aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2016-02-06virtio: move allocation to virtqueue_pop/vring_popPaolo Bonzini1-8/+13
The return code of virtqueue_pop/vring_pop is unused except to check for errors or 0. We can thus easily move allocation inside the functions and just return a pointer to the VirtQueueElement. The advantage is that we will be able to allocate only the space that is needed for the actual size of the s/g list instead of the full VIRTQUEUE_MAX_SIZE items. Currently VirtQueueElement takes about 48K of memory, and this kind of allocation puts a lot of stress on malloc. By cutting the size by two or three orders of magnitude, malloc can use much more efficient algorithms. The patch is pretty large, but changes to each device are testable more or less independently. Splitting it would mostly add churn. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2016-02-03virtio-gpu: block any rendering until client (ui) is doneGerd Hoffmann3-0/+26
Wire up gl_block callback, so ui code can request to stop virtio-gpu rendering. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-02-03virtio-gpu: add support to enable/disable command processingGerd Hoffmann2-2/+6
So we can stop rendering for a while in case we have to. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2016-02-03virtio-gpu: maintain command queueGerd Hoffmann1-17/+36
We'll go take out the commands we receive out of the virt queue and put them into a linked list, to decouple virtio queue handling from actual command processing. Also move cmd processing to new virtio_gpu_handle_ctrl func, so we can easily kick it from different places. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-02-03virtio-gpu: fix memory leak in error pathGerd Hoffmann1-1/+2
Found by Coverity Scan, buf not freed on error. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2016-01-29hw/display: Clean up includesPeter Maydell22-2/+22
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-21-git-send-email-peter.maydell@linaro.org
2016-01-29virtio: Clean up includesPeter Maydell4-0/+4
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-15-git-send-email-peter.maydell@linaro.org
2016-01-29xen: Clean up includesPeter Maydell1-9/+1
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-14-git-send-email-peter.maydell@linaro.org
2016-01-29arm: Clean up includesPeter Maydell3-0/+3
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-13-git-send-email-peter.maydell@linaro.org
2016-01-29lm32: Clean up includesPeter Maydell2-0/+2
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-5-git-send-email-peter.maydell@linaro.org
2016-01-26xen: Switch uses of xc_map_foreign_{pages,bulk} to use libxenforeignmemory API.Ian Campbell1-8/+9
In Xen 4.7 we are refactoring parts libxenctrl into a number of separate libraries which will provide backward and forward API and ABI compatiblity. One such library will be libxenforeignmemory which provides access to privileged foreign mappings and which will provide an interface equivalent to xc_map_foreign_{pages,bulk}. The new xenforeignmemory_map() function behaves like xc_map_foreign_pages() when the err argument is NULL and like xc_map_foreign_bulk() when err is non-NULL, which maps into the shim here onto checking err == NULL and calling the appropriate old function. Note that xenforeignmemory_map() takes the number of pages before the arrays themselves, in order to support potentially future use of variable-length-arrays in the prototype (in the future, when Xen's baseline toolchain requirements are new enough to ensure VLAs are supported). In preparation for adding support for libxenforeignmemory add support to the <=4.0 and <=4.6 compat code in xen_common.h to allow us to switch to using the new API. These shims will disappear for versions of Xen which include libxenforeignmemory. Since libxenforeignmemory will have its own handle type but for <= 4.6 the functionality is provided by using a libxenctrl handle we introduce a new global xen_fmem alongside the existing xen_xc. In fact we make xen_fmem a pointer to the existing xen_xc, which then works correctly with both <=4.0 (xc handle is an int) and <=4.6 (xc handle is a pointer). In the latter case xen_fmem is actually a double indirect pointer, but it all falls out in the wash. Unlike libxenctrl libxenforeignmemory has an explicit unmap function, rather than just specifying that munmap should be used, so the unmap paths are updated to use xenforeignmemory_unmap, which is a shim for munmap on these versions of xen. The mappings in xen-hvm.c do not appear to be unmapped (which makes sense for a qemu-dm process) In fb_disconnect this results in a change from simply mmap over the existing mapping (with an implicit munmap) to expliclty unmapping with xenforeignmemory_unmap and then mapping the required anonymous memory in the same hole. I don't think this is a problem since any other thread which was racily touching this region would already be running the risk of hitting the mapping halfway through the call. If this is thought to be a problem then we could consider adding an extra API to the libxenforeignmemory interface to replace a foreign mapping with anonymous shared memory, but I'd prefer not to. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2016-01-26xen: Switch uses of xc_map_foreign_range into xc_map_foreign_pagesIan Campbell1-7/+8
