aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)Author
2023-11-07ati-vga: Implement fallback for pixman routinesBALATON Zoltan
Pixman routines can fail if no implementation is available and it will become optional soon so add fallbacks when pixman does not work. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <ed0fba3f74e48143f02228b83bf8796ca49f3e7d.1698871239.git.balaton@eik.bme.hu> (cherry picked from commit 08730ee0cc01c3fceb907a93436d15170a7556c4) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-10-05hw/display/ramfb: plug slight guest-triggerable leak on mode settingLaszlo Ersek
The fw_cfg DMA write callback in ramfb prepares a new display surface in QEMU; this new surface is put to use ("swapped in") upon the next display update. At that time, the old surface (if any) is released. If the guest triggers the fw_cfg DMA write callback at least twice between two adjacent display updates, then the second callback (and further such callbacks) will leak the previously prepared (but not yet swapped in) display surface. The issue can be shown by: (1) starting QEMU with "-trace displaysurface_free", and (2) running the following program in the guest UEFI shell: > #include <Library/ShellCEntryLib.h> // ShellAppMain() > #include <Library/UefiBootServicesTableLib.h> // gBS > #include <Protocol/GraphicsOutput.h> // EFI_GRAPHICS_OUTPUT_PROTOCOL > > INTN > EFIAPI > ShellAppMain ( > IN UINTN Argc, > IN CHAR16 **Argv > ) > { > EFI_STATUS Status; > VOID *Interface; > EFI_GRAPHICS_OUTPUT_PROTOCOL *Gop; > UINT32 Mode; > > Status = gBS->LocateProtocol ( > &gEfiGraphicsOutputProtocolGuid, > NULL, > &Interface > ); > if (EFI_ERROR (Status)) { > return 1; > } > > Gop = Interface; > > Mode = 1; > for ( ; ;) { > Status = Gop->SetMode (Gop, Mode); > if (EFI_ERROR (Status)) { > break; > } > > Mode = 1 - Mode; > } > > return 1; > } The symptom is then that: - only one trace message appears periodically, - the time between adjacent messages keeps increasing -- implying that some list structure (containing the leaked resources) keeps growing, - the "surface" pointer is ever different. > 18566@1695127471.449586:displaysurface_free surface=0x7f2fcc09a7c0 > 18566@1695127471.529559:displaysurface_free surface=0x7f2fcc9dac10 > 18566@1695127471.659812:displaysurface_free surface=0x7f2fcc441dd0 > 18566@1695127471.839669:displaysurface_free surface=0x7f2fcc0363d0 > 18566@1695127472.069674:displaysurface_free surface=0x7f2fcc413a80 > 18566@1695127472.349580:displaysurface_free surface=0x7f2fcc09cd00 > 18566@1695127472.679783:displaysurface_free surface=0x7f2fcc1395f0 > 18566@1695127473.059848:displaysurface_free surface=0x7f2fcc1cae50 > 18566@1695127473.489724:displaysurface_free surface=0x7f2fcc42fc50 > 18566@1695127473.969791:displaysurface_free surface=0x7f2fcc45dcc0 > 18566@1695127474.499708:displaysurface_free surface=0x7f2fcc70b9d0 > 18566@1695127475.079769:displaysurface_free surface=0x7f2fcc82acc0 > 18566@1695127475.709941:displaysurface_free surface=0x7f2fcc369c00 > 18566@1695127476.389619:displaysurface_free surface=0x7f2fcc32b910 > 18566@1695127477.119772:displaysurface_free surface=0x7f2fcc0d5a20 > 18566@1695127477.899517:displaysurface_free surface=0x7f2fcc086c40 > 18566@1695127478.729962:displaysurface_free surface=0x7f2fccc72020 > 18566@1695127479.609839:displaysurface_free surface=0x7f2fcc185160 > 18566@1695127480.539688:displaysurface_free surface=0x7f2fcc23a7e0 > 18566@1695127481.519759:displaysurface_free surface=0x7f2fcc3ec870 > 18566@1695127482.549930:displaysurface_free surface=0x7f2fcc634960 > 18566@1695127483.629661:displaysurface_free surface=0x7f2fcc26b140 > 18566@1695127484.759987:displaysurface_free surface=0x7f2fcc321700 > 18566@1695127485.940289:displaysurface_free surface=0x7f2fccaad100 We figured this wasn't a CVE-worthy problem, as only small amounts of memory were leaked (the framebuffer itself is mapped from guest RAM, QEMU only allocates administrative structures), plus libvirt restricts QEMU memory footprint anyway, thus the guest can only DoS itself. Plug the leak, by releasing the last prepared (not yet swapped in) display surface, if any, in the fw_cfg DMA write callback. Regarding the "reproducer", with the fix in place, the log is flooded with trace messages (one per fw_cfg write), *and* the trace message alternates between just two "surface" pointer values (i.e., nothing is leaked, the allocator flip-flops between two objects in effect). This issue appears to date back to the introducion of ramfb (995b30179bdc, "hw/display: add ramfb, a simple boot framebuffer living in guest ram", 2018-06-18). Cc: Gerd Hoffmann <kraxel@redhat.com> (maintainer:ramfb) Cc: qemu-stable@nongnu.org Fixes: 995b30179bdc Signed-off-by: Laszlo Ersek <lersek@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20230919131955.27223-1-lersek@redhat.com> (cherry picked from commit e0288a778473ebd35eac6cc1924faca7d477d241) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-09-11qxl: don't assert() if device isn't yet initializedMarc-André Lureau
If the PCI BAR isn't yet mapped or was unmapped, QXL_IO_SET_MODE will assert(). Instead, report a guest bug and keep going. This can be reproduced with: cat << EOF | ./qemu-system-x86_64 -vga qxl -m 2048 -nodefaults -qtest stdio outl 0xcf8 0x8000101c outl 0xcfc 0xc000 outl 0xcf8 0x80001001 outl 0xcfc 0x01000000 outl 0xc006 0x00 EOF Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1829 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit 95bef686e490bc3afc3f51f5fc6e20bf260b938c) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-09-11hw: replace most qemu_bh_new calls with qemu_bh_new_guardedAlexander Bulekov
This protects devices from bh->mmio reentrancy issues. Thanks: Thomas Huth <thuth@redhat.com> for diagnosing OS X test failure. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230427211013.2994127-5-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit f63192b0544af5d3e4d5edfd85ab520fcf671377) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-28virtio-gpu: Make non-gl display updates work again when blob=trueVivek Kasireddy
In the case where the console does not have gl capability, and if blob is set to true, make sure that the display updates still work. Commit e86a93f55463 accidentally broke this by misplacing the return statement (in resource_flush) causing the updates to be silently ignored. Fixes: e86a93f55463 ("virtio-gpu: splitting one extended mode guest fb into n-scanouts") Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Dongwon Kim <dongwon.kim@intel.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20230623060454.3749910-1-vivek.kasireddy@intel.com> (cherry picked from commit 34e29d85a7734802317c4cac9ad52b10d461c1dc) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2022-12-03hw/display/next-fb: Fix comment typoEvgeny Ermakov
Signed-off-by: Evgeny Ermakov <evgeny.v.ermakov@gmail.com> Message-Id: <20221125160849.23711-1-evgeny.v.ermakov@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-11-29hw/display/qxl: Assert memory slot fits in preallocated MemoryRegionPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20221128202741.4945-6-philmd@linaro.org>
2022-11-29hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144)Philippe Mathieu-Daudé
Have qxl_get_check_slot_offset() return false if the requested buffer size does not fit within the slot memory region. Similarly qxl_phys2virt() now returns NULL in such case, and qxl_dirty_one_surface() aborts. This avoids buffer overrun in the host pointer returned by memory_region_get_ram_ptr(). Fixes: CVE-2022-4144 (out-of-bounds read) Reported-by: Wenxu Yin (@awxylitol) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20221128202741.4945-5-philmd@linaro.org>
2022-11-29hw/display/qxl: Pass requested buffer size to qxl_phys2virt()Philippe Mathieu-Daudé
Currently qxl_phys2virt() doesn't check for buffer overrun. In order to do so in the next commit, pass the buffer size as argument. For QXLCursor in qxl_render_cursor() -> qxl_cursor() we verify the size of the chunked data ahead, checking we can access 'sizeof(QXLCursor) + chunk->data_size' bytes. Since in the SPICE_CURSOR_TYPE_MONO case the cursor is assumed to fit in one chunk, no change are required. In SPICE_CURSOR_TYPE_ALPHA the ahead read is handled in qxl_unpack_chunks(). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20221128202741.4945-4-philmd@linaro.org>
2022-11-29hw/display/qxl: Document qxl_phys2virt()Philippe Mathieu-Daudé
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20221128202741.4945-3-philmd@linaro.org>
2022-11-29hw/display/qxl: Have qxl_log_command Return early if no log_cmd handlerPhilippe Mathieu-Daudé
