summaryrefslogtreecommitdiffstats
path: root/hw/display
Commit message (Collapse)AuthorAgeFilesLines
* vbe: rework sanity checksGerd Hoffmann2014-09-041-59/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Plug a bunch of holes in the bochs dispi interface parameter checking. Add a function doing verification on all registers. Call that unconditionally on every register write. That way we should catch everything, even changing one register affecting the valid range of another register. Some of the holes have been added by commit e9c6149f6ae6873f14a12eea554925b6aa4c4dec. Before that commit the maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES * 32 bpp) has been smaller than the qemu vga memory (8MB) and the checking for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok. Some of the holes have been there forever, such as VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes lacking any verification. Security impact: (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga frame buffer as source -> host memory leak. Memory isn't leaked to the guest but to the vnc client though. (2) Qemu will segfault in case the memory range happens to include unmapped areas -> Guest can DoS itself. The guest can not modify host memory, so I don't think this can be used by the guest to escape. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* vbe: make bochs dispi interface return the correct memory size with qxlGerd Hoffmann2014-09-043-2/+7
| | | | | | | | | | | | | | VgaState->vram_size is the size of the pci bar. In case of qxl not the whole pci bar can be used as vga framebuffer. Add a new variable vbe_size to handle that case. By default (if unset) it equals vram_size, but qxl can set vbe_size to something else. This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results and sanity checks are done with the correct size too. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* qxl-render: add more sanity checksGerd Hoffmann2014-09-011-1/+3
| | | | | | | | | | | | | | Damn, the dirty rectangle values are signed integers. So the checks added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good enough, we also have to make sure they are not negative. [ Note: There must be something broken in spice-server so we get negative values in the first place. Bug opened: https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
* memory: convert memory_region_destroy to object_unparentPaolo Bonzini2014-08-181-1/+1
| | | | | | | | | Explicitly call object_unparent in the few places where we will re-create the memory region. If the memory region is simply being destroyed as part of device teardown, let QOM handle it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vga: do not dynamically allocate chain4_aliasPaolo Bonzini2014-08-172-15/+12
| | | | | | | | | Instead, add a boolean variable to indicate the presence of the region. This avoids a repeated malloc/free (later we can also avoid the add_child/unparent by changing the offset/size of the alias). Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cirrus: Fix host CPU blitsBenjamin Herrenschmidt2014-07-111-2/+1
| | | | | | | | | | | | | | | | | | | Commit b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef "CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke cpu to video blits. When the ROP function is called from cirrus_bitblt_cputovideo_next(), we pass 0 for the pitch but only operate on one line at a time. The added test was tripping because after the initial substraction, the pitch becomes negative. Make the test only trip when the height is larger than one (ie. the pitch is actually used). This fixes HW cursor support in Windows NT4.0 (which otherwise was a white rectangle) and general display of icons in that OS when using 8bpp mode. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus: Fix build of debug codeBenjamin Herrenschmidt2014-07-111-4/+4
| | | | | | | Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus_vga: adding sanity check for vram sizeGonglei2014-07-111-0/+16
| | | | | | | | | | | when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xen: build on ARMStefano Stabellini2014-07-071-8/+10
| | | | | | | | | | | | Collection of fixes to build QEMU with Xen support on ARM: - use xenstore_read_fe_uint64 to retrieve the page-ref (xenfb); - use xen_pfn_t instead of unsigned long in xenfb; - unsigned long/xenpfn_t in xen_remove_from_physmap; - in xen-mapcache.c use HOST_LONG_BITS to check for QEMU's address space size. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* spice: fix 32bit buildGerd Hoffmann2014-06-201-1/+1
| | | | | | | Tested-by: Luiz Capitulino <lcapitulino@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1403244764-8622-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela2014-06-164-12/+6
| | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* qxl-render: add sanity checkGerd Hoffmann2014-06-131-0/+6
