aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2024-10-14ui: refactor using a common qemu_pixman_shareableMarc-André Lureau1-53/+19
Use a common shareable type for win32 & unix, and helper functions. This simplify the code as it avoids a lot of #ifdef'ery. Note: if it helps review, commits could be reordered to introduce the common type before introducing shareable memory for unix. Suggested-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20241008125028.1177932-19-marcandre.lureau@redhat.com>
2024-10-14virtio-gpu: allocate shareable 2d resources on !win32Marc-André Lureau1-12/+27
Similar to what was done in commit 9462ff46 ("virtio-gpu/win32: allocate shareable 2d resources/images") for win32, allocate resource memory with memfd, so the associated display surface memory can be shared with a different process. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20241008125028.1177932-18-marcandre.lureau@redhat.com>
2024-10-14ui/pixman: generalize shared_image_destroyMarc-André Lureau1-2/+2
Learn to free memfd-allocated shared memory. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20241008125028.1177932-10-marcandre.lureau@redhat.com>
2024-10-14ui/win32: fix potential use-after-free with dbus shared memoryMarc-André Lureau1-12/+2
DisplaySurface may be free before the pixman image is freed, since the image is refcounted and used by different objects, including pending dbus messages. Furthermore, setting the destroy function in create_displaysurface_from() isn't appropriate, as it may not be used, and may be overriden as in ramfb. Set the destroy function when the shared handle is set, use the HANDLE directly for destroy data, using a single common helper qemu_pixman_win32_image_destroy(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20241008125028.1177932-5-marcandre.lureau@redhat.com>
2024-10-04Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingPeter Maydell2-2/+2
* pc: Add a description for the i8042 property * kvm: support for nested FRED * tests/unit: fix warning when compiling test-nested-aio-poll with LTO * kvm: refactoring of VM creation * target/i386: expose IBPB-BRTYPE and SBPB CPUID bits to the guest * hw/char: clean up serial * remove virtfs-proxy-helper * target/i386/kvm: Report which action failed in kvm_arch_put/get_registers * qom: improvements to object_resolve_path*() # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmb++MsUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroPVnwf/cdvfxvDm22tEdlh8vHlV17HtVdcC # Hw334M/3PDvbTmGzPBg26lzo4nFS6SLrZ8ETCeqvuJrtKzqVk9bI8ssZW5KA4ijM # nkxguRPHO8E6U33ZSucc+Hn56+bAx4I2X80dLKXJ87OsbMffIeJ6aHGSEI1+fKVh # pK7q53+Y3lQWuRBGhDIyKNuzqU4g+irpQwXOhux63bV3ADadmsqzExP6Gmtl8OKM # DylPu1oK7EPZumlSiJa7Gy1xBqL4Rc4wGPNYx2RVRjp+i7W2/Y1uehm3wSBw+SXC # a6b7SvLoYfWYS14/qCF4cBL3sJH/0f/4g8ZAhDDxi2i5kBr0/5oioDyE/A== # =/zo4 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 03 Oct 2024 21:04:27 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (23 commits) qom: update object_resolve_path*() documentation qom: set *ambiguous on all paths qom: rename object_resolve_path_type() "ambiguousp" target/i386/kvm: Report which action failed in kvm_arch_put/get_registers kvm: Allow kvm_arch_get/put_registers to accept Error** accel/kvm: refactor dirty ring setup minikconf: print error entirely on stderr 9p: remove 'proxy' filesystem backend driver hw/char: Extract serial-mm hw/char/serial.h: Extract serial-isa.h hw: Remove unused inclusion of hw/char/serial.h target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest kvm: refactor core virtual machine creation into its own function kvm/i386: replace identity_base variable with a constant kvm/i386: refactor kvm_arch_init and split it into smaller functions kvm: replace fprintf with error_report()/printf() in kvm_init() kvm/i386: fix return values of is_host_cpu_intel() kvm/i386: make kvm_filter_msr() and related definitions private to kvm module hw/i386/pc: Add a description for the i8042 property tests/unit: remove block layer code from test-nested-aio-poll ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org> # Conflicts: # hw/arm/Kconfig # hw/arm/pxa2xx.c
2024-10-03hw/char: Extract serial-mmBernhard Beschow2-2/+2
