aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)Author
2017-01-27char: rename CharDriverState ChardevMarc-André Lureau
Pick a uniform chardev type name. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-25Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2017-01-24 # gpg: Signature made Tue 24 Jan 2017 20:27:08 GMT # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: (31 commits) hw/isa/isa-bus: Set category of the "isabus-bridge" device usb: Set category and description of the MTP device gdbstub.c: update old error report statements gdbstub.c: fix GDB connection segfault caused by empty machines scsi-disk: add 'fall through' comment to switch VERIFY cases Drop duplicate display option documentation hw/display/framebuffer.c: Avoid overflow for framebuffers > 4GB win32: use glib gpoll if glib >= 2.50 util/mmap-alloc: refactor a little bit for readability util/mmap-alloc: check parameter before using vfio: remove a duplicated word in comments docs: sync pci-ids.txt disas/cris.c: Fix Coverity warning about unchecked NULL lm32: milkymist-tmu2: fix another integer overflow hw/i386/kvmvapic: Remove dead code in patch_hypercalls() doc/usb2: fix typo qga: fix erroneous argument to strerror block: remove dead check pci-assign: avoid pointless stat qemu-img: remove dead check ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-24hw/display/framebuffer.c: Avoid overflow for framebuffers > 4GBPeter Maydell
Coverity points out that calculating src_len by multiplying src_width by rows could overflow. This can only happen in the implausible case of a framebuffer larger than 4GB, but we may as well fix it, placating Coverity. (CID1005515) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24lm32: milkymist-tmu2: fix another integer overflowPeter Maydell
Don't truncate the multiplication and do a 64 bit one instead because the result is stored in a 64 bit variable. This fixes a similar coverity warning to commit 237a8650d640, in a similar way, and is the other half of the fix for coverity CID 1167561. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Michael Walle <michael@walle.cc> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24hw: Fix typos found by codespellStefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de> Acked-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24migration: disallow migrate_add_blocker during migrationAshijeet Acharya
If a migration is already in progress and somebody attempts to add a migration blocker, this should rightly fail. Add an errp parameter and a retcode return value to migrate_add_blocker. Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Ashijeet Acharya <ashijeetacharya@gmail.com> Message-Id: <1484566314-3987-5-git-send-email-ashijeetacharya@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: Greg Kurz <groug@kaod.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Merged with recent 'Allow invtsc migration' change
2017-01-24migration: extend VMStateInfoJianjun Duan
Current migration code cannot handle some data structures such as QTAILQ in qemu/queue.h. Here we extend the signatures of put/get in VMStateInfo so that customized handling is supported. put now will return int type. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Jianjun Duan <duanj@linux.vnet.ibm.com> Message-Id: <1484852453-12728-2-git-send-email-duanj@linux.vnet.ibm.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-01-11virtio-gpu: tag as not hotpluggableGerd Hoffmann
qemu can't hotplug display devices. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1483970138-20360-1-git-send-email-kraxel@redhat.com
2017-01-11virtio-gpu: Fix memory leak in virtio_gpu_load()Peter Maydell
Coverity points out that if we fail in the "creating resources" loop in virtio_gpu_load() we will leak various resources (CID 1356431). Failing a VM load is going to leave the simulation in a complete mess, but we can tidy up to the point that a full system reset should get us back to sanity. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1483969123-14839-3-git-send-email-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11virtio-gpu: Recalculate VirtIOGPU::hostmem on VM loadPeter Maydell
