aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2022-10-22Drop useless casts from g_malloc() & friends to pointerMarkus Armbruster1-1/+1
These memory allocation functions return void *, and casting to another pointer type is useless clutter. Drop these casts. If you really want another pointer type, consider g_new(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220923120025.448759-3-armbru@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-10-12cirrus_vga: fix potential memory overflowlu zhipeng1-1/+1
Signed-off-by: lu zhipeng <luzhipeng@cestc.cn> Message-Id: <20220929122352.1891-1-luzhipeng@cestc.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-29vhost-user: Call qemu_socketpair() instead of socketpair()Guoyi Tu1-1/+2
As the close-on-exec flags is not set on the file descriptors returned by socketpair() at default, the fds will survive across exec' function. In the case that exec' function get invoked, such as the live-update feature which is been developing, it will cause fd leaks. To address this problem, we should call qemu_socketpair() to create an pair of connected sockets with the close-on-exec flag set. Signed-off-by: Guoyi Tu <tugy@chinatelecom.cn> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <7002b12a5fb0a30cd878e14e07da61c36da72913.1661240709.git.tugy@chinatelecom.cn>
2022-09-27virtio-gpu: update scanout if there is any area covered by the rectDongwon Kim1-3/+4
The scanout is currently updated only if the whole rect is inside the scanout space. This is not a correct condition because the scanout should be updated even a small area in the scanout space is covered by the rect. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220909014052.7297-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638)Philippe Mathieu-Daudé1-3/+3
When building QEMU with DEBUG_ATI defined then running with '-device ati-vga,romfile="" -d unimp,guest_errors -trace ati\*' we get: ati_mm_write 4 0x16c0 DP_CNTL <- 0x1 ati_mm_write 4 0x146c DP_GUI_MASTER_CNTL <- 0x2 ati_mm_write 4 0x16c8 DP_MIX <- 0xff0000 ati_mm_write 4 0x16c4 DP_DATATYPE <- 0x2 ati_mm_write 4 0x224 CRTC_OFFSET <- 0x0 ati_mm_write 4 0x142c DST_PITCH_OFFSET <- 0xfe00000 ati_mm_write 4 0x1420 DST_Y <- 0x3fff ati_mm_write 4 0x1410 DST_HEIGHT <- 0x3fff ati_mm_write 4 0x1588 DST_WIDTH_X <- 0x3fff3fff ati_2d_blt: vram:0x7fff5fa00000 addr:0 ds:0x7fff61273800 stride:2560 bpp:32 rop:0xff ati_2d_blt: 0 0 0, 0 127 0, (0,0) -> (16383,16383) 16383x16383 > ^ ati_2d_blt: pixman_fill(dst:0x7fff5fa00000, stride:254, bpp:8, x:16383, y:16383, w:16383, h:16383, xor:0xff000000) Thread 3 "qemu-system-i38" received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff7f62ce0 in sse2_fill.lto_priv () at /lib64/libpixman-1.so.0 #1 0x00007ffff7f09278 in pixman_fill () at /lib64/libpixman-1.so.0 #2 0x0000555557b5a9af in ati_2d_blt (s=0x631000028800) at hw/display/ati_2d.c:196 #3 0x0000555557b4b5a2 in ati_mm_write (opaque=0x631000028800, addr=5512, data=1073692671, size=4) at hw/display/ati.c:843 #4 0x0000555558b90ec4 in memory_region_write_accessor (mr=0x631000039cc0, addr=5512, ..., size=4, ...) at softmmu/memory.c:492 Commit 584acf34cb0 ("ati-vga: Fix reverse bit blts") introduced the local dst_x and dst_y which adjust the (x, y) coordinates depending on the direction in the SRCCOPY ROP3 operation, but forgot to address the same issue for the PATCOPY, BLACKNESS and WHITENESS operations, which also call pixman_fill(). Fix that now by using the adjusted coordinates in the pixman_fill call, and update the related debug printf(). Reported-by: Qiang Liu <qiangliu@zju.edu.cn> Fixes: 584acf34cb0 ("ati-vga: Fix reverse bit blts") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20210906153103.1661195-1-philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-08-08xlnx_dp: drop unsupported AUXCommand in xlnx_dp_aux_set_commandQiang Liu1-2/+2
In xlnx_dp_aux_set_command, when the command leads to the default branch, xlxn-dp will abort and then crash. This patch removes this abort and drops this operation. Fixes: 58ac482 ("introduce xlnx-dp") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/411 Reported-by: Qiang Liu <cyruscyliu@gmail.com> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Frederic Konrad <fkonrad@amd.com> Message-Id: <20220808080116.2184881-1-cyruscyliu@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-07-28vga: fix incorrect line height in 640x200x2 modePaolo Bonzini1-1/+2
When in CGA modes, QEMU wants to ignore the maximum scan field (bits 0..4) of the maximum scan length register in the CRTC. It is not clear why this is needed---for example, Bochs ignores bit 7 instead. The issue is that the CGA modes are not detected correctly, and in particular mode 6 results in multi_scan==3 according to how SeaBIOS programs it. The right way to check for CGA graphics modes is to check whether bit 13 of the address is special cased by the CRT controller to achieve line interleaving, i.e. whether bit 0 of the CRTC mode control register is clear. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1020 Reported-by: Korneliusz Osmenda <korneliuszo@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-07-26hw/display/bcm2835_fb: Fix framebuffer allocation addressAlan Jian1-2/+1
