aboutsummaryrefslogtreecommitdiff
path: root/hw/display/vga.c
AgeCommit message (Collapse)AuthorFilesLines
2024-01-18vga: sort-of implement word and double-word access modesPaolo Bonzini1-24/+65
Jazz Jackrabbit has a very unusual VGA setup, where it uses odd/even mode with 256-color graphics. Probably, it wants to use fast VRAM-to-VRAM copies without having to store 4 copies of the sprites as needed in mode X, one for each mod-4 alignment; odd/even mode simplifies the code a lot if it's okay to place on a 160-pixels horizontal grid. At the same time, because it wants to use double buffering (a la "mode X") it uses byte mode, not word mode as is the case in text modes. In order to implement the combination of odd/even mode (plane number comes from bit 0 of the address) and byte mode (use all bytes of VRAM, whereas word mode only uses bytes 0, 2, 4,... on each of the four planes), we need to separate the effect on the plane number from the effect on the address. Implementing the modes properly is a mess in QEMU, because it would change the layout of VRAM and break migration. As an approximation, shift right when the CPU accesses memory instead of shifting left when the CRT controller reads it. A hack is needed in order to write font data properly (see comment in the code), but it works well enough for the game. Because doubleword and chain4 modes are now independent, chain4 does not assert anymore that the address is in range. Instead it just returns all ones and discards writes, like other modes. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18vga: use latches in odd/even mode tooPaolo Bonzini1-26/+12
Jazz Jackrabbit uses odd/even mode with 256-color graphics. This is probably so that it can do very fast blitting with a decent resolution (two pixels, compared to four pixels for "regular" mode X). Accesses still use all planes (reads go to the latches and the game uses read mode 1 so that the CPU always gets 0xFF; writes use the plane mask register because the game sets bit 2 of the sequencer's memory mode register). For this to work, QEMU needs to use the code for latched memory accesses in odd/even mode. The only difference between odd/even mode and "regular" planar mode is how the plane is computed in read mode 0, and how the planes are masked if the aforementioned bit 2 is reset. It is almost enough to fix the game. You also need to honor byte/word mode selection, which is done in the next patch. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18vga: reindent memory access codePaolo Bonzini1-96/+105
The next patch will reuse latched memory access in text modes. Start with a patch that moves the latched access code out of the "if". Best reviewed with "git diff -b". Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18vga: implement horizontal pel panning in graphics modesPaolo Bonzini1-4/+32
This implements smooth scrolling, as used for example by Commander Keen and Second Reality. Unfortunately, this is not enough to avoid tearing in Commander Keen, because sometimes the wrong start address is used for a frame. On real EGA, the panning register is sampled on every line, while the display start is latched for the next frame at the start of the vertical retrace. On real VGA, the panning register is also latched, but at the end of the vertical retrace. It looks like Keen exploits this by only waiting for horizontal retrace when setting the display start, but implementing it breaks the 256-color Keen games... Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18vga: mask addresses in non-VESA modes to 256kPaolo Bonzini1-0/+3
This allows setting the start address to a high value, and reading the bottom of the screen from the beginning of VRAM. Commander Keen 4 ("Goodbye, Galaxy!") relies on this behavior. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18vga: introduce VGADisplayParamsPaolo Bonzini1-48/+34
The next patches will introduce more parameters that cause a full refresh. Instead of adding arguments to get_offsets and lines to update_basic_params, do everything through a struct. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-01-18vga: use common endian swap macrosPaolo Bonzini1-48/+17
