aboutsummaryrefslogtreecommitdiff
path: root/hw/display/ati.c
AgeCommit message (Collapse)Author
2020-06-30ati-vga: Add dummy MEM_SDRAM_MODE_REGBALATON Zoltan
Radeon chips have an SDRAM mode reg that is accessed by some drivers. We don't emulate the memory controller but provide some default value to prevent drivers getting unexpected 0. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: cc1324b9ef06beb8ae233ddc77dedd8bab9b8624.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-30ati-vga: Do not assert on errorBALATON Zoltan
Do not abort on unsupported value just print log and continue. While display will likely be broken this prevents malicious guest to crash QEMU causing denial of service. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 0c13dab5d8e3b7e7479c3edbf53aeac8c09de6de.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-30ati-vga: Support unaligned access to hardware cursor registersBALATON Zoltan
This fixes horizontal mouse movement and pointer color with MacOS that writes these registers with access size less than 4 so previously only the last portion of access was effective overwriting previous partial writes. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: ba1d5ba97f246e8807f86f1243c2bdc6497dc8f2.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-15qdev: Convert uses of qdev_create() manuallyMarkus Armbruster
Same transformation as in the previous commit. Manual, because convincing Coccinelle to transform these cases is somewhere between not worthwhile and infeasible (at least for me). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-11-armbru@redhat.com>
2020-06-15display/sm501 display/ati: Fix to realize "i2c-ddc"Markus Armbruster
sm501_init() and ati_vga_realize() create an "i2c-ddc" device, but neglect to realize it. Affects machines sam460ex, shix, r2d, and fulong2e. In theory, a device becomes real only on realize. In practice, the transition from unreal to real is a fuzzy one. The work to make a device real can be spread between realize methods (fine), instance_init methods (wrong), and board code wiring up the device (fine as long as it effectively happens on realize). Depending on what exactly is done where, a device can work even when we neglect to realize it. This one appears to work. Nevertheless, it's a clear misuse of the interface. Even when it works today (more or less by chance), it can break tomorrow. Fix by realizing it right away. Visible in "info qom-tree"; here's the change for sam460ex: /machine (sam460ex-machine) [...] /unattached (container) [...] - /device[14] (sii3112) + /device[14] (i2c-ddc) + /device[15] (sii3112) [rest of device[*] renumbered...] Fixes: 4a1f253adb45ac6019971193d5077c4d5d55886a Fixes: c82c7336de58876862e6b4dccbda29e9240fd388 Cc: BALATON Zoltan <balaton@eik.bme.hu> Cc: qemu-ppc@nongnu.org Cc: Magnus Damm <magnus.damm@gmail.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200609122339.937862-19-armbru@redhat.com>
2020-06-05ati-vga: check mm_index before recursive call (CVE-2020-13800)Prasad J Pandit
While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-18ati-vga: Do not allow unaligned access via index registerBALATON Zoltan
According to docs bits 1 and 0 of MM_INDEX are hard coded to 0 so unaligned access via this register should not be possible. This also fixes problems reported in bug #1878134. Buglink: https://bugs.launchpad.net/qemu/+bug/1878134 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Alexander Bulekov <alxndr@bu.edu> Acked-by: Alexander Bulekov <alxndr@bu.edu> Message-id: 20200516132352.39E9374594E@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-01-24qdev: set properties with device_class_set_props()Marc-André Lureau
The following patch will need to handle properties registration during class_init time. Let's use a device_class_set_props() setter. spatch --macro-file scripts/cocci-macro-file.h --sp-file ./scripts/coccinelle/qdev-set-props.cocci --keep-comments --in-place --dir . @@ typedef DeviceClass; DeviceClass *d; expression val; @@ - d->props = val + device_class_set_props(d, val) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20200110153039.1379601-20-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-09-19ati: use vga_read_byte in ati_cursor_defineGerd Hoffmann
This makes sure reads are confined to vga video memory. v3: use uint32_t, fix cut+paste bug. v2: fix ati_cursor_draw_line too. Reported-by: xu hang <flier_m@outlook.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190917111441.27405-3-kraxel@redhat.com
2019-08-22ati-vga: Implement dummy VBlank IRQBALATON Zoltan
The MacOS driver exits if the card does not have an interrupt. If we set PCI_INTERRUPT_PIN to 1 then it enables VBlank interrupts and it boots but the mouse pointer cannot be moved. This patch implements a dummy VBlank interrupt triggered by a 60 Hz timer. With this the pointer now moves but MacOS still hangs somewhere before completely finishing boot. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <89364275f2fb5f85ee73c0e76528aa91691a499a.1565907489.git.balaton@eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Add limited support for big endian frame buffer apertureBALATON Zoltan