Only 3 command types are logged: no need to call qxl_phys2virt() for the other types. Using different cases will help to pass different structure sizes to qxl_phys2virt() in a pair of commits. Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20221128202741.4945-2-philmd@linaro.org>
2022-11-10display: include dependencies explicitlyMichael S. Tsirkin
acpi-vga-stub.c pulls in vga_int.h However that currently pulls in ui/console.h which breaks e.g. on systems without pixman. It's better to remove ui/console.h from vga_int.h and directly include it where it's used. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20221109222112.74519-1-mst@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reported-by: Miroslav Rezanina <mrezanin@redhat.com> Reported-by: Frederic Bezies <fredbezies@gmail.com> Reported-by: Laurent Vivier <lvivier@redhat.com> Fixes: cfead31326 ("AcpiDevAmlIf interface to build VGA device descs") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2022-11-08Merge tag 'pull-request-2022-11-08' of https://gitlab.com/thuth/qemu into ↵Stefan Hajnoczi
staging * Last minute s390x fixes before the hard freeze * Whiste space clean-up in ui/, display/ and hw/usb/ # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmNqPZ0RHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbVbwxAArAxJewpow+QBj7dMd6qLrpC7mjxgiiQD # F8XNYh6bPpPo3+4exmMKMS+DGSLC5TJnp61F4IHyH+yOx8DVWmrjo97q+nWYYD4y # jOdC5a2kzkMzVjrxy26uvPhoUGkiM5w8H5bF9hcWukuEwqpoJPU7u5RXd1yn48Ju # O1RrASw+rHZSnCGFFXldG2HoS+bUOaZRHQs5kV9EwpqEn42eQtq38CQ7YEMloOkD # FpPl75KEQ9/doqSbGLdFP1HzaG/emtFnioIXlGM3Y7RzDxCgvKTdAvPCOBO7LxHA # oOY/nFcRYIEUslvyZLUXahKE2qBv2nenmWAQ9lwGd/iU78nWzR19BZdpItSP3Sjj # HFLOKztqI8qLbx966uOU8O5FaYqfGPV6QZVOSzAl7u8GZbqpN5lp+uArEoGtawMo # 9fRDAgSoser9AAIWr1TOoFGRff3VT4hlZeale3VOmfxAOBc2r70pzvk3ou5mo8NU # VXb6Uz5nNIm8RV9fr6/jgllfQDMiCHSwaAnC1hABqAwatcU/SJ4dKfXbdwjsPN8V # jgC5GqAHaC9mwQu0rfZSzuGZkosh0MZVik/xcWO3hspT/CyIafpi42POyQEjOMYf # 5SgJ8ydV32xEGQw66cl9yLAuhN4F8eTavLwQBV7pmCeySm8HCFGuZrmQkeOTBTD2 # HEbJJjz9zgI= # =P8Mt # -----END PGP SIGNATURE----- # gpg: Signature made Tue 08 Nov 2022 06:29:33 EST # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2022-11-08' of https://gitlab.com/thuth/qemu: hw/usb: fix tab indentation hw/display: fix tab indentation ui: fix tab indentation s390x/s390-virtio-ccw: Switch off zPCI enhancements on older machines Revert "s390x/s390-virtio-ccw: add zpcii-disable machine property" Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-11-08hw/display: fix tab indentationAmarjargal Gundjalam
The TABs should be replaced with spaces, to make sure that we have a consistent coding style with an indentation of 4 spaces everywhere. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/370 Signed-off-by: Amarjargal Gundjalam <amarjargal16@gmail.com> Message-Id: <5cefd05b4d3721d416e48e6df19df18cb6338933.1666707782.git.amarjargal16@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-11-07acpi: pc: vga: use AcpiDevAmlIf interface to build VGA device descriptorsIgor Mammedov
NB: We do not expect any functional change in any ACPI tables with this change. It's only a refactoring. NB2: Some targets (or1k) do not support acpi and CONFIG_ACPI is off for them. However, modules are reused between all architectures so CONFIG_ACPI is on. For those architectures, dummy stub function definitions help to resolve symbols. This change uses more of these and so it adds a couple of dummy stub definitions so that symbols for those can be resolved. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Message-Id: <20221017102146.2254096-2-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Ani Sinha <ani@anisinha.ca> CC: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Ani Sinha <ani@anisinha.ca> Message-Id: <20221107152744.868434-1-ani@anisinha.ca>
2022-10-22Drop useless casts from g_malloc() & friends to pointerMarkus Armbruster
These memory allocation functions return void *, and casting to another pointer type is useless clutter. Drop these casts. If you really want another pointer type, consider g_new(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220923120025.448759-3-armbru@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-10-12cirrus_vga: fix potential memory overflowlu zhipeng