| | | | | | | Verify dirty rectangle is completely within the primary surface, just ignore it in case it isn't. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* spice: add mouse cursor supportGerd Hoffmann2014-06-131-1/+5
| | | | | | | So you'll have a mouse pointer when running non-qxl gfx cards with mouse pointer support (virtio-gpu, IIRC vmware too). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw: vmware_vga: don't return cursorx when the driver asks for cursory registerNicolas Owens2014-06-101-1/+1
| | | | | | | | | | | hello qemu-*@nongnu.org, this is my first contribution. apologies if something is incorrect. this patch fixes vmware_vga.c so that it actually returns the cursory register when asked for, instead of cursorx. Signed-off-by: Nicolas Owens <mischief@offblast.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into stagingPeter Maydell2014-06-052-38/+53
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | * remotes/mcayland/qemu-sparc: apb: implement IOMMU translation for PCI host bridge apb: handle reading/writing of IOMMU control registers apb: fix IOMMU register sizes apb: Move IOMMU registers into a separate IOMMUState struct tcx: move initialisation from realizefn to initfn tcx: move initialisation from SysBusDevice class to TCX class realizefn cg3: add extra check to prevent CG3 register array overflow cg3: move initialisation from realizefn to initfn Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * tcx: move initialisation from realizefn to initfnMark Cave-Ayland2014-06-051-18/+28
| | | | | | | | | | | | | | Initialisation cleanup as suggested by Andreas. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
| * tcx: move initialisation from SysBusDevice class to TCX class realizefnMark Cave-Ayland2014-06-051-14/+12
| | | | | | | | | | | | | | This is an intermediate step to bring TCX in line with CG3. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
| * cg3: add extra check to prevent CG3 register array overflowMark Cave-Ayland2014-06-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | The case statements in the CG3 read and write register routines have a maximum value of CG3_REG_SIZE, so if a value were written to this offset then it would overflow the register array. Currently this cannot be exploited since the MemoryRegion restricts accesses to the range 0 ... CG3_REG_SIZE - 1, but it seems worth clarifying this for future review and/or static analysis. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Paolo Bonzini <pbonzini@redhat.com>
| * cg3: move initialisation from realizefn to initfnMark Cave-Ayland2014-06-051-8/+15
| | | | | | | | | | | | | | Initialisation cleanup as suggested by Andreas. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
* | hw: use ld_p/st_p instead of ld_raw/st_rawPaolo Bonzini2014-06-053-10/+10
|/ | | | | | | | | | The ld_raw and st_raw definitions are only needed in code that must compile for both user-mode and softmmu emulation. Device models can use the equivalent ld_p/st_p which are simple pointer accessors. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Merge remote-tracking branch ↵Peter Maydell2014-05-281-8/+8
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/pmaydell/tags/pull-target-arm-20140527' into staging target-arm: * Preliminary restructuring for EL2/EL3 support * improve CPACR handling * fix pxa2xx_lcd palette formats * update highbank/midway maintainer # gpg: Signature made Tue 27 May 2014 17:26:27 BST using RSA key ID 14360CDE # gpg: Can't check signature: public key not found * remotes/pmaydell/tags/pull-target-arm-20140527: (26 commits) target-arm: A64: Register VBAR_EL3 target-arm: A64: Register VBAR_EL2 target-arm: Make vbar_write writeback to any CPREG target-arm: A64: Generalize update_spsel for the various ELs target-arm: A64: Generalize ERET to various ELs target-arm: A64: Trap ERET from EL0 at translation time target-arm: A64: Forbid ERET to higher or unimplemented ELs target-arm: Register EL3 versions of ELR and SPSR target-arm: Register EL2 versions of ELR and SPSR target-arm: Add a feature flag for EL3 target-arm: Add a feature flag for EL2 target-arm: A64: Introduce aarch64_banked_spsr_index() target-arm: Add SPSR entries for EL2/HYP and EL3/MON target-arm: A64: Add ELR entries for EL2 and 3 target-arm: A64: Add SP entries for EL2 and 3 target-arm: c12_vbar -> vbar_el[] target-arm: Make esr_el1 an array target-arm: Make elr_el1 an array target-arm: Use a 1:1 mapping between EL and MMU index target-arm: A32: Use get_mem_index for load/stores ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/display/pxa2xx_lcd: Fix 16bpp+alpha and 18bpp+alpha palette formatsPeter Maydell2014-05-271-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pxa2xx palette entry "16bpp plus transparency" format is xxxxxxxTRRRRR000GGGGGG00BBBBB000, and "18bpp plus transparency" is xxxxxxxTRRRRRR00GGGGGG00BBBBBB00. Correct errors in the code for reading these and converting them to the internal format. In particular, the buggy code was attempting to mask out bit 24 of a uint16_t, which Coverity spotted as an error. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1400233901-31785-1-git-send-email-peter.maydell@linaro.org
