All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [PULL 0/8] Vga 20190507 patches
@ 2019-05-07  8:19 Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 1/8] qxl: check release info object Gerd Hoffmann
                   ` (8 more replies)
  0 siblings, 9 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, qemu-arm, qemu-ppc,
	Gerd Hoffmann, Edgar E. Iglesias, Paolo Bonzini

The following changes since commit a6ae23831b05a11880b40f7d58e332c45a6b04f7:

  Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging (2019-05-03 15:26:09 +0100)

are available in the Git repository at:

  git://git.kraxel.org/qemu tags/vga-20190507-pull-request

for you to fetch changes up to 6306cae275c7091aa4e785809d956b475bfedab4:

  i2c-ddc: move it to hw/display (2019-05-07 09:56:10 +0200)

----------------------------------------------------------------
vga: bugfixes for qxl, cirrus, ati.
vga: add "-vga help" support.
vga: move i2c-ddc to display.

----------------------------------------------------------------

BALATON Zoltan (1):
  ati-vga: Fix check for blt outside vram

Daniel P. Berrangé (1):
  qxl: avoid unaligned pointer reads/writes

Marc-André Lureau (2):
  vl: constify VGAInterfaceInfo
  vl: add -vga help support

Paolo Bonzini (1):
  i2c-ddc: move it to hw/display

Philippe Mathieu-Daudé (2):
  hw/display/cirrus_vga: Update the documentation URL
  hw/display/cirrus_vga: Remove unused include

Prasad J Pandit (1):
  qxl: check release info object

 include/hw/{i2c => display}/i2c-ddc.h |  0
 include/hw/display/xlnx_dp.h          |  2 +-
 hw/display/ati_2d.c                   | 12 +++---
 hw/display/cirrus_vga.c               | 10 +++--
 hw/{i2c => display}/i2c-ddc.c         |  2 +-
 hw/display/qxl.c                      | 58 +++++++++++++--------------
 hw/display/sii9022.c                  |  2 +-
 hw/display/sm501.c                    |  2 +-
 vl.c                                  | 46 +++++++++++++++------
 hw/display/Kconfig                    |  5 +++
 hw/display/Makefile.objs              |  1 +
 hw/i2c/Kconfig                        |  5 ---
 hw/i2c/Makefile.objs                  |  1 -
 13 files changed, 84 insertions(+), 62 deletions(-)
 rename include/hw/{i2c => display}/i2c-ddc.h (100%)
 rename hw/{i2c => display}/i2c-ddc.c (99%)

-- 
2.18.1



^ permalink raw reply	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 1/8] qxl: check release info object
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 2/8] hw/display/cirrus_vga: Update the documentation URL Gerd Hoffmann
                   ` (7 subsequent siblings)
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Prasad J Pandit, Alistair Francis, qemu-arm,
	qemu-ppc, Gerd Hoffmann, Edgar E. Iglesias, Paolo Bonzini

From: Prasad J Pandit <pjp@fedoraproject.org>

When releasing spice resources in release_resource() routine,
if release info object 'ext.info' is null, it leads to null
pointer dereference. Add check to avoid it.

Reported-by: Bugs SysSec <bugs-syssec@rub.de>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20190425063534.32747-1-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/qxl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index c8ce5781e037..632923add239 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -777,6 +777,9 @@ static void interface_release_resource(QXLInstance *sin,
     QXLReleaseRing *ring;
     uint64_t *item, id;
 
+    if (!ext.info) {
+        return;
+    }
     if (ext.group_id == MEMSLOT_GROUP_HOST) {
         /* host group -> vga mode update request */
         QXLCommandExt *cmdext = (void *)(intptr_t)(ext.info->id);
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 2/8] hw/display/cirrus_vga: Update the documentation URL
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 1/8] qxl: check release info object Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 3/8] hw/display/cirrus_vga: Remove unused include Gerd Hoffmann
                   ` (6 subsequent siblings)
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, qemu-arm, qemu-ppc,
	Gerd Hoffmann, Edgar E. Iglesias, Paolo Bonzini,
	Philippe Mathieu-Daudé

