summaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2018-05-07qxl: fix local renderer crashGerd Hoffmann1-1/+2
Make sure we only ask the spice local renderer for display updates in case we have a valid primary surface. Without that spice is confused and throws errors in case a display update request (triggered by screendump for example) happens in parallel to a mode switch and hits the race window where the old primary surface is gone and the new isn't establisted yet. Cc: qemu-stable@nongnu.org Fixes: https://bugzilla.redhat.com//show_bug.cgi?id=1567733 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180427115528.345-1-kraxel@redhat.com
2018-03-13secondary-vga: properly close QemuConsole on unplugGerd Hoffmann1-0/+9
Using the new graphic_console_close() function. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2018-03-12vga: fix region calculationGerd Hoffmann1-0/+2
Typically the scanline length and the line offset are identical. But in case they are not our calculation for region_end is incorrect. Using line_offset is fine for all scanlines, except the last one where we have to use the actual scanline length. Fixes: CVE-2018-7550 Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Tested-by: Ross Lagerwall <ross.lagerwall@citrix.com> Message-id: 20180309143704.13420-1-kraxel@redhat.com
2018-03-06g364fb: fix DirtyBitmapSnapshot leakPaolo Bonzini1-0/+1
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-03-01hw/sii9022: Add support for Silicon Image SII9022Linus Walleij3-0/+197
This adds support for emulating the Silicon Image SII9022 DVI/HDMI bridge. It's not very clever right now, it just acknowledges the switch into DDC I2C mode and back. Combining this with the existing DDC I2C emulation gives the right behavior on the Versatile Express emulation passing through the QEMU EDID to the emulated platform. Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Message-id: 20180227104903.21353-5-linus.walleij@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: explictly reset ddc_req/ddc_skip_finish/ddc] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-02-26virtio-gpu-3d: add support for second capability set (v4)Dave Airlie2-1/+21
Due to a kernel bug we can never increase the size of capability set 1, so introduce a new capability set in parallel, old userspace will continue to use the old set, new userspace will start using the new one when it detects a fixed kernel. v2: don't use a define from virglrenderer, just probe it. v3: fix compilation when virglrenderer disabled v4: fix style warning, just use ?: op instead. Signed-off-by: Dave Airlie <airlied@redhat.com> Message-id: 20180223023814.24459-1-airlied@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-02-13memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshotPaolo Bonzini7-13/+0
Simplify the users of memory_region_snapshot_and_clear_dirty, so that they do not have to call memory_region_sync_dirty_bitmap explicitly. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-02-13g364fb: switch to using DirtyBitmapSnapshotPaolo Bonzini1-4/+6
This removes the last user of memory_region_test_and_clear_dirty outside memory.c. Tested-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-02-09Include qapi/error.h exactly where neededMarkus Armbruster5-1/+5
This cleanup makes the number of objects depending on qapi/error.h drop from 1910 (out of 4743) to 1612 in my "build everything" tree. While there, separate #include from file comment with a blank line, and drop a useless comment on why qemu/osdep.h is included first. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20180201111846.21846-5-armbru@redhat.com> [Semantic conflict with commit 34e304e975 resolved, OSX breakage fixed]
2018-02-05exynos4210: workaround UBSAN compilation errorMarc-André Lureau1-1/+1
gcc 5.4.0-6ubuntu1~16.04.5 build with UBSAN enabled error: CC hw/display/exynos4210_fimd.o /home/petmay01/linaro/qemu-for-merges/hw/display/exynos4210_fimd.c: In function ‘fimd_get_buffer_id’: /home/petmay01/linaro/qemu-for-merges/hw/display/exynos4210_fimd.c:1105:5: error: case label does not reduce to an integer constant case FIMD_WINCON_BUF2_STAT: Because FIMD_WINCON_BUF2_STAT case contains an integer overflow, use U suffix to get the unsigned type. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180116151152.4040-2-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-02-02virtio-gpu: disallow vIOMMUPeter Xu2-1/+12