Signed-off-by: lu zhipeng <luzhipeng@cestc.cn> Message-Id: <20220929122352.1891-1-luzhipeng@cestc.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-29vhost-user: Call qemu_socketpair() instead of socketpair()Guoyi Tu
As the close-on-exec flags is not set on the file descriptors returned by socketpair() at default, the fds will survive across exec' function. In the case that exec' function get invoked, such as the live-update feature which is been developing, it will cause fd leaks. To address this problem, we should call qemu_socketpair() to create an pair of connected sockets with the close-on-exec flag set. Signed-off-by: Guoyi Tu <tugy@chinatelecom.cn> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <7002b12a5fb0a30cd878e14e07da61c36da72913.1661240709.git.tugy@chinatelecom.cn>
2022-09-27virtio-gpu: update scanout if there is any area covered by the rectDongwon Kim
The scanout is currently updated only if the whole rect is inside the scanout space. This is not a correct condition because the scanout should be updated even a small area in the scanout space is covered by the rect. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220909014052.7297-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-27hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638)Philippe Mathieu-Daudé
When building QEMU with DEBUG_ATI defined then running with '-device ati-vga,romfile="" -d unimp,guest_errors -trace ati\*' we get: ati_mm_write 4 0x16c0 DP_CNTL <- 0x1 ati_mm_write 4 0x146c DP_GUI_MASTER_CNTL <- 0x2 ati_mm_write 4 0x16c8 DP_MIX <- 0xff0000 ati_mm_write 4 0x16c4 DP_DATATYPE <- 0x2 ati_mm_write 4 0x224 CRTC_OFFSET <- 0x0 ati_mm_write 4 0x142c DST_PITCH_OFFSET <- 0xfe00000 ati_mm_write 4 0x1420 DST_Y <- 0x3fff ati_mm_write 4 0x1410 DST_HEIGHT <- 0x3fff ati_mm_write 4 0x1588 DST_WIDTH_X <- 0x3fff3fff ati_2d_blt: vram:0x7fff5fa00000 addr:0 ds:0x7fff61273800 stride:2560 bpp:32 rop:0xff ati_2d_blt: 0 0 0, 0 127 0, (0,0) -> (16383,16383) 16383x16383 > ^ ati_2d_blt: pixman_fill(dst:0x7fff5fa00000, stride:254, bpp:8, x:16383, y:16383, w:16383, h:16383, xor:0xff000000) Thread 3 "qemu-system-i38" received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff7f62ce0 in sse2_fill.lto_priv () at /lib64/libpixman-1.so.0 #1 0x00007ffff7f09278 in pixman_fill () at /lib64/libpixman-1.so.0 #2 0x0000555557b5a9af in ati_2d_blt (s=0x631000028800) at hw/display/ati_2d.c:196 #3 0x0000555557b4b5a2 in ati_mm_write (opaque=0x631000028800, addr=5512, data=1073692671, size=4) at hw/display/ati.c:843 #4 0x0000555558b90ec4 in memory_region_write_accessor (mr=0x631000039cc0, addr=5512, ..., size=4, ...) at softmmu/memory.c:492 Commit 584acf34cb0 ("ati-vga: Fix reverse bit blts") introduced the local dst_x and dst_y which adjust the (x, y) coordinates depending on the direction in the SRCCOPY ROP3 operation, but forgot to address the same issue for the PATCOPY, BLACKNESS and WHITENESS operations, which also call pixman_fill(). Fix that now by using the adjusted coordinates in the pixman_fill call, and update the related debug printf(). Reported-by: Qiang Liu <qiangliu@zju.edu.cn> Fixes: 584acf34cb0 ("ati-vga: Fix reverse bit blts") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20210906153103.1661195-1-philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-08-08xlnx_dp: drop unsupported AUXCommand in xlnx_dp_aux_set_commandQiang Liu
In xlnx_dp_aux_set_command, when the command leads to the default branch, xlxn-dp will abort and then crash. This patch removes this abort and drops this operation. Fixes: 58ac482 ("introduce xlnx-dp") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/411 Reported-by: Qiang Liu <cyruscyliu@gmail.com> Tested-by: Qiang Liu <cyruscyliu@gmail.com> Suggested-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Qiang Liu <cyruscyliu@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Frederic Konrad <fkonrad@amd.com> Message-Id: <20220808080116.2184881-1-cyruscyliu@gmail.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-07-28vga: fix incorrect line height in 640x200x2 modePaolo Bonzini
