aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2014-05-05pl022: fix buffer overun on invalid state loadMichael S. Tsirkin
CVE-2013-4530 pl022.c did not bounds check tx_fifo_head and rx_fifo_head after loading them from file and before they are used to dereference array. Reported-by: Michael S. Tsirkin <mst@redhat.com Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05hw/pci/pcie_aer.c: fix buffer overruns on invalid state loadMichael S. Tsirkin
4) CVE-2013-4529 hw/pci/pcie_aer.c pcie aer log can overrun the buffer if log_num is too large There are two issues in this file: 1. log_max from remote can be larger than on local then buffer will overrun with data coming from state file. 2. log_num can be larger then we get data corruption again with an overflow but not adversary controlled. Fix both issues. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05hpet: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4527 hw/timer/hpet.c buffer overrun hpet is a VARRAY with a uint8 size but static array of 32 To fix, make sure num_timers is valid using VMSTATE_VALID hook. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05ahci: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4526 Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded. So we use the old version of ports to read the array but then allow any value for ports. This can cause the code to overflow. There's no reason to migrate ports - it never changes. So just make sure it matches. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05virtio: out-of-bounds buffer write on invalid state loadMichael S. Tsirkin
CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in virtio_load@hw/virtio/virtio.c So we have this code since way back when: num = qemu_get_be32(f); for (i = 0; i < num; i++) { vdev->vq[i].vring.num = qemu_get_be32(f); array of vqs has size VIRTIO_PCI_QUEUE_MAX, so on invalid input this will write beyond end of buffer. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05PortioList: Store PortioList in device stateKirill Batuzov
PortioList is an abstraction used for construction of MemoryRegionPortioList from MemoryRegionPortio. It can be used later to unmap created memory regions. It also requires proper cleanup because some of the memory inside is allocated dynamically. By moving PortioList ot device state we make it possible to cleanup later and avoid leaking memory. This change spans several target platforms. The following testcases cover all changed lines: qemu-system-ppc -M prep qemu-system-i386 -vga qxl qemu-system-i386 -M isapc -soundhw adlib -device ib700,id=watchdog0,bus=isa.0 Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05arm: Clean up fragile use of error_is_set() in realize() methodsMarkus Armbruster
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f0). I guess the error_is_set(errp) in the DeviceClass realize() methods are merely fragile right now, because I can't find a call chain that passes a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05qom: Clean up fragile use of error_is_set() in set() methodsMarkus Armbruster
Using error_is_set(ERRP) to find out whether a function failed is either wrong, fragile, or unnecessarily opaque. It's wrong when ERRP may be null, because errors go undetected when it is. It's fragile when proving ERRP non-null involves a non-local argument. Else, it's unnecessarily opaque (see commit 84d18f0). I guess the error_is_set(errp) in the ObjectProperty set() methods are merely fragile right now, because I can't find a call chain that passes a null errp argument. Make the code more robust and more obviously correct: receive the error in a local variable, then propagate it through the parameter. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05hw: Consistently name Error ** objects errp, and not errMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05hw: Consistently name Error * objects err, and not errpMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05machine: Remove QEMUMachine indirection from MachineClassMarcel Apfelbaum
No need to go through qemu_machine field. Use MachineClass fields directly. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05machine: Copy QEMUMachine's fields to MachineClassMarcel Apfelbaum
In order to eliminate the QEMUMachine indirection, add its fields directly to MachineClass. Do not yet remove qemu_machine field because it is still in use by sPAPR. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> [AF: Copied fields for sPAPR, too] Signed-off-by: Andreas Färber <afaerber@suse.de>
2014-05-05virtio-net: out-of-bounds buffer write on invalid state loadMichael S. Tsirkin
CVE-2013-4150 QEMU 1.5.0 out-of-bounds buffer write in virtio_net_load()@hw/net/virtio-net.c This code is in hw/net/virtio-net.c: if (n->max_queues > 1) { if (n->max_queues != qemu_get_be16(f)) { error_report("virtio-net: different max_queues "); return -1; } n->curr_queues = qemu_get_be16(f); for (i = 1; i < n->curr_queues; i++) { n->vqs[i].tx_waiting = qemu_get_be32(f); } } Number of vqs is max_queues, so if we get invalid input here, for example if max_queues = 2, curr_queues = 3, we get write beyond end of the buffer, with data that comes from wire. This might be used to corrupt qemu memory in hard to predict ways. Since we have lots of function pointers around, RCE might be possible. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05SMBIOS: Build aggregate smbios tables and entry pointGabriel L. Somlo