hw/char/serial currently contains the implementation of both TYPE_SERIAL and TYPE_SERIAL_MM. According to serial_class_init(), TYPE_SERIAL is an internal class while TYPE_SERIAL_MM is used by numerous machine types directly. Let's move the latter into its own module which makes the dependencies more obvious and the code more tidy. The includes and the dependencies have been converted mechanically except in the hw/char directories which were updated manually. The result was compile-tested. Now, only hw/char makes direct use of TYPE_SERIAL: # grep -r -e "select SERIAL" | grep -v SERIAL_ hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL hw/char/Kconfig: select SERIAL # grep -r -e "/serial\\.h" include/hw/char/serial-mm.h:#include "hw/char/serial.h" hw/char/serial-pci-multi.c:#include "hw/char/serial.h" hw/char/serial.c:#include "hw/char/serial.h" hw/char/serial-isa.c:#include "hw/char/serial.h" hw/char/serial-pci.c:#include "hw/char/serial.h" Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Bernhard Beschow <shentey@gmail.com> Link: https://lore.kernel.org/r/20240905073832.16222-4-shentey@gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-10-02hw/qxl: fix -Werror=maybe-uninitialized false-positivesMarc-André Lureau1-2/+2
../hw/display/qxl.c:1352:5: error: ‘pci_region’ may be used uninitialized [-Werror=maybe-uninitialized] ../hw/display/qxl.c:1365:22: error: ‘pci_start’ may be used uninitialized [-Werror=maybe-uninitialized] Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
2024-10-01hw/display: Remove omap_dssPeter Maydell2-1094/+0
The omap_dss device is OMAP2 only, and we are removing it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240903160751.4100218-50-peter.maydell@linaro.org
2024-10-01hw/display: Remove Blizzard display devicePeter Maydell3-1030/+0
Remove the blizzard display device, which was only used with the n800 and n810 machines. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-id: 20240903160751.4100218-28-peter.maydell@linaro.org
2024-10-01hw/display: Remove pxa2xx_lcd.cPeter Maydell2-1452/+0
Remove the pxa2xx-specific pxa2xx_lcd device. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240903160751.4100218-19-peter.maydell@linaro.org
2024-10-01hw/display: Remove tc6393xb devicePeter Maydell2-569/+0
The tc6393xb was used only by the XScale-based Zaurus machine types. Now they have been removed we can remove this device too. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240903160751.4100218-7-peter.maydell@linaro.org
2024-09-20hw/display: Fix mirrored output in dm163Inès Varhol1-1/+1
DM163 is an emulated 8x8 LED matrix. This commit flips the image horizontally so it's rendered the same way as on the hardware. Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-09-13hw: Use device_class_set_legacy_reset() instead of opencodingPeter Maydell19-21/+21
Use device_class_set_legacy_reset() instead of opencoding an assignment to DeviceClass::reset. This change was produced with: spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/device-reset.cocci \ --keep-comments --smpl-spacing --in-place --dir hw Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240830145812.1967042-8-peter.maydell@linaro.org
2024-09-10virtio: Allow .get_vhost() without vhost_startedHanna Czenczek1-1/+1
Historically, .get_vhost() was probably only called when vdev->vhost_started is true. However, we now decidedly want to call it also when vhost_started is false, specifically so we can issue a reset to the vhost back-end while device operation is stopped. Some .get_vhost() implementations dereference some pointers (or return offsets from them) that are probably guaranteed to be non-NULL when vhost_started is true, but not necessarily otherwise. This patch makes all such implementations check all such pointers, returning NULL if any is NULL. Signed-off-by: Hanna Czenczek <hreitz@redhat.com> Message-Id: <20240723163941.48775-2-hreitz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
2024-08-23hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()Haoran Zhang1-1/+1
fix vhost_user_gpu_chr_read() where `size` was incorrectly passed to `msg->flags`. Fixes: 267f664658 ("hw/display: add vhost-user-vga & gpu-pci") Signed-off-by: Haoran Zhang <wh1sper@zju.edu.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-08-06hw/display/virtio-gpu: Improve "opengl is not available" error messagePeter Maydell1-1/+7
