aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2017-01-039pfs: move pdus to V9fsStateStefano Stabellini
pdus are initialized and used in 9pfs common code. Move the array from V9fsVirtioState to V9fsState. Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Greg Kurz <groug@kaod.org> Signed-off-by: Greg Kurz <groug@kaod.org>
2017-01-03virtio-gpu: fix memory leak in resource attach backingLi Qiang
In the resource attach backing function, everytime it will allocate 'res->iov' thus can leading a memory leak. This patch avoid this. Signed-off-by: Li Qiang <liq3ea@gmail.com> Message-id: 1483003721-65360-1-git-send-email-liq3ea@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-03virtio-gpu-3d: fix memory leak in resource attach backingLi Qiang
If the virgl_renderer_resource_attach_iov function fails the 'res_iovs' will be leaked. Add check of the return value to free the 'res_iovs' when failing. Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1482999086-59795-1-git-send-email-liq3ea@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-03virtio-gpu: call cleanup mapping function in resource destroyLi Qiang
If the guest destroy the resource before detach banking, the 'iov' and 'addrs' field in resource is not freed thus leading memory leak issue. This patch avoid this. Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-27hw/i2c: Add a NULL check for i2c slave init callbacksAlastair D'Silva
Add a NULL check for i2c slave init callbacks, so that we no longer need to implement empty init functions. Signed-off-by: Alastair D'Silva <alastair@d-silva.org> Message-id: 20161202054617.6749-4-alastair@au1.ibm.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: squashed in later tweak from Alistair to if() phrasing] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27hw/arm: remove trailing whitespaceAlastair D'Silva
Remove trailing whitespace in hw/arm/pxa2xx.c Signed-off-by: Alastair D'Silva <alastair@d-silva.org> Message-id: 20161202054617.6749-3-alastair@au1.ibm.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed/smc: set the number of flash modules for the FMC controllerCédric Le Goater
Add a new configuration field at the board level and propagate the value using the "num-cs" property of the FMC controller model. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1480434248-27138-14-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed/smc: improve segment register supportCédric Le Goater
The HW does not enforce all the rules in the specs and allows a few "curious" setups like zero size segments and overlaps. So change the model to be in sync but keep the warnings which are always interesting for debug. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 1480434248-27138-13-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed/scu: fix SCU region sizeCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-12-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: change SoC revision of the palmetto-bmc machineCédric Le Goater
The palmetto BMC machine uses a AST2400 revision A1 SoC. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-11-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: add the definitions for the AST2400 A1 SoCCédric Le Goater
There is not much differences with the A0 revision apart from the DDR calibration. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-10-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: add a memory region for SRAMCédric Le Goater
The size of the SRAM depends on the SoC model, so use a per-soc definition when creating the region. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-9-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: add support for the romulus-bmc boardCédric Le Goater
The Romulus machine is an OpenPOWER system with an AST2500 SoC for the BMC and a POWER9 chip for the host. It does not make much difference for qemu a part from the fact that the FMC controller has two SPI flash module. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 1480434248-27138-8-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: extend the board configuration with flash modelsCédric Le Goater
Future machine will use different flash models for the FMC and the SPI controllers. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-7-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: attach the second SPI controller object to the SoCCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-6-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: remove cannot_destroy_with_object_finalize_yetCédric Le Goater
With commit ce5b1bbf624b ("exec: move cpu_exec_init() calls to realize functions"), we can now remove cannot_destroy_with_object_finalize_yet. Suggested-by: Andrew Jeffery <andrew@aj.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1480434248-27138-5-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27aspeed: QOMify the CPU object and attach it to the SoCCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-4-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27m25p80: add support for the mx66l1g45gCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Marcin Krzeminski <marcin.krzeminski@nokia.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 1480434248-27138-3-git-send-email-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27hw/arm/virt: add 2.9 machine typePeter Maydell
