs
> @@ -8,4 +8,5 @@ else
>  common-obj-y += can_host_stub.o
>  endif
>  common-obj-$(CONFIG_CAN_SJA1000) += can_sja1000.o
> +common-obj-$(CONFIG_CAN_PCI) += can_kvaser_pci.o
>  endif
> diff --git a/hw/can/can_kvaser_pci.c b/hw/can/can_kvaser_pci.c
> new file mode 100644
> index 0000000000..7e3f28d83c
> --- /dev/null
> +++ b/hw/can/can_kvaser_pci.c
> @@ -0,0 +1,375 @@
> +/*
> + * Kvaser PCI CAN device (SJA1000 based) emulation
> + *
> + * Copyright (c) 2013-2014 Jin Yang
> + * Copyright (c) 2014-2018 Pavel Pisa
> + *
> + * Partially based on educational PCIexpress APOHW hardware
> + * emulator used fro class A0B36APO at CTU FEE course by
> + *    Rostislav Lisovy and Pavel Pisa
> + *
> + * Initial development supported by Google GSoC 2013 from RTEMS project slot
> + *
> + * Permission is hereby granted, free of charge, to any person obtaining a copy
> + * of this software and associated documentation files (the "Software"), to deal
> + * in the Software without restriction, including without limitation the rights
> + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> + * copies of the Software, and to permit persons to whom the Software is
> + * furnished to do so, subject to the following conditions:
> + *
> + * The above copyright notice and this permission notice shall be included in
> + * all copies or substantial portions of the Software.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
> + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
> + * THE SOFTWARE.
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qemu/event_notifier.h"
> +#include "qemu/thread.h"
> +#include "qemu/sockets.h"
> +#include "qemu/error-report.h"
> +#include "chardev/char.h"
> +#include "hw/hw.h"
> +#include "hw/pci/pci.h"
> +#include "can/can_emu.h"
> +
> +#include "can_sja1000.h"
> +
> +#define TYPE_CAN_PCI_DEV "kvaser_pci"
> +
> +#define KVASER_PCI_DEV(obj) \
> +    OBJECT_CHECK(KvaserPCIState, (obj), TYPE_CAN_PCI_DEV)
> +
> +#ifndef KVASER_PCI_VENDOR_ID1
> +#define KVASER_PCI_VENDOR_ID1     0x10e8    /* the PCI device and vendor IDs */
> +#endif
> +
> +#ifndef KVASER_PCI_DEVICE_ID1
> +#define KVASER_PCI_DEVICE_ID1     0x8406
> +#endif
> +
> +#define KVASER_PCI_S5920_RANGE    0x80
> +#define KVASER_PCI_SJA_RANGE      0x80
> +#define KVASER_PCI_XILINX_RANGE   0x8
> +
> +#define KVASER_PCI_BYTES_PER_SJA  0x20
> +
> +#define S5920_OMB                 0x0C
> +#define S5920_IMB                 0x1C
> +#define S5920_MBEF                0x34
> +#define S5920_INTCSR              0x38
> +#define S5920_RCR                 0x3C
> +#define S5920_PTCR                0x60
> +
> +#define S5920_INTCSR_ADDON_INTENABLE_M        0x2000
> +#define S5920_INTCSR_INTERRUPT_ASSERTED_M     0x800000
> +
> +#define KVASER_PCI_XILINX_VERINT  7   /* Lower nibble simulate interrupts,
> +                                         high nibble version number. */
> +
> +#define KVASER_PCI_XILINX_VERSION_NUMBER 13
> +
> +typedef struct KvaserPCIState {
> +    /*< private >*/
> +    PCIDevice       dev;
> +    /*< public >*/
> +    MemoryRegion    s5920_io;
> +    MemoryRegion    sja_io;
> +    MemoryRegion    xilinx_io;
> +
> +    CanSJA1000State sja_state;
> +    qemu_irq        irq;
> +
> +    uint32_t        s5920_intcsr;
> +    uint32_t        s5920_irqstate;
> +
> +    char            *model; /* The model that support, only SJA1000 now. */
> +    char            *canbus;
> +    char            *host;
> +} KvaserPCIState;
> +
> +static void kvaser_pci_irq_raise(void *opaque)
> +{
> +    KvaserPCIState *d = (KvaserPCIState *)opaque;
> +    d->s5920_irqstate = 1;
> +
> +    if (d->s5920_intcsr & S5920_INTCSR_ADDON_INTENABLE_M) {
> +        qemu_irq_raise(d->irq);
> +    }
> +}
> +
> +static void kvaser_pci_irq_lower(void *opaque)
> +{
> +    KvaserPCIState *d = (KvaserPCIState *)opaque;
> +    d->s5920_irqstate = 0;
> +    qemu_irq_lower(d->irq);
> +}
> +
> +static void
> +kvaser_pci_reset(void *opaque)

static void kvaser_pci_reset(void *opaque)

