summaryrefslogtreecommitdiffstats
path: root/hw/display/vga.c
Commit message (Collapse)AuthorAgeFilesLines
* memory: Rename memory_region_init_ram() to memory_region_init_ram_nomigrate()Peter Maydell2017-07-141-1/+1
| | | | | | | | | | Rename memory_region_init_ram() to memory_region_init_ram_nomigrate(). This leaves the way clear for us to provide a memory_region_init_ram() which does handle migration. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1499438577-7674-4-git-send-email-peter.maydell@linaro.org
* vmstate: error hint for failed equal checksHalil Pasic2017-06-281-1/+1
| | | | | | | | | | | | | | | | | In some cases a failing VMSTATE_*_EQUAL does not mean we detected a bug, but it's actually the best we can do. Especially in these cases a verbose error message is required. Let's introduce infrastructure for specifying a error hint to be used if equal check fails. Let's do this by adding a parameter to the _EQUAL macros called _err_hint. Also change all current users to pass NULL as last parameter so nothing changes for them. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170623144823.42936-1-pasic@linux.vnet.ibm.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
* vga: fix display update region calculationGerd Hoffmann2017-05-111-1/+1
| | | | | | | | | | | | vga display update mis-calculated the region for the dirty bitmap snapshot in case the scanlines are padded. This can triggere an assert in cpu_physical_memory_snapshot_get_dirty(). Fixes: fec5e8c92becad223df9d972770522f64aafdb72 Reported-by: Kevin Wolf <kwolf@redhat.com> Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170509104839.19415-1-kraxel@redhat.com
* vga: make display updates thread safe.Gerd Hoffmann2017-04-241-19/+17Star
| | | | | | | | | | | | | | | | | | | | | | The vga code clears the dirty bits *after* reading the framebuffer memory. So if the guest framebuffer updates hits the race window between vga reading the framebuffer and vga clearing the dirty bits vga will miss that update Fix it by using the new memory_region_copy_and_clear_dirty() memory_region_copy_get_dirty() functions. That way we clear the dirty bitmap before reading the framebuffer. Any guest display updates happening in parallel will be properly tracked in the dirty bitmap then and the next display refresh will pick them up. Problem triggers with mttcg only. Before mttcg was merged tcg never ran in parallel to vga emulation. Using kvm will hide the problem too, due to qemu operating on a userspace copy of the kernel's dirty bitmap. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-5-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: add vga_scanline_invalidated helperGerd Hoffmann2017-04-241-3/+11
| | | | | | | | | | | | | | | Add vga_scanline_invalidated helper to check whenever a scanline was invalidated. Add a sanity check to fix OOB read access for display heights larger than 2048. Only cirrus uses this, for hardware cursor rendering, so having this work properly for the first 2048 scanlines only shouldn't be a problem as the cirrus can't handle large resolutions anyway. Also changing the invalidated_y_table size would break live migration. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-4-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: replace debug printf with trace pointsGerd Hoffmann2017-02-101-23/+4Star
| | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-1-git-send-email-kraxel@redhat.com
* coccinelle: Remove unnecessary variables for function return valueEduardo Habkost2016-06-201-3/+1Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Use Coccinelle script to replace 'ret = E; return ret' with 'return E'. The script will do the substitution only when the function return type and variable type are the same. Manual fixups: * audio/audio.c: coding style of "read (...)" and "write (...)" * block/qcow2-cluster.c: wrap line to make it shorter * block/qcow2-refcount.c: change indentation of wrapped line * target-tricore/op_helper.c: fix coding style of "remainder|quotient" * target-mips/dsp_helper.c: reverted changes because I don't want to argue about checkpatch.pl * ui/qemu-pixman.c: fix line indentation * block/rbd.c: restore blank line between declarations and statements Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1465855078-19435-4-git-send-email-ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Unused Coccinelle rule name dropped along with a redundant comment; whitespace touched up in block/qcow2-cluster.c; stale commit message paragraph deleted] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* vga: add sr_vbe register setGerd Hoffmann2016-05-231-22/+28
