summary refs log tree commit diff stats
path: root/hw/display (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' ↵Peter Maydell2016-06-201-0/+122
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging # gpg: Signature made Mon 20 Jun 2016 21:29:27 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/tracing-pull-request: (42 commits) trace: split out trace events for linux-user/ directory trace: split out trace events for qom/ directory trace: split out trace events for target-ppc/ directory trace: split out trace events for target-s390x/ directory trace: split out trace events for target-sparc/ directory trace: split out trace events for net/ directory trace: split out trace events for audio/ directory trace: split out trace events for ui/ directory trace: split out trace events for hw/alpha/ directory trace: split out trace events for hw/arm/ directory trace: split out trace events for hw/acpi/ directory trace: split out trace events for hw/vfio/ directory trace: split out trace events for hw/s390x/ directory trace: split out trace events for hw/pci/ directory trace: split out trace events for hw/ppc/ directory trace: split out trace events for hw/9pfs/ directory trace: split out trace events for hw/i386/ directory trace: split out trace events for hw/isa/ directory trace: split out trace events for hw/sd/ directory trace: split out trace events for hw/sparc/ directory ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * trace: split out trace events for hw/display/ directoryDaniel P. Berrange2016-06-201-0/+122
| | | | | | | | | | | | | | | | | | Move all trace-events for files in the hw/display/ directory to their own file. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1466066426-16657-18-git-send-email-berrange@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* | Merge remote-tracking branch 'remotes/mwalle/tags/lm32-queue/20160620' into ↵Peter Maydell2016-06-202-18/+26
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging lm32/milkymist: some qomifying # gpg: Signature made Mon 20 Jun 2016 17:27:53 BST # gpg: using RSA key 0xB458ABB0D8D378E3 # gpg: Good signature from "Michael Walle <michael@walle.cc>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 2190 3E48 4537 A7C2 90CE 3EB2 B458 ABB0 D8D3 78E3 * remotes/mwalle/tags/lm32-queue/20160620: milkymist: update specification URLs hw/intc: QOM'ify lm32_pic.c hw/display: QOM'ify milkymist-vgafb.c hw/display: QOM'ify milkymist-tmu2.c hw/timer: QOM'ify milkymist_sysctl hw/timer: QOM'ify lm32_timer Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | milkymist: update specification URLsMichael Walle2016-06-202-2/+2
| | | | | | | | | | | | | | | | | | | | | The old milkymist.org domain just forwards to mm-labs.hk nowadays. I've created a mirror of the documents. Signed-off-by: Michael Walle <michael@walle.cc>
| * | hw/display: QOM'ify milkymist-vgafb.cxiaoqiang zhao2016-06-201-6/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Michael Walle <michael@walle.cc> Tested-by: Michael Walle <michael@walle.cc> Signed-off-by: Michael Walle <michael@walle.cc>
| * | hw/display: QOM'ify milkymist-tmu2.cxiaoqiang zhao2016-06-201-10/+14
| |/ | | | | | | | | | | | | | | | | | | | | * Drop the old SysBus init function and use instance_init * Move tmu2_glx_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Michael Walle <michael@walle.cc> Tested-by: Michael Walle <michael@walle.cc> Signed-off-by: Michael Walle <michael@walle.cc>
* / coccinelle: Remove unnecessary variables for function return valueEduardo Habkost2016-06-201-3/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | Use Coccinelle script to replace 'ret = E; return ret' with 'return E'. The script will do the substitution only when the function return type and variable type are the same. Manual fixups: * audio/audio.c: coding style of "read (...)" and "write (...)" * block/qcow2-cluster.c: wrap line to make it shorter * block/qcow2-refcount.c: change indentation of wrapped line * target-tricore/op_helper.c: fix coding style of "remainder|quotient" * target-mips/dsp_helper.c: reverted changes because I don't want to argue about checkpatch.pl * ui/qemu-pixman.c: fix line indentation * block/rbd.c: restore blank line between declarations and statements Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1465855078-19435-4-git-send-email-ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Unused Coccinelle rule name dropped along with a redundant comment; whitespace touched up in block/qcow2-cluster.c; stale commit message paragraph deleted] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* os-posix: include sys/mman.hPaolo Bonzini2016-06-161-1/+0
| | | | | | | | | qemu/osdep.h checks whether MAP_ANONYMOUS is defined, but this check is bogus without a previous inclusion of sys/mman.h. Include it in sysemu/os-posix.h and remove it from everywhere else. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* introduce xlnx-dpKONRAD Frederic2016-06-142-0/+1337
