aboutsummaryrefslogtreecommitdiff
path: root/hw/net
AgeCommit message (Collapse)Author
2016-10-28xen: Rename xen_be_send_notifyEmil Condrea
Prepare xen_be_send_notify to be shared with frontends: * xen_be_send_notify -> xen_pv_send_notify Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Rename xen_be_unbind_evtchnEmil Condrea
Prepare xen_be_unbind_evtchn to be shared with frontends: * xen_be_unbind_evtchn -> xen_pv_unbind_evtchn Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Rename xen_be_printf to xen_pv_printfEmil Condrea
Prepare xen_be_printf to be used by both backend and frontends: * xen_be_printf -> xen_pv_printf Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Fix coding style warningsEmil Condrea
Fixes: * WARNING: line over 80 characters Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Fix coding style errorsEmil Condrea
Fixes the following errors: * ERROR: line over 90 characters * ERROR: code indent should never use tabs * ERROR: space prohibited after that open square bracket '[' * ERROR: do not initialise statics to 0 or NULL * ERROR: "(foo*)" should be "(foo *)" Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-26net: rtl8139: limit processing of ring descriptorsPrasad J Pandit
RTL8139 ethernet controller in C+ mode supports multiple descriptor rings, each with maximum of 64 descriptors. While processing transmit descriptor ring in 'rtl8139_cplus_transmit', it does not limit the descriptor count and runs forever. Add check to avoid it. Reported-by: Andrew Henderson <hendersa@icculus.org> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-10-26net: vmxnet: initialise local tx descriptorLi Qiang
In Vmxnet3 device emulator while processing transmit(tx) queue, when it reaches end of packet, it calls vmxnet3_complete_packet. In that local 'txcq_descr' object is not initialised, which could leak host memory bytes a guest. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-10-26e1000e: Don't zero out buffer address in rx descriptorKevin Wolf
The e1000e emulation zeroes out any used rx descriptor and then writes a completely newly constructed value there. By doing this, it doesn't only update the write-back area of the descriptors (as it's supposed to do), but it also clears the buffer address, which real hardware doesn't do. The spec explicitly mentions in chapter 7.1.8 that it is valid for a driver to reuse a descriptor and only update the status field while doing so, i.e. reusing the old buffer address: If software statically allocates buffers, and uses memory read to check for completed descriptors, it simply has to zero the status byte in the descriptor to make it ready for reuse by hardware. This patch fixes the behaviour to leave the buffer address in descriptors unchanged even after the descriptor has been used. Signed-off-by: Kevin Wolf <mail@kevin-wolf.de> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-10-26net: rocker: set limit to DMA buffer sizePrasad J Pandit
Rocker network switch emulator has test registers to help debug DMA operations. While testing host DMA access, a buffer address is written to register 'TEST_DMA_ADDR' and its size is written to register 'TEST_DMA_SIZE'. When performing TEST_DMA_CTRL_INVERT test, if DMA buffer size was greater than 'INT_MAX', it leads to an invalid buffer access. Limit the DMA buffer size to avoid it. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-10-26net: eepro100: fix memory leak in device uninitLi Qiang
The exit dispatch of eepro100 network card device doesn't free the 's->vmstate' field which was allocated in device realize thus leading a host memory leak. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-10-26net: pcnet: fix source formatting and indentationPrasad J Pandit
Fix indentations and source format at few places. Add braces around 'if' and 'while' statements. Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-10-26net: pcnet: check rx/tx descriptor ring lengthPrasad J Pandit
The AMD PC-Net II emulator has set of control and status(CSR) registers. Of these, CSR76 and CSR78 hold receive and transmit descriptor ring length respectively. This ring length could range from 1 to 65535. Setting ring length to zero leads to an infinite loop in pcnet_rdra_addr() or pcnet_transmit(). Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-10-10virtio: cleanup VMSTATE_VIRTIO_DEVICEHalil Pasic
Now all the usages of the old version of VMSTATE_VIRTIO_DEVICE are gone, so we can get rid of the conditionals, and the old macro. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-net: convert VMSTATE_VIRTIO_DEVICEHalil Pasic
Use the new VMSTATE_VIRTIO_DEVICE macro. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-net: handle virtio_net_flush_tx() errorsGreg Kurz
