aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2016-07-07aux: Rename aux.[ch] to auxbus.[ch] for the benefit of WindowsPeter Maydell1-1/+1
On Windows 'aux.*' is a reserved name and cannot be used for filenames; see https://msdn.microsoft.com/en-gb/library/windows/desktop/aa365247(v=vs.85).aspx This prevents cloning the QEMU git repo on Windows: C:\Java\sources\kvm> git clone https://github.com/qemu/qemu.git Cloning into 'qemu'... remote: Counting objects: 279563, done. remote: Total 279563 (delta 0), reused 0 (delta 0), pack-reused 279563R Receiving objects: 100% (279563/279563), 122.45 MiB | 3.52 MiB/s, done. Resolving deltas: 100% (221942/221942), done. Checking connectivity... done. error: unable to create file hw/misc/aux.c (No such file or directory) error: unable to create file include/hw/misc/aux.h (No such file or directory) Checking out files: 100% (4795/4795), done. fatal: unable to checkout working tree warning: Clone succeeded, but checkout failed. You can inspect what was checked out with 'git status' and retry the checkout with 'git checkout -f HEAD' (bug https://bugs.launchpad.net/bugs/1595240) Rename the offending files for the benefit of Windows. Reported-by: Алексей Курган <akurgan@yandex.ru> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Wei Huang <wei@redhat.com> Tested-by: KONRAD Frederic <fred.konrad@greensocs.com> Message-id: 1467377145-32385-1-git-send-email-peter.maydell@linaro.org
2016-07-07xlnx_dp: fix iffy xlnx_dp_aux_push_tx_fifoPaolo Bonzini1-4/+6
xlnx_dp_aux_push_tx_fifo takes an immediate uint8_t and a buffer length, which must be 1 because that is how many uint8_t's fit in a uint8_t. Sure enough, that is what xlnx_dp_write passes to it, but the function is just weird. Therefore, make xlnx_dp_aux_push_tx_fifo look like xlnx_dp_aux_push_rx_fifo, taking a pointer to the buffer. Reported by Coverity. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-06virgl: pass whole GL scanout dimensionsMarc-André Lureau1-2/+3
Spice client needs the whole GL texture dimension to be able to show a scanout with a monitor offset (different than +0+0). Furthermore, this fixes a crash when calling surface_{width,height}() after dpy_gfx_replace_surface(con, NULL) was called in virgl_cmd_set_scanout() Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1465911849-30423-4-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-06virgl: count the calls to gl_blockMarc-André Lureau1-2/+8
In virgl_cmd_resource_flush(), when several consoles are updated, it needs to keep blocking until all spice gl draws are done. This fixes an assert() in spice when using multiple monitors with virgl. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1465911849-30423-2-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-06spice: avoid .set_mm_time on >= 0.12.6John Snow1-0/+4
Spice deprecated this callback in 0.12.6. It's not a problem yet, but it will cause Clang to fail in a -Werror build due to the deprecated tag. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1467240095-12507-2-git-send-email-jsnow@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-06qxl: fix surface migrationGerd Hoffmann2-17/+22
Create a helper function qxl_dirty_one_surface() to mark a single qxl surface as dirty. Use the new qxl_get_check_slot_offset function and lookup the memory region from the slot instead of assuming the surface is stored in vram. Use the new helper function in qxl_dirty_surfaces, for both primary and off-screen surfaces. For off-screen surfaces this is no functional change. For primary surfaces this will dirty only the memory actually used instead of the whole surface0 region. It will also work correctly in case the guest places the primary surface in vram instead of the surface0 region (linux kms driver does that). https://bugzilla.redhat.com/show_bug.cgi?id=1235732 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1466597244-5938-3-git-send-email-kraxel@redhat.com
2016-07-06qxl: store memory region and offset instead of pointer for guest slotsGerd Hoffmann2-5/+13
Store MemoryRegion and offset instead of a pointer for each qxl memory slot, so we can easily figure in which memory region an qxl object stored. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1466597244-5938-2-git-send-email-kraxel@redhat.com
2016-07-06qxl: factor out qxl_get_check_slot_offsetGerd Hoffmann1-21/+38
New helper function which translates a qxl physical address into memory slot and offset. Also applies sanity checks. Factored out from qxl_phys2virt. No functional change. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1466597244-5938-1-git-send-email-kraxel@redhat.com
2016-07-06qxl: handle no updates in interface_update_area_completeGerd Hoffmann1-1/+2
Simply return early in case there are no updated rects. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1465395101-13580-1-git-send-email-kraxel@redhat.com