When in CGA modes, QEMU wants to ignore the maximum scan field (bits 0..4) of the maximum scan length register in the CRTC. It is not clear why this is needed---for example, Bochs ignores bit 7 instead. The issue is that the CGA modes are not detected correctly, and in particular mode 6 results in multi_scan==3 according to how SeaBIOS programs it. The right way to check for CGA graphics modes is to check whether bit 13 of the address is special cased by the CRT controller to achieve line interleaving, i.e. whether bit 0 of the CRTC mode control register is clear. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1020 Reported-by: Korneliusz Osmenda <korneliuszo@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-07-26hw/display/bcm2835_fb: Fix framebuffer allocation addressAlan Jian
This patch fixes the dedicated framebuffer mailbox interface by removing an unneeded offset. This means that we pick the framebuffer address in the same way that we do if the guest code uses the buffer allocate mechanism of the bcm2835_property interface (case 0x00040001: /* Allocate buffer */ in bcm2835_property.c). The documentation of this mailbox interface doesn't say anything about using parts of the request buffer address to affect the chosen framebuffer address: https://github.com/raspberrypi/firmware/wiki/Mailbox-framebuffer-interface Some baremetal applications like the Screen01/Screen02 examples from Baking Pi tutorial[1] didn't work before this patch. [1] https://www.cl.cam.ac.uk/projects/raspberrypi/tutorials/os/screen01.html Signed-off-by: Alan Jian <alanjian85@outlook.com> Message-id: 20220725145838.8412-1-alanjian85@outlook.com [PMM: tweaked commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-30hw/i2c: add asynchronous sendKlaus Jensen
Add an asynchronous version of i2c_send() that requires the slave to explicitly acknowledge on the bus with i2c_ack(). The current master must use the new i2c_start_send_async() to indicate that it wants to do an asynchronous transfer. This allows the i2c core to check if the target slave supports this or not. This approach relies on adding a new enum i2c_event member, which is why a bunch of other devices needs changes in their event handling switches. Signed-off-by: Klaus Jensen <k.jensen@samsung.com> Message-Id: <20220601210831.67259-5-its@irrelevant.dk> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20220630045133.32251-6-me@pjd.dev> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2022-06-26artist: set memory region owners for buffers to the artist deviceMark Cave-Ayland
This fixes the output of "info qom-tree" so that the buffers appear as children of the artist device, rather than underneath the "unattached" container. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220624160839.886649-1-mark.cave-ayland@ilande.co.uk> Reviewed-by: Helge Deller <deller@gmx.de>
2022-06-14virtio-gpu: Respect UI refresh rate for EDIDAkihiko Odaki
Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220226115516.59830-4-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14ui: Deliver refresh rate via QemuUIInfoAkihiko Odaki
This change adds a new member, refresh_rate to QemuUIInfo in include/ui/console.h. It represents the refresh rate of the physical display backend, and it is more appropriate than GUI update interval as the refresh rate which the emulated device reports: - sdl may set GUI update interval shorter than the refresh rate of the physical display to respond to user-generated events. - sdl and vnc aggressively changes GUI update interval, but a guests is typically not designed to respond to frequent refresh rate changes, or frequent "display mode" changes in general. The frequency of refresh rate changes of the physical display backend matches better to the guest's expectation. QemuUIInfo also has other members representing "display mode", which makes it suitable for refresh rate representation. It has a throttling of update notifications, and prevents frequent changes of the display mode. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220226115516.59830-3-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14ui/console: Do not return a value with ui_infoAkihiko Odaki
The returned value is not used and misleading. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220226115516.59830-2-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-14virtio-gpu: update done only on the scanout associated with rectDongwon Kim
It only needs to update the scanouts containing the rect area coming with the resource-flush request from the guest. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20220505214030.4261-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-06-08xlnx_dp: Fix the interrupt disable logicSai Pavan Boddu
