aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2020-05-28hw/display/omap_dss: Replace fprintf() call by qemu_log_mask(LOG_UNIMP)Philippe Mathieu-Daudé1-1/+1
Replace fprintf() call by qemu_log_mask(LOG_UNIMP), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-14-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/exynos4210_fimd: Use qemu_log_mask(GUEST_ERROR)Philippe Mathieu-Daudé1-17/+29
Replace DPRINT_ERROR() by qemu_log_mask(GUEST_ERROR). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-13-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/vmware_vga: Let the PCI device own its I/O MemoryRegionPhilippe Mathieu-Daudé1-1/+1
To avoid the orphan I/O memory region being added in the /unattached QOM container, register the PCI device as its owner. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200526062252.19852-12-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/vmware_vga: Replace printf() calls by qemu_log_mask(ERROR)Philippe Mathieu-Daudé1-5/+11
Avoid flooding stdio by converting printf() calls to qemu_log_mask(GUEST_ERROR), which are disabled by default. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-11-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/xlnx_dp: Replace disabled DPRINTF() by error_report()Philippe Mathieu-Daudé1-6/+8
DPRINTF() calls are disabled by default, so when unexpected data is used, the whole process abort without information. Display a bit of information with error_report() before crashing. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-10-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/dpcd: Convert debug printf()s to trace eventsPhilippe Mathieu-Daudé2-13/+7
Convert DPRINTF() to trace events and remove ifdef'ry. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-9-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/dpcd: Fix memory region sizePhilippe Mathieu-Daudé1-2/+2
The memory region size is 512K. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-8-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Convert debug printf() to trace eventPhilippe Mathieu-Daudé2-14/+11
Convert the final bit of DEBUG_BITBLT to a tracepoint. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-7-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Use qemu_log_mask(ERROR) instead of debug printfPhilippe Mathieu-Daudé1-44/+33
Replace some debug printf() calls by qemu_log_mask(LOG_GUEST_ERROR). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-6-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Use qemu_log_mask(UNIMP) instead of debug printfPhilippe Mathieu-Daudé1-6/+8
Replace some debug printf() calls by qemu_log_mask(LOG_UNIMP), and add a new one in cirrus_linear_bitblt_read(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-5-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Convert debug printf() to trace eventPhilippe Mathieu-Daudé2-3/+2
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-4-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cg3: Convert debug printf()s to trace eventsPhilippe Mathieu-Daudé2-10/+8
Convert DPRINTF() to trace events and remove ifdef'ry. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-3-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-21hw/arm/pxa2xx: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé1-3/+5
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200518140309.5220-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-18ramfb: fix size calculationGerd Hoffmann1-9/+10
size calculation isn't correct with guest-supplied stride, the last display line isn't accounted for correctly. For the typical case of stride > linesize (add padding) we error on the safe side (calculated size is larger than actual size). With stride < linesize (scanlines overlap) the calculated size is smaller than the actual size though so our guest memory mapping might end up being too small. While being at it also fix ramfb_create_display_surface to use hwaddr for the parameters. That way all calculation are done with hwaddr type and we can't get funny effects from type castings. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-7-kraxel@redhat.com
2020-05-18ramfb: add sanity checks to ramfb_create_display_surfaceGerd Hoffmann1-0/+6
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-6-kraxel@redhat.com
2020-05-18ramfb: don't update RAMFBState on errorsGerd Hoffmann1-9/+17
