summaryrefslogtreecommitdiffstats
path: root/hw/display
Commit message (Collapse)AuthorAgeFilesLines
* vmware-vga: use vmsvga_verify_rect in vmsvga_fill_rectGerd Hoffmann2014-10-291-7/+10
| | | | | | | | Add verification to vmsvga_fill_rect, re-enable HW_FILL_ACCEL. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
* vmware-vga: use vmsvga_verify_rect in vmsvga_copy_rectGerd Hoffmann2014-10-291-6/+14
| | | | | | | | Add verification to vmsvga_copy_rect, re-enable HW_RECT_ACCEL. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
* vmware-vga: use vmsvga_verify_rect in vmsvga_update_rectGerd Hoffmann2014-10-281-28/+4
| | | | | | | | | | | Switch vmsvga_update_rect over to use vmsvga_verify_rect. Slight change in behavior: We don't try to automatically fixup rectangles any more. In case we find invalid update requests we'll do a full-screen update instead. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
* vmware-vga: add vmsvga_verify_rectGerd Hoffmann2014-10-281-1/+52
| | | | | | | | | Add verification function for rectangles, returning true if verification passes and false otherwise. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
* vmware-vga: CVE-2014-3689: turn off hw accelGerd Hoffmann2014-10-281-0/+2
| | | | | | | | | | | | | | Quick & easy stopgap for CVE-2014-3689: We just compile out the hardware acceleration functions which lack sanity checks. Thankfully we have capability bits for them (SVGA_CAP_RECT_COPY and SVGA_CAP_RECT_FILL), so guests should deal just fine, in theory. Subsequent patches will add the missing checks and re-enable the hardware acceleration emulation. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
* Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell2014-10-221-1/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Block patches # gpg: Signature made Mon 20 Oct 2014 13:04:09 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: (28 commits) block: Make device model's references to BlockBackend strong block: Lift device model API into BlockBackend blockdev: Convert qmp_eject(), qmp_change_blockdev() to BlockBackend block/qapi: Convert qmp_query_block() to BlockBackend blockdev: Fix blockdev-add not to create DriveInfo blockdev: Drop superfluous DriveInfo member id pc87312: Drop unused members of PC87312State ide: Complete conversion from BlockDriverState to BlockBackend hw: Convert from BlockDriverState to BlockBackend, mostly virtio-blk: Rename VirtIOBlkConf variables to conf virtio-blk: Drop redundant VirtIOBlock member conf block: Rename BlockDriverCompletionFunc to BlockCompletionFunc block: Rename BlockDriverAIOCB* to BlockAIOCB* block: Eliminate DriveInfo member bdrv, use blk_by_legacy_dinfo() block: Merge BlockBackend and BlockDriverState name spaces block: Eliminate BlockDriverState member device_name[] block: Eliminate bdrv_iterate(), use bdrv_next() blockdev: Eliminate drive_del() block: Make BlockBackend own its BlockDriverState block: Code motion to get rid of stubs/blockdev.c ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw: Convert from BlockDriverState to BlockBackend, mostlyMarkus Armbruster2014-10-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device models should access their block backends only through the block-backend.h API. Convert them, and drop direct includes of inappropriate headers. Just four uses of BlockDriverState are left: * The Xen paravirtual block device backend (xen_disk.c) opens images itself when set up via xenbus, bypassing blockdev.c. I figure it should go through qmp_blockdev_add() instead. * Device model "usb-storage" prompts for keys. No other device model does, and this one probably shouldn't do it, either. * ide_issue_trim_cb() uses bdrv_aio_discard() instead of blk_aio_discard() because it fishes its backend out of a BlockAIOCB, which has only the BlockDriverState. * PC87312State has an unused BlockDriverState[] member. The next two commits take care of the latter two. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| * block: Eliminate DriveInfo member bdrv, use blk_by_legacy_dinfo()Markus Armbruster2014-10-201-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch is big, but all it really does is replacing dinfo->bdrv by blk_bs(blk_by_legacy_dinfo(dinfo)) The replacement is repetitive, but the conversion of device models to BlockBackend is imminent, and will shorten it to just blk_legacy_dinfo(dinfo). Line wrapping muddies the waters a bit. I also omit tests whether dinfo->bdrv is null, because it never is. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoît Canet <benoit.canet@nodalink.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
* | Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20141015-1' into ↵Peter Maydell2014-10-221-0/+5