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andrew Jones <drjones@redhat.com>
2016-12-27hw/intc/arm_gicv3: Don't signal Pending+Active interrupts to CPUPeter Maydell
The GICv3 requires that we only signal Pending interrupts to the CPU. This category does not include Pending+Active interrupts, which means we need to check whether the interrupt is Active in the gicr_int_pending() and gicd_int_pending() functions. Interrupts are rarely in the Active+Pending state, but KVM uses this as part of its handling of the virtual timer, so this bug was causing KVM to go into an infinite loop of taking the vtimer interrupt when the guest first triggered it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2016-12-27hw/intc/arm_gicv3: Remove incorrect usage of fieldoffsetPeter Maydell
In the ARMCPRegInfo definitions for the GICv3 CPU interface registers, we were trying to use .fieldoffset to specify the locations of data fields within the GICv3CPUState struct. This is completely broken, because .fieldoffset is for offsets into the CPUARMState struct. We didn't notice because we were only using this for reads to BPR0, AP0R<n>, IGRPEN0 and CTLR_EL3, and Linux doesn't use these registers. Replace the .fieldoffset uses with explicit read functions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2016-12-27hw/intc/arm_gicv3_common: fix aff3 in typerAndrew Jones
Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 20161209143703.29457-1-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27cadence_uart: Check if receiver timeout counter is disabledAndrew Gacek
When register Rcvr_timeout_reg0 (R_RTOR in cadence_uart.c) is set to 0, the receiver timeout counter should be disabled. See page 1801 of "Zynq-7000 AP SoC Technical Reference Manual". This commit adds a such a check before setting the receive timeout interrupt. Signed-off-by: Andrew Gacek <andrew.gacek@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-27cadence_uart: Check baud rate generator and divider values on migrationAlistair Francis
The Cadence UART device emulator calculates speed by dividing the baud rate by a 'baud rate generator' & 'baud rate divider' value. The device specification defines these register values to be non-zero and within certain limits. Checks were recently added when writing to these registers but not when restoring from migration. This patch adds checks when restoring from migration to avoid divide by zero errors. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 04ae30ed8ee1758cd2d2af880da4d28f74c67738.1481132150.git.alistair.francis@xilinx.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-12-22kvmclock: reduce kvmclock difference on migrationMarcelo Tosatti
Check for KVM_CAP_ADJUST_CLOCK capability KVM_CLOCK_TSC_STABLE, which indicates that KVM_GET_CLOCK returns a value as seen by the guest at that moment. For new machine types, use this value rather than reading from guest memory. This reduces kvmclock difference on migration from 5s to 0.1s (when max_downtime == 5s). Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Message-Id: <20161121105052.598267440@redhat.com> [Add comment explaining what is going on. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22scsi-disk: fix VERIFY for scsi-blockPaolo Bonzini
When a scsi-disk object receives VERIFY command with BYTCHK bit being zero, scsi_block_is_passthrough returns false and finally makes req being proceeded by scsi_block_dma_command. Because scsi_block_dma_command has removed process of VERIFY, QEMU will abort in this function. Reported-by: Junlian Bell <zhongjun@sangfor.com.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22hw/block/pflash_cfi*.c: fix confusing assert fail messageZiyue Yang
The patch is to fix the confusing assert fail message caused by un-initialized device structure (from bite sized tasks). The bug can be reproduced by ./qemu-system-x86_64 -nographic -device cfi.pflash01 The CFI hardware is dynamically loaded by QOM realizing mechanism, however the realizing function in pflash_cfi01_realize function requires the device being initialized manually before calling, like ./qemu-system-x86_64 -nographic -device cfi.pflash01,num-blocks=1024,sector-length=4096,name=testcard Once the initializing parameters are left off in the command, it will leave the device structure not initialized, which makes pflash_cfi01_realize try to realize a zero-volume card, causing /mnt/EXT_volume/projects/qemu/qemu-dev/exec.c:1378: find_ram_offset: Assertion `size != 0\' failed. Through my test, at least the flash device's block-number, sector-length and its name is needed for pflash_cfi01_realize to behave correctly. So I think the new asserts are needed to hint the QEMU user to specify the device's parameters correctly. Signed-off-by: Ziyue Yang <skiver.cloud.yzy@gmail.com> Message-Id: <1481810693-13733-1-git-send-email-skiver.cloud.yzy@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Ziyue Yang <yzylivezh@hotmail.com>