The constant-expression bswap is provided by const_le32(), and GET_PLANE() can also be implemented using cpu_to_le32(). Remove the custom macros in vga.c. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29hw/display: Constify VMStateRichard Henderson1-3/+3
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-27-richard.henderson@linaro.org>
2023-04-20hw/display: Compile vga.c as target-independent codeThomas Huth1-9/+22
The target checks here are only during the initialization, so they are not performance critical. We can switch these to runtime checks to avoid that we have to compile this file multiple times during the build, and make the code ready for an universal build one day. Message-Id: <20230412163501.36770-1-thuth@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-01-18bulk: Rename TARGET_FMT_plx -> HWADDR_FMT_plxPhilippe Mathieu-Daudé1-4/+4
The 'hwaddr' type is defined in "exec/hwaddr.h" as: hwaddr is the type of a physical address (its size can be different from 'target_ulong'). All definitions use the 'HWADDR_' prefix, except TARGET_FMT_plx: $ fgrep define include/exec/hwaddr.h #define HWADDR_H #define HWADDR_BITS 64 #define HWADDR_MAX UINT64_MAX #define TARGET_FMT_plx "%016" PRIx64 ^^^^^^ #define HWADDR_PRId PRId64 #define HWADDR_PRIi PRIi64 #define HWADDR_PRIo PRIo64 #define HWADDR_PRIu PRIu64 #define HWADDR_PRIx PRIx64 #define HWADDR_PRIX PRIX64 Since hwaddr's size can be *different* from target_ulong, it is very confusing to read one of its format using the 'TARGET_FMT_' prefix, normally used for the target_long / target_ulong types: $ fgrep TARGET_FMT_ include/exec/cpu-defs.h #define TARGET_FMT_lx "%08x" #define TARGET_FMT_ld "%d" #define TARGET_FMT_lu "%u" #define TARGET_FMT_lx "%016" PRIx64 #define TARGET_FMT_ld "%" PRId64 #define TARGET_FMT_lu "%" PRIu64 Apparently this format was missed during commit a8170e5e97 ("Rename target_phys_addr_t to hwaddr"), so complete it by doing a bulk-rename with: $ sed -i -e s/TARGET_FMT_plx/HWADDR_FMT_plx/g $(git grep -l TARGET_FMT_plx) Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230110212947.34557-1-philmd@linaro.org> [thuth: Fix some warnings from checkpatch.pl along the way] Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-11-10display: include dependencies explicitlyMichael S. Tsirkin1-0/+1
acpi-vga-stub.c pulls in vga_int.h However that currently pulls in ui/console.h which breaks e.g. on systems without pixman. It's better to remove ui/console.h from vga_int.h and directly include it where it's used. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20221109222112.74519-1-mst@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reported-by: Miroslav Rezanina <mrezanin@redhat.com> Reported-by: Frederic Bezies <fredbezies@gmail.com> Reported-by: Laurent Vivier <lvivier@redhat.com> Fixes: cfead31326 ("AcpiDevAmlIf interface to build VGA device descs") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2022-07-28vga: fix incorrect line height in 640x200x2 modePaolo Bonzini1-1/+2
When in CGA modes, QEMU wants to ignore the maximum scan field (bits 0..4) of the maximum scan length register in the CRTC. It is not clear why this is needed---for example, Bochs ignores bit 7 instead. The issue is that the CGA modes are not detected correctly, and in particular mode 6 results in multi_scan==3 according to how SeaBIOS programs it. The right way to check for CGA graphics modes is to check whether bit 13 of the address is special cased by the CRT controller to achieve line interleaving, i.e. whether bit 0 of the CRTC mode control register is clear. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1020 Reported-by: Korneliusz Osmenda <korneliuszo@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-06Replace TARGET_WORDS_BIGENDIANMarc-André Lureau1-1/+1
Convert the TARGET_WORDS_BIGENDIAN macro, similarly to what was done with HOST_BIG_ENDIAN. The new TARGET_BIG_ENDIAN macro is either 0 or 1, and thus should always be defined to prevent misuse. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Suggested-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220323155743.1585078-8-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-06Replace config-time define HOST_WORDS_BIGENDIANMarc-André Lureau1-6/+6
