summaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)AuthorFilesLines
2016-06-29Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell21-1218/+182
* serial port fixes (Paolo) * Q35 modeling improvements (Paolo, Vasily) * chardev cleanup improvements (Marc-André) * iscsi bugfix (Peter L.) * cpu_exec patch from multi-arch patches (Peter C.) * pci-assign tweak (Lin Ma) # gpg: Signature made Wed 29 Jun 2016 15:56:30 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (35 commits) socket: unlink unix socket on remove socket: add listen feature char: clean up remaining chardevs when leaving vhost-user: disable chardev handlers on close vhost-user-test: fix g_cond_wait_until compat implementation vl: smp_parse: fix regression ich9: implement SCI_IRQ_SEL register ich9: implement ACPI_EN register serial: reinstate watch after migration serial: remove watch on reset char: change qemu_chr_fe_add_watch to return unsigned serial: separate serial_xmit and serial_watch_cb serial: simplify tsr_retry reset serial: make tsr_retry unsigned iscsi: fix assertion in is_sector_request_lun_aligned target-*: Don't redefine cpu_exec() pci-assign: Move "Invalid ROM" error message to pci-assign-load-rom.c vnc: generalize "VNC server running on ..." message scsi: esp: fix migration MC146818 RTC: add GPIO access to output IRQ ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-29ich9: implement SCI_IRQ_SEL registerPaolo Bonzini1-10/+18
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ich9: implement ACPI_EN registerPaolo Bonzini1-3/+12
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29serial: reinstate watch after migrationPaolo Bonzini1-2/+23
Otherwise, a serial port can get stuck if it is migrated while flow control is in effect. Tested-by: Bret Ketchum <bcketchum@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29serial: remove watch on resetPaolo Bonzini1-4/+12
Otherwise, this can cause serial_xmit to be entered with LSR.TEMT=0, which is invalid and causes an assertion failure. Reported-by: Bret Ketchum <bcketchum@gmail.com> Tested-by: Bret Ketchum <bcketchum@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29char: change qemu_chr_fe_add_watch to return unsignedPaolo Bonzini1-3/+6
g_source_attach can return any value between 1 and UINT_MAX if you let QEMU run long enough. However, qemu_chr_fe_add_watch can also return a negative errno value when the device is disconnected or does not support chr_add_watch. Change it to return zero to avoid overloading these values. Fix the cadence_uart which asserts in this case (easily obtained with "-serial pty"). Tested-by: Bret Ketchum <bcketchum@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29serial: separate serial_xmit and serial_watch_cbPaolo Bonzini1-7/+11
serial_xmit starts transmission of whatever is in the transmitter register, THR or FIFO; serial_watch_cb is a wrapper around it and is only used as a qemu_chr_fe_add_watch callback. Tested-by: Bret Ketchum <bcketchum@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29serial: simplify tsr_retry resetPaolo Bonzini1-3/+1
Move common code outside the if, and reset tsr_retry even in loopback mode. Right now it cannot become non-zero, but it will be possible as soon as we start respecting the baud rate. Tested-by: Bret Ketchum <bcketchum@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29serial: make tsr_retry unsignedPaolo Bonzini1-4/+8
It can never become negative; reflect this in the type of the field and simplify the conditions. Tested-by: Bret Ketchum <bcketchum@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29pci-assign: Move "Invalid ROM" error message to pci-assign-load-rom.cLin Ma2-4/+3
In function pci_assign_dev_load_option_rom, For those pci devices don't have 'rom' file under sysfs or if loading ROM from external file, The function returns NULL, and won't set the passed 'size' variable. In these 2 cases, qemu still reports "Invalid ROM" error message, Users may be confused by it. Signed-off-by: Lin Ma <lma@suse.com> Message-Id: <1466010327-22368-1-git-send-email-lma@suse.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29scsi: esp: fix migrationPaolo Bonzini1-2/+3
Commit 926cde5 ("scsi: esp: make cmdbuf big enough for maximum CDB size", 2016-06-16) changed the size of a migrated field. Split it in two parts, and only migrate the second part in a new vmstate version. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29MC146818 RTC: add GPIO access to output IRQEfimov Vasily1-2/+4
The MC146818 RTC device has output IRQ line. Currently the corresponding field is only accessible through direct access. Such access violates Qemu model. The patch makes the field accessible through GPIO. It also updates the setting of the IRQ during initialization. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29isa: introduce wrapper isa_connect_gpio_outEfimov Vasily1-0/+7
Currently a direct access to the device structure field is used to connect ISA device IRQ to the bus. GPIO access should be used instead if possible. The patch adds wrapper isa_connect_gpio_out. The function connects specified output GPIO to specified ISA IRQ. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ICH9 LPC: move call of isa_bus_irqs to 'realize' methodEfimov Vasily2-3/+2
