When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.
Reported-by: Li Qiang <qiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
commit fefe2a78 accidently dropped the code path for injecting
raw packets. This feature is needed for sending gratuitous ARPs
after an incoming migration has completed. The result is increased
network downtime for vservers where the network card is not virtio-net
with the VIRTIO_NET_F_GUEST_ANNOUNCE feature.
Fixes: fefe2a78ab
Cc: qemu-stable@nongnu.org
Cc: hongyang.yang@easystack.cn
Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Using gcc 6.1 for alpha-linux-user target we see the following build error:
.../target-alpha/translate.c: In function ‘in_superpage’:
.../target-alpha/translate.c:454:52: error: self-comparison always evaluates to true [-Werror=tautological-compare]
&& addr >> TARGET_VIRT_ADDR_SPACE_BITS == addr >> 63);
Reported-by: Pranith Kumar <bobby.prani@gmail.com>
Signed-off-by: Richard Henderson <rth@twiddle.net>
Message-id: 1466192793-2559-1-git-send-email-rth@twiddle.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
target-arm queue:
* arm_gicv3: add missing 'break' statements
* cadence_uart: protect against transmit errors
* cadence_gem: avoid infinite loops with misconfigured buffer
* cadence_gem: set the 'last' bit when 'wrap' is set
* reenable tmp105 test case
* palmetto-bmc: add ASPEED system control unit model
* m25p80: add new 512Mbit and 1Gbit devices
# gpg: Signature made Mon 27 Jun 2016 15:43:42 BST
# gpg: using RSA key 0x3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg: aka "Peter Maydell <pmaydell@gmail.com>"
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE
* remotes/pmaydell/tags/pull-target-arm-20160627:
m25p80: Fix WINBOND fast read command handling
m25p80: New flash devices.
m25p80: Fast read commands family changes.
m25p80: Introduce configuration registers.
m25p80: Introduce quad and equad modes.
m25p80: Add additional flash commands:
m25p80: Introduce COLLECTING_VAR_LEN_DATA state.
m25p80: Allow more than four banks.
m25p80: Make a table for JEDEC ID.
m25p80: Replace JEDEC ID masking with function.
palmetto-bmc: Configure the SCU's hardware strapping register
ast2400: Integrate the SCU model and set silicon revision
hw/misc: Add a model for the ASPEED System Control Unit
arm: Re-enable tmp105 test
cadence_gem: Set the last bit when wrap is set
cadence_gem: Avoid infinite loops with a misconfigured buffer
cadence_uart: Protect against transmit errors
hw/intc/arm_gicv3: Add missing break
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
The SCU is a collection of chip-level control registers that manage the
various functions supported by ASPEED SoCs. Typically the bits control
interactions with clocks, external hardware or reset behaviour, and we
can largly take a hands-off approach to reads and writes.
Firmware makes heavy use of the state to determine how to boot, but the
reset values vary from SoC to SoC (eg AST2400 vs AST2500). A qdev
property is exposed so that the integrating SoC model can configure the
silicon revision, which in-turn selects the appropriate reset values.
Further qdev properties are exposed so the board model can configure the
board-dependent hardware strapping.
Almost all provided AST2400 reset values are specified by the datasheet.
The notable exception is SOC_SCRATCH1, where we mark the DRAM as
successfully initialised to avoid unnecessary dark corners in the SoC's
u-boot support.
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 1466744305-23163-2-git-send-email-andrew@aj.id.au
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: drop unnecessary inttypes.h include]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
ppc patch queue for 2016-06-27
Small queue this time. Main reason for sending it is the pair of
patches to fix up the new cpu hotplug model used on Power to what
should be an actually usable state. There's also a small BookE bugfix
and a XICS trivial cleanup.
# gpg: Signature made Mon 27 Jun 2016 06:28:37 BST
# gpg: using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg: aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg: aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E 87DC 6C38 CACA 20D9 B392
* remotes/dgibson/tags/ppc-for-2.7-20160627:
qapi: keep names in 'CpuInstanceProperties' in sync with struct CPUCore
qapi: Report support for -device cpu hotplug in query-machines
ppc/xics: Remove unused xics_set_irq_type()
target-ppc: ppce500_spin.c uses SPR_PIR, should use SPR_BOOKE_PIR
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
MIPS patches 2016-06-24
Changes:
* support IEEE 754-2008 in MIPS CPUs
# gpg: Signature made Fri 24 Jun 2016 16:09:38 BST
# gpg: using RSA key 0x52118E3C0B29DA6B
# gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>"
# Primary key fingerprint: 8DD3 2F98 5495 9D66 35D4 4FC0 5211 8E3C 0B29 DA6B
* remotes/lalrae/tags/mips-20160624:
target-mips: Add FCR31's FS bit definition
target-mips: Implement FCR31's R/W bitmask and related functionalities
target-mips: Add nan2008 flavor of <CEIL|CVT|FLOOR|ROUND|TRUNC>.<L|W>.<S|D>
target-mips: Add abs2008 flavor of <ABS|NEG>.<S|D>
target-mips: Activate IEEE 754-2008 signaling NaN bit meaning for MSA
linux-user: Update preprocessor constants for Mips-specific e_flags bits
softfloat: Handle snan_bit_is_one == 0 in MIPS pickNaNMulAdd()
softfloat: For Mips only, correct default NaN values
softfloat: Clean code format in fpu/softfloat-specialize.h
softfloat: Implement run-time-configurable meaning of signaling NaN bit
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
struct CPUCore uses 'id' suffix in the property name. As docs for
query-hotpluggable-cpus state that the cpu core properties should be
passed back to device_add by management in case new members are added
and thus the names for the fields should be kept in sync.
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
[dwg: Removed a duplicated word in comment]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
For management apps it's very useful to know whether the selected
machine type supports cpu hotplug via the new -device approach. Using
the presence of 'query-hotpluggable-cpus' alone is not enough as a
witness.
Add a property to 'MachineInfo' called 'hotpluggable-cpus' that will
report the presence of this feature.
Example of output:
{
"hotpluggable-cpus": false,
"name": "mac99",
"cpu-max": 1
},
{
"hotpluggable-cpus": true,
"name": "pseries-2.7",
"is-default": true,
"cpu-max": 255,
"alias": "pseries"
},
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
ppce500_spin.c uses SPR_PIR to initialize the spin table, however on
Book E processors the correct SPR is SPR_BOOKE_PIR.
Signed-off-by: Aaron Larson <alarson@ddci.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Do what the comment says, test for signal_pending non-zero,
rather than the current code which tests for bit 0 non-zero.
Signed-off-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
If the structure pointed by NLMSG_DATA() is bigger
than the size of NLMSG_DATA(), don't swap its fields
to avoid memory corruption.
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
The third argument to the rt_sigqueueinfo syscall is a pointer to
a siginfo_t, not a pointer to a sigset_t. Fix the error in the
arguments to lock_user(), which meant that we would not have
detected some faults that we should.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
Prasad J Pandit