Kamal Heib [Thu, 14 Mar 2019 15:30:31 +0000 (17:30 +0200)]
hw/pvrdma: Fix zero-initialization of resp in {query/modify}_qp
Make sure to zero-initialize only the pvrdma_cmd_query_qp_resp and not
the whole pvrdma_cmd_resp for query_qp, in modify_qp the resp isn't used
so remove it.
Yuval Shaia [Mon, 11 Mar 2019 10:29:11 +0000 (03:29 -0700)]
hw/rdma: Free all receive buffers when QP is destroyed
When QP is destroyed the backend QP is destroyed as well. This ensures
we clean all received buffer we posted to it.
However, a contexts of these buffers are still remain in the device.
Fix it by maintaining a list of buffer's context and free them when QP
is destroyed.
Yuval Shaia [Mon, 11 Mar 2019 10:29:09 +0000 (03:29 -0700)]
{hmp, hw/pvrdma}: Expose device internals via monitor interface
Allow interrogating device internals through HMP interface.
The exposed indicators can be used for troubleshooting by developers or
sysadmin.
There is no need to expose these attributes to a management system (e.x.
libvirt) because (1) most of them are not "device-management' related
info and (2) there is no guarantee the interface is stable.
Yuval Shaia [Mon, 11 Mar 2019 10:29:07 +0000 (03:29 -0700)]
hw/rdma: Protect against concurrent execution of poll_cq
The function rdma_poll_cq is called from two contexts - completion
handler thread which sense new completion on backend channel and
explicitly as result of guest issuing poll_cq command.
Add lock to protect against concurrent executions.
Yuval Shaia [Mon, 11 Mar 2019 10:29:05 +0000 (03:29 -0700)]
hw/rdma: Switch to generic error reporting way
Utilize error_report for all pr_err calls and some pr_dbg that are
considered as errors.
For the remaining pr_dbg calls, the important ones were replaced by
trace points while other deleted.
Some of the functions got renamed to include prefix "rdma/pvrdma"
in the function name.
Yuval Shaia [Tue, 12 Feb 2019 11:23:47 +0000 (13:23 +0200)]
contrib/rdmacm-mux: Fix out-of-bounds risk
The function get_fd extract context from the received MAD message and
uses it as a key to fetch the destination fd from the mapping table.
A context can be dgid in case of CM request message or comm_id in case
of CM SIDR response message.
When MAD message with a smaller size as expected for the message type
received we are hitting out-of-bounds where we are looking for the
context out of message boundaries.
Peter Maydell [Fri, 15 Mar 2019 11:39:42 +0000 (11:39 +0000)]
Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20190315' into staging
target-arm queue:
* Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
* virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
* virt-acpi-build: Fix SMMUv3 GSIV values
* Allow EL0 to write to arch timer registers, not just read them
* bcm2836_control: Implement local timer
Some generic arch timer registers are Config-RW in the EL0,
which means the EL0 exception level can have write permission
if it is appropriately configured.
When VM access registers, QEMU firstly checks whether they have RW
permission, then check whether it is appropriately configured.
If they are defined to read only in EL0, even though they have been
appropriately configured, they still do not have write permission.
So need to add the write permission according to ARMV8 spec when
define it.
Eric Auger [Fri, 15 Mar 2019 11:12:28 +0000 (11:12 +0000)]
hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
The GSIV numbers of the SPI based interrupts is not correct as
ARM_SPI_BASE was not added to the irqmap[VIRT_SMMU] value. So
this may collide with VIRTIO_MMIO irq window.
Zoltán Baldaszti [Fri, 15 Mar 2019 11:12:28 +0000 (11:12 +0000)]
hw/intc/bcm2836_control: Implement local timer
The BCM2836 control logic module includes a simple
"local timer" which is a programmable down-counter that
can generates an interrupt. Implement this functionality.