| | | | | | | | | | | | | | | | | | | | Commit "fd3c136 vga: make sure vga register setup for vbe stays intact (CVE-2016-3712)." causes a regression. The win7 installer is unhappy because it can't freely modify vga registers any more while in vbe mode. This patch introduces a new sr_vbe register set. The vbe_update_vgaregs will fill sr_vbe[] instead of sr[]. Normal vga register reads and writes go to sr[]. Any sr register read access happens through a new sr() helper function which will read from sr_vbe[] with vbe active and from sr[] otherwise. This way we can allow guests update sr[] registers as they want, without allowing them disrupt vbe video modes that way. Cc: qemu-stable@nongnu.org Reported-by: Thomas Lamprecht <thomas@lamprecht.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com
* vga: make sure vga register setup for vbe stays intact (CVE-2016-3712).Gerd Hoffmann2016-05-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT registers, to make sure the vga registers will always have the values needed by vbe mode. This makes sure the sanity checks applied by vbe_fixup_regs() are effective. Without this guests can muck with shift_control, can turn on planar vga modes or text mode emulation while VBE is active, making qemu take code paths meant for CGA compatibility, but with the very large display widths and heigts settable using VBE registers. Which is good for one or another buffer overflow. Not that critical as they typically read overflows happening somewhere in the display code. So guests can DoS by crashing qemu with a segfault, but it is probably not possible to break out of the VM. Fixes: CVE-2016-3712 Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com> Reported-by: P J P <ppandit@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: update vga register setup on vbe changesGerd Hoffmann2016-05-021-0/+1
| | | | | | | Call the new vbe_update_vgaregs() function on vbe configuration changes, to make sure vga registers are up-to-date. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: factor out vga register setupGerd Hoffmann2016-05-021-34/+44
| | | | | | | | | When enabling vbe mode qemu will setup a bunch of vga registers to make sure the vga emulation operates in correct mode for a linear framebuffer. Move that code to a separate function so we can call it from other places too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: add vbe_enabled() helperGerd Hoffmann2016-05-021-4/+9
| | | | | | Makes code a bit easier to read. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: fix banked access bounds checking (CVE-2016-3710)Gerd Hoffmann2016-05-021-6/+18
| | | | | | | | | | | | | | | | | | | | | | vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* Replaced get_tick_per_sec() by NANOSECONDS_PER_SECONDRutuja Shah2016-03-221-3/+3
| | | | | | | | | | | | | | | | | | This patch replaces get_ticks_per_sec() calls with the macro NANOSECONDS_PER_SECOND. Also, as there are no callers, get_ticks_per_sec() is then removed. This replacement improves the readability and understandability of code. For example, timer_mod(fdctrl->result_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + (get_ticks_per_sec() / 50)); NANOSECONDS_PER_SECOND makes it obvious that qemu_clock_get_ns matches the unit of the expression on the right side of the plus. Signed-off-by: Rutuja Shah <rutu.shah.26@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* include/qemu/osdep.h: Don't include qapi/error.hMarkus Armbruster2016-03-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: Markus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw/display: Clean up includesPeter Maydell2016-01-291-0/+1
| | | | | | | | | | Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-21-git-send-email-peter.maydell@linaro.org
* ui/curses: Fix color attribute of monitor for cursesOGAWA Hirofumi2016-01-081-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current text_console_update() writes totally broken color attributes to console_write_ch(). The format now is writing, [WRONG] bold << 21 | fg << 12 | bg << 8 | char fg == 3bits curses color number bg == 3bits curses color number I can't see this format is where come from. Anyway, this doesn't work at all. What curses expects is actually (and vga.c is using), [RIGHT] bold << 21 | bg << 11 | fg << 8 | char fg == 3bits vga color number bg == 3bits vga color number And curses set COLOR_PAIR() up to match this format, and curses's chtype. I.e, bold | color_pair | char color_pair == (bg << 3 | fg) To fix, this simply uses VGA color number everywhere except curses.c internal. Then, convert it to above [RIGHT] format to write by console_write_ch(). And as bonus, this reduces to expose curses define to other parts (removes COLOR_* from console.c). [Tested the first line is displayed as white on blue back for monitor in curses console] Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Message-id: 