2016-07-06qxl: use uint64_t for vram sizeGerd Hoffmann2-6/+6
This allows for the 64bit vram bar to become larger than 2G (try -device qxl-vga,vram64_size_mb=8192). https://bugzilla.redhat.com/show_bug.cgi?id=1340439 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1465389648-5179-1-git-send-email-kraxel@redhat.com
2016-07-04ssi: change ssi_slave_init to be a realize opsCédric Le Goater2-6/+4
This enables qemu to handle late inits and report errors. All the SSI slave routine names were changed accordingly. Code was modified to handle errors when possible (m25p80 and ssi-sd) Tested with the m25p80 slave object. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 1467138270-32481-2-git-send-email-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-21milkymist: fix tmu2.c build failure (missing error.h include)Gerd Hoffmann1-0/+1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael Walle <michael@walle.cc> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-20Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' ↵Peter Maydell1-0/+122
into staging # gpg: Signature made Mon 20 Jun 2016 21:29:27 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/tracing-pull-request: (42 commits) trace: split out trace events for linux-user/ directory trace: split out trace events for qom/ directory trace: split out trace events for target-ppc/ directory trace: split out trace events for target-s390x/ directory trace: split out trace events for target-sparc/ directory trace: split out trace events for net/ directory trace: split out trace events for audio/ directory trace: split out trace events for ui/ directory trace: split out trace events for hw/alpha/ directory trace: split out trace events for hw/arm/ directory trace: split out trace events for hw/acpi/ directory trace: split out trace events for hw/vfio/ directory trace: split out trace events for hw/s390x/ directory trace: split out trace events for hw/pci/ directory trace: split out trace events for hw/ppc/ directory trace: split out trace events for hw/9pfs/ directory trace: split out trace events for hw/i386/ directory trace: split out trace events for hw/isa/ directory trace: split out trace events for hw/sd/ directory trace: split out trace events for hw/sparc/ directory ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-20Merge remote-tracking branch 'remotes/mwalle/tags/lm32-queue/20160620' into ↵Peter Maydell2-18/+26
staging lm32/milkymist: some qomifying # gpg: Signature made Mon 20 Jun 2016 17:27:53 BST # gpg: using RSA key 0xB458ABB0D8D378E3 # gpg: Good signature from "Michael Walle <michael@walle.cc>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2190 3E48 4537 A7C2 90CE 3EB2 B458 ABB0 D8D3 78E3 * remotes/mwalle/tags/lm32-queue/20160620: milkymist: update specification URLs hw/intc: QOM'ify lm32_pic.c hw/display: QOM'ify milkymist-vgafb.c hw/display: QOM'ify milkymist-tmu2.c hw/timer: QOM'ify milkymist_sysctl hw/timer: QOM'ify lm32_timer Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-20trace: split out trace events for hw/display/ directoryDaniel P. Berrange1-0/+122
Move all trace-events for files in the hw/display/ directory to their own file. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1466066426-16657-18-git-send-email-berrange@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-20milkymist: update specification URLsMichael Walle2-2/+2
The old milkymist.org domain just forwards to mm-labs.hk nowadays. I've created a mirror of the documents. Signed-off-by: Michael Walle <michael@walle.cc>
2016-06-20hw/display: QOM'ify milkymist-vgafb.cxiaoqiang zhao1-6/+10
* Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Michael Walle <michael@walle.cc> Tested-by: Michael Walle <michael@walle.cc> Signed-off-by: Michael Walle <michael@walle.cc>
2016-06-20hw/display: QOM'ify milkymist-tmu2.cxiaoqiang zhao1-10/+14
* Drop the old SysBus init function and use instance_init * Move tmu2_glx_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Michael Walle <michael@walle.cc> Tested-by: Michael Walle <michael@walle.cc> Signed-off-by: Michael Walle <michael@walle.cc>
2016-06-20coccinelle: Remove unnecessary variables for function return valueEduardo Habkost1-3/+1
Use Coccinelle script to replace 'ret = E; return ret' with 'return E'. The script will do the substitution only when the function return type and variable type are the same. Manual fixups: * audio/audio.c: coding style of "read (...)" and "write (...)" * block/qcow2-cluster.c: wrap line to make it shorter * block/qcow2-refcount.c: change indentation of wrapped line * target-tricore/op_helper.c: fix coding style of "remainder|quotient" * target-mips/dsp_helper.c: reverted changes because I don't want to argue about checkpatch.pl * ui/qemu-pixman.c: fix line indentation * block/rbd.c: restore blank line between declarations and statements Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1465855078-19435-4-git-send-email-ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Unused Coccinelle rule name dropped along with a redundant comment; whitespace touched up in block/qcow2-cluster.c; stale commit message paragraph deleted] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-06-16os-posix: include sys/mman.hPaolo Bonzini1-1/+0