The isa_bus_irqs function initializes ISA bus IRQ array pointer with specified value. Previously the ICH9 LPC bridge model did not have its own IRQs but only IRQ pointer cache. And same GSI were used for ISA bus and other sources behind the bridge (PCI, SCI). Hence, the pc_q35_init was only possible place to setup both ISA bus IRQs and the bridge IRQ cache. As a result, the call of isa_bus_irqs was made from pc_q35_init. Now the ICH9 LPC bridge has its own output IRQs which are connected to GSI. The output IRQs are already used to route IRQs from PCI and SCI. The patch makes the ICH9 LPC bridge output IRQs to used for ISA bus too. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ICH9 LPC: handle GSI as qdev GPIOEfimov Vasily2-1/+8
The ICH9 LPC bridge has 24 output IRQs connected to GSI. Currently the IRQs are referenced by pointers. The pointers are initialized at startup by direct access to the structure fields. This violates Qemu device model. The patch makes the IRQs handling to use GPIO model. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ich9: unify pic and ioapic IRQ vectorsPaolo Bonzini2-4/+3
ich9->pic and ich9->ioapic differ for the first 16 GSIs (because ich9->pic is wired to 8259+IOAPIC but ich9->ioapic is wired to IOAPIC only). However, ich9->ioapic is never used for the first 16 GSIs, so the two vectors can be merged. Reviewed-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ich9: clean up ich9_lpc_update_pic/ich9_lpc_update_apic and callersPaolo Bonzini1-23/+17
Make ich9_lpc_update_pic take care only of GSIs 0-15, and ich9_lpc_update_apic take care only of GSIs 16-23. Assert that they are called with the correct GSI indices. Reviewed-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ich9: call ich9_lpc_update_pic for disabled pirqsPaolo Bonzini1-3/+0
An asserted pirq can be disabled and the corresponding GSIs should then go down to 0. However, because of the conditional in ich9_lpc_update_by_pirq, the legacy 8259 pin could remain stuck to 1. Reviewed-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ICH9 SMB: make TYPE_ICH9_SMB_DEVICE macro publicEfimov Vasily1-1/+0
ICH9 SMB bridge can be created using qdev API despite existence of helper function. The type name is needed for such creation. Using a preprocessor alias instead the string type name itself is preferable. The patch makes the alias accessible through the header. Signed-off-by: Efimov Vasily <real@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29port92: handle A20 IRQ as GPIOEfimov Vasily1-5/+5
The port92 device has outgouing IRQ line A20. Currently the IRQ is referenced by a pointer which normally is set during machine initialization. The pointer is never changed at runtime. Hence, common GPIO model can be applied to A20 IRQ line. Note that checking for IRQ to be connected as in previous version of code is not required qemu_set_irq will do it. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29pckbd: handle A20 IRQ as GPIOEfimov Vasily1-14/+7
The i8042 device has outgouing IRQ line A20. Currently the IRQ is referenced by a pointer which normally is set during machine initialization. The pointer is never changed at runtime. So common GPIO model can be applied to A20 IRQ line. Note that checking for IRQ to be connected as in previous version of code is not required because qemu_set_irq will do it. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29pc_q35: configure Q35 instance using propertiesEfimov Vasily1-6/+12
Currently, Q35 instance is configured using direct access to structure fields. The patch uses property interface to set the fields. Signed-off-by: Efimov Vasily <real@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29Q35: implement property interfece to several parametersEfimov Vasily1-0/+20
During creation of Q35 instance several parameters are set using direct access. It violates Qemu device model. Correctly, the parameters should be handled as object properties. The patch adds four link type properties for fields: mch.ram_memory mch.pci_address_space mch.system_memory mch.address_space_io And, it adds two size type properties for fields: mch.below_4g_mem_size mch.above_4g_mem_size Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29pflash: make TYPE_CFI_PFLASH0{1,2} macros publicEfimov Vasily2-2/+0
qdev API can be used to create CFI pflash devices despite existance of helper functions. The type name is needed in course of such creation. Using the preprocessor alias instead of the string literal itself is preferable. The patch makes the aliases accessible through the header. Signed-off-by: Efimov Vasily <real@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29vmport: identify vmport type by macro TYPE_VMPORTEfimov Vasily1-1/+0
Currently vmport device is identified by the string literal. Using a preprocessor alias instead is preferable. Signed-off-by: Efimov Vasily <real@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29pcspk: convert "pit" property type from ptr to linkEfimov Vasily1-2/+7
The speaker device needs pointer to ISA PIT device to operate. But according to qdev-properties.h, properties of pointer type should be avoided. It seems a link type property is a good substitution. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29ide: move headers to include folderEfimov Vasily4-1117/+1
The patch moves "hw/ide/achi.h", "hw/ide/pci.h" and "hw/ide/internal.h" headers to corresponding folders inside "include" folder alike other Qemu headers. Signed-off-by: Efimov Vasily <real@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-28hw/sh4/sh_pci.c: Use ldl_le_p() and stl_le_p()Peter Maydell1-2/+2