2016-12-22multiboot: copy the cmdline verbatim, unescape module stringsVlad Lungu
get_opt_value() truncates the value at the first comma Use memcpy() instead so that -append works correctly in the presence of commas. For -initrd to work right, instead, unescape the module filename and parameters with get_opt_value() before calling mb_add_cmdline(). Signed-off-by: Vlad Lungu <vlad.lungu@windriver.com> Message-Id: <1481805124-16242-1-git-send-email-vlad.lungu@windriver.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22pc: make pit configurableChao Peng
Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com> Message-Id: <1478330391-74060-4-git-send-email-chao.p.peng@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22pc: make sata configurableChao Peng
Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com> Message-Id: <1478330391-74060-3-git-send-email-chao.p.peng@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22pc: make smbus configurableChao Peng
Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com> Message-Id: <1478330391-74060-2-git-send-email-chao.p.peng@linux.intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22virtio-scsi: introduce virtio_scsi_acquire/releasePaolo Bonzini
These will be used more as soon as the acquire/release is pushed down to the ioeventfd handlers. Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22watchdog: 6300esb: add exit functionLi Qiang
When the Intel 6300ESB watchdog is hot unplug. The timer allocated in realize isn't freed thus leaking memory leak. This patch avoid this through adding the exit function. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-Id: <583cde9c.3223ed0a.7f0c2.886e@mx.google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-20Move target-* CPU file into a target/ folderThomas Huth
We've currently got 18 architectures in QEMU, and thus 18 target-xxx folders in the root folder of the QEMU source tree. More architectures (e.g. RISC-V, AVR) are likely to be included soon, too, so the main folder of the QEMU sources slowly gets quite overcrowded with the target-xxx folders. To disburden the main folder a little bit, let's move the target-xxx folders into a dedicated target/ folder, so that target-xxx/ simply becomes target/xxx/ instead. Acked-by: Laurent Vivier <laurent@vivier.eu> [m68k part] Acked-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> [tricore part] Acked-by: Michael Walle <michael@walle.cc> [lm32 part] Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com> [s390x part] Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com> [s390x part] Acked-by: Eduardo Habkost <ehabkost@redhat.com> [i386 part] Acked-by: Artyom Tarasenko <atar4qemu@gmail.com> [sparc part] Acked-by: Richard Henderson <rth@twiddle.net> [alpha part] Acked-by: Max Filippov <jcmvbkbc@gmail.com> [xtensa part] Reviewed-by: David Gibson <david@gibson.dropbear.id.au> [ppc part] Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> [cris&microblaze part] Acked-by: Guan Xuetao <gxt@mprc.pku.edu.cn> [unicore32 part] Signed-off-by: Thomas Huth <thuth@redhat.com>
2016-12-20virtio-gpu: track and limit host memory allocationsGerd Hoffmann
This patch makes virtio-gpu track host memory allocations for ressources and applies a limit (configurable 256M by default). When exceeding the limit virtio-gpu throws VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY errors (like it already does today when pixman image allocations fail). This patch covers 2d mode only. For 3d mode we have to figure how we are going to handle this best. qemu doesn't track resources in case virglrenderer is used, so I guess we should extend virglrenderer to allow setting a limit, then let qemu set the limit and catch virgl_renderer_resource_create failures. Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Dave Airlie <airlied@redhat.com> Cc: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1480423356-22255-1-git-send-email-kraxel@redhat.com
2016-12-20display: virtio-gpu-3d: check virgl capabilities max_sizePrasad J Pandit
Virtio GPU device while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command, retrieves the maximum capabilities size to fill in the response object. It continues to fill in capabilities even if retrieved 'max_size' is zero(0), thus resulting in OOB access. Add check to avoid it. Reported-by: Zhenhao Hong <zhenhaohong@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20161214070156.23368-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-16virtio: avoid using guest_notifier_mask in vhost-user modeWei Huang