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The documentation URL is not working, but is backed up by the
Wayback Machine on the Internet Archive.
Replace the outdated link by a captured one.
Add another link to the VGADOC4b.ZIP archive content.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190504121650.12651-1-philmd@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/cirrus_vga.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index a0e71469f4d0..a04440b3748c 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -23,8 +23,13 @@
  * THE SOFTWARE.
  */
 /*
- * Reference: Finn Thogersons' VGADOC4b
- *   available at http://home.worldonline.dk/~finth/
+ * Reference: Finn Thogersons' VGADOC4b:
+ *
+ *  http://web.archive.org/web/20021019054927/http://home.worldonline.dk/finth/
+ *
+ * VGADOC4b.ZIP content available at:
+ *
+ *  https://pdos.csail.mit.edu/6.828/2005/readings/hardware/vgadoc
  */
 #include "qemu/osdep.h"
 #include "qemu/units.h"
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 3/8] hw/display/cirrus_vga: Remove unused include
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 1/8] qxl: check release info object Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 2/8] hw/display/cirrus_vga: Update the documentation URL Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 4/8] vl: constify VGAInterfaceInfo Gerd Hoffmann
                   ` (5 subsequent siblings)
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, qemu-arm, qemu-ppc,
	Gerd Hoffmann, Edgar E. Iglesias, Paolo Bonzini,
	Philippe Mathieu-Daudé

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Commit ce3cf70edaaf split the ISA device out of the PCI one,
but forgot to remove the "hw/loader.h" header inclusion (the ISA
device calls rom_add_vga()).  Remove the now unused include.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190505225640.4592-1-philmd@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/cirrus_vga.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index a04440b3748c..76c052c702ef 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -38,7 +38,6 @@
 #include "hw/hw.h"
 #include "hw/pci/pci.h"
 #include "ui/pixel_ops.h"
-#include "hw/loader.h"
 #include "cirrus_vga_internal.h"
 
 /*
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 4/8] vl: constify VGAInterfaceInfo
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
                   ` (2 preceding siblings ...)
  2019-05-07  8:19 ` [Qemu-devel] [PULL 3/8] hw/display/cirrus_vga: Remove unused include Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 5/8] vl: add -vga help support Gerd Hoffmann
                   ` (4 subsequent siblings)
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, Marc-André Lureau,
	qemu-arm, qemu-ppc, Gerd Hoffmann, Edgar E. Iglesias,
	Paolo Bonzini

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190412152713.16018-2-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 vl.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/vl.c b/vl.c
index d9fea0a11966..6b2820483c43 100644
--- a/vl.c
+++ b/vl.c
@@ -2015,7 +2015,7 @@ typedef struct VGAInterfaceInfo {
     const char *class_names[2];
 } VGAInterfaceInfo;
 
-static VGAInterfaceInfo vga_interfaces[VGA_TYPE_MAX] = {
+static const VGAInterfaceInfo vga_interfaces[VGA_TYPE_MAX] = {
     [VGA_NONE] = {
         .opt_name = "none",
     },
@@ -2061,7 +2061,7 @@ static VGAInterfaceInfo vga_interfaces[VGA_TYPE_MAX] = {
 
 static bool vga_interface_available(VGAInterfaceType t)
 {
-    VGAInterfaceInfo *ti = &vga_interfaces[t];
+    const VGAInterfaceInfo *ti = &vga_interfaces[t];
 
     assert(t < VGA_TYPE_MAX);
     return !ti->class_names[0] ||
@@ -2076,7 +2076,7 @@ static void select_vgahw(const char *p)
 
     assert(vga_interface_type == VGA_NONE);
     for (t = 0; t < VGA_TYPE_MAX; t++) {
-        VGAInterfaceInfo *ti = &vga_interfaces[t];
+        const VGAInterfaceInfo *ti = &vga_interfaces[t];
         if (ti->opt_name && strstart(p, ti->opt_name, &opts)) {
             if (!vga_interface_available(t)) {
                 error_report("%s not available", ti->name);
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 5/8] vl: add -vga help support
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
                   ` (3 preceding siblings ...)
  2019-05-07  8:19 ` [Qemu-devel] [PULL 4/8] vl: constify VGAInterfaceInfo Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 6/8] qxl: avoid unaligned pointer reads/writes Gerd Hoffmann
                   ` (3 subsequent siblings)
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, Marc-André Lureau,
	qemu-arm, qemu-ppc, Gerd Hoffmann, Edgar E. Iglesias,
	Paolo Bonzini