* | jazz_led: Add missing break in switch caseSaravanakumar2014-05-241-0/+1
|/ | | | | | Signed-off-by: Saravanakumar <saravanakumar.punith@gmail.com> Reviewed-by: Paolo Bonizni <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140515' ↵Peter Maydell2014-05-156-9/+4
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging migration/next for 20140515 # gpg: Signature made Thu 15 May 2014 02:32:25 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140515: usb: fix up post load checks migration: show average throughput when migration finishes savevm: Remove all the unneeded version_minimum_id_old (rest) savevm: Remove all the unneeded version_minimum_id_old (usb) Split ram_save_block arch_init: Simplify code for load_xbzrle() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * savevm: Remove all the unneeded version_minimum_id_old (rest)Juan Quintela2014-05-146-9/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* | savevm: Remove all the unneeded version_minimum_id_old (arm)Juan Quintela2014-05-134-10/+6
|/ | | | | | | | | | | | | | | | | | | | | After commit 767adce2d, they are redundant. This way we don't assign them except when needed. Once there, there were lots of cases where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (apart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> [PMM: fixed minor conflict, corrected commit message typos] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140505' ↵Peter Maydell2014-05-071-0/+24
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging migration/next for 20140505 # gpg: Signature made Mon 05 May 2014 21:27:24 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140505: (36 commits) migration: expose xbzrle cache miss rate migration: expose the bitmap_sync_count to the end migration: Add counts of updating the dirty bitmap XBZRLE: Fix one XBZRLE corruption issues migration: remove duplicate code Coverity: Fix failure path for qemu_accept in migration Init the XBZRLE.lock in ram_mig_init Provide init function for ram migration Count used RAMBlock pages for migration_dirty_pages Make qemu_peek_buffer loop until it gets it's data Disallow outward migration while awaiting incoming migration virtio: validate config_len on load virtio-net: out-of-bounds buffer write on load openpic: avoid buffer overrun on incoming migration ssi-sd: fix buffer overrun on invalid state load savevm: Ignore minimum_version_id_old if there is no load_state_old usb: sanity check setup_index+setup_len in post_load vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ virtio-scsi: fix buffer overrun on invalid state load zaurus: fix buffer overrun on invalid state load ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * ssd0323: fix buffer overun on invalid state loadMichael S. Tsirkin2014-05-051-0/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2013-4538 s->cmd_len used as index in ssd0323_transfer() to store 32-bit field. Possible this field might then be supplied by guest to overwrite a return addr somewhere. Same for row/col fields, which are indicies into framebuffer array. To fix validate after load. Additionally, validate that the row/col_start/end are within bounds; otherwise the guest can provoke an overrun by either setting the _end field so large that the row++ increments just walk off the end of the array, or by setting the _start value to something bogus and then letting the "we hit end of row" logic reset row to row_start. For completeness, validate mode as well. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
* | PortioList: Store PortioList in device stateKirill Batuzov2014-05-054-11/+11
|/ | | | | | | | | | | | | | | | | | | | PortioList is an abstraction used for construction of MemoryRegionPortioList from MemoryRegionPortio. It can be used later to unmap created memory regions. It also requires proper cleanup because some of the memory inside is allocated dynamically. By moving PortioList ot device state we make it possible to cleanup later and avoid leaking memory. This change spans several target platforms. The following testcases cover all changed lines: qemu-system-ppc -M prep qemu-system-i386 -vga qxl qemu-system-i386 -M isapc -soundhw adlib -device ib700,id=watchdog0,bus=isa.0 Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* vga: add secondary stdvga variantGerd Hoffmann2014-04-282-0/+65
| | | | | | | | Add a standard vga variant which doesn't occupy any legacy resources and thus can easily be used as secondary (or legacy-free) graphics adapter. Programming must be done using the MMIO bar. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: allow non-global vmstateGerd Hoffmann2014-04-288-10/+10
| | | | | | | | Need a way to opt-out from vga.vram being global vmstate, for secondary vga cards. Add a bool parameter to vga_common_init to support this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ui/vnc: fix vmware VGA incompatiblitiesPeter Lieven2014-03-181-1/+2