The 'hostmem' field in VirtIOGPU is used to track the total memory used in pixmaps so that we can impose a maximum limit on it. However this field is neither migrated nor recalculated on VM load, which means that after a migration it will be incorrectly too low, which can allow the guest to use more pixmap memory than it should. The per-resource hostmem fields are not filled in either as we reallocate them in the load function. Recalculate the memory used for each pixmap and the total memory used as we reallocate the pixmaps in virtio_gpu_load(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1483969123-14839-2-git-send-email-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11display: cirrus: ignore source pitch value as needed in blit_is_unsafeBruce Rogers
Commit 4299b90 added a check which is too broad, given that the source pitch value is not required to be initialized for solid fill operations. This patch refines the blit_is_unsafe() check to ignore source pitch in that case. After applying the above commit as a security patch, we noticed the SLES 11 SP4 guest gui failed to initialize properly. Signed-off-by: Bruce Rogers <brogers@suse.com> Message-id: 20170109203520.5619-1-brogers@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11virtio-gpu: fix information leak in capset get dispatchLi Qiang
In virgl_cmd_get_capset function, it uses g_malloc to allocate a response struct to the guest. As the 'resp'struct hasn't been full initialized it will lead the 'resp->padding' field to the guest. Use g_malloc0 to avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 58188cae.4a6ec20a.3d2d1.aff2@mx.google.com [ kraxel: resolved conflict ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-09i2c: Allow I2C devices to NAK start eventsCorey Minyard
Add a return value to the event handler. Some I2C devices will NAK if they have no data, so allow them to do this. This required the following changes: Go through all the event handlers and change them to return int and return 0. Modify i2c_start_transfer to terminate the transaction on a NAK. Modify smbus handing to not assert if a NAK occurs on a second operation, and terminate the transaction and return -1 instead. Add some information on semantics to I2CSlaveClass. Signed-off-by: Corey Minyard <cminyard@mvista.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-03virtio-gpu: fix memory leak in resource attach backingLi Qiang
In the resource attach backing function, everytime it will allocate 'res->iov' thus can leading a memory leak. This patch avoid this. Signed-off-by: Li Qiang <liq3ea@gmail.com> Message-id: 1483003721-65360-1-git-send-email-liq3ea@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-03virtio-gpu-3d: fix memory leak in resource attach backingLi Qiang
If the virgl_renderer_resource_attach_iov function fails the 'res_iovs' will be leaked. Add check of the return value to free the 'res_iovs' when failing. Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1482999086-59795-1-git-send-email-liq3ea@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-03virtio-gpu: call cleanup mapping function in resource destroyLi Qiang
If the guest destroy the resource before detach banking, the 'iov' and 'addrs' field in resource is not freed thus leading memory leak issue. This patch avoid this. Signed-off-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1480386565-10077-1-git-send-email-liq3ea@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-20virtio-gpu: track and limit host memory allocationsGerd Hoffmann
This patch makes virtio-gpu track host memory allocations for ressources and applies a limit (configurable 256M by default). When exceeding the limit virtio-gpu throws VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY errors (like it already does today when pixman image allocations fail). This patch covers 2d mode only. For 3d mode we have to figure how we are going to handle this best. qemu doesn't track resources in case virglrenderer is used, so I guess we should extend virglrenderer to allow setting a limit, then let qemu set the limit and catch virgl_renderer_resource_create failures. Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Dave Airlie <airlied@redhat.com> Cc: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1480423356-22255-1-git-send-email-kraxel@redhat.com
2016-12-20display: virtio-gpu-3d: check virgl capabilities max_sizePrasad J Pandit
Virtio GPU device while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command, retrieves the maximum capabilities size to fill in the response object. It continues to fill in capabilities even if retrieved 'max_size' is zero(0), thus resulting in OOB access. Add check to avoid it. Reported-by: Zhenhao Hong <zhenhaohong@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20161214070156.23368-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05display: cirrus: check vga bits per pixel(bpp) valuePrasad J Pandit