Signed-off-by: Zoltán Baldaszti <[email protected]>
[PMM: wrote commit message; wrapped long line; tweaked
some comments to match the final version of the code] Reviewed-by: Peter Maydell <[email protected]> Signed-off-by: Peter Maydell <[email protected]>
* remotes/vivier2/tags/trivial-branch-pull-request:
tests/.gitignore: ignore test-qapi-emit-events.[ch] for in-tree builds
.gitignore: ignore docs/built created for in-tree builds
maint: Ignore built elf2dmp
Peter Maydell [Thu, 14 Mar 2019 13:04:46 +0000 (13:04 +0000)]
Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-for-4.0-120319-1' into staging
Final testing fixes for 4.0
- various CI tweaks and fixes
- fixes for some tcg tests
- addition of system tcg tests
# gpg: Signature made Tue 12 Mar 2019 17:07:24 GMT
# gpg: using RSA key 6685AE99E75167BCAFC8DF35FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <[email protected]>" [full]
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8 DF35 FBD0 DB09 5A9E 2A44
* remotes/stsquad/tags/pull-testing-for-4.0-120319-1: (26 commits)
.travis.yml: add softmmu check-tcg tests
.travis.yml: separate softfloat from check-tcg
tests/tcg/arm: account for pauth randomness
tests/tcg/i386: add memory test to exercise softmmu
tests/tcg/i386: add system mode Hello World test
tests/tcg: provide a minilib for system tests
tests/tcg: enable cris base user-mode tests
tests/tcg/cris: align mul operations
tests/tcg/cris: comment out the ccs test
tests/tcg: split cris tests into bare and libc directories
tests/tcg/cris: cleanup sys.c
tests/docker: add fedora-cris-cross compilers
tests/tcg/arm: add ARMv6-M UNDEFINED 32-bit instruction test
tests/tcg/xtensa: enable system tests
tests/docker: add debian-xtensa-cross image
tests/tcg/mips: fix hello-mips compilation
tests/tcg: add gdb runner variant
tests/tcg: split run-test into user and system variants
tests/tcg: add QEMU_OPT option for test runner
tests/tcg: enable tcg tests for softmmu
...
Peter Maydell [Thu, 14 Mar 2019 09:34:51 +0000 (09:34 +0000)]
Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging
Pull request
* Add 'drop-cache=on|off' option to file-posix.c. The default is on.
Disabling the option fixes a QEMU 3.0.0 performance regression when live
migrating on the same host with cache.direct=off.
# gpg: Signature made Wed 13 Mar 2019 11:07:48 GMT
# gpg: using RSA key 9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <[email protected]>" [full]
# gpg: aka "Stefan Hajnoczi <[email protected]>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8
Peter Maydell [Wed, 13 Mar 2019 22:20:27 +0000 (22:20 +0000)]
Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.0-sf4' into staging
target/riscv: Convert to decodetree
Bastian: this patchset converts the RISC-V decoder to decodetree in four major steps:
1) Convert 32-bit instructions to decodetree [Patch 1-15]:
Many of the gen_* functions are called by the decode functions for 16-bit
and 32-bit functions. If we move translation code from the gen_*
functions to the generated trans_* functions of decode-tree, we get a lot of
duplication. Therefore, we mostly generate calls to the old gen_* function
which are properly replaced after step 2).
Each of the trans_ functions are grouped into files corresponding to their
ISA extension, e.g. addi which is in RV32I is translated in the file
'trans_rvi.inc.c'.
2) Convert 16-bit instructions to decodetree [Patch 16-18]:
All 16 bit instructions have a direct mapping to a 32 bit instruction. Thus,
we convert the arguments in the 16 bit trans_ function to the arguments of
the corresponding 32 bit instruction and call the 32 bit trans_ function.
3) Remove old manual decoding in gen_* function [Patch 19-29]:
this move all manual translation code into the trans_* instructions of
decode tree, such that we can remove the old decode_* functions.
Palmer: This, with some additional cleanup patches, passed Alistar's
testing on rv32 and rv64 as well as my testing on rv64, so I think it's
good to go. I've run my standard test against this exact tag.
I still don't have a Mac to try this on, sorry!