Fix interrupt disable logic. Mask value 1 indicates that interrupts are disabled. Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Frederic Konrad <fkonrad@amd.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220601172353.3220232-4-fkonrad@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-08xlnx_dp: Introduce a vblank signalSai Pavan Boddu
Add a periodic timer which raises vblank at a frequency of 30Hz. Note that this is a migration compatibility break for the xlnx-zcu102 board type. Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Frederic Konrad <fkonrad@amd.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220601172353.3220232-3-fkonrad@xilinx.com Changes by fkonrad: - Switched to transaction-based ptimer API. - Added the DP_INT_VBLNK_START macro. Signed-off-by: Frederic Konrad <fkonrad@amd.com> [PMM: bump vmstate version, add commit message note about compat break] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-08xlnx_dp: fix the wrong register sizeFrederic Konrad
The core and the vblend registers size are wrong, they should respectively be 0x3B0 and 0x1E0 according to: https://www.xilinx.com/htmldocs/registers/ug1087/ug1087-zynq-ultrascale-registers.html. Let's fix that and use macros when creating the mmio region. Fixes: 58ac482a66d ("introduce xlnx-dp") Signed-off-by: Frederic Konrad <fkonrad@amd.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20220601172353.3220232-2-fkonrad@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-06-06modules: introduces module_kconfig directiveJose R. Ziviani
module_kconfig is a new directive that should be used with module_obj whenever that module depends on the Kconfig to be enabled. When the module is enabled in Kconfig we are sure that its dependencies will be enabled as well, thus the module will be loaded without any problem. The correct way to use module_kconfig is by passing the Kconfig option to module_kconfig (or the *config-devices.mak without CONFIG_). Signed-off-by: Jose R. Ziviani <jziviani@suse.de> Signed-off-by: Dario Faggioli <dfaggioli@suse.com> Message-Id: <165369002370.5857.12150544416563557322.stgit@work> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-05-18Merge tag 'artist-cursor-fix-final-pull-request' of ↵Richard Henderson
https://github.com/hdeller/qemu-hppa into staging hppa: Artist graphics driver fixes for HP-UX and keyboard fix in firmware boot console This series updates the SeaBIOS-hppa firmware to version 5, in which additional HP fonts were added to the firmware and the firmware boot console was fixed to accept input from the emulated PS/2 keyboard when running in graphical mode (serial console was working before already). To test use the "-boot menu=on" qemu option. The artist graphics card driver got various fixes when running the X11-Windows on HP-UX: - fixes the horizontal and vertical postioning of the X11 cursor with HP-UX - allows X11 to blank the screen (e.g. screensaver) - allows the X11 driver to turn the X11 cursor on/off Signed-off-by: Helge Deller <deller@gmx.de> -- Changes compared to version 2 of this series: - Fixed style issues in the X-cursor positioning patch (noticed by Mark Cave-Ayland) Changes compared to version 1 of this series: - Added some Acked-by's from Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> - SeaBIOS-hppa v5 instead of v4 (PS/2 keyboard now works in boot console) - integrated artist X11 X-cusor positioning fix (which was sent serperately before) -- This series should apply cleanly on git head and can be pulled for testing from: https://github.com/hdeller/qemu-hppa.git artist-cursor-fix-final # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCYoUcLwAKCRD3ErUQojoP # X/joAQCmuV5MD+BTWf91fRTfzXSfOYSp1XahTaItUldKG2ZBWQD+Lflhsoyg4xLd # 2daeDRN1tH2HWldjnCPyMyZ5Ag97PwY= # =ZrTm # -----END PGP SIGNATURE----- # gpg: Signature made Wed 18 May 2022 09:17:51 AM PDT # gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F # gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown] # gpg: aka "Helge Deller <deller@kernel.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603 # Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F * tag 'artist-cursor-fix-final-pull-request' of https://github.com/hdeller/qemu-hppa: artist: Fix X cursor position calculation in X11 artist: Emulate screen blanking artist: Allow to turn cursor on or off artist: Fix vertical X11 cursor position in HP-UX artist: Use human-readable variable names instead of reg_xxx artist: Introduce constant for max cursor size seabios-hppa: Update SeaBIOS-hppa to VERSION 5 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-05-16artist: Fix X cursor position calculation in X11Helge Deller
