aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2017-02-21hw: Default -drive to if=ide explicitly where it worksMarkus Armbruster12-0/+15
Block backends defined with -drive if=ide are meant to be picked up by machine initialization code: a suitable frontend gets created and wired up automatically. if=ide drives not picked up that way can still be used with -device as if they had if=none, but that's unclean and best avoided. Unused ones produce an "Orphaned drive without device" warning. -drive parameter "if" is optional, and the default depends on the machine type. If a machine type doesn't specify a default, the default is "ide". Many machine types default to if=ide, even though they don't actually have an IDE controller. A future patch will change these defaults to something more sensible. To prepare for it, this patch makes default "ide" explicit for the machines that actually pick up if=ide drives: * alpha: clipper * arm/aarch64: spitz borzoi terrier tosa * i386/x86_64: generic-pc-machine (with concrete subtypes pc-q35-* pc-i440fx-* pc-* isapc xenfv) * mips64el: fulong2e * mips/mipsel/mips64el: malta mips * ppc/ppc64: mac99 g3beige prep * sh4/sh4eb: r2d * sparc64: sun4u sun4v Note that ppc64 machine powernv already sets an "ide" default explicitly. Its IDE controller isn't implemented, yet. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <1487153147-11530-2-git-send-email-armbru@redhat.com>
2017-02-21usb-ccid: add check message size checksGerd Hoffmann1-3/+10
Check message size too when figuring whenever we should expect more data. Fix debug message to show useful data, p->iov.size is fixed anyway if we land there, print how much we got meanwhile instead. Also check announced message size against actual message size. That is a more general fix for CVE-2017-5898 than commit "c7dfbf3 usb: ccid: check ccid apdu length". Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487250819-23764-4-git-send-email-kraxel@redhat.com
2017-02-21usb-ccid: move header size checkGerd Hoffmann1-7/+6
Move up header size check, so we can use header fields in sanity checks (in followup patches). Also reword the debug message. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487250819-23764-3-git-send-email-kraxel@redhat.com
2017-02-21usb-ccid: better bulk_out error handlingGerd Hoffmann1-55/+61
Add err goto label where we can jump to from all error conditions. STALL request on all errors. Reset position on all errors. Normal request processing is not in a else branch any more, so this code is reintended, there are no code changes in that part of the code though. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487250819-23764-2-git-send-email-kraxel@redhat.com
2017-02-21xhci: drop via vendor command handlingGerd Hoffmann1-31/+0
Seems pretty pointless, we don't emulate an via xhci controller. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486382139-30630-5-git-send-email-kraxel@redhat.com
2017-02-21xhci: fix nec vendor quirk handlingGerd Hoffmann1-15/+29
Only the TYPE_NEC_XHCI controller will have the nec vendor quirks. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486382139-30630-4-git-send-email-kraxel@redhat.com
2017-02-21xhci: add qemu xhci controllerGerd Hoffmann1-4/+36
Turn existing TYPE_XHCI into an abstract base class. Create two child classes, TYPE_NEC_XHCI (same name as old xhci controller) and TYPE_QEMU_XHCI (using an ID from our namespace). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Message-id: 1486382139-30630-3-git-send-email-kraxel@redhat.com
2017-02-21xhci: drop ER_FULL_HACK workaroundGerd Hoffmann1-106/+11
The nec/renesas driver problems have finally been debugged and root caused, see commit "7da76e1 xhci: fix event queue IRQ handling". It's pretty clear now that (a) The whole "driver can't handle ring full" story is most likely wrong. (b) The ER_FULL_HACK workaround based on the false assumtion doesn't much. It avoids the driver crashing (without commit 7da76e1), but it doesn't make usb work. (c) With 7da76e1 applied it doesn't trigger any more. So, lets kill it. Or, to be exact, lets almost kill it. Some data fields are kept unused in the state struct, for live migration backward compatibility. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486382139-30630-2-git-send-email-kraxel@redhat.com
2017-02-21xhci: apply limits to loopsGerd Hoffmann2-1/+15
Limits should be big enough that normal guest should not hit it. Add a tracepoint to log them, just in case. Also, while being at it, log the existing link trb limit too. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1486383669-6421-1-git-send-email-kraxel@redhat.com