> +{
> +    KvaserPCIState *d = (KvaserPCIState *)opaque;
> +    CanSJA1000State *s = &d->sja_state;
> +
> +    can_sja_hardware_reset(s);
> +}
> +
> +static uint64_t kvaser_pci_s5920_io_read(void *opaque, hwaddr addr,
> +                             unsigned size)

weird align

> +{
> +    KvaserPCIState *d = opaque;
> +    uint64_t val;
> +
> +    switch (addr) {
> +    case S5920_INTCSR:
> +        val = d->s5920_intcsr;
> +        val &= ~S5920_INTCSR_INTERRUPT_ASSERTED_M;
> +        if (d->s5920_irqstate) {
> +            val |= S5920_INTCSR_INTERRUPT_ASSERTED_M;
> +        }
> +        return val;
> +    }
> +    return 0;
> +}
> +
> +static void kvaser_pci_s5920_io_write(void *opaque, hwaddr addr, uint64_t data,
> +                                      unsigned size)
> +{
> +    KvaserPCIState *d = opaque;
> +
> +    switch (addr) {
> +    case S5920_INTCSR:
> +        if (~d->s5920_intcsr & data & S5920_INTCSR_ADDON_INTENABLE_M) {
> +            if (d->s5920_irqstate) {
> +                qemu_irq_raise(d->irq);
> +            }
> +        }
> +        d->s5920_intcsr = data;
> +        break;
> +    }
> +}
> +
> +static uint64_t kvaser_pci_sja_io_read(void *opaque, hwaddr addr, unsigned size)
> +{
> +    KvaserPCIState *d = opaque;
> +    CanSJA1000State *s = &d->sja_state;
> +
> +    if (addr >= KVASER_PCI_BYTES_PER_SJA) {
> +        return 0;
> +    }
> +
> +    return can_sja_mem_read(s, addr, size);
> +}
> +
> +static void kvaser_pci_sja_io_write(void *opaque, hwaddr addr, uint64_t data,
> +                                    unsigned size)
> +{
> +    KvaserPCIState *d = opaque;
> +    CanSJA1000State *s = &d->sja_state;
> +
> +    if (addr >= KVASER_PCI_BYTES_PER_SJA) {
> +        return;
> +    }
> +
> +    can_sja_mem_write(s, addr, data, size);
> +}
> +
> +static uint64_t kvaser_pci_xilinx_io_read(void *opaque, hwaddr addr,
> +                                          unsigned size)
> +{
> +    /*KvaserPCIState *d = opaque;*/

remove?

it would be nice to have trace events here (later).

> +
> +    switch (addr) {
> +    case KVASER_PCI_XILINX_VERINT:
> +        return (KVASER_PCI_XILINX_VERSION_NUMBER << 4) | 0;
> +    }
> +
> +    return 0;
> +}
> +
> +static void kvaser_pci_xilinx_io_write(void *opaque, hwaddr addr, uint64_t data,
> +                             unsigned size)
> +{
> +    /*KvaserPCIState *d = opaque;*/

also trace events.

> +}
> +
> +static const MemoryRegionOps kvaser_pci_s5920_io_ops = {
> +    .read = kvaser_pci_s5920_io_read,
> +    .write = kvaser_pci_s5920_io_write,
> +    .endianness = DEVICE_LITTLE_ENDIAN,
> +    .impl = {
> +        .min_access_size = 4,
> +        .max_access_size = 4,
> +    },
> +};
> +
> +static const MemoryRegionOps kvaser_pci_sja_io_ops = {
> +    .read = kvaser_pci_sja_io_read,
> +    .write = kvaser_pci_sja_io_write,
> +    .endianness = DEVICE_LITTLE_ENDIAN,
> +    .impl = {
> +        .min_access_size = 1,

superfluous ^

> +        .max_access_size = 1,
> +    },
> +};
> +
> +static const MemoryRegionOps kvaser_pci_xilinx_io_ops = {
> +    .read = kvaser_pci_xilinx_io_read,
> +    .write = kvaser_pci_xilinx_io_write,
> +    .endianness = DEVICE_LITTLE_ENDIAN,
> +    .impl = {
> +        .min_access_size = 1,

ditto

> +        .max_access_size = 1,
> +    },
> +};
> +
> +static int kvaser_pci_init(PCIDevice *pci_dev)
> +{
> +    KvaserPCIState *d = KVASER_PCI_DEV(pci_dev);
> +    CanSJA1000State *s = &d->sja_state;
> +    uint8_t *pci_conf;
> +    CanBusState *can_bus;
> +
> +    if (d->model) {
> +        if (strncmp(d->model, "pcican-s", 256)) { /* for security reason */

Why 256?

