aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2014-09-30vga: Remove rgb_to_pixel indirectionBenjamin Herrenschmidt3-29/+19
We always use rgb_to_pixel32 nowadays. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Separate LE and BE conversion functionsBenjamin Herrenschmidt2-40/+112
Provide different functions for converting from an LE vs a BE framebuffer. We cannot rely on the simple cases always being shared surfaces since cirrus will need to always shadow for cursor emulation, so we need the full set of functions to be able to later handle runtime switching. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\ Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Remove remainder of old conversion cruftBenjamin Herrenschmidt2-178/+95
All the macros used to generate different versions of vga_template.h are now unnecessary, take them all out and remove the _32 suffix from most functions. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Start cutting out non-32bpp conversion supportBenjamin Herrenschmidt1-236/+22
Nowadays, we either share a surface with the host, or we create a 32bpp ARGB console surface. So we only need to draw/convert to 32bpp, enabling us to remove all but one instance of vga_template.h inclusion (to be further cleaned up), rgb_to_pixel_* etc... Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30Merge remote-tracking branch ↵Peter Maydell2-16/+0
'remotes/pmaydell/tags/pull-target-arm-20140929' into staging target-arm: * more EL2/EL3 preparation work * don't handle c15_cpar changes via tb_flush() * fix some unused function warnings in ARM devices * build the GDB XML for 32 bit CPUs into qemu-*-aarch64 * implement guest breakpoint support # gpg: Signature made Mon 29 Sep 2014 19:25:37 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140929: target-arm: Add support for VIRQ and VFIQ target-arm: Add IRQ and FIQ routing to EL2 and 3 target-arm: A64: Emulate the SMC insn target-arm: Add a Hypervisor Trap exception type target-arm: A64: Emulate the HVC insn target-arm: A64: Correct updates to FAR and ESR on exceptions target-arm: Don't take interrupts targeting lower ELs target-arm: Break out exception masking to a separate func target-arm: A64: Refactor aarch64_cpu_do_interrupt target-arm: Add SCR_EL3 target-arm: Add HCR_EL2 target-arm: Don't handle c15_cpar changes via tb_flush() hw/input/tsc210x.c: Delete unused array tsc2101_rates hw/display/pxa2xx_lcd.c: Remove unused function pxa2xx_dma_rdst_set hw/intc/imx_avic.c: Remove unused function imx_avic_set_prio() hw/display/blizzard.c: Delete unused function blizzard_rgb2yuv configure: Build GDB XML for 32 bit ARM CPUs into qemu aarch64 binaries target-arm: Implement handling of breakpoint firing target-arm: Implement setting guest breakpoints Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-29hw/display/pxa2xx_lcd.c: Remove unused function pxa2xx_dma_rdst_setPeter Maydell1-8/+0
The function pxa2xx_dma_rdst_set() is unused; delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410723223-17711-4-git-send-email-peter.maydell@linaro.org
2014-09-29hw/display/blizzard.c: Delete unused function blizzard_rgb2yuvPeter Maydell1-8/+0
The function blizzard_rgb2yuv() is unused; delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410723223-17711-2-git-send-email-peter.maydell@linaro.org
2014-09-29qxl: use graphic_console_set_hwopsGerd Hoffmann1-40/+9
Simply switch function pointers when entering/leaving vga mode. Allows to remove wrapper functions which do nothing but dispatch calls depending on the current qxl mode. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23tcx: Implement hardware accelerationMark Cave-Ayland1-118/+559
The S24/TCX framebuffer is a mildly accelerated video card with blitter, stippler and hardware cursor. * Solaris and NetBSD 6.x use all the hardware acceleration features * The Xorg driver (used by Linux) can use the hardware cursor only This patch implements hardware acceleration in both 8 bit and 24 bit modes. It is based on the NetBSD driver sources and from tests with Solaris. Signed-off-by: Olivier Danet <odanet@caramail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2014-09-12Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell7-11/+17