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | staging qxl: keep going if reaching guest bug on empty area # gpg: Signature made Wed 15 Oct 2014 11:45:37 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/spice/tags/pull-spice-20141015-1: qxl: keep going if reaching guest bug on empty area Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qxl: keep going if reaching guest bug on empty areaMarc-André Lureau2014-10-151-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Xorg server hangs when using xfig and typing a text with space: #0 qxl_wait_for_io_command (qxl=<value optimized out>) at qxl_io.c:47 #1 0x00007f826a49a299 in qxl_download_box (surface=0x221d030, x1=231, y1=259, x2=<value optimized out>, y2=<value optimized out>) at qxl_surface.c:143 while (!(ram_header->int_pending & QXL_INTERRUPT_IO_CMD)) usleep (1); The QXL driver is calling QXL_IO_UPDATE_AREA with an empty area. This is a guest bug. The call is async and no ack is sent back on guest bug, so the X server will hang. The driver should be improved to avoid this situation and also to abort on QXL_INTERRUPT_ERROR. This will be a different patch series for the driver. However, it is simple enough to keep qemu running on empty areas update, which is what this patch provides. https://bugzilla.redhat.com/show_bug.cgi?id=1151363 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | hw/display/vga: Remove unused arrays dmask4 and dmask16Peter Maydell2014-10-151-26/+0
| | | | | | | | | | | | | | | | | | | | Following cleanup of the vga device code in commit d2e043a8041, the arrays dmask4 and dmask16 are now unused. gcc doesn't warn about this, but clang does; remove them. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | vga-pci: add qext region to mmioGerd Hoffmann2014-10-151-0/+70
|/ | | | | | | | | | | Add a qemu extented register range to the standard vga mmio bar. Right nowe there are two registers: One readonly register returning the size of the region (so we can easily add more registers there if needed) and one endian control register, so guests (especially ppc) can flip the framebuffer endianness as they need it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Add endian to vmstateBenjamin Herrenschmidt2014-09-302-4/+39
| | | | | | | | | | | | | | | | | Include the endian state in the migration stream as an optional subsection which we only include when the endian isn't the default, thus enabling backward compatibility of the common case. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Changes by kraxel: * Remove bochs dispi interface changes. We'll do that in a different way to make sure we don't conflict with possible future bochs dispi interface changes. * keep live migration bits. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Make fb endian a common state variableBenjamin Herrenschmidt2014-09-302-13/+20
| | | | | | | | And initialize it based on target endian Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Rename vga_template.h to vga-helpers.hBenjamin Herrenschmidt2014-09-302-1/+1
| | | | | | | | | | It's no longer a template, we only instanciate the file once. Keep it a #included file so the functions remain static. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove some "should be done in BIOS" commentsBenjamin Herrenschmidt2014-09-301-4/+2
| | | | | | | | | Not all platforms have a VGA BIOS, powerpc typically relies on using the DISPI interface to initialize the card. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* cirrus: Remove non-32bpp cursor drawingBenjamin Herrenschmidt2014-09-302-130/+36
| | | | | | | | | We only draw cursor on non-shared surfaces (so it seems...) and these are always 32bpp Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Simplify vga_draw_blank() a bitBenjamin Herrenschmidt2014-09-301-7/+2
| | | | | | | | | The test for surface_bits_per_pixel() isn't necessary anymore, the 8bpp case never happens. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove rgb_to_pixel indirectionBenjamin Herrenschmidt2014-09-303-29/+19
| | | | | | | | We always use rgb_to_pixel32 nowadays. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Separate LE and BE conversion functionsBenjamin Herrenschmidt2014-09-302-40/+112
| | | | | | | | | | | | Provide different functions for converting from an LE vs a BE framebuffer. We cannot rely on the simple cases always being shared surfaces since cirrus will need to always shadow for cursor emulation, so we need the full set of functions to be able to later handle runtime switching. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\ Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove remainder of old conversion cruftBenjamin Herrenschmidt2014-09-302-178/+95
