aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)Author
2018-07-03virtio-gpu: disable scanout when backing resource is destroyedGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180702162443.16796-4-kraxel@redhat.com
2018-07-03virtio-gpu: update old resource too.Gerd Hoffmann
When switching scanout from one resource to another we must update the scanout_bitmask field for both new (set bit) and old (clear bit) resource. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180702162443.16796-3-kraxel@redhat.com
2018-07-03virtio-gpu: tweak scanout disable.Gerd Hoffmann
- Factor out the code to virtio_gpu_disable_scanout(). - Allow disable scanout 0, show a message then. - Clear scanout->resource_id. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180702162443.16796-2-kraxel@redhat.com
2018-07-02ramfb: enable vgabiosGerd Hoffmann
Add vgabios binary to fw_cfg vgaroms. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-07-02bochs-display: enable vgabiosGerd Hoffmann
Add vgabios binary to pci rom bar. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-06-27compiler: add a sizeof_field() macroStefan Hajnoczi
Determining the size of a field is useful when you don't have a struct variable handy. Open-coding this is ugly. This patch adds the sizeof_field() macro, which is similar to typeof_field(). Existing instances are updated to use the macro. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Message-id: 20180614164431.29305-1-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2018-06-26ramfb: fix overflowGerd Hoffmann
> CID 1393621: (OVERFLOW_BEFORE_WIDEN) > Potentially overflowing expression "stride * s->height" with type "unsigned > int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used > in a context that expects an expression of type "hwaddr" (64 bits, unsigned). Fix by changing stride from uint32_t to hwaddr. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180626083120.19515-1-kraxel@redhat.com
2018-06-26vga: set owner for mmio regionsGerd Hoffmann
This makes sure the regions are properly cleaned when unplugging -device seconday-vga. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Thomas Huth <thuth@redhat.com> Message-id: 20180626060941.8326-1-kraxel@redhat.com
2018-06-21sm501: Fix hardware cursor color conversionSebastian Bauer
According to the sm501 specs the hardware cursor colors are to be given in the rgb565 format, but the code currently interprets them as bgr565. Therefore, the colors of the hardware cursors are wrong in the QEMU display, e.g., the standard mouse pointer of AmigaOS appears blue instead of red. This change fixes this issue by replacing the existing naive bgr565 => rgb888 conversion with a standard rgb565 => rgb888 one that also scales the color component values properly. Signed-off-by: Sebastian Bauer <mail@sebastianbauer.info> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-19Merge remote-tracking branch 'remotes/kraxel/tags/vga-20180618-pull-request' ↵Peter Maydell
into staging vga: add ramfb, print virglrenderer version # gpg: Signature made Mon 18 Jun 2018 10:57:38 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20180618-pull-request: Add ramfb MAINTAINERS entry hw/display: add standalone ramfb device hw/display: add ramfb, a simple boot framebuffer living in guest ram configure: print virglrenderer version Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-18hw/display: add standalone ramfb deviceGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20180613122948.18149-3-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-06-18hw/display: add ramfb, a simple boot framebuffer living in guest ramGerd Hoffmann
The boot framebuffer is expected to be configured by the firmware, so it uses fw_cfg as interface. Initialization goes as follows: (1) Check whenever etc/ramfb is present. (2) Allocate framebuffer from RAM. (3) Fill struct RAMFBCfg, write it to etc/ramfb. Done. You can write stuff to the framebuffer now, and it should appear automagically on the screen. Note that this isn't very efficient because it does a full display update on each refresh. No dirty tracking. Dirty tracking would have to be active for the whole ram slot, so that wouldn't be very efficient either. For a boot display which is active for a short time only this isn't a big deal. As permanent guest display something better should be used (if possible). This is the ramfb core code. Some windup is needed for display devices which want have a ramfb boot display. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20180613122948.18149-2-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-06-16sm501: Do not clear read only bits when writing registersBALATON Zoltan
When writing registers that have read only bits we have to avoid changing these bits as they may have non zero values. Make sure we use the correct masks to mask out read only and reserved bits when changing registers. Also remove extra spaces from dram_control and arbitration_control assignments. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-06-12object: fix OBJ_PROP_LINK_UNREF_ON_RELEASE ambivalenceMarc-André Lureau