If the user tries to use the virtio-gpu-gl device but the display backend doesn't have OpenGL support enabled, we currently print a rather uninformative error message: $ qemu-system-aarch64 -M virt -device virtio-gpu-gl qemu-system-aarch64: -device virtio-gpu-gl: opengl is not available Since OpenGL is not enabled on display frontends by default, users are quite likely to run into this. Improve the error message to be more specific and to suggest to the user a path forward. Note that the case of "user tried to enable OpenGL but the display backend doesn't handle it" is caught elsewhere first, so we can assume that isn't the problem: $ qemu-system-aarch64 -M virt -device virtio-gpu-gl -display curses,gl=on qemu-system-aarch64: OpenGL is not supported by the display (Use of error_append_hint() requires us to add an ERRP_GUARD() to the function, as noted in include/qapi/error.h.) With this commit we now produce the hopefully more helpful error: $ ./build/x86/qemu-system-aarch64 -M virt -device virtio-gpu-gl qemu-system-aarch64: -device virtio-gpu-gl: The display backend does not have OpenGL support enabled It can be enabled with '-display BACKEND,gl=on' where BACKEND is the name of the display backend to use. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2443 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20240731154136.3494621-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-22virtio-gpu-gl: declare dependency on ui-openglMarc-André Lureau1-0/+1
Since commit e8a2db94 "virtio-gpu-virgl: teach it to get the QEMU EGL display", virtio-gl depends on ui-opengl symbol "qemu_egl_display". Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2391 Fixes: e8a2db94 ("virtio-gpu-virgl: teach it to get the QEMU EGL display") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2024-07-18hw/display/bcm2835_fb: fix fb_use_offsets conditionSamJakob1-1/+1
It is common practice when implementing double-buffering on VideoCore to do so by multiplying the height of the virtual buffer by the number of virtual screens desired (i.e., two - in the case of double-bufferring). At present, this won't work in QEMU because the logic in fb_use_offsets require that both the virtual width and height exceed their physical counterparts. This appears to be unintentional/a typo and indeed the comment states; "Experimentally, the hardware seems to do this only if the viewport size is larger than the physical screen". The viewport/virtual size would be larger than the physical size if either virtual dimension were larger than their physical counterparts and not necessarily both. Signed-off-by: SamJakob <me@samjakob.com> Message-id: 20240713160353.62410-1-me@samjakob.com Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-07-16ui/console: Remove dpy_cursor_define_supported()Akihiko Odaki2-8/+2
Remove dpy_cursor_define_supported() as it brings no benefit today and it has a few inherent problems. All graphical displays except egl-headless support cursor composition without DMA-BUF, and egl-headless is meant to be used in conjunction with another graphical display, so dpy_cursor_define_supported() always returns true and meaningless. Even if we add a new display without cursor composition in the future, dpy_cursor_define_supported() will be problematic as a cursor display fix for it because some display devices like virtio-gpu cannot tell the lack of cursor composition capability to the guest and are unable to utilize the value the function returns. Therefore, all non-headless graphical displays must actually implement cursor composition for correct cursor display. Another problem with dpy_cursor_define_supported() is that it returns true even if only some of the display listeners support cursor composition, which is wrong unless all display listeners that lack cursor composition is headless. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20240715-cursor-v3-4-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-16ui/console: Convert mouse visibility parameter into boolAkihiko Odaki3-4/+3
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240715-cursor-v3-2-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-07-01vhost-user-gpu: fix import of DMABUFMarc-André Lureau1-2/+3