In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA, 'cirrus_get_bpp' returns zero(0), which could lead to a divide by zero error in while copying pixel data. The same could occur via blit pitch values. Add check to avoid it. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05virtio-gpu: fix memory leak in update_cursor_data_virglLi Qiang
In update_cursor_data_virgl function, if the 'width'/ 'height' is not equal to current cursor's width/height it will return without free the 'data' allocated previously. This will lead a memory leak issue. This patch fix this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 58187760.41d71c0a.cca75.4cb9@mx.google.com Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05virtio-gpu: fix information leak in getting capset info dispatchLi Qiang
In virgl_cmd_get_capset_info dispatch function, the 'resp' hasn't been full initialized before writing to the guest. This will leak the 'resp.padding' and 'resp.hdr.padding' fieds to the guest. This patch fix this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-id: 5818661e.0860240a.77264.7a56@mx.google.com Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05qxl: Only emit QXL_INTERRUPT_CLIENT_MONITORS_CONFIG on config changesChristophe Fergeau
Currently if the client keeps sending the same monitor config to QEMU/spice-server, QEMU will always raise a QXL_INTERRUPT_CLIENT_MONITORS_CONFIG regardless of whether there was a change or not. Guest-side (with fedora 25), the kernel QXL KMS driver will also forward the event to user-space without checking if there were actual changes. Next in line are gnome-shell/mutter (on a default f25 install), which will try to reconfigure everything without checking if there is anything to do. Where this gets ugly is that when applying the resolution changes, gnome-shell/mutter will call drmModeRmFB, drmModeAddFB, and drmModeSetCrtc, which will cause the primary surface to be destroyed and recreated by the QXL KMS driver. This in turn will cause the client to resend a client monitors config message, which will cause QEMU to reemit an interrupt with an unchanged monitors configuration, ... This causes https://bugzilla.redhat.com/show_bug.cgi?id=1266484 This commit makes sure that we only emit QXL_INTERRUPT_CLIENT_MONITORS_CONFIG when there are actual configuration changes the guest should act on. Signed-off-by: Christophe Fergeau <cfergeau@redhat.com> Message-id: 20161028144840.18326-1-cfergeau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-10-31Merge remote-tracking branch 'remotes/sstabellini/tags/xen-20161028-tag' ↵Peter Maydell
into staging Xen 2016/10/28 # gpg: Signature made Sat 29 Oct 2016 02:03:42 BST # gpg: using RSA key 0x894F8F4870E1AE90 # gpg: Good signature from "Stefano Stabellini <sstabellini@kernel.org>" # gpg: aka "Stefano Stabellini <stefano.stabellini@eu.citrix.com>" # Primary key fingerprint: D04E 33AB A51F 67BA 07D3 0AEA 894F 8F48 70E1 AE90 * remotes/sstabellini/tags/xen-20161028-tag: xen: Rename xen_be_del_xendev xen: Rename xen_be_find_xendev xen: Rename xen_be_evtchn_event xen: Rename xen_be_send_notify xen: Rename xen_be_unbind_evtchn xen: Rename xen_be_printf to xen_pv_printf xen: Move xenstore cleanup and mkdir functions xen: Prepare xendev qtail to be shared with frontends xen: Move evtchn functions to xen_pvdev.c xen: Move xenstore_update to xen_pvdev.c xen: Create a new file xen_pvdev.c xen: Fix coding style warnings xen: Fix coding style errors Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-28xen: Rename xen_be_find_xendevEmil Condrea
Prepare xen_be_find_xendev to be shared with frontends: * xen_be_find_xendev -> xen_pv_find_xendev Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Rename xen_be_send_notifyEmil Condrea
Prepare xen_be_send_notify to be shared with frontends: * xen_be_send_notify -> xen_pv_send_notify Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Rename xen_be_unbind_evtchnEmil Condrea
Prepare xen_be_unbind_evtchn to be shared with frontends: * xen_be_unbind_evtchn -> xen_pv_unbind_evtchn Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Rename xen_be_printf to xen_pv_printfEmil Condrea
Prepare xen_be_printf to be used by both backend and frontends: * xen_be_printf -> xen_pv_printf Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Fix coding style warningsEmil Condrea