A link property can be set during creation, with object_property_add_link() and later with object_property_set_link(). add_link() doesn't add a reference to the target object, while set_link() does. Furthemore, OBJ_PROP_LINK_UNREF_ON_RELEASE flags, set during add_link, says whether a reference must be released when the property is destroyed. This can lead to leaks if the property was later set_link(), as the added reference is never released. Instead, rename OBJ_PROP_LINK_UNREF_ON_RELEASE to OBJ_PROP_LINK_STRONG and use that has an indication on how the link handle reference management in set_link(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180531195119.22021-3-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-06-08xilinx-dp: Add trailing '\n' to qemu_log() callPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20180606152128.449-4-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-04Merge remote-tracking branch 'remotes/kraxel/tags/vga-20180604-pull-request' ↵Peter Maydell
into staging Two little vga fixes. # gpg: Signature made Mon 04 Jun 2018 09:48:53 BST # gpg: using RSA key 4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/vga-20180604-pull-request: vga: cleanup surface handling bochs-display: add missing break Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-04Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
acpi, vhost, misc: fixes, features vDPA support, fix to vhost blk RO bit handling, some include path cleanups, NFIT ACPI table. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Fri 01 Jun 2018 17:25:19 BST # gpg: using RSA key 281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (31 commits) vhost-blk: turn on pre-defined RO feature bit ACPI testing: test NFIT platform capabilities nvdimm, acpi: support NFIT platform capabilities tests/.gitignore: add entry for generated file arch_init: sort architectures ui: use local path for local headers qga: use local path for local headers colo: use local path for local headers migration: use local path for local headers usb: use local path for local headers sd: fix up include vhost-scsi: drop an unused include ppc: use local path for local headers rocker: drop an unused include e1000e: use local path for local headers ioapic: fix up includes ide: use local path for local headers display: use local path for local headers trace: use local path for local headers migration: drop an unused include ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-06-04vga: cleanup surface handlingGerd Hoffmann
Just set the full_update flag if we need a new DisplaySurface. Create a new surface when the flag is set instead of having two places where qemu_create_displaysurface_from() is called. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180525131318.28437-1-kraxel@redhat.com
2018-06-04bochs-display: add missing breakGerd Hoffmann
Fixes: CID 1391291 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180525045344.28347-1-kraxel@redhat.com
2018-06-01display: use local path for local headersMichael S. Tsirkin
When pulling in headers that are in the same directory as the C file (as opposed to one in include/), we should use its relative path, without a directory. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2018-06-01hw: make virtio devices configurable via default-configs/Paolo Bonzini
This is only half of the work, because the proxy devices (virtio-*-pci, virtio-*-ccw, etc.) are still included unconditionally. It is still a move in the right direction. Based-on: <20180522194943.24871-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-06-01hw/i2c: Use DeviceClass::realize instead of I2CSlaveClass::initPhilippe Mathieu-Daudé
I2CSlaveClass::init is no more used, remove it. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20180419212727.26095-3-f4bug@amsat.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20180528144509.15812-3-armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-06-01hw: Do not include "sysemu/block-backend.h" if it is not necessaryPhilippe Mathieu-Daudé
Remove those unneeded includes to speed up the compilation process a little bit. (Continue 7eceff5b5a1fa cleanup) Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20180528232719.4721-13-f4bug@amsat.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-06-01hw: Do not include "exec/address-spaces.h" if it is not necessaryPhilippe Mathieu-Daudé
Code change produced with: $ git grep '#include "exec/address-spaces.h"' hw include/hw | \ cut -d: -f-1 | \ xargs egrep -L "(get_system_|address_space_)" | \ xargs sed -i.bak '/#include "exec\/address-spaces.h"/d' Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20180528232719.4721-12-f4bug@amsat.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-05-24bochs-display: add pcie supportGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180522165058.15404-6-kraxel@redhat.com
2018-05-24bochs-display: add dirty tracking supportGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180522165058.15404-5-kraxel@redhat.com
2018-05-24hw/display: add new bochs-display deviceGerd Hoffmann