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Provide help output similar to other argument help handling:

$ qemu-system-x86_64 -vga help
none
std                  standard VGA (default)
cirrus               Cirrus VGA
vmware               VMWare SVGA
xenfb
qxl                  QXL VGA
virtio               Virtio VG

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190412152713.16018-3-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 vl.c | 40 +++++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 9 deletions(-)

diff --git a/vl.c b/vl.c
index 6b2820483c43..b6709514c1bb 100644
--- a/vl.c
+++ b/vl.c
@@ -2069,11 +2069,39 @@ static bool vga_interface_available(VGAInterfaceType t)
            object_class_by_name(ti->class_names[1]);
 }
 
-static void select_vgahw(const char *p)
+static const char *
+get_default_vga_model(const MachineClass *machine_class)
+{
+    if (machine_class->default_display) {
+        return machine_class->default_display;
+    } else if (vga_interface_available(VGA_CIRRUS)) {
+        return "cirrus";
+    } else if (vga_interface_available(VGA_STD)) {
+        return "std";
+    }
+
+    return NULL;
+}
+
+static void select_vgahw(const MachineClass *machine_class, const char *p)
 {
     const char *opts;
     int t;
 
+    if (g_str_equal(p, "help")) {
+        const char *def = get_default_vga_model(machine_class);
+
+        for (t = 0; t < VGA_TYPE_MAX; t++) {
+            const VGAInterfaceInfo *ti = &vga_interfaces[t];
+
+            if (vga_interface_available(t) && ti->opt_name) {
+                printf("%-20s %s%s\n", ti->opt_name, ti->name ?: "",
+                       g_str_equal(ti->opt_name, def) ? " (default)" : "");
+            }
+        }
+        exit(0);
+    }
+
     assert(vga_interface_type == VGA_NONE);
     for (t = 0; t < VGA_TYPE_MAX; t++) {
         const VGAInterfaceInfo *ti = &vga_interfaces[t];
@@ -4424,16 +4452,10 @@ int main(int argc, char **argv, char **envp)
 
     /* If no default VGA is requested, the default is "none".  */
     if (default_vga) {
-        if (machine_class->default_display) {
-            vga_model = machine_class->default_display;
-        } else if (vga_interface_available(VGA_CIRRUS)) {
-            vga_model = "cirrus";
-        } else if (vga_interface_available(VGA_STD)) {
-            vga_model = "std";
-        }
+        vga_model = get_default_vga_model(machine_class);
     }
     if (vga_model) {
-        select_vgahw(vga_model);
+        select_vgahw(machine_class, vga_model);
     }
 
     if (watchdog) {
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 6/8] qxl: avoid unaligned pointer reads/writes
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
                   ` (4 preceding siblings ...)
  2019-05-07  8:19 ` [Qemu-devel] [PULL 5/8] vl: add -vga help support Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 7/8] ati-vga: Fix check for blt outside vram Gerd Hoffmann
                   ` (2 subsequent siblings)
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, qemu-arm, qemu-ppc,
	Gerd Hoffmann, Edgar E. Iglesias, Paolo Bonzini

From: Daniel P. Berrangé <berrange@redhat.com>

The SPICE_RING_PROD_ITEM() macro is initializing a local
'uint64_t *' variable to point to the 'el' field inside
the QXLReleaseRing struct. This uint64_t field is not
guaranteed aligned as the struct is packed.