Build an aggregate set of smbios tables and an entry point structure. Insert tables and entry point into fw_cfg respectively under "etc/smbios/smbios-tables" and "etc/smbios/smbios-anchor". Machine types <= 2.0 will for now continue using field-by-field overrides to SeaBIOS defaults, but for machine types 2.1 and up we expect the BIOS to look for and use the aggregate tables generated by this patch. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> [ kraxel: fix 32bit build ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-05usb: mtp: reply INCOMPLETE_TRANSFER on read errorsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: fix possible buffer overflowGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: drop data-out hexdumpGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: avoid empty description stringGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: fix error path memory leakGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: fix serial (must be exact 32 chars)Gerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: fix version (is decimal not bcd)Gerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: fix usb_mtp_add_u64Gerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb: mtp: replace debug printfs with trace pointsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Peter Wu <peter@lekensteyn.nl> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-05-05usb-ohci: Add vmstate descriptorAlexey Kardashevskiy
This adds migration support for OHCI. This defines a descriptor for OHCIState. This changes some OHCIState field types to be migration compatible. This adds a descriptor for OHCIPort. This migrates the EOF timer if the USB was started at the time of migration. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-05SMBIOS: Use bitmaps to prevent incompatible comand line optionsGabriel L. Somlo
Replace existing smbios_check_collision() functionality with a pair of bitmaps: have_binfile_bitmap and have_fields_bitmap. Bits corresponding to each smbios type are set by smbios_entry_add(), which also uses the bitmaps to ensure that binary blobs and field values are never accepted for the same type. These bitmaps will also be used in the future to decide whether or not to build a full table for a given smbios type. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-05SMBIOS: Use macro to set smbios defaultsGabriel L. Somlo
The function smbios_set_defaults() uses a repeating code pattern for each field. This patch replaces that pattern with a macro. This patch contains no functional changes. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-05SMBIOS: Rename symbols to better reflect future useGabriel L. Somlo
Rename the following symbols: - smbios_set_type1_defaults() to the more general smbios_set_defaults(); - bool smbios_type1_defaults to the more general smbios_defaults; - smbios_get_table() to smbios_get_table_legacy(); This patch contains no functional changes. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-05E820: Add interface for accessing e820 tableGabriel L. Somlo
Add the following two functions: - e820_get_num_entries() - query the size of the e820 table - e820_get_entry() - grab an entry matching a given set of criteria This interface is currently necessary for creating type 19 (memory array mapped address) structures in smbios. Signed-off-by: Gabriel Somlo <somlo@cmu.edu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-05pc: add 2.1 machine typeMichael S. Tsirkin
At the moment, 2.1 and 2.0 machines are identical. As several people are working on incompatible changes to the PC machine, collaboration will be made easier by merging this place-holder. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-05-02Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20140501' into staging target-arm queue: * implement XScale cache lockdown cp15 ops * fix v7M CPUID base register * implement WFE and YIELD as yields for A64 * fix A64 "BLR LR" * support Cortex-A57 in virt machine model * a few other minor AArch64 bugfixes # gpg: Signature made Thu 01 May 2014 15:42:17 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140501: hw/arm/virt: Add support for Cortex-A57 hw/arm/virt: Put GIC register banks on 64K boundaries hw/arm/virt: Create the GIC ourselves rather than (ab)using a15mpcore_priv target-arm: Correct a comment refering to EL0 target-arm: A64: Fix a typo when declaring TLBI ops target-arm: A64: Handle blr lr target-arm: Make vbar_write 64bit friendly on 32bit hosts target-arm: implement WFE/YIELD as a yield for AArch64 armv7m_nvic: fix CPUID Base Register target-arm: Implement XScale cache lockdown operations as NOPs Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-01Merge remote-tracking branch 'remotes/cohuck/tags/kvm_cap_helpers' into stagingPeter Maydell
Add helpers for enabling kvm capabilities and convert the existing s390x and ppc users to use them. # gpg: Signature made Wed 30 Apr 2014 14:48:45 BST using RSA key ID C6F02FAF # gpg: Can't check signature: public key not found * remotes/cohuck/tags/kvm_cap_helpers: ppc: use kvm_vcpu_enable_cap() s390x: use kvm_vcpu_enable_cap() kvm: add kvm_{vm,vcpu}_enable_cap Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-01Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-2' into stagingPeter Maydell
vga: add secondary stdvga variant # gpg: Signature made Mon 28 Apr 2014 10:11:44 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vga-2: add secondary-vga to display-vga test add display-vga test vga: add secondary stdvga variant vga: allow non-global vmstate Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-01hw/arm/virt: Add support for Cortex-A57Peter Maydell
Support the Cortex-A57 in the virt machine model. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1398362083-17737-4-git-send-email-peter.maydell@linaro.org
2014-05-01hw/arm/virt: Put GIC register banks on 64K boundariesPeter Maydell
For an AArch64 CPU which supports 64K pages, having the GIC register banks at 4K offsets is potentially awkward. Move them out to being at 64K offsets. (This is harmless for AArch32 CPUs and for AArch64 CPUs with 4K pages, so it is simpler to use the same offsets everywhere than to try to use 64K offsets only for AArch64 host CPUs.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1398362083-17737-3-git-send-email-peter.maydell@linaro.org
2014-05-01hw/arm/virt: Create the GIC ourselves rather than (ab)using a15mpcore_privPeter Maydell