virtio-gpu has special code path that bypassed vIOMMU protection. So for now let's disable iommu_platform for the device until we fully support that (if needed). After the patch, both virtio-vga and virtio-gpu won't allow to boot with iommu_platform parameter set. CC: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-id: 20180131040401.3550-1-peterx@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-26aarch64-softmmu.mak: Use an ARM specific configAlistair Francis1-1/+1
In preperation for having an ARM and MicroBlaze ZynqMP machine let's split out the current ARM specific config options. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2018-01-25Merge remote-tracking branch ↵Peter Maydell1-1/+29
'remotes/pmaydell/tags/pull-target-arm-20180125' into staging target-arm queue: * target/arm: Fix address truncation in 64-bit pagetable walks * i.MX: Fix FEC/ENET receive functions * target/arm: preparatory refactoring for SVE emulation * hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending" * hw/intc/arm_gic: Fix C_RPR value on idle priority * hw/intc/arm_gic: Fix group priority computation for group 1 IRQs * hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1 * hw/arm/virt: Check that the CPU realize method succeeded * sdhci: fix a NULL pointer dereference due to uninitialized AddressSpace object * xilinx_spips: Correct usage of an uninitialized local variable * pl110: Implement vertical compare/next base interrupts # gpg: Signature made Thu 25 Jan 2018 12:59:25 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180125: (21 commits) pl110: Implement vertical compare/next base interrupts xilinx_spips: Correct usage of an uninitialized local variable sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object hw/arm/virt: Check that the CPU realize method succeeded hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1 hw/intc/arm_gic: Fix group priority computation for group 1 IRQs hw/intc/arm_gic: Fix C_RPR value on idle priority hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending" target/arm: Simplify fp_exception_el for user-only target/arm: Hoist store to flags output in cpu_get_tb_cpu_state target/arm: Move cpu_get_tb_cpu_state out of line target/arm: Add ARM_FEATURE_SVE vmstate: Add VMSTATE_UINT64_SUB_ARRAY target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers target/arm: Change the type of vfp.regs target/arm: Use pointers in neon tbl helper target/arm: Use pointers in neon zip/uzp helpers target/arm: Use pointers in crypto helpers target/arm: Mark disas_set_insn_syndrome inline i.MX: Fix FEC/ENET receive funtions ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25pl110: Implement vertical compare/next base interruptsLinus Walleij1-1/+29
This implements rudimentary support for interrupt generation on the PL110. I am working on a new DRI/KMS driver for Linux and since that uses the blanking interrupt, we need something to fire here. Without any interrupt support Linux waits for a while and then gives ugly messages about the vblank not working in the console (it does not hang perpetually or anything though, DRI is pretty forgiving). I solved it for now by setting up a timer to fire at 60Hz and pull the interrupts for "vertical compare" and "next memory base" at this interval. This works fine and fires roughly the same number of IRQs on QEMU as on the hardware and leaves the console clean and nice. People who want to create more accurate emulation can probably work on top of this if need be. It is certainly closer to the hardware behaviour than what we have today anyway. Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Message-id: 20180123225654.5764-1-linus.walleij@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: folded long lines] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25vga: check the validation of memory addr when draw textlinzhecheng1-0/+3
Start a vm with qemu-kvm -enable-kvm -vnc :66 -smp 1 -m 1024 -hda redhat_5.11.qcow2 -device pcnet -vga cirrus, then use VNC client to connect to VM, and excute the code below in guest OS will lead to qemu crash: int main() { iopl(3); srand(time(NULL)); int a,b; while(1){ a = rand()%0x100; b = 0x3c0 + (rand()%0x20); outb(a,b); } return 0; } The above code is writing the registers of VGA randomly. We can write VGA CRT controller registers index 0x0C or 0x0D (which is the start address register) to modify the the display memory address of the upper left pixel or character of the screen. The address may be out of the range of vga ram. So we should check the validation of memory address when reading or writing it to avoid segfault. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20180111132724.13744-1-linzhecheng@huawei.com Fixes: CVE-2018-5683 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-23Merge remote-tracking branch 'remotes/huth/tags/pull-request-2018-01-22' ↵Peter Maydell7-25/+25
