summaryrefslogtreecommitdiffstats
path: root/hw/display
Commit message (Collapse)AuthorAgeFilesLines
...
* qdev: Use returned bool to check for qdev_realize() etc. failureMarkus Armbruster2020-07-102-5/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert foo(..., &err); if (err) { ... } to if (!foo(..., &err)) { ... } for qdev_realize(), qdev_realize_and_unref(), qbus_realize() and their wrappers isa_realize_and_unref(), pci_realize_and_unref(), sysbus_realize(), sysbus_realize_and_unref(), usb_realize_and_unref(). Coccinelle script: @@ identifier fun = { isa_realize_and_unref, pci_realize_and_unref, qbus_realize, qdev_realize, qdev_realize_and_unref, sysbus_realize, sysbus_realize_and_unref, usb_realize_and_unref }; expression list args, args2; typedef Error; Error *err; @@ - fun(args, &err, args2); - if (err) + if (!fun(args, &err, args2)) { ... } Chokes on hw/arm/musicpal.c's lcd_refresh() with the unhelpful error message "no position information". Nothing to convert there; skipped. Fails to convert hw/arm/armsse.c, because Coccinelle gets confused by ARMSSE being used both as typedef and function-like macro there. Converted manually. A few line breaks tidied up manually. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> Reviewed-by: Greg Kurz <groug@kaod.org> Message-Id: <20200707160613.848843-5-armbru@redhat.com>
* vga: build virtio-gpu as moduleGerd Hoffmann2020-07-071-10/+13
| | | | | | | Drops libvirglrenderer.so dependency from core qemu. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20200624131045.14512-10-kraxel@redhat.com
* vga: build virtio-gpu only onceGerd Hoffmann2020-07-071-6/+6
| | | | | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200624131045.14512-9-kraxel@redhat.com
* vga: build qxl as moduleGerd Hoffmann2020-07-071-1/+4
| | | | | | | First step in making spice support modular. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20200624131045.14512-8-kraxel@redhat.com
* Replace uses of FROM_SSI_SLAVE() macro with QOM castsPeter Maydell2020-07-032-6/+13
| | | | | | | | | | | | | | | | | | | | | The FROM_SSI_SLAVE() macro predates QOM and is used as a typesafe way to cast from an SSISlave* to the instance struct of a subtype of TYPE_SSI_SLAVE. Switch to using the QOM cast macros instead, which have the same effect (by writing the QOM macros if the types were previously missing them.) (The FROM_SSI_SLAVE() macro allows the SSISlave member of the subtype's struct to be anywhere as long as it is named "ssidev", whereas a QOM cast macro insists that it is the first thing in the subtype's struct. This is true for all the types we convert here.) This removes all the uses of FROM_SSI_SLAVE() so we can delete the definition. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-18-peter.maydell@linaro.org
* hw/display/bcm2835_fb.c: Initialize all fields of structPeter Maydell2020-07-031-0/+4
| | | | | | | | | | | | | | | | | In bcm2835_fb_mbox_push(), Coverity complains (CID 1429989) that we pass a pointer to a local struct to another function without initializing all its fields. This is a real bug: bcm2835_fb_reconfigure() copies the whole of our new BCM2385FBConfig struct into s->config, so any fields we don't initialize will corrupt the state of the device. Copy the two fields which we don't want to update (pixo and alpha) from the existing config so we don't accidentally change them. Fixes: cfb7ba983857e40e88 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200628195436.27582-1-peter.maydell@linaro.org
* Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2020-07-02' ↵Peter Maydell2020-07-022-2/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging Error reporting patches patches for 2020-07-02 # gpg: Signature made Thu 02 Jul 2020 10:55:48 BST # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-error-2020-07-02: (28 commits) migration/rdma: Plug memory leaks in qemu_rdma_registration_stop() arm/{bcm2835,fsl-imx25,fsl-imx6}: Fix realize error API violations hw/arm/armsse: Fix armsse_realize() error API violation aspeed: Fix realize error API violation arm/stm32f205 arm/stm32f405: Fix realize error API violation amd_iommu: Fix amdvi_realize() error API violation x86: Fix x86_cpu_new() error handling mips/cps: Fix mips_cps_realize() error API violations riscv_hart: Fix riscv_harts_realize() error API violations riscv/sifive_u: Fix sifive_u_soc_realize() error API violations hw/arm: Drop useless object_property_set_link() error handling hw: Fix error API violation around object_property_set_link() qdev: Drop qbus_set_hotplug_handler() parameter @errp qdev: Drop qbus_set_bus_hotplug_handler() parameter @errp aspeed: Clean up roundabout error propagation vnc: Plug minor memory leak in vnc_display_open() test-util-filemonitor: Plug unlikely memory leak sd/milkymist-memcard: Plug minor memory leak in realize qga: Plug unlikely memory leak in guest-set-memory-blocks spapr: Plug minor memory leak in spapr_machine_init() ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw: Fix error API violation around object_property_set_link()Markus Armbruster2020-07-022-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. virtio_gpu_pci_base_realize(), virtio_vga_base_realize(), sparc32_ledma_device_realize(), sparc32_dma_realize(), sparc32_dma_realize() xilinx_axidma_realize(), mips_cps_realize(), macio_realize_ide(), xilinx_enet_realize(), and virtio_iommu_pci_realize() are wrong that way: they reuse the argument they pass to object_property_set_link() for another call. Harmless, because object_property_set_link() can't actually fail for them: it fails when the property doesn't exist, is not settable, or its .check() method fails. Fix by passing &error_abort instead. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Alistair Francis <alistair@alistair23.me> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> Cc: Eric Auger <eric.auger@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200630090351.1247703-16-armbru@redhat.com> Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
* | ati-vga: Add dummy MEM_SDRAM_MODE_REGBALATON Zoltan2020-06-303-0/+7
| | | | | | | | | | | | | | | | | | | | Radeon chips have an SDRAM mode reg that is accessed by some drivers. We don't emulate the memory controller but provide some default value to prevent drivers getting unexpected 0. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: cc1324b9ef06beb8ae233ddc77dedd8bab9b8624.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | ati-vga: Do not assert on errorBALATON Zoltan2020-06-301-1/+1
| | | | | | | | | | | | | | | | | | | | Do not abort on unsupported value just print log and continue. While display will likely be broken this prevents malicious guest to crash QEMU causing denial of service. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 0c13dab5d8e3b7e7479c3edbf53aeac8c09de6de.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | ati-vga: Support unaligned access to hardware cursor registersBALATON Zoltan2020-06-301-29/+58
| | | | | | | | | | | | | | | | | | | | | | This fixes horizontal mouse movement and pointer color with MacOS that writes these registers with access size less than 4 so previously only the last portion of access was effective overwriting previous partial writes. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: ba1d5ba97f246e8807f86f1243c2bdc6497dc8f2.1592737958.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Fix and optimize overlap checkBALATON Zoltan2020-06-301-10/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | When doing reverse blit we need to check if source and dest overlap but it is not trivial due to possible different base and pitch of source and dest. Do rectangle overlap if base and pitch match, otherwise just check if memory area containing the rects overlaps so rects could possibly overlap. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-Id: <20200624164737.A941374633D@zero.eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Convert debug printfs to tracesBALATON Zoltan2020-06-302-37/+25Star
| | | | | | | | | | | | | | Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: caf97bf0c84a440896ddf020e84c312fa5c15076.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Do not allow guest to set invalid formatBALATON Zoltan2020-06-301-0/+3
| | | | | | | | | | | | | | | | | | | | Prevent guest setting invalid format value that might trip checks in sm501_2d_operation(). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 26d4fa9b8ce81e2723e98d592ccba7550042752c.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Use stn_he_p/ldn_he_p instead of switch/caseBALATON Zoltan2020-06-301-11/+1Star
| | | | | | | | | | | | | | | | | | | | | | Instead of open coding op with different sizes using a switch and type casting it can be written more compactly using stn_he_p/ldn_he_p. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: e2f649cb286f0735a10ec87c1b36a7ae081acb61.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Optimise 1 pixel 2d opsBALATON Zoltan2020-06-301-3/+16