Code should not take the address of fields within a
packed struct. Changing the SPICE_RING_PROD_ITEM()
macro to avoid taking the address of the field is
impractical. It is clearer to just remove the macro
and inline its functionality in the three call sites
that need it.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20190412121626.19829-6-berrange@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/qxl.c | 55 +++++++++++++++++++++---------------------------
 1 file changed, 24 insertions(+), 31 deletions(-)

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 632923add239..3880a7410b73 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -33,24 +33,6 @@
 
 #include "qxl.h"
 
-/*
- * NOTE: SPICE_RING_PROD_ITEM accesses memory on the pci bar and as
- * such can be changed by the guest, so to avoid a guest trigerrable
- * abort we just qxl_set_guest_bug and set the return to NULL. Still
- * it may happen as a result of emulator bug as well.
- */
-#undef SPICE_RING_PROD_ITEM
-#define SPICE_RING_PROD_ITEM(qxl, r, ret) {                             \
-        uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r);           \
-        if (prod >= ARRAY_SIZE((r)->items)) {                           \
-            qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
-                          "%u >= %zu", prod, ARRAY_SIZE((r)->items));   \
-            ret = NULL;                                                 \
-        } else {                                                        \
-            ret = &(r)->items[prod].el;                                 \
-        }                                                               \
-    }
-
 #undef SPICE_RING_CONS_ITEM
 #define SPICE_RING_CONS_ITEM(qxl, r, ret) {                             \
         uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r);           \
@@ -414,7 +396,8 @@ static void init_qxl_rom(PCIQXLDevice *d)
 static void init_qxl_ram(PCIQXLDevice *d)
 {
     uint8_t *buf;
-    uint64_t *item;
+    uint32_t prod;
+    QXLReleaseRing *ring;
 
     buf = d->vga.vram_ptr;
     d->ram = (QXLRam *)(buf + le32_to_cpu(d->shadow_rom.ram_header_offset));
@@ -426,9 +409,12 @@ static void init_qxl_ram(PCIQXLDevice *d)
     SPICE_RING_INIT(&d->ram->cmd_ring);
     SPICE_RING_INIT(&d->ram->cursor_ring);
     SPICE_RING_INIT(&d->ram->release_ring);
-    SPICE_RING_PROD_ITEM(d, &d->ram->release_ring, item);
-    assert(item);
-    *item = 0;
+
+    ring = &d->ram->release_ring;
+    prod = ring->prod & SPICE_RING_INDEX_MASK(ring);
+    assert(prod < ARRAY_SIZE(ring->items));
+    ring->items[prod].el = 0;
+
     qxl_ring_set_dirty(d);
 }
 
@@ -732,7 +718,7 @@ static int interface_req_cmd_notification(QXLInstance *sin)
 static inline void qxl_push_free_res(PCIQXLDevice *d, int flush)
 {
     QXLReleaseRing *ring = &d->ram->release_ring;
-    uint64_t *item;
+    uint32_t prod;
     int notify;
 
 #define QXL_FREE_BUNCH_SIZE 32
@@ -759,11 +745,15 @@ static inline void qxl_push_free_res(PCIQXLDevice *d, int flush)
     if (notify) {
         qxl_send_events(d, QXL_INTERRUPT_DISPLAY);
     }
-    SPICE_RING_PROD_ITEM(d, ring, item);
-    if (!item) {
+
+    ring = &d->ram->release_ring;
+    prod = ring->prod & SPICE_RING_INDEX_MASK(ring);
+    if (prod >= ARRAY_SIZE(ring->items)) {
+        qxl_set_guest_bug(d, "SPICE_RING_PROD_ITEM indices mismatch "
+                          "%u >= %zu", prod, ARRAY_SIZE(ring->items));
         return;
     }
-    *item = 0;
+    ring->items[prod].el = 0;
     d->num_free_res = 0;
     d->last_release = NULL;
     qxl_ring_set_dirty(d);
@@ -775,7 +765,8 @@ static void interface_release_resource(QXLInstance *sin,
 {
     PCIQXLDevice *qxl = container_of(sin, PCIQXLDevice, ssd.qxl);
     QXLReleaseRing *ring;
-    uint64_t *item, id;
+    uint32_t prod;
+    uint64_t id;
 