Replace a config-time define with a compile time condition define (compatible with clang and gcc) that must be declared prior to its usage. This avoids having a global configure time define, but also prevents from bad usage, if the config header wasn't included before. This can help to make some code independent from qemu too. gcc supports __BYTE_ORDER__ from about 4.6 and clang from 3.2. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> [ For the s390x parts I'm involved in ] Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220323155743.1585078-7-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-18hw/display/vga: Report a proper error when adding a 2nd ISA VGAThomas Huth1-0/+6
QEMU currently abort()s if the user tries to add a second ISA VGA device, for example: $ ./qemu-system-x86_64 -device isa-vga -device isa-vga RAMBlock "vga.vram" already registered, abort! Aborted (core dumped) $ ./qemu-system-x86_64 -device isa-cirrus-vga -device isa-cirrus-vga RAMBlock "vga.vram" already registered, abort! Aborted (core dumped) $ ./qemu-system-mips64el -M pica61 -device isa-vga RAMBlock "vga.vram" already registered, abort! Aborted (core dumped) Such a crash should never happen just because of giving bad parameters at the command line. Let's return a proper error message instead. (The idea is based on an original patch by Jose R. Ziviani for the isa-vga device, but this now fixes it for the isa-cirrus-vga device, too) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/44 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220317083027.16688-4-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-18hw/display: Allow vga_common_init() to return errorsThomas Huth1-2/+9
The vga_common_init() function currently cannot report errors to its caller. But in the following patch, we'd need this possibility, so let's change it to take an "Error **" as parameter for this. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220317083027.16688-3-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-06-15vga: Allow writing VBE_DISPI_ID5 to ID registerDennis Wölfing1-1/+2
The highest VBE_DISPI_INDEX_ID version supported by QEMU is VBE_DISPI_ID5. But currently QEMU only allows writing values up to VBE_DISPI_ID4 to the VBE_DISPI_INDEX_ID register. As a result of this when a lower version is written to this register and later VBE_DISPI_ID5 is written back, reads from the register will continue to report the lower version. Indeed SeaBIOS is doing that during VGA initialization which causes guests to always read VBE_DISPI_ID0 instead of the correct version. Signed-off-by: Dennis Wölfing <denniswoelfing@gmx.de> Message-Id: <20210607115303.228659-1-denniswoelfing@gmx.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2021-05-10modules: add have_vgaGerd Hoffmann1-0/+2
Introduce a symbol which can be used to prevent display modules which need vga support being loaded into system emulators with CONFIG_VGA=n. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20210430113547.1816178-1-kraxel@redhat.com Message-Id: <20210430113547.1816178-16-kraxel@redhat.com>
2020-09-01hw/display/vga:Remove redundant statement in vga_draw_graphic()Chen Qun1-1/+0
Clang static code analyzer show warning: hw/display/vga.c:1677:9: warning: Value stored to 'update' is never read update = full_update; ^ ~~~~~~~~~~~ Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Message-Id: <20200827110311.164316-11-kuhn.chenqun@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2019-12-18vga: cleanup mapping of VRAM for non-PCI VGAPaolo Bonzini1-12/+0
vga_init_vbe is now used only from ISA VGA cards. Since the alias is not needed anymore, remove it (effectively reverting commit 8294a64d7f, "vga: fix vram double-mapping with -vga std and -M pc-0.12", 2012-05-29) and the now unused vbe_mapped field of VGACommonState. The function now consists of a single memory_region_add_subregion call, so we can inline it; this avoids incorrect usage from PCI cards. Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Based-on: <05af415a-5058-98b4-4a12-9d093a30b1e3@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-12-18hw/display: Remove "rombar" hack from vga-pci and vmware_vgaThomas Huth1-3/+1