87r3j95407.fsf@mail.parknet.co.jp Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* Fix bad error handling after memory_region_init_ram()Markus Armbruster2015-09-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Symptom: $ qemu-system-x86_64 -m 10000000 Unexpected error in ram_block_add() at /work/armbru/qemu/exec.c:1456: upstream-qemu: cannot set up guest memory 'pc.ram': Cannot allocate memory Aborted (core dumped) Root cause: commit ef701d7 screwed up handling of out-of-memory conditions. Before the commit, we report the error and exit(1), in one place, ram_block_add(). The commit lifts the error handling up the call chain some, to three places. Fine. Except it uses &error_abort in these places, changing the behavior from exit(1) to abort(), and thus undoing the work of commit 3922825 "exec: Don't abort when we can't allocate guest memory". The three places are: * memory_region_init_ram() Commit 4994653 (right after commit ef701d7) lifted the error handling further, through memory_region_init_ram(), multiplying the incorrect use of &error_abort. Later on, imitation of existing (bad) code may have created more. * memory_region_init_ram_ptr() The &error_abort is still there. * memory_region_init_rom_device() Doesn't need fixing, because commit 33e0eb5 (soon after commit ef701d7) lifted the error handling further, and in the process changed it from &error_abort to passing it up the call chain. Correct, because the callers are realize() methods. Fix the error handling after memory_region_init_ram() with a Coccinelle semantic patch: @r@ expression mr, owner, name, size, err; position p; @@ memory_region_init_ram(mr, owner, name, size, ( - &error_abort + &error_fatal | err@p ) ); @script:python@ p << r.p; @@ print "%s:%s:%s" % (p[0].file, p[0].line, p[0].column) When the last argument is &error_abort, it gets replaced by &error_fatal. This is the fix. If the last argument is anything else, its position is reported. This lets us check the fix is complete. Four positions get reported: * ram_backend_memory_alloc() Error is passed up the call chain, ultimately through user_creatable_complete(). As far as I can tell, it's callers all handle the error sanely. * fsl_imx25_realize(), fsl_imx31_realize(), dp8393x_realize() DeviceClass.realize() methods, errors handled sanely further up the call chain. We're good. Test case again behaves: $ qemu-system-x86_64 -m 10000000 qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory [Exit 1 ] The next commits will repair the rest of commit ef701d7's damage. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1441983105-26376-3-git-send-email-armbru@redhat.com> Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
* migration: Use normal VMStateDescriptions for SubsectionsJuan Quintela2015-06-121-7/+4Star
| | | | | | | | | | | | | | | | We create optional sections with this patch. But we already have optional subsections. Instead of having two mechanism that do the same, we can just generalize it. For subsections we just change: - Add a needed function to VMStateDescription - Remove VMStateSubsection (after removal of the needed function it is just a VMStateDescription) - Adjust the whole tree, moving the needed function to the corresponding VMStateDescription Signed-off-by: Juan Quintela <quintela@redhat.com>
* Fix remaining warnings from Sparse (void return)Stefan Weil2015-03-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Sparse report: hw/display/vga.c:2000:5: warning: returning void-valued expression hw/intc/arm_gic.c:707:9: warning: returning void-valued expression hw/intc/etraxfs_pic.c:138:9: warning: returning void-valued expression hw/nvram/fw_cfg.c:475:5: warning: returning void-valued expression hw/timer/a9gtimer.c:124:5: warning: returning void-valued expression hw/tpm/tpm_tis.c:794:5: warning: returning void-valued expression hw/usb/hcd-musb.c:558:9: warning: returning void-valued expression hw/usb/hcd-musb.c:776:13: warning: returning void-valued expression hw/usb/hcd-musb.c:867:5: warning: returning void-valued expression hw/usb/hcd-musb.c:932:5: warning: returning void-valued expression include/qom/cpu.h:584:5: warning: returning void-valued expression monitor.c:4686:13: warning: returning void-valued expression monitor.c:4690:13: warning: returning void-valued expression Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Andreas Färber <afaerber@suse.de> Cc: Luiz Capitulino <lcapitulino@redhat.com> Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* vga: refactor vram_size clamping and roundingRadim Krčmář2015-03-031-7/+15
| | | | | | | | | | Make the code a bit more obvious. We don't have min/max, so a general helper for clamp probably isn't acceptable either. Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* spice: fix invalid memory access to vga.vramRadim Krčmář2015-03-031-2/+2