This patch fixes the dedicated framebuffer mailbox interface by removing an unneeded offset. This means that we pick the framebuffer address in the same way that we do if the guest code uses the buffer allocate mechanism of the bcm2835_property interface (case 0x00040001: /* Allocate buffer */ in bcm2835_property.c). The documentation of this mailbox interface doesn't say anything about using parts of the request buffer address to affect the chosen framebuffer address: https://github.com/raspberrypi/firmware/wiki/Mailbox-framebuffer-interface Some baremetal applications like the Screen01/Screen02 examples from Baking Pi tutorial[1] didn't work before this patch. [1] https://www.cl.cam.ac.uk/projects/raspberrypi/tutorials/os/screen01.html Signed-off-by: Alan Jian <alanjian85@outlook.com> Message-id: 20220725145838.8412-1-alanjian85@outlook.com [PMM: tweaked commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-30hw/i2c: add asynchronous sendKlaus Jensen2-0/+4
Add an asynchronous version of i2c_send() that requires the slave to explicitly acknowledge on the bus with i2c_ack(). The current master must use the new i2c_start_send_async() to indicate that it wants to do an asynchronous transfer. This allows the i2c core to check if the target slave supports this or not. This approach relies on adding a new enum i2c_event member, which is why a bunch of other devices needs changes in their event handling switches. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Message-Id: <20220601210831.67259-5-its@irrelevant.dk> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220630045133.32251-6-me@pjd.dev> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-26artist: set memory region owners for buffers to the artist deviceMark Cave-Ayland1-1/+1
This fixes the output of "info qom-tree" so that the buffers appear as children of the artist device, rather than underneath the "unattached" container. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220624160839.886649-1-mark.cave-ayland@ilande.co.uk> Reviewed-by: Helge Deller <deller@gmx.de>
2022-06-14virtio-gpu: Respect UI refresh rate for EDIDAkihiko Odaki2-0/+2
Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220226115516.59830-4-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14ui: Deliver refresh rate via QemuUIInfoAkihiko Odaki1-3/+11
This change adds a new member, refresh_rate to QemuUIInfo in include/ui/console.h. It represents the refresh rate of the physical display backend, and it is more appropriate than GUI update interval as the refresh rate which the emulated device reports: - sdl may set GUI update interval shorter than the refresh rate of the physical display to respond to user-generated events. - sdl and vnc aggressively changes GUI update interval, but a guests is typically not designed to respond to frequent refresh rate changes, or frequent "display mode" changes in general. The frequency of refresh rate changes of the physical display backend matches better to the guest's expectation. QemuUIInfo also has other members representing "display mode", which makes it suitable for refresh rate representation. It has a throttling of update notifications, and prevents frequent changes of the display mode. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220226115516.59830-3-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14ui/console: Do not return a value with ui_infoAkihiko Odaki2-6/+5
The returned value is not used and misleading. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220226115516.59830-2-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14virtio-gpu: update done only on the scanout associated with rectDongwon Kim1-0/+3
It only needs to update the scanouts containing the rect area coming with the resource-flush request from the guest. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20220505214030.4261-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-08xlnx_dp: Fix the interrupt disable logicSai Pavan Boddu1-1/+1
Fix interrupt disable logic. Mask value 1 indicates that interrupts are disabled. Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Frederic Konrad <fkonrad@amd.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220601172353.3220232-4-fkonrad@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-08xlnx_dp: Introduce a vblank signalSai Pavan Boddu1-4/+26
Add a periodic timer which raises vblank at a frequency of 30Hz. Note that this is a migration compatibility break for the xlnx-zcu102 board type. Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Frederic Konrad <fkonrad@amd.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220601172353.3220232-3-fkonrad@xilinx.com Changes by fkonrad: - Switched to transaction-based ptimer API. - Added the DP_INT_VBLNK_START macro. Signed-off-by: Frederic Konrad <fkonrad@amd.com> [PMM: bump vmstate version, add commit message note about compat break] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-08xlnx_dp: fix the wrong register sizeFrederic Konrad1-7/+10