Because guest mask notifier cannot be used in vhost-user mode, a boolean flag "use_guest_notifier_mask" was added in commit 5669655aafd to disable the use of guest mask notifier under virtio-pci. However this flag wasn't checked in other virtio devices, such as virtio-mmio. In our tests, it caused assertion error under "vhost-user + virtio-mmio". This patch addresses this problem by adding a check before guest_notifier_mask is called. Signed-off-by: Wei Huang <wei@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-12-16pci: fix error message for express slotsMichael S. Tsirkin
PCI Express downstream slot has a single PCI slot behind it, using PCI_DEVFN(PCI_SLOT(devfn), 0) does not give you function 0 in cases such as ARI as well as some error cases. This is exactly what we are hitting: $ qemu-system-x86_64 -machine q35 -readconfig docs/q35-chipset.cfg -monitor stdio (qemu) device_add e1000e,bus=ich9-pcie-port-4,addr=00 (qemu) device_add e1000e,bus=ich9-pcie-port-4,addr=08 Segmentation fault (core dumped) The fix is to use the pci_get_function_0 API. Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reported-by: Eduardo Habkost <ehabkost@redhat.com> Tested-by: Cao jin <caoj.fnst@cn.fujitsu.com> Tested-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
2016-12-16i386: amd_iommu: fix MMIO register count and accessPrasad J Pandit
IOMMU MMIO registers are divided in two groups by their offsets. Low offsets(<0x2000) registers are grouped into 'amdvi_mmio_low' table and higher offsets(>=0x2000) registers are grouped into 'amdvi_mmio_high' table. No of registers in each table is given by macro 'AMDVI_MMIO_REGS_LOW' and 'AMDVI_MMIO_REGS_HIGH' resp. Values of these two macros were swapped, resulting in an OOB access when reading 'amdvi_mmio_high' table. Correct these two macros. Also read from 'amdvi_mmio_low' table for lower address. Reported-by: Azureyang <azureyang@tencent.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-12-15virtio-pci: Fix cross-version migration with older machinesMaxime Coquelin
This patch fixes a cross-version migration regression introduced by commit d1b4259f ("virtio-bus: Plug devices after features are negotiated"). The problem is encountered when host's vhost backend does not support VIRTIO_F_VERSION_1, and migration is initiated from a v2.7 or prior machine with virtio-pci modern capabilities enabled to a v2.8 machine. In this case, modern capabilities get exposed to the guest by the source, whereas the target will detect version 1 is not supported so will only expose legacy capabilities. The problem is fixed by introducing a new "x-ignore-backend-features" property, which is set in v2.7 and prior compatibility modes. Doing this, v2.7 machine keeps its broken behaviour (enabling modern while version is not supported), and newer machines will behave correctly. Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Message-id: 20161214163035.3297-1-maxime.coquelin@redhat.com Suggested-by: Stefan Hajnoczi <stefanha@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Cornelia Huck <cornelia.huck@de.ibm.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-12-06Merge remote-tracking branch 'jasowang/tags/net-pull-request' into stagingStefan Hajnoczi
# gpg: Signature made Tue 06 Dec 2016 02:24:23 AM GMT # gpg: using RSA key 0xEF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * jasowang/tags/net-pull-request: fsl_etsec: Fix various small problems in hexdump code fsl_etsec: Pad short payloads with zeros net: mcf: check receive buffer size register value Message-id: 1480991552-14360-1-git-send-email-jasowang@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-12-06fsl_etsec: Fix various small problems in hexdump codeAndrey Smirnov
Fix various small problems in hexdump code, such as: - Reference to non-existing field etsec->nic->nc.name is replaced with nc->name - Type mismatch warnings Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-12-05display: cirrus: check vga bits per pixel(bpp) valuePrasad J Pandit
In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA, 'cirrus_get_bpp' returns zero(0), which could lead to a divide by zero error in while copying pixel data. The same could occur via blit pitch values. Add check to avoid it. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05fsl_etsec: Pad short payloads with zerosAndrey Smirnov
Depending on QEMU network setup it is possible for us to receive a complete Ethernet packet that is less 64 bytes long. One such example is when QEMU is configured to use a standalone TAP device (not set to be a part of any bridge) receives and ARP packet. In cases like that we need to add more than just 4-bytes of CRC padding and ensure that our payload is at least 60 bytes long, such that, when combined with CRC padding bytes the resulting size is at least 802.3 minimum MTU bytes long (64). Failing to do that results in code in etsec_walk_rx_ring() setting BD_RX_SH which, in turn, makes corresponding Linux driver of emulated host to reject buffer as a runt packet Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-12-05net: mcf: check receive buffer size register valuePrasad J Pandit
