| 00adced5 | 23-Jul-2024 |
Hanna Czenczek <hreitz@redhat.com> |
virtio: Allow .get_vhost() without vhost_started
Historically, .get_vhost() was probably only called when vdev->vhost_started is true. However, we now decidedly want to call it also when vhost_star
virtio: Allow .get_vhost() without vhost_started
Historically, .get_vhost() was probably only called when vdev->vhost_started is true. However, we now decidedly want to call it also when vhost_started is false, specifically so we can issue a reset to the vhost back-end while device operation is stopped.
Some .get_vhost() implementations dereference some pointers (or return offsets from them) that are probably guaranteed to be non-NULL when vhost_started is true, but not necessarily otherwise. This patch makes all such implementations check all such pointers, returning NULL if any is NULL.
Signed-off-by: Hanna Czenczek <hreitz@redhat.com> Message-Id: <20240723163941.48775-2-hreitz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
show more ...
|
| d6192f3f | 21-Aug-2024 |
Haoran Zhang <wh1sper@zju.edu.cn> |
hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
fix vhost_user_gpu_chr_read() where `size` was incorrectly passed to `msg->flags`.
Fixes: 267f664658 ("hw/display: add vhost-user-vga & gp
hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
fix vhost_user_gpu_chr_read() where `size` was incorrectly passed to `msg->flags`.
Fixes: 267f664658 ("hw/display: add vhost-user-vga & gpu-pci") Signed-off-by: Haoran Zhang <wh1sper@zju.edu.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
show more ...
|
| 0fa57cbf | 31-Jul-2024 |
Peter Maydell <peter.maydell@linaro.org> |
hw/display/virtio-gpu: Improve "opengl is not available" error message
If the user tries to use the virtio-gpu-gl device but the display backend doesn't have OpenGL support enabled, we currently pri
hw/display/virtio-gpu: Improve "opengl is not available" error message
If the user tries to use the virtio-gpu-gl device but the display backend doesn't have OpenGL support enabled, we currently print a rather uninformative error message:
$ qemu-system-aarch64 -M virt -device virtio-gpu-gl qemu-system-aarch64: -device virtio-gpu-gl: opengl is not available
Since OpenGL is not enabled on display frontends by default, users are quite likely to run into this. Improve the error message to be more specific and to suggest to the user a path forward.
Note that the case of "user tried to enable OpenGL but the display backend doesn't handle it" is caught elsewhere first, so we can assume that isn't the problem:
$ qemu-system-aarch64 -M virt -device virtio-gpu-gl -display curses,gl=on qemu-system-aarch64: OpenGL is not supported by the display
(Use of error_append_hint() requires us to add an ERRP_GUARD() to the function, as noted in include/qapi/error.h.)
With this commit we now produce the hopefully more helpful error: $ ./build/x86/qemu-system-aarch64 -M virt -device virtio-gpu-gl qemu-system-aarch64: -device virtio-gpu-gl: The display backend does not have OpenGL support enabled It can be enabled with '-display BACKEND,gl=on' where BACKEND is the name of the display backend to use.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2443 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-ID: <20240731154136.3494621-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
show more ...
|
| cc455d7e | 17-Jun-2024 |
Marc-André Lureau <marcandre.lureau@redhat.com> |
virtio-gpu-gl: declare dependency on ui-opengl
Since commit e8a2db94 "virtio-gpu-virgl: teach it to get the QEMU EGL display", virtio-gl depends on ui-opengl symbol "qemu_egl_display".
Resolves: ht
virtio-gpu-gl: declare dependency on ui-opengl
Since commit e8a2db94 "virtio-gpu-virgl: teach it to get the QEMU EGL display", virtio-gl depends on ui-opengl symbol "qemu_egl_display".
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2391 Fixes: e8a2db94 ("virtio-gpu-virgl: teach it to get the QEMU EGL display") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
show more ...
|
| 345acc44 | 13-Jul-2024 |
SamJakob <me@samjakob.com> |
hw/display/bcm2835_fb: fix fb_use_offsets condition
It is common practice when implementing double-buffering on VideoCore to do so by multiplying the height of the virtual buffer by the number of vi
hw/display/bcm2835_fb: fix fb_use_offsets condition
It is common practice when implementing double-buffering on VideoCore to do so by multiplying the height of the virtual buffer by the number of virtual screens desired (i.e., two - in the case of double-bufferring).