After writing up the virtual mdev device emulating a display supporting the bochs vbe dispi interface (mbochs.ko) and seeing how simple it actually is I've figured that would be useful for qemu too. So, here it is, -device bochs-display. It is basically -device VGA without legacy vga emulation. PCI bar 0 is the framebuffer, PCI bar 2 is mmio with the registers. The vga registers are simply not there though, neither in the legacy ioport location nor in the mmio bar. Consequently it is PCI class DISPLAY_OTHER not DISPLAY_VGA. So there is no text mode emulation, no weird video modes (planar, 256color palette), no memory window at 0xa0000. Just a linear framebuffer in the pci memory bar. And the amount of code to emulate this (and therefore the attack surface) is an order of magnitude smaller when compared to vga emulation. Compatibility wise it works with OVMF (latest git master). The bochs-drm.ko linux kernel module can handle it just fine too. So UEFI guests should not see any functional difference to VGA. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180522165058.15404-4-kraxel@redhat.com
2018-05-24vga-pci: use PCI_VGA_MMIO_SIZEGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180522165058.15404-3-kraxel@redhat.com
2018-05-24vga: move bochs vbe defines to header fileGerd Hoffmann
Create a new header file, move the bochs vbe dispi interface defines to it, so they can be used outside vga code. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180522165058.15404-2-kraxel@redhat.com
2018-05-24vga: catch depth 0Gerd Hoffmann
depth == 0 is used to indicate 256 color modes. Our region calculation goes wrong in that case. So detect that and just take the safe code path we already have for the wraparound case. While being at it also catch depth == 15 (where our region size calculation goes wrong too). And make the comment more verbose, explaining what is going on here. Without this windows guest install might trigger an assert due to trying to check dirty bitmap outside the snapshot region. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1575541 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180514103117.21059-1-kraxel@redhat.com
2018-05-18ui: add x_keymap.o to modulesPaolo Bonzini
x_keymap.o is common to the SDL and GTK+ modules, and it causes the QEMU binary to link to the X11 libraries. Add it separately to the modules to keep the main QEMU binary smaller. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1526560782-18732-1-git-send-email-pbonzini@redhat.com [ kraxel: fix lm32 target build (milkymist-tmu2) ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-05-07qxl: fix local renderer crashGerd Hoffmann
Make sure we only ask the spice local renderer for display updates in case we have a valid primary surface. Without that spice is confused and throws errors in case a display update request (triggered by screendump for example) happens in parallel to a mode switch and hits the race window where the old primary surface is gone and the new isn't establisted yet. Cc: qemu-stable@nongnu.org Fixes: https://bugzilla.redhat.com//show_bug.cgi?id=1567733 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20180427115528.345-1-kraxel@redhat.com
2018-03-13secondary-vga: properly close QemuConsole on unplugGerd Hoffmann
Using the new graphic_console_close() function. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2018-03-12vga: fix region calculationGerd Hoffmann
Typically the scanline length and the line offset are identical. But in case they are not our calculation for region_end is incorrect. Using line_offset is fine for all scanlines, except the last one where we have to use the actual scanline length. Fixes: CVE-2018-7550 Reported-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org> Tested-by: Ross Lagerwall <ross.lagerwall@citrix.com> Message-id: 20180309143704.13420-1-kraxel@redhat.com
2018-03-06g364fb: fix DirtyBitmapSnapshot leakPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-03-01hw/sii9022: Add support for Silicon Image SII9022Linus Walleij
This adds support for emulating the Silicon Image SII9022 DVI/HDMI bridge. It's not very clever right now, it just acknowledges the switch into DDC I2C mode and back. Combining this with the existing DDC I2C emulation gives the right behavior on the Versatile Express emulation passing through the QEMU EDID to the emulated platform. Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Message-id: 20180227104903.21353-5-linus.walleij@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: explictly reset ddc_req/ddc_skip_finish/ddc] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-02-26virtio-gpu-3d: add support for second capability set (v4)Dave Airlie
Due to a kernel bug we can never increase the size of capability set 1, so introduce a new capability set in parallel, old userspace will continue to use the old set, new userspace will start using the new one when it detects a fixed kernel. v2: don't use a define from virglrenderer, just probe it. v3: fix compilation when virglrenderer disabled v4: fix style warning, just use ?: op instead. Signed-off-by: Dave Airlie <airlied@redhat.com> Message-id: 20180223023814.24459-1-airlied@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-02-13memory: hide memory_region_sync_dirty_bitmap behind DirtyBitmapSnapshotPaolo Bonzini