# gpg: Signature made Wed 13 Mar 2019 13:44:49 GMT
# gpg: using RSA key 00CE76D1834960DFCE886DF8EF4CA1502CCBAB41
# gpg: issuer "[email protected]"
# gpg: Good signature from "Palmer Dabbelt <[email protected]>" [unknown]
# gpg: aka "Palmer Dabbelt <[email protected]>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 00CE 76D1 8349 60DF CE88 6DF8 EF4C A150 2CCB AB41
* remotes/palmer/tags/riscv-for-master-4.0-sf4: (29 commits)
target/riscv: Remove decode_RV32_64G()
target/riscv: Remove gen_system()
target/riscv: Rename trans_arith to gen_arith
target/riscv: Remove manual decoding of RV32/64M insn
target/riscv: Remove shift and slt insn manual decoding
target/riscv: make ADD/SUB/OR/XOR/AND insn use arg lists
target/riscv: Move gen_arith_imm() decoding into trans_* functions
target/riscv: Remove manual decoding from gen_store()
target/riscv: Remove manual decoding from gen_load()
target/riscv: Remove manual decoding from gen_branch()
target/riscv: Remove gen_jalr()
target/riscv: Convert quadrant 2 of RVXC insns to decodetree
target/riscv: Convert quadrant 1 of RVXC insns to decodetree
target/riscv: Convert quadrant 0 of RVXC insns to decodetree
target/riscv: Convert RV priv insns to decodetree
target/riscv: Convert RV64D insns to decodetree
target/riscv: Convert RV32D insns to decodetree
target/riscv: Convert RV64F insns to decodetree
target/riscv: Convert RV32F insns to decodetree
target/riscv: Convert RV64A insns to decodetree
...
configure: remove slirp submodule support that doesn't exist yet
The slirp code is not yet split off into a separate repository, so
configuring QEMU to use slirp as a submodule is premature. This
causes the non-existant "slirp" to be requested from git when syncing
submodules. This in turn appears to be cause of non-deterministic
failures some developers are seeing with QEMU's submodule sync process.
Peter Maydell [Wed, 13 Mar 2019 19:10:40 +0000 (19:10 +0000)]
Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging
pci, pc, virtio: features, fixes, cleanups
intel-iommu scalable option
pcie acs emulation
beginning for vhost-user-blk reconnect and of vhost-user backend work
misc fixes and cleanups
Signed-off-by: Michael S. Tsirkin <[email protected]>
# gpg: Signature made Wed 13 Mar 2019 02:52:02 GMT
# gpg: using RSA key 281F0DB8D28D5469
# gpg: Good signature from "Michael S. Tsirkin <[email protected]>" [full]
# gpg: aka "Michael S. Tsirkin <[email protected]>" [full]
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67
# Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469
* remotes/mst/tags/for_upstream: (26 commits)
i386, acpi: check acpi_memory_hotplug capacity in pre_plug
gen_pcie_root_port: Add ACS (Access Control Services) capability
pcie: Add a simple PCIe ACS (Access Control Services) helper function
vhost-user-blk: Add support to get/set inflight buffer
libvhost-user: Support tracking inflight I/O in shared memory
libvhost-user: Introduce vu_queue_map_desc()
libvhost-user: Remove unnecessary FD flag check for event file descriptors
vhost-user: Support transferring inflight buffer between qemu and backend
nvdimm: use NVDIMM_ACPI_IO_LEN for the proper IO size
nvdimm: use *function* directly instead of allocating it again
nvdimm: fix typo in nvdimm_build_nvdimm_devices argument
intel_iommu: add scalable-mode option to make scalable mode work
intel_iommu: add 256 bits qi_desc support
intel_iommu: scalable mode emulation
libvhost-user: add vu_queue_unpop()
libvhost-user-glib: export vug_source_new()
vhost-user: split vhost_user_read()
vhost-user: wrap some read/write with retry handling
libvhost-user: exit by default on VHOST_USER_NONE
vhost-user: simplify vhost_user_init/vhost_user_cleanup
...