| | | | | | | | | | | | | | | | | | | | Some guests do 1x1 blits which is faster to do directly than calling a function for it so avoid overhead in this case. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 7cccc302d7b4c5c313bad7681ac4686417143c3e.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Introduce variable for commonly used value for better readabilityBALATON Zoltan2020-06-301-20/+21
| | | | | | | | | | | | | | | | | | | | | | | | The bytes per pixel value can be calculated from format but it's used freqently enough (and will be used more in subseqent patches) so store it in a variable for better readabilty. Also drop some unneded 0x prefix around where new variable is defined. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: b9ea5ef2d68583db9f3fb73a2b859abbd7c044a8.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Ignore no-op blitsBALATON Zoltan2020-06-301-0/+5
| | | | | | | | | | | | | | | | | | | | Some guests seem to try source copy blits with same source and dest which are no-op so avoid calling pixman for these. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: a2a8214dd37344dfb65f1c343ace4cff2e94f3bb.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Drop unneded variableBALATON Zoltan2020-06-301-3/+2Star
| | | | | | | | | | | | | | | | | | | | We don't need a separate variable to keep track if we allocated memory that needs to be freed as we can test the pointer itself. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: ff9136c3151a15cdfa1d9b7a68acf11cffb8efa4.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | sm501: Fix bounds checksBALATON Zoltan2020-06-301-4/+4
|/ | | | | | | | | | | We don't need to add width to pitch when calculating last point, that would reject valid ops within the card's local_mem. Fixes: b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4 Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: ddb5781d12913bb9d6dbfd9e5b1e2b893e2b3e2d.1592686588.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sysbus: Convert qdev_set_parent_bus() use with Coccinelle, part 3Markus Armbruster2020-06-151-2/+2
| | | | | | | | | | These are init/realize pairs produced by the previous commit's Coccinelle script where the argument test doesn't quite match. They need even more careful review. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-50-armbru@redhat.com>
* sysbus: Convert to sysbus_realize() etc. with CoccinelleMarkus Armbruster2020-06-152-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert from qdev_realize(), qdev_realize_and_unref() with null @bus argument to sysbus_realize(), sysbus_realize_and_unref(). Coccinelle script: @@ expression dev, errp; @@ - qdev_realize(DEVICE(dev), NULL, errp); + sysbus_realize(SYS_BUS_DEVICE(dev), errp); @@ expression sysbus_dev, dev, errp; @@ + sysbus_dev = SYS_BUS_DEVICE(dev); - qdev_realize_and_unref(dev, NULL, errp); + sysbus_realize_and_unref(sysbus_dev, errp); - sysbus_dev = SYS_BUS_DEVICE(dev); @@ expression sysbus_dev, dev, errp; expression expr; @@ sysbus_dev = SYS_BUS_DEVICE(dev); ... when != dev = expr; - qdev_realize_and_unref(dev, NULL, errp); + sysbus_realize_and_unref(sysbus_dev, errp); @@ expression dev, errp; @@ - qdev_realize_and_unref(DEVICE(dev), NULL, errp); + sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp); @@ expression dev, errp; @@ - qdev_realize_and_unref(dev, NULL, errp); + sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp); Whitespace changes minimized manually. Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-46-armbru@redhat.com> [Conflicts in hw/misc/empty_slot.c and hw/sparc/leon3.c resolved]
* sysbus: Tidy up sysbus_init_child_obj()'s @childsize arg, part 1Markus Armbruster2020-06-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The callers of sysbus_init_child_obj() commonly pass either &child, sizeof(child), or pchild, sizeof(*pchild). Tidy up the few that use sizeof(child_type) instead, mostly to keep future commits simpler. Coccinelle script: @@ expression parent, propname, type; type T; T child; @@ - sysbus_init_child_obj(parent, propname, &child, sizeof(T), type) + sysbus_init_child_obj(parent, propname, &child, sizeof(child), type) @@ expression parent, propname, type; type T; T *child; @@ - sysbus_init_child_obj(parent, propname, child, sizeof(T), type) + sysbus_init_child_obj(parent, propname, child, sizeof(*child), type) Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-42-armbru@redhat.com>
* auxbus: Eliminate aux_create_slave()Markus Armbruster2020-06-151-1/+1