In Xen 4.7 we are refactoring parts libxenctrl into a number of separate libraries which will provide backward and forward API and ABI compatiblity. One such library will be libxenforeignmemory which provides access to privileged foreign mappings and which will provide an interface equivalent to xc_map_foreign_{pages,bulk}. In preparation for this switch all uses of xc_map_foreign_range to xc_map_foreign_pages. This is trivial because size was always XC_PAGE_SIZE so the necessary adjustments are trivial: * Pass &mfn (an array of length 1) instead of mfn. The function takes a pointer to const, so there is no possibily of mfn changing due to this change. * Pass nr_pages=1 instead of size=XC_PAGE_SIZE There is one wrinkle in xen_console.c:con_initialise() where con->ring_ref is an int but can in some code paths (when !xendev->dev) be treated as an mfn. I think this is an existing latent truncation hazard on platforms where xen_pfn_t is 64-bit and int is 32-bit (e.g. amd64, both arm* variants). I'm unsure under what circumstances xendev->dev can be NULL or if anything elsewhere ensures the value fits into an int. For now I just use a temporary xen_pfn_t to in effect upcast the pointer from int* to xen_pfn_t*. In xenfb.c:common_bind we now explicitly launder the mfn into a xen_pfn_t, so it has the correct type to be passed to xc_map_foreign_pages and doesn't provoke warnings on 32-bit x86. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2016-01-21Merge remote-tracking branch 'remotes/sstabellini/tags/xen-20160121' into ↵Peter Maydell1-2/+3
staging Xen 2016/01/21 # gpg: Signature made Thu 21 Jan 2016 16:58:50 GMT using RSA key ID 70E1AE90 # gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" * remotes/sstabellini/tags/xen-20160121: Xen PCI passthru: convert to realize() Add Error **errp for xen_pt_config_init() Add Error **errp for xen_pt_setup_vga() Add Error **errp for xen_host_pci_device_get() Xen: use qemu_strtoul instead of strtol Change xen_host_pci_sysfs_path() to return void xen-pvdevice: convert to realize() xen-hvm: Clean up xen_ram_alloc() error handling xen-hvm: Clean up xen_hvm_init() error handling xenfb.c: avoid expensive loops when prod <= out_cons MAINTAINERS: update Xen files Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-01-21ssi: Move ssi.h into a separate directoryAlistair Francis2-2/+2
Move the ssi.h include file into the ssi directory. While touching the code also fix the typdef lines as checkpatch complains. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-01-14xenfb.c: avoid expensive loops when prod <= out_consStefano Stabellini1-2/+3
If the frontend sets out_cons to a value higher than out_prod, it will cause xenfb_handle_events to loop about 2^32 times. Avoid that by using better checks at the beginning of the function. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reported-by: Ling Liu <liuling-it@360.cn>
2016-01-08ui/curses: Fix color attribute of monitor for cursesOGAWA Hirofumi2-3/+6
Current text_console_update() writes totally broken color attributes to console_write_ch(). The format now is writing, [WRONG] bold << 21 | fg << 12 | bg << 8 | char fg == 3bits curses color number bg == 3bits curses color number I can't see this format is where come from. Anyway, this doesn't work at all. What curses expects is actually (and vga.c is using), [RIGHT] bold << 21 | bg << 11 | fg << 8 | char fg == 3bits vga color number bg == 3bits vga color number And curses set COLOR_PAIR() up to match this format, and curses's chtype. I.e, bold | color_pair | char color_pair == (bg << 3 | fg) To fix, this simply uses VGA color number everywhere except curses.c internal. Then, convert it to above [RIGHT] format to write by console_write_ch(). And as bonus, this reduces to expose curses define to other parts (removes COLOR_* from console.c). [Tested the first line is displayed as white on blue back for monitor in curses console] Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Message-id: 87r3j95407.fsf@mail.parknet.co.jp Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-12-18xenfb: avoid reading twice the same fields from the shared pageStefano Stabellini1-4/+6
Reading twice the same field could give the guest an attack of opportunity. In the case of event->type, gcc could compile the switch statement into a jump table, effectively ending up reading the type field multiple times. This is part of XSA-155. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
2015-12-17linux-headers: update from kvm/nextPaolo Bonzini1-2/+2
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-12-17arm: explicitly mark device loads as little-endianPaolo Bonzini2-6/+6