2017-02-21usb: ohci: limit the number of link edsLi Qiang1-1/+8
The guest may builds an infinite loop with link eds. This patch limit the number of linked ed to avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 5899a02e.45ca240a.6c373.93c1@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-21usb: ohci: fix error return code in servicing iso tdLi Qiang1-1/+1
It should return 1 if an error occurs when reading iso td. This will avoid an infinite loop issue in ohci_service_ed_list. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 5899ac3e.1033240a.944d5.9a2d@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-21usb: ehci: fix memory leak in ehciLi Qiang3-0/+15
In usb_ehci_init function, it initializes 's->ipacket', but there is no corresponding function to free this. As the ehci can be hotplug and unplug, this will leak host memory leak. In order to make the hierarchy clean, we should add a ehci pci finalize function, then call the clean function in ehci device. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 589a85b8.3c2b9d0a.b8e6.1434@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-20Merge remote-tracking branch 'remotes/huth/tags/coldfire-20170219' into stagingPeter Maydell3-90/+44
Updates for the m68k ColdFire machines: - Remove the obsolete dummy machine - QOMify the ColdFire interrupt controller - Volunteer for maintaining the orphan ColdFire boards # gpg: Signature made Sat 18 Feb 2017 23:08:55 GMT # gpg: using RSA key 0x2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth/tags/coldfire-20170219: MAINTAINERS: Add odd fixer for the ColdFire boards hw/m68k: QOMify the ColdFire interrupt controller hw/m68k: Remove dummy machine Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-18hw/m68k: QOMify the ColdFire interrupt controllerThomas Huth1-4/+44
Use type_init() and friends to adapt the ColdFire interrupt controller to the latest QEMU device conventions. Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Thomas Huth <huth@tuxfamily.org>
2017-02-18hw/m68k: Remove dummy machineThomas Huth2-86/+0
Since it is now possible to instantiate a CPU and RAM with the "none" machine, too, and a kernel can be loaded there with the generic loader device, there is no more need for the m68k "dummy" machine. Thus let's remove this unmaintained file now. Reviewed-by: Laurent Vivier <laurent@vivier.eu> Signed-off-by: Thomas Huth <huth@tuxfamily.org>
2017-02-17intel_iommu: vtd_slpt_level_shift check levelPeter Xu1-0/+1
This helps in debugging incorrect level passed in. Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17intel_iommu: convert dbg macros to trace for transPeter Xu2-45/+34
Another patch to convert the DPRINTF() stuffs. This patch focuses on the address translation path and caching. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17intel_iommu: convert dbg macros to traces for invPeter Xu2-57/+56
VT-d codes are still using static DEBUG_INTEL_IOMMU macro. That's not good, and we should end the day when we need to recompile the code before getting useful debugging information for vt-d. Time to switch to the trace system. This is the first patch to do it. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17intel_iommu: renaming gpa to iova where properPeter Xu1-22/+22
There are lots of places in current intel_iommu.c codes that named "iova" as "gpa". It is really confusing to use a name "gpa" in these places (which is very easily to be understood as "Guest Physical Address", while it's not). To make the codes (much) easier to be read, I decided to do this once and for all. No functional change is made. Only literal ones. Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17intel_iommu: simplify irq region translationPeter Xu1-22/+6
Now we have a standalone memory region for MSI, all the irq region requests should be redirected there. Cleaning up the block with an assertion instead. Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17intel_iommu: add "caching-mode" optionAviv Ben-David2-0/+6
This capability asks the guest to invalidate cache before each map operation. We can use this invalidation to trap map operations in the hypervisor. Signed-off-by: Aviv Ben-David <bd.aviv@gmail.com> [peterx: using "caching-mode" instead of "cache-mode" to align with spec] [peterx: re-write the subject to make it short and clear] Reviewed-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Signed-off-by: Aviv Ben-David <bd.aviv@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17vfio: allow to notify unmap for very large regionPeter Xu1-4/+3