Store width & height & surface in local variables. Update RAMFBState with the new values only in case the ramfb_create_display_surface() call succeeds. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-5-kraxel@redhat.com
2020-05-18ramfb: drop leftover debug messageGerd Hoffmann1-2/+0
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-4-kraxel@redhat.com
2020-05-18Revert "hw/display/ramfb: lock guest resolution after it's set"Gerd Hoffmann1-22/+4
This reverts commit a9e0cb67b7f4c485755659f9b764c38b5f970de4. This breaks OVMF. Reproducer: Just hit 'ESC' at early boot to enter firmware setup. OVMF wants switch from (default) 800x600 to 640x480 for that, and this patch blocks it. Cc: Hou Qiming <hqm03ster@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-3-kraxel@redhat.com
2020-05-18Revert "hw/display/ramfb: initialize fw-config space with xres/ yres"Gerd Hoffmann2-26/+2
This reverts commit f79081b4b71b72640bedd40a7cd76f864c8287f1. Patch has broken byteorder handling: RAMFBCfg fields are in bigendian byteorder, the reset function doesn't care so native byteorder is used instead. Given this went unnoticed so far the feature is obviously unused, so just revert the patch. Cc: Hou Qiming <hqm03ster@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-2-kraxel@redhat.com
2020-05-18hw/display: Include local 'framebuffer.h'Philippe Mathieu-Daudé2-2/+2
The "framebuffer.h" header is not an exported include. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <huth@tuxfamily.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200504082003.16298-2-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-18ati-vga: Do not allow unaligned access via index registerBALATON Zoltan1-1/+1
According to docs bits 1 and 0 of MM_INDEX are hard coded to 0 so unaligned access via this register should not be possible. This also fixes problems reported in bug #1878134. Buglink: https://bugs.launchpad.net/qemu/+bug/1878134 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Alexander Bulekov <alxndr@bu.edu> Acked-by: Alexander Bulekov <alxndr@bu.edu> Message-id: 20200516132352.39E9374594E@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-15hw: Remove unnecessary DEVICE() castPhilippe Mathieu-Daudé5-6/+6
The DEVICE() macro is defined as: #define DEVICE(obj) OBJECT_CHECK(DeviceState, (obj), TYPE_DEVICE) which expands to: ((DeviceState *)object_dynamic_cast_assert((Object *)(obj), (name), __FILE__, __LINE__, __func__)) This assertion can only fail when @obj points to something other than its stated type, i.e. when we're in undefined behavior country. Remove the unnecessary DEVICE() casts when we already know the pointer is of DeviceState type. Patch created mechanically using spatch with this script: @@ typedef DeviceState; DeviceState *s; @@ - DEVICE(s) + s Acked-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Paul Durrant <paul@xen.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: John Snow <jsnow@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200512070020.22782-4-f4bug@amsat.org>
2020-05-15qdev: Unrealize must not failMarkus Armbruster1-1/+1
Devices may have component devices and buses. Device realization may fail. Realization is recursive: a device's realize() method realizes its components, and device_set_realized() realizes its buses (which should in turn realize the devices on that bus, except bus_set_realized() doesn't implement that, yet). When realization of a component or bus fails, we need to roll back: unrealize everything we realized so far. If any of these unrealizes failed, the device would be left in an inconsistent state. Must not happen. device_set_realized() lets it happen: it ignores errors in the roll back code starting at label child_realize_fail. Since realization is recursive, unrealization must be recursive, too. But how could a partly failed unrealize be rolled back? We'd have to re-realize, which can fail. This design is fundamentally broken. device_set_realized() does not roll back at all. Instead, it keeps unrealizing, ignoring further errors. It can screw up even for a device with no buses: if the lone dc->unrealize() fails, it still unregisters vmstate, and calls listeners' unrealize() callback. bus_set_realized() does not roll back either. Instead, it stops unrealizing. Fortunately, no unrealize method can fail, as we'll see below. To fix the design error, drop parameter @errp from all the unrealize methods. Any unrealize method that uses @errp now needs an update. This leads us to unrealize() methods that can