aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)Author
2017-04-24Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170424-1' into ↵Peter Maydell
staging fix display update races, part one. add xres + yres properties to qxl and virtio. misc fixes and cleanups. # gpg: Signature made Mon 24 Apr 2017 13:14:49 BST # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-vga-20170424-1: virtio-gpu: add xres and yres properties qxl: add xres and yres properties vmsvga: fix vmsvga_update_display g364fb: make display updates thread safe exynos: make display updates thread safe framebuffer: make display updates thread safe vga: make display updates thread safe. vga: add vga_scanline_invalidated helper memory: add support getting and using a dirty bitmap copy. bitmap: add bitmap_copy_and_clear_atomic virtio-gpu: replace PIXMAN_* by PIXMAN_BE_* console: add same displaychangelistener registration pre-condition console: add same surface replace pre-condition Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Add vmstate descriptorBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 86803c6f40cd678b61b3b1a1429683f60f0aa89a.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Add some more missing registersBALATON Zoltan
This is to allow clients to initialise these without failing as long as no 2D engine function is called that would use the written value. Saved values are not used yet (may get used when more of 2D engine is added sometimes) and clients normally only write to most of these registers, nothing is known to ever read them but they are documented as read/write so also implement read for these. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 80adf8e4d084ec6cc30d149f8e8215debb67314a.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Add support for panel layerBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 2029a276362c0c3a14c78acb56baa9466848dd51.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Misc clean upsBALATON Zoltan
- Rename a variable - Move variable declarations out of loop to the beginning in draw_hwc_line Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 187c9e4e09d9bc2967b2454b36bb088ceef0b8bc.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Fix hardware cursorBALATON Zoltan
Rework HWC handling to simplify it and fix cursor not updating on screen as needed. Previously cursor was not updated because checking for changes in a line overrode the update flag set for the cursor but fixing this is not enough because the cursor should also be updated if its shape or location changes. Introduce hwc_invalidate() function to handle that similar to other display controller models. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 6970a5e9868b7246656c1d02038dc5d5fa369507.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Fix device endiannessBALATON Zoltan
We only emulate the sysbus device in its default LE mode and PCI is LE as well so specify this for registers and framebuffer memory. Note that though the Linux kernel driver has code which claims to handle both big and little endian, it is obviously bogus for 16 bit and cannot be trusted as a source of information on the framebuffer pixel format. This is our best guess about device behaviour based on the specs and testing with MorphOS that is known to work on real HW. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 8b9605a569f8bf54074e15903620b18cd9967c89.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Add emulation of chip connected via PCIBALATON Zoltan
Only the display controller part is created automatically on PCI Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 647d292c6f5abba8b2a614687229949b5dcb864e.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Get rid of base address in draw_hwc_lineBALATON Zoltan
Do not use the base address to access data in local memory. This is in preparation to allow chip connected via PCI where base address depends on where the BAR is mapped so it will be unknown. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 79dab21bc6ec4d563aabf265c3bab40e2e95aae8.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: QOMifyBALATON Zoltan
Adding vmstate saving is not in this patch because the state structure will be changed in further patches, then another patch will add vmstate descriptor after those changes. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: a32b7fc981a20205f96d530d8e958f12ace1104c.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Add missing arbitration control registerBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: d1eaf3b19c40aeb32a343a211f2b56664a67f948.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Use defined constants instead of literal values where availableBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 31205c2df623e7b133ef942ff4f5e95fff800a14.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24sm501: Fixed code style and a few typos in commentsBALATON Zoltan
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Aurelien Jarno <aurelien@aurel32.net> Message-id: 36288b703e7d56822c818567193ff28cdc47377e.1492787889.git.balaton@eik.bme.hu Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-04-24virtio-gpu: add xres and yres propertiesGerd Hoffmann
So the default resolution is configurable. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170421092214.8176-1-kraxel@redhat.com