Linux vfio driver supports to do VFIO_IOMMU_UNMAP_DMA for a very big region. This can be leveraged by QEMU IOMMU implementation to cleanup existing page mappings for an entire iova address space (by notifying with an IOTLB with extremely huge addr_mask). However current vfio_iommu_map_notify() does not allow that. It make sure that all the translated address in IOTLB is falling into RAM range. The check makes sense, but it should only be a sensible checker for mapping operations, and mean little for unmap operations. This patch moves this check into map logic only, so that we'll get faster unmap handling (no need to translate again), and also we can then better support unmapping a very big region when it covers non-ram ranges or even not-existing ranges. Acked-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17vfio: introduce vfio_get_vaddr()Peter Xu1-20/+45
A cleanup for vfio_iommu_map_notify(). Now we will fetch vaddr even if the operation is unmap, but it won't hurt much. One thing to mention is that we need the RCU read lock to protect the whole translation and map/unmap procedure. Acked-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17vfio: trace map/unmap for notify as wellPeter Xu2-2/+3
We traces its range, but we don't know whether it's a MAP/UNMAP. Let's dump it as well. Acked-by: Alex Williamson <alex.williamson@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17pcie: simplify pcie_add_capability()Peter Xu1-11/+3
When we add PCIe extended capabilities, we should be following the rule that we add the head extended cap (at offset 0x100) first, then the rest of them. Meanwhile, we are always adding new capability bits at the end of the list. Here the "next" looks meaningless in all cases since it should always be zero (along with the "header"). Simplify the function a bit, and it looks more readable now. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: Fix no interrupt when not creating msi controllerMichael S. Tsirkin1-3/+8
For ARM virt machine, if we use virt-2.7 which will not create ITS node, the virtio-net can not recieve interrupts so it can't get ip address through dhcp. This fixes commit 83d768b(virtio: set ISR on dataplane notifications). Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: use VRingMemoryRegionCaches for avail and used ringsPaolo Bonzini2-37/+109
The virtio-net change is necessary because it uses virtqueue_fill and virtqueue_flush instead of the more convenient virtqueue_push. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: check for vring setup in virtio_queue_update_used_idxPaolo Bonzini1-1/+3
If the vring has not been set up, it is not necessary for vring_used_idx to do anything (as is already the case when the caller is virtio_load). This is harmless for now, but it will be a problem when the MemoryRegionCache has not been set up. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: use VRingMemoryRegionCaches for descriptor ringPaolo Bonzini1-14/+12
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: add MemoryListener to cache ring translationsPaolo Bonzini1-3/+102
The cached translations are RCU-protected to allow efficient use when processing virtqueues. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: use MemoryRegionCache to access descriptorsPaolo Bonzini1-41/+39
For now, the cache is created on every virtqueue_pop. Later on, direct descriptors will be able to reuse it. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: use address_space_map/unmap to access descriptorsPaolo Bonzini1-28/+75
This makes little difference, but it makes the code change smaller for the next patch that introduces MemoryRegionCache. This is because map/unmap are similar to MemoryRegionCache init/destroy. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17virtio: Report real progress in VQ aio poll handlerFam Zheng5-20/+39
In virtio_queue_host_notifier_aio_poll, not all "!virtio_queue_empty()" cases are making true progress. Currently the offending one is virtio-scsi event queue, whose handler does nothing if no event is pending. As a result aio_poll() will spin on the "non-empty" VQ and take 100% host CPU. Fix this by reporting actual progress from virtio queue aio handlers. Reported-by: Ed Swierk <eswierk@skyportsystems.com> Signed-off-by: Fam Zheng <famz@redhat.com> Tested-by: Ed Swierk <eswierk@skyportsystems.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-17pci/pcie: don't assume cap id 0 is reservedMichael S. Tsirkin1-4/+7