fail. Merely passing it to another unrealize method cannot cause failure, though. Here are the ones that do other things with @errp: * virtio_serial_device_unrealize() Fails when qbus_set_hotplug_handler() fails, but still does all the other work. On failure, the device would stay realized with its resources completely gone. Oops. Can't happen, because qbus_set_hotplug_handler() can't actually fail here. Pass &error_abort to qbus_set_hotplug_handler() instead. * hw/ppc/spapr_drc.c's unrealize() Fails when object_property_del() fails, but all the other work is already done. On failure, the device would stay realized with its vmstate registration gone. Oops. Can't happen, because object_property_del() can't actually fail here. Pass &error_abort to object_property_del() instead. * spapr_phb_unrealize() Fails and bails out when remove_drcs() fails, but other work is already done. On failure, the device would stay realized with some of its resources gone. Oops. remove_drcs() fails only when chassis_from_bus()'s object_property_get_uint() fails, and it can't here. Pass &error_abort to remove_drcs() instead. Therefore, no unrealize method can fail before this patch. device_set_realized()'s recursive unrealization via bus uses object_property_set_bool(). Can't drop @errp there, so pass &error_abort. We similarly unrealize with object_property_set_bool() elsewhere, always ignoring errors. Pass &error_abort instead. Several unrealize methods no longer handle errors from other unrealize methods: virtio_9p_device_unrealize(), virtio_input_device_unrealize(), scsi_qdev_unrealize(), ... Much of the deleted error handling looks wrong anyway. One unrealize methods no longer ignore such errors: usb_ehci_pci_exit(). Several realize methods no longer ignore errors when rolling back: v9fs_device_realize_common(), pci_qdev_unrealize(), spapr_phb_realize(), usb_qdev_realize(), vfio_ccw_realize(), virtio_device_realize(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-17-armbru@redhat.com>
2020-05-15qom: Drop parameter @errp of object_property_add() & friendsMarkus Armbruster7-14/+10
The only way object_property_add() can fail is when a property with the same name already exists. Since our property names are all hardcoded, failure is a programming error, and the appropriate way to handle it is passing &error_abort. Same for its variants, except for object_property_add_child(), which additionally fails when the child already has a parent. Parentage is also under program control, so this is a programming error, too. We have a bit over 500 callers. Almost half of them pass &error_abort, slightly fewer ignore errors, one test case handles errors, and the remaining few callers pass them to their own callers. The previous few commits demonstrated once again that ignoring programming errors is a bad idea. Of the few ones that pass on errors, several violate the Error API. The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. ich9_pm_add_properties(), sparc32_ledma_realize(), sparc32_dma_realize(), xilinx_axidma_realize(), xilinx_enet_realize() are wrong that way. When the one appropriate choice of argument is &error_abort, letting users pick the argument is a bad idea. Drop parameter @errp and assert the preconditions instead. There's one exception to "duplicate property name is a programming error": the way object_property_add() implements the magic (and undocumented) "automatic arrayification". Don't drop @errp there. Instead, rename object_property_add() to object_property_try_add(), and add the obvious wrapper object_property_add(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-15-armbru@redhat.com> [Two semantic rebase conflicts resolved]
2020-05-05Merge remote-tracking branch ↵Peter Maydell2-9/+5
'remotes/vivier2/tags/trivial-branch-for-5.1-pull-request' into staging trivial patches (20200504) Silent static analyzer warning Remove dead assignments Support -chardev serial on macOS Update MAINTAINERS Some cosmetic changes # gpg: Signature made Mon 04 May 2020 16:45:18 BST # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-for-5.1-pull-request: hw/timer/pxa2xx_timer: Add assertion to silent static analyzer warning hw/timer/stm32f2xx_timer: Remove dead assignment hw/gpio/aspeed_gpio: Remove dead assignment hw/isa/i82378: Remove dead assignment hw/ide/sii3112: Remove dead assignment hw/input/adb-kbd: Remove dead assignment hw/i2c/pm_smbus: Remove dead assignment blockdev: Remove dead assignment block: Avoid dead assignment Compress lines for immediate return chardev: Add macOS to list of OSes that support -chardev serial MAINTAINERS: Update Keith Busch's email address elf_ops: Don't try to g_mapped_file_unref(NULL) hw/mem/pc-dimm: Fix line over 80 characters warning hw/mem/pc-dimm: Print slot number on error at pc_dimm_pre_plug() MAINTAINERS: Mark the LatticeMico32 target as orphan timer/exynos4210_mct: Remove redundant statement in exynos4210_mct_write() display/blizzard: use extract16() for fix clang analyzer warning in blizzard_draw_line16_32() scsi/esp-pci: add g_assert() for fix clang analyzer warning in esp_pci_io_write() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-04Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell1-23/+20
staging Pull request v2: * Fixed stray slirp submodule change [Peter] Fixes for the lock guard macros, code conversions to the lock guard macros, and support for selecting fuzzer targets with argv[0]. # gpg: Signature made Mon 04 May 2020 16:11:11 BST # gpg: using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full] # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" [full] # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/block-pull-request: lockable: Replace locks with lock guard macros lockable: replaced locks with lock guard macros where appropriate lockable: fix __COUNTER__ macro to be referenced properly fuzz: select fuzz target using executable name Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-04lockable: replaced locks with lock guard macros where appropriateDaniel Brodsky1-23/+20
- ran regexp "qemu_mutex_lock\(.*\).*\n.*if" to find targets - replaced result with QEMU_LOCK_GUARD if all unlocks at function end - replaced result with WITH_QEMU_LOCK_GUARD if unlock not at end Signed-off-by: Daniel Brodsky <dnbrdsky@gmail.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-id: 20200404042108.389635-3-dnbrdsky@gmail.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-05-04virtio-vga: fix virtio-vga bar orderingAnthoine Bourgeois1-0/+1
With virtio-vga, pci bar are reordered. Bar #2 is used for compatibility with stdvga. By default, bar #2 is used by virtio modern io bar. This bar is the last one introduce in the virtio pci bar layout and it's crushed by the virtio-vga reordering. So virtio-vga and modern-pio-notify are incompatible because virtio-vga failed to initialize with this option. This fix sets the modern io bar to the bar #5 to avoid conflict. Signed-off-by: Anthoine Bourgeois <anthoine.bourgeois@gmail.com> Message-Id: <20200422215455.10244-1-anthoine.bourgeois@gmail.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-04Compress lines for immediate returnSimran Singhal1-3/+1
Compress two lines into a single line if immediate return statement is found. It also remove variables progress, val, data, ret and sock as they are no longer needed. Remove space between function "mixer_load" and '(' to fix the checkpatch.pl error:- ERROR: space prohibited between function name and open parenthesis '(' Done using following coccinelle script: @@ local idexpression ret; expression e; @@ -ret = +return e; -return ret; Signed-off-by: Simran Singhal <singhalsimran0@gmail.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200401165314.GA3213@simran-Inspiron-5558> [lv: in handle_aiocb_write_zeroes_unmap() move "int ret" inside the #ifdef] Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-05-04display/blizzard: use extract16() for fix clang analyzer warning in ↵Chen Qun1-6/+4
blizzard_draw_line16_32() Clang static code analyzer show warning: hw/display/blizzard.c:940:9: warning: Value stored to 'data' is never read data >>= 5; ^ ~ Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20200325025919.21316-3-kuhn.chenqun@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-04-29bochs-display: Fix vgamem=SIZE error handlingMarkus Armbruster1-2/+4
bochs_display_realize() rejects out-of-range vgamem. The error handling is broken: $ qemu-system-x86_64 -S -display none -monitor stdio QEMU 4.2.93 monitor - type 'help' for more information (qemu) device_add bochs-display,vgamem=1 Error: bochs-display: video memory too small (qemu) device_add bochs-display,vgamem=1 RAMBlock "0000:00:04.0/bochs-display-vram" already registered, abort! Aborted (core dumped) Cause: bochs_display_realize() neglects to bail out after setting the error. Fix that. Fixes: 765c94290863eef1fc4a67819d452cc13b7854a1 Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200422130719.28225-8-armbru@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2020-04-07ati-vga: Fix checks in ati_2d_blt() to avoid crashBALATON Zoltan1-11/+26