Behaviour of emulated devices should not depend on the endianness of the CPU, so avoid using the endian-dependent load and store functions in the PXA2xx and OMAP display devices. These devices are little endian when they do DMA access. (Since ARM softmmu is always compiled as little endian, this means that the endian-dependent load and store functions are always little endian, so this commit makes no functionally visible change.) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: rewrote commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-11-06qxl: Use g_new() & friends where that makes obvious senseMarkus Armbruster1-1/+1
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Same Coccinelle semantic patch as in commit b45c03f. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-11-06hw/display/tcx: Remove superfluous OBJECT() typecastsThomas Huth1-14/+12
The tcx_initfn() function is already supplied with an Object *obj pointer, so there is no need to cast the state pointer back to an Object pointer all over the place. And while we're at it, also remove the superfluous "return;" statement in this function. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-11-03ui/opengl: Reduce build required libraries for openglOGAWA Hirofumi1-2/+2
We now use epoxy to load opengl libraries. This means we don't need to link opengl libraries directly if interfaces handled by epoxy. With this, we just need epoxy headers and epoxy's *.so to build. Tested with epoxy-1.3.1. - sdl2/gtk/console egl stuff doesn't require other than epoxy - milkymist-tmu2 glx stuff doesn't require other than epoxy (lm32 test is limited, because can't find mmone-bios.bin, so just test to load libGL with "./lm32-softmmu/qemu-system-lm32 -M milkymist,accel=qtest") Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> [ lm32 tested by kraxel ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-10-20vmsvga: more cursor checksGerd Hoffmann1-4/+7
Check the cursor size more carefully. Also switch to unsigned while being at it, so they can't be negative. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-10-12Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-10-09' ↵Peter Maydell2-3/+3
into staging Fix device introspection regressions # gpg: Signature made Fri 09 Oct 2015 14:43:41 BST using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-monitor-2015-10-09: Revert "qdev: Use qdev_get_device_class() for -device <type>,help" qdev: Protect device-list-properties against broken devices qmp: Fix device-list-properties not to crash for abstract device device-introspect-test: New, covering device introspection libqtest: New hmp() & friends libqtest: Clean up unused QTestState member sigact_old tests: Fix how qom-test is run macio: move DBDMA_init from instance_init to realize hw: do not pass NULL to memory_region_init from instance_init memory: allow destroying a non-empty MemoryRegion virtio-input: Fix device introspection on non-Linux hosts update-linux-headers: Rename SW_MAX to SW_MAX_ Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-10-09hw: do not pass NULL to memory_region_init from instance_initPaolo Bonzini2-3/+3
This causes the region to outlive the object, because it attaches the region to /machine. This is not nice for the "realize" method, but much worse for "instance_init" because it can cause dangling pointers after a simple object_new/object_unref pair. Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1443689999-12182-3-git-send-email-armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com>
2015-10-08virtio-gpu: add cursor update tracepointGerd Hoffmann1-1/+8
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2015-10-08virtio-gpu: add 3d mode and virgl rendering support.Gerd Hoffmann3-10/+731
Add virglrenderer library detection. Add 3d mode to virtio-gpu, wire up virglrenderer library. When in 3d mode render using the new context management and texture scanout callbacks. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2015-10-08virtio-gpu: change licence from GPLv2 to GPLv2+Gerd Hoffmann2-3/+3
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-10-08virtio-gpu: move iov free to virtio_gpu_cleanup_mapping_iovGerd Hoffmann1-2/+1
For symmetry reasons: virtio_gpu_create_mapping_iov() allocates it so virtio_gpu_cleanup_mapping_iov() should free it, otherwise it's easy to miss a free() needed and leak memory. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2015-09-18Fix bad error handling after memory_region_init_ram()Markus Armbruster7-11/+11
Symptom: $ qemu-system-x86_64 -m 10000000 Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456: upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory Aborted (core dumped) Root cause: commit ef701d7 screwed up handling of out-of-memory conditions. Before the commit, we report the error and exit(1), in one place, ram_block_add(). The commit lifts the error handling up the call chain some, to three places. Fine. Except it uses &error_abort in these places, changing the behavior from exit(1) to abort(), and thus undoing the work of commit 3922825 "exec: Don't abort when we can't allocate guest memory". The three places are: * memory_region_init_ram() Commit 4994653 (right after commit ef701d7) lifted the error handling further, through memory_region_init_ram(), multiplying the incorrect use