When using vhost-user-gpu with GL, qemu -display gtk doesn't show output and prints: qemu: eglCreateImageKHR failed Since commit 9ac06df8b ("virtio-gpu-udmabuf: correct naming of QemuDmaBuf size properties"), egl_dmabuf_import_texture() uses backing_{width,height} for the texture dimension. Fixes: 9ac06df8b ("virtio-gpu-udmabuf: correct naming of QemuDmaBuf size properties") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20240515105237.1074116-1-marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2024-06-19ui+display: rename is_buffer_shared() -> surface_is_allocated()Gerd Hoffmann3-13/+14
Boolean return value is reversed, to align with QEMU_ALLOCATED_FLAG, so all callers must be adapted. Also rename share_surface variable in vga_draw_graphic() to reduce confusion. No functional change. Suggested-by: Marc-André Lureau <marcandre.lureau@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20240605131444.797896-4-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-19stdvga: fix screen blankingGerd Hoffmann1-0/+7
In case the display surface uses a shared buffer (i.e. uses vga vram directly instead of a shadow) go unshare the buffer before clearing it. This avoids vga memory corruption, which in turn fixes unblanking not working properly with X11. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2067 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20240605131444.797896-2-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-06-04hw/xen: Register framebuffer backend via xen_backend_init()Philippe Mathieu-Daudé1-2/+7
Align the framebuffer backend with the other legacy ones, register it via xen_backend_init() when '-vga xenfb' is used. It is safe because MODULE_INIT_XEN_BACKEND is called in xen_bus_realize(), long after CLI processing initialized the vga_interface_type variable. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-8-philmd@linaro.org>
2024-06-04hw/xen: Make XenDevOps structures constPhilippe Mathieu-Daudé1-2/+2
Keep XenDevOps structures in .rodata. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-5-philmd@linaro.org>
2024-05-22virtio-gpu: fix v2 migrationMarc-André Lureau1-8/+22
Commit dfcf74fa ("virtio-gpu: fix scanout migration post-load") broke forward/backward version migration. Versioning of nested VMSD structures is not straightforward, as the wire format doesn't have nested structures versions. Introduce x-scanout-vmstate-version and a field test to save/load appropriately according to the machine version. Fixes: dfcf74fa ("virtio-gpu: fix scanout migration post-load") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Tested-by: Fiona Ebner <f.ebner@proxmox.com> [fixed long lines] Signed-off-by: Fabiano Rosas <farosas@suse.de>
2024-05-14ui/console: Use qemu_dmabuf_new() and free() helpers insteadDongwon Kim2-27/+28
This commit introduces utility functions for the creation and deallocation of QemuDmaBuf instances. Additionally, it updates all relevant sections of the codebase to utilize these new utility functions. v7: remove prefix, "dpy_gl_" from all helpers qemu_dmabuf_free() returns without doing anything if input is null (Daniel P. Berrangé <berrange@redhat.com>) call G_DEFINE_AUTOPTR_CLEANUP_FUNC for qemu_dmabuf_free() (Daniel P. Berrangé <berrange@redhat.com>) v8: Introduction of helpers was removed as those were already added by the previous commit v9: set dmabuf->allow_fences to 'true' when dmabuf is created in virtio_gpu_create_dmabuf()/virtio-gpu-udmabuf.c removed unnecessary spaces were accidently added in the patch, 'ui/console: Use qemu_dmabuf_new() a...' v11: Calling qemu_dmabuf_close was removed as closing dmabuf->fd will be done in qemu_dmabuf_free anyway. (Daniel P. Berrangé <berrange@redhat.com>) v12: --- Calling qemu_dmabuf_close separately as qemu_dmabuf_free doesn't do it. --- 'dmabuf' is now allocated space so it should be freed at the end of dbus_scanout_texture v13: --- Immediately free dmabuf after it is released to prevent possible leaking of the ptr (Marc-André Lureau <marcandre.lureau@redhat.com>) --- Use g_autoptr macro to define *dmabuf for auto clean up instead of calling qemu_dmabuf_free (Marc-André Lureau <marcandre.lureau@redhat.com>) v14: --- (vhost-user-gpu) Change qemu_dmabuf_free back to g_clear_pointer as it was done because of some misunderstanding (v13). --- (vhost-user-gpu) g->dmabuf[m->scanout_id] needs to be set to NULL to prevent freed dmabuf to be accessed again in case if(fd==-1)break; happens (before new dmabuf is allocated). Otherwise, it would cause invalid memory access when the same function is executed. Also NULL check should be done before qemu_dmabuf_close (it asserts dmabuf!=NULL.). (Marc-André Lureau <marcandre.lureau@redhat.com>) Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20240508175403.3399895-6-dongwon.kim@intel.com>