All these errors are caused by a buggy guest: let's switch the device to the broken state instead of terminating QEMU. Also we detach the element from the virtqueue and free it. If this happens, virtio_net_flush_tx() also returns -EINVAL, so that all callers can stop processing the virtqueue immediatly. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-net: handle virtio_net_receive() errorsGreg Kurz
All these errors are caused by a buggy guest: let's switch the device to the broken state instead of terminating QEMU. Also we detach the element from the virtqueue and free it. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-net: handle virtio_net_handle_ctrl() errorGreg Kurz
This error is caused by a buggy guest: let's switch the device to the broken state instead of terminating QEMU. Also we detach the element from the virtqueue and free it. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-04cadence_gem: Fix priority queue out of bounds accessAlistair Francis
There was an error with some of the register implementation assuming there are 16 priority queues supported when the IP only supports 8. This patch corrects the registers to only support 8 queues. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reported-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 33bf2d28326d22875602234b8b15cf56fb678333.1474911607.git.alistair.francis@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-27imx_fec: fix error in qemu_send_packet argumentPaolo Bonzini
This uses the wrong frame size for packets composed of multiple descriptors. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27mcf_fec: fix error in qemu_send_packet argumentPaolo Bonzini
This uses the wrong frame size for packets composed of multiple descriptors. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27net: mcf: limit buffer descriptor countPrasad J Pandit
ColdFire Fast Ethernet Controller uses buffer descriptors to manage data flow to/fro receive & transmit queues. While transmitting packets, it could continue to read buffer descriptors if a buffer descriptor has length of zero and has crafted values in bd.flags. Set upper limit to number of buffer descriptors. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000e: Fix EIAC register implementationDmitry Fleytman
This patch fixes 2 issues: 1. Bits set in EIAC register should be cleared from IMS when EIAM is not used. 2. Only bit that corresonds to the interrupt being raised should be cleared. See spec. 10.2.4.7 Interrupt Auto Clear Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000e: Fix spurious RX TCP ACK interruptsDmitry Fleytman
Do not raise ACK interrupts when RFCTL.ACKDIS bit is set (see spec. 10.2.5.16). Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000e: Fix OTHER interrupts processing for MSI-XDmitry Fleytman
Interrupt mask for legacy OTHER causes should not apply to MSI-X OTHER cause. Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000e: Fix PBACLR implementationDmitry Fleytman
This patch fixes incorrect check for interrypt type being used. PBSCLR register is valid for MSI-X only. See spec. 10.2.3.13 MSI—X PBA Clear Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000e: Fix CTRL_EXT.EIAME behaviorDmitry Fleytman
CTRL_EXT.EIAME bit controls clearing of IAM bits, but current code clears IMS bits instead. See spec. 10.2.2.5 Extended Device Control Register. Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000e: Flush receive queues on link upDmitry Fleytman
Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000e: Flush all receive queues on receive enableDmitry Fleytman
Before this patch first netdev queue only was flushed. Signed-off-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27e1000: fix buliding complaintGonglei
hw/net/e1000e_core.c:56: warning: e1000e_set_interrupt_cause declared inline after being called hw/net/e1000e_core.c:56: warning: previous declaration of e1000e_set_interrupt_cause was here Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-27virtio-net: allow increasing rx queue sizeMichael S. Tsirkin
This allows increasing the rx queue size up to 1024: unlike with tx, guests don't put in huge S/G lists into RX so the risk of running into the max 1024 limitation due to some off-by-one seems small. It's helpful for users like OVS-DPDK which don't do any buffering on the host - 1K roughly matches 500 entries in tun + 256 in the current rx queue, which seems to work reasonably well. We could probably make do with ~750 entries but virtio spec limits us to powers of two. It might be a good idea to specify an s/g size limit in a future version. It also might be possible to make the queue size smaller down the road, 64 seems like the minimal value which will still work (as guests seem to assume a queue full of 1.5K buffers is enough to process the largest incoming packet, which is ~64K). No one actually asked for this, and with virtio 1 guests can reduce ring size without need for host configuration, so don't bother with this for now. Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Jason Wang <jasowang@redhat.com> Suggested-by: Patrik Hermansson <phermansson@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-09-23Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.8-20160923' ↵Peter Maydell