2017-04-24qxl: add xres and yres propertiesGerd Hoffmann
Add properties for the default display resolution, pass on that information to the guest so the driver can use it. Also move up qxl_crc32() function so we don't need a forward declaration. Additionally guest driver updates are needed so the guest driver will actually pick this up, which will probably land in linux kernel 4.12. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421092234.8368-1-kraxel@redhat.com
2017-04-24vmsvga: fix vmsvga_update_displayGerd Hoffmann
Fix standard vga mode check: Both s->config and s->enabled must be set to enable vmware command fifo processing. Drop dirty tracking code from the fifo rendering code path, it isn't used anyway because vmsvga turns off dirty tracking when leaving standard vga mode. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-9-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-24g364fb: make display updates thread safeGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-8-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-24exynos: make display updates thread safeGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-7-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-24framebuffer: make display updates thread safeGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-6-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-24vga: make display updates thread safe.Gerd Hoffmann
The vga code clears the dirty bits *after* reading the framebuffer memory. So if the guest framebuffer updates hits the race window between vga reading the framebuffer and vga clearing the dirty bits vga will miss that update Fix it by using the new memory_region_copy_and_clear_dirty() memory_region_copy_get_dirty() functions. That way we clear the dirty bitmap before reading the framebuffer. Any guest display updates happening in parallel will be properly tracked in the dirty bitmap then and the next display refresh will pick them up. Problem triggers with mttcg only. Before mttcg was merged tcg never ran in parallel to vga emulation. Using kvm will hide the problem too, due to qemu operating on a userspace copy of the kernel's dirty bitmap. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-5-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-24vga: add vga_scanline_invalidated helperGerd Hoffmann
Add vga_scanline_invalidated helper to check whenever a scanline was invalidated. Add a sanity check to fix OOB read access for display heights larger than 2048. Only cirrus uses this, for hardware cursor rendering, so having this work properly for the first 2048 scanlines only shouldn't be a problem as the cirrus can't handle large resolutions anyway. Also changing the invalidated_y_table size would break live migration. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-4-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-24virtio-gpu: replace PIXMAN_* by PIXMAN_BE_*Laurent Vivier
This avoids a "#ifdef HOST_WORDS_BIGENDIAN" and this is the purpose of PIXMAN_BE_* macros. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Sahid Orentino Ferdjaoui <sahid.ferdjaoui@redhat.com> Message-id: 20170403114044.15762-1-lvivier@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: switch to load_image_mr() and remove prom_addr hackMark Cave-Ayland
Previous to the existence of load_image_mr(), the only way to load in the FCode ROM image was to pass in its physical address via qdev properties and use load_image_targphys(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: use tcx_set_dirty() for accelerated opsMark Cave-Ayland
Rather than calling memory_region_set_dirty() directly, make sure that we call tcx_set_dirty() instead. This ensures that the 24-bit plane and cplane are also invalidated correctly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove primitives for non-32-bit surfacesMark Cave-Ayland
As all surfaces in QEMU are now either shared or 32-bit ARGB regardless of the guest depth, remove all non-32-bit primitives from tcx_update_display() and consequence their implementation which are no longer required. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove TARGET_PAGE_SIZE from tcx24_update_display()Mark Cave-Ayland
Now that page alignment is handled by the memory API, there is no need to duplicate the code 4 times (4 * 1024 == 4096 == TARGET_PAGE_SIZE). Finally we have now removed all traces of TARGET_PAGE_SIZE. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove TARGET_PAGE_SIZE from tcx_update_display()Mark Cave-Ayland
Now that page alignment is handled by the memory API, there is no need to duplicate the code 4 times (4 * 1024 == 4096 == TARGET_PAGE_SIZE). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove page24 and cpage from tcx24_update_display()Mark Cave-Ayland
Since all of the tcx_*_dirty() functions now calculate the 24-bit and cplane offsets themselves from the base address, these variables are no longer needed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: alter tcx24_reset_dirty() to accept address and length parametersMark Cave-Ayland
This can now be used by both the 8-bit and 24-bit display code, so rename to tcx_check_dirty(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: alter tcx24_check_dirty() to accept address and length parametersMark Cave-Ayland