Now that the old pc-0.x machine types have been removed, we do not need the old "rombar" hacks anymore. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20191209125248.5849-5-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-09-19vga: move access helpers to separate include fileGerd Hoffmann1-0/+1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190917111441.27405-2-kraxel@redhat.com
2019-08-16Include hw/hw.h exactly where neededMarkus Armbruster1-1/+0
In my "build everything" tree, changing hw/hw.h triggers a recompile of some 2600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). The previous commits have left only the declaration of hw_error() in hw/hw.h. This permits dropping most of its inclusions. Touching it now recompiles less than 200 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-19-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-08-16Include migration/vmstate.h lessMarkus Armbruster1-0/+1
In my "build everything" tree, changing migration/vmstate.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). hw/hw.h supposedly includes it for convenience. Several other headers include it just to get VMStateDescription. The previous commit made that unnecessary. Include migration/vmstate.h only where it's still needed. Touching it now recompiles only some 1600 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-16-armbru@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-08-16Include sysemu/reset.h a lot lessMarkus Armbruster1-0/+2
In my "build everything" tree, changing sysemu/reset.h triggers a recompile of some 2600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). The main culprit is hw/hw.h, which supposedly includes it for convenience. Include sysemu/reset.h only where it's needed. Touching it now recompiles less than 200 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20190812052359.30071-9-armbru@redhat.com>
2019-01-11avoid TABs in files that only contain a fewPaolo Bonzini1-4/+4
Most files that have TABs only contain a handful of them. Change them to spaces so that we don't confuse people. disas, standard-headers, linux-headers and libdecnumber are imported from other projects and probably should be exempted from the check. Outside those, after this patch the following files still contain both 8-space and TAB sequences at the beginning of the line. Many of them have a majority of TABs, or were initially committed with all tabs. bsd-user/i386/target_syscall.h bsd-user/x86_64/target_syscall.h crypto/aes.c hw/audio/fmopl.c hw/audio/fmopl.h hw/block/tc58128.c hw/display/cirrus_vga.c hw/display/xenfb.c hw/dma/etraxfs_dma.c hw/intc/sh_intc.c hw/misc/mst_fpga.c hw/net/pcnet.c hw/sh4/sh7750.c hw/timer/m48t59.c hw/timer/sh_timer.c include/crypto/aes.h include/disas/bfd.h include/hw/sh4/sh.h libdecnumber/decNumber.c linux-headers/asm-generic/unistd.h linux-headers/linux/kvm.h linux-user/alpha/target_syscall.h linux-user/arm/nwfpe/double_cpdo.c linux-user/arm/nwfpe/fpa11_cpdt.c linux-user/arm/nwfpe/fpa11_cprt.c linux-user/arm/nwfpe/fpa11.h linux-user/flat.h linux-user/flatload.c linux-user/i386/target_syscall.h linux-user/ppc/target_syscall.h linux-user/sparc/target_syscall.h linux-user/syscall.c linux-user/syscall_defs.h linux-user/x86_64/target_syscall.h slirp/cksum.c slirp/if.c slirp/ip.h slirp/ip_icmp.c slirp/ip_icmp.h slirp/ip_input.c slirp/ip_output.c slirp/mbuf.c slirp/misc.c slirp/sbuf.c slirp/socket.c slirp/socket.h slirp/tcp_input.c slirp/tcpip.h slirp/tcp_output.c slirp/tcp_subr.c slirp/tcp_timer.c slirp/tftp.c slirp/udp.c slirp/udp.h target/cris/cpu.h target/cris/mmu.c target/cris/op_helper.c target/sh4/helper.c target/sh4/op_helper.c target/sh4/translate.c tcg/sparc/tcg-target.inc.c tests/tcg/cris/check_addo.c tests/tcg/cris/check_moveq.c tests/tcg/cris/check_swap.c tests/tcg/multiarch/test-mmap.c ui/vnc-enc-hextile-template.h ui/vnc-enc-zywrle.h util/envlist.c util/readline.c The following have only TABs: bsd-user/i386/target_signal.h bsd-user/sparc64/target_signal.h bsd-user/sparc64/target_syscall.h bsd-user/sparc/target_signal.h bsd-user/sparc/target_syscall.h bsd-user/x86_64/target_signal.h crypto/desrfb.c hw/audio/intel-hda-defs.h hw/core/uboot_image.h hw/sh4/sh7750_regnames.c hw/sh4/sh7750_regs.h include/hw/cris/etraxfs_dma.h linux-user/alpha/termbits.h linux-user/arm/nwfpe/fpopcode.h linux-user/arm/nwfpe/fpsr.h