VFIO actually wants to create a capability with ID == 0. This is done to make guest drivers skip the given capability. pcie_add_capability then trips up on this capability when looking for end of capability list. To support this use-case, it's easy enough to switch to e.g. 0xffffffff for these comparisons - we can be sure it will never match a 16-bit capability ID. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
2017-02-16Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell7-36/+98
* GUEST_PANICKED improvements (Anton) * vCont gdbstub rewrite (Claudio) * Fix CPU creation with -device (Liyang) * Logging fixes for pty chardevs (Ed) * Makefile "move if changed" fix (Lin) * First part of cpu_exec refactoring (me) * SVM emulation fix (me) * apic_delivered fix (Pavel) * "info ioapic" fix (Peter) * qemu-nbd socket activation (Richard) * QOMification of mcf_uart (Thomas) # gpg: Signature made Thu 16 Feb 2017 17:37:31 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (23 commits) target-i386: correctly propagate retaddr into SVM helpers vl: log available guest crash information report guest crash information in GUEST_PANICKED event i386/cpu: add crash-information QOM property Makefile: avoid leaving the temporary QEMU_PKGVERSION header file vl: Move the cpu_synchronize_all_post_init() after generic devices initialization qemu-nbd: Implement socket activation. qemu-doc: Clarify that -vga std is now the default cpu-exec: remove outermost infinite loop cpu-exec: avoid repeated sigsetjmp on interrupts cpu-exec: avoid cpu_loop_exit in cpu_handle_interrupt cpu-exec: tighten barrier on TCG_EXIT_REQUESTED cpu-exec: fix icount out-of-bounds access hw/char/mcf_uart: QOMify the ColdFire UART gdbstub: Fix vCont behaviour move vm_start to cpus.c char: drop data written to a disconnected pty apic: reset apic_delivered global variable on machine reset qemu-char: socket backend: disconnect on write error test-vmstate: remove yield_until_fd_readable ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-16report guest crash information in GUEST_PANICKED eventAnton Nefedov2-2/+3
it's not very convenient to use the crash-information property interface, so provide a CPU class callback to get the guest crash information, and pass that information in the event Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com> Signed-off-by: Denis V. Lunev <den@openvz.org> Message-Id: <1487053524-18674-3-git-send-email-den@openvz.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16hw/char/mcf_uart: QOMify the ColdFire UARTThomas Huth2-28/+80
Use type_init() etc. to adapt the ColdFire UART to the latest QEMU device conventions. Signed-off-by: Thomas Huth <huth@tuxfamily.org> Message-Id: <1485586582-6490-1-git-send-email-huth@tuxfamily.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16apic: reset apic_delivered global variable on machine resetPavel Dovgalyuk1-0/+2
This patch adds call to apic_reset_irq_delivered when the virtual machine is reset. Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Message-Id: <20170131114054.276.62201.stgit@PASHA-ISP> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16kvm/ioapic: correct kvm ioapic versionPeter Xu1-0/+5
Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1486106298-3699-4-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16ioapic: fix error report value of def versionPeter Xu1-2/+4
It should be 0x20, rather than 0x11. Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1486106298-3699-3-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-16kvm/ioapic: dump real object instead of a fake onePeter Xu1-4/+4
When we do "info ioapic" for kvm ioapic, we were building up a temporary ioapic object. Let's fetch the real one and update correspond to the real object as well. This fixes printing uninitialized version field in ioapic_print_redtbl(). Reported-by: Peter Maydell <peter.maydell@linaro.org> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-Id: <1486106298-3699-2-git-send-email-peterx@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-15net: e1000e: fix an infinite loop issueLi Qiang1-1/+6
This issue is like the issue in e1000 network card addressed in this commit: e1000: eliminate infinite loops on out-of-bounds transfer start. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-02-15net: imx: limit buffer descriptor countPrasad J Pandit1-4/+6
i.MX Fast Ethernet Controller uses buffer descriptors to manage data flow to/fro receive & transmit queues. While transmitting packets, it could continue to read buffer descriptors if a buffer descriptor has length of zero and has crafted values in bd.flags. Set an upper limit to number of buffer descriptors. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-02-15net: e1000e: fix dead code in e1000e_write_packet_to_guestPaolo Bonzini1-1/+1