> +            error_report("Can't create CAN device, "
> +                         "the model %s is not supported now.", d->model);
> +            exit(1);
> +        }
> +    }
> +
> +    can_bus = can_bus_find_by_name(d->canbus, true);
> +    if (can_bus == NULL) {
> +        error_report("Cannot create can find/allocate CAN bus");
> +        exit(1);
> +
> +    }
> +
> +    if (d->host != NULL) {
> +        if (can_bus_connect_to_host_device(can_bus, d->host) < 0) {
> +            error_report("Cannot connect CAN bus to host device \"%s\"",
> +                         d->host);
> +            exit(1);
> +        }
> +    }
> +
> +    pci_conf = pci_dev->config;
> +    pci_conf[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
> +
> +    d->irq = pci_allocate_irq(&d->dev);
> +
> +    can_sja_init(s, kvaser_pci_irq_raise, kvaser_pci_irq_lower, d);
> +
> +    qemu_register_reset(kvaser_pci_reset, d);
> +
> +    if (can_sja_connect_to_bus(s, can_bus) < 0) {
> +        error_report("can_sja_connect_to_bus failed");
> +        exit(1);
> +    }
> +
> +    memory_region_init_io(&d->s5920_io, OBJECT(d), &kvaser_pci_s5920_io_ops,
> +                          d, "kvaser_pci-s5920", KVASER_PCI_S5920_RANGE);
> +    memory_region_init_io(&d->sja_io, OBJECT(d), &kvaser_pci_sja_io_ops,
> +                          d, "kvaser_pci-sja", KVASER_PCI_SJA_RANGE);
> +    memory_region_init_io(&d->xilinx_io, OBJECT(d), &kvaser_pci_xilinx_io_ops,
> +                          d, "kvaser_pci-xilinx", KVASER_PCI_XILINX_RANGE);
> +
> +    pci_register_bar(&d->dev, /*BAR*/ 0, PCI_BASE_ADDRESS_SPACE_IO,
> +                                            &d->s5920_io);
> +    pci_register_bar(&d->dev, /*BAR*/ 1, PCI_BASE_ADDRESS_SPACE_IO,
> +                                            &d->sja_io);
> +    pci_register_bar(&d->dev, /*BAR*/ 2, PCI_BASE_ADDRESS_SPACE_IO,
> +                                            &d->xilinx_io);
> +
> +    return 0;
> +}
> +
> +static void kvaser_pci_exit(PCIDevice *pci_dev)
> +{
> +    KvaserPCIState *d = KVASER_PCI_DEV(pci_dev);
> +    CanSJA1000State *s = &d->sja_state;
> +
> +    can_sja_disconnect(s);
> +
> +    qemu_unregister_reset(kvaser_pci_reset, d);
> +
> +    /*
> +     * regions d->s5920_io, d->sja_io and d->xilinx_io
> +     * are destroyed by QOM now
> +     */
> +
> +    can_sja_exit(s);
> +
> +    qemu_free_irq(d->irq);
> +}
> +
> +static const VMStateDescription vmstate_kvaser_pci = {
> +    .name = "kvaser_pci",
> +    .version_id = 1,
> +    .minimum_version_id = 1,
> +    .minimum_version_id_old = 1,
> +    .fields = (VMStateField[]) {
> +        VMSTATE_PCI_DEVICE(dev, KvaserPCIState),
> +        VMSTATE_STRUCT(sja_state, KvaserPCIState, 0, vmstate_can_sja,
> +                       CanSJA1000State),
> +        /*char *model,*/
> +        VMSTATE_UINT32(s5920_intcsr, KvaserPCIState),
> +        VMSTATE_UINT32(s5920_irqstate, KvaserPCIState),
> +        VMSTATE_END_OF_LIST()
> +    }
> +};
> +
> +static void qdev_kvaser_pci_reset(DeviceState *dev)
> +{
> +    KvaserPCIState *d = KVASER_PCI_DEV(dev);
> +    kvaser_pci_reset(d);
> +}
> +
> +static Property kvaser_pci_properties[] = {
> +    DEFINE_PROP_STRING("canbus",   KvaserPCIState, canbus),
> +    DEFINE_PROP_STRING("host",  KvaserPCIState, host),
> +    DEFINE_PROP_STRING("model", KvaserPCIState, model),
> +    DEFINE_PROP_END_OF_LIST(),
> +};
> +
> +static void kvaser_pci_class_init(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
> +
> +    k->init = kvaser_pci_init;
> +    k->exit = kvaser_pci_exit;
> +    k->vendor_id = KVASER_PCI_VENDOR_ID1;
> +    k->device_id = KVASER_PCI_DEVICE_ID1;
> +    k->revision = 0x00;
> +    k->class_id = 0x00ff00;
> +    dc->desc = "Kvaser PCICANx";
> +    dc->props = kvaser_pci_properties;
> +    dc->vmsd = &vmstate_kvaser_pci;
> +    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
> +    dc->reset = qdev_kvaser_pci_reset;
> +}
> +
> +static const TypeInfo kvaser_pci_info = {
> +    .name          = TYPE_CAN_PCI_DEV,
> +    .parent        = TYPE_PCI_DEVICE,
> +    .instance_size = sizeof(KvaserPCIState),
> +    .class_init    = kvaser_pci_class_init,
> +    .interfaces = (InterfaceInfo[]) {
> +        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
> +        { },
> +    },
> +};
> +
> +static void kvaser_pci_register_types(void)
> +{
> +    type_register_static(&kvaser_pci_info);
> +}
> +
> +type_init(kvaser_pci_register_types)
>