into staging Pull request for various patches that have been reviewed and laying on the mailing list for a while, but apparently no maintainer feels really responsible for picking up. # gpg: Signature made Mon 22 Jan 2018 11:10:16 GMT # gpg: using RSA key 0x2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth/tags/pull-request-2018-01-22: hw/isa: Replace fprintf(stderr, "*\n" with error_report() hw/ipmi: Replace fprintf(stderr, "*\n" with error_report() hw/bt: Replace fprintf(stderr, "*\n" with error_report() Fixes after renaming __FUNCTION__ to __func__ Replace all occurances of __FUNCTION__ with __func__ tests/cpu-plug-test: Test CPU hot-plugging on s390x tests/cpu-plug-test: Check CPU hot-plugging on ppc64, too tests/cpu-plug-test: Check the CPU hot-plugging with device_add, too tests: Rename pc-cpu-test.c to cpu-plug-test.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-22Replace all occurances of __FUNCTION__ with __func__Alistair Francis7-25/+25
Replace all occurs of __FUNCTION__ except for the check in checkpatch with the non GCC specific __func__. One line in hcd-musb.c was manually tweaked to pass checkpatch. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> [THH: Removed hunks related to pxa2xx_mmci.c (fixed already)] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-01-20sm501: Add missing break to caseBALATON Zoltan1-0/+1
Noticed by Coverity, forgotten in 5690d9ece Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-16Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell3-3/+3
* QemuMutex tracing improvements (Alex) * ram_addr_t optimization (David) * SCSI fixes (Fam, Stefan, me) * do {} while (0) fixes (Eric) * KVM fix for PMU (Jan) * memory leak fixes from ASAN (Marc-André) * migration fix for HPET, icount, loadvm (Maria, Pavel) * hflags fixes (me, Tao) * block/iscsi uninitialized variable (Peter L.) * full support for GMainContexts in character devices (Peter Xu) * more boot-serial-test (Thomas) * Memory leak fix (Zhecheng) # gpg: Signature made Tue 16 Jan 2018 14:15:45 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (51 commits) scripts/analyse-locks-simpletrace.py: script to analyse lock times util/qemu-thread-*: add qemu_lock, locked and unlock trace events cpu: flush TB cache when loading VMState block/iscsi: fix initialization of iTask in iscsi_co_get_block_status find_ram_offset: Align ram_addr_t allocation on long boundaries find_ram_offset: Add comments and tracing cpu_physical_memory_sync_dirty_bitmap: Another alignment fix checkpatch: Enforce proper do/while (0) style maint: Fix macros with broken 'do/while(0); ' usage tests: Avoid 'do/while(false); ' in vhost-user-bridge chardev: Clean up previous patch indentation chardev: Use goto/label instead of do/break/while(0) mips: Tweak location of ';' in macros net: Drop unusual use of do { } while (0); irq: fix memory leak cpus: unify qemu_*_wait_io_event icount: fixed saving/restoring of icount warp timers scripts/qemu-gdb/timers.py: new helper to dump timer state scripts/qemu-gdb: add simple tcg lock status helper target-i386: update hflags on Hypervisor.framework ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-16maint: Fix macros with broken 'do/while(0); ' usageEric Blake3-3/+3
The point of writing a macro embedded in a 'do { ... } while (0)' loop (particularly if the macro has multiple statements or would otherwise end with an 'if' statement) is so that the macro can be used as a drop-in statement with the caller supplying the trailing ';'. Although our coding style frowns on brace-less 'if': if (cond) statement; else something else; that is the classic case where failure to use do/while(0) wrapping would cause the 'else' to pair with any embedded 'if' in the macro rather than the intended outer 'if'. But conversely, if the macro includes an embedded ';', then the same brace-less coding style would now have two statements, making the 'else' a syntax error rather than