2024-05-14ui/console: Use qemu_dmabuf_get_..() helpers insteadDongwon Kim2-7/+5
This commit updates all instances where fields within the QemuDmaBuf struct are directly accessed, replacing them with calls to these new helper functions. v6: fix typos in helper names in ui/spice-display.c v7: removed prefix, "dpy_gl_" from all helpers v8: Introduction of helpers was removed as those were already added by the previous commit v11: -- Use new qemu_dmabuf_close() instead of close(qemu_dmabuf_get_fd()). (Daniel P. Berrangé <berrange@redhat.com>) -- Use new qemu_dmabuf_dup_fd() instead of dup(qemu_dmabuf_get_fd()). (Daniel P. Berrangé <berrange@redhat.com>) Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20240508175403.3399895-4-dongwon.kim@intel.com>
2024-05-10xen: register legacy backends via xen_backend_initPaolo Bonzini1-1/+7
It is okay to register legacy backends in the middle of xen_bus_init(). All that the registration does is record the existence of the backend in xenstore. This makes it possible to remove them from the build without introducing undefined symbols in xen_be_init(). It also removes the need for the backend_register callback, whose only purpose is to avoid registering nonfunctional backends. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240509170044.190795-8-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-03display: remove GraphicHwOps from typedefs.hPaolo Bonzini1-0/+1
Basically all uses of GraphicHwOps are defining an instance of it, which requires the full definition of the struct. It is pointless to have it in typedefs.h. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-05-03build: do not build virtio-vga-gl if virgl/opengl not availablePaolo Bonzini1-6/+8
If virgl and opengl are not available, the build process creates a useless libvirtio-vga-gl module that does not have any device in it. Follow the example of virtio-vga-rutabaga and do not build the module at all in that case. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-30hw/display : Add device DM163Inès Varhol4-0/+367
This device implements the IM120417002 colors shield v1.1 for Arduino (which relies on the DM163 8x3-channel led driving logic) and features a simple display of an 8x8 RGB matrix. The columns of the matrix are driven by the DM163 and the rows are driven externally. Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240424200929.240921-2-ines.varhol@telecom-paris.fr [PMM: updated to new reset hold method prototype] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-04-26exec: Declare target_words_bigendian() in 'exec/tswap.h'Philippe Mathieu-Daudé1-1/+1
We usually check target endianess before swapping values, so target_words_bigendian() declaration makes sense in "exec/tswap.h" with the target swapping helpers. Remove "hw/core/cpu.h" when it was only included to get the target_words_bigendian() declaration. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng> Message-Id: <20231212123401.37493-16-philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2024-04-25hw, target: Add ResetType argument to hold and exit phase methodsPeter Maydell1-2/+2
We pass a ResetType argument to the Resettable class enter phase method, but we don't pass it to hold and exit, even though the callsites have it readily available. This means that if a device cared about the ResetType it would need to record it in the enter phase method to use later on. Pass the type to all three of the phase methods to avoid having to do that. Commit created with for dir in hw target include; do \ spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/reset-type.cocci \ --keep-comments --smpl-spacing --in-place \ --include-headers --dir $dir; done and no manual edits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Luc Michel <luc.michel@amd.com> Message-id: 20240412160809.1260625-5-peter.maydell@linaro.org
2024-04-18vga: move dirty memory region code togetherPaolo Bonzini1-4/+4
Take into account split screen mode close to wrap around, which is the other special case for dirty memory region computation. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-18vga: optimize computation of dirty memory regionPaolo Bonzini1-17/+7