Use ldl_le_p() and stl_le_p() instead of le32_to_cpup() and cpu_to_le32w(); the former handle misaligned addresses and don't need casts, and the latter are deprecated. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Acked-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 1465575021-3774-1-git-send-email-peter.maydell@linaro.org
2016-06-28Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell4-44/+101
staging # gpg: Signature made Tue 28 Jun 2016 14:23:24 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: virtio-blk: add num-queues device property virtio-blk: dataplane multiqueue support virtio-blk: live migrate s->rq with multiqueue virtio-blk: associate request with a virtqueue virtio-blk: tell dataplane which vq to notify virtio-blk: multiqueue batch notify virtio-blk: add VirtIOBlockConf->num_queues dma-helpers: dma_blk_io() cancel support Revert "virtio: sync the dataplane vring state to the virtqueue before virtio_save" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-28virtio-blk: add num-queues device propertyStefan Hajnoczi1-2/+13
Multiqueue virtio-blk can be enabled as follows: qemu -device virtio-blk-pci,num-queues=8 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1466511196-12612-8-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28virtio-blk: dataplane multiqueue supportStefan Hajnoczi1-16/+34
Monitor ioeventfds for all virtqueues in the device's AioContext. This is not true multiqueue because requests from all virtqueues are processed in a single IOThread. In the future it will be possible to use multiple IOThreads when the QEMU block layer supports multiqueue. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1466511196-12612-7-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28virtio-blk: live migrate s->rq with multiqueueStefan Hajnoczi1-1/+19
Add a field for the virtqueue index when migrating the s->rq request list. The new field is only needed when num_queues > 1. Existing QEMUs are unaffected by this change and therefore virtio-blk migration stays compatible. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1466511196-12612-6-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28virtio-blk: associate request with a virtqueueStefan Hajnoczi1-9/+11
Multiqueue requires that each request knows to which virtqueue it belongs. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1466511196-12612-5-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28virtio-blk: tell dataplane which vq to notifyStefan Hajnoczi3-4/+4
Let the virtio_blk_data_plane_notify() caller decide which virtqueue to notify. This will allow the function to be used with multiqueue. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1466511196-12612-4-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28virtio-blk: multiqueue batch notifyStefan Hajnoczi1-6/+23
The batch notification BH needs to know which virtqueues to notify when multiqueue is enabled. Use a bitmap to track the virtqueues with pending notifications. At this point there is only one virtqueue so hard-code virtqueue index 0. A later patch will switch to real virtqueue indices. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1466511196-12612-3-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28virtio-blk: add VirtIOBlockConf->num_queuesStefan Hajnoczi1-0/+1
The num_queues field is always 1 for the time being. A later patch will make it a configurable device property so that multiqueue can be enabled. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Message-id: 1466511196-12612-2-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28Revert "virtio: sync the dataplane vring state to the virtqueue before ↵Stefan Hajnoczi2-10/+0
virtio_save" This reverts commit 10a06fd65f667a972848ebbbcac11bdba931b544. Dataplane has used the same virtqueue code as non-dataplane since commits e24a47c5b73e04f94030e2daa356c7582aebfca2 ("virtio-scsi: do not use vring in dataplane") and 03de2f527499ae0c6d16a379665d072345254f2c ("virtio-blk: do not use vring in dataplane"). It is no longer necessary to stop dataplane in order to sync state since there is no duplicated virtqueue state. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Message-id: 1466503331-9831-1-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-28Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into ↵Peter Maydell4-142/+158
staging # gpg: Signature made Tue 28 Jun 2016 04:29:53 BST # gpg: using RSA key 0xEF04965B398D6211 # gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211 * remotes/jasowang/tags/net-pull-request: vmxnet3: Fix reading/writing guest memory specially when behind an IOMMU rtl8139: save/load RxMulOk counter (again) Change net/socket.c to use socket_*() functions net: mipsnet: check transmit buffer size before sending net: fix qemu_announce_self not emitting packets Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-28misc/aspeed_scu: Fix build error caused by missing headerPranith Kumar1-0/+1