of &error_abort. Later on, imitation of existing (bad) code may have created more. * memory_region_init_ram_ptr() The &error_abort is still there. * memory_region_init_rom_device() Doesn't need fixing, because commit 33e0eb5 (soon after commit ef701d7) lifted the error handling further, and in the process changed it from &error_abort to passing it up the call chain. Correct, because the callers are realize() methods. Fix the error handling after memory_region_init_ram() with a Coccinelle semantic patch: @r@ expression mr, owner, name, size, err; position p; @@ memory_region_init_ram(mr, owner, name, size, ( - &error_abort + &error_fatal | err@p ) ); @script:python@ p << r.p; @@ print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column) When the last argument is &error_abort, it gets replaced by &error_fatal. This is the fix. If the last argument is anything else, its position is reported. This lets us check the fix is complete. Four positions get reported: * ram_backend_memory_alloc() Error is passed up the call chain, ultimately through user_creatable_complete(). As far as I can tell, it's callers all handle the error sanely. * fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize() DeviceClass.realize() methods, errors handled sanely further up the call chain. We're good. Test case again behaves: $ qemu-system-x86_64 -m 10000000 qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory [Exit 1 ] The next commits will repair the rest of commit ef701d7's damage. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
2015-09-11typofixes - v4Veres Lajos1-1/+1
Signed-off-by: Veres Lajos <vlajos@gmail.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-09-11maint: avoid useless "if (foo) free(foo)" patternDaniel P. Berrange1-3/+1
The free() and g_free() functions both happily accept NULL on any platform QEMU builds on. As such putting a conditional 'if (foo)' check before calls to 'free(foo)' merely serves to bloat the lines of code. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-09-07arm: Use g_new() & friends where that makes obvious senseMarkus Armbruster2-4/+2
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Coccinelle semantic patch: @@ type T; @@ -g_malloc(sizeof(T)) +g_new(T, 1) @@ type T; @@ -g_try_malloc(sizeof(T)) +g_try_new(T, 1) @@ type T; @@ -g_malloc0(sizeof(T)) +g_new0(T, 1) @@ type T; @@ -g_try_malloc0(sizeof(T)) +g_try_new0(T, 1) @@ type T; expression n; @@ -g_malloc(sizeof(T) * (n)) +g_new(T, n) @@ type T; expression n; @@ -g_try_malloc(sizeof(T) * (n)) +g_try_new(T, n) @@ type T; expression n; @@ -g_malloc0(sizeof(T) * (n)) +g_new0(T, n) @@ type T; expression n; @@ -g_try_malloc0(sizeof(T) * (n)) +g_try_new0(T, n) @@ type T; expression p, n; @@ -g_realloc(p, sizeof(T) * (n)) +g_renew(T, p, n) @@ type T; expression p, n; @@ -g_try_realloc(p, sizeof(T) * (n)) +g_try_renew(T, p, n) @@ type T; expression n; @@ -(T *)g_new(T, n) +g_new(T, n) @@ type T; expression n; @@ -(T *)g_new0(T, n) +g_new0(T, n) @@ type T; expression p, n; @@ -(T *)g_renew(T, p, n) +g_renew(T, p, n) Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1440524394-15640-1-git-send-email-armbru@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-28Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell1-1/+2
virtio fixes for 2.4 Mostly virtio 1 spec compliance fixes. We are unlikely to make it perfectly compliant in the first release, but it seems worth it to try. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon Jul 27 21:55:48 2015 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: virtio: minor cleanup acpi: fix pvpanic device is not shown in ui virtio-blk: only clear VIRTIO_F_ANY_LAYOUT for legacy device virtio-blk: fail get_features when both scsi and 1.0 were set virtio: get_features() can fail virtio-pci: fix memory MR cleanup for modern virtio: set any_layout in virtio core virtio-9p: fix any_layout virtio-serial: fix ANY_LAYOUT virtio: hide legacy features from modern guests Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-27virtio: get_features() can failJason Wang1-1/+2
Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-24Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell6-51/+137
* qemu-char fixes * SCSI fixes (including CVE-2015-5158) * RCU fixes * Framebuffer logic to set DIRTY_MEMORY_VGA * Fix compiler warning for --disable-vnc * qemu-doc fixes * x86 TCG pasto fix # gpg: Signature made Fri Jul 24 12:57:52 2015 BST using RSA key ID 78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # gpg: WARNING: This key is not certified with sufficiently trusted signatures! # gpg: It is not certain that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: target-i386/FPU: a misprint in helper_fistll_ST0 qemu-doc: fix typos framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer memory: count number of active VGA logging clients vl: Fix compiler warning for builds without VNC scsi: Handle no media case for scsi_get_configuration rcu: actually register threads that have RCU read-side critical sections scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158) vnc: fix memory leak qemu-char: Fix missed data on unix socket qemu-char: handle EINTR for TCP character devices exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-07-24framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebufferPaolo Bonzini6-51/+137