linux-user/arm/syscall_nr.h linux-user/arm/target_signal.h linux-user/cris/target_signal.h linux-user/i386/target_signal.h linux-user/linux_loop.h linux-user/m68k/target_signal.h linux-user/microblaze/target_signal.h linux-user/mips64/target_signal.h linux-user/mips/target_signal.h linux-user/mips/target_syscall.h linux-user/mips/termbits.h linux-user/ppc/target_signal.h linux-user/sh4/target_signal.h linux-user/sh4/termbits.h linux-user/sparc64/target_syscall.h linux-user/sparc/target_signal.h linux-user/x86_64/target_signal.h linux-user/x86_64/termbits.h pc-bios/optionrom/optionrom.h slirp/mbuf.h slirp/misc.h slirp/sbuf.h slirp/tcp.h slirp/tcp_timer.h slirp/tcp_var.h target/i386/svm.h target/sparc/asi.h target/xtensa/core-dc232b/xtensa-modules.inc.c target/xtensa/core-dc233c/xtensa-modules.inc.c target/xtensa/core-de212/core-isa.h target/xtensa/core-de212/xtensa-modules.inc.c target/xtensa/core-fsf/xtensa-modules.inc.c target/xtensa/core-sample_controller/core-isa.h target/xtensa/core-sample_controller/xtensa-modules.inc.c target/xtensa/core-test_kc705_be/core-isa.h target/xtensa/core-test_kc705_be/xtensa-modules.inc.c tests/tcg/cris/check_abs.c tests/tcg/cris/check_addc.c tests/tcg/cris/check_addcm.c tests/tcg/cris/check_addoq.c tests/tcg/cris/check_bound.c tests/tcg/cris/check_ftag.c tests/tcg/cris/check_int64.c tests/tcg/cris/check_lz.c tests/tcg/cris/check_openpf5.c tests/tcg/cris/check_sigalrm.c tests/tcg/cris/crisutils.h tests/tcg/cris/sys.c tests/tcg/i386/test-i386-ssse3.c ui/vgafont.h Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20181213223737.11793-3-pbonzini@redhat.com> Reviewed-by: Aleksandar Markovic <amarkovic@wavecomp.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com> Acked-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Eric Blake <eblake@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Stefan Markovic <smarkovic@wavecomp.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-30use dpy_gfx_update_fullGerd Hoffmann1-2/+1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180810132856.22833-1-kraxel@redhat.com
2018-07-03Merge remote-tracking branch 'remotes/kraxel/tags/vga-20180703-pull-request' ↵Peter Maydell1-2/+2
into staging vga: disable global_vmstate, virtio-gpu scanout tracking fixes. # gpg: Signature made Tue 03 Jul 2018 10:44:56 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20180703-pull-request: vga: disable global_vmstate for 3.0+ machine types virtio-gpu: disable scanout when backing resource is destroyed virtio-gpu: update old resource too. virtio-gpu: tweak scanout disable. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # hw/display/qxl.c # hw/display/vga-isa-mm.c
2018-07-03vga: disable global_vmstate for 3.0+ machine typesGerd Hoffmann1-2/+2
Move global_vmstate from vga_common_init() parameter to VGACommonState field. Set global_vmstate to true for isa vga devices, so nothing changes here. virtio-vga and secondary-vga already set global_vmstate to false so no change here either. All other pci vga devices get a new global-vmstate property, defaulting to false. A compat property flips it to true for older machine types. With this in place you don't get a vmstate section naming conflict any more when adding multiple pci vga devices to your vm. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-Id: <20180702163345.17892-1-kraxel@redhat.com>
2018-07-02hw/display: Use the IEC binary prefix definitionsPhilippe Mathieu-Daudé1-2/+3
It eases code review, unit is explicit. Patch generated using: $ git grep -E '(1024|2048|4096|8192|(<<|>>).?(10|20|30))' hw/ include/hw/ and modified manually. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20180625124238.25339-15-f4bug@amsat.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-06-04vga: cleanup surface handlingGerd Hoffmann1-17/+19
Just set the full_update flag if we need a new DisplaySurface. Create a new surface when the flag is set instead of having two places where qemu_create_displaysurface_from() is called. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180525131318.28437-1-kraxel@redhat.com
2018-05-24vga: catch depth 0Gerd Hoffmann1-5/+18