     if (!ext.info) {
         return;
@@ -795,16 +786,18 @@ static void interface_release_resource(QXLInstance *sin,
      * pci bar 0, $command.release_info
      */
     ring = &qxl->ram->release_ring;
-    SPICE_RING_PROD_ITEM(qxl, ring, item);
-    if (!item) {
+    prod = ring->prod & SPICE_RING_INDEX_MASK(ring);
+    if (prod >= ARRAY_SIZE(ring->items)) {
+        qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch "
+                          "%u >= %zu", prod, ARRAY_SIZE(ring->items));
         return;
     }
-    if (*item == 0) {
+    if (ring->items[prod].el == 0) {
         /* stick head into the ring */
         id = ext.info->id;
         ext.info->next = 0;
         qxl_ram_set_dirty(qxl, &ext.info->next);
-        *item = id;
+        ring->items[prod].el = id;
         qxl_ring_set_dirty(qxl);
     } else {
         /* append item to the list */
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 7/8] ati-vga: Fix check for blt outside vram
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
                   ` (5 preceding siblings ...)
  2019-05-07  8:19 ` [Qemu-devel] [PULL 6/8] qxl: avoid unaligned pointer reads/writes Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07  8:19 ` [Qemu-devel] [PULL 8/8] i2c-ddc: move it to hw/display Gerd Hoffmann
  2019-05-07 23:06 ` [Qemu-devel] [PULL 0/8] Vga 20190507 patches Peter Maydell
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, qemu-arm, qemu-ppc,
	Gerd Hoffmann, Edgar E. Iglesias, Paolo Bonzini

From: BALATON Zoltan <balaton@eik.bme.hu>

Fix the check preventing calling pixman functions that would access
memory outside allocated vram. The r128 X driver sometimes seem to try
blits that span outside vram, this check prevents crashing QEMU in
that case. (The r128 X driver may have problems even on real hardware
so I'm not sure if it's a client bug or emulation problem but at least
QEMU should survive.)

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Tested-by: Andrew Randrianasulu <randrianasulu@gmail.com>
Message-Id: <20190409110732.5C5FF7465DB@zero.eik.bme.hu>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/ati_2d.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
index bc98ba6eebf6..fe3ae148647b 100644
--- a/hw/display/ati_2d.c
+++ b/hw/display/ati_2d.c
@@ -79,10 +79,10 @@ void ati_2d_blt(ATIVGAState *s)
                 s->regs.dst_width, s->regs.dst_height);
         end = s->vga.vram_ptr + s->vga.vram_size;
         if (src_bits >= end || dst_bits >= end ||
-            src_bits + (s->regs.src_y + s->regs.dst_height) * src_stride +
-            s->regs.src_x >= end ||
-            dst_bits + (s->regs.dst_y + s->regs.dst_height) * dst_stride +
-            s->regs.dst_x >= end) {
+            src_bits + s->regs.src_x + (s->regs.src_y + s->regs.dst_height) *
+            src_stride * sizeof(uint32_t) >= end ||
+            dst_bits + s->regs.dst_x + (s->regs.dst_y + s->regs.dst_height) *
+            dst_stride * sizeof(uint32_t) >= end) {
             qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
             return;
         }
@@ -140,8 +140,8 @@ void ati_2d_blt(ATIVGAState *s)
                 filler);
         end = s->vga.vram_ptr + s->vga.vram_size;
         if (dst_bits >= end ||
-            dst_bits + (s->regs.dst_y + s->regs.dst_height) * dst_stride +
-            s->regs.dst_x >= end) {
+            dst_bits + s->regs.dst_x + (s->regs.dst_y + s->regs.dst_height) *
+            dst_stride * sizeof(uint32_t) >= end) {
             qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
             return;
         }
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* [Qemu-devel] [PULL 8/8] i2c-ddc: move it to hw/display
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
                   ` (6 preceding siblings ...)
  2019-05-07  8:19 ` [Qemu-devel] [PULL 7/8] ati-vga: Fix check for blt outside vram Gerd Hoffmann
@ 2019-05-07  8:19 ` Gerd Hoffmann
  2019-05-07 23:06 ` [Qemu-devel] [PULL 0/8] Vga 20190507 patches Peter Maydell
  8 siblings, 0 replies; 10+ messages in thread
From: Gerd Hoffmann @ 2019-05-07  8:19 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Alistair Francis, qemu-arm, qemu-ppc,
	Gerd Hoffmann, Edgar E. Iglesias, Paolo Bonzini