| | | | | | | | | | All the macros used to generate different versions of vga_template.h are now unnecessary, take them all out and remove the _32 suffix from most functions. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Start cutting out non-32bpp conversion supportBenjamin Herrenschmidt2014-09-301-236/+22
| | | | | | | | | | | | | Nowadays, we either share a surface with the host, or we create a 32bpp ARGB console surface. So we only need to draw/convert to 32bpp, enabling us to remove all but one instance of vga_template.h inclusion (to be further cleaned up), rgb_to_pixel_* etc... Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* Merge remote-tracking branch ↵Peter Maydell2014-09-302-16/+0
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20140929' into staging target-arm: * more EL2/EL3 preparation work * don't handle c15_cpar changes via tb_flush() * fix some unused function warnings in ARM devices * build the GDB XML for 32 bit CPUs into qemu-*-aarch64 * implement guest breakpoint support # gpg: Signature made Mon 29 Sep 2014 19:25:37 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140929: target-arm: Add support for VIRQ and VFIQ target-arm: Add IRQ and FIQ routing to EL2 and 3 target-arm: A64: Emulate the SMC insn target-arm: Add a Hypervisor Trap exception type target-arm: A64: Emulate the HVC insn target-arm: A64: Correct updates to FAR and ESR on exceptions target-arm: Don't take interrupts targeting lower ELs target-arm: Break out exception masking to a separate func target-arm: A64: Refactor aarch64_cpu_do_interrupt target-arm: Add SCR_EL3 target-arm: Add HCR_EL2 target-arm: Don't handle c15_cpar changes via tb_flush() hw/input/tsc210x.c: Delete unused array tsc2101_rates hw/display/pxa2xx_lcd.c: Remove unused function pxa2xx_dma_rdst_set hw/intc/imx_avic.c: Remove unused function imx_avic_set_prio() hw/display/blizzard.c: Delete unused function blizzard_rgb2yuv configure: Build GDB XML for 32 bit ARM CPUs into qemu aarch64 binaries target-arm: Implement handling of breakpoint firing target-arm: Implement setting guest breakpoints Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/display/pxa2xx_lcd.c: Remove unused function pxa2xx_dma_rdst_setPeter Maydell2014-09-291-8/+0
| | | | | | | | | | | | | | The function pxa2xx_dma_rdst_set() is unused; delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410723223-17711-4-git-send-email-peter.maydell@linaro.org
| * hw/display/blizzard.c: Delete unused function blizzard_rgb2yuvPeter Maydell2014-09-291-8/+0
| | | | | | | | | | | | | | The function blizzard_rgb2yuv() is unused; delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410723223-17711-2-git-send-email-peter.maydell@linaro.org
* | qxl: use graphic_console_set_hwopsGerd Hoffmann2014-09-291-40/+9
|/ | | | | | | | Simply switch function pointers when entering/leaving vga mode. Allows to remove wrapper functions which do nothing but dispatch calls depending on the current qxl mode. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* tcx: Implement hardware accelerationMark Cave-Ayland2014-09-231-118/+559
| | | | | | | | | | | | | | | The S24/TCX framebuffer is a mildly accelerated video card with blitter, stippler and hardware cursor. * Solaris and NetBSD 6.x use all the hardware acceleration features * The Xorg driver (used by Linux) can use the hardware cursor only This patch implements hardware acceleration in both 8 bit and 24 bit modes. It is based on the NetBSD driver sources and from tests with Solaris. Signed-off-by: Olivier Danet <odanet@caramail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2014-09-127-11/+17
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Memory: improve error reporting and avoid crashes on hotplug - Build: fixing block/iscsi.so and ranlib warnings on Mac OS X - Migration fixes for x86 - The odd KVM patch. # gpg: Signature made Thu 11 Sep 2014 11:21:10 BST using RSA key ID 9B4D86F2 # gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>" # gpg: aka "Paolo Bonzini <bonzini@gnu.org>" * remotes/bonzini/tags/for-upstream: (21 commits) gdbstub: init mon_chr through qemu_chr_alloc pckbd: adding new fields to vmstate mc146818rtc: add missed field to vmstate piix: do not set irq while loading vmstate serial: fixing vmstate for save/restore parallel: adding vmstate for save/restore fdc: adding vmstate for save/restore cpu: init vmstate for ticks and clock offset apic_common: vapic_paddr synchronization fix vl: use QLIST_FOREACH_SAFE to visit change state handlers exec: add parameter errp to gethugepagesize exec: report error when memory < hpagesize hostmem-ram: don't exit qemu if size of memory-backend-ram is way too big memory: add parameter errp to memory_region_init_rom_device memory: add parameter errp to memory_region_init_ram exec: add parameter errp to qemu_ram_alloc and qemu_ram_alloc_from_ptr rules.mak: Fix DSO build by pulling in archive symbols util: Don't link host-utils.o if it's empty util: Move general qemu_getauxval to util/getauxval.c trace: Only link generated-tracers.o with "simple" backend ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * memory: add parameter errp to memory_region_init_ramHu Tao2014-09-097-11/+17