pairing with the outer 'if'. Thus, even though our coding style with required braces is not impacted, ending a macro with ';' makes our code harder to port to projects that use brace-less styles. The change should have no semantic impact. I was not able to fully compile-test all of the changes (as some of them are examples of the ugly bit-rotting debug print statements that are completely elided by default, and I didn't want to recompile with the necessary -D witnesses - cleaning those up is left as a bite-sized task for another day); I did, however, audit that for all files touched, all callers of the changed macros DID supply a trailing ';' at the callsite, and did not appear to be used as part of a brace-less conditional. Found mechanically via: $ git grep -B1 'while (0);' | grep -A1 \\\\ Signed-off-by: Eric Blake <eblake@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20171201232433.25193-7-eblake@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-12spice: remove QXLWorker interface fieldFrediano Ziglio1-1/+0
This fields points to an old interface that is no more used in the current code. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Message-id: 20171122135625.16625-1-fziglio@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-10sm501: Add some more unimplemented registersBALATON Zoltan1-0/+17
These are not really implemented (just return zero or default values) but add these so guests accessing them can run. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-10sm501: Add panel hardware cursor registers also to read functionBALATON Zoltan1-0/+13
These were forgotten when adding panel layer support in ffd39257018 "SM501 emulation for R2D-SH4". Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [dwg: Added reference to earlier commit in message] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-12-18hw/display/vga: extract public API from i386/pc to "hw/display/vga.h"Philippe Mathieu-Daudé3-4/+3
and remove the old i386/pc dependency. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-12-18hw/display/vga: "vga_int.h" requires "ui/console.h"Philippe Mathieu-Daudé9-9/+2
since The VGACommonState struct has a GraphicHwOps *hw_ops member, then remove the now unnecessary includes. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-12-18hw/display/vga: "vga.h" only contains registers defs, rename it "vga_regs.h"Philippe Mathieu-Daudé2-1/+1
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-12-15Merge remote-tracking branch 'remotes/sstabellini/tags/xen-20171214-tag' ↵Peter Maydell1-138/+156
into staging Xen 2017/12/14 # gpg: Signature made Fri 15 Dec 2017 00:26:26 GMT # gpg: using RSA key 0x894F8F4870E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" # gpg: aka "Stefano Stabellini <sstabellini@kernel.org>" # Primary key fingerprint: D04E 33AB A51F 67BA 07D3 0AEA 894F 8F48 70E1 AE90 * remotes/sstabellini/tags/xen-20171214-tag: xen/pt: Set is_express to avoid out-of-bounds write xenfb: activate input handlers for raw pointer devices xenfb: Add [feature|request]-raw-pointer xenfb: Use Input Handlers directly ui: generate qcode to linux mappings xen-disk: use an IOThread per instance Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-12-14xenfb: activate input handlers for raw pointer devicesOwen Smith1-0/+5
If the frontend requests raw pointers, the input handlers must be activated to have the input events delivered to the xenfb backend. Without activation, the input events are delivered to handlers registered earlier, which would be the emulated USB tablet or emulated PS/2 mouse. HVM xen_kbdfront can incorrectly scale absolute coordinates when the display resolution is not 800x600. Signed-off-by: Owen Smith <owen.smith@citrix.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
2017-12-14xenfb: Add [feature|request]-raw-pointerOwen Smith1-17/+30
Writes "feature-raw-pointer" during init to indicate the backend can pass raw unscaled values for absolute axes to the frontend. Frontends set "request-raw-pointer" to indicate the backend should not attempt to scale absolute values to console size. "request-raw-pointer" is only valid if "request-abs-pointer" is also set. Raw unscaled pointer values are in the range [0, 0x7fff] "feature-raw-pointer" and "request-raw-pointer" added to Xen header in commit 7868654ff7fe5e4a2eeae2b277644fa884a5031e Signed-off-by: Owen Smith <owen.smith@citrix.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