The X cursor postion can be calculated based on the backporch and interleave values. In the emulation we ignore the HP-UX settings for backporch and use instead twice the size of the emulated cursor. With those changes the X-position of the graphics cursor is now finally working correctly on HP-UX 10 and HP-UX 11. Based on coding in Xorg X11R6.6 Signed-off-by: Helge Deller <deller@gmx.de>
2022-05-16artist: Emulate screen blankingHelge Deller
The misc_video and misc_ctrl registers control the visibility of the screen. Start with the screen turned on, and hide or show the screen based on the control registers. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Allow to turn cursor on or offHelge Deller
Bit 0x80 in the cursor_cntrl register specifies if the cursor should be visible. Prevent rendering the cursor if it's invisible. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Fix vertical X11 cursor position in HP-UXHelge Deller
Drop the hard-coded value of 1146 lines which seems to work with HP-UX 11, but not with HP-UX 10. Instead encode the screen height in byte 0 of active_lines_low and byte 3 of misc_video as it's expected by the Xorg X11 graphics driver. This potentially allows for higher vertical screen resolutions than 1280x1024 with X11. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Use human-readable variable names instead of reg_xxxHelge Deller
Convert the variable names of some registers to human-readable and understandable names. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16artist: Introduce constant for max cursor sizeHelge Deller
Add the constant NGLE_MAX_SPRITE_SIZE which defines the currently maximum supported cursor size. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-16virtio: add vhost support for virtio devicesJonah Palmer
This patch adds a get_vhost() callback function for VirtIODevices that returns the device's corresponding vhost_dev structure, if the vhost device is running. This patch also adds a vhost_started flag for VirtIODevices. Previously, a VirtIODevice wouldn't be able to tell if its corresponding vhost device was active or not. Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <1648819405-25696-3-git-send-email-jonah.palmer@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-05-16virtio: drop name parameter for virtio_init()Jonah Palmer
This patch drops the name parameter for the virtio_init function. The pair between the numeric device ID and the string device ID (name) of a virtio device already exists, but not in a way that lets us map between them. This patch lets us do this and removes the need for the name parameter in the virtio_init function. Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com> Message-Id: <1648819405-25696-2-git-send-email-jonah.palmer@oracle.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2022-05-08artist: only render dirty scanlines on the display surfaceMark Cave-Ayland
The framebuffer_update_display() function returns the dirty scanlines that were touched since the last display update, however artist_update_display() always calls dpy_gfx_update() with start and end scanlines of 0 and s->height causing the entire display surface to be rendered on every update. Update artist_update_display() so that dpy_gfx_update() only renders the dirty scanlines on the display surface, bypassing the display surface rendering completely if framebuffer_update_display() indicates no changes occurred. This noticeably improves boot performance when the framebuffer is enabled on my rather modest laptop here, including making the GTK UI usable. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220504153708.10352-4-mark.cave-ayland@ilande.co.uk> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-08artist: remove unused ROP8OFF() macroMark Cave-Ayland
This macro is unused and so can simply be removed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220504153708.10352-3-mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-05-08artist: checkpatch and newline style fixesMark Cave-Ayland