| | | | | | | | | | aux_create_slave() has become a trivial wrapper around qdev_new(). There's just one user. Eliminate. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-35-armbru@redhat.com>
* auxbus: Convert a use of qdev_set_parent_bus()Markus Armbruster2020-06-151-1/+1
| | | | | | | | | | | Convert qdev_set_parent_bus()/qdev_init_nofail() to qdev_realize(); recent commit "qdev: New qdev_new(), qdev_realize(), etc." explains why. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-34-armbru@redhat.com>
* auxbus: New aux_bus_realize(), pairing with aux_bus_init()Markus Armbruster2020-06-151-1/+1
| | | | | | | | | | | | aux_bus_init() encapsulates the creation of an aux-bus and its aux-to-i2c-bridge device. Create aux_bus_realize() to similarly encapsulate their realization. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-33-armbru@redhat.com>
* auxbus: Rename aux_init_bus() to aux_bus_init()Markus Armbruster2020-06-151-1/+1
| | | | | | | | Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-32-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
* qdev: Convert uses of qdev_set_parent_bus() with CoccinelleMarkus Armbruster2020-06-152-4/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In addition to the qdev_create() patterns converted so far, we have a qdev_set_parent_bus() pattern. Mostly when we embed a device in a parent device rather than allocating it on the heap. This pattern also puts devices in the dangerous "no QOM parent, but plugged into bus" state I explained in recent commit "qdev: New qdev_new(), qdev_realize(), etc." Apply same solution: convert to qdev_realize(). Coccinelle script: @@ expression dev, bus, errp; symbol true; @@ - qdev_set_parent_bus(DEVICE(dev), bus); ... - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize(DEVICE(dev), bus, errp); @ depends on !(file in "qdev-monitor.c") && !(file in "hw/core/qdev.c")@ expression dev, bus, errp; symbol true; @@ - qdev_set_parent_bus(dev, bus); ... - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize(dev, bus, errp); @@ expression dev, bus; symbol true; @@ - qdev_set_parent_bus(DEVICE(dev), bus); ... - qdev_init_nofail(DEVICE(dev)); + qdev_realize(DEVICE(dev), bus, &error_fatal); Unconverted uses of qdev_set_parent_bus() remain. They'll be converted later in this series. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-12-armbru@redhat.com> [Also convert new hw/virtio/vhost-user-vsock-pci.c]
* qdev: Convert uses of qdev_create() manuallyMarkus Armbruster2020-06-153-8/+7Star
| | | | | | | | | | Same transformation as in the previous commit. Manual, because convincing Coccinelle to transform these cases is somewhere between not worthwhile and infeasible (at least for me). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-11-armbru@redhat.com>
* qdev: Convert uses of qdev_create() with CoccinelleMarkus Armbruster2020-06-152-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the transformation explained in the commit before previous. Takes care of just one pattern that needs conversion. More to come in this series. Coccinelle script: @ depends on !(file in "hw/arm/highbank.c")@ expression bus, type_name, dev, expr; @@ - dev = qdev_create(bus, type_name); + dev = qdev_new(type_name); ... when != dev = expr - qdev_init_nofail(dev); + qdev_realize_and_unref(dev, bus, &error_fatal); @@ expression bus, type_name, dev, expr; identifier DOWN; @@ - dev = DOWN(qdev_create(bus, type_name)); + dev = DOWN(qdev_new(type_name)); ... when != dev = expr - qdev_init_nofail(DEVICE(dev)); + qdev_realize_and_unref(DEVICE(dev), bus, &error_fatal); @@ expression bus, type_name, expr; identifier dev; @@ - DeviceState *dev = qdev_create(bus, type_name); + DeviceState *dev = qdev_new(type_name); ... when != dev = expr - qdev_init_nofail(dev); + qdev_realize_and_unref(dev, bus, &error_fatal); @@ expression bus, type_name, dev, expr, errp; symbol true; @@ - dev = qdev_create(bus, type_name); + dev = qdev_new(type_name); ... when != dev = expr - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize_and_unref(dev, bus, errp); @@ expression bus, type_name, expr, errp; identifier dev; symbol true; @@ - DeviceState *dev = qdev_create(bus, type_name); + DeviceState *dev = qdev_new(type_name); ... when != dev = expr - object_property_set_bool(OBJECT(dev), true, "realized", errp); + qdev_realize_and_unref(dev, bus, errp); The first rule exempts hw/arm/highbank.c, because it matches along two control flow paths there, with different @type_name. Covered by the next commit's manual conversions. Missing #include "qapi/error.h" added manually. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-10-armbru@redhat.com> [Conflicts in hw/misc/empty_slot.c and hw/sparc/leon3.c resolved]