ColdFire Fast Ethernet Controller uses a receive buffer size register(EMRBR) to hold maximum size of all receive buffers. It is set by a user before any operation. If it was set to be zero, ColdFire emulator would go into an infinite loop while receiving data in mcf_fec_receive. Add check to avoid it. Reported-by: Wjjzhang <wjjzhang@tencent.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-12-05virtio-gpu: fix memory leak in update_cursor_data_virglLi Qiang
In update_cursor_data_virgl function, if the 'width'/ 'height' is not equal to current cursor's width/height it will return without free the 'data' allocated previously. This will lead a memory leak issue. This patch fix this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 58187760.41d71c0a.cca75.4cb9@mx.google.com Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05virtio-gpu: fix information leak in getting capset info dispatchLi Qiang
In virgl_cmd_get_capset_info dispatch function, the 'resp' hasn't been full initialized before writing to the guest. This will leak the 'resp.padding' and 'resp.hdr.padding' fieds to the guest. This patch fix this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 5818661e.0860240a.77264.7a56@mx.google.com Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05qxl: Only emit QXL_INTERRUPT_CLIENT_MONITORS_CONFIG on config changesChristophe Fergeau
Currently if the client keeps sending the same monitor config to QEMU/spice-server, QEMU will always raise a QXL_INTERRUPT_CLIENT_MONITORS_CONFIG regardless of whether there was a change or not. Guest-side (with fedora 25), the kernel QXL KMS driver will also forward the event to user-space without checking if there were actual changes. Next in line are gnome-shell/mutter (on a default f25 install), which will try to reconfigure everything without checking if there is anything to do. Where this gets ugly is that when applying the resolution changes, gnome-shell/mutter will call drmModeRmFB, drmModeAddFB, and drmModeSetCrtc, which will cause the primary surface to be destroyed and recreated by the QXL KMS driver. This in turn will cause the client to resend a client monitors config message, which will cause QEMU to reemit an interrupt with an unchanged monitors configuration, ... This causes https://bugzilla.redhat.com/show_bug.cgi?id=1266484 This commit makes sure that we only emit QXL_INTERRUPT_CLIENT_MONITORS_CONFIG when there are actual configuration changes the guest should act on. Signed-off-by: Christophe Fergeau <cfergeau@redhat.com> Message-id: 20161028144840.18326-1-cfergeau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-01Merge remote-tracking branch 'dgibson/tags/ppc-for-2.8-20161201' into stagingStefan Hajnoczi
ppc patch queue 2016-12-01 Just a single migration / hotplug fix in this set. I believe it's important enough to go in this late in the 2.8 release process. # gpg: Signature made Thu 01 Dec 2016 04:43:49 AM GMT # gpg: using RSA key 0x6C38CACA20D9B392 # gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" # gpg: aka "David Gibson (kernel.org) <dwg@kernel.org>" # gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>" # gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" # Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392 * dgibson/tags/ppc-for-2.8-20161201: spapr: fix default DRC state for coldplugged LMBs Message-id: 20161201044441.14365-1-david@gibson.dropbear.id.au Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-12-01spapr: fix default DRC state for coldplugged LMBsMichael Roth
Currently we set the initial isolation/allocation state for DRCs associated with coldplugged LMBs to ISOLATED/UNUSABLE, respectively, under the assumption that the guest will move this state to UNISOLATED/USABLE. In fact, this is only the case for LMBs added via hotplug. For coldplugged LMBs, the guest actually assumes the initial state to be UNISOLATED/USABLE. In practice, this only becomes an issue when we attempt to unplug one of these LMBs, where the guest kernel will issue an rtas-get-sensor-state call to check that the corresponding DRC is in an USABLE state before it will release the LMB back to QEMU. If the returned state is otherwise, the guest will assume no further action is needed, which bypasses the QEMU-side cleanup that occurs during the USABLE->UNUSABLE transition. This results in LMBs and their corresponding pc-dimm devices to stick around indefinitely. This patch fixes the issue by manually setting DRCs associated with cold-plugged LMBs to UNISOLATED/ALLOCATED, but leaving the hotplug state untouched. As it turns out, this is analogous to the handling for cold-plugged CPUs in spapr_core_plug(). Cc: qemu-ppc@nongnu.org Cc: David Gibson <david@gibson.dropbear.id.au> Cc: Bharata B Rao <bharata@linux.vnet.ibm.com> Cc: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-17 04:32:03 +0000