aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)Author
2020-06-30sm501: Use stn_he_p/ldn_he_p instead of switch/caseBALATON Zoltan
Instead of open coding op with different sizes using a switch and type casting it can be written more compactly using stn_he_p/ldn_he_p. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: e2f649cb286f0735a10ec87c1b36a7ae081acb61.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-30sm501: Optimise 1 pixel 2d opsBALATON Zoltan
Some guests do 1x1 blits which is faster to do directly than calling a function for it so avoid overhead in this case. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 7cccc302d7b4c5c313bad7681ac4686417143c3e.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-30sm501: Introduce variable for commonly used value for better readabilityBALATON Zoltan
The bytes per pixel value can be calculated from format but it's used freqently enough (and will be used more in subseqent patches) so store it in a variable for better readabilty. Also drop some unneded 0x prefix around where new variable is defined. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: b9ea5ef2d68583db9f3fb73a2b859abbd7c044a8.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-30sm501: Ignore no-op blitsBALATON Zoltan
Some guests seem to try source copy blits with same source and dest which are no-op so avoid calling pixman for these. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: a2a8214dd37344dfb65f1c343ace4cff2e94f3bb.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-30sm501: Drop unneded variableBALATON Zoltan
We don't need a separate variable to keep track if we allocated memory that needs to be freed as we can test the pointer itself. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: ff9136c3151a15cdfa1d9b7a68acf11cffb8efa4.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-30sm501: Fix bounds checksBALATON Zoltan
We don't need to add width to pitch when calculating last point, that would reject valid ops within the card's local_mem. Fixes: b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: ddb5781d12913bb9d6dbfd9e5b1e2b893e2b3e2d.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-15sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 3Markus Armbruster
These are init/realize pairs produced by the previous commit's Coccinelle script where the argument test doesn't quite match. They need even more careful review. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-50-armbru@redhat.com>
2020-06-15sysbus: Convert to sysbus_realize() etc. with CoccinelleMarkus Armbruster
Convert from qdev_realize(), qdev_realize_and_unref() with null @bus argument to sysbus_realize(), sysbus_realize_and_unref(). Coccinelle script: @@ expression dev, errp; @@ - qdev_realize(DEVICE(dev), NULL, errp); + sysbus_realize(SYS_BUS_DEVICE(dev), errp); @@ expression sysbus_dev, dev, errp; @@ + sysbus_dev = SYS_BUS_DEVICE(dev); - qdev_realize_and_unref(dev, NULL, errp); + sysbus_realize_and_unref(sysbus_dev, errp); - sysbus_dev = SYS_BUS_DEVICE(dev); @@ expression sysbus_dev, dev, errp; expression expr; @@ sysbus_dev = SYS_BUS_DEVICE(dev); ... when != dev = expr; - qdev_realize_and_unref(dev, NULL, errp); + sysbus_realize_and_unref(sysbus_dev, errp); @@ expression dev, errp; @@ - qdev_realize_and_unref(DEVICE(dev), NULL, errp); + sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp); @@ expression dev, errp; @@ - qdev_realize_and_unref(dev, NULL, errp); + sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp); Whitespace changes minimized manually. Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-46-armbru@redhat.com> [Conflicts in hw/misc/empty_slot.c and hw/sparc/leon3.c resolved]
2020-06-15sysbus: Tidy up sysbus_init_child_obj()'s @childsize arg, part 1Markus Armbruster
The callers of sysbus_init_child_obj() commonly pass either &child, sizeof(child), or pchild, sizeof(*pchild). Tidy up the few that use sizeof(child_type) instead, mostly to keep future commits simpler. Coccinelle script: @@ expression parent, propname, type; type T; T child; @@ - sysbus_init_child_obj(parent, propname, &child, sizeof(T), type) + sysbus_init_child_obj(parent, propname, &child, sizeof(child), type) @@ expression parent, propname, type; type T; T *child; @@ - sysbus_init_child_obj(parent, propname, child, sizeof(T), type) + sysbus_init_child_obj(parent, propname, child, sizeof(*child), type) Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-42-armbru@redhat.com>
2020-06-15auxbus: Eliminate aux_create_slave()Markus Armbruster
aux_create_slave() has become a trivial wrapper around qdev_new(). There's just one user. Eliminate. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-35-armbru@redhat.com>
2020-06-15auxbus: Convert a use of qdev_set_parent_bus()Markus Armbruster
Convert qdev_set_parent_bus()/qdev_init_nofail() to qdev_realize(); recent commit "qdev: New qdev_new(), qdev_realize(), etc." explains why. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-34-armbru@redhat.com>
2020-06-15auxbus: New aux_bus_realize(), pairing with aux_bus_init()Markus Armbruster
aux_bus_init() encapsulates the creation of an aux-bus and its aux-to-i2c-bridge device. Create aux_bus_realize() to similarly encapsulate their realization. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-33-armbru@redhat.com>
2020-06-15auxbus: Rename aux_init_bus() to aux_bus_init()Markus Armbruster