Set frame buffer endianness according to requested endianness for frame buffer apertures. We set frame buffer to big endian if any of the two apertures are set to big endian. Using different endianness for the two apertures is not implemented. This fixes inverted colors with MacOS and Xorg frame buffer driver but some Linux drivers may have endianness issues even on real hardware so this may not fix all cases. MorphOS uses aper0 in LE, Linux uses aper0 in BE and MacOS uses aper1 in BE but not sure about others or if MacOS also may need aper0 in which case we'll need a more complex fix but MacOS has other problems yet so for now this might work. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: e2a7ec7af3fc30523213bcd27832ccad34323f2c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Attempt to handle CRTC offset not exact multiple of strideBALATON Zoltan
MacOS uses non-0 offset so it needs this and the resulting vbe_start_addr seems correct but picture is still broken with OpenBIOS after FCode runs but that maybe due to firmware problems now. After boot, picture is now correct. It also occured to me that these CRTC regs are also present in VGA so I wonder if they should be shared in case some drivers try to poke them via VGA regs or these are a separate set of regs for extended mode. Added a comment noting this but drivers I've tried so far program the card accessing ati regs so I did not attempt to change it. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 1c6fce457ef7e6f889e38dc0423791be92310a62.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix hardware cursor image offsetBALATON Zoltan
The crtc_offset is not needed, cur_offset is relative to the start of vram not the start of displayed area. This fixes broken pointer image with MacOS that uses non-0 crtc_offset. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: e6acb1fa3ca980dc948045443e5986e2aa79bf7c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix cursor color with guest_hwcursor=trueBALATON Zoltan
Fixes: a38127414bd007c5b6ae64c664d9e8839393277e Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: d99f9e07923a74932dbb15e93dd50aa8d2816b19.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Fix GPIO_MONID register writeBALATON Zoltan
Also update bitbang_i2c state when output bits are changed while enable bits are set. This fixes EDID access by the ATI FCode ROM. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 292e70a92b7fbfd9a4120d433dbdcfda4e5f6c3c.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21ati-vga: Add registers for getting aperturesBALATON Zoltan
Some drivers (e.g. Linux radeon drm and MacOS) access these to find apertures to access card. Try to implement these but not sure these are correct yet. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: b2df13655feecd63c0049ec45fd87d1026f67091.1565558093.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-16Include hw/qdev-properties.h lessMarkus Armbruster
In my "build everything" tree, changing hw/qdev-properties.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). Many places including hw/qdev-properties.h (directly or via hw/qdev.h) actually need only hw/qdev-core.h. Include hw/qdev-core.h there instead. hw/qdev.h is actually pointless: all it does is include hw/qdev-core.h and hw/qdev-properties.h, which in turn includes hw/qdev-core.h. Replace the remaining uses of hw/qdev.h by hw/qdev-properties.h. While there, delete a few superfluous inclusions of hw/qdev-core.h. Touching hw/qdev-properties.h now recompiles some 1200 objects. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20190812052359.30071-22-armbru@redhat.com>
2019-08-16Include hw/hw.h exactly where neededMarkus Armbruster
In my "build everything" tree, changing hw/hw.h triggers a recompile of some 2600 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). The previous commits have left only the declaration of hw_error() in hw/hw.h. This permits dropping most of its inclusions. Touching it now recompiles less than 200 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-19-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-07-05ati-vga: Fix setting offset together with pitch for r128proBALATON Zoltan
Turns out my last fix to this broke one case for Rage 128 Pro so revert that part of previous patch. This now fixes the remaining rendering problems for MorphOS which now can produce picture with -device ati-vga (although it may not be optimised yet and video overlay emulation is still known to be missing). Fixes: 866ad5f5ff620078f88183aa254f7b02727e6aa3 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: da33261a841755691f698db8190c868df0c0d3ae.1562276605.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-07-05ati-vga: Fix frame buffer endianness for big endian targetBALATON Zoltan
The extended mode frame buffer should be little endian even when emulating big endian machine (such as PPC). This fixes color problems with MorphOS. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 439aa85061f103446df7b42632d730971a372432.1562151410.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-07-03hw/i2c/bitbang_i2c: Use in-place rather than malloc'd bitbang_i2c_interface ↵Peter Maydell