- Memory: improve error reporting and avoid crashes on hotplug - Build: fixing block/iscsi.so and ranlib warnings on Mac OS X - Migration fixes for x86 - The odd KVM patch. # gpg: Signature made Thu 11 Sep 2014 11:21:10 BST using RSA key ID 9B4D86F2 # gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>" # gpg: aka "Paolo Bonzini <bonzini@gnu.org>" * remotes/bonzini/tags/for-upstream: (21 commits) gdbstub: init mon_chr through qemu_chr_alloc pckbd: adding new fields to vmstate mc146818rtc: add missed field to vmstate piix: do not set irq while loading vmstate serial: fixing vmstate for save/restore parallel: adding vmstate for save/restore fdc: adding vmstate for save/restore cpu: init vmstate for ticks and clock offset apic_common: vapic_paddr synchronization fix vl: use QLIST_FOREACH_SAFE to visit change state handlers exec: add parameter errp to gethugepagesize exec: report error when memory < hpagesize hostmem-ram: don't exit qemu if size of memory-backend-ram is way too big memory: add parameter errp to memory_region_init_rom_device memory: add parameter errp to memory_region_init_ram exec: add parameter errp to qemu_ram_alloc and qemu_ram_alloc_from_ptr rules.mak: Fix DSO build by pulling in archive symbols util: Don't link host-utils.o if it's empty util: Move general qemu_getauxval to util/getauxval.c trace: Only link generated-tracers.o with "simple" backend ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-11Merge remote-tracking branch 'remotes/kraxel/tags/pull-console-20140905-2' ↵Peter Maydell4-12/+21
into staging console: pixman switchover continued, add some infrastructure to make it easier using pixman in display device emulation. # gpg: Signature made Fri 05 Sep 2014 14:38:57 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-console-20140905-2: console: Remove unused QEMU_BIG_ENDIAN_FLAG console: add qemu_pixman_linebuf_copy console: add dpy_gfx_update_dirty console: add qemu_create_displaysurface_guestmem console: stop using PixelFormat console: reimplement qemu_default_pixelformat console: add qemu_default_pixman_format console: add qemu_pixelformat_from_pixman Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-09memory: add parameter errp to memory_region_init_ramHu Tao7-11/+17
Add parameter errp to memory_region_init_ram and update all call sites to pass in &error_abort. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-05console: stop using PixelFormatGerd Hoffmann4-12/+21
With this patch the qemu console core stops using PixelFormat and pixman format codes side-by-side, pixman format code is the primary way to specify the DisplaySurface format: * DisplaySurface stops carrying a PixelFormat field. * qemu_create_displaysurface_from() expects a pixman format now. Functions to convert PixelFormat to pixman_format_code_t (and back) exist for those who still use PixelFormat. As PixelFormat allows easy access to masks and shifts it will probably continue to exist. [ xenfb added by Benjamin Herrenschmidt ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-04vbe: rework sanity checksGerd Hoffmann1-59/+95
Plug a bunch of holes in the bochs dispi interface parameter checking. Add a function doing verification on all registers. Call that unconditionally on every register write. That way we should catch everything, even changing one register affecting the valid range of another register. Some of the holes have been added by commit e9c6149f6ae6873f14a12eea554925b6aa4c4dec. Before that commit the maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES * 32 bpp) has been smaller than the qemu vga memory (8MB) and the checking for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok. Some of the holes have been there forever, such as VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes lacking any verification. Security impact: (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga frame buffer as source -> host memory leak. Memory isn't leaked to the guest but to the vnc client though. (2) Qemu will segfault in case the memory range happens to include unmapped areas -> Guest can DoS itself. The guest can not modify host memory, so I don't think this can be used by the guest to escape. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-09-04vbe: make bochs dispi interface return the correct memory size with qxlGerd Hoffmann3-2/+7
VgaState->vram_size is the size of the pci bar. In case of qxl not the whole pci bar can be used as vga framebuffer. Add a new variable vbe_size to handle that case. By default (if unset) it equals vram_size, but qxl can set vbe_size to something else. This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results and sanity checks are done with the correct size too. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-09-01qxl-render: add more sanity checksGerd Hoffmann1-1/+3
Damn, the dirty rectangle values are signed integers. So the checks added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good enough, we also have to make sure they are not negative. [ Note: There must be something broken in spice-server so we get negative values in the first place. Bug opened: https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2014-08-18memory: convert memory_region_destroy to object_unparentPaolo Bonzini1-1/+1