depth == 0 is used to indicate 256 color modes. Our region calculation goes wrong in that case. So detect that and just take the safe code path we already have for the wraparound case. While being at it also catch depth == 15 (where our region size calculation goes wrong too). And make the comment more verbose, explaining what is going on here. Without this windows guest install might trigger an assert due to trying to check dirty bitmap outside the snapshot region. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1575541 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180514103117.21059-1-kraxel@redhat.com
2018-03-12vga: fix region calculationGerd Hoffmann1-0/+2
Typically the scanline length and the line offset are identical. But in case they are not our calculation for region_end is incorrect. Using line_offset is fine for all scanlines, except the last one where we have to use the actual scanline length. Fixes: CVE-2018-7550 Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Tested-by: Ross Lagerwall <ross.lagerwall@citrix.com> Message-id: 20180309143704.13420-1-kraxel@redhat.com
2018-02-13memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshotPaolo Bonzini1-6/+0
Simplify the users of memory_region_snapshot_and_clear_dirty, so that they do not have to call memory_region_sync_dirty_bitmap explicitly. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-25vga: check the validation of memory addr when draw textlinzhecheng1-0/+3
Start a vm with qemu-kvm -enable-kvm -vnc :66 -smp 1 -m 1024 -hda redhat_5.11.qcow2 -device pcnet -vga cirrus, then use VNC client to connect to VM, and excute the code below in guest OS will lead to qemu crash: int main() { iopl(3); srand(time(NULL)); int a,b; while(1){ a = rand()%0x100; b = 0x3c0 + (rand()%0x20); outb(a,b); } return 0; } The above code is writing the registers of VGA randomly. We can write VGA CRT controller registers index 0x0C or 0x0D (which is the start address register) to modify the the display memory address of the upper left pixel or character of the screen. The address may be out of the range of vga ram. So we should check the validation of memory address when reading or writing it to avoid segfault. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20180111132724.13744-1-linzhecheng@huawei.com Fixes: CVE-2018-5683 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-12-18hw/display/vga: extract public API from i386/pc to "hw/display/vga.h"Philippe Mathieu-Daudé1-1/+1
and remove the old i386/pc dependency. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-12-18hw/display/vga: "vga_int.h" requires "ui/console.h"Philippe Mathieu-Daudé1-1/+0
since The VGACommonState struct has a GraphicHwOps *hw_ops member, then remove the now unnecessary includes. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-12-18hw/display/vga: "vga.h" only contains registers defs, rename it "vga_regs.h"Philippe Mathieu-Daudé1-1/+1
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-11-10vga: fix region checks in wraparound caseGerd Hoffmann1-2/+2
Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20171030102830.4469-1-kraxel@redhat.com
2017-10-17vga: add ram_addr_t castGerd Hoffmann1-1/+1
Reported by Coverity. Fixes: CID 1381409 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20171010141323.14049-4-kraxel@redhat.com
2017-10-17vga: handle cirrus vbe mode wraparounds.Gerd Hoffmann1-7/+21
Commit "3d90c62548 vga: stop passing pointers to vga_draw_line* functions" is incomplete. It doesn't handle the case that the vga rendering code tries to create a shared surface, i.e. a pixman image backed by vga video memory. That can not work in case the guest display wraps from end of video memory to the start. So force shadowing in that case. Also adjust the snapshot region calculation. Can trigger with cirrus only, when programming vbe modes using the bochs api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds can't happen. Fixes: CVE-2017-13672 Fixes: 3d90c6254863693a6b13d918d2b8682e08bbc681 Cc: P J P <ppandit@redhat.com> Reported-by: David Buchanan <d@vidbuchanan.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20171010141323.14049-3-kraxel@redhat.com
2017-10-17vga: drop line_offset variableGerd Hoffmann1-4/+3
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-09-01vga/migration: Update memory map in post_loadDr. David Alan Gilbert1-0/+1