Ensure that subsequent patches do not cause checkpatch to fail and also tidy up extra/missing newlines. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220504153708.10352-2-mark.cave-ayland@ilande.co.uk> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Helge Deller <deller@gmx.de> Reviewed-by: Sven Schnelle <svens@stackframe.org> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2022-04-22hw/display/vmware_vga: do not discard screen updatesCarwyn Ellis
In certain circumstances, typically when there is lots changing on the screen, updates will be discarded resulting in garbled output. This change simplifies the traversal of the display update FIFO queue when applying updates. We just track the queue length and iterate up to the end of the queue. Additionally when adding updates to the queue, if the buffer reaches capacity we force a flush before accepting further events. Signed-off-by: Carwyn Ellis <carwynellis@gmail.com> Message-Id: <20220206183956.10694-3-carwynellis@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-19Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson
* Add cpu0-id to query-sev-capabilities * whpx support for breakpoints and stepping * initial support for Hyper-V Synthetic Debugging * use monotonic clock for QemuCond and QemuSemaphore * Remove qemu-common.h include from most units and lots of other clenaups * do not include headers for all virtio devices in virtio-ccw.h # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmJXCQAUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNT6wf+NHDJUEdDiwaVGVTGXgHuiaycsymi # FpNPiw/+XxSGN5xF3fkUGgqaDrcwIYwVfnXlghKSz8kp1cP3cjxa5CzNMLGTp5je # N6BxFbD7yC6dhagGm3mj32jlsptv3M38OHqKc3t+RaUAotP5RF2VdCyfUBLG6vU0 # aMzvMfMtB5aG0D8Fr5EV63t1JMTceFU0YxsG73UCFs2Yx4Z0cGBbNxMbHweRhd1q # tPeVDS46MFPM3/2cGGHpeeqxkoCTU7A9j1VuNQI3k+Kg+6W5YVxiK/UP7bw77E/a # yAHsmIVTNro8ajMBch73weuHtGtdfFLvCKc6QX6aVjzK4dF1voQ01E7gPQ== # =rMle # -----END PGP SIGNATURE----- # gpg: Signature made Wed 13 Apr 2022 10:31:44 AM PDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [undefined] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (53 commits) target/i386: Remove unused XMMReg, YMMReg types and CPUState fields target/i386: do not access beyond the low 128 bits of SSE registers virtio-ccw: do not include headers for all virtio devices virtio-ccw: move device type declarations to .c files virtio-ccw: move vhost_ccw_scsi to a separate file s390x: follow qdev tree to detect SCSI device on a CCW bus hw: hyperv: Initial commit for Synthetic Debugging device hyperv: Add support to process syndbg commands hyperv: Add definitions for syndbg hyperv: SControl is optional to enable SynIc thread-posix: optimize qemu_sem_timedwait with zero timeout thread-posix: implement Semaphore with QemuCond and QemuMutex thread-posix: use monotonic clock for QemuCond and QemuSemaphore thread-posix: remove the posix semaphore support whpx: Added support for breakpoints and stepping build-sys: simplify AF_VSOCK check build-sys: drop ntddscsi.h check Remove qemu-common.h include from most units qga: remove explicit environ argument from exec/spawn Move fcntl_setfl() to oslib-posix ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2022-04-07ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)Mauro Matteo Cascella
Prevent potential integer overflow by limiting 'width' and 'height' to 512x512. Also change 'datasize' type to size_t. Refer to security advisory https://starlabs.sg/advisories/22-4206/ for more information. Fixes: CVE-2021-4206 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081712.345609-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-07display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)Mauro Matteo Cascella
Avoid fetching 'width' and 'height' a second time to prevent possible race condition. Refer to security advisory https://starlabs.sg/advisories/22-4207/ for more information. Fixes: CVE-2021-4207 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220407081106.343235-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-04-06Remove qemu-common.h include from most unitsMarc-André Lureau
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220323155743.1585078-33-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-13 09:54:29 +0000