into staging ppc patch queue 2016-09-23 This pull request supersedes ppc-for-2.8-20160922. There was a clang build error in that, and I've also added one extra patch in the new pull. Included in this set of ppc and spapr patches are: * TCG implementations for more POWER9 instructions * Some preliminary XICS fixes in preparataion for the pnv machine type * A significant ADB (Macintosh kbd/mouse) cleanup * Some conversions to use trace instead of debug macros * Fixes to correctly handle global TLB flush synchronization in TCG. This is already a bug, but it will have much more impact when we get MTTCG * Add more qtest testcases for Power * Some MAINTAINERS updates * Assorted bugfixes * Add the basics of NUMA associativity to the spapr PCI host bridge This touches some test files and monitor.c which are technically outside the ppc code, but coming through this tree because the changes are primarily of interest to ppc. # gpg: Signature made Fri 23 Sep 2016 08:14:47 BST # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * remotes/dgibson/tags/ppc-for-2.8-20160923: (45 commits) spapr_pci: Add numa node id monitor: fix crash for platforms without a CPU 0 linux-user: ppc64: fix ARCH_206 bit in AT_HWCAP ppc/kvm: Mark 64kB page size support as disabled if not available ppc/xics: An ICS with offset 0 is assumed to be uninitialized ppc/xics: account correct irq status Enable H_CLEAR_MOD and H_CLEAR_REF hypercalls on KVM/PPC64. target-ppc: tlbie/tlbivax should have global effect target-ppc: add flag in check_tlb_flush() target-ppc: add TLB_NEED_LOCAL_FLUSH flag spapr: Introduce sPAPRCPUCoreClass target-ppc: implement darn instruction target-ppc: add stxsi[bh]x instruction target-ppc: add lxsi[bw]zx instruction target-ppc: add xxspltib instruction target-ppc: consolidate store conditional target-ppc: move out stqcx impementation target-ppc: consolidate load with reservation target-ppc: convert st[16,32,64]r to use new macro target-ppc: convert st64 to use new macro ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-23spapr_llan: convert to trace framework instead of DPRINTFLaurent Vivier
Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-09-22cadence_gem: Correct indentationAlistair Francis
Fix up the indentation inside the for loop that was introduced in the previous patch. This commit is almost empty if viewed using 'git show -w', except for a few changes that were required to avoid the 80 charecter line limit. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: b40d1b12d24be9f0ac5d72f86249103e0c1c720a.1469727764.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22cadence_gem: Add queue supportAlistair Francis
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 28921252217b1d14f16889bafa88675f5b7a66cb.1469727764.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22cadence_gem: Add support for screeningAlistair Francis
The Cadence GEM hardware allows incoming data to be 'screened' based on some register values. Add support for these screens. We also need to increase the max regs to avoid compilation failures. These new registers are implemented in the next patch. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 73e69a8ad9fa2763e9f68f71eaf2469dd5744fcc.1469727764.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22cadence_gem: Add the num-priority-queues propertyAlistair Francis
The Cadence GEM hardware supports N number priority queues, this patch is a step towards that by adding the property to set the queues. At the moment behaviour doesn't change as we only use queue 0. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 6543ec0d0c4bfd2678d0ed683efb197e91b17733.1469727764.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22cadence_gem: QOMify Cadence GEMAlistair Francis
The sysbus_init_irq() call will eventually depend on a property so it needs to be in the realize function. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 486595809cf416d18a750aafbcfa1c81d7160c59.1469727764.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-22hw/ptimer: Introduce timer policy featureDmitry Osipenko
Some of the timer devices may behave differently from what ptimer provides. Introduce ptimer policy feature that allows ptimer users to change default and wrong timer behaviour, for example to continuously trigger periodic timer when load value is equal to "0". Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Message-id: 994cd608ec392da6e58f0643800dda595edb9d97.1473252818.git.digetx@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-13hw/net/e1000e: Fix compiler warningChanglong Xie