On 14.01.2018 21:14, pisa@cmp.felk.cvut.cz wrote:
> From: Pavel Pisa <pisa@cmp.felk.cvut.cz>
> 
> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
> ---
>  default-configs/pci.mak |   1 +
>  hw/can/Makefile.objs    |   1 +
>  hw/can/can_kvaser_pci.c | 375 ++++++++++++++++++++++++++++++++++++++++++++++++
>  3 files changed, 377 insertions(+)
>  create mode 100644 hw/can/can_kvaser_pci.c

 Hi,

the kvaser_pci device introduced a new way to crash QEMU, e.g.:

mips64el-softmmu/qemu-system-mips64el -M malta,accel=qtest \
                                      -device kvaser_pci

Program received signal SIGSEGV, Segmentation fault.
0x0000555555a6e2ec in can_bus_insert_client (bus=0x0, client=client@entry=0x5555570c4018)
    at /home/thuth/devel/qemu/net/can/can_core.c:50
50	    QTAILQ_INSERT_TAIL(&bus->clients, client, next);
(gdb) bt
#0  0x0000555555a6e2ec in can_bus_insert_client (bus=0x0, client=client@entry=0x5555570c4018)
    at /home/thuth/devel/qemu/net/can/can_core.c:50
#1  0x00005555559d7364 in can_sja_connect_to_bus (s=s@entry=0x5555570c3f80, bus=<optimized out>)
    at /home/thuth/devel/qemu/hw/net/can/can_sja1000.c:869
#2  0x00005555559d75a4 in kvaser_pci_realize (pci_dev=0x5555570c33d0, errp=0x7fffffffd8e0)
    at /home/thuth/devel/qemu/hw/net/can/can_kvaser_pci.c:230
#3  0x00005555559e12f1 in pci_qdev_realize (qdev=0x5555570c33d0, errp=0x7fffffffd980)
    at /home/thuth/devel/qemu/hw/pci/pci.c:2029
#4  0x0000555555963c3a in device_set_realized (obj=<optimized out>, value=<optimized out>, errp=0x7fffffffdab8)
    at /home/thuth/devel/qemu/hw/core/qdev.c:852
#5  0x0000555555aa7a7e in property_set_bool (obj=0x5555570c33d0, v=<optimized out>, name=<optimized out>, opaque=0x555556f6d220, errp=0x7fffffffdab8) at /home/thuth/devel/qemu/qom/object.c:1906
#6  0x0000555555aabbef in object_property_set_qobject (obj=obj@entry=0x5555570c33d0, value=value@entry=0x5555570c4a60, name=name@entry=0x555555c7079f "realized", errp=errp@entry=0x7fffffffdab8)
    at /home/thuth/devel/qemu/qom/qom-qobject.c:27
#7  0x0000555555aa9860 in object_property_set_bool (obj=0x5555570c33d0, value=<optimized out>, name=0x555555c7079f "realized", errp=0x7fffffffdab8) at /home/thuth/devel/qemu/qom/object.c:1171
#8  0x00005555558eb1d9 in qdev_device_add (opts=0x55555689ff40, errp=errp@entry=0x7fffffffdb90)
    at /home/thuth/devel/qemu/qdev-monitor.c:634
#9  0x00005555558ed547 in device_init_func (opaque=<optimized out>, opts=<optimized out>, errp=<optimized out>)
    at /home/thuth/devel/qemu/vl.c:2350
#10 0x0000555555b8d75a in qemu_opts_foreach (list=<optimized out>, func=func@entry=
    0x5555558ed520 <device_init_func>, opaque=opaque@entry=0x0, errp=errp@entry=0x0)
    at /home/thuth/devel/qemu/util/qemu-option.c:1073
#11 0x00005555557b8f64 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>)
    at /home/thuth/devel/qemu/vl.c:4618

Could you please fix this?

