Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* vga: implement odd/even and byte/word/doubleword modes more accurately
* vga: implement horizontal pel panning
* KVM: add c

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* vga: implement odd/even and byte/word/doubleword modes more accurately
* vga: implement horizontal pel panning
* KVM: add class property to configure KVM device node to use
* fix various bugs in x86 TCG PC-relative translation
* properly align huge pages on LoongArch
* cleanup patches

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmWo8wkUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroMhHAf+KiYvN/gxrYnpSS7IfbFqx6MtQrwW
# Hj9QsfgRF2sThRu6BveLMG7REwEtwFh7lMhUbiyR/mzuYN9cMmHDw4OE62WRrL86
# 3PAtzAaJ/Lzd8Qp4K4un+ZrFZvq8a83HvGRRTaF9wO6/9EwpqmqMTbrNlSSA08Gy
# mnfXGEt0oYitJ3JUH0MI8y6EOh1mkIhEfGPeyJaGDZVW/m4ob+QIauNOOozYN7r6
# QK+2OU0HeJC5CIzi2o5kq5U0AydVO1iAp7OBxtclYaaSvRyhlpEmbdTIKCzzPlUx
# vZthxbU2PgzUbME8fraUcd7GzT64++QOLDxNyZNEL8PCCcd0lRQ0EEukgA==
# =Uz0X
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 18 Jan 2024 09:44:41 GMT
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.c
qemu/osdep: Add huge page aligned support on LoongArch platform
remove unnecessary casts from uintptr_t
target/i386: pcrel: store low bits of physical address in data[0]
target/i386: fix incorrect EIP in PC-relative translation blocks
target/i386: Do not re-compute new pc with CF_PCREL
io_uring: move LuringState typedef to block/aio.h
Add class property to configure KVM device node to use
vga: sort-of implement word and double-word access modes
vga: use latches in odd/even mode too
vga: reindent memory access code
vga: optimize horizontal pel panning in 256-color modes
vga: implement horizontal pel panning in graphics modes
vga: mask addresses in non-VESA modes to 256k
vga: introduce VGADisplayParams
vga: use common endian swap macros

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

vga: optimize horizontal pel panning in 256-color modes

Do not go through the panning buffer unless the address wraps in the middle
of the line.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

vga: implement horizontal pel panning in graphics modes

This implements smooth scrolling, as used for example by Commander Keen
and Second Reality.

Unfortunately, this is not enough to avoid tearin

vga: implement horizontal pel panning in graphics modes

This implements smooth scrolling, as used for example by Commander Keen
and Second Reality.

Unfortunately, this is not enough to avoid tearing in Commander Keen,
because sometimes the wrong start address is used for a frame.
On real EGA, the panning register is sampled on every line, while
the display start is latched for the next frame at the start of the
vertical retrace. On real VGA, the panning register is also latched,
but at the end of the vertical retrace. It looks like Keen exploits
this by only waiting for horizontal retrace when setting the display
start, but implementing it breaks the 256-color Keen games...

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

vga: mask addresses in non-VESA modes to 256k

This allows setting the start address to a high value, and reading the
bottom of the screen from the beginning of VRAM. Commander Keen 4
("Goodbye, Gal

vga: mask addresses in non-VESA modes to 256k

This allows setting the start address to a high value, and reading the
bottom of the screen from the beginning of VRAM. Commander Keen 4
("Goodbye, Galaxy!") relies on this behavior.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/kraxel/tags/ati-20190919-pull-request' into staging

vga: fix cursor code in ati-vga.

# gpg: Signature made Thu 19 Sep 2019 10:10:32 BST
# gpg: u

Merge remote-tracking branch 'remotes/kraxel/tags/ati-20190919-pull-request' into staging

vga: fix cursor code in ati-vga.