| | | | | | | | | | | | this fixes invalid rectangle updates observed after commit 12b316d with the vmware VGA driver. The issues occured because the server and client surface update seems to be out of sync at some points and the max width of the surface is not dividable by VNC_DIRTY_BITS_PER_PIXEL (16). Reported-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ssi: Convert legacy SSI_SLAVE -> DEVICE castsPeter Crosthwaite2014-03-122-8/+10
| | | | | | | | Convert legacy ->qdev style casts from TYPE_SSI_SLAVE to TYPE_DEVICE. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> [AF: Introduce local DeviceState variable for transition to QOM realize] Signed-off-by: Andreas Färber <afaerber@suse.de>
* xenfb: Fix graphic_console_init() build failureAndreas Färber2014-03-081-1/+1
| | | | | | | | | | | | | In commit 5643706a095044d75df1c0588aac553a595b972b (console: add head to index to qemu consoles.) graphic_console_init() was extended to take an additional argument, but xenfb was not updated accordingly. Fix it. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Don Slutz <dslutz@verizon.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1394228528-31625-1-git-send-email-afaerber@suse.de
* console: add head to index to qemu consoles.Gerd Hoffmann2014-03-0520-23/+23
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sun4m: Add Sun CG3 framebuffer and corresponding OpenBIOS FCode ROMMark Cave-Ayland2014-02-272-0/+386
| | | | | | | | | | | | The CG3 framebuffer is a simple 8-bit framebuffer for use with operating systems such as early Solaris that do not have drivers for TCX. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Blue Swirl <blauwirbel@gmail.com> CC: Anthony Liguori <aliguori@amazon.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Bob Breuer <breuerr@mc.net> CC: Artyom Tarasenko <atar4qemu@gmail.com>
* qxl: add sanity checkGerd Hoffmann2014-02-241-1/+7
| | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-peter' ↵Peter Maydell2014-02-203-9/+15
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging QOM infrastructure fixes and device conversions * QTest cleanups and test cases for PCI NICs * NAND fix for "info qtree" * Cleanup and extension of QOM machine tests * IndustryPack test cases and conversion to QOM realize * I2C cleanups * Cleanups of legacy qdev properties # gpg: Signature made Mon 17 Feb 2014 22:15:37 GMT using RSA key ID 3E7E013F # gpg: Good signature from "Andreas Färber <afaerber@suse.de>" # gpg: aka "Andreas Färber <afaerber@suse.com>" * remotes/afaerber/tags/qom-devices-for-peter: (49 commits) qtest: Include system headers before user headers qapi: Refine human printing of sizes qdev: Use QAPI type names for properties qdev: Add enum property types to QAPI schema block: Handle "rechs" and "large" translation options qdev: Remove hex8/32/64 property types qdev: Remove most legacy printers qdev: Use human mode in "info qtree" qapi: Add human mode to StringOutputVisitor qdev: Inline qdev_prop_parse() qdev: Legacy properties are just strings qdev: Legacy properties are now read-only qdev: Remove legacy parsers for hex8/32/64 qdev: Sizes are now parsed by StringInputVisitor qapi: Add size parser to StringInputVisitor qtest: Don't segfault with invalid -qtest option ipack: Move IndustryPack out of hw/char/ ipoctal232: QOM parent field cleanup ipack: QOM parent field cleanup for IPackDevice ipack: QOM parent field cleanup for IPackBus ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qdev: Remove hex8/32/64 property typesPaolo Bonzini2014-02-142-3/+3
| | | | | | | | | | | | | | | | | | Replace them with uint8/32/64. Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
| * ssd0303: QOM'ifyAndreas Färber2014-02-141-6/+12
| | | | | | | | | | | | | | | | Replace usages of FROM_I2C_SLAVE() with QOM cast macro. Rename parent field. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* | Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell2014-02-134-4/+4
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | acpi,pc,pci fixes and enhancements Most changes here are hotplug related: This merges hotplug infrastructure changes by Igor, some acpi related fixes, and PC fixes. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 10 Feb 2014 09:13:26 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: ACPI: Remove commented-out code from HPET._CRS hw/pci: switch to a generic hotplug handling for PCIDevice pci/pcie: convert PCIE hotplug to use hotplug-handler API pci/shpc: convert SHPC hotplug to use hotplug-handler API acpi/piix4pm: convert ACPI PCI hotplug to use hotplug-handler API qdev:pci: refactor PCIDevice to use generic "hotpluggable" property hw/acpi: move typeinfo to the file end qdev: add "hotpluggable" property to Device qdev: add to BusState "hotplug-handler" link define hotplug interface loader: document that errno is set pc.c: better error message on initrd sizing failure pc_piix: enable legacy hotplug for Xen qtest: don't report signals if qtest driver enabled hw:piix4:acpi: reuse pcihp code for legacy PCI hotplug pcihp: remove unused AcpiPciHpPciStatus.device_present field pcihp: make pci_read() mmio calback compatible with legacy ACPI hotplug pcihp: make PCI hotplug mmio handlers indifferent to PCI_HOTPLUG_ADDR pcihp: replace enable|disable_device() with oneliners pcihp: reduce number of device check events Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qdev:pci: refactor PCIDevice to use generic "hotpluggable" propertyIgor Mammedov2014-02-104-4/+4