From: Paolo Bonzini <pbonzini@redhat.com>

Move it together with the other EDID code.  hw/i2c should only
include the core and the adapters, not the slaves.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20190325155923.30987-1-pbonzini@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 include/hw/{i2c => display}/i2c-ddc.h | 0
 include/hw/display/xlnx_dp.h          | 2 +-
 hw/{i2c => display}/i2c-ddc.c         | 2 +-
 hw/display/sii9022.c                  | 2 +-
 hw/display/sm501.c                    | 2 +-
 hw/display/Kconfig                    | 5 +++++
 hw/display/Makefile.objs              | 1 +
 hw/i2c/Kconfig                        | 5 -----
 hw/i2c/Makefile.objs                  | 1 -
 9 files changed, 10 insertions(+), 10 deletions(-)
 rename include/hw/{i2c => display}/i2c-ddc.h (100%)
 rename hw/{i2c => display}/i2c-ddc.c (99%)

diff --git a/include/hw/i2c/i2c-ddc.h b/include/hw/display/i2c-ddc.h
similarity index 100%
rename from include/hw/i2c/i2c-ddc.h
rename to include/hw/display/i2c-ddc.h
diff --git a/include/hw/display/xlnx_dp.h b/include/hw/display/xlnx_dp.h
index 26b759cd448d..45a805033a53 100644
--- a/include/hw/display/xlnx_dp.h
+++ b/include/hw/display/xlnx_dp.h
@@ -27,7 +27,7 @@
 #include "hw/misc/auxbus.h"
 #include "hw/i2c/i2c.h"
 #include "hw/display/dpcd.h"
-#include "hw/i2c/i2c-ddc.h"
+#include "hw/display/i2c-ddc.h"
 #include "qemu/fifo8.h"
 #include "qemu/units.h"
 #include "hw/dma/xlnx_dpdma.h"
diff --git a/hw/i2c/i2c-ddc.c b/hw/display/i2c-ddc.c
similarity index 99%
rename from hw/i2c/i2c-ddc.c
rename to hw/display/i2c-ddc.c
index 7aa872777145..9fe5403a923e 100644
--- a/hw/i2c/i2c-ddc.c
+++ b/hw/display/i2c-ddc.c
@@ -20,7 +20,7 @@
 #include "qemu-common.h"
 #include "qemu/log.h"
 #include "hw/i2c/i2c.h"
-#include "hw/i2c/i2c-ddc.h"
+#include "hw/display/i2c-ddc.h"
 
 #ifndef DEBUG_I2CDDC
 #define DEBUG_I2CDDC 0
diff --git a/hw/display/sii9022.c b/hw/display/sii9022.c
index 9994385c35a2..9c36e4c17ec9 100644
--- a/hw/display/sii9022.c
+++ b/hw/display/sii9022.c
@@ -16,7 +16,7 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "hw/i2c/i2c.h"
-#include "hw/i2c/i2c-ddc.h"
+#include "hw/display/i2c-ddc.h"
 #include "trace.h"
 
 #define SII9022_SYS_CTRL_DATA 0x1a
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index 2122291308f0..1e2709b2d002 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -35,7 +35,7 @@
 #include "hw/sysbus.h"
 #include "hw/pci/pci.h"
 #include "hw/i2c/i2c.h"
-#include "hw/i2c/i2c-ddc.h"
+#include "hw/display/i2c-ddc.h"
 #include "qemu/range.h"
 #include "ui/pixel_ops.h"
 #include "qemu/bswap.h"
diff --git a/hw/display/Kconfig b/hw/display/Kconfig
index 72be57a40311..c236cd2d0a7c 100644
--- a/hw/display/Kconfig
+++ b/hw/display/Kconfig
@@ -1,3 +1,8 @@
+config DDC
+    bool
+    depends on I2C
+    select EDID
+
 config EDID
     bool
 