Peter Maydell [Wed, 13 Mar 2019 14:44:28 +0000 (14:44 +0000)]
Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
Block layer patches:
- file-posix: Make auto-read-only dynamic
- Add x-blockdev-reopen QMP command
- Finalize block-latency-histogram QMP command
- gluster: Build fixes for newer lib version
# gpg: Signature made Tue 12 Mar 2019 19:30:31 GMT
# gpg: using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <[email protected]>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6
* remotes/kevin/tags/for-upstream: (28 commits)
qemu-iotests: Test the x-blockdev-reopen QMP command
block: Add an 'x-blockdev-reopen' QMP command
block: Remove the AioContext parameter from bdrv_reopen_multiple()
block: Add bdrv_reset_options_allowed()
block: Add a 'mutable_opts' field to BlockDriver
block: Allow changing the backing file on reopen
block: Allow omitting the 'backing' option in certain cases
block: Handle child references in bdrv_reopen_queue()
block: Add 'keep_old_opts' parameter to bdrv_reopen_queue()
block: Freeze the backing chain for the duration of the stream job
block: Freeze the backing chain for the duration of the mirror job
block: Freeze the backing chain for the duration of the commit job
block: Allow freezing BdrvChild links
nvme: fix write zeroes offset and count
file-posix: Make auto-read-only dynamic
file-posix: Prepare permission code for fd switching
file-posix: Lock new fd in raw_reopen_prepare()
file-posix: Store BDRVRawState.reopen_state during reopen
file-posix: Factor out raw_reconfigure_getfd()
file-posix: Fix bdrv_open_flags() for snapshot=on
...
Peter Maydell [Wed, 13 Mar 2019 13:09:38 +0000 (13:09 +0000)]
Merge remote-tracking branch 'remotes/rth/tags/pull-dt-20190312' into staging
Break out documentation to docs/devel/.
Add support for pattern groups.
Other misc cleanups for multiple decode functions.
# gpg: Signature made Tue 12 Mar 2019 16:59:37 GMT
# gpg: using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <[email protected]>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A 05C0 64DF 38E8 AF7E 215F
* remotes/rth/tags/pull-dt-20190312:
decodetree: Properly diagnose fields overflowing an insn
decodetree: Prefix extract function names with decode_function
decodetree: Allow +- to begin a number initializing a field
decodetree: Produce clean output for an empty input file
decodetree: Add --static-decode option
test/decode: Add tests for PatternGroups
decodetree: Allow grouping of overlapping patterns
decodetree: Do not unconditionaly return from Pattern.output_code
decodetree: Ensure build_tree does not include values outside insnmask
decodetree: Document the usefulness of argument sets
decodetree: Move documentation to docs/devel/decodetree.rst
MAINTAINERS: Add scripts/decodetree.py to the TCG section
Stefan Hajnoczi [Thu, 7 Mar 2019 16:49:41 +0000 (16:49 +0000)]
file-posix: add drop-cache=on|off option
Commit dd577a26ff03b6829721b1ffbbf9e7c411b72378 ("block/file-posix:
implement bdrv_co_invalidate_cache() on Linux") introduced page cache
invalidation so that cache.direct=off live migration is safe on Linux.
The invalidation takes a significant amount of time when the file is
large and present in the page cache. Normally this is not the case for
cross-host live migration but it can happen when migrating between QEMU
processes on the same host.
On same-host migration we don't need to invalidate pages for correctness
anyway, so an option to skip page cache invalidation is useful. I
investigated optimizing invalidation and detecting same-host migration,
but both are hard to achieve so a user-visible option will suffice.
As a bonus this option means that the cache invalidation feature will
now be detectable by libvirt via QMP schema introspection.
target/riscv: make ADD/SUB/OR/XOR/AND insn use arg lists
manual decoding in gen_arith() is not necessary with decodetree. For now
the function is called trans_arith as the original gen_arith still
exists. The former will be renamed to gen_arith as soon as the old
gen_arith can be removed.
target/riscv: Move gen_arith_imm() decoding into trans_* functions
gen_arith_imm() does a lot of decoding manually, which was hard to read
in case of the shift instructions and is not necessary anymore with
decodetree.
target/riscv: Convert RV64I load/store insns to decodetree
this splits the 64-bit only instructions into its own decode file such
that we generate the decoder for these instructions only for the RISC-V
64 bit target.