The core and the vblend registers size are wrong, they should respectively be 0x3B0 and 0x1E0 according to: https://www.xilinx.com/htmldocs/registers/ug1087/ug1087-zynq-ultrascale-registers.html. Let's fix that and use macros when creating the mmio region. Fixes: 58ac482a66d ("introduce xlnx-dp") Signed-off-by: Frederic Konrad <fkonrad@amd.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220601172353.3220232-2-fkonrad@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-06modules: introduces module_kconfig directiveJose R. Ziviani11-0/+11
module_kconfig is a new directive that should be used with module_obj whenever that module depends on the Kconfig to be enabled. When the module is enabled in Kconfig we are sure that its dependencies will be enabled as well, thus the module will be loaded without any problem. The correct way to use module_kconfig is by passing the Kconfig option to module_kconfig (or the *config-devices.mak without CONFIG_). Signed-off-by: Jose R. Ziviani <jziviani@suse.de> Signed-off-by: Dario Faggioli <dfaggioli@suse.com> Message-Id: <165369002370.5857.12150544416563557322.stgit@work> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-18Merge tag 'artist-cursor-fix-final-pull-request' of ↵Richard Henderson1-43/+125
https://github.com/hdeller/qemu-hppa into staging hppa: Artist graphics driver fixes for HP-UX and keyboard fix in firmware boot console This series updates the SeaBIOS-hppa firmware to version 5, in which additional HP fonts were added to the firmware and the firmware boot console was fixed to accept input from the emulated PS/2 keyboard when running in graphical mode (serial console was working before already). To test use the "-boot menu=on" qemu option. The artist graphics card driver got various fixes when running the X11-Windows on HP-UX: - fixes the horizontal and vertical postioning of the X11 cursor with HP-UX - allows X11 to blank the screen (e.g. screensaver) - allows the X11 driver to turn the X11 cursor on/off Signed-off-by: Helge Deller <deller@gmx.de> -- Changes compared to version 2 of this series: - Fixed style issues in the X-cursor positioning patch (noticed by Mark Cave-Ayland) Changes compared to version 1 of this series: - Added some Acked-by's from Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> - SeaBIOS-hppa v5 instead of v4 (PS/2 keyboard now works in boot console) - integrated artist X11 X-cusor positioning fix (which was sent serperately before) -- This series should apply cleanly on git head and can be pulled for testing from: https://github.com/hdeller/qemu-hppa.git artist-cursor-fix-final # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCYoUcLwAKCRD3ErUQojoP # X/joAQCmuV5MD+BTWf91fRTfzXSfOYSp1XahTaItUldKG2ZBWQD+Lflhsoyg4xLd # 2daeDRN1tH2HWldjnCPyMyZ5Ag97PwY= # =ZrTm # -----END PGP SIGNATURE----- # gpg: Signature made Wed 18 May 2022 09:17:51 AM PDT # gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F # gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown] # gpg: aka "Helge Deller <deller@kernel.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603 # Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F * tag 'artist-cursor-fix-final-pull-request' of https://github.com/hdeller/qemu-hppa: artist: Fix X cursor position calculation in X11 artist: Emulate screen blanking artist: Allow to turn cursor on or off artist: Fix vertical X11 cursor position in HP-UX artist: Use human-readable variable names instead of reg_xxx artist: Introduce constant for max cursor size seabios-hppa: Update SeaBIOS-hppa to VERSION 5 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-05-16artist: Fix X cursor position calculation in X11Helge Deller1-16/+22
The X cursor postion can be calculated based on the backporch and interleave values. In the emulation we ignore the HP-UX settings for backporch and use instead twice the size of the emulated cursor. With those changes the X-position of the graphics cursor is now finally working correctly on HP-UX 10 and HP-UX 11. Based on coding in Xorg X11R6.6 Signed-off-by: Helge Deller <deller@gmx.de>
2022-05-16artist: Emulate screen blankingHelge Deller1-0/+30
The misc_video and misc_ctrl registers control the visibility of the screen. Start with the screen turned on, and hide or show the screen based on the control registers. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Allow to turn cursor on or offHelge Deller1-0/+14
Bit 0x80 in the cursor_cntrl register specifies if the cursor should be visible. Prevent rendering the cursor if it's invisible. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Fix vertical X11 cursor position in HP-UXHelge Deller1-5/+9