| | | | | | | | | | | | | | | | | | Add parameter errp to memory_region_init_ram and update all call sites to pass in &error_abort. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/pull-console-20140905-2' ↵Peter Maydell2014-09-114-12/+21
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging console: pixman switchover continued, add some infrastructure to make it easier using pixman in display device emulation. # gpg: Signature made Fri 05 Sep 2014 14:38:57 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-console-20140905-2: console: Remove unused QEMU_BIG_ENDIAN_FLAG console: add qemu_pixman_linebuf_copy console: add dpy_gfx_update_dirty console: add qemu_create_displaysurface_guestmem console: stop using PixelFormat console: reimplement qemu_default_pixelformat console: add qemu_default_pixman_format console: add qemu_pixelformat_from_pixman Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * console: stop using PixelFormatGerd Hoffmann2014-09-054-12/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the qemu console core stops using PixelFormat and pixman format codes side-by-side, pixman format code is the primary way to specify the DisplaySurface format: * DisplaySurface stops carrying a PixelFormat field. * qemu_create_displaysurface_from() expects a pixman format now. Functions to convert PixelFormat to pixman_format_code_t (and back) exist for those who still use PixelFormat. As PixelFormat allows easy access to masks and shifts it will probably continue to exist. [ xenfb added by Benjamin Herrenschmidt ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | vbe: rework sanity checksGerd Hoffmann2014-09-041-59/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Plug a bunch of holes in the bochs dispi interface parameter checking. Add a function doing verification on all registers. Call that unconditionally on every register write. That way we should catch everything, even changing one register affecting the valid range of another register. Some of the holes have been added by commit e9c6149f6ae6873f14a12eea554925b6aa4c4dec. Before that commit the maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES * 32 bpp) has been smaller than the qemu vga memory (8MB) and the checking for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok. Some of the holes have been there forever, such as VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes lacking any verification. Security impact: (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga frame buffer as source -> host memory leak. Memory isn't leaked to the guest but to the vnc client though. (2) Qemu will segfault in case the memory range happens to include unmapped areas -> Guest can DoS itself. The guest can not modify host memory, so I don't think this can be used by the guest to escape. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* | vbe: make bochs dispi interface return the correct memory size with qxlGerd Hoffmann2014-09-043-2/+7
|/ | | | | | | | | | | | | | VgaState->vram_size is the size of the pci bar. In case of qxl not the whole pci bar can be used as vga framebuffer. Add a new variable vbe_size to handle that case. By default (if unset) it equals vram_size, but qxl can set vbe_size to something else. This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results and sanity checks are done with the correct size too. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* qxl-render: add more sanity checksGerd Hoffmann2014-09-011-1/+3
| | | | | | | | | | | | | | Damn, the dirty rectangle values are signed integers. So the checks added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good enough, we also have to make sure they are not negative. [ Note: There must be something broken in spice-server so we get negative values in the first place. Bug opened: https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* memory: convert memory_region_destroy to object_unparentPaolo Bonzini2014-08-181-1/+1
| | | | | | | | | Explicitly call object_unparent in the few places where we will re-create the memory region. If the memory region is simply being destroyed as part of device teardown, let QOM handle it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vga: do not dynamically allocate chain4_aliasPaolo Bonzini2014-08-172-15/+12