 Thanks,
  Thomas

Hello Thomas,

thanks for report but I at this time I am and
can be some time in condition which does not allow
me to access e-mail and normal work

On Tuesday 06 of March 2018 16:29:19 Thomas Huth wrote:
> On 14.01.2018 21:14, pisa@cmp.felk.cvut.cz wrote:
> > From: Pavel Pisa <pisa@cmp.felk.cvut.cz>
> >
> > Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
> > ---
> >  default-configs/pci.mak |   1 +
> >  hw/can/Makefile.objs    |   1 +
> >  hw/can/can_kvaser_pci.c | 375
> > ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 377
> > insertions(+)
> >  create mode 100644 hw/can/can_kvaser_pci.c
>
>  Hi,
>
> the kvaser_pci device introduced a new way to crash QEMU, e.g.:
>
> mips64el-softmmu/qemu-system-mips64el -M malta,accel=qtest \
>                                       -device kvaser_pci
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000555555a6e2ec in can_bus_insert_client (bus=0x0,
> client=client@entry=0x5555570c4018) at
> /home/thuth/devel/qemu/net/can/can_core.c:50
> 50	    QTAILQ_INSERT_TAIL(&bus->clients, client, next);

The reason is that parameters canbus0 and canbus1 are required.

  -object can-bus,id=canbus0 \
  -device kvaser_pci,canbus0=canbus0

This could be be fast fix but plead somebody else to send regular
patch.

--- a/net/can/can_host.c
+++ b/net/can/can_host.c
@@ -57,6 +57,10 @@ static void can_host_connect(CanHostState *ch, Error **errp)
         return;
     }

+    if (ch->bus_client == NULL) {
+        error_setg(errp, "bus is not specified for given device.");
+        return;
+    }
     can_bus_insert_client(ch->bus, &ch->bus_client);
 }


My personal opinion is to create bus on 

Best wishes,

Pavel Pisa

On 06/03/2018 21:52, Pavel Pisa wrote:
> Hello Thomas,
> 
> thanks for report but I at this time I am and
> can be some time in condition which does not allow
> me to access e-mail and normal work
> 
> On Tuesday 06 of March 2018 16:29:19 Thomas Huth wrote:
>> On 14.01.2018 21:14, pisa@cmp.felk.cvut.cz wrote:
>>> From: Pavel Pisa <pisa@cmp.felk.cvut.cz>
>>>
>>> Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
>>> ---
>>>  default-configs/pci.mak |   1 +
>>>  hw/can/Makefile.objs    |   1 +
>>>  hw/can/can_kvaser_pci.c | 375
>>> ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 377
>>> insertions(+)
>>>  create mode 100644 hw/can/can_kvaser_pci.c
>>
>>  Hi,
>>
>> the kvaser_pci device introduced a new way to crash QEMU, e.g.:
>>
>> mips64el-softmmu/qemu-system-mips64el -M malta,accel=qtest \
>>                                       -device kvaser_pci
>>
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x0000555555a6e2ec in can_bus_insert_client (bus=0x0,
>> client=client@entry=0x5555570c4018) at
>> /home/thuth/devel/qemu/net/can/can_core.c:50
>> 50	    QTAILQ_INSERT_TAIL(&bus->clients, client, next);
> 
> The reason is that parameters canbus0 and canbus1 are required.
> 
>   -object can-bus,id=canbus0 \
>   -device kvaser_pci,canbus0=canbus0
> 
> This could be be fast fix but plead somebody else to send regular
> patch.
> 
> --- a/net/can/can_host.c
> +++ b/net/can/can_host.c
> @@ -57,6 +57,10 @@ static void can_host_connect(CanHostState *ch, Error **errp)
>          return;
>      }
> 
> +    if (ch->bus_client == NULL) {
> +        error_setg(errp, "bus is not specified for given device.");
> +        return;
> +    }
>      can_bus_insert_client(ch->bus, &ch->bus_client);
>  }

Ok, I'll check it out.

Thanks Thomas for the report!

Paolo