Drop the hard-coded value of 1146 lines which seems to work with HP-UX 11, but not with HP-UX 10. Instead encode the screen height in byte 0 of active_lines_low and byte 3 of misc_video as it's expected by the Xorg X11 graphics driver. This potentially allows for higher vertical screen resolutions than 1280x1024 with X11. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Use human-readable variable names instead of reg_xxxHelge Deller1-23/+49
Convert the variable names of some registers to human-readable and understandable names. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Introduce constant for max cursor sizeHelge Deller1-4/+6
Add the constant NGLE_MAX_SPRITE_SIZE which defines the currently maximum supported cursor size. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16virtio: add vhost support for virtio devicesJonah Palmer1-0/+7
This patch adds a get_vhost() callback function for VirtIODevices that returns the device's corresponding vhost_dev structure, if the vhost device is running. This patch also adds a vhost_started flag for VirtIODevices. Previously, a VirtIODevice wouldn't be able to tell if its corresponding vhost device was active or not. Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <1648819405-25696-3-git-send-email-jonah.palmer@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-05-16virtio: drop name parameter for virtio_init()Jonah Palmer1-1/+1
This patch drops the name parameter for the virtio_init function. The pair between the numeric device ID and the string device ID (name) of a virtio device already exists, but not in a way that lets us map between them. This patch lets us do this and removes the need for the name parameter in the virtio_init function. Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <1648819405-25696-2-git-send-email-jonah.palmer@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-05-08artist: only render dirty scanlines on the display surfaceMark Cave-Ayland1-1/+3
The framebuffer_update_display() function returns the dirty scanlines that were touched since the last display update, however artist_update_display() always calls dpy_gfx_update() with start and end scanlines of 0 and s->height causing the entire display surface to be rendered on every update. Update artist_update_display() so that dpy_gfx_update() only renders the dirty scanlines on the display surface, bypassing the display surface rendering completely if framebuffer_update_display() indicates no changes occurred. This noticeably improves boot performance when the framebuffer is enabled on my rather modest laptop here, including making the GTK UI usable. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220504153708.10352-4-mark.cave-ayland@ilande.co.uk> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-08artist: remove unused ROP8OFF() macroMark Cave-Ayland1-6/+0
This macro is unused and so can simply be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220504153708.10352-3-mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-08artist: checkpatch and newline style fixesMark Cave-Ayland1-12/+11
Ensure that subsequent patches do not cause checkpatch to fail and also tidy up extra/missing newlines. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220504153708.10352-2-mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-04-22hw/display/vmware_vga: do not discard screen updatesCarwyn Ellis2-18/+24
In certain circumstances, typically when there is lots changing on the screen, updates will be discarded resulting in garbled output. This change simplifies the traversal of the display update FIFO queue when applying updates. We just track the queue length and iterate up to the end of the queue. Additionally when adding updates to the queue, if the buffer reaches capacity we force a flush before accepting further events. Signed-off-by: Carwyn Ellis <carwynellis@gmail.com> Message-Id: <20220206183956.10694-3-carwynellis@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-19Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson9-20/+16
* Add cpu0-id to query-sev-capabilities * whpx support for breakpoints and stepping * initial support for Hyper-V Synthetic Debugging * use monotonic clock for QemuCond and QemuSemaphore * Remove qemu-common.h include from most units and lots of other clenaups * do not include headers for all virtio devices in virtio-ccw.h # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmJXCQAUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNT6wf+NHDJUEdDiwaVGVTGXgHuiaycsymi # FpNPiw/+XxSGN5xF3fkUGgqaDrcwIYwVfnXlghKSz8kp1cP3cjxa5CzNMLGTp5je # N6BxFbD7yC6dhagGm3mj32jlsptv3M38OHqKc3t+RaUAotP5RF2VdCyfUBLG6vU0 # aMzvMfMtB5aG0D8Fr5EV63t1JMTceFU0YxsG73UCFs2Yx4Z0cGBbNxMbHweRhd1q # tPeVDS46MFPM3/2cGGHpeeqxkoCTU7A9j1VuNQI3k+Kg+6W5YVxiK/UP7bw77E/a # yAHsmIVTNro8ajMBch73weuHtGtdfFLvCKc6QX6aVjzK4dF1voQ01E7gPQ== # =rMle # -----END PGP SIGNATURE----- # gpg: Signature made Wed 13 Apr 2022 10:31:44 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (53 commits) target/i386: Remove unused XMMReg, YMMReg types and CPUState fields target/i386: do not access beyond the low 128 bits of SSE registers virtio-ccw: do not include headers