slave:~/.xie/qemu-colo # gcc --version gcc (SUSE Linux) 4.3.4 [gcc-4_3-branch revision 152973] slave:~/.xie/qemu-colo # make -j8 CC hw/net/e1000e_core.o hw/net/e1000e_core.c:56: warning: ‘e1000e_set_interrupt_cause’ declared inline after being called hw/net/e1000e_core.c:56: warning: previous declaration of ‘e1000e_set_interrupt_cause’ was here LINK x86_64-softmmu/qemu-system-x86_64 Signed-off-by: Changlong Xie <xiecl.fnst@cn.fujitsu.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-07spapr: implement H_CHANGE_LOGICAL_LAN_MAC h_callLaurent Vivier
Since kernel v4.0, linux uses H_CHANGE_LOGICAL_LAN_MAC to change lively the MAC address of an ibmveth interface. As QEMU doesn't implement this h_call, we can't change anymore the MAC address of an spapr-vlan interface. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-08-22e1000e: remove internal interrupt flagCao jin
Commit 66bf7d58 removed internal msi state flag E1000E_USE_MSI, E1000E_USE_MSIX is not necessary too, remove it now. And interrupt flag field intr_state also can be removed now. CC: Dmitry Fleytman <dmitry@daynix.com> CC: Jason Wang <jasowang@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Dmitry Fleytman <dmitry@daynix.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-08-18net: vmxnet: use g_new for pkt initialisationLi Qiang
When network transport abstraction layer initialises pkt, the maximum fragmentation count is not checked. This could lead to an integer overflow causing a NULL pointer dereference. Replace g_malloc() with g_new() to catch the multiplication overflow. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Acked-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-08-12trace-events: fix first line comment in trace-eventsLaurent Vivier
Documentation is docs/tracing.txt instead of docs/trace-events.txt. find . -name trace-events -exec \ sed -i "s?See docs/trace-events.txt for syntax documentation.?See docs/tracing.txt for syntax documentation.?" \ {} \; Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1470669081-17860-1-git-send-email-lvivier@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-08-10Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio/vhost: fixes some bugfixes for virtio/vhost Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 10 Aug 2016 16:16:22 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: vhost-user: Attempt to fix a race with set_mem_table. vhost-user: Introduce a new protocol feature REPLY_ACK. vhost: check for vhost_ops before using. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-08-10vhost: check for vhost_ops before using.Ilya Maximets
'vhost_set_vring_enable()' tries to call function using pointer to 'vhost_ops' which can be already zeroized in 'vhost_dev_cleanup()' while vhost disconnection. Fix that by checking 'vhost_ops' before using. This fixes QEMU crash on calling 'ethtool -L eth0 combined 2' if vhost disconnected. Signed-off-by: Ilya Maximets <i.maximets@samsung.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-08-09hw/net: Fix a heap overflow in xlnx.xps-ethernetlitechaojianhu
The .receive callback of xlnx.xps-ethernetlite doesn't check the length of data before calling memcpy. As a result, the NetClientState object in heap will be overflowed. All versions of qemu with xlnx.xps-ethernetlite will be affected. Reported-by: chaojianhu <chaojianhu@hotmail.com> Signed-off-by: chaojianhu <chaojianhu@hotmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-08-09net: vmxnet3: check for device_active before writeLi Qiang
Vmxnet3 device emulator does not check if the device is active, before using it for write. It leads to a use after free issue, if the vmxnet3_io_bar0_write routine is called after the device is deactivated. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Acked-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-08-09net: check fragment length during fragmentationPrasad J Pandit
Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-07-29vhost: add vhost_net_set_backend()Marc-André Lureau
Not all vhost-user backends support ops->vhost_net_set_backend(). It is a nicer to provide an assert/error than to crash trying to call. Furthermore, it improves a bit the code by hiding vhost_ops details. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-29vhost-net: vhost_migration_done is vhost-user specificMarc-André Lureau
Either the callback is mandatory to implement, in which case an assert() is more appropriate, or it's not and we can't tell much whether the function should fail or not (given it's name, I guess it should silently success by default). Instead, make the implementation mandatory and vhost-user specific to be more clear about its usage. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-01 10:10:42 +0000