The depth == 0 and depth == 15 have to be special cased because width * depth / 8 does not provide the correct scanline length. However, thanks to the recent reorganization of vga_draw_graphic() the correct value of VRAM bits per pixel is available in "bits". Use it (via the same "bwidth" computation that is used later in the function), thus restricting the slow path to the wraparound case. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-18ramfb: move stubs out of stubs/Paolo Bonzini2-1/+16
Since the ramfb stubs are needed exactly when the Kconfig symbols are not needed, move them to hw/display/ and compile them when ramfb.c is absent. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240408155330.522792-14-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-10hw/display/virtio-gpu: Protect from DMA re-entrancy bugsPhilippe Mathieu-Daudé1-4/+2
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() so the bus and device use the same guard. Otherwise the DMA-reentrancy protection can be bypassed: $ cat << EOF | qemu-system-i386 -display none -nodefaults \ -machine q35,accel=qtest \ -m 512M \ -device virtio-gpu \ -qtest stdio outl 0xcf8 0x80000820 outl 0xcfc 0xe0004000 outl 0xcf8 0x80000804 outw 0xcfc 0x06 write 0xe0004030 0x4 0x024000e0 write 0xe0004028 0x1 0xff write 0xe0004020 0x4 0x00009300 write 0xe000401c 0x1 0x01 write 0x101 0x1 0x04 write 0x103 0x1 0x1c write 0x9301c8 0x1 0x18 write 0x105 0x1 0x1c write 0x107 0x1 0x1c write 0x109 0x1 0x1c write 0x10b 0x1 0x00 write 0x10d 0x1 0x00 write 0x10f 0x1 0x00 write 0x111 0x1 0x00 write 0x113 0x1 0x00 write 0x115 0x1 0x00 write 0x117 0x1 0x00 write 0x119 0x1 0x00 write 0x11b 0x1 0x00 write 0x11d 0x1 0x00 write 0x11f 0x1 0x00 write 0x121 0x1 0x00 write 0x123 0x1 0x00 write 0x125 0x1 0x00 write 0x127 0x1 0x00 write 0x129 0x1 0x00 write 0x12b 0x1 0x00 write 0x12d 0x1 0x00 write 0x12f 0x1 0x00 write 0x131 0x1 0x00 write 0x133 0x1 0x00 write 0x135 0x1 0x00 write 0x137 0x1 0x00 write 0x139 0x1 0x00 write 0xe0007003 0x1 0x00 EOF ... ================================================================= ==276099==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000011178 at pc 0x562cc3b736c7 bp 0x7ffed49dee60 sp 0x7ffed49dee58 READ of size 8 at 0x60d000011178 thread T0 #0 0x562cc3b736c6 in virtio_gpu_ctrl_response hw/display/virtio-gpu.c:180:42 #1 0x562cc3b7c40b in virtio_gpu_ctrl_response_nodata hw/display/virtio-gpu.c:192:5 #2 0x562cc3b7c40b in virtio_gpu_simple_process_cmd hw/display/virtio-gpu.c:1015:13 #3 0x562cc3b82873 in virtio_gpu_process_cmdq hw/display/virtio-gpu.c:1050:9 #4 0x562cc4a85514 in aio_bh_call util/async.c:169:5 #5 0x562cc4a85c52 in aio_bh_poll util/async.c:216:13 #6 0x562cc4a1a79b in aio_dispatch util/aio-posix.c:423:5 #7 0x562cc4a8a2da in aio_ctx_dispatch util/async.c:358:5 #8 0x7f36840547a8 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x547a8) #9 0x562cc4a8b753 in glib_pollfds_poll util/main-loop.c:290:9 #10 0x562cc4a8b753 in os_host_main_loop_wait util/main-loop.c:313:5 #11 0x562cc4a8b753 in main_loop_wait util/main-loop.c:592:11 #12 0x562cc3938186 in qemu_main_loop system/runstate.c:782:9 #13 0x562cc43b7af5 in qemu_default_main system/main.c:37:14 #14 0x7f3683a6c189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #15 0x7f3683a6c244 in __libc_start_main csu/../csu/libc-start.c:381:3 #16 0x562cc2a58ac0 in _start (qemu-system-i386+0x231bac0) 0x60d000011178 is located 56 bytes inside of 136-byte region [0x60d000011140,0x60d0000111c8) freed by thread T0 here: #0 0x562cc2adb662 in __interceptor_free (qemu-system-i386+0x239e662) #1 0x562cc3b86b21 in virtio_gpu_reset hw/display/virtio-gpu.c:1524:9 #2 0x562cc416e20e in virtio_reset hw/virtio/virtio.c:2145:9 #3 0x562cc37c5644 in virtio_pci_reset hw/virtio/virtio-pci.c:2249:5 #4 0x562cc4233758 in memory_region_write_accessor system/memory.c:497:5 #5 0x562cc4232eea in access_with_adjusted_size system/memory.c:573:18 previously allocated by thread T0 here: #0 0x562cc2adb90e in malloc (qemu-system-i386+0x239e90e) #1 0x7f368405a678 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5a678) #2 0x562cc4163ffc in virtqueue_split_pop hw/virtio/virtio.c:1612:12 #3 0x562cc4163ffc in virtqueue_pop hw/virtio/virtio.c:1783:16 #4 0x562cc3b91a95 in virtio_gpu_handle_ctrl