In some corner cases (that never happen during normal operation but a malicious guest could program wrong values) pixman functions were called with parameters that result in a crash. Fix this and add more checks to disallow such cases. Reported-by: Ziming Zhang <ezrakiez@gmail.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-03-23hw/arm/bcm283x: Correct the license textPhilippe Mathieu-Daudé1-1/+0
The license is the 'GNU General Public License v2.0 or later', not 'and': This program is free software; you can redistribute it and/ori modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. Fix the license comment. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200312213455.15854-1-philmd@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-17hw/display: Let devices own the MemoryRegion they createPhilippe Mathieu-Daudé2-3/+4
Avoid orphan memory regions being added in the /unattached QOM container. This commit was produced with the Coccinelle script scripts/coccinelle/memory-region-housekeeping.cocci. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-03-17hw/display: Use memory_region_init_rom() with read-only regionsPhilippe Mathieu-Daudé2-6/+4
This commit was produced with the Coccinelle script scripts/coccinelle/memory-region-housekeeping.cocci. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-03-16stdvga+bochs-display: add dummy mmio handlerGerd Hoffmann2-6/+6
The bochs-display mmio bar has some sub-regions with the actual hardware registers. What happens when the guest access something outside those regions depends on the archirecture. On x86 those reads succeed (and return 0xff I think). On risc-v qemu aborts. This patch adds handlers for the parent region, to make the wanted behavior explicit and to make things consistent across architectures. v2: - use existing unassigned_io_ops. - also cover stdvga. Cc: Alistair Francis <alistair23@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20200309100009.17624-1-kraxel@redhat.com
2020-03-09display/exynos4210_fimd: Remove redundant statement in exynos4210_fimd_update()Chen Qun1-1/+0
Clang static code analyzer show warning: hw/display/exynos4210_fimd.c:1313:17: warning: Value stored to 'is_dirty' is never read is_dirty = false; Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20200302130715.29440-9-kuhn.chenqun@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-03-09display/pxa2xx_lcd: Remove redundant statement in pxa2xx_palette_parse()Chen Qun1-1/+0
Clang static code analyzer show warning: hw/display/pxa2xx_lcd.c:596:9: warning: Value stored to 'format' is never read format = 0; ^ ~ Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20200302130715.29440-8-kuhn.chenqun@huawei.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2020-03-02qxl: map rom r/oGerd Hoffmann1-1/+1
Map qxl rom read-only into the guest, so the guest can't tamper with the content. qxl has a shadow copy of the rom to deal with that, but the shadow doesn't cover the mode list. A privilidged user in the guest can manipulate the mode list and that to trick qemu into oob reads, leading to a DoS via segfault if that read access happens to hit unmapped memory. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200225055920.17261-2-kraxel@redhat.com
2020-03-02Arithmetic error in EDID generation fixedAnton V. Boyarshinov1-2/+2
To calculate screen size in centimeters we should calculate: pixels/dpi*2.54 but not pixels*dpi/2540 Using wrong formula we actually get 65 DPI and very small fonts. Signed-off-by: Anton V. Boyarshinov <boyarsh@altlinux.org> Message-id: 20200226122054.366b9cda@table.localdomain Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-02-25Merge branch 'exec_rw_const_v4' of https://github.com/philmd/qemu into HEADPaolo Bonzini5-12/+13
2020-02-20Merge remote-tracking branch ↵Peter Maydell1-1/+1