Simplify the users of memory_region_snapshot_and_clear_dirty, so that they do not have to call memory_region_sync_dirty_bitmap explicitly. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-02-13g364fb: switch to using DirtyBitmapSnapshotPaolo Bonzini
This removes the last user of memory_region_test_and_clear_dirty outside memory.c. Tested-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-02-09Include qapi/error.h exactly where neededMarkus Armbruster
This cleanup makes the number of objects depending on qapi/error.h drop from 1910 (out of 4743) to 1612 in my "build everything" tree. While there, separate #include from file comment with a blank line, and drop a useless comment on why qemu/osdep.h is included first. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20180201111846.21846-5-armbru@redhat.com> [Semantic conflict with commit 34e304e975 resolved, OSX breakage fixed]
2018-02-05exynos4210: workaround UBSAN compilation errorMarc-André Lureau
gcc 5.4.0-6ubuntu1~16.04.5 build with UBSAN enabled error: CC hw/display/exynos4210_fimd.o /home/petmay01/linaro/qemu-for-merges/hw/display/exynos4210_fimd.c: In function ‘fimd_get_buffer_id’: /home/petmay01/linaro/qemu-for-merges/hw/display/exynos4210_fimd.c:1105:5: error: case label does not reduce to an integer constant case FIMD_WINCON_BUF2_STAT: Because FIMD_WINCON_BUF2_STAT case contains an integer overflow, use U suffix to get the unsigned type. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20180116151152.4040-2-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-02-02virtio-gpu: disallow vIOMMUPeter Xu
virtio-gpu has special code path that bypassed vIOMMU protection. So for now let's disable iommu_platform for the device until we fully support that (if needed). After the patch, both virtio-vga and virtio-gpu won't allow to boot with iommu_platform parameter set. CC: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Message-id: 20180131040401.3550-1-peterx@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-26aarch64-softmmu.mak: Use an ARM specific configAlistair Francis
In preperation for having an ARM and MicroBlaze ZynqMP machine let's split out the current ARM specific config options. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Acked-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2018-01-25Merge remote-tracking branch ↵Peter Maydell
'remotes/pmaydell/tags/pull-target-arm-20180125' into staging target-arm queue: * target/arm: Fix address truncation in 64-bit pagetable walks * i.MX: Fix FEC/ENET receive functions * target/arm: preparatory refactoring for SVE emulation * hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending" * hw/intc/arm_gic: Fix C_RPR value on idle priority * hw/intc/arm_gic: Fix group priority computation for group 1 IRQs * hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1 * hw/arm/virt: Check that the CPU realize method succeeded * sdhci: fix a NULL pointer dereference due to uninitialized AddressSpace object * xilinx_spips: Correct usage of an uninitialized local variable * pl110: Implement vertical compare/next base interrupts # gpg: Signature made Thu 25 Jan 2018 12:59:25 GMT # gpg: using RSA key 0x3C2525ED14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" # gpg: aka "Peter Maydell <pmaydell@gmail.com>" # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * remotes/pmaydell/tags/pull-target-arm-20180125: (21 commits) pl110: Implement vertical compare/next base interrupts xilinx_spips: Correct usage of an uninitialized local variable sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object hw/arm/virt: Check that the CPU realize method succeeded hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1 hw/intc/arm_gic: Fix group priority computation for group 1 IRQs hw/intc/arm_gic: Fix C_RPR value on idle priority hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending" target/arm: Simplify fp_exception_el for user-only target/arm: Hoist store to flags output in cpu_get_tb_cpu_state target/arm: Move cpu_get_tb_cpu_state out of line target/arm: Add ARM_FEATURE_SVE vmstate: Add VMSTATE_UINT64_SUB_ARRAY target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers target/arm: Change the type of vfp.regs target/arm: Use pointers in neon tbl helper target/arm: Use pointers in neon zip/uzp helpers target/arm: Use pointers in crypto helpers target/arm: Mark disas_set_insn_syndrome inline i.MX: Fix FEC/ENET receive funtions ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25pl110: Implement vertical compare/next base interruptsLinus Walleij