hw/display/virtio-gpu.c:1112:15 #5 0x562cc4a85514 in aio_bh_call util/async.c:169:5 #6 0x562cc4a85c52 in aio_bh_poll util/async.c:216:13 #7 0x562cc4a1a79b in aio_dispatch util/aio-posix.c:423:5 SUMMARY: AddressSanitizer: heap-use-after-free hw/display/virtio-gpu.c:180:42 in virtio_gpu_ctrl_response With this change, the same reproducer triggers: qemu-system-i386: warning: Blocked re-entrant IO on MemoryRegion: virtio-pci-common-virtio-gpu at addr: 0x6 Fixes: CVE-2024-3446 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Yongkang Jia <kangel@zju.edu.cn> Reported-by: Xiao Lei <nop.leixiao@gmail.com> Reported-by: Yiming Tao <taoym@zju.edu.cn> Buglink: https://bugs.launchpad.net/qemu/+bug/1888606 Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20240409105537.18308-3-philmd@linaro.org>
2024-04-02vga: do not treat horiz pel panning value of 8 as "enabled"Paolo Bonzini1-1/+3
Horizontal pel panning bit 3 is only used in text mode. In graphics mode, it can be treated as if it was zero, thus not extending the dirty memory region. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02vga: adjust dirty memory region if pel panning is activePaolo Bonzini1-1/+4
When pel panning is active, one more byte is read from each of the VGA memory planes. This has to be accounted in the computation of region_end, otherwise vga_draw_graphic() fails an assertion: qemu-system-i386: ../system/physmem.c:946: cpu_physical_memory_snapshot_get_dirty: Assertion `start + length <= snap->end' failed. Reported-by: Helge Konetzka <hk@zapateado.de> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2244 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02vga: move computation of dirty memory region laterPaolo Bonzini1-25/+25
Move the computation of region_start and region_end after the value of "bits" is known. This makes it possible to distinguish modes that support horizontal pel panning from modes that do not. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-04-02vga: merge conditionals on shift control registerPaolo Bonzini1-47/+42
There are two sets of conditionals using the shift control bits: one to verify the palette and adjust disp_width, one to compute the "v" and "bits" variables. Merge them into one, with the extra benefit that we now have the "bits" value available early and can use it to compute region_end. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-03-12Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into ↵Peter Maydell1-17/+41
staging display/ui: pending fixes - ui/vnc: Respect bound console - ui/dbus: optimize a bit message queuing - virtio-gpu: fix blob scanout post-load # -----BEGIN PGP SIGNATURE----- # # iQJQBAABCAA6FiEEh6m9kz+HxgbSdvYt2ujhCXWWnOUFAmXwYCYcHG1hcmNhbmRy # ZS5sdXJlYXVAcmVkaGF0LmNvbQAKCRDa6OEJdZac5bv9D/9J1g76mYND+ad++d+G # YiewXtHVwrHm9g+TxUdWXaBcDFy+uFtGpwIBtYN76YjSSL47li74V7sQTZ2FQVys # Y8W61xBzDoAcCLV7/m48WW/mov2+TtyUFYIC3ZOBFS6Ol5aiJ8uurJa11h2WTacq # tQKlK5g//Yv0H0cxn1cYMqRFdsko3H2hSmYz36QuPWfxivC2VeMnN/iTSGfiVSb+ # hTkOdRu+5qmt3mbbYo0Z6YpvjhLqSLob6n29+P7/QlwrQxP+A/JSS4FrAHryXzvm # qZ/wRsPmThjwpnt3ZV9AapagQ7908FRmh1EhyAxrWq2G8QGK/XvJ/JPwBOgZGEiy # W48N5FQhdQUkxkVpkmQVpGhJFAzclqJh/duZiBtixw+25Md6DG04OwHy9k7qCph7 # qj2BZuaSafVcSE0JEG78bt5YHAO3Joyfjf7Jhb0Tqvn2kbv94tCTGtUIH6ngYv4Z # r0vTmlDr7pe1xaa9HeFpaopckvj4uQhlcMHnrETnUtcdWKE5SaBlgNsIwHlNlKZ6 # wmUIMKymXNRIiCZrf2xxJr7PeZ8FJgTlHCy9poSJRwpZDKHaZQMecklELx+jECuU # DPhAmTPTZjCKiXGCI+KlL6nDy/H7zA6boCMO2QpKVk0ehviWOQZvu94srTJL5nz/ # RX+rwGbf3+8LfIFJmLcQCD5qag== # =oY0A # -----END PGP SIGNATURE----- # gpg: Signature made Tue 12 Mar 2024 14:01:10 GMT # gpg: using RSA key 87A9BD933F87C606D276F62DDAE8E10975969CE5 # gpg: issuer "marcandre.lureau@redhat.com" # gpg: Good signature from "Marc-André Lureau <marcandre.lureau@redhat.com>" [full] # gpg: aka "Marc-André Lureau <marcandre.lureau@gmail.com>" [full] # Primary key fingerprint: 87A9 BD93 3F87 C606 D276 F62D DAE8 E109 7596 9CE5 * tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu: virtio-gpu: fix scanout migration post-load virtio-gpu: remove needless condition ui/dbus: filter out pending messages when scanout ui/dbus: factor out sending a scanout ui/vnc: Respect bound console Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2024-03-12virtio-gpu: fix scanout migration post-loadMarc-André Lureau1-10/+41