Explicitly call object_unparent in the few places where we will re-create the memory region. If the memory region is simply being destroyed as part of device teardown, let QOM handle it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-17vga: do not dynamically allocate chain4_aliasPaolo Bonzini2-15/+12
Instead, add a boolean variable to indicate the presence of the region. This avoids a repeated malloc/free (later we can also avoid the add_child/unparent by changing the offset/size of the alias). Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-11cirrus: Fix host CPU blitsBenjamin Herrenschmidt1-2/+1
Commit b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef "CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke cpu to video blits. When the ROP function is called from cirrus_bitblt_cputovideo_next(), we pass 0 for the pitch but only operate on one line at a time. The added test was tripping because after the initial substraction, the pitch becomes negative. Make the test only trip when the height is larger than one (ie. the pitch is actually used). This fixes HW cursor support in Windows NT4.0 (which otherwise was a white rectangle) and general display of icons in that OS when using 8bpp mode. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus: Fix build of debug codeBenjamin Herrenschmidt1-4/+4
Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus_vga: adding sanity check for vram sizeGonglei1-0/+16
when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-07xen: build on ARMStefano Stabellini1-8/+10
Collection of fixes to build QEMU with Xen support on ARM: - use xenstore_read_fe_uint64 to retrieve the page-ref (xenfb); - use xen_pfn_t instead of unsigned long in xenfb; - unsigned long/xenpfn_t in xen_remove_from_physmap; - in xen-mapcache.c use HOST_LONG_BITS to check for QEMU's address space size. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-20spice: fix 32bit buildGerd Hoffmann1-1/+1
Tested-by: Luiz Capitulino <lcapitulino@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1403244764-8622-1-git-send-email-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-16savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela4-12/+6
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-13qxl-render: add sanity checkGerd Hoffmann1-0/+6
Verify dirty rectangle is completely within the primary surface, just ignore it in case it isn't. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-06-13spice: add mouse cursor supportGerd Hoffmann1-1/+5
So you'll have a mouse pointer when running non-qxl gfx cards with mouse pointer support (virtio-gpu, IIRC vmware too). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-06-10hw: vmware_vga: don't return cursorx when the driver asks for cursory registerNicolas Owens1-1/+1
hello qemu-*@nongnu.org, this is my first contribution. apologies if something is incorrect. this patch fixes vmware_vga.c so that it actually returns the cursory register when asked for, instead of cursorx. Signed-off-by: Nicolas Owens <mischief@offblast.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-06-05Merge remote-tracking branch 'remotes/mcayland/qemu-sparc' into stagingPeter Maydell2-38/+53
* remotes/mcayland/qemu-sparc: apb: implement IOMMU translation for PCI host bridge apb: handle reading/writing of IOMMU control registers apb: fix IOMMU register sizes apb: Move IOMMU registers into a separate IOMMUState struct tcx: move initialisation from realizefn to initfn tcx: move initialisation from SysBusDevice class to TCX class realizefn cg3: add extra check to prevent CG3 register array overflow cg3: move initialisation from realizefn to initfn Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-05tcx: move initialisation from realizefn to initfnMark Cave-Ayland1-18/+28
Initialisation cleanup as suggested by Andreas. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
2014-06-05tcx: move initialisation from SysBusDevice class to TCX class realizefnMark Cave-Ayland1-14/+12
This is an intermediate step to bring TCX in line with CG3. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
2014-06-05cg3: add extra check to prevent CG3 register array overflowMark Cave-Ayland1-2/+2
The case statements in the CG3 read and write register routines have a maximum value of CG3_REG_SIZE, so if a value were written to this offset then it would overflow the register array. Currently this cannot be exploited since the MemoryRegion restricts accesses to the range 0 ... CG3_REG_SIZE - 1, but it seems worth clarifying this for future review and/or static analysis. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Paolo Bonzini <pbonzini@redhat.com>