'remotes/vivier2/tags/trivial-branch-pull-request' into staging Fix memory leak with fdt cosmetic change in code and logs update mailmap # gpg: Signature made Wed 19 Feb 2020 10:15:56 GMT # gpg: using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C # gpg: issuer "laurent@vivier.eu" # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full] # gpg: aka "Laurent Vivier <laurent@vivier.eu>" [full] # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" [full] # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier2/tags/trivial-branch-pull-request: hw/xtensa/xtfpga:fix leak of fdevice tree blob hw/nios2:fix leak of fdevice tree blob hw/net/rocker: Report unimplemented feature with qemu_log_mask(UNIMP) hw/block/pflash_cfi02: Remove unneeded variable assignment hw/display/qxl: Remove unneeded variable assignment contrib/rdmacm-mux: Remove superfluous semicolon tests/qtest/libqos/qgraph: Remove superfluous semicolons target/i386/whpx: Remove superfluous semicolon ui/input-barrier: Remove superfluous semicolon hw/vfio/display: Remove superfluous semicolon hw/scsi/esp: Remove superfluous semicolon hw/m68k/next-cube: Remove superfluous semicolon hw/arm/xlnx-versal: Remove superfluous semicolon audio/alsaaudio: Remove superfluous semicolons scripts/checkpatch.pl: Detect superfluous semicolon in C code Report stringified errno in VFIO related errors mailmap: Add entry for Yu-Chen Lin Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-02-20Let cpu_[physical]_memory() calls pass a boolean 'is_write' argumentPhilippe Mathieu-Daudé4-7/+8
Use an explicit boolean type. This commit was produced with the included Coccinelle script scripts/coccinelle/exec_rw_const. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-02-20Remove unnecessary cast when using the cpu_[physical]_memory APIPhilippe Mathieu-Daudé1-5/+5
This commit was produced with the included Coccinelle script scripts/coccinelle/exec_rw_const. Suggested-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-02-18hw/display/artist: Remove dead code (CID 1419388 & 1419389)Philippe Mathieu-Daudé1-9/+0
Coverity reports: *** CID 1419388: Control flow issues (DEADCODE) /hw/display/artist.c: 739 in draw_line_xy() 733 if (endy < 0) { 734 endy = 0; 735 } 736 737 738 if (endx < 0) { >>> CID 1419388: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return;". 739 return; 740 } 741 742 if (endy < 0) { 743 return; 744 } *** CID 1419389: Control flow issues (DEADCODE) /hw/display/artist.c: 743 in draw_line_xy() 737 738 if (endx < 0) { 739 return; 740 } 741 742 if (endy < 0) { >>> CID 1419389: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return;". 743 return; 744 } 745 746 trace_artist_draw_line(startx, starty, endx, endy); 747 draw_line(s, startx, starty, endx, endy, false, -1, -1); 748 } Fixes: Covertiy CID 1419388 and 1419389 (commit 4765384ce33) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Sven Schnelle <svens@stackframe.org> Message-Id: <20200214001303.12873-6-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2020-02-18hw/display/artist: Avoid drawing line when nothing to displayPhilippe Mathieu-Daudé1-0/+3
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200214001303.12873-5-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2020-02-18hw/display/artist: Delay some variables initializationPhilippe Mathieu-Daudé1-5/+5
We want to have an early exit path. Delay some initializations before the variables are used. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Sven Schnelle <svens@stackframe.org> Message-Id: <20200214001303.12873-4-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2020-02-18hw/display/artist: Remove pointless initializationPhilippe Mathieu-Daudé1-1/+0
We are initializating incy inconditionally: if (y1 <= y2) { incy = 1; } else { incy = -1; } Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Sven Schnelle <svens@stackframe.org> Message-Id: <20200214001303.12873-3-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2020-02-18hw/display/artist: Move trace event to draw_line()Philippe Mathieu-Daudé1-5/+1
Instead of emitting the trace event before each call to draw_line(), call it once at draw_line() entrance. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Sven Schnelle <svens@stackframe.org> Message-Id: <20200214001303.12873-2-f4bug@amsat.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2020-02-18hw/display/qxl: Remove unneeded variable assignmentPhilippe Mathieu-Daudé1-1/+1
Fix warning reported by Clang static code analyzer: hw/display/qxl.c:1634:14: warning: Value stored to 'orig_io_port' during its initialization is never read uint32_t orig_io_port = io_port; ^~~~~~~~~~~~ ~~~~~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200215161557.4077-3-philmd@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
generated by cgit v1.1 at 2025-01-15 19:29:33 +0000