At present, this won't work in QEMU because the logic in fb_use_offsets require that both the virtual width and height exceed their physical counterparts.
This appears to be unintentional/a typo and indeed the comment states; "Experimentally, the hardware seems to do this only if the viewport size is larger than the physical screen". The viewport/virtual size would be larger than the physical size if either virtual dimension were larger than their physical counterparts and not necessarily both.
Signed-off-by: SamJakob <me@samjakob.com> Message-id: 20240713160353.62410-1-me@samjakob.com Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
| 4bba8398 | 15-Jul-2024 |
Akihiko Odaki <akihiko.odaki@daynix.com> |
ui/console: Remove dpy_cursor_define_supported()
Remove dpy_cursor_define_supported() as it brings no benefit today and it has a few inherent problems.
All graphical displays except egl-headless su
ui/console: Remove dpy_cursor_define_supported()
Remove dpy_cursor_define_supported() as it brings no benefit today and it has a few inherent problems.
All graphical displays except egl-headless support cursor composition without DMA-BUF, and egl-headless is meant to be used in conjunction with another graphical display, so dpy_cursor_define_supported() always returns true and meaningless.
Even if we add a new display without cursor composition in the future, dpy_cursor_define_supported() will be problematic as a cursor display fix for it because some display devices like virtio-gpu cannot tell the lack of cursor composition capability to the guest and are unable to utilize the value the function returns. Therefore, all non-headless graphical displays must actually implement cursor composition for correct cursor display.
Another problem with dpy_cursor_define_supported() is that it returns true even if only some of the display listeners support cursor composition, which is wrong unless all display listeners that lack cursor composition is headless.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-ID: <20240715-cursor-v3-4-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
show more ...
|
| a418e7ae | 15-Jul-2024 |
Akihiko Odaki <akihiko.odaki@daynix.com> |
ui/console: Convert mouse visibility parameter into bool
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki
ui/console: Convert mouse visibility parameter into bool
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Phil Dennis-Jordan <phil@philjordan.eu> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240715-cursor-v3-2-afa5b9492dbf@daynix.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
show more ...
|
| 80c8a26d | 15-May-2024 |
Marc-André Lureau <marcandre.lureau@redhat.com> |
vhost-user-gpu: fix import of DMABUF
When using vhost-user-gpu with GL, qemu -display gtk doesn't show output and prints: qemu: eglCreateImageKHR failed
Since commit 9ac06df8b ("virtio-gpu-udmabuf:
vhost-user-gpu: fix import of DMABUF
When using vhost-user-gpu with GL, qemu -display gtk doesn't show output and prints: qemu: eglCreateImageKHR failed
Since commit 9ac06df8b ("virtio-gpu-udmabuf: correct naming of QemuDmaBuf size properties"), egl_dmabuf_import_texture() uses backing_{width,height} for the texture dimension.
Fixes: 9ac06df8b ("virtio-gpu-udmabuf: correct naming of QemuDmaBuf size properties") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20240515105237.1074116-1-marcandre.lureau@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
show more ...
|
| abd749b5 | 05-Jun-2024 |
Gerd Hoffmann <kraxel@redhat.com> |
ui+display: rename is_buffer_shared() -> surface_is_allocated()
Boolean return value is reversed, to align with QEMU_ALLOCATED_FLAG, so all callers must be adapted. Also rename share_surface variab
ui+display: rename is_buffer_shared() -> surface_is_allocated()
Boolean return value is reversed, to align with QEMU_ALLOCATED_FLAG, so all callers must be adapted. Also rename share_surface variable in vga_draw_graphic() to reduce confusion.
No functional change.
Suggested-by: Marc-André Lureau <marcandre.lureau@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20240605131444.797896-4-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
show more ...
|
| b1cf266c | 05-Jun-2024 |
Gerd Hoffmann <kraxel@redhat.com> |
stdvga: fix screen blanking
In case the display surface uses a shared buffer (i.e. uses vga vram directly instead of a shadow) go unshare the buffer before clearing it.
This avoids vga memory corru
stdvga: fix screen blanking
In case the display surface uses a shared buffer (i.e. uses vga vram directly instead of a shadow) go unshare the buffer before clearing it.
This avoids vga memory corruption, which in turn fixes unblanking not working properly with X11.
Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2067 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20240605131444.797896-2-kraxel@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
show more ...
|
| 6ece1df9 | 10-May-2024 |
Philippe Mathieu-Daudé <philmd@linaro.org> |
hw/xen: Register framebuffer backend via xen_backend_init()
Align the framebuffer backend with the other legacy ones, register it via xen_backend_init() when '-vga xenfb' is used. It is safe because
hw/xen: Register framebuffer backend via xen_backend_init()
Align the framebuffer backend with the other legacy ones, register it via xen_backend_init() when '-vga xenfb' is used. It is safe because MODULE_INIT_XEN_BACKEND is called in xen_bus_realize(), long after CLI processing initialized the vga_interface_type variable.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-8-philmd@linaro.org>
show more ...
|
| d76795ea | 10-May-2024 |
Philippe Mathieu-Daudé <philmd@linaro.org> |
hw/xen: Make XenDevOps structures const
Keep XenDevOps structures in .rodata.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <2024051
hw/xen: Make XenDevOps structures const
Keep XenDevOps structures in .rodata.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Paul Durrant <paul@xen.org> Message-Id: <20240510104908.76908-5-philmd@linaro.org>
show more ...
|
| 40a23ef6 | 16-May-2024 |
Marc-André Lureau <marcandre.lureau@redhat.com> |
virtio-gpu: fix v2 migration
Commit dfcf74fa ("virtio-gpu: fix scanout migration post-load") broke forward/backward version migration. Versioning of nested VMSD structures is not straightforward, as
virtio-gpu: fix v2 migration
Commit dfcf74fa ("virtio-gpu: fix scanout migration post-load") broke forward/backward version migration. Versioning of nested VMSD structures is not straightforward, as the wire format doesn't have nested structures versions. Introduce x-scanout-vmstate-version and a field test to save/load appropriately according to the machine version.
Fixes: dfcf74fa ("virtio-gpu: fix scanout migration post-load") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Fiona Ebner <f.ebner@proxmox.com> Tested-by: Fiona Ebner <f.ebner@proxmox.com> [fixed long lines] Signed-off-by: Fabiano Rosas <farosas@suse.de>
show more ...
|
| c0fcd633 | 08-May-2024 |
Dongwon Kim <dongwon.kim@intel.com> |
ui/console: Use qemu_dmabuf_new() and free() helpers instead
This commit introduces utility functions for the creation and deallocation of QemuDmaBuf instances. Additionally, it updates all relevant
ui/console: Use qemu_dmabuf_new() and free() helpers instead
This commit introduces utility functions for the creation and deallocation of QemuDmaBuf instances. Additionally, it updates all relevant sections of the codebase to utilize these new utility functions.
v7: remove prefix, "dpy_gl_" from all helpers qemu_dmabuf_free() returns without doing anything if input is null (Daniel P. Berrangé <berrange@redhat.com>) call G_DEFINE_AUTOPTR_CLEANUP_FUNC for qemu_dmabuf_free() (Daniel P. Berrangé <berrange@redhat.com>)
v8: Introduction of helpers was removed as those were already added by the previous commit
v9: set dmabuf->allow_fences to 'true' when dmabuf is created in virtio_gpu_create_dmabuf()/virtio-gpu-udmabuf.c
removed unnecessary spaces were accidently added in the patch, 'ui/console: Use qemu_dmabuf_new() a...'
v11: Calling qemu_dmabuf_close was removed as closing dmabuf->fd will be done in qemu_dmabuf_free anyway. (Daniel P. Berrangé <berrange@redhat.com>)
v12: --- Calling qemu_dmabuf_close separately as qemu_dmabuf_free doesn't do it.
--- 'dmabuf' is now allocated space so it should be freed at the end of dbus_scanout_texture
v13: --- Immediately free dmabuf after it is released to prevent possible leaking of the ptr (Marc-André Lureau <marcandre.lureau@redhat.com>)
--- Use g_autoptr macro to define *dmabuf for auto clean up instead of calling qemu_dmabuf_free (Marc-André Lureau <marcandre.lureau@redhat.com>)
v14: --- (vhost-user-gpu) Change qemu_dmabuf_free back to g_clear_pointer as it was done because of some misunderstanding (v13).