| | | | | | | | | | | | | | | | This is the implementation of the DisplayPort. It has an aux-bus to access dpcd and edid. Graphic plane is connected to the channel 3. Video plane is connected to the channel 0. Audio stream are connected to the channels 4 and 5. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Tested-By: Hyun Kwon <hyun.kwon@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Message-id: 1465833014-21982-9-git-send-email-fred.konrad@greensocs.com [PMM: fixed format strings] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* introduce dpcd moduleKONRAD Frederic2016-06-142-0/+174
| | | | | | | | | | | | This introduces dpcd module. It wires on a aux-bus and can be accessed by the driver to get lane-speed, etc. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Tested-By: Hyun Kwon <hyun.kwon@xilinx.com> Message-id: 1465833014-21982-6-git-send-email-fred.konrad@greensocs.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* xen: Use DIV_ROUND_UPLaurent Vivier2016-06-071-2/+2
| | | | | | | | | | | | Replace (((n) + (d) - 1) /(d)) by DIV_ROUND_UP(n,d). This patch is the result of coccinelle script scripts/coccinelle/round.cocci CC: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* virtio-gpu: add live migration supportGerd Hoffmann2016-06-063-7/+195
| | | | | | | | | Store some additional state for cursor and resource backing storage, so we can write out and reload things. Implement vmsave+vmload for 2d mode. Continue blocking live migration in 3d/virgl mode. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464009727-7753-1-git-send-email-kraxel@redhat.com
* vmsvga: don't process more than 1024 fifo commands at onceGerd Hoffmann2016-06-061-2/+2
| | | | | | | | | | | | | vmsvga_fifo_run is called in regular intervals (on each display update) and will resume where it left off. So we can simply exit the loop, without having to worry about how processing will continue. Fixes: CVE-2016-4453 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-5-git-send-email-kraxel@redhat.com
* vmsvga: shadow fifo registersGerd Hoffmann2016-06-061-29/+28
| | | | | | | | | | | | | | | The fifo is normal ram. So kvm vcpu threads and qemu iothread can access the fifo in parallel without syncronization. Which in turn implies we can't use the fifo pointers in-place because the guest can try changing them underneath us. So add shadows for them, to make sure the guest can't modify them after we've applied sanity checks. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-4-git-send-email-kraxel@redhat.com
* vmsvga: add more fifo checksGerd Hoffmann2016-06-061-1/+4
| | | | | | | | | | | Make sure all fifo ptrs are within range. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-3-git-send-email-kraxel@redhat.com
* vmsvga: move fifo sanity checks to vmsvga_fifo_lengthGerd Hoffmann2016-06-061-13/+15
| | | | | | | | | | | | | | | Sanity checks are applied when the fifo is enabled by the guest (SVGA_REG_CONFIG_DONE write). Which doesn't help much if the guest changes the fifo registers afterwards. Move the checks to vmsvga_fifo_length so they are done each time qemu is about to read from the fifo. Fixes: CVE-2016-4454 Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1464592161-18348-2-git-send-email-kraxel@redhat.com
* virtio-gpu: fix scanout rectanglesGerd Hoffmann2016-06-031-1/+13
| | | | | | | | | | | | | | | | Commit "ca58b45 ui/virtio-gpu: add and use qemu_create_displaysurface_pixman" breaks scanouts which use a region of the underlying resource only. So, we need another way to handle the underlying issue. Lets create a new pixman image, grab a reference on the pixman providing the underlying storage, hook up a destroy callback which releases the reference. That way regions work again and releasing the backing storage should still be impossible thanks to the extra reference we are holding. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1464597655-26341-1-git-send-email-kraxel@redhat.com
* vga: add sr_vbe register setGerd Hoffmann2016-05-232-22/+29
| | | | | | | | | | | | | | | | | | | | Commit "fd3c136 vga: make sure vga register setup for vbe stays intact (CVE-2016-3712)." causes a regression. The win7 installer is unhappy because it can't freely modify vga registers any more while in vbe mode. This patch introduces a new sr_vbe register set. The vbe_update_vgaregs will fill sr_vbe[] instead of sr[]. Normal vga register reads and writes go to sr[]. Any sr register read access happens through a new sr() helper function which will read from sr_vbe[] with vbe active and from sr[] otherwise. This way we can allow guests update sr[] registers as they want, without allowing them disrupt vbe video modes that way. Cc: qemu-stable@nongnu.org Reported-by: Thomas Lamprecht <thomas@lamprecht.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com
* virtio-gpu: fix ui idx checkMarc-André Lureau2016-05-231-1/+1