Tracing configurations error out currently as follows: /home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c: In function ‘aspeed_scu_read’: /home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:9: error: implicit declaration of function ‘qemu_log_mask’ [-Werror=implicit-function-declaration] /home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:9: error: nested extern declaration of ‘qemu_log_mask’ [-Werror=nested-externs] /home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:23: error: ‘LOG_GUEST_ERROR’ undeclared (first use in this function) /home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:130:23: note: each undeclared identifier is reported only once for each function it appears in /home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c: In function ‘aspeed_scu_write’: /home/travis/build/pranith/qemu/hw/misc/aspeed_scu.c:154:23: error: ‘LOG_GUEST_ERROR’ undeclared (first use in this function) This is caused by a missing header file. Fix it. Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 20160627215304.821-1-bobby.prani@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-28vmxnet3: Fix reading/writing guest memory specially when behind an IOMMUKarimAllah Ahmed2-113/+139
When a PCI device lives behind an IOMMU, it should use 'pci_dma_*' family of functions when any transfer from/to guest memory is required while 'cpu_physical_memory_*' family of functions completely bypass any MMU/IOMMU in the system. vmxnet3 in some places was using 'cpu_physical_memory_*' family of functions which works fine with the default QEMU setup where IOMMU is not enabled but fails miserably when IOMMU is enabled. This commit converts all such instances in favor of 'pci_dma_*' Cc: Dmitry Fleytman <dmitry@daynix.com> Cc: Jason Wang <jasowang@redhat.com> Cc: qemu-devel@nongnu.org Cc: Anthony Liguori <aliguori@amazon.com> Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de> Acked-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-06-28rtl8139: save/load RxMulOk counter (again)David Vrabel1-26/+14
Commit 9d29cdeaaca3a0383af764000b71492c4fc67c6e (rtl8139: port TallyCounters to vmstate) introduced in incompatibility in the v4 format as it omitted the RxOkMul counter. There are presumably no users that were impacted by the v4 to v4' breakage, so increase the save version to 5 and re-add the field, keeping backward compatibility with v4'. We can't have a field conditional on the section version in vmstate_tally_counters since this version checked would not be the section version (but the version defined in this structure). So, move all the fields into the main state structure. Signed-off-by: David Vrabel <david.vrabel@citrix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-06-28net: mipsnet: check transmit buffer size before sendingPrasad J Pandit1-3/+5
When processing MIPSnet I/O port write operation, it uses a transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices 's->tx_written' and 's->tx_count' are used to control data written to this buffer. If the two were to be equal before writing, it'd lead to an OOB write access beyond tx_buffer. Add check to avoid it. Reported-by: Li Qiang <qiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-06-27macio: Use blk_drain instead of blk_drain_allFam Zheng1-1/+1
We only care about the associated backend, so blk_drain is more appropriate here. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 20160612065603.21911-1-famz@redhat.com Signed-off-by: John Snow <jsnow@redhat.com>
2016-06-27hw/net/e1000: Don't use *_to_cpup()Peter Maydell3-13/+13
Don't use *_to_cpup() to do byte-swapped loads; instead use ld*_p() which correctly handle misaligned accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> Message-id: 1466097446-981-6-git-send-email-peter.maydell@linaro.org
2016-06-27hw/net/virtio-net.c: Don't use *_to_cpup()Peter Maydell1-1/+1
Don't use *_to_cpup() to do byte-swapped loads; instead use ld*_p() which correctly handle misaligned accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> Message-id: 1466097446-981-5-git-send-email-peter.maydell@linaro.org
2016-06-27hw/net/rocker: Don't use *_to_cpup()Peter Maydell1-3/+3
Don't use *_to_cpup() to do byte-swapped loads; instead use ld*_p() which correctly handle misaligned accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> Message-id: 1466097446-981-4-git-send-email-peter.maydell@linaro.org
2016-06-27hw/net/rtl8139.c: Don't use *_to_cpup()Peter Maydell1-5/+4
Don't use *_to_cpup() to do byte-swapped loads; instead use ld*_p() which correctly handle misaligned accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> Message-id: 1466097446-981-3-git-send-email-peter.maydell@linaro.org
2016-06-27hw/net/eepro100.c: Don't use cpu_to_*w() and *_to_cpup()Peter Maydell1-4/+4
Don't use cpu_to_*w() and *_to_cpup() to do byte-swapped loads and stores; instead use ld*_p() and st*_p() which correctly handle misaligned accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Acked-by: Jason Wang <jasowang@redhat.com> Acked-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> Message-id: 1466097446-981-2-git-send-email-peter.maydell@linaro.org
2016-06-27m25p80: Fix WINBOND fast read command handlingMarcin Krzeminski1-2/+5
This commit fix obvious bug in WINBOND command handling. Datasheet states that default dummy cycles is 8 so fix it. Signed-off-by: Marcin Krzeminski <marcin.krzeminski@nokia.com> Message-id: 1466755631-25201-11-git-send-email-marcin.krzeminski@nokia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-27m25p80: New flash devices.Marcin Krzeminski1-6/+13
Macronix: mx66u51235f and mx66u1g45g Micron: mt25ql01g and mt25qu01g Spansion: s25fs512s and s70fs01gs Signed-off-by: Marcin Krzeminski <marcin.krzeminski@nokia.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-id: 1466755631-25201-10-git-send-email-marcin.krzeminski@nokia.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-02 03:03:12 +0000