This implements rudimentary support for interrupt generation on the PL110. I am working on a new DRI/KMS driver for Linux and since that uses the blanking interrupt, we need something to fire here. Without any interrupt support Linux waits for a while and then gives ugly messages about the vblank not working in the console (it does not hang perpetually or anything though, DRI is pretty forgiving). I solved it for now by setting up a timer to fire at 60Hz and pull the interrupts for "vertical compare" and "next memory base" at this interval. This works fine and fires roughly the same number of IRQs on QEMU as on the hardware and leaves the console clean and nice. People who want to create more accurate emulation can probably work on top of this if need be. It is certainly closer to the hardware behaviour than what we have today anyway. Cc: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Message-id: 20180123225654.5764-1-linus.walleij@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: folded long lines] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-25vga: check the validation of memory addr when draw textlinzhecheng
Start a vm with qemu-kvm -enable-kvm -vnc :66 -smp 1 -m 1024 -hda redhat_5.11.qcow2 -device pcnet -vga cirrus, then use VNC client to connect to VM, and excute the code below in guest OS will lead to qemu crash: int main() { iopl(3); srand(time(NULL)); int a,b; while(1){ a = rand()%0x100; b = 0x3c0 + (rand()%0x20); outb(a,b); } return 0; } The above code is writing the registers of VGA randomly. We can write VGA CRT controller registers index 0x0C or 0x0D (which is the start address register) to modify the the display memory address of the upper left pixel or character of the screen. The address may be out of the range of vga ram. So we should check the validation of memory address when reading or writing it to avoid segfault. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-id: 20180111132724.13744-1-linzhecheng@huawei.com Fixes: CVE-2018-5683 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-01-23Merge remote-tracking branch 'remotes/huth/tags/pull-request-2018-01-22' ↵Peter Maydell
into staging Pull request for various patches that have been reviewed and laying on the mailing list for a while, but apparently no maintainer feels really responsible for picking up. # gpg: Signature made Mon 22 Jan 2018 11:10:16 GMT # gpg: using RSA key 0x2ED9D774FE702DB5 # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" # gpg: aka "Thomas Huth <thuth@redhat.com>" # gpg: aka "Thomas Huth <huth@tuxfamily.org>" # gpg: aka "Thomas Huth <th.huth@posteo.de>" # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * remotes/huth/tags/pull-request-2018-01-22: hw/isa: Replace fprintf(stderr, "*\n" with error_report() hw/ipmi: Replace fprintf(stderr, "*\n" with error_report() hw/bt: Replace fprintf(stderr, "*\n" with error_report() Fixes after renaming __FUNCTION__ to __func__ Replace all occurances of __FUNCTION__ with __func__ tests/cpu-plug-test: Test CPU hot-plugging on s390x tests/cpu-plug-test: Check CPU hot-plugging on ppc64, too tests/cpu-plug-test: Check the CPU hot-plugging with device_add, too tests: Rename pc-cpu-test.c to cpu-plug-test.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-01-22Replace all occurances of __FUNCTION__ with __func__Alistair Francis
Replace all occurs of __FUNCTION__ except for the check in checkpatch with the non GCC specific __func__. One line in hcd-musb.c was manually tweaked to pass checkpatch. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> [THH: Removed hunks related to pxa2xx_mmci.c (fixed already)] Signed-off-by: Thomas Huth <thuth@redhat.com>
2018-01-20sm501: Add missing break to caseBALATON Zoltan
Noticed by Coverity, forgotten in 5690d9ece Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2018-01-16Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* QemuMutex tracing improvements (Alex) * ram_addr_t optimization (David) * SCSI fixes (Fam, Stefan, me) * do {} while (0) fixes (Eric) * KVM fix for PMU (Jan) * memory leak fixes from ASAN (Marc-André) * migration fix for HPET, icount, loadvm (Maria, Pavel) * hflags fixes (me, Tao) * block/iscsi uninitialized variable (Peter L.) * full support for GMainContexts in character devices (Peter Xu) * more boot-serial-test (Thomas) * Memory leak fix (Zhecheng) # gpg: Signature made Tue 16 Jan 2018 14:15:45 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (51 commits) scripts/analyse-locks-simpletrace.py: script to analyse lock times util/qemu-thread-*: add qemu_lock, locked and unlock trace events cpu: flush TB cache when loading VMState block/iscsi: fix initialization of iTask in iscsi_co_get_block_status find_ram_offset: Align ram_addr_t allocation on long boundaries find_ram_offset: Add comments and tracing cpu_physical_memory_sync_dirty_bitmap: Another alignment fix checkpatch: Enforce proper do/while (0) style maint: Fix macros with broken 'do/while(0); ' usage tests: Avoid 'do/while(false); ' in vhost-user-bridge chardev: Clean up previous patch indentation chardev: Use goto/label instead of do/break/while(0) mips: Tweak location of ';' in macros net: Drop unusual use of do { } while (0); irq: fix memory leak cpus: unify qemu_*_wait_io_event icount: fixed saving/restoring of icount warp timers scripts/qemu-gdb/timers.py: new helper to dump timer state scripts/qemu-gdb: add simple tcg lock status helper target-i386: update hflags on Hypervisor.framework ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-11 23:36:54 +0000