The current post-loading code for scanout has a FIXME: it doesn't take the resource region/rect into account. But there is more, when adding blob migration support in commit f66767f75c9, I didn't realize that blob resources could be used for scanouts. This situationn leads to a crash during post-load, as they don't have an associated res->image. virtio_gpu_do_set_scanout() handle all cases, but requires the associated virtio_gpu_framebuffer, which is currently not saved during migration. Add a v2 of "virtio-gpu-one-scanout" with the framebuffer fields, so we can restore blob scanouts, as well as fixing the existing FIXME. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Sebastian Ott <sebott@redhat.com>
2024-03-12virtio-gpu: remove needless conditionMarc-André Lureau1-7/+0
qemu_create_displaysurface_pixman() never returns NULL. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
2024-03-12bulk: Access existing variables initialized to &S->F when availablePhilippe Mathieu-Daudé1-1/+1
When a variable is initialized to &struct->field, use it in place. Rationale: while this makes the code more concise, this also helps static analyzers. Mechanical change using the following Coccinelle spatch script: @@ type S, F; identifier s, m, v; @@ S *s; ... F *v = &s->m; <+... - &s->m + v ...+> Inspired-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240129164514.73104-2-philmd@linaro.org> Acked-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> [thuth: Dropped hunks that need a rebase, and fixed sizeof() in pmu_realize()] Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-03-12hw/display/macfb: Fix missing ERRP_GUARD() in macfb_nubus_realize()Zhao Liu1-0/+1
As the comment in qapi/error, dereferencing @errp requires ERRP_GUARD(): * = Why, when and how to use ERRP_GUARD() = * * Without ERRP_GUARD(), use of the @errp parameter is restricted: * - It must not be dereferenced, because it may be null. ... * ERRP_GUARD() lifts these restrictions. * * To use ERRP_GUARD(), add it right at the beginning of the function. * @errp can then be used without worrying about the argument being * NULL or &error_fatal. * * Using it when it's not needed is safe, but please avoid cluttering * the source with useless code. But in macfb_nubus_realize(), @errp is dereferenced without ERRP_GUARD(): ndc->parent_realize(dev, errp); if (*errp) { return; } Here we check *errp, because the ndc->parent_realize(), as a DeviceClass.realize() callback, returns void. And since macfb_nubus_realize(), also as a DeviceClass.realize(), doesn't get the NULL @errp parameter, it hasn't triggered the bug that dereferencing the NULL @errp. To follow the requirement of @errp, add missing ERRP_GUARD() in macfb_nubus_realize(). Suggested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20240223085653.1255438-3-zhao1.liu@linux.intel.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2024-03-08mips: do not list individual devices from configs/Paolo Bonzini1-1/+1
Add new "select" and "imply" directives if needed. The resulting config-devices.mak files are the same as before. Builds without default devices will become much smaller than before, and qtests fail (as expected, though suboptimal) for mips64-softmmu because most tests do not use -nodefaults, so remove it from build-without-defaults Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2024-02-27hw/usb: extract sysbus-ohci to a separate filePaolo Bonzini1-0/+1
Split the sysbus version to a separate file so that it is not included in PCI-only machines, and adjust Kconfig for machines that do need sysbus-ohci. The copyrights are based on the time and employer of balrog and Paul Brook's contributions. While adjusting the SM501 dependency, move it to the right place instead of keeping it in the R4D machine. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240223124406.234509-10-pbonzini@redhat.com> [PMD: Rename some functions using 'ohci_sysbus_' prefix] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2024-02-26hw/display/exynos4210_fimd: Pass frame buffer memory region as linkPhilippe Mathieu-Daudé1-3/+16
Add the Exynos4210fimdState::'framebuffer-memory' property. Have the board set it. We don't need to call sysbus_address_space() anymore. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240226173805.289-5-philmd@linaro.org>
generated by cgit v1.1 at 2025-02-01 15:06:43 +0000