--- (vhost-user-gpu) g->dmabuf[m->scanout_id] needs to be set to NULL to prevent freed dmabuf to be accessed again in case if(fd==-1)break; happens (before new dmabuf is allocated). Otherwise, it would cause invalid memory access when the same function is executed. Also NULL check should be done before qemu_dmabuf_close (it asserts dmabuf!=NULL.). (Marc-André Lureau <marcandre.lureau@redhat.com>)
Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20240508175403.3399895-6-dongwon.kim@intel.com>
show more ...
|
| 6779a307 | 08-May-2024 |
Dongwon Kim <dongwon.kim@intel.com> |
ui/console: Use qemu_dmabuf_get_..() helpers instead
This commit updates all instances where fields within the QemuDmaBuf struct are directly accessed, replacing them with calls to these new helper
ui/console: Use qemu_dmabuf_get_..() helpers instead
This commit updates all instances where fields within the QemuDmaBuf struct are directly accessed, replacing them with calls to these new helper functions.
v6: fix typos in helper names in ui/spice-display.c
v7: removed prefix, "dpy_gl_" from all helpers
v8: Introduction of helpers was removed as those were already added by the previous commit
v11: -- Use new qemu_dmabuf_close() instead of close(qemu_dmabuf_get_fd()). (Daniel P. Berrangé <berrange@redhat.com>) -- Use new qemu_dmabuf_dup_fd() instead of dup(qemu_dmabuf_get_fd()). (Daniel P. Berrangé <berrange@redhat.com>)
Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Cc: Daniel P. Berrangé <berrange@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20240508175403.3399895-4-dongwon.kim@intel.com>
show more ...
|
| 88f5ed70 | 09-May-2024 |
Paolo Bonzini <pbonzini@redhat.com> |
xen: register legacy backends via xen_backend_init
It is okay to register legacy backends in the middle of xen_bus_init(). All that the registration does is record the existence of the backend in xe
xen: register legacy backends via xen_backend_init
It is okay to register legacy backends in the middle of xen_bus_init(). All that the registration does is record the existence of the backend in xenstore.
This makes it possible to remove them from the build without introducing undefined symbols in xen_be_init(). It also removes the need for the backend_register callback, whose only purpose is to avoid registering nonfunctional backends.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240509170044.190795-8-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
show more ...
|
| da4b2481 | 02-May-2024 |
Paolo Bonzini <pbonzini@redhat.com> |
display: remove GraphicHwOps from typedefs.h
Basically all uses of GraphicHwOps are defining an instance of it, which requires the full definition of the struct. It is pointless to have it in typed
display: remove GraphicHwOps from typedefs.h
Basically all uses of GraphicHwOps are defining an instance of it, which requires the full definition of the struct. It is pointless to have it in typedefs.h.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
show more ...
|
| 8a161d08 | 02-May-2024 |
Paolo Bonzini <pbonzini@redhat.com> |
build: do not build virtio-vga-gl if virgl/opengl not available
If virgl and opengl are not available, the build process creates a useless libvirtio-vga-gl module that does not have any device in it
build: do not build virtio-vga-gl if virgl/opengl not available
If virgl and opengl are not available, the build process creates a useless libvirtio-vga-gl module that does not have any device in it. Follow the example of virtio-vga-rutabaga and do not build the module at all in that case.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
show more ...
|
| c771f883 | 24-Apr-2024 |
Inès Varhol <ines.varhol@telecom-paris.fr> |
hw/display : Add device DM163
This device implements the IM120417002 colors shield v1.1 for Arduino (which relies on the DM163 8x3-channel led driving logic) and features a simple display of an 8x8
hw/display : Add device DM163
This device implements the IM120417002 colors shield v1.1 for Arduino (which relies on the DM163 8x3-channel led driving logic) and features a simple display of an 8x8 RGB matrix. The columns of the matrix are driven by the DM163 and the rows are driven externally.
Acked-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr> Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240424200929.240921-2-ines.varhol@telecom-paris.fr [PMM: updated to new reset hold method prototype] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
| 42508261 | 12-Dec-2023 |
Philippe Mathieu-Daudé <philmd@linaro.org> |
exec: Declare target_words_bigendian() in 'exec/tswap.h'
We usually check target endianess before swapping values, so target_words_bigendian() declaration makes sense in "exec/tswap.h" with the targ
exec: Declare target_words_bigendian() in 'exec/tswap.h'
We usually check target endianess before swapping values, so target_words_bigendian() declaration makes sense in "exec/tswap.h" with the target swapping helpers.