Samuel Thibault [Mon, 11 Mar 2019 13:51:27 +0000 (14:51 +0100)]
curses: add option to specify VGA font encoding
This uses iconv to convert glyphs from the specified VGA font encoding to
unicode, and makes use of cchar_t instead of chtype when using ncursesw,
which allows to store all wide char as well as the WACS values. The default
charset is made CP437 since that is the charset of the hardware default VGA
font. This also makes the curses backend set the LC_CTYPE locale to "" to
allow curses to emit wide characters.
Before we do device realization and plug, we should allocate necessary
resources and check if memory-hotplug-support property is enabled.
At the piix4 and ich9, the memory-hotplug-support property is checked at
plug stage. This means that device has been realized and mapped into guest
address space 'pc_dimm_plug()' by the time acpi plug handler is called,
where it might fail and crash QEMU due to reaching g_assert_not_reached()
(piix4) or error_abort (ich9).
Fix it by checking if memory hotplug is enabled at pre_plug stage
where we can gracefully abort hotplug request.
Knut Omang [Thu, 21 Feb 2019 18:13:23 +0000 (19:13 +0100)]
gen_pcie_root_port: Add ACS (Access Control Services) capability
Claim ACS support in the generic PCIe root port to allow
passthrough of individual functions of a device to different
guests (in a nested virt.setting) with VFIO.
Without this patch, all functions of a device, such as all VFs of
an SR/IOV device, will end up in the same IOMMU group.
A similar situation occurs on Windows with Hyper-V.
In the single function device case, it also has a small cosmetic
benefit in that the root port itself is not grouped with
the device. VFIO handles that situation in that binding rules
only apply to endpoints, so it does not limit passthrough in
those cases.
Knut Omang [Thu, 21 Feb 2019 18:13:22 +0000 (19:13 +0100)]
pcie: Add a simple PCIe ACS (Access Control Services) helper function
Implementing an ACS capability on downstream ports and multifunction
endpoints indicates isolation and IOMMU visibility to a finer
granularity. This creates smaller IOMMU groups in the guest and thus
more flexibility in assigning endpoints to guest userspace or an L2
guest.
Xie Yongji [Thu, 28 Feb 2019 08:53:52 +0000 (16:53 +0800)]
libvhost-user: Support tracking inflight I/O in shared memory
This patch adds support for VHOST_USER_GET_INFLIGHT_FD and
VHOST_USER_SET_INFLIGHT_FD message to set/get shared buffer
to/from qemu. Then backend can track inflight I/O in this buffer.
Xie Yongji [Thu, 28 Feb 2019 08:53:49 +0000 (16:53 +0800)]
vhost-user: Support transferring inflight buffer between qemu and backend
This patch introduces two new messages VHOST_USER_GET_INFLIGHT_FD
and VHOST_USER_SET_INFLIGHT_FD to support transferring a shared
buffer between qemu and backend.
Firstly, qemu uses VHOST_USER_GET_INFLIGHT_FD to get the
shared buffer from backend. Then qemu should send it back
through VHOST_USER_SET_INFLIGHT_FD each time we start vhost-user.
This shared buffer is used to track inflight I/O by backend.
Qemu should retrieve a new one when vm reset.
Yi Sun [Tue, 5 Mar 2019 02:34:55 +0000 (10:34 +0800)]
intel_iommu: add scalable-mode option to make scalable mode work
This patch adds an option to provide flexibility for user to expose
Scalable Mode to guest. User could expose Scalable Mode to guest by
the config as below:
Liu, Yi L [Tue, 5 Mar 2019 02:34:53 +0000 (10:34 +0800)]
intel_iommu: scalable mode emulation
Intel(R) VT-d 3.0 spec introduces scalable mode address translation to
replace extended context mode. This patch extends current emulator to
support Scalable Mode which includes root table, context table and new
pasid table format change. Now intel_iommu emulates both legacy mode
and scalable mode (with legacy-equivalent capability set).