| | | | | | | | Fix off-by-one value check (0 is the first scanout). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-7-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-gpu: use VIRTIO_GPU_MAX_SCANOUTSMarc-André Lureau2016-05-231-2/+2
| | | | | | | | The value is defined in virtio_gpu.h already (changing from 4 to 16). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-6-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-gpu: check max_outputs onlyMarc-André Lureau2016-05-232-5/+4
| | | | | | | | The scanout id should not be above the configured num_scanouts. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-5-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-gpu: check max_outputs valueMarc-André Lureau2016-05-231-0/+6
| | | | | | | | The value must be less than VIRTIO_GPU_MAX_SCANOUT. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-4-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-vga: propagate on gpu realized errorMarc-André Lureau2016-05-232-1/+8
| | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-3-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-gpu: check early scanout idMarc-André Lureau2016-05-231-10/+9
| | | | | | | | | Before accessing the g->scanout array, in order to avoid potential out-of-bounds access. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1463653560-26958-2-git-send-email-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw: explicitly include qemu/log.hPaolo Bonzini2016-05-194-0/+4
| | | | | | Move the inclusion out of hw/hw.h, most files do not need it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* qemu-common: push cpu.h inclusion out of qemu-common.hPaolo Bonzini2016-05-191-0/+1
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* qemu-common: stop including qemu/host-utils.h from qemu-common.hPaolo Bonzini2016-05-191-0/+1
| | | | | | | Move it to the actual users. There are some inclusions of qemu/host-utils.h in headers, but they are all necessary. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Merge remote-tracking branch 'remotes/lalrae/tags/mips-20160513' into stagingPeter Maydell2016-05-131-7/+11
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIPS patches 2016-05-13 Changes: * fix zeroing CP0.WatchLo registers in soft reset * QOMify Jazz led # gpg: Signature made Fri 13 May 2016 11:04:04 BST using RSA key ID 0B29DA6B # gpg: Good signature from "Leon Alrae <leon.alrae@imgtec.com>" * remotes/lalrae/tags/mips-20160513: hw/display: QOM'ify jazz_led.c target-mips: fix call to memset in soft reset code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/display: QOM'ify jazz_led.cxiaoqiang.zhao2016-05-131-7/+11
| | | | | | | | | | | | | | | | | | * Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* | hw/display/blizzard: Remove blizzard_template.hPeter Maydell2016-05-122-99/+77
| | | | | | | | | | | | | | | | | | | | | | We no longer need to do the "multiply include this header" trick with blizzard_template.h, and it is only used in a single .c file, so just put its contents inline in blizzard.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-3-git-send-email-peter.maydell@linaro.org
* | hw/display/blizzard: Expand out macrosPeter Maydell2016-05-121-38/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | Now that we can assume that only depth 32 is possible, there's no need for the COPY_PIXEL1 and PIXEL_TYPE macros, and the SKIP_PIXEL, COPY_PIXEL and SWAP_WORDS macros aren't used at all. Expand out COPY_PIXEL1 and PIXEL_TYPE where they are used, delete the unused macro definitions, and expand out the uses of glue(name_prefix, DEPTH). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1462371352-21498-2-git-send-email-peter.maydell@linaro.org
* | hw/display: QOM'ify exynos4210_fimd.cxiaoqiang zhao2016-05-121-7/+12
| | | | | | | | | | | | | | | | | | | | * Drop the old SysBus init function and use instance_init * Move graphic_console_init into realize stage Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-id: 1462417489-28603-2-git-send-email-zxq_yx_007@163.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | omap_lcdc: Remove support for DEPTH != 32Pooja Dhannawat2016-05-122-51/+7
| | | | | | | | | | | | | | | | | | | | | | surface_bits_per_pixel() always returns 32 so, removing other dead code which is based on DEPTH !== 32 Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1459260142-9144-1-git-send-email-dhannawatpooja1@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | blizzard: Remove support for DEPTH != 32Pooja Dhannawat2016-05-122-66/+5
|/ | | | | | | | | | Removing support for DEPTH != 32 from blizzard template header and file that includes it, as macro DEPTH == 32 only used. Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Pooja Dhannawat <dhannawatpooja1@gmail.com> Message-id: 1458971873-2768-1-git-send-email-dhannawatpooja1@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).Gerd Hoffmann2016-05-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Reported-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: update vga register setup on vbe changesGerd Hoffmann2016-05-021-0/+1
| | | | | | | Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: factor out vga register setupGerd Hoffmann2016-05-021-34/+44
| | | | | | | | | When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: add vbe_enabled() helperGerd Hoffmann2016-05-021-4/+9
| | | | | | Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: fix banked access bounds checking (CVE-2016-3710)Gerd Hoffmann2016-05-021-6/+18
| | | | | | | | | | | | | | | | | | | | | | vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* xenfb: use the correct condition to avoid excessive loopingWei Liu2016-04-121-1/+1
| | | | | | | | | | | | In commit ac0487e1 ("xenfb.c: avoid expensive loops when prod <= out_cons"), ">=" was used. In fact, a full ring is a legit state. Correct the test to use ">". Reported-by: "Hao, Xudong" <xudong.hao@intel.com> Signed-off-by: Wei Liu <wei.liu2@citrix.com> Tested-by: "Hao, Xudong" <xudong.hao@intel.com> Acked-by: Anthony Perard <anthony.perard@citrix.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
* virtio-gpu: block live migrationGerd Hoffmann2016-04-111-0/+7
| | | | | | | | | | Feeling a bit nervous putting the full live migration support patch (https://patchwork.ozlabs.org/patch/606902/) in that late in the 2.6 devel cycle as it carries some non-trivial changes. So disable migration in case virtio-gpu is present for now. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ui/virtio-gpu: add and use qemu_create_displaysurface_pixmanGerd Hoffmann2016-04-111-4/+1
| | | | | | | | | | | | | | | | | | Add a the new qemu_create_displaysurface_pixman function, to create a DisplaySurface backed by an existing pixman image. In that case there is no need to create a new pixman image pointing to the same backing storage. We can just use the existing image directly. This does not only simplify things a bit, but most importantly it gets the reference counting right, so the backing storage for the pixman image wouldn't be released underneath us. Use new function in virtio-gpu, where using it actually fixes use-after-free crashes. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1459499240-742-1-git-send-email-kraxel@redhat.com
* Replaced get_tick_per_sec() by NANOSECONDS_PER_SECONDRutuja Shah2016-03-221-3/+3
| | | | | | | | | | | | | | | | | | This patch replaces get_ticks_per_sec() calls with the macro NANOSECONDS_PER_SECOND. Also, as there are no callers, get_ticks_per_sec() is then removed. This replacement improves the readability and understandability of code. For example, timer_mod(fdctrl->result_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + (get_ticks_per_sec() / 50)); NANOSECONDS_PER_SECOND makes it obvious that qemu_clock_get_ns matches the unit of the expression on the right side of the plus. Signed-off-by: Rutuja Shah <rutu.shah.26@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw: explicitly include qemu-common.h and cpu.hPaolo Bonzini2016-03-222-0/+3
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* include/qemu/osdep.h: Don't include qapi/error.hMarkus Armbruster2016-03-228-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: Markus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* bcm2835_fb: add framebuffer device for Raspberry PiGrégory ESTRADE2016-03-162-0/+425
| | | | | | | | | | | | | | | The framebuffer occupies the upper portion of memory (64MiB by default), but it can only be controlled/configured via a system mailbox or property channel (to be added by a subsequent patch). Signed-off-by: Grégory ESTRADE <gregory.estrade@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Message-id: 1457467526-8840-4-git-send-email-Andrew.Baumann@microsoft.com [AB: added Windows (BGR) support and cleanup/refactoring for upstream submission] Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* qxl: lock current_async update in qxl_soft_resetGerd Hoffmann2016-03-011-0/+2
| | | | | | | This should fix a defect report from Coverity. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
* cirrus_vga: fix off-by-one in blit_region_is_unsafePaolo Bonzini2016-03-011-2/+2
| | | | | | | | | | | | | | | | The "max" value is being compared with >=, but addr + width points to the first byte that will _not_ be copied. Laszlo suggested using a "greater than" comparison, instead of subtracting one like it is already done above for the height, so that max remains always positive. The mistake is "safe"---it will reject some blits, but will never cause out-of-bounds writes. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* all: Clean up includesPeter Maydell2016-02-231-1/+0
| | | | | | | | | | Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Blake <eblake@redhat.com>
* xen: Drop __XEN_LATEST_INTERFACE_VERSION__ checks from prior to Xen 4.2Ian Campbell2016-02-101-7/+0
| | | | | | | | | | | We assume (and check for in configure) 4.2 or later now. In reality all of the removed checks are for far older versions. FMT_ioreq_size is no longer needed. Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>