struct Currently the bitbang_i2c_init() function allocates a bitbang_i2c_interface struct which it returns. This is unfortunate because it means that if the function is used from a DeviceState init method then the memory will be leaked by an "init then delete" cycle, as used by the qmp/hmp commands that list device properties. Since three out of four of the uses of this function are in device init methods, switch the function to do an in-place initialization of a struct that can be embedded in the device state struct of the caller. This fixes LeakSanitizer leak warnings that have appeared in the patchew configuration (which only tries to run the sanitizers for the x86_64-softmmu target) now that we use the bitbang-i2c code in an x86-64 config. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190702163844.20458-1-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-06-28ati-vga: switch to vgabios-ati.binGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20190620151104.2678-4-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-06-28ati-vga: Fixes to offset and pitch registersBALATON Zoltan
Fix bit masks of registers for offset and pitch and also handle default values for both R128P and RV100. This improves picture a bit but does not resolve all problems yet so there might be some more bugs somewhere. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20190624100005.7A1CA746395@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-06-28ati-vga: Implement DDC and EDID info from monitorBALATON Zoltan
This adds DDC support to ati-vga and connects i2c-ddc to it. This allows at least MacOS with an ATI ndrv, Linux radeonfb and MorphOS to get monitor EDID info (although MorphOS splash screen is not displayed and radeonfb needs additional tables from vgabios-rv100). Xorg needs additional support from VESA vgabios, it's missing INT10 0x4F15 function (see https://gitlab.freedesktop.org/xorg/xserver/blob/master/hw/xfree86/vbe/vbe.c) without which no DDC is available that also prevents loading the accelerated X driver. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 046ddebb7ec8db48c4e877ee444ec1c41e385a74.1561028123.git.balaton@eik.bme.hu ati-vga: Clarify comment Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20190620195213.C54127461AE@zero.eik.bme.hu ati-vga: Add DDC reg names for debug Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20190621181459.2F8207462AA@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-06-12Include qemu/module.h where needed, drop it from qemu-common.hMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190523143508.25387-4-armbru@redhat.com> [Rebased with conflicts resolved automatically, except for hw/usb/dev-hub.c hw/misc/exynos4210_rng.c hw/misc/bcm2835_rng.c hw/misc/aspeed_scu.c hw/display/virtio-vga.c hw/arm/stm32f205_soc.c; ui/cocoa.m fixed up]
2019-05-13Clean up includesMarkus Armbruster
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes, with the changes to the following files manually reverted: contrib/libvhost-user/libvhost-user-glib.h contrib/libvhost-user/libvhost-user.c contrib/libvhost-user/libvhost-user.h linux-user/mips64/cpu_loop.c linux-user/mips64/signal.c linux-user/sparc64/cpu_loop.c linux-user/sparc64/signal.c linux-user/x86_64/cpu_loop.c linux-user/x86_64/signal.c slirp/src/* target/s390x/gen-features.c tests/fp/platform.h tests/migration/s390x/a-b-bios.c tests/test-rcu-simpleq.c tests/test-rcu-tailq.c tests/uefi-test-tools/UefiTestToolsPkg/BiosTablesTest/BiosTablesTest.c We're in the process of spinning out slirp/. tests/fp/platform.h is has to include qemu/osdep.h because tests/fp/berkeley-softfloat-3/ and tests/fp/berkeley-testfloat-3/ don't. tests/uefi-test-tools/ is guest software. The remaining reverts are the same as in commit b7d89466dde. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190313162812.8885-1-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [Revert change to tests/fp/platform.h, adjust commit message]
2019-03-26ati-vga: Fix indexed access to video memoryBALATON Zoltan
Coverity (CID 1399700) found that this was wrong so instead of trying to do it by hand use existing access functions that should work better. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20190318223842.427CB7456B2@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-03-11hw/display: Add basic ATI VGA emulationBALATON Zoltan
At least two machines, the PPC mac99 and MIPS fulong2e, have an ATI gfx chip by default (Rage 128 Pro and M6/RV100 respectively) and guests running on these and the PMON2000 firmware of the fulong2e expect this to be available. Fortunately these are very similar chips so they can be mostly emulated in the same device model. This patch adds basic emulation of these ATI VGA chips. While this is incomplete and currently only enough to run the MIPS firmware and get framebuffer output with Linux, it allows the fulong2e board to work more like the real hardware and having it in QEMU in this state provides a way to experiment with it and allows others to contribute to improve it. It is compiled for all archs but only the fulong2e (which currently has no display output at all) is set to use it by default (in a separate patch). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Aleksandar Markovic <amarkovic@wavecomp.com> Tested-by: Andrew Randrianasulu <randrianasulu@gmail.com> Tested-by: Howard Spoelstra <hsp.cat7@gmail.com> Message-id: 0b1b7c22873a6e37627261b04fb687412b25ff4f.1552152100.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-05 04:37:05 +0000