for all virtio devices virtio-ccw: move device type declarations to .c files virtio-ccw: move vhost_ccw_scsi to a separate file s390x: follow qdev tree to detect SCSI device on a CCW bus hw: hyperv: Initial commit for Synthetic Debugging device hyperv: Add support to process syndbg commands hyperv: Add definitions for syndbg hyperv: SControl is optional to enable SynIc thread-posix: optimize qemu_sem_timedwait with zero timeout thread-posix: implement Semaphore with QemuCond and QemuMutex thread-posix: use monotonic clock for QemuCond and QemuSemaphore thread-posix: remove the posix semaphore support whpx: Added support for breakpoints and stepping build-sys: simplify AF_VSOCK check build-sys: drop ntddscsi.h check Remove qemu-common.h include from most units qga: remove explicit environ argument from exec/spawn Move fcntl_setfl() to oslib-posix ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-07ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)Mauro Matteo Cascella2-0/+9
Prevent potential integer overflow by limiting 'width' and 'height' to 512x512. Also change 'datasize' type to size_t. Refer to security advisory https://starlabs.sg/advisories/22-4206/ for more information. Fixes: CVE-2021-4206 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081712.345609-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-07display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)Mauro Matteo Cascella1-1/+1
Avoid fetching 'width' and 'height' a second time to prevent possible race condition. Refer to security advisory https://starlabs.sg/advisories/22-4207/ for more information. Fixes: CVE-2021-4207 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081106.343235-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-06Remove qemu-common.h include from most unitsMarc-André Lureau4-4/+0
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220323155743.1585078-33-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-06Replace qemu_real_host_page variables with inlined functionsMarc-André Lureau1-1/+1
Replace the global variables with inlined helper functions. getpagesize() is very likely annotated with a "const" function attribute (at least with glibc), and thus optimization should apply even better. This avoids the need for a constructor initialization too. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220323155743.1585078-12-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-06Replace TARGET_WORDS_BIGENDIANMarc-André Lureau1-1/+1
Convert the TARGET_WORDS_BIGENDIAN macro, similarly to what was done with HOST_BIG_ENDIAN. The new TARGET_BIG_ENDIAN macro is either 0 or 1, and thus should always be defined to prevent misuse. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Suggested-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220323155743.1585078-8-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-06Replace config-time define HOST_WORDS_BIGENDIANMarc-André Lureau5-14/+14
Replace a config-time define with a compile time condition define (compatible with clang and gcc) that must be declared prior to its usage. This avoids having a global configure time define, but also prevents from bad usage, if the config header wasn't included before. This can help to make some code independent from qemu too. gcc supports __BYTE_ORDER__ from about 4.6 and clang from 3.2. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> [ For the s390x parts I'm involved in ] Acked-by: Halil Pasic <pasic@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220323155743.1585078-7-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-03-22Replace GCC_FMT_ATTR with G_GNUC_PRINTFMarc-André Lureau1-1/+1
One less qemu-specific macro. It also helps to make some headers/units only depend on glib, and thus moved in standalone projects eventually. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
2022-03-21Use g_new() & friends where that makes obvious senseMarkus Armbruster4-6/+6
g_new(T, n) is neater than g_malloc(sizeof(T) * n). It's also safer, for two reasons. One, it catches multiplication overflowing size_t. Two, it returns T * rather than void *, which lets the compiler catch more type errors. This commit only touches allocations with size arguments of the form sizeof(T). Patch created mechanically with: $ spatch --in-place --sp-file scripts/coccinelle/use-g_new-etc.cocci \ --macro-file scripts/cocci-macro-file.h FILES... Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20220315144156.1595462-4-armbru@redhat.com> Reviewed-by: Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
2022-03-18hw/display/vga: Report a proper error when adding a 2nd ISA VGAThomas Huth1-0/+6