| | | | | | | | | Instead, add a boolean variable to indicate the presence of the region. This avoids a repeated malloc/free (later we can also avoid the add_child/unparent by changing the offset/size of the alias). Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cirrus: Fix host CPU blitsBenjamin Herrenschmidt2014-07-111-2/+1
| | | | | | | | | | | | | | | | | | | Commit b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef "CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke cpu to video blits. When the ROP function is called from cirrus_bitblt_cputovideo_next(), we pass 0 for the pitch but only operate on one line at a time. The added test was tripping because after the initial substraction, the pitch becomes negative. Make the test only trip when the height is larger than one (ie. the pitch is actually used). This fixes HW cursor support in Windows NT4.0 (which otherwise was a white rectangle) and general display of icons in that OS when using 8bpp mode. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus: Fix build of debug codeBenjamin Herrenschmidt2014-07-111-4/+4
| | | | | | | Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus_vga: adding sanity check for vram sizeGonglei2014-07-111-0/+16
| | | | | | | | | | | when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xen: build on ARMStefano Stabellini2014-07-071-8/+10
| | | | | | | | | | | | Collection of fixes to build QEMU with Xen support on ARM: - use xenstore_read_fe_uint64 to retrieve the page-ref (xenfb); - use xen_pfn_t instead of unsigned long in xenfb; - unsigned long/xenpfn_t in xen_remove_from_physmap; - in xen-mapcache.c use HOST_LONG_BITS to check for QEMU's address space size. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* spice: fix 32bit buildGerd Hoffmann2014-06-201-1/+1
| | | | | | | Tested-by: Luiz Capitulino <lcapitulino@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1403244764-8622-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela2014-06-164-12/+6
| | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* qxl-render: add sanity checkGerd Hoffmann2014-06-131-0/+6
| | | | | | | Verify dirty rectangle is completely within the primary surface, just ignore it in case it isn't. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* spice: add mouse cursor supportGerd Hoffmann2014-06-131-1/+5
| | | | | | | So you'll have a mouse pointer when running non-qxl gfx cards with mouse pointer support (virtio-gpu, IIRC vmware too). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw: vmware_vga: don't return cursorx when the driver asks for cursory registerNicolas Owens2014-06-101-1/+1
| | | | | | | | | | | hello qemu-*@nongnu.org, this is my first contribution. apologies if something is incorrect. this patch fixes vmware_vga.c so that it actually returns the cursory register when asked for, instead of cursorx. Signed-off-by: Nicolas Owens <mischief@offblast.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into stagingPeter Maydell2014-06-052-38/+53
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | * remotes/mcayland/qemu-sparc: apb: implement IOMMU translation for PCI host bridge apb: handle reading/writing of IOMMU control registers apb: fix IOMMU register sizes apb: Move IOMMU registers into a separate IOMMUState struct tcx: move initialisation from realizefn to initfn tcx: move initialisation from SysBusDevice class to TCX class realizefn cg3: add extra check to prevent CG3 register array overflow cg3: move initialisation from realizefn to initfn Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tcx: move initialisation from realizefn to initfnMark Cave-Ayland2014-06-051-18/+28
| | | | | | | | | | | | | | Initialisation cleanup as suggested by Andreas. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
| * tcx: move initialisation from SysBusDevice class to TCX class realizefnMark Cave-Ayland2014-06-051-14/+12
| | | | | | | | | | | | | | This is an intermediate step to bring TCX in line with CG3. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
| * cg3: add extra check to prevent CG3 register array overflowMark Cave-Ayland2014-06-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | The case statements in the CG3 read and write register routines have a maximum value of CG3_REG_SIZE, so if a value were written to this offset then it would overflow the register array. Currently this cannot be exploited since the MemoryRegion restricts accesses to the range 0 ... CG3_REG_SIZE - 1, but it seems worth clarifying this for future review and/or static analysis. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Paolo Bonzini <pbonzini@redhat.com>
| * cg3: move initialisation from realizefn to initfnMark Cave-Ayland2014-06-051-8/+15
| | | | | | | | | | | | | | Initialisation cleanup as suggested by Andreas. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
OpenPOWER on IntegriCloud