This can now be used by both the 8-bit and 24-bit display code, so rename to tcx_check_dirty(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: ensure tcx_set_dirty() also invalidates the 24-bit plane and cplaneMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: alter tcx_set_dirty() to accept address and length parametersMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21cg3: switch to load_image_mr() and remove prom-addr hackMark Cave-Ayland
Previous to the existence of load_image_mr(), the only way to load in the FCode ROM image was to pass in its physical address via qdev properties and use load_image_targphys(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-04-21cg3: fix up size parameter for memory_region_get_dirty()Mark Cave-Ayland
The code was incorrectly calculating the end address rather than the size of the required region. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21cg3: remove TARGET_PAGE_SIZE rounding on dirty page detectionMark Cave-Ayland
This was an artifact from very early versions of the code from before the memory API and is no longer needed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-11qxl: add migration blocker to avoid pre-save assertGerd Hoffmann
Cc: 1635339@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170410113131.2585-1-kraxel@redhat.com
2017-04-07qxl: switch display on entering VGAMarc-André Lureau
Since commit cd958edb1fae85d, same size console resize is skipped. This change broke QXL incoming migration in VGA mode, qemu_spice_display_switch() is no longer called during qxl_post_load(), because default message surface is of the same size, and during displaychangelistener registration, PCIQXLDevice.mode is QXL_MODE_UNDEFINED. This triggers a later crash on refresh: ==2634== Invalid read of size 4 ==3516== at 0x65F3050: pixman_image_get_data (in /usr/lib64/libpixman-1.so.0.34.0) ==3516== by 0x6F0CEB: qemu_spice_create_update (spice-display.c:215) ==3516== by 0x6F1CC7: qemu_spice_display_refresh (spice-display.c:502) ==3516== by 0x58CF77: display_refresh (qxl.c:1948) ==3516== by 0x6E8084: do_safe_dpy_refresh (console.c:1591) ==3516== by 0x6E80D5: dpy_refresh (console.c:1604) ==3516== by 0x6E4508: gui_update (console.c:201) ==3516== by 0x81898E: timerlist_run_timers (qemu-timer.c:536) ==3516== by 0x8189D6: qemu_clock_run_timers (qemu-timer.c:547) ==3516== by 0x818D98: qemu_clock_run_all_timers (qemu-timer.c:662) ==3516== by 0x81952A: main_loop_wait (main-loop.c:514) ==3516== by 0x4ADD29: main_loop (vl.c:1898) One way to solve this is to explicitely call qemu_spice_display_switch() on entering VGA mode, which is called during qxl_post_load(). Fixes: "null pointer access on migration resume of systemrescuecd boot menu with qxl-vga" https://bugs.launchpad.net/qemu/+bug/1679126 https://bugzilla.redhat.com/show_bug.cgi?id=1438566 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170406120513.638-4-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-27cirrus: fix PUTPIXEL macroGerd Hoffmann
Should be "c" not "col". The macro is used with "col" as third parameter everywhere, so this tyops doesn't break something. Fixes: 026aeffcb4752054830ba203020ed6eb05bcaba8 Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1490168303-24588-1-git-send-email-kraxel@redhat.com
2017-03-21add opengl_cflags to QEMU_CFLAGSGerd Hoffmann
... and drop OPENGL_CFLAGS from Makefiles. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1490079888-29029-1-git-send-email-kraxel@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
fixes for 2.9-rc1, plus removal of -mno-cygwin references # gpg: Signature made Mon 20 Mar 2017 11:25:07 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hax: fix breakage in locking configure: remove Cygwin xen: do not build backends for targets that do not support xen qemu-ga: obey LISTEN_PID when using systemd socket activation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-19xen: do not build backends for targets that do not support xenStefano Stabellini
Change Makefile.objs to use CONFIG_XEN instead of CONFIG_XEN_BACKEND, so that the Xen backends are only built for targets that support Xen. Set CONFIG_XEN in the toplevel Makefile to ensure that files that are built only once pick up Xen support properly. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> Tested-by: Greg Kurz <groug@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> CC: pbonzini@redhat.com CC: peter.maydell@linaro.org CC: rth@twiddle.net CC: stefanha@redhat.com Message-Id: <1489694518-16978-1-git-send-email-sstabellini@kernel.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-17cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16Gerd Hoffmann
The switch from pointers to addresses (commit 026aeffcb4752054830ba203020ed6eb05bcaba8 and ffaf857778286ca54e3804432a2369a279e73aa7) added a off-by-one bug to 16bit backward blits. Fix. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: stop passing around src pointers in the blitterGerd Hoffmann