Fixes: * WARNING: line over 80 characters Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28xen: Fix coding style errorsEmil Condrea
Fixes the following errors: * ERROR: line over 90 characters * ERROR: code indent should never use tabs * ERROR: space prohibited after that open square bracket '[' * ERROR: do not initialise statics to 0 or NULL * ERROR: "(foo*)" should be "(foo *)" Signed-off-by: Emil Condrea <emilcondrea@gmail.com> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Quan Xu <xuquan8@huawei.com> Acked-by: Anthony PERARD <anthony.perard@citrix.com>
2016-10-28lm32: milkymist-tmu2: fix integer overflowMichael Walle
Don't truncate the multiplication and do a 64 bit one instead because because the result is stored in a 64 bit variable. Spotted by coverity, CID 1167561. Signed-off-by: Michael Walle <michael@walle.cc> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-10-26virtio-gpu: fix memory leak in virtio_gpu_resource_create_2dLi Qiang
In virtio gpu resource create dispatch, if the pixman format is zero it doesn't free the resource object allocated previously. Thus leading a host memory leak issue. This patch avoid this. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 57df486e.8379240a.c3620.ff81@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-10-24hw/display: QOM'ify pl110.cxiaoqiang zhao
Drop the old Sysbus init and use instance_init and DeviceClass::realize instead Signed-off-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-id: 20161023091816.3839-5-zxq_yx_007@163.com [PMM: added accidentally dropped blank line] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-10Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
virtio, pc: fixes and features more guest error handling for virtio devices virtio migration rework pc fixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Mon 10 Oct 2016 00:39:11 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (33 commits) intel-iommu: Check IOAPIC's Trigger Mode against the one in IRTE virtio: cleanup VMSTATE_VIRTIO_DEVICE vhost-vsock: convert VMSTATE_VIRTIO_DEVICE virtio-rng: convert VMSTATE_VIRTIO_DEVICE virtio-balloon: convert VMSTATE_VIRTIO_DEVICE virtio-scsi: convert VMSTATE_VIRTIO_DEVICE virtio-input: convert VMSTATE_VIRTIO_DEVICE virtio-gpu: convert VMSTATE_VIRTIO_DEVICE virtio-serial: convert VMSTATE_VIRTIO_DEVICE virtio-9p: convert VMSTATE_VIRTIO_DEVICE virtio-net: convert VMSTATE_VIRTIO_DEVICE virtio-blk: convert VMSTATE_VIRTIO_DEVICE virtio: prepare change VMSTATE_VIRTIO_DEVICE macro net: don't poke at chardev internal QemuOpts virtio-scsi: handle virtio_scsi_set_config() error virtio-scsi: convert virtio_scsi_bad_req() to use virtio_error() virtio-net: handle virtio_net_flush_tx() errors virtio-net: handle virtio_net_receive() errors virtio-net: handle virtio_net_handle_ctrl() error virtio-blk: handle virtio_blk_handle_request() errors ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-10virtio: cleanup VMSTATE_VIRTIO_DEVICEHalil Pasic
Now all the usages of the old version of VMSTATE_VIRTIO_DEVICE are gone, so we can get rid of the conditionals, and the old macro. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-gpu: convert VMSTATE_VIRTIO_DEVICEHalil Pasic
Use the new VMSTATE_VIRTIO_DEVICE macro. The device virtio-gpu is special because it actually does not adhere to the virtio migration schema, because device state is last. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-08virtio: rename the bar index field name in VirtIOPCIProxyChen Fan
the bar index names are much similar to the bar memory regions, distinguish them to improve the code readability. Signed-off-by: Chen Fan <fan.chen@easystack.cn> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-22vmstateify ssd0323 displayDr. David Alan Gilbert
Bumps version number because we now use the VMSTATE_SSI_SLAVE that only uses a byte rather than a 32bit (for saving a bool 'cs'). Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1472035246-12483-2-git-send-email-dgilbert@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-13virtio-vga: adapt to page-per-vq=offGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1473319012-27560-1-git-send-email-kraxel@redhat.com
2016-09-13virtio-gpu-pci: tag as not hotpluggableGerd Hoffmann
We can't hotplug display adapters in qemu, tag virtio-gpu-pci accordingly (virtio-vga already has this). Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1473319037-27645-1-git-send-email-kraxel@redhat.com