| | | | | | | | | | | | | | | | | vga_common_init() doesn't allow more than 256 MiB vram size and silently shrinks any larger value. qxl_dirty_surfaces() used the unshrinked size via qxl->shadow_rom.surface0_area_size when accessing the memory, which resulted in segfault. Add a workaround for this case and an assert if it happens again. We have to bump the vga memory limit too, because 256 MiB wouldn't have allowed 8k (it requires more than 128 MiB). 1024 MiB doesn't work, but 512 MiB seems fine. Proposed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Radim Krčmář <rkrcmar@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* isa: remove isa_mem_base variableHervé Poussineau2015-02-131-2/+1Star
| | | | | | | Now that isa_mem_base variable is always 0, we can remove its usage. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* vga: Fix warning caused by missing 'static' attributeStefan Weil2015-02-101-1/+1
| | | | | | | | | | Warning from the Sparse static analysis tool: hw/display/vga.c:2012:26: warning: symbol 'vmstate_vga_endian' was not declared. Should it be static? Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* ui: Add dpy_gfx_check_format() to check backend shared surface supportBenjamin Herrenschmidt2015-01-191-4/+14
| | | | | | | | | | | | | This allows VGA to decide whether to use a shared surface based on whether the UI backend supports the format or not. Backends that don't provide the new callback fallback to native 32 bpp which is equivalent to what was supported before. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> [ kraxel: fix console check, allow only 32 bpp as fallback ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: Add mechanism to force the use of a shadow surfaceBenjamin Herrenschmidt2014-12-161-2/+15
| | | | | | | | This prevents surface sharing which will be necessary to fix cirrus HW cursor support. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/vga: Remove unused arrays dmask4 and dmask16Peter Maydell2014-10-151-26/+0Star
| | | | | | | | | | Following cleanup of the vga device code in commit d2e043a8041, the arrays dmask4 and dmask16 are now unused. gcc doesn't warn about this, but clang does; remove them. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: Add endian to vmstateBenjamin Herrenschmidt2014-09-301-4/+37
| | | | | | | | | | | | | | | | | Include the endian state in the migration stream as an optional subsection which we only include when the endian isn't the default, thus enabling backward compatibility of the common case. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Changes by kraxel: * Remove bochs dispi interface changes. We'll do that in a different way to make sure we don't conflict with possible future bochs dispi interface changes. * keep live migration bits. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Make fb endian a common state variableBenjamin Herrenschmidt2014-09-301-13/+19
| | | | | | | | And initialize it based on target endian Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Rename vga_template.h to vga-helpers.hBenjamin Herrenschmidt2014-09-301-1/+1
| | | | | | | | | | It's no longer a template, we only instanciate the file once. Keep it a #included file so the functions remain static. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove some "should be done in BIOS" commentsBenjamin Herrenschmidt2014-09-301-4/+2Star
| | | | | | | | | Not all platforms have a VGA BIOS, powerpc typically relies on using the DISPI interface to initialize the card. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Simplify vga_draw_blank() a bitBenjamin Herrenschmidt2014-09-301-7/+2Star
| | | | | | | | | The test for surface_bits_per_pixel() isn't necessary anymore, the 8bpp case never happens. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove rgb_to_pixel indirectionBenjamin Herrenschmidt2014-09-301-21/+10Star
| | | | | | | | We always use rgb_to_pixel32 nowadays. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Separate LE and BE conversion functionsBenjamin Herrenschmidt2014-09-301-15/+28
| | | | | | | | | | | | Provide different functions for converting from an LE vs a BE framebuffer. We cannot rely on the simple cases always being shared surfaces since cirrus will need to always shadow for cursor emulation, so we need the full set of functions to be able to later handle runtime switching. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\ Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove remainder of old conversion cruftBenjamin Herrenschmidt2014-09-301-24/+22Star
| | | | | | | | | | All the macros used to generate different versions of vga_template.h are now unnecessary, take them all out and remove the _32 suffix from most functions. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Start cutting out non-32bpp conversion supportBenjamin Herrenschmidt2014-09-301-236/+22Star