2017-12-14xenfb: Use Input Handlers directlyOwen Smith1-137/+137
Avoid the unneccessary calls through the input-legacy.c file by using the qemu_input_handler_*() calls directly. This did require reworking the event and sync handlers to use the reverse mapping from qcode to linux using qemu_input_qcode_to_linux(). Removes the scancode2linux mapping, and supporting documention. Signed-off-by: Owen Smith <owen.smith@citrix.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
2017-12-13hw/display/tc6393xb: limit irq handler index to TC6393XB_GPIOSPrasad J Pandit1-0/+1
The ctz32() routine could return a value greater than TC6393XB_GPIOS=16, because the device has 24 GPIO level bits but we only implement 16 outgoing lines. This could lead to an OOB array access. Mask 'level' to avoid it. Reported-by: Moguofang <moguofang@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20171212041539.25700-1-ppandit@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-11-13Merge remote-tracking branch 'remotes/kraxel/tags/vga-20171110-pull-request' ↵Peter Maydell3-7/+18
into staging vga: bugfixes for 2.11 # gpg: Signature made Fri 10 Nov 2017 13:26:30 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20171110-pull-request: vmsvga: use ARRAY_SIZE macro vga: fix region checks in wraparound case virtio-gpu: fix bug in host memory calculation. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-11-10vmsvga: use ARRAY_SIZE macroPhilippe Mathieu-Daudé1-3/+2
Applied using the Coccinelle semantic patch scripts/coccinelle/use_osdep.cocci Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20170718061005.29518-23-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-11-10vga: fix region checks in wraparound caseGerd Hoffmann1-2/+2
Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20171030102830.4469-1-kraxel@redhat.com
2017-11-10virtio-gpu: fix bug in host memory calculation.Tao Wu1-2/+14
The old code treats bits as bytes when calculating host memory usage. Change it to be consistent with allocation logic in pixman library. Signed-off-by: Tao Wu <lepton@google.com> Message-Id: <20171109181741.31318-1-lepton@google.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-11-08hw/display/sm501: Fix comment in sm501_sysbus_class_init()Thomas Huth1-1/+1
The "cannot_instantiate_with_device_add_yet" flag has been renamed to "user_creatable" a while ago. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2017-10-17cirrus: fix oob access in mode4and5 write functionsGerd Hoffmann1-4/+2
Move dst calculation into the loop, so we apply the mask on each interation and will not overflow vga memory. Cc: Prasad J Pandit <pjp@fedoraproject.org> Reported-by: Niu Guoxiang <niuguoxiang@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20171011084314.21752-1-kraxel@redhat.com
2017-10-17vga: add ram_addr_t castGerd Hoffmann1-1/+1
Reported by Coverity. Fixes: CID 1381409 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20171010141323.14049-4-kraxel@redhat.com
2017-10-17vga: handle cirrus vbe mode wraparounds.Gerd Hoffmann1-7/+21
Commit "3d90c62548 vga: stop passing pointers to vga_draw_line* functions" is incomplete. It doesn't handle the case that the vga rendering code tries to create a shared surface, i.e. a pixman image backed by vga video memory. That can not work in case the guest display wraps from end of video memory to the start. So force shadowing in that case. Also adjust the snapshot region calculation. Can trigger with cirrus only, when programming vbe modes using the bochs api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds can't happen. Fixes: CVE-2017-13672 Fixes: 3d90c6254863693a6b13d918d2b8682e08bbc681 Cc: P J P <ppandit@redhat.com> Reported-by: David Buchanan <d@vidbuchanan.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20171010141323.14049-3-kraxel@redhat.com
2017-10-17vga: drop line_offset variableGerd Hoffmann1-4/+3
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-10-15pci: Add INTERFACE_CONVENTIONAL_PCI_DEVICE to Conventional PCI devicesEduardo Habkost5-0/+20
