bwlp/qemu.git/hw/display, branch spice_video_codecs

hw/display/next-fb: Fix comment typo

2022-12-03T21:07:07+00:00

Signed-off-by: Evgeny Ermakov Message-Id: <20221125160849.23711-1-evgeny.v.ermakov@gmail.com> Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Peter Maydell Signed-off-by: Thomas Huth

hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion

2022-11-29T23:15:26+00:00

Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Stefan Hajnoczi Message-Id: <20221128202741.4945-6-philmd@linaro.org>

hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144)

2022-11-29T23:15:26+00:00

Have qxl_get_check_slot_offset() return false if the requested buffer size does not fit within the slot memory region. Similarly qxl_phys2virt() now returns NULL in such case, and qxl_dirty_one_surface() aborts. This avoids buffer overrun in the host pointer returned by memory_region_get_ram_ptr(). Fixes: CVE-2022-4144 (out-of-bounds read) Reported-by: Wenxu Yin (@awxylitol) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336 Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Stefan Hajnoczi Message-Id: <20221128202741.4945-5-philmd@linaro.org>

hw/display/qxl: Pass requested buffer size to qxl_phys2virt()

2022-11-29T23:15:26+00:00

Currently qxl_phys2virt() doesn't check for buffer overrun. In order to do so in the next commit, pass the buffer size as argument. For QXLCursor in qxl_render_cursor() -> qxl_cursor() we verify the size of the chunked data ahead, checking we can access 'sizeof(QXLCursor) + chunk->data_size' bytes. Since in the SPICE_CURSOR_TYPE_MONO case the cursor is assumed to fit in one chunk, no change are required. In SPICE_CURSOR_TYPE_ALPHA the ahead read is handled in qxl_unpack_chunks(). Signed-off-by: Philippe Mathieu-Daudé Acked-by: Gerd Hoffmann Signed-off-by: Stefan Hajnoczi Message-Id: <20221128202741.4945-4-philmd@linaro.org>

hw/display/qxl: Document qxl_phys2virt()

2022-11-29T23:15:26+00:00

Reviewed-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Stefan Hajnoczi Message-Id: <20221128202741.4945-3-philmd@linaro.org>

hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler

2022-11-29T23:15:26+00:00

Only 3 command types are logged: no need to call qxl_phys2virt() for the other types. Using different cases will help to pass different structure sizes to qxl_phys2virt() in a pair of commits. Reviewed-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Stefan Hajnoczi Message-Id: <20221128202741.4945-2-philmd@linaro.org>

display: include dependencies explicitly

2022-11-10T15:17:18+00:00

acpi-vga-stub.c pulls in vga_int.h However that currently pulls in ui/console.h which breaks e.g. on systems without pixman. It's better to remove ui/console.h from vga_int.h and directly include it where it's used. Signed-off-by: Michael S. Tsirkin Message-Id: <20221109222112.74519-1-mst@redhat.com> Tested-by: Laurent Vivier Reported-by: Miroslav Rezanina Reported-by: Frederic Bezies Reported-by: Laurent Vivier Fixes: cfead31326 ("AcpiDevAmlIf interface to build VGA device descs") Reviewed-by: Philippe Mathieu-Daudé Tested-by: Philippe Mathieu-Daudé

Merge tag 'pull-request-2022-11-08' of https://gitlab.com/thuth/qemu into staging

2022-11-08T16:34:06+00:00

* Last minute s390x fixes before the hard freeze * Whiste space clean-up in ui/, display/ and hw/usb/ # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmNqPZ0RHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbVbwxAArAxJewpow+QBj7dMd6qLrpC7mjxgiiQD # F8XNYh6bPpPo3+4exmMKMS+DGSLC5TJnp61F4IHyH+yOx8DVWmrjo97q+nWYYD4y # jOdC5a2kzkMzVjrxy26uvPhoUGkiM5w8H5bF9hcWukuEwqpoJPU7u5RXd1yn48Ju # O1RrASw+rHZSnCGFFXldG2HoS+bUOaZRHQs5kV9EwpqEn42eQtq38CQ7YEMloOkD # FpPl75KEQ9/doqSbGLdFP1HzaG/emtFnioIXlGM3Y7RzDxCgvKTdAvPCOBO7LxHA # oOY/nFcRYIEUslvyZLUXahKE2qBv2nenmWAQ9lwGd/iU78nWzR19BZdpItSP3Sjj # HFLOKztqI8qLbx966uOU8O5FaYqfGPV6QZVOSzAl7u8GZbqpN5lp+uArEoGtawMo # 9fRDAgSoser9AAIWr1TOoFGRff3VT4hlZeale3VOmfxAOBc2r70pzvk3ou5mo8NU # VXb6Uz5nNIm8RV9fr6/jgllfQDMiCHSwaAnC1hABqAwatcU/SJ4dKfXbdwjsPN8V # jgC5GqAHaC9mwQu0rfZSzuGZkosh0MZVik/xcWO3hspT/CyIafpi42POyQEjOMYf # 5SgJ8ydV32xEGQw66cl9yLAuhN4F8eTavLwQBV7pmCeySm8HCFGuZrmQkeOTBTD2 # HEbJJjz9zgI= # =P8Mt # -----END PGP SIGNATURE----- # gpg: Signature made Tue 08 Nov 2022 06:29:33 EST # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth " [full] # gpg: aka "Thomas Huth " [full] # gpg: aka "Thomas Huth " [full] # gpg: aka "Thomas Huth " [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2022-11-08' of https://gitlab.com/thuth/qemu: hw/usb: fix tab indentation hw/display: fix tab indentation ui: fix tab indentation s390x/s390-virtio-ccw: Switch off zPCI enhancements on older machines Revert "s390x/s390-virtio-ccw: add zpcii-disable machine property" Signed-off-by: Stefan Hajnoczi

hw/display: fix tab indentation

2022-11-08T09:23:32+00:00

The TABs should be replaced with spaces, to make sure that we have a consistent coding style with an indentation of 4 spaces everywhere. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/370 Signed-off-by: Amarjargal Gundjalam Message-Id: <5cefd05b4d3721d416e48e6df19df18cb6338933.1666707782.git.amarjargal16@gmail.com> Reviewed-by: Thomas Huth Signed-off-by: Thomas Huth

acpi: pc: vga: use AcpiDevAmlIf interface to build VGA device descriptors

2022-11-07T19:00:29+00:00

NB: We do not expect any functional change in any ACPI tables with this change. It's only a refactoring. NB2: Some targets (or1k) do not support acpi and CONFIG_ACPI is off for them. However, modules are reused between all architectures so CONFIG_ACPI is on. For those architectures, dummy stub function definitions help to resolve symbols. This change uses more of these and so it adds a couple of dummy stub definitions so that symbols for those can be resolved. Signed-off-by: Igor Mammedov Message-Id: <20221017102146.2254096-2-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: Ani Sinha CC: Bernhard Beschow Signed-off-by: Ani Sinha Message-Id: <20221107152744.868434-1-ani@anisinha.ca>