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-32-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2020-06-15qdev: Convert uses of qdev_set_parent_bus() with CoccinelleMarkus Armbruster
In addition to the qdev_create() patterns converted so far, we have a qdev_set_parent_bus() pattern. Mostly when we embed a device in a parent device rather than allocating it on the heap. This pattern also puts devices in the dangerous "no QOM parent, but plugged into bus" state I explained in recent commit "qdev: New qdev_new(), qdev_realize(), etc." Apply same solution: convert to qdev_realize(). Coccinelle script: @@ expression dev, bus, errp; symbol true; @@ - qdev_set_parent_bus(DEVICE(dev), bus); ... - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize(DEVICE(dev), bus, errp); @ depends on !(file in "qdev-monitor.c") && !(file in "hw/core/qdev.c")@ expression dev, bus, errp; symbol true; @@ - qdev_set_parent_bus(dev, bus); ... - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize(dev, bus, errp); @@ expression dev, bus; symbol true; @@ - qdev_set_parent_bus(DEVICE(dev), bus); ... - qdev_init_nofail(DEVICE(dev)); + qdev_realize(DEVICE(dev), bus, &error_fatal); Unconverted uses of qdev_set_parent_bus() remain. They'll be converted later in this series. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-12-armbru@redhat.com> [Also convert new hw/virtio/vhost-user-vsock-pci.c]
2020-06-15qdev: Convert uses of qdev_create() manuallyMarkus Armbruster
Same transformation as in the previous commit. Manual, because convincing Coccinelle to transform these cases is somewhere between not worthwhile and infeasible (at least for me). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-11-armbru@redhat.com>
2020-06-15qdev: Convert uses of qdev_create() with CoccinelleMarkus Armbruster
This is the transformation explained in the commit before previous. Takes care of just one pattern that needs conversion. More to come in this series. Coccinelle script: @ depends on !(file in "hw/arm/highbank.c")@ expression bus, type_name, dev, expr; @@ - dev = qdev_create(bus, type_name); + dev = qdev_new(type_name); ... when != dev = expr - qdev_init_nofail(dev); + qdev_realize_and_unref(dev, bus, &error_fatal); @@ expression bus, type_name, dev, expr; identifier DOWN; @@ - dev = DOWN(qdev_create(bus, type_name)); + dev = DOWN(qdev_new(type_name)); ... when != dev = expr - qdev_init_nofail(DEVICE(dev)); + qdev_realize_and_unref(DEVICE(dev), bus, &error_fatal); @@ expression bus, type_name, expr; identifier dev; @@ - DeviceState *dev = qdev_create(bus, type_name); + DeviceState *dev = qdev_new(type_name); ... when != dev = expr - qdev_init_nofail(dev); + qdev_realize_and_unref(dev, bus, &error_fatal); @@ expression bus, type_name, dev, expr, errp; symbol true; @@ - dev = qdev_create(bus, type_name); + dev = qdev_new(type_name); ... when != dev = expr - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize_and_unref(dev, bus, errp); @@ expression bus, type_name, expr, errp; identifier dev; symbol true; @@ - DeviceState *dev = qdev_create(bus, type_name); + DeviceState *dev = qdev_new(type_name); ... when != dev = expr - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize_and_unref(dev, bus, errp); The first rule exempts hw/arm/highbank.c, because it matches along two control flow paths there, with different @type_name. Covered by the next commit's manual conversions. Missing #include "qapi/error.h" added manually. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-10-armbru@redhat.com> [Conflicts in hw/misc/empty_slot.c and hw/sparc/leon3.c resolved]
2020-06-15display/sm501 display/ati: Fix to realize "i2c-ddc"Markus Armbruster
sm501_init() and ati_vga_realize() create an "i2c-ddc" device, but neglect to realize it. Affects machines sam460ex, shix, r2d, and fulong2e. In theory, a device becomes real only on realize. In practice, the transition from unreal to real is a fuzzy one. The work to make a device real can be spread between realize methods (fine), instance_init methods (wrong), and board code wiring up the device (fine as long as it effectively happens on realize). Depending on what exactly is done where, a device can work even when we neglect to realize it. This one appears to work. Nevertheless, it's a clear misuse of the interface. Even when it works today (more or less by chance), it can break tomorrow. Fix by realizing it right away. Visible in "info qom-tree"; here's the change for sam460ex: /machine (sam460ex-machine) [...] /unattached (container) [...] - /device[14] (sii3112) + /device[14] (i2c-ddc) + /device[15] (sii3112) [rest of device[*] renumbered...] Fixes: 4a1f253adb45ac6019971193d5077c4d5d55886a Fixes: c82c7336de58876862e6b4dccbda29e9240fd388 Cc: BALATON Zoltan <balaton@eik.bme.hu> Cc: qemu-ppc@nongnu.org Cc: Magnus Damm <magnus.damm@gmail.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200609122339.937862-19-armbru@redhat.com>
2020-06-15display/xlnx_dp: Fix to realize "i2c-ddc" and "aux-to-i2c-bridge"Markus Armbruster