* display/sm501 display/ati: Fix to realize "i2c-ddc"Markus Armbruster2020-06-152-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sm501_init() and ati_vga_realize() create an "i2c-ddc" device, but neglect to realize it. Affects machines sam460ex, shix, r2d, and fulong2e. In theory, a device becomes real only on realize. In practice, the transition from unreal to real is a fuzzy one. The work to make a device real can be spread between realize methods (fine), instance_init methods (wrong), and board code wiring up the device (fine as long as it effectively happens on realize). Depending on what exactly is done where, a device can work even when we neglect to realize it. This one appears to work. Nevertheless, it's a clear misuse of the interface. Even when it works today (more or less by chance), it can break tomorrow. Fix by realizing it right away. Visible in "info qom-tree"; here's the change for sam460ex: /machine (sam460ex-machine) [...] /unattached (container) [...] - /device[14] (sii3112) + /device[14] (i2c-ddc) + /device[15] (sii3112) [rest of device[*] renumbered...] Fixes: 4a1f253adb45ac6019971193d5077c4d5d55886a Fixes: c82c7336de58876862e6b4dccbda29e9240fd388 Cc: BALATON Zoltan <balaton@eik.bme.hu> Cc: qemu-ppc@nongnu.org Cc: Magnus Damm <magnus.damm@gmail.com> Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> Cc: Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Tested-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20200609122339.937862-19-armbru@redhat.com>
* display/xlnx_dp: Fix to realize "i2c-ddc" and "aux-to-i2c-bridge"Markus Armbruster2020-06-151-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xlnx_dp_init() creates these two devices, but they're never realized. Affects machine xlnx-zcu102. In theory, a device becomes real only on realize. In practice, the transition from unreal to real is a fuzzy one. The work to make a device real can be spread between realize methods (fine), instance_init methods (wrong), and board code wiring up the device (fine as long as it effectively happens on realize). Depending on what exactly is done where, a device can work even when we neglect to realize it. These two appear to work. Nevertheless, it's a clear misuse of the interface. Even when it works today (more or less by chance), it can break tomorrow. Fix by realizing them in xlnx_dp_realize(). Fixes: 58ac482a66de09a7590f705e53fc6a3fb8a055e8 Cc: KONRAD Frederic <fred.konrad@greensocs.com> Cc: Alistair Francis <alistair@alistair23.me> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-arm@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20200609122339.937862-3-armbru@redhat.com>
* hw/display/cirrus_vga: Fix code mis-indentationPhilippe Mathieu-Daudé2020-06-051-3/+3
| | | | | | | | | | | While replacing fprintf() by qemu_log_mask() in commit 2b55f4d3504, we incorrectly used a 'tab = 4 spaces' alignment, leading to misindented new code. Fix now. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200529165436.23573-1-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* ati-vga: check mm_index before recursive call (CVE-2020-13800)Prasad J Pandit2020-06-051-2/+8
| | | | | | | | | | | | | | | | While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by: Ren Ding <rding@gatech.edu> Reported-by: Hanqing Zhao <hanqing@gatech.edu> Reported-by: Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by: BALATON Zoltan <balaton@eik.bme.hu> Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sm501: Remove obsolete changelog and todo commentBALATON Zoltan2020-05-281-18/+1Star
| | | | | | | | | Also update copyright year for latest changes Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 1392cad2ad1315a5a50409970e0af061821462e6.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sm501: Optimize small overlapping blitsBALATON Zoltan2020-05-281-4/+11
| | | | | | | | | | AmigaOS tends to do a lot of small blits (even 1 pixel). Avoid malloc overhead by keeping around a buffer for this and only alloc when blitting larger areas. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 7946852258d528497e85f465327fc90b5c3b59fb.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sm501: Replace hand written implementation with pixman where possibleBALATON Zoltan2020-05-281-88/+119