qemu/osdep.h checks whether MAP_ANONYMOUS is defined, but this check is bogus without a previous inclusion of sys/mman.h. Include it in sysemu/os-posix.h and remove it from everywhere else. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-14introduce xlnx-dpKONRAD Frederic2-0/+1337
This is the implementation of the DisplayPort. It has an aux-bus to access dpcd and edid. Graphic plane is connected to the channel 3. Video plane is connected to the channel 0. Audio stream are connected to the channels 4 and 5. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Tested-By: Hyun Kwon <hyun.kwon@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 1465833014-21982-9-git-send-email-fred.konrad@greensocs.com [PMM: fixed format strings] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-14introduce dpcd moduleKONRAD Frederic2-0/+174
This introduces dpcd module. It wires on a aux-bus and can be accessed by the driver to get lane-speed, etc. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Tested-By: Hyun Kwon <hyun.kwon@xilinx.com> Message-id: 1465833014-21982-6-git-send-email-fred.konrad@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-07xen: Use DIV_ROUND_UPLaurent Vivier1-2/+2
Replace (((n) + (d) - 1) /(d)) by DIV_ROUND_UP(n,d). This patch is the result of coccinelle script scripts/coccinelle/round.cocci CC: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-06-06virtio-gpu: add live migration supportGerd Hoffmann3-7/+195
Store some additional state for cursor and resource backing storage, so we can write out and reload things. Implement vmsave+vmload for 2d mode. Continue blocking live migration in 3d/virgl mode. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464009727-7753-1-git-send-email-kraxel@redhat.com
2016-06-06vmsvga: don't process more than 1024 fifo commands at onceGerd Hoffmann1-2/+2
vmsvga_fifo_run is called in regular intervals (on each display update) and will resume where it left off. So we can simply exit the loop, without having to worry about how processing will continue. Fixes: CVE-2016-4453 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com
2016-06-06vmsvga: shadow fifo registersGerd Hoffmann1-29/+28
The fifo is normal ram. So kvm vcpu threads and qemu iothread can access the fifo in parallel without syncronization. Which in turn implies we can't use the fifo pointers in-place because the guest can try changing them underneath us. So add shadows for them, to make sure the guest can't modify them after we've applied sanity checks. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-4-git-send-email-kraxel@redhat.com
2016-06-06vmsvga: add more fifo checksGerd Hoffmann1-1/+4
Make sure all fifo ptrs are within range. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-3-git-send-email-kraxel@redhat.com
2016-06-06vmsvga: move fifo sanity checks to vmsvga_fifo_lengthGerd Hoffmann1-13/+15
Sanity checks are applied when the fifo is enabled by the guest (SVGA_REG_CONFIG_DONE write). Which doesn't help much if the guest changes the fifo registers afterwards. Move the checks to vmsvga_fifo_length so they are done each time qemu is about to read from the fifo. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com
2016-06-03virtio-gpu: fix scanout rectanglesGerd Hoffmann1-1/+13
Commit "ca58b45 ui/virtio-gpu: add and use qemu_create_displaysurface_pixman" breaks scanouts which use a region of the underlying resource only. So, we need another way to handle the underlying issue. Lets create a new pixman image, grab a reference on the pixman providing the underlying storage, hook up a destroy callback which releases the reference. That way regions work again and releasing the backing storage should still be impossible thanks to the extra reference we are holding. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1464597655-26341-1-git-send-email-kraxel@redhat.com
2016-05-23vga: add sr_vbe register setGerd Hoffmann2-22/+29
Commit "fd3c136 vga: make sure vga register setup for vbe stays intact (CVE-2016-3712)." causes a regression. The win7 installer is unhappy because it can't freely modify vga registers any more while in vbe mode. This patch introduces a new sr_vbe register set. The vbe_update_vgaregs will fill sr_vbe[] instead of sr[]. Normal vga register reads and writes go to sr[]. Any sr register read access happens through a new sr() helper function which will read from sr_vbe[] with vbe active and from sr[] otherwise. This way we can allow guests update sr[] registers as they want, without allowing them disrupt vbe video modes that way. Cc: qemu-stable@nongnu.org Reported-by: Thomas Lamprecht <thomas@lamprecht.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com