| | | | | | | | | | | | | | | | | | Get rid of PCIDevice specific PCIDeviceClass.no_hotplug and use generic DeviceClass.hotpluggable field instead. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* | exec: Make ldq/ldub_*_phys input an AddressSpaceEdgar E. Iglesias2014-02-112-1/+2
| | | | | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* | Merge remote-tracking branch 'remotes/mwalle/tags/lm32-fixes/20140204' into ↵Peter Maydell2014-02-081-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging target-lm32: fixes # gpg: Signature made Tue 04 Feb 2014 18:47:56 GMT using DSA key ID 3F98A378 # gpg: Can't check signature: public key not found * remotes/mwalle/tags/lm32-fixes/20140204: hw/lm32: print error if cpu model is not found target-lm32: stop VM on illegal or unknown instruction lm32_sys: dump cpu state if test case fails lm32_sys: print test result on stderr target-lm32: add breakpoint/watchpoint support target-lm32: move model features to LM32CPU target-lm32: kill cpu_abort() calls milkymist-vgafb: swap pixel data in source buffer lm32_uart/lm32_juart: use qemu_chr_fe_write_all() milkymist-uart: use qemu_chr_fe_write_all() instead of qemu_chr_fe_write() tests: lm32: new rule for single test cases lm32_sys: increase test case name length limit Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | milkymist-vgafb: swap pixel data in source bufferMichael Walle2014-02-041-1/+1
| |/ | | | | | | | | | | | | | | | | In commit fc97bb5ba3e7239c0b6d24095df6784868dfebbf the lduw_raw() call was eliminated. But we are reading from the target buffer a 16-bit value, which is in big-endian format. Therefore, use lduw_be_p() to read the value. Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Walle <michael@walle.cc>
* | hw/display/qxl: fix signed to unsigned comparisonAlon Levy2014-02-031-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | Several small signedness / overflow corrections to qxl_create_guest_primary: 1. use 64 bit unsigned for size to avoid overflow possible from two 32 bit multiplicants. 2. correct sign for requested_height 3. add a more verbose error message when setting guest bug state (which causes a complete guess blackout until reset, so it helps if it is verbose). Signed-off-by: Alon Levy <alevy@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | qxl: clear irq on resetAlon Levy2014-02-031-0/+1
|/ | | | | | | | | | | | Without this we occasionally trigger an assert at hw/pci/pci.c:pcibus_reset that asserts the irq_count is zero on reset. This has become a problem with the new drm driver for linux, since doing a reboot from console causes a race between console updates that set the irq and the reset assertion that the irq is clear. Signed-off-by: Alon Levy <alevy@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* display: avoid multi-statement macroPaolo Bonzini2014-01-314-29/+59
| | | | | | | | | | | For blizzard, pl110 and tc6393xb this is harmless, but for pxa2xx Coverity noticed that it is used inside an "if" statement. Fix it because it's the file with the highest number of defects in the whole QEMU tree! Use "do...while (0)", or just remove the semicolon if there's a single statement in the macro. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* xenfb: map framebuffer read-only and handle unmap errorsStefano Stabellini2014-01-171-1/+6
| | | | | | | | | | | The framebuffer is needlessly mapped (PROT_READ | PROT_WRITE), map it PROT_READ instead. The framebuffer is unmapped by replacing the framebuffer pages with anonymous shared memory, calling mmap. Check for return errors and print a warning. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
* sysbus: Set cannot_instantiate_with_device_add_yetMarkus Armbruster2013-12-231-1/+0
| | | | | | | | | | | | | | | | | | device_add plugs devices into suitable bus. For "real" buses, that actually connects the device. For sysbus, the connections need to be made separately, and device_add can't do that. The device would be left unconnected, and could not possibly work. Quite a few, but not all sysbus devices already set cannot_instantiate_with_device_add_yet in their class init function. Set it in their abstract base's class init function sysbus_device_class_init(), and remove the now redundant assignments from device class init functions. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel.a@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
OpenPOWER on IntegriCloud