2016-09-13vmsvga: correct bitmap and pixmap size checksPrasad J Pandit
When processing svga command DEFINE_CURSOR in vmsvga_fifo_run, the computed BITMAP and PIXMAP size are checked against the 'cursor.mask[]' and 'cursor.image[]' array sizes in bytes. Correct these checks to avoid OOB memory access. Reported-by: Qinghao Tang <luodalongde@gmail.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1473338754-15430-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-09-08portio: keep references on portioMarc-André Lureau
The isa_register_portio_list() function allocates ioports data/state. Let's keep the reference to this data on some owner. This isn't enough to fix leaks, but at least, ASAN stops complaining of direct leaks. Further cleanup would require calling portio_list_del/destroy(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2016-08-12trace-events: fix first line comment in trace-eventsLaurent Vivier
Documentation is docs/tracing.txt instead of docs/trace-events.txt. find . -name trace-events -exec \ sed -i "s?See docs/trace-events.txt for syntax documentation.?See docs/tracing.txt for syntax documentation.?" \ {} \; Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1470669081-17860-1-git-send-email-lvivier@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-07-29hw/virtio-pci: fix virtio behaviourMarcel Apfelbaum
Enable transitional virtio devices by default. Enable virtio-1.0 for devices plugged into PCIe ports (Root ports or Downstream ports). Using the virtio-1 mode will remove the limitation of the number of devices that can be attached to a machine by removing the need for the IO BAR. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2016-07-21Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc, pci, virtio: new features, cleanups, fixes - interrupt remapping for intel iommus - a bunch of virtio cleanups - fixes all over the place Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 21 Jul 2016 18:49:30 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (57 commits) intel_iommu: avoid unnamed fields virtio: Update migration docs virtio-gpu: Wrap in vmstate virtio-gpu: Use migrate_add_blocker for virgl migration blocking virtio-input: Wrap in vmstate 9pfs: Wrap in vmstate virtio-serial: Wrap in vmstate virtio-net: Wrap in vmstate virtio-balloon: Wrap in vmstate virtio-rng: Wrap in vmstate virtio-blk: Wrap in vmstate virtio-scsi: Wrap in vmstate virtio: Migration helper function and macro virtio-serial: Remove old migration version support virtio-net: Remove old migration version support virtio-scsi: Replace HandleOutput typedef Revert "mirror: Workaround for unexpected iohandler events during completion" virtio-scsi: Call virtio_add_queue_aio virtio-blk: Call virtio_add_queue_aio virtio: Introduce virtio_add_queue_aio ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-21virtio-gpu: Wrap in vmstateDr. David Alan Gilbert
Forcibly convert it to a vmstate wrapper; proper conversion comes later. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-21virtio-gpu: Use migrate_add_blocker for virgl migration blockingDr. David Alan Gilbert
virgl conditionally registers a vmstate as unmigratable when virgl is enabled; instead use the migrate_add_blocker mechanism. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2016-07-20qxl: fix qxl_set_dirty call in qxl_dirty_one_surfaceGerd Hoffmann
qxl_set_dirty() expects start and end as range specification. qxl_dirty_one_surface passes 'size' instead of 'offset + size' as end parameter. Fix that. Also use uint64_t everywhere while being at it. Bug was added by "e25139b qxl: set only off-screen surfaces dirty instead of the whole vram" and carried forward unnoticed by "5cdc402 qxl: fix surface migration". Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1468413187-22071-1-git-send-email-kraxel@redhat.com
2016-07-12Clean up decorations and whitespace around header guardsMarkus Armbruster
Cleaned up with scripts/clean-header-guards.pl. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
2016-07-12Clean up ill-advised or unusual header guardsMarkus Armbruster
Cleaned up with scripts/clean-header-guards.pl. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
2016-07-12Use #include "..." for our own headers, <...> for othersMarkus Armbruster
Tracked down with an ugly, brittle and probably buggy Perl script. Also move includes converted to <...> up so they get included before ours where that's obviously okay. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 23:02:20 +0000