Remove "hw/core/cpu.h" when it was only included to get the target_words_bigendian() declaration.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng> Message-Id: <20231212123401.37493-16-philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
| ad80e367 | 12-Apr-2024 |
Peter Maydell <peter.maydell@linaro.org> |
hw, target: Add ResetType argument to hold and exit phase methods
We pass a ResetType argument to the Resettable class enter phase method, but we don't pass it to hold and exit, even though the call
hw, target: Add ResetType argument to hold and exit phase methods
We pass a ResetType argument to the Resettable class enter phase method, but we don't pass it to hold and exit, even though the callsites have it readily available. This means that if a device cared about the ResetType it would need to record it in the enter phase method to use later on. Pass the type to all three of the phase methods to avoid having to do that.
Commit created with
for dir in hw target include; do \ spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/reset-type.cocci \ --keep-comments --smpl-spacing --in-place \ --include-headers --dir $dir; done
and no manual edits.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Luc Michel <luc.michel@amd.com> Message-id: 20240412160809.1260625-5-peter.maydell@linaro.org
show more ...
|
| f89761d3 | 02-Apr-2024 |
Paolo Bonzini <pbonzini@redhat.com> |
vga: move dirty memory region code together
Take into account split screen mode close to wrap around, which is the other special case for dirty memory region computation.
Signed-off-by: Paolo Bonzi
vga: move dirty memory region code together
Take into account split screen mode close to wrap around, which is the other special case for dirty memory region computation.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
show more ...
|
| ab75ecb7 | 02-Apr-2024 |
Paolo Bonzini <pbonzini@redhat.com> |
vga: optimize computation of dirty memory region
The depth == 0 and depth == 15 have to be special cased because width * depth / 8 does not provide the correct scanline length. However, thanks to th
vga: optimize computation of dirty memory region
The depth == 0 and depth == 15 have to be special cased because width * depth / 8 does not provide the correct scanline length. However, thanks to the recent reorganization of vga_draw_graphic() the correct value of VRAM bits per pixel is available in "bits".
Use it (via the same "bwidth" computation that is used later in the function), thus restricting the slow path to the wraparound case.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
show more ...
|
| 5643190b | 08-Apr-2024 |
Paolo Bonzini <pbonzini@redhat.com> |
ramfb: move stubs out of stubs/
Since the ramfb stubs are needed exactly when the Kconfig symbols are not needed, move them to hw/display/ and compile them when ramfb.c is absent.
Signed-off-by: Pa
ramfb: move stubs out of stubs/
Since the ramfb stubs are needed exactly when the Kconfig symbols are not needed, move them to hw/display/ and compile them when ramfb.c is absent.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240408155330.522792-14-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
show more ...
|
| ba28e0ff | 04-Apr-2024 |
Philippe Mathieu-Daudé <philmd@linaro.org> |
hw/display/virtio-gpu: Protect from DMA re-entrancy bugs
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() so the bus and device use the same guard. Otherwise the DMA-reentrancy protection ca
hw/display/virtio-gpu: Protect from DMA re-entrancy bugs
Replace qemu_bh_new_guarded() by virtio_bh_new_guarded() so the bus and device use the same guard. Otherwise the DMA-reentrancy protection can be bypassed:
$ cat << EOF | qemu-system-i386 -display none -nodefaults \ -machine q35,accel=qtest \ -m 512M \ -device virtio-gpu \ -qtest stdio outl 0xcf8 0x80000820 outl 0xcfc 0xe0004000 outl 0xcf8 0x80000804 outw 0xcfc 0x06 write 0xe0004030 0x4 0x024000e0 write 0xe0004028 0x1 0xff write 0xe0004020 0x4 0x00009300 write 0xe000401c 0x1 0x01 write 0x101 0x1 0x04 write 0x103 0x1 0x1c write 0x9301c8 0x1 0x18 write 0x105 0x1 0x1c write 0x107 0x1 0x1c write 0x109 0x1 0x1c write 0x10b 0x1 0x00 write 0x10d 0x1 0x00 write 0x10f 0x1 0x00 write 0x111 0x1 0x00 write 0x113 0x1 0x00 write 0x115 0x1 0x00 write 0x117 0x1 0x00 write 0x119 0x1 0x00 write 0x11b 0x1 0x00 write 0x11d 0x1 0x00 write 0x11f 0x1 0x00 write 0x121 0x1 0x00 write 0x123 0x1 0x00 write 0x125 0x1 0x00 write 0x127 0x1 0x00 write 0x129 0x1 0x00 write 0x12b 0x1 0x00 write 0x12d 0x1 0x00 write 0x12f 0x1 0x00 write 0x131 0x1 0x00 write 0x133 0x1 0x00 write 0x135 0x1 0x00 write 0x137 0x1 0x00 write 0x139 0x1 0x00 write 0xe0007003 0x1 0x00 EOF ... ================================================================= ==276099==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000011178 at pc 0x562cc3b736c7 bp 0x7ffed49dee60 sp 0x7ffed49dee58 READ of size 8 at 0x60d000011178 thread T0 #0 0x562cc3b736c6 in virtio_gpu_ctrl_response hw/display/virtio-gpu.c:180:42 #1 0x562cc3b7c40b in virtio_gpu_ctrl_response_nodata hw/display/virtio-gpu.c:192:5 #2 0x562cc3b7c40b in virtio_gpu_simple_process_cmd hw/display/virtio-gpu.c:1015:13 #3 0x562cc3b82873 in virtio_gpu_process_cmdq hw/display/virtio-gpu.c:1050:9 #4 0x562cc4a85514 in aio_bh_call util/async.c:169:5 #5 0x562cc4a85c52 in aio_bh_poll util/async.c:216:13 #6 0x562cc4a1a79b in aio_dispatch util/aio-posix.c:423:5 #7 0x562cc4a8a2da in aio_ctx_dispatch util/async.c:358:5 #8 0x7f36840547a8 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x547a8) #9 0x562cc4a8b753 in glib_pollfds_poll util/main-loop.c:290:9 #10 0x562cc4a8b753 in os_host_main_loop_wait util/main-loop.c:313:5 #11 0x562cc4a8b753 in main_loop_wait util/main-loop.c:592:11 #12 0x562cc3938186 in qemu_main_loop system/runstate.c:782:9 #13 0x562cc43b7af5 in qemu_default_main system/main.c:37:14 #14 0x7f3683a6c189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #15 0x7f3683a6c244 in __libc_start_main csu/../csu/libc-start.c:381:3 #16 0x562cc2a58ac0 in _start (qemu-system-i386+0x231bac0)
0x60d000011178 is located 56 bytes inside of 136-byte region [0x60d000011140,0x60d0000111c8) freed by thread T0 here: #0 0x562cc2adb662 in __interceptor_free (qemu-system-i386+0x239e662) #1 0x562cc3b86b21 in virtio_gpu_reset hw/display/virtio-gpu.c:1524:9 #2 0x562cc416e20e in virtio_reset hw/virtio/virtio.c:2145:9 #3 0x562cc37c5644 in virtio_pci_reset hw/virtio/virtio-pci.c:2249:5 #4 0x562cc4233758 in memory_region_write_accessor system/memory.c:497:5 #5 0x562cc4232eea in access_with_adjusted_size system/memory.c:573:18
previously allocated by thread T0 here: #0 0x562cc2adb90e in malloc (qemu-system-i386+0x239e90e) #1 0x7f368405a678 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5a678) #2 0x562cc4163ffc in virtqueue_split_pop hw/virtio/virtio.c:1612:12 #3 0x562cc4163ffc in virtqueue_pop hw/virtio/virtio.c:1783:16 #4 0x562cc3b91a95 in virtio_gpu_handle_ctrl hw/display/virtio-gpu.c:1112:15 #5 0x562cc4a85514 in aio_bh_call util/async.c:169:5 #6 0x562cc4a85c52 in aio_bh_poll util/async.c:216:13 #7 0x562cc4a1a79b in aio_dispatch util/aio-posix.c:423:5
SUMMARY: AddressSanitizer: heap-use-after-free hw/display/virtio-gpu.c:180:42 in virtio_gpu_ctrl_response
With this change, the same reproducer triggers:
qemu-system-i386: warning: Blocked re-entrant IO on MemoryRegion: virtio-pci-common-virtio-gpu at addr: 0x6
Fixes: CVE-2024-3446 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Yongkang Jia <kangel@zju.edu.cn> Reported-by: Xiao Lei <nop.leixiao@gmail.com> Reported-by: Yiming Tao <taoym@zju.edu.cn> Buglink: https://bugs.launchpad.net/qemu/+bug/1888606 Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20240409105537.18308-3-philmd@linaro.org>
show more ...
|