Add INTERFACE_CONVENTIONAL_PCI_DEVICE to all direct subtypes of TYPE_PCI_DEVICE, except: 1) The ones that already have INTERFACE_PCIE_DEVICE set: * base-xhci * e1000e * nvme * pvscsi * vfio-pci * virtio-pci * vmxnet3 2) base-pci-bridge Not all PCI bridges are Conventional PCI devices, so INTERFACE_CONVENTIONAL_PCI_DEVICE is added only to the subtypes that are actually Conventional PCI: * dec-21154-p2p-bridge * i82801b11-bridge * pbm-bridge * pci-bridge The direct subtypes of base-pci-bridge not touched by this patch are: * xilinx-pcie-root: Already marked as PCIe-only. * pcie-pci-bridge: Already marked as PCIe-only. * pcie-port: all non-abstract subtypes of pcie-port are already marked as PCIe-only devices. 3) megasas-base Not all megasas devices are Conventional PCI devices, so the interface names are added to the subclasses registered by megasas_register_types(), according to information in the megasas_devices[] array. "megasas-gen2" already implements INTERFACE_PCIE_DEVICE, so add INTERFACE_CONVENTIONAL_PCI_DEVICE only to "megasas". Acked-by: Alberto Garcia <berto@igalia.com> Acked-by: John Snow <jsnow@redhat.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-09-27migration: Route more error pathsDr. David Alan Gilbert1-3/+1
vmstate_save_state is called in lots of places. Route error returns from the easier cases back up; there are lots of more complex cases where their own error paths need fixing. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20170925112917.21340-7-dgilbert@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Commit message fix up as Peter's review
2017-09-27migration: pre_save return intDr. David Alan Gilbert1-1/+3
Modify the pre_save method on VMStateDescription to return an int rather than void so that it potentially can fail. Changed zillions of devices to make them return 0; the only case I've made it return non-0 is hw/intc/s390_flic_kvm.c that already had an error_report/return case. Note: If you add an error exit in your pre_save you must emit an error_report to say why. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20170925112917.21340-2-dgilbert@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-09-26hw/display/virtio-gpu: Put the virtio-gpu-device into the display categoryThomas Huth1-0/+1
The virtio-gpu-pci device is already in the display category, so the virtio-gpu-device should be there, too. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-09-26hw/display/xenfb.c: Add trace_xenfb_key_eventLiang Yan2-0/+2
It may be better to add a trace event to monitor the last moment of a key event from QEMU to guest VM Signed-off-by: Liang Yan <lyan@suse.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-09-19virtio-gpu: Handle endian conversionFarhan Ali1-8/+62
Virtio GPU code currently only supports litte endian format, and so using the Virtio GPU device on a big endian machine does not work. Let's fix it by supporting the correct host cpu byte order. Signed-off-by: Farhan Ali <alifm@linux.vnet.ibm.com> Message-Id: <dc748e15f36db808f90b4f2393bc29ba7556a9f6.1505485574.git.alifm@linux.vnet.ibm.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
2017-09-13virtio-gpu: don't clear QemuUIInfo information on resetGerd Hoffmann1-12/+0
Don't reset window layout information (passed via virtio_gpu_ui_info) on device reset, so the user interface window layout will be kept intact over reboots. The head size and position was commented out already, so this patch just drops the dead code. Additionally the enabled head mask must be kept so multihead setups work properly too. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1460595 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170906142058.2460-1-kraxel@redhat.com
2017-09-01vga/migration: Update memory map in post_loadDr. David Alan Gilbert1-0/+1
After migration the chain4 alias mapping added by 80763888 (in 2011) might be missing, since there's no call to vga_update_memory_access in the post_load after the registers are updated. Add it back. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-id: 20170804113329.13609-1-dgilbert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-09-01qxl: add support for chunked cursors.Gerd Hoffmann1-7/+29
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170828123933.30323-3-kraxel@redhat.com
2017-09-01qxl: drop mono cursor supportGerd Hoffmann1-9/+0
The chunk size sanity check in qxl_render_cursor works for SPICE_CURSOR_TYPE_ALPHA cursors only. So support for SPICE_CURSOR_TYPE_MONO cursors must be broken for ages without anyone noticing. Most likely it simply isn't used any more by guest drivers. Drop the dead code. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170828123933.30323-2-kraxel@redhat.com
generated by cgit v1.2.1 (git 2.18.0) at 2024-06-19 21:27:49 +0000