2014-06-05cg3: move initialisation from realizefn to initfnMark Cave-Ayland1-8/+15
Initialisation cleanup as suggested by Andreas. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Andreas Färber <afaerber@suse.de>
2014-06-05hw: use ld_p/st_p instead of ld_raw/st_rawPaolo Bonzini3-10/+10
The ld_raw and st_raw definitions are only needed in code that must compile for both user-mode and softmmu emulation. Device models can use the equivalent ld_p/st_p which are simple pointer accessors. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-28Merge remote-tracking branch ↵Peter Maydell1-8/+8
'remotes/pmaydell/tags/pull-target-arm-20140527' into staging target-arm: * Preliminary restructuring for EL2/EL3 support * improve CPACR handling * fix pxa2xx_lcd palette formats * update highbank/midway maintainer # gpg: Signature made Tue 27 May 2014 17:26:27 BST using RSA key ID 14360CDE # gpg: Can't check signature: public key not found * remotes/pmaydell/tags/pull-target-arm-20140527: (26 commits) target-arm: A64: Register VBAR_EL3 target-arm: A64: Register VBAR_EL2 target-arm: Make vbar_write writeback to any CPREG target-arm: A64: Generalize update_spsel for the various ELs target-arm: A64: Generalize ERET to various ELs target-arm: A64: Trap ERET from EL0 at translation time target-arm: A64: Forbid ERET to higher or unimplemented ELs target-arm: Register EL3 versions of ELR and SPSR target-arm: Register EL2 versions of ELR and SPSR target-arm: Add a feature flag for EL3 target-arm: Add a feature flag for EL2 target-arm: A64: Introduce aarch64_banked_spsr_index() target-arm: Add SPSR entries for EL2/HYP and EL3/MON target-arm: A64: Add ELR entries for EL2 and 3 target-arm: A64: Add SP entries for EL2 and 3 target-arm: c12_vbar -> vbar_el[] target-arm: Make esr_el1 an array target-arm: Make elr_el1 an array target-arm: Use a 1:1 mapping between EL and MMU index target-arm: A32: Use get_mem_index for load/stores ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-27hw/display/pxa2xx_lcd: Fix 16bpp+alpha and 18bpp+alpha palette formatsPeter Maydell1-8/+8
The pxa2xx palette entry "16bpp plus transparency" format is xxxxxxxTRRRRR000GGGGGG00BBBBB000, and "18bpp plus transparency" is xxxxxxxTRRRRRR00GGGGGG00BBBBBB00. Correct errors in the code for reading these and converting them to the internal format. In particular, the buggy code was attempting to mask out bit 24 of a uint16_t, which Coverity spotted as an error. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1400233901-31785-1-git-send-email-peter.maydell@linaro.org
2014-05-24jazz_led: Add missing break in switch caseSaravanakumar1-0/+1
Signed-off-by: Saravanakumar <saravanakumar.punith@gmail.com> Reviewed-by: Paolo Bonizni <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-15Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140515' ↵Peter Maydell6-9/+4
into staging migration/next for 20140515 # gpg: Signature made Thu 15 May 2014 02:32:25 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140515: usb: fix up post load checks migration: show average throughput when migration finishes savevm: Remove all the unneeded version_minimum_id_old (rest) savevm: Remove all the unneeded version_minimum_id_old (usb) Split ram_save_block arch_init: Simplify code for load_xbzrle() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-14savevm: Remove all the unneeded version_minimum_id_old (rest)Juan Quintela6-9/+4
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-13savevm: Remove all the unneeded version_minimum_id_old (arm)Juan Quintela4-10/+6
After commit 767adce2d, they are redundant. This way we don't assign them except when needed. Once there, there were lots of cases where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (apart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> [PMM: fixed minor conflict, corrected commit message typos] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20140505' ↵Peter Maydell1-0/+24