The MemoryRegionSection contains enough information to access the RAM region underlying the framebuffer, and can be cached inside the display device. By doing this, the new framebuffer_update_memory_section function can enable dirty memory logging on the relevant RAM region. The function must be called whenever the stride or base of the framebuffer changes; a simple way to cover these cases is to call it on every full frame invalidation, which is a rare case. framebuffer_update_display now works entirely on a MemoryRegionSection, without going through cpu_physical_memory_map/unmap. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-22qxl: Fix new function name for spice-server libraryFrediano Ziglio1-2/+1
The new spice-server function to limit the number of monitors (0.12.6) changed while development from spice_qxl_set_monitors_config_limit to spice_qxl_max_monitors (accepted upstream). By mistake I post patch with former name. This patch fix the function name. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com> Acked-by: Martin Kletzander <mkletzan@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2015-07-16qxl: allow to specify head limit to qxl driverFrediano Ziglio2-5/+24
This patch allow to limit number of heads using qxl driver. By default qxl driver is not limited on any kind on head use so can decide to use as much heads. libvirt has this as a video card parameter (actually set to 1 but not used). This parameter will allow to limit setting a use can do (which could be confusing). Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-07-07virtio-gpu: use virtio_instance_init_common, fixup propertiesGerd Hoffmann3-7/+7
Switch over to virtio_instance_init_common. Drop duplicate properties in virtio-gpu-pci and virtio-vga as they are properly aliased now. Also drop the indirection via DEFINE_VIRTIO_GPU_PROPERTIES, we don't need it any more as the properties are defined in a single place now. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-07-07virtio-gpu: update console device property.Gerd Hoffmann2-0/+15
Update the device link of the QemuConsole, so it points to the virtio-gpu-pci or virtio-vga device instead of virtio-gpu-device. This is needed because we want to find the device by id, for example for input routing, and the id specified on the command line is attached to the pci proxy, not the virtio device. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-06-23hw/display/tcx.c: Fix memory leakShannon Zhao1-0/+1
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-23hw/display/cg3.c: Fix memory leakShannon Zhao1-0/+1
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com> Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-23hw/display/qxl-logger.c: Constify some variableFrediano Ziglio1-8/+8
Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-06-22Include monitor/monitor.h exactly where neededMarkus Armbruster1-1/+0
In particular, don't include it into headers. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
2015-06-22qerror: Move #include out of qerror.hMarkus Armbruster2-0/+2
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Luiz Capitulino <lcapitulino@redhat.com>
2015-06-16Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150615-1' into ↵Peter Maydell6-5/+256
staging virtio-gpu: pci support bits and virtio-vga. # gpg: Signature made Mon Jun 15 13:55:19 2015 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vga-20150615-1: virtio-vga: add vgabios configuration virtio-vga: add '-vga virtio' support virtio-vga: add virtio gpu device with vga compatibility virtio-gpu-pci: add virtio pci support virtio-gpu: fix error message Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-06-15hw/display/exynos4210_fimd: Fix bit-swapping codePeter Maydell1-1/+1
fimd_swap_data() includes code to reverse the bits in a 64-bit integer, but an off-by-one error meant that it would try to shift off the top of the integer. Correct the bug (spotted by Coverity). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1432912615-23107-1-git-send-email-peter.maydell@linaro.org
2015-06-12virtio-vga: add virtio gpu device with vga compatibilityGerd Hoffmann4-4/+186
This patch adds a virtio-vga device. It is simliar to virtio-gpu-pci, but it also adds in vga compatibility, so guests without native virtio-gpu support can drive the device in vga mode. It is compatible with stdvga. Written by Dave Airlie and Gerd Hoffmann. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-06-12virtio-gpu-pci: add virtio pci supportGerd Hoffmann2-0/+69
This patch adds virtio-gpu-pci, which is the pci proxy for the virtio gpu device. With this patch in place virtio-gpu is functional. You need a linux guest with a virtio-gpu driver though, and output will appear pretty late in boot, once the kernel initialized drm and fbcon. Written by Dave Airlie and Gerd Hoffmann. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>