Because is_first is declared inside a loop, it is always true. The store is dead, and so is the "else" branch of "if (is_first)". is_last is okay though. Reported by Coverity. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2017-02-14Merge remote-tracking branch 'remotes/rth/tags/pull-or-20170214' into stagingPeter Maydell1-2/+2
Queued openrisc patches # gpg: Signature made Mon 13 Feb 2017 21:21:03 GMT # gpg: using RSA key 0xAD1270CC4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" # Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC 16A4 AD12 70CC 4DD0 279B * remotes/rth/tags/pull-or-20170214: (24 commits) target/openrisc: Optimize for r0 being zero target/openrisc: Tidy handling of delayed branches target/openrisc: Tidy ppc/npc implementation target/openrisc: Optimize l.jal to next target/openrisc: Fix madd target/openrisc: Implement muld, muldu, macu, msbu target/openrisc: Represent MACHI:MACLO as a single unit target/openrisc: Implement msync target/openrisc: Enable trap, csync, msync, psync for user mode target/openrisc: Set flags on helpers target/openrisc: Use movcond where appropriate target/openrisc: Keep SR_CY and SR_OV in a separate variables target/openrisc: Keep SR_F in a separate variable target/openrisc: Invert the decoding in dec_calc target/openrisc: Put SR[OVE] in TB flags target/openrisc: Streamline arithmetic and OVE target/openrisc: Rationalize immediate extraction target/openrisc: Tidy insn dumping target/openrisc: Implement lwa, swa target/openrisc: Fix exception handling status registers ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-14target/openrisc: Rename the cpu from or32 to or1kRichard Henderson1-2/+2
This is in keeping with the toolchain and or1ksim. Signed-off-by: Richard Henderson <rth@twiddle.net>
2017-02-13virtio/migration: Migrate virtio-net to VMStateDr. David Alan Gilbert1-105/+211
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20170203160651.19917-5-dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Merge fix against Halil's removal of the '_start' field in VMSTATE_VBUFFER_MULTIPLY
2017-02-13migration: consolidate VMStateField.startHalil Pasic10-16/+14
The member VMStateField.start is used for two things, partial data migration for VBUFFER data (basically provide migration for a sub-buffer) and for locating next in QTAILQ. The implementation of the VBUFFER feature is broken when VMSTATE_ALLOC is used. This however goes unnoticed because actually partial migration for VBUFFER is not used at all. Let's consolidate the usage of VMStateField.start by removing support for partial migration for VBUFFER. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170203175217.45562-1-pasic@linux.vnet.ibm.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-02-13Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170213-1' into ↵Peter Maydell5-52/+67
staging vga: bugfixes for cirrus and virtio-gpu # gpg: Signature made Mon 13 Feb 2017 08:14:47 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-vga-20170213-1: Revert "cirrus: allow zero source pitch in pattern fill rops" cirrus: fix patterncopy checks cirrus: replace debug printf with trace points vga: replace debug printf with trace points virtio-gpu: fix resource leak in virgl_cmd_resource_unref virtio-gpu: fix memory leak in set scanout Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-13Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20170210.0' ↵Peter Maydell2-3/+7
into staging VFIO updates 2017-02-10 - Fix GTT wrap-around for Skylake IGD assignment (Alex Williamson) - Tag vfio-pci-igd-lpc-bridge as bridge device category (Thomas Huth) - Don't build calxeda-xgmac or amd-xgbe except on ARM (Thomas Huth) # gpg: Signature made Fri 10 Feb 2017 21:34:33 GMT # gpg: using RSA key 0x239B9B6E3BB08B22 # gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" # gpg: aka "Alex Williamson <alex@shazbot.org>" # gpg: aka "Alex Williamson <alwillia@redhat.com>" # gpg: aka "Alex Williamson <alex.l.williamson@gmail.com>" # Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B 8A90 239B 9B6E 3BB0 8B22 * remotes/awilliam/tags/vfio-updates-20170210.0: hw/vfio: Add CONFIG switches for calxeda-xgmac and amd-xgbe hw/vfio/pci-quirks: Set category of the "vfio-pci-igd-lpc-bridge" device vfio-pci: Fix GTT wrap-around for Skylake+ IGD Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.1 at 2025-01-16 12:00:26 +0000