xlnx_dp_init() creates these two devices, but they're never realized. Affects machine xlnx-zcu102. In theory, a device becomes real only on realize. In practice, the transition from unreal to real is a fuzzy one. The work to make a device real can be spread between realize methods (fine), instance_init methods (wrong), and board code wiring up the device (fine as long as it effectively happens on realize). Depending on what exactly is done where, a device can work even when we neglect to realize it. These two appear to work. Nevertheless, it's a clear misuse of the interface. Even when it works today (more or less by chance), it can break tomorrow. Fix by realizing them in xlnx_dp_realize(). Fixes: 58ac482a66de09a7590f705e53fc6a3fb8a055e8 Cc: KONRAD Frederic <fred.konrad@greensocs.com> Cc: Alistair Francis <alistair@alistair23.me> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200609122339.937862-3-armbru@redhat.com>
2020-06-05hw/display/cirrus_vga: Fix code mis-indentationPhilippe Mathieu-Daudé
While replacing fprintf() by qemu_log_mask() in commit 2b55f4d3504, we incorrectly used a 'tab = 4 spaces' alignment, leading to misindented new code. Fix now. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200529165436.23573-1-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-06-05ati-vga: check mm_index before recursive call (CVE-2020-13800)Prasad J Pandit
While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Remove obsolete changelog and todo commentBALATON Zoltan
Also update copyright year for latest changes Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 1392cad2ad1315a5a50409970e0af061821462e6.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Optimize small overlapping blitsBALATON Zoltan
AmigaOS tends to do a lot of small blits (even 1 pixel). Avoid malloc overhead by keeping around a buffer for this and only alloc when blitting larger areas. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 7946852258d528497e85f465327fc90b5c3b59fb.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Replace hand written implementation with pixman where possibleBALATON Zoltan
Besides being faster this should also prevent malicious guests to abuse 2D engine to overwrite data or cause a crash. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 58666389b6cae256e4e972a32c05cf8aa51bffc0.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Clean up local variables in sm501_2d_operationBALATON Zoltan
Make variables local to the block they are used in to make it clearer which operation they are needed for. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: ae59f8138afe7f6a5a4a82539d0f61496a906b06.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Use BIT(x) macro to shorten constantBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 124bf5de8d7cf503b32b377d0445029a76bfbd49.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Shorten long variable names in sm501_2d_operationBALATON Zoltan
This increases readability and cleans up some confusing naming. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: b9b67b94c46e945252a73c77dfd117132c63c4fb.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28sm501: Convert printf + abort to qemu_log_maskBALATON Zoltan
Some places already use qemu_log_mask() to log unimplemented features or errors but some others have printf() then abort(). Convert these to qemu_log_mask() and avoid aborting to prevent guests to easily cause denial of service. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 305af87f59d81e92f2aaff09eb8a3603b8baa322.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/pxa2xx_lcd: Replace printf() call by qemu_log_mask()Philippe Mathieu-Daudé
Replace printf() calls by qemu_log_mask(UNIMP), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-15-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/omap_dss: Replace fprintf() call by qemu_log_mask(LOG_UNIMP)Philippe Mathieu-Daudé
Replace fprintf() call by qemu_log_mask(LOG_UNIMP), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-14-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/exynos4210_fimd: Use qemu_log_mask(GUEST_ERROR)Philippe Mathieu-Daudé
Replace DPRINT_ERROR() by qemu_log_mask(GUEST_ERROR). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-13-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/vmware_vga: Let the PCI device own its I/O MemoryRegionPhilippe Mathieu-Daudé
To avoid the orphan I/O memory region being added in the /unattached QOM container, register the PCI device as its owner. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200526062252.19852-12-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/vmware_vga: Replace printf() calls by qemu_log_mask(ERROR)Philippe Mathieu-Daudé
Avoid flooding stdio by converting printf() calls to qemu_log_mask(GUEST_ERROR), which are disabled by default. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-11-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/xlnx_dp: Replace disabled DPRINTF() by error_report()Philippe Mathieu-Daudé
DPRINTF() calls are disabled by default, so when unexpected data is used, the whole process abort without information. Display a bit of information with error_report() before crashing. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-10-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/dpcd: Convert debug printf()s to trace eventsPhilippe Mathieu-Daudé
Convert DPRINTF() to trace events and remove ifdef'ry. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-9-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/dpcd: Fix memory region sizePhilippe Mathieu-Daudé
The memory region size is 512K. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-8-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Convert debug printf() to trace eventPhilippe Mathieu-Daudé