diff --git a/hw/display/Makefile.objs b/hw/display/Makefile.objs
index dbd453ab1b01..650031f72536 100644
--- a/hw/display/Makefile.objs
+++ b/hw/display/Makefile.objs
@@ -1,3 +1,4 @@
+common-obj-$(CONFIG_DDC) += i2c-ddc.o
 common-obj-$(CONFIG_EDID) += edid-generate.o edid-region.o
 
 common-obj-$(CONFIG_FW_CFG_DMA) += ramfb.o
diff --git a/hw/i2c/Kconfig b/hw/i2c/Kconfig
index 820b24de5b27..78a2008e3ad5 100644
--- a/hw/i2c/Kconfig
+++ b/hw/i2c/Kconfig
@@ -5,11 +5,6 @@ config SMBUS_EEPROM
     bool
     depends on I2C
 
-config DDC
-    bool
-    depends on I2C
-    select EDID
-
 config VERSATILE_I2C
     bool
     select I2C
diff --git a/hw/i2c/Makefile.objs b/hw/i2c/Makefile.objs
index 5f76b6a9909a..d7073a401f1c 100644
--- a/hw/i2c/Makefile.objs
+++ b/hw/i2c/Makefile.objs
@@ -1,6 +1,5 @@
 common-obj-$(CONFIG_I2C) += core.o smbus_slave.o smbus_master.o
 common-obj-$(CONFIG_SMBUS_EEPROM) += smbus_eeprom.o
-common-obj-$(CONFIG_DDC) += i2c-ddc.o
 common-obj-$(CONFIG_VERSATILE_I2C) += versatile_i2c.o
 common-obj-$(CONFIG_ACPI_X86_ICH) += smbus_ich9.o
 common-obj-$(CONFIG_ACPI_SMBUS) += pm_smbus.o
-- 
2.18.1



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [Qemu-devel] [PULL 0/8] Vga 20190507 patches
  2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
                   ` (7 preceding siblings ...)
  2019-05-07  8:19 ` [Qemu-devel] [PULL 8/8] i2c-ddc: move it to hw/display Gerd Hoffmann
@ 2019-05-07 23:06 ` Peter Maydell
  8 siblings, 0 replies; 10+ messages in thread
From: Peter Maydell @ 2019-05-07 23:06 UTC (permalink / raw)
  To: Gerd Hoffmann
  Cc: Alistair Francis, QEMU Developers, qemu-arm, qemu-ppc,
	Paolo Bonzini, Edgar E. Iglesias

On Tue, 7 May 2019 at 09:19, Gerd Hoffmann <kraxel@redhat.com> wrote:
>
> The following changes since commit a6ae23831b05a11880b40f7d58e332c45a6b04f7:
>
>   Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging (2019-05-03 15:26:09 +0100)
>
> are available in the Git repository at:
>
>   git://git.kraxel.org/qemu tags/vga-20190507-pull-request
>
> for you to fetch changes up to 6306cae275c7091aa4e785809d956b475bfedab4:
>
>   i2c-ddc: move it to hw/display (2019-05-07 09:56:10 +0200)
>
> ----------------------------------------------------------------
> vga: bugfixes for qxl, cirrus, ati.
> vga: add "-vga help" support.
> vga: move i2c-ddc to display.
>
> ----------------------------------------------------------------
>

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/4.1
for any user-visible changes.

-- PMM


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2019-05-07 23:07 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-07  8:19 [Qemu-devel] [PULL 0/8] Vga 20190507 patches Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 1/8] qxl: check release info object Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 2/8] hw/display/cirrus_vga: Update the documentation URL Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 3/8] hw/display/cirrus_vga: Remove unused include Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 4/8] vl: constify VGAInterfaceInfo Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 5/8] vl: add -vga help support Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 6/8] qxl: avoid unaligned pointer reads/writes Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 7/8] ati-vga: Fix check for blt outside vram Gerd Hoffmann
2019-05-07  8:19 ` [Qemu-devel] [PULL 8/8] i2c-ddc: move it to hw/display Gerd Hoffmann
2019-05-07 23:06 ` [Qemu-devel] [PULL 0/8] Vga 20190507 patches Peter Maydell

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.