Does basically the same as "cirrus: stop passing around dst pointers in the blitter", just for the src pointer instead of the dst pointer. For the src we have to care about cputovideo blits though and fetch the data from s->cirrus_bltbuf instead of vga memory. The cirrus_src*() helper functions handle that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489584487-3489-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: stop passing around dst pointers in the blitterGerd Hoffmann
Instead pass around the address (aka offset into vga memory). Calculate the pointer in the rop_* functions, after applying the mask to the address, to make sure the address stays within the valid range. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489574872-8679-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: fix cirrus_invalidate_regionGerd Hoffmann
off_cur_end is exclusive, so off_cur_end == cirrus_addr_mask is valid. Fix calculation to make sure to allow that, otherwise the assert added by commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3 can trigger for valid blits. Test case: boot windows nt 4.0 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489579606-26020-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: add option to disable blitterGerd Hoffmann
Ok, we have this beast in the cirrus code which is not used at all by modern guests, except when you try to find security holes in qemu. So, add an option to disable blitter altogether. Guests released within the last ten years should not show any rendering issues if you turn off blitter support. There are no known bugs in the cirrus blitter code. But in the past we hoped a few times already that we've finally nailed the last issue. So having some easy way to mitigate in case yet another blitter issue shows up certainly makes me sleep a bit better at night. For completeness: The by far better way to mitigate is to switch away from cirrus and use stdvga instead. Or something more modern like virtio-vga in case your guest has support for it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494540-15745-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: switch to 4 MB video memory by defaultGerd Hoffmann
Quoting cirrus source code: Follow real hardware, cirrus card emulated has 4 MB video memory. Also accept 8 MB/16 MB for backward compatibility. So just use 4MB by default. We decided to leave that at 8MB by default a while ago, for live migration compatibility reasons. But we have compat properties to handle that, so that isn't a compeling reason. This also removes some sanity check inconsistencies in the cirrus code. Some places check against the allocated video memory, some places check against the 4MB physical hardware has. Guest code can trigger asserts because of that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494514-15606-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus/vnc: zap bitblit support from console code.Gerd Hoffmann
There is a special code path (dpy_gfx_copy) to allow graphic emulation notify user interface code about bitblit operations carryed out by guests. It is supported by cirrus and vnc server. The intended purpose is to optimize display scrolls and just send over the scroll op instead of a full display update. This is rarely used these days though because modern guests simply don't use the cirrus blitter any more. Any linux guest using the cirrus drm driver doesn't. Any windows guest newer than winxp doesn't ship with a cirrus driver any more and thus uses the cirrus as simple framebuffer. So this code tends to bitrot and bugs can go unnoticed for a long time. See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV" which fixes a bug lingering in the code for almost a year, added by commit "c7628bf vnc: only alloc server surface with clients connected". Also the vnc server will throttle the frame rate in case it figures the network can't keep up (send buffers are full). This doesn't work with dpy_gfx_copy, for any copy operation sent to the vnc client we have to send all outstanding updates beforehand, otherwise the vnc client might run the client side blit on outdated data and thereby corrupt the display. So this dpy_gfx_copy "optimization" might even make things worse on slow network links. Lets kill it once for all. Oh, and one more reason: Turns out (after writing the patch) we have a security bug in that code path ... Fixes: CVE-2016-9603 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494419-14340-1-git-send-email-kraxel@redhat.com
2017-03-16fix :cirrus_vga fix OOB read case qemu Segmentation faulthangaohuai
check the validity of parameters in cirrus_bitblt_rop_fwd_transp_xxx and cirrus_bitblt_rop_fwd_xxx to avoid the OOB read which causes qemu Segmentation fault. After the fix, we will touch the assert in cirrus_invalidate_region: assert(off_cur_end >= off_cur); Signed-off-by: fangying <fangying1@huawei.com> Signed-off-by: hangaohuai <hangaohuai@huawei.com> Message-id: 20170314063919.16200-1-hangaohuai@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-09qxl: clear guest_cursor on QXL_CURSOR_HIDEGerd Hoffmann
Make sure we don't leave guest_cursor pointing into nowhere. This might lead to (rare) live migration failures, due to target trying to restore the cursor from the stale pointer. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1421788 Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1488789111-27340-1-git-send-email-kraxel@redhat.com
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-08 21:25:12 +0000