2016-05-23virtio-gpu: fix ui idx checkMarc-André Lureau1-1/+1
Fix off-by-one value check (0 is the first scanout). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-7-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: use VIRTIO_GPU_MAX_SCANOUTSMarc-André Lureau1-2/+2
The value is defined in virtio_gpu.h already (changing from 4 to 16). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-6-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: check max_outputs onlyMarc-André Lureau2-5/+4
The scanout id should not be above the configured num_scanouts. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-5-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: check max_outputs valueMarc-André Lureau1-0/+6
The value must be less than VIRTIO_GPU_MAX_SCANOUT. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-4-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-vga: propagate on gpu realized errorMarc-André Lureau2-1/+8
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-3-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-23virtio-gpu: check early scanout idMarc-André Lureau1-10/+9
Before accessing the g->scanout array, in order to avoid potential out-of-bounds access. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-2-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-19hw: explicitly include qemu/log.hPaolo Bonzini4-0/+4
Move the inclusion out of hw/hw.h, most files do not need it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-19qemu-common: push cpu.h inclusion out of qemu-common.hPaolo Bonzini1-0/+1
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-19qemu-common: stop including qemu/host-utils.h from qemu-common.hPaolo Bonzini1-0/+1
Move it to the actual users. There are some inclusions of qemu/host-utils.h in headers, but they are all necessary. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-13Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160513' into stagingPeter Maydell1-7/+11
MIPS patches 2016-05-13 Changes: * fix zeroing CP0.WatchLo registers in soft reset * QOMify Jazz led # gpg: Signature made Fri 13 May 2016 11:04:04 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" * remotes/lalrae/tags/mips-20160513: hw/display: QOM'ify jazz_led.c target-mips: fix call to memset in soft reset code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-13hw/display: QOM'ify jazz_led.cxiaoqiang.zhao1-7/+11
* Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2016-05-12hw/display/blizzard: Remove blizzard_template.hPeter Maydell2-99/+77
We no longer need to do the "multiply include this header" trick with blizzard_template.h, and it is only used in a single .c file, so just put its contents inline in blizzard.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-3-git-send-email-peter.maydell@linaro.org
2016-05-12hw/display/blizzard: Expand out macrosPeter Maydell1-38/+17
Now that we can assume that only depth 32 is possible, there's no need for the COPY_PIXEL1 and PIXEL_TYPE macros, and the SKIP_PIXEL, COPY_PIXEL and SWAP_WORDS macros aren't used at all. Expand out COPY_PIXEL1 and PIXEL_TYPE where they are used, delete the unused macro definitions, and expand out the uses of glue(name_prefix, DEPTH). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-2-git-send-email-peter.maydell@linaro.org
2016-05-12hw/display: QOM'ify exynos4210_fimd.cxiaoqiang zhao1-7/+12
* Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-id: 1462417489-28603-2-git-send-email-zxq_yx_007@163.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12omap_lcdc: Remove support for DEPTH != 32Pooja Dhannawat2-51/+7
surface_bits_per_pixel() always returns 32 so, removing other dead code which is based on DEPTH !== 32 Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1459260142-9144-1-git-send-email-dhannawatpooja1@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12blizzard: Remove support for DEPTH != 32Pooja Dhannawat2-66/+5
Removing support for DEPTH != 32 from blizzard template header and file that includes it, as macro DEPTH == 32 only used. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1458971873-2768-1-git-send-email-dhannawatpooja1@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-02vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).Gerd Hoffmann1-0/+6
Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Reported-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: update vga register setup on vbe changesGerd Hoffmann1-0/+1
Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: factor out vga register setupGerd Hoffmann1-34/+44
When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02vga: add vbe_enabled() helperGerd Hoffmann1-4/+9
Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.1 at 2024-11-03 00:14:42 +0000