| | | | | | | | | | | | | Nowadays, we either share a surface with the host, or we create a 32bpp ARGB console surface. So we only need to draw/convert to 32bpp, enabling us to remove all but one instance of vga_template.h inclusion (to be further cleaned up), rgb_to_pixel_* etc... Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell2014-09-121-1/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Memory: improve error reporting and avoid crashes on hotplug - Build: fixing block/iscsi.so and ranlib warnings on Mac OS X - Migration fixes for x86 - The odd KVM patch. # gpg: Signature made Thu 11 Sep 2014 11:21:10 BST using RSA key ID 9B4D86F2 # gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>" # gpg: aka "Paolo Bonzini <bonzini@gnu.org>" * remotes/bonzini/tags/for-upstream: (21 commits) gdbstub: init mon_chr through qemu_chr_alloc pckbd: adding new fields to vmstate mc146818rtc: add missed field to vmstate piix: do not set irq while loading vmstate serial: fixing vmstate for save/restore parallel: adding vmstate for save/restore fdc: adding vmstate for save/restore cpu: init vmstate for ticks and clock offset apic_common: vapic_paddr synchronization fix vl: use QLIST_FOREACH_SAFE to visit change state handlers exec: add parameter errp to gethugepagesize exec: report error when memory < hpagesize hostmem-ram: don't exit qemu if size of memory-backend-ram is way too big memory: add parameter errp to memory_region_init_rom_device memory: add parameter errp to memory_region_init_ram exec: add parameter errp to qemu_ram_alloc and qemu_ram_alloc_from_ptr rules.mak: Fix DSO build by pulling in archive symbols util: Don't link host-utils.o if it's empty util: Move general qemu_getauxval to util/getauxval.c trace: Only link generated-tracers.o with "simple" backend ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * memory: add parameter errp to memory_region_init_ramHu Tao2014-09-091-1/+2
| | | | | | | | | | | | | | | | | | Add parameter errp to memory_region_init_ram and update all call sites to pass in &error_abort. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | Merge remote-tracking branch 'remotes/kraxel/tags/pull-console-20140905-2' ↵Peter Maydell2014-09-111-4/+8
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging console: pixman switchover continued, add some infrastructure to make it easier using pixman in display device emulation. # gpg: Signature made Fri 05 Sep 2014 14:38:57 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-console-20140905-2: console: Remove unused QEMU_BIG_ENDIAN_FLAG console: add qemu_pixman_linebuf_copy console: add dpy_gfx_update_dirty console: add qemu_create_displaysurface_guestmem console: stop using PixelFormat console: reimplement qemu_default_pixelformat console: add qemu_default_pixman_format console: add qemu_pixelformat_from_pixman Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * console: stop using PixelFormatGerd Hoffmann2014-09-051-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch the qemu console core stops using PixelFormat and pixman format codes side-by-side, pixman format code is the primary way to specify the DisplaySurface format: * DisplaySurface stops carrying a PixelFormat field. * qemu_create_displaysurface_from() expects a pixman format now. Functions to convert PixelFormat to pixman_format_code_t (and back) exist for those who still use PixelFormat. As PixelFormat allows easy access to masks and shifts it will probably continue to exist. [ xenfb added by Benjamin Herrenschmidt ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | vbe: rework sanity checksGerd Hoffmann2014-09-041-59/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Plug a bunch of holes in the bochs dispi interface parameter checking. Add a function doing verification on all registers. Call that unconditionally on every register write. That way we should catch everything, even changing one register affecting the valid range of another register. Some of the holes have been added by commit e9c6149f6ae6873f14a12eea554925b6aa4c4dec. Before that commit the maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES * 32 bpp) has been smaller than the qemu vga memory (8MB) and the checking for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok. Some of the holes have been there forever, such as VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes lacking any verification. Security impact: (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga frame buffer as source -> host memory leak. Memory isn't leaked to the guest but to the vnc client though. (2) Qemu will segfault in case the memory range happens to include unmapped areas -> Guest can DoS itself. The guest can not modify host memory, so I don't think this can be used by the guest to escape. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* | vbe: make bochs dispi interface return the correct memory size with qxlGerd Hoffmann2014-09-041-2/+5