The key points are below:
1. Extend root table operations to support both legacy mode and scalable
mode.
2. Extend context table operations to support both legacy mode and
scalable mode.
3. Add pasid tabled operations to support scalable mode.
Since commit 2566378d6d13bf4d28c7770bdbda5f7682594bbe, libvhost-user
no longer panics on disconnect (rc == 0), and instead silently ignores
an invalid VHOST_USER_NONE message.
Without extra work from the API user, this will simply busy-loop on
HUP events. The obvious thing to do is to exit(0) instead, while
additional or different work can be done by overriding
iface->process_msg().
vhost-user: define conventions for vhost-user backends
As discussed during "[PATCH v4 00/29] vhost-user for input & GPU"
review, let's define a common set of backend conventions to help with
management layer implementation, and interoperability.
contrib/libvhost-user/libvhost-user.c:953:20: error: implicit conversion from enumeration type 'enum VhostUserSlaveRequest' to different enumeration type 'VhostUserRequest' (aka 'enum VhostUserRequest') [-Werror,-Wenum-conversion]
.request = VHOST_USER_SLAVE_VRING_HOST_NOTIFIER_MSG,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
David Gibson [Wed, 6 Mar 2019 03:06:01 +0000 (14:06 +1100)]
virtio-balloon: Restore MADV_WILLNEED hint on balloon deflate
Prior to f6deb6d9 "virtio-balloon: Remove unnecessary MADV_WILLNEED on
deflate", the balloon device issued an madvise() MADV_WILLNEED on
pages removed from the balloon. That would hint to the host kernel
that the pages were likely to be needed by the guest in the near
future.
It's unclear if this is actually valuable or not, and so f6deb6d9
removed this, essentially ignoring balloon deflate requests. However,
concerns have been raised that this might cause a performance
regression by causing extra latency for the guest in certain
configurations.
So, until we can get actual benchmark data to see if that's the case,
this restores the old behaviour, issuing a MADV_WILLNEED when a page is
removed from the balloon.
David Gibson [Wed, 6 Mar 2019 03:06:00 +0000 (14:06 +1100)]
virtio-balloon: Fix possible guest memory corruption with inflates & deflates
This fixes a balloon bug with a nasty consequence - potentially
corrupting guest memory - but which is extremely unlikely to be
triggered in practice.
The balloon always works in 4kiB units, but the host could have a
larger page size on certain platforms. Since ed48c59 "virtio-balloon:
Safely handle BALLOON_PAGE_SIZE < host page size" we've handled this
by accumulating requests to balloon 4kiB subpages until they formed a
full host page. Since f6deb6d "virtio-balloon: Remove unnecessary
MADV_WILLNEED on deflate" we essentially ignore deflate requests.
Suppose we have a host with 8kiB pages, and one host page has subpages
A & B. If we get this sequence of events -
inflate A
deflate A
inflate B
- the current logic will discard the whole host page. That's
incorrect because the guest has deflated subpage A, and could have
written important data to it.
This patch fixes the problem by adjusting our state information about
partially ballooned host pages when deflate requests are received.
ed48c59875b6 "virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host
page size" introduced a new temporary data structure which tracks 4kiB
chunks which have been inserted into the balloon by the guest but
don't yet form a full host page which we can discard.
Unfortunately, I had a thinko and allocated that structure with
g_malloc0() but freed it with a plain free() rather than g_free().
This corrects the problem.
Wei Wang [Tue, 12 Mar 2019 09:34:40 +0000 (17:34 +0800)]
virtio-balloon: fix a use-after-free case
The elem could theorically contain both outbuf and inbufs. We move the
free operation to the end of this function to avoid using elem->in_sg
while elem has been freed.
* remotes/huth-gitlab/tags/pull-request-2019-03-12:
scripts/qemugdb: re-license timers.py to GPLv2 or later
hw/sd/sdhci: Move PCI-related code into a separate file
ahci-test: Drop dependence on global_qtest
tests: test-announce-self: fix memory leak
projects / qemu.git / log