After migration the chain4 alias mapping added by 80763888 (in 2011) might be missing, since there's no call to vga_update_memory_access in the post_load after the registers are updated. Add it back. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-id: 20170804113329.13609-1-dgilbert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-09-01vga: stop passing pointers to vga_draw_line* functionsGerd Hoffmann1-2/+3
Instead pass around the address (aka offset into vga memory). Add vga_read_* helper functions which apply vbe_size_mask to the address, to make sure the address stays within the valid range, similar to the cirrus blitter fixes (commits ffaf857778 and 026aeffcb4). Impact: DoS for privileged guest users. qemu crashes with a segfault, when hitting the guard page after vga memory allocation, while reading vga memory for display updates. Fixes: CVE-2017-13672 Cc: P J P <ppandit@redhat.com> Reported-by: David Buchanan <d@vidbuchanan.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170828122906.18993-1-kraxel@redhat.com
2017-09-01vga: fix display update region calculation (split screen)Gerd Hoffmann1-2/+8
vga display update mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used. This can trigger an assert in cpu_physical_memory_snapshot_get_dirty(). Impact: DoS for privileged guest users. Fixes: CVE-2017-13673 Fixes: fec5e8c92becad223df9d972770522f64aafdb72 Cc: P J P <ppandit@redhat.com> Reported-by: David Buchanan <d@vidbuchanan.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170828123307.15392-1-kraxel@redhat.com
2017-08-31vga: use DIV_ROUND_UPMarc-André Lureau1-1/+1
I used the clang-tidy qemu-round check to generate the fix: https://github.com/elmarco/clang-tools-extra Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Richard Henderson <rth@twiddle.net>
2017-07-14memory: Rename memory_region_init_ram() to memory_region_init_ram_nomigrate()Peter Maydell1-1/+1
Rename memory_region_init_ram() to memory_region_init_ram_nomigrate(). This leaves the way clear for us to provide a memory_region_init_ram() which does handle migration. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1499438577-7674-4-git-send-email-peter.maydell@linaro.org
2017-06-28vmstate: error hint for failed equal checksHalil Pasic1-1/+1
In some cases a failing VMSTATE_*_EQUAL does not mean we detected a bug, but it's actually the best we can do. Especially in these cases a verbose error message is required. Let's introduce infrastructure for specifying a error hint to be used if equal check fails. Let's do this by adding a parameter to the _EQUAL macros called _err_hint. Also change all current users to pass NULL as last parameter so nothing changes for them. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170623144823.42936-1-pasic@linux.vnet.ibm.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2017-05-11vga: fix display update region calculationGerd Hoffmann1-1/+1
vga display update mis-calculated the region for the dirty bitmap snapshot in case the scanlines are padded. This can triggere an assert in cpu_physical_memory_snapshot_get_dirty(). Fixes: fec5e8c92becad223df9d972770522f64aafdb72 Reported-by: Kevin Wolf <kwolf@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170509104839.19415-1-kraxel@redhat.com
2017-04-24vga: make display updates thread safe.Gerd Hoffmann1-19/+17
The vga code clears the dirty bits *after* reading the framebuffer memory. So if the guest framebuffer updates hits the race window between vga reading the framebuffer and vga clearing the dirty bits vga will miss that update Fix it by using the new memory_region_copy_and_clear_dirty() memory_region_copy_get_dirty() functions. That way we clear the dirty bitmap before reading the framebuffer. Any guest display updates happening in parallel will be properly tracked in the dirty bitmap then and the next display refresh will pick them up. Problem triggers with mttcg only. Before mttcg was merged tcg never ran in parallel to vga emulation. Using kvm will hide the problem too, due to qemu operating on a userspace copy of the kernel's dirty bitmap. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-5-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.1 at 2025-04-02 17:55:47 +0000