QEMU currently abort()s if the user tries to add a second ISA VGA device, for example: $ ./qemu-system-x86_64 -device isa-vga -device isa-vga RAMBlock "vga.vram" already registered, abort! Aborted (core dumped) $ ./qemu-system-x86_64 -device isa-cirrus-vga -device isa-cirrus-vga RAMBlock "vga.vram" already registered, abort! Aborted (core dumped) $ ./qemu-system-mips64el -M pica61 -device isa-vga RAMBlock "vga.vram" already registered, abort! Aborted (core dumped) Such a crash should never happen just because of giving bad parameters at the command line. Let's return a proper error message instead. (The idea is based on an original patch by Jose R. Ziviani for the isa-vga device, but this now fixes it for the isa-cirrus-vga device, too) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/44 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220317083027.16688-4-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-18hw/display: Allow vga_common_init() to return errorsThomas Huth11-13/+42
The vga_common_init() function currently cannot report errors to its caller. But in the following patch, we'd need this possibility, so let's change it to take an "Error **" as parameter for this. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220317083027.16688-3-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-18hw/display/cirrus_vga: Clean up indentation in pci_cirrus_vga_realize()Thomas Huth1-28/+29
Most of the code in this function had been indented with 5 spaces instead of 4. Since 4 is our preferred style, remove one space in the bad lines here. Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <20220317083027.16688-2-thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-09macfb: set initial value of mode control registers in macfb_common_realize()Mark Cave-Ayland1-0/+8
If booting Linux directly in the q800 machine using -kernel rather than using a MacOS toolbox ROM, the mode control registers are never initialised, causing macfb_mode_write() to fail to determine the current resolution after migration. Resolve this by always setting the initial values of the mode control registers based upon the initial macfb properties during realize. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220305155530.9265-6-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-03-09macfb: add VMStateDescription fields for display type and VBL timerMark Cave-Ayland1-0/+2
These fields are required in the migration stream to restore macfb state correctly. Note this is a migration break, but since there are upcoming incompatible changes for the q800 machine (and migration does not even succeed without these patches) then this is not an issue. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220305155530.9265-5-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-03-09macfb: increase number of registers saved in MacfbStateMark Cave-Ayland1-0/+8
The MacOS toolbox ROM accesses a number of addresses between 0x0 and 0x200 during initialisation and resolution changes. Whilst the function of many of these registers is unknown, it is worth the minimal cost of saving these extra values as part of migration to help future-proof the migration stream for the q800 machine as it starts to stabilise. Note this is a migration break, but since there are upcoming incompatible changes for the q800 machine (and migration does not even succeed without these patches) then this is not an issue. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220305155530.9265-4-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-03-09macfb: don't use special irq_state and irq_mask variables in MacfbStateMark Cave-Ayland1-8/+7
The current IRQ state and IRQ mask are handled exactly the same as standard register accesses, so store these values directly in the regs array rather than having separate variables for them. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220305155530.9265-3-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-03-09macfb: add VMStateDescription for MacfbNubusState and MacfbSysBusStateMark Cave-Ayland1-2/+22
Currently when QEMU tries to migrate the macfb framebuffer it crashes randomly because the opaque provided by the DeviceClass vmsd property for both devices is set to MacfbState rather than MacfbNubusState or MacfbSysBusState as appropriate. Resolve the issue by adding new VMStateDescriptions for MacfbNubusState and MacfbSysBusState which embed the existing vmstate_macfb VMStateDescription within them using VMSTATE_STRUCT. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220305155530.9265-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-03-04hw/display/vmware_vga: replace fprintf calls with trace eventsCarwyn Ellis2-12/+21
Debug output was always being sent to STDERR. This has been replaced with trace events. Signed-off-by: Carwyn Ellis <carwynellis@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220206183956.10694-2-carwynellis@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-03-04edid: Fix clock of Detailed Timing DescriptorAkihiko Odaki1-34/+32
The clock field is 16-bits in EDID Detailed Timing Descriptor, but edid_desc_timing assumed it is 32-bit. Write the 16-bit value if it fits in 16-bit. Write DisplayID otherwise. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220213021529.2248-1-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.1 at 2025-01-13 18:11:23 +0000