into staging migration/next for 20140505 # gpg: Signature made Mon 05 May 2014 21:27:24 BST using RSA key ID 5872D723 # gpg: Can't check signature: public key not found * remotes/juanquintela/tags/migration/20140505: (36 commits) migration: expose xbzrle cache miss rate migration: expose the bitmap_sync_count to the end migration: Add counts of updating the dirty bitmap XBZRLE: Fix one XBZRLE corruption issues migration: remove duplicate code Coverity: Fix failure path for qemu_accept in migration Init the XBZRLE.lock in ram_mig_init Provide init function for ram migration Count used RAMBlock pages for migration_dirty_pages Make qemu_peek_buffer loop until it gets it's data Disallow outward migration while awaiting incoming migration virtio: validate config_len on load virtio-net: out-of-bounds buffer write on load openpic: avoid buffer overrun on incoming migration ssi-sd: fix buffer overrun on invalid state load savevm: Ignore minimum_version_id_old if there is no load_state_old usb: sanity check setup_index+setup_len in post_load vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ virtio-scsi: fix buffer overrun on invalid state load zaurus: fix buffer overrun on invalid state load ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-05ssd0323: fix buffer overun on invalid state loadMichael S. Tsirkin1-0/+24
CVE-2013-4538 s->cmd_len used as index in ssd0323_transfer() to store 32-bit field. Possible this field might then be supplied by guest to overwrite a return addr somewhere. Same for row/col fields, which are indicies into framebuffer array. To fix validate after load. Additionally, validate that the row/col_start/end are within bounds; otherwise the guest can provoke an overrun by either setting the _end field so large that the row++ increments just walk off the end of the array, or by setting the _start value to something bogus and then letting the "we hit end of row" logic reset row to row_start. For completeness, validate mode as well. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05PortioList: Store PortioList in device stateKirill Batuzov4-11/+11
PortioList is an abstraction used for construction of MemoryRegionPortioList from MemoryRegionPortio. It can be used later to unmap created memory regions. It also requires proper cleanup because some of the memory inside is allocated dynamically. By moving PortioList ot device state we make it possible to cleanup later and avoid leaking memory. This change spans several target platforms. The following testcases cover all changed lines: qemu-system-ppc -M prep qemu-system-i386 -vga qxl qemu-system-i386 -M isapc -soundhw adlib -device ib700,id=watchdog0,bus=isa.0 Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-04-28vga: add secondary stdvga variantGerd Hoffmann2-0/+65
Add a standard vga variant which doesn't occupy any legacy resources and thus can easily be used as secondary (or legacy-free) graphics adapter. Programming must be done using the MMIO bar. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-28vga: allow non-global vmstateGerd Hoffmann8-10/+10
Need a way to opt-out from vga.vram being global vmstate, for secondary vga cards. Add a bool parameter to vga_common_init to support this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-03-18ui/vnc: fix vmware VGA incompatiblitiesPeter Lieven1-1/+2
this fixes invalid rectangle updates observed after commit 12b316d with the vmware VGA driver. The issues occured because the server and client surface update seems to be out of sync at some points and the max width of the surface is not dividable by VNC_DIRTY_BITS_PER_PIXEL (16). Reported-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-03-12ssi: Convert legacy SSI_SLAVE -> DEVICE castsPeter Crosthwaite2-8/+10
Convert legacy ->qdev style casts from TYPE_SSI_SLAVE to TYPE_DEVICE. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> [AF: Introduce local DeviceState variable for transition to QOM realize] Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-03-08xenfb: Fix graphic_console_init() build failureAndreas Färber1-1/+1
In commit 5643706a095044d75df1c0588aac553a595b972b (console: add head to index to qemu consoles.) graphic_console_init() was extended to take an additional argument, but xenfb was not updated accordingly. Fix it. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Don Slutz <dslutz@verizon.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1394228528-31625-1-git-send-email-afaerber@suse.de
2014-03-05console: add head to index to qemu consoles.Gerd Hoffmann20-23/+23
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-02-27sun4m: Add Sun CG3 framebuffer and corresponding OpenBIOS FCode ROMMark Cave-Ayland2-0/+386
The CG3 framebuffer is a simple 8-bit framebuffer for use with operating systems such as early Solaris that do not have drivers for TCX. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> CC: Blue Swirl <blauwirbel@gmail.com> CC: Anthony Liguori <aliguori@amazon.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Bob Breuer <breuerr@mc.net> CC: Artyom Tarasenko <atar4qemu@gmail.com>
2014-02-24qxl: add sanity checkGerd Hoffmann1-1/+7
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
generated by cgit v1.1 at 2025-01-23 14:30:21 +0000