summaryrefslogtreecommitdiffstats
path: root/hw/display/cirrus_vga.c
Commit message (Collapse)AuthorAgeFilesLines
* display: cirrus: ignore source pitch value as needed in blit_is_unsafeBruce Rogers2017-01-111-4/+7
| | | | | | | | | | | | Commit 4299b90 added a check which is too broad, given that the source pitch value is not required to be initialized for solid fill operations. This patch refines the blit_is_unsafe() check to ignore source pitch in that case. After applying the above commit as a security patch, we noticed the SLES 11 SP4 guest gui failed to initialize properly. Signed-off-by: Bruce Rogers <brogers@suse.com> Message-id: 20170109203520.5619-1-brogers@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* display: cirrus: check vga bits per pixel(bpp) valuePrasad J Pandit2016-12-051-4/+10
| | | | | | | | | | | | In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA, 'cirrus_get_bpp' returns zero(0), which could lead to a divide by zero error in while copying pixel data. The same could occur via blit pitch values. Add check to avoid it. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* include/qemu/osdep.h: Don't include qapi/error.hMarkus Armbruster2016-03-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: Markus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cirrus_vga: fix off-by-one in blit_region_is_unsafePaolo Bonzini2016-03-011-2/+2
| | | | | | | | | | | | | | | | The "max" value is being compared with >=, but addr + width points to the first byte that will _not_ be copied. Laszlo suggested using a "greater than" comparison, instead of subtracting one like it is already done above for the height, so that max remains always positive. The mistake is "safe"---it will reject some blits, but will never cause out-of-bounds writes. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display: Clean up includesPeter Maydell2016-01-291-0/+1
| | | | | | | | | | Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-21-git-send-email-peter.maydell@linaro.org
* cirrus_vga: QOMifyGonglei2015-05-191-2/+6
| | | | | | | QOMify pci-cirrus-vga like isa-cirrus-vga device. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus-vga: Convert to realizeMarkus Armbruster2015-02-261-6/+5Star
| | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
* isa: remove isa_mem_base variableHervé Poussineau2015-02-131-1/+1
| | | | | | | Now that isa_mem_base variable is always 0, we can remove its usage. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* move hw cursor pos from cirrus to vgaGerd Hoffmann2014-12-161-16/+15Star
|
* cirrus: Force use of shadow pixmap when HW cursor is enabledBenjamin Herrenschmidt2014-12-161-1/+8
| | | | | | | | The HW cursor cannot be painted on a shared surface. This fixes HW cursor display in Windows NT 4.0 and Windows 98. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus: don't overflow CirrusVGAState->cirrus_bltbufGerd Hoffmann2014-12-011-0/+4
| | | | | | This is CVE-2014-8106. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus: fix blit region checkGerd Hoffmann2014-12-011-17/+44
| | | | | | | | | | | | | | | Issues: * Doesn't check pitches correctly in case it is negative. * Doesn't check width at all. Turn macro into functions while being at it, also factor out the check for one region which we then can simply call twice for src + dst. This is CVE-2014-8106. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
* cirrus: Remove non-32bpp cursor drawingBenjamin Herrenschmidt2014-09-301-28/+36
| | | | | | | | | We only draw cursor on non-shared surfaces (so it seems...) and these are always 32bpp Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove rgb_to_pixel indirectionBenjamin Herrenschmidt2014-09-301-6/+9
| | | | | | | | We always use rgb_to_pixel32 nowadays. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* cirrus: Fix build of debug codeBenjamin Herrenschmidt2014-07-111-4/+4
| | | | | | | Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus_vga: adding sanity check for vram sizeGonglei2014-07-111-0/+16
| | | | | | | | | | | when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela2014-06-161-4/+2Star
| | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* vga: allow non-global vmstateGerd Hoffmann2014-04-281-2/+2
| | | | | | | | Need a way to opt-out from vga.vram being global vmstate, for secondary vga cards. Add a bool parameter to vga_common_init to support this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* console: add head to index to qemu consoles.Gerd Hoffmann2014-03-051-2/+2