Rather than having the virt machine model create an a15mpcore_priv device regardless of the actual CPU type in order to instantiate the GIC, move to having the machine model create the GIC directly. This corresponds to a system which uses a standalone GIC (eg the GIC-400) rather than the one built in to the CPU core. The primary motivation for this is to support the Cortex-A57, which for a KVM configuration will use a GICv2, which is not built into the CPU. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1398362083-17737-2-git-send-email-peter.maydell@linaro.org
2014-05-01armv7m_nvic: fix CPUID Base RegisterRabin Vincent
cp15.c0_cpuid is never initialized for ARMv7-M; take the value directly from cpu->midr instead. Signed-off-by: Rabin Vincent <rabin@rab.in> Message-id: 1398036308-32166-1-git-send-email-rabin@rab.in Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-30ppc: use kvm_vcpu_enable_cap()Cornelia Huck
Convert existing users of KVM_ENABLE_CAP to new helper. Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
2014-04-29hda-audio: fix non-mixer codecsGerd Hoffmann
They don't advertise mixer support, but still allow the guest change mixer settings. Add a check to avoid it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-28Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-04-28' ↵Peter Maydell
into staging trivial patches for 2014-04-28 # gpg: Signature made Mon 28 Apr 2014 05:56:01 BST using RSA key ID A4C3D7DB # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 6F67 E18E 7C91 C5B1 5514 66A7 BEE5 9D74 A4C3 D7DB * remotes/mjt/tags/trivial-patches-2014-04-28: slirp/smb: Move ncalrpc directory to tmp po: add proper Language: tags to .po files po/Makefile: fix $SRC_PATH reference init_paths: fix minor memory leak virtfs-proxy-helper: fix call to accept net/net.c: remove unnecessary semicolon Add QEMU logo (SVG file) vl: avoid closing stdout with 'writeconfig' xilinx: Fix typo in comment (Marvel -> Marvell) vl: Eliminate a superfluous local variable vl: Remove useless 'continue' gitignore: cleanups #2 tests/.gitignore: Ignore test-rfifolock move test-* from .gitignore to tests/.gitignore configure: Improve help behavior vl: convert -m to QemuOpts qemu-option: introduce qemu_find_opts_singleton misc: Use cpu_physical_memory_read and cpu_physical_memory_write Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-28Merge remote-tracking branch 'remotes/qmp-unstable/queue/qmp' into stagingPeter Maydell
* remotes/qmp-unstable/queue/qmp: monitor: fix qmp_getfd() fd leak in error case HMP: support specifying dump format for dump-guest-memory HMP: fix doc of dump-guest-memory qmp: object-add: Validate class before creating object monitor: Add device_add and device_del completion. monitor: Add command_completion callback to mon_cmd_t. monitor: Fix drive_del id argument type completion. error: Remove some unused headers qerror.h: Replace QERR_NOT_SUPPORTED with QERR_UNSUPPORTED qerror.h: Remove QERR defines that are only used once qerror.h: Remove unused error classes error: Print error_report() to stderr if using qmp monitor: Remove unused monitor_print_filename error: Privatize error_print_loc vnc: Remove default_mon usage slirp: Remove default_mon usage Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-28megasas: Add MSI supportHannes Reinecke
Some hardware instances do support MSI, so we should do likewise. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-28megasas: Enable MSI-X supportHannes Reinecke
MSI-X support has been fixed in qemu, so we can enable it again. Signed-off-by: Hannes Reinecke <hare@suse.de> [Do not change VMSTATE_PCI_DEVICE to PCIE. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-28megasas: Implement LD_LIST_QUERYHannes Reinecke
Newer firmware implement a LD_LIST_QUERY command, and due to a driver issue no drives might be detected if this command isn't supported. So add emulation for this command, too. Cc: qemu-stable@nongnu.org Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-28scsi: Improve error messages morePaolo Bonzini
Remove the "scsi-block:" prefix for error messages as suggested by Markus. Improve the previous patch by making the message the same for both scsi-block and scsi-generic, including the strerror() output in both and making an explicit reference to SG_IO. Also s/can not/cannot/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-28Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into ↵Peter Maydell
staging Net patches # gpg: Signature made Fri 25 Apr 2014 15:07:31 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/net-pull-request: net: Don't use error_is_set() to suppress additional errors net: Make qmp_query_rx_filter() with name argument more obvious net: xilinx_axienet.c: Add phy soft reset bit clearing net/net.c: Remove unnecessary semicolon pcnet: remove duplicate assignment tap: Avoid extra iterations while closing file fd Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-04-28scsi-disk: Improve error messager if can't get version numberFam Zheng
More often it is that bdrv_ioctl fails due to not supported by driver or whatever reason, in this case we should be specific, because "interface too old" is very confusing. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-28vga: add secondary stdvga variantGerd Hoffmann
Add a standard vga variant which doesn't occupy any legacy resources and thus can easily be used as secondary (or legacy-free) graphics adapter. Programming must be done using the MMIO bar. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-28vga: allow non-global vmstateGerd Hoffmann
Need a way to opt-out from vga.vram being global vmstate, for secondary vga cards. Add a bool parameter to vga_common_init to support this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-04-28xilinx: Fix typo in comment (Marvel -> Marvell)Stefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-04-27misc: Use cpu_physical_memory_read and cpu_physical_memory_writeStefan Weil
These functions don't need type casts (as does cpu_physical_memory_rw) and also make the code better readable. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>