|/ | | | | | | | | | | | | | VgaState->vram_size is the size of the pci bar. In case of qxl not the whole pci bar can be used as vga framebuffer. Add a new variable vbe_size to handle that case. By default (if unset) it equals vram_size, but qxl can set vbe_size to something else. This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results and sanity checks are done with the correct size too. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* memory: convert memory_region_destroy to object_unparentPaolo Bonzini2014-08-181-1/+1
| | | | | | | | | Explicitly call object_unparent in the few places where we will re-create the memory region. If the memory region is simply being destroyed as part of device teardown, let QOM handle it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vga: do not dynamically allocate chain4_aliasPaolo Bonzini2014-08-171-14/+10Star
| | | | | | | | | Instead, add a boolean variable to indicate the presence of the region. This avoids a repeated malloc/free (later we can also avoid the add_child/unparent by changing the offset/size of the alias). Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela2014-06-161-2/+1Star
| | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* PortioList: Store PortioList in device stateKirill Batuzov2014-05-051-7/+5Star
| | | | | | | | | | | | | | | | | | | | PortioList is an abstraction used for construction of MemoryRegionPortioList from MemoryRegionPortio. It can be used later to unmap created memory regions. It also requires proper cleanup because some of the memory inside is allocated dynamically. By moving PortioList ot device state we make it possible to cleanup later and avoid leaking memory. This change spans several target platforms. The following testcases cover all changed lines: qemu-system-ppc -M prep qemu-system-i386 -vga qxl qemu-system-i386 -M isapc -soundhw adlib -device ib700,id=watchdog0,bus=isa.0 Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* vga: add secondary stdvga variantGerd Hoffmann2014-04-281-0/+4
| | | | | | | | Add a standard vga variant which doesn't occupy any legacy resources and thus can easily be used as secondary (or legacy-free) graphics adapter. Programming must be done using the MMIO bar. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: allow non-global vmstateGerd Hoffmann2014-04-281-2/+2
| | | | | | | | Need a way to opt-out from vga.vram being global vmstate, for secondary vga cards. Add a bool parameter to vga_common_init to support this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* vga: fix invalid read after freeMarc-André Lureau2013-11-061-1/+0Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After calling dpy_gfx_replace_surface(s->con, surface), the outer surface is invalid. ==5370== Invalid read of size 4 ==5370== at 0x460229: surface_bits_per_pixel (console.h:250) ==5370== by 0x466A81: get_depth_index (vga.c:1173) ==5370== by 0x467EC2: vga_draw_graphic (vga.c:1718) ==5370== by 0x4687A5: vga_update_display (vga.c:1914) ==5370== by 0x2A782E: qxl_hw_update (qxl.c:1766) ==5370== by 0x3EB83B: graphic_hw_update (console.c:254) ==5370== by 0x3FBE31: qemu_spice_display_refresh (spice-display.c:418) ==5370== by 0x2A7D01: display_refresh (qxl.c:1886) ==5370== by 0x3EEE1C: dpy_refresh (console.c:1436) ==5370== by 0x3EB543: gui_update (console.c:192) ==5370== by 0x3C43B3: timerlist_run_timers (qemu-timer.c:488) ==5370== by 0x3C4416: qemu_clock_run_timers (qemu-timer.c:499) ==5370== Address 0x22ffb1e0 is 0 bytes inside a block of size 56 free'd ==5370== at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==5370== by 0x4245FC: free_and_trace (vl.c:2771) ==5370== by 0x50899AE: g_free (gmem.c:252) ==5370== by 0x3EE8D3: qemu_free_displaysurface (console.c:1332) ==5370== by 0x3EEDB7: dpy_gfx_replace_surface (console.c:1427) ==5370== by 0x467EB6: vga_draw_graphic (vga.c:1714) ==5370== by 0x4687A5: vga_update_display (vga.c:1914) ==5370== by 0x2A782E: qxl_hw_update (qxl.c:1766) ==5370== by 0x3EB83B: graphic_hw_update (console.c:254) ==5370== by 0x3FBE31: qemu_spice_display_refresh (spice-display.c:418) ==5370== by 0x2A7D01: display_refresh (qxl.c:1886) ==5370== by 0x3EEE1C: dpy_refresh (console.c:1436) Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1383664554-15248-1-git-send-email-marcandre.lureau@gmail.com Signed-off-by: Anthony Liguori <aliguori@amazon.com>
* vga: Mark relevant portio lists regions as coalesced MMIO flushingJan Kiszka2013-10-171-4/+1Star
| | | | | | | | This allows to remove the explicit qemu_flush_coalesced_mmio_buffer calls. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>