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* qdev:pci: refactor PCIDevice to use generic "hotpluggable" propertyIgor Mammedov2014-02-101-1/+1
| | | | | | | | | Get rid of PCIDevice specific PCIDeviceClass.no_hotplug and use generic DeviceClass.hotpluggable field instead. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* cirrus: Mark vga io region as coalesced MMIO flushingJan Kiszka2013-10-171-2/+1Star
| | | | | | | | This allows to remove the explicit qemu_flush_coalesced_mmio_buffer calls - the memory core will invoke them now. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* devices: Associate devices to their logical categoryMarcel Apfelbaum2013-07-291-0/+2
| | | | | | | | | The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* hw/d*: pass owner to memory_region_init* functionsPaolo Bonzini2013-07-041-1/+1
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vga: pass owner to cirrus_init_commonPaolo Bonzini2013-07-041-10/+12
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vga: pass owner to vga_common_initPaolo Bonzini2013-07-041-2/+2
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* memory: add owner argument to initialization functionsPaolo Bonzini2013-07-041-8/+8
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* isa: Use realizefn for ISADeviceAndreas Färber2013-06-071-6/+6
| | | | | | | | Drop ISADeviceClass::init and the resulting no-op initfn and let children implement their own realizefn. Adapt error handling. Split off an instance_init where sensible. Signed-off-by: Andreas Färber <afaerber@suse.de>
* Remove unnecessary break statementsStefan Weil2013-06-011-1/+0Star
| | | | | | | | | | | | | | | | | Fix these warnings from cppcheck: hw/display/cirrus_vga.c:2603: hw/sd/sd.c:348: hw/timer/exynos4210_mct.c:1033: target-arm/translate.c:9886: target-s390x/mem_helper.c:518: target-unicore32/translate.c:1936: style: Consecutive return, break, continue, goto or throw statements are unnecessary. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* cirrus_vga: QOM'ify ISA Cirrus VGAAndreas Färber2013-04-291-5/+10
| | | | | | | | | | | Introduce type constant and cast macro to obsolete DO_UPCAST(). Prepares for ISA realizefn. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Andreas Färber <afaerber@suse.de> Message-id: 1367093935-29091-3-git-send-email-afaerber@suse.de Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* console: add device link to QemuConsolesGerd Hoffmann2013-04-251-2/+2
| | | | | | So it is possible to figure which qemu console displays which device. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* console: add GraphicHwOpsGerd Hoffmann2013-04-161-6/+2Star
| | | | | | | Pass a single GraphicHwOps struct pointer to graphic_console_init, instead of a bunch of function pointers. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* console: simplify screendumpGerd Hoffmann2013-04-161-2/+2
| | | | | | | | | | | | | | | | | | | Screendumps are alot simpler as we can update non-active QemuConsoles now. So we only need to update the QemuConsole we want write out, then dump the DisplaySurface content into a ppm file. Done. No console switching needed. No special support code in the gfx card emulation needed. Zap it all. Also move ppm_save out of the vga code and next to the qmp_screendump function. For now screen dumping is limited to console #0 (like it used to be), even though it is dead simple to extend it to other consoles. I wanna finish the console cleanup before setting new qapi interfaces into stone. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Igor Mitsyanko <i.mitsyanko@gmail.com>
* console: rename vga_hw_*, add QemuConsole paramGerd Hoffmann2013-04-161-1/+1
| | | | | | | | | | | | Add QemuConsole parameter to vga_hw_*, so the interface allows to update non-active consoles (the actual code can't handle this yet, see next patch). Passing NULL is allowed and updates the active console, like the functions do today. While touching all vga_hw_* calls anyway rename that to the functions to hardware-neutral graphics_hw_* Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw: move private headers to hw/ subdirectories.Paolo Bonzini2013-04-081-19/+19
| | | | | | | Many headers are used only in a single directory. These can be kept in hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw: move target-independent files to subdirectoriesPaolo Bonzini2013-04-081-0/+3021
This patch tackles all files that are compiled once, moving them to subdirectories of hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2026-05-21 08:09:09 +0200