| | | | | | | | | Besides being faster this should also prevent malicious guests to abuse 2D engine to overwrite data or cause a crash. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 58666389b6cae256e4e972a32c05cf8aa51bffc0.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sm501: Clean up local variables in sm501_2d_operationBALATON Zoltan2020-05-281-15/+16
| | | | | | | | | | Make variables local to the block they are used in to make it clearer which operation they are needed for. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: ae59f8138afe7f6a5a4a82539d0f61496a906b06.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sm501: Use BIT(x) macro to shorten constantBALATON Zoltan2020-05-281-3/+2Star
| | | | | | | Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 124bf5de8d7cf503b32b377d0445029a76bfbd49.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sm501: Shorten long variable names in sm501_2d_operationBALATON Zoltan2020-05-281-23/+22Star
| | | | | | | | This increases readability and cleans up some confusing naming. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: b9b67b94c46e945252a73c77dfd117132c63c4fb.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* sm501: Convert printf + abort to qemu_log_maskBALATON Zoltan2020-05-281-30/+27Star
| | | | | | | | | | | | Some places already use qemu_log_mask() to log unimplemented features or errors but some others have printf() then abort(). Convert these to qemu_log_mask() and avoid aborting to prevent guests to easily cause denial of service. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 305af87f59d81e92f2aaff09eb8a3603b8baa322.1590089984.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/pxa2xx_lcd: Replace printf() call by qemu_log_mask()Philippe Mathieu-Daudé2020-05-281-12/+14
| | | | | | | | | | | Replace printf() calls by qemu_log_mask(UNIMP), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-15-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/omap_dss: Replace fprintf() call by qemu_log_mask(LOG_UNIMP)Philippe Mathieu-Daudé2020-05-281-1/+1
| | | | | | | | | | | Replace fprintf() call by qemu_log_mask(LOG_UNIMP), which is disabled by default. This avoid flooding the terminal when fuzzing the device. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-14-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/exynos4210_fimd: Use qemu_log_mask(GUEST_ERROR)Philippe Mathieu-Daudé2020-05-281-17/+29
| | | | | | | | | Replace DPRINT_ERROR() by qemu_log_mask(GUEST_ERROR). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-13-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/vmware_vga: Let the PCI device own its I/O MemoryRegionPhilippe Mathieu-Daudé2020-05-281-1/+1
| | | | | | | | | To avoid the orphan I/O memory region being added in the /unattached QOM container, register the PCI device as its owner. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200526062252.19852-12-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/vmware_vga: Replace printf() calls by qemu_log_mask(ERROR)Philippe Mathieu-Daudé2020-05-281-5/+11
| | | | | | | | | | Avoid flooding stdio by converting printf() calls to qemu_log_mask(GUEST_ERROR), which are disabled by default. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-11-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/xlnx_dp: Replace disabled DPRINTF() by error_report()Philippe Mathieu-Daudé2020-05-281-6/+8
| | | | | | | | | | | | | DPRINTF() calls are disabled by default, so when unexpected data is used, the whole process abort without information. Display a bit of information with error_report() before crashing. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-10-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/dpcd: Convert debug printf()s to trace eventsPhilippe Mathieu-Daudé2020-05-282-13/+7Star
| | | | | | | | | Convert DPRINTF() to trace events and remove ifdef'ry. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-9-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/dpcd: Fix memory region sizePhilippe Mathieu-Daudé2020-05-281-2/+2
| | | | | | | | | The memory region size is 512K. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-8-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display/cirrus_vga: Convert debug printf() to trace eventPhilippe Mathieu-Daudé2020-05-282-14/+11Star
| | | | | | | | | Convert the final bit of DEBUG_BITBLT to a tracepoint. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200526062252.19852-7-f4bug@amsat.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-15 19:40:46 +0100