Convert the final bit of DEBUG_BITBLT to a tracepoint. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-7-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Use qemu_log_mask(ERROR) instead of debug printfPhilippe Mathieu-Daudé
Replace some debug printf() calls by qemu_log_mask(LOG_GUEST_ERROR). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-6-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Use qemu_log_mask(UNIMP) instead of debug printfPhilippe Mathieu-Daudé
Replace some debug printf() calls by qemu_log_mask(LOG_UNIMP), and add a new one in cirrus_linear_bitblt_read(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-5-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cirrus_vga: Convert debug printf() to trace eventPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-4-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-28hw/display/cg3: Convert debug printf()s to trace eventsPhilippe Mathieu-Daudé
Convert DPRINTF() to trace events and remove ifdef'ry. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-3-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-21hw/arm/pxa2xx: Replace hw_error() by qemu_log_mask()Philippe Mathieu-Daudé
hw_error() calls exit(). This a bit overkill when we can log the accesses as unimplemented or guest error. When fuzzing the devices, we don't want the whole process to exit. Replace some hw_error() calls by qemu_log_mask(). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200518140309.5220-3-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-18ramfb: fix size calculationGerd Hoffmann
size calculation isn't correct with guest-supplied stride, the last display line isn't accounted for correctly. For the typical case of stride > linesize (add padding) we error on the safe side (calculated size is larger than actual size). With stride < linesize (scanlines overlap) the calculated size is smaller than the actual size though so our guest memory mapping might end up being too small. While being at it also fix ramfb_create_display_surface to use hwaddr for the parameters. That way all calculation are done with hwaddr type and we can't get funny effects from type castings. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-7-kraxel@redhat.com
2020-05-18ramfb: add sanity checks to ramfb_create_display_surfaceGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-6-kraxel@redhat.com
2020-05-18ramfb: don't update RAMFBState on errorsGerd Hoffmann
Store width & height & surface in local variables. Update RAMFBState with the new values only in case the ramfb_create_display_surface() call succeeds. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-5-kraxel@redhat.com
2020-05-18ramfb: drop leftover debug messageGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-4-kraxel@redhat.com
2020-05-18Revert "hw/display/ramfb: lock guest resolution after it's set"Gerd Hoffmann
This reverts commit a9e0cb67b7f4c485755659f9b764c38b5f970de4. This breaks OVMF. Reproducer: Just hit 'ESC' at early boot to enter firmware setup. OVMF wants switch from (default) 800x600 to 640x480 for that, and this patch blocks it. Cc: Hou Qiming <hqm03ster@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-3-kraxel@redhat.com
2020-05-18Revert "hw/display/ramfb: initialize fw-config space with xres/ yres"Gerd Hoffmann
This reverts commit f79081b4b71b72640bedd40a7cd76f864c8287f1. Patch has broken byteorder handling: RAMFBCfg fields are in bigendian byteorder, the reset function doesn't care so native byteorder is used instead. Given this went unnoticed so far the feature is obviously unused, so just revert the patch. Cc: Hou Qiming <hqm03ster@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-2-kraxel@redhat.com
2020-05-18hw/display: Include local 'framebuffer.h'Philippe Mathieu-Daudé
The "framebuffer.h" header is not an exported include. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <huth@tuxfamily.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200504082003.16298-2-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-18ati-vga: Do not allow unaligned access via index registerBALATON Zoltan
According to docs bits 1 and 0 of MM_INDEX are hard coded to 0 so unaligned access via this register should not be possible. This also fixes problems reported in bug #1878134. Buglink: https://bugs.launchpad.net/qemu/+bug/1878134 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Alexander Bulekov <alxndr@bu.edu> Acked-by: Alexander Bulekov <alxndr@bu.edu> Message-id: 20200516132352.39E9374594E@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-05-15hw: Remove unnecessary DEVICE() castPhilippe Mathieu-Daudé
The DEVICE() macro is defined as: #define DEVICE(obj) OBJECT_CHECK(DeviceState, (obj), TYPE_DEVICE) which expands to: ((DeviceState *)object_dynamic_cast_assert((Object *)(obj), (name), __FILE__, __LINE__, __func__)) This assertion can only fail when @obj points to something other than its stated type, i.e. when we're in undefined behavior country. Remove the unnecessary DEVICE() casts when we already know the pointer is of DeviceState type. Patch created mechanically using spatch with this script: @@ typedef DeviceState; DeviceState *s; @@ - DEVICE(s) + s Acked-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Paul Durrant <paul@xen.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: John Snow <jsnow@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200512070020.22782-4-f4bug@amsat.org>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 21:28:25 +0000