# gpg: Signature made Thu 19 Sep 2019 10:10:32 BST
# gpg: using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ati-20190919-pull-request:
ati: use vga_read_byte in ati_cursor_define
vga: move access helpers to separate include file

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

vga: move access helpers to separate include file

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190917111441.27405-2-kraxel@r

vga: move access helpers to separate include file

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190917111441.27405-2-kraxel@redhat.com

show more ...

vga: stop passing pointers to vga_draw_line* functions

Instead pass around the address (aka offset into vga memory).
Add vga_read_* helper functions which apply vbe_size_mask to
the address, to make

vga: stop passing pointers to vga_draw_line* functions

Instead pass around the address (aka offset into vga memory).
Add vga_read_* helper functions which apply vbe_size_mask to
the address, to make sure the address stays within the valid
range, similar to the cirrus blitter fixes (commits ffaf857778
and 026aeffcb4).

Impact: DoS for privileged guest users. qemu crashes with
a segfault, when hitting the guard page after vga memory
allocation, while reading vga memory for display updates.

Fixes: CVE-2017-13672
Cc: P J P <ppandit@redhat.com>
Reported-by: David Buchanan <d@vidbuchanan.co.uk>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20170828122906.18993-1-kraxel@redhat.com

show more ...

vga: Rename vga_template.h to vga-helpers.h

It's no longer a template, we only instanciate the file once.

Keep it a #included file so the functions remain static.

Signed-off-by: Benjamin Herrensch

vga: Rename vga_template.h to vga-helpers.h

It's no longer a template, we only instanciate the file once.

Keep it a #included file so the functions remain static.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

show more ...

vga: Separate LE and BE conversion functions

Provide different functions for converting from an LE vs a BE
framebuffer. We cannot rely on the simple cases always being
shared surfaces since cirrus w

vga: Separate LE and BE conversion functions

Provide different functions for converting from an LE vs a BE
framebuffer. We cannot rely on the simple cases always being
shared surfaces since cirrus will need to always shadow for
cursor emulation, so we need the full set of functions to
be able to later handle runtime switching.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

show more ...

vga: Remove remainder of old conversion cruft

All the macros used to generate different versions of vga_template.h
are now unnecessary, take them all out and remove the _32 suffix from
most function

vga: Remove remainder of old conversion cruft

All the macros used to generate different versions of vga_template.h
are now unnecessary, take them all out and remove the _32 suffix from
most functions.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

show more ...

hw: use ld_p/st_p instead of ld_raw/st_raw

The ld_raw and st_raw definitions are only needed in code that
must compile for both user-mode and softmmu emulation. Device
models can use the equivalent

hw: use ld_p/st_p instead of ld_raw/st_raw

The ld_raw and st_raw definitions are only needed in code that
must compile for both user-mode and softmmu emulation. Device
models can use the equivalent ld_p/st_p which are simple
pointer accessors.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

show more ...

bswap.h: Remove cpu_to_32wu()

Replace the legacy cpu_to_32wu() with stl_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Mi

bswap.h: Remove cpu_to_32wu()

Replace the legacy cpu_to_32wu() with stl_p().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 1383669517-25598-10-git-send-email-peter.maydell@linaro.org
Signed-off-by: Anthony Liguori <aliguori@amazon.com>

show more ...

hw: move private headers to hw/ subdirectories.

Many headers are used only in a single directory. These can be
kept in hw/.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

vga: use constants from vga.h

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

vga: move Cirrus VGA template to its own file

Standard VGA does not use vga_draw_cursor_line_* functions.
Move the template to cirrus_vga_template.h.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

vga: Rename last VGAState occurrences to VGACommonState

Signed-off-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

rename WORDS_BIGENDIAN to HOST_WORDS_BIGENDIAN

Signed-off-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

find -type f | xargs sed -i 's/[\t ]*$//g' # Yes, again. Note the star in the regex.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3177 c046a42c-6fe2-441c-8c8c-71466251a162

find -type f | xargs sed -i 's/[\t ]$//g' # on most files


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3173 c046a42c-6fe2-441c-8c8c-71466251a162

BGR_FORMAT fix


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1914 c046a42c-6fe2-441c-8c8c-71466251a162

bgr32 pixel format support


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1912 c046a42c-6fe2-441c-8c8c-71466251a162

limited 8 bit support - removed unaligned memory accesses in VGA (initial patch by Johannes Schindelin)


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1116 c046a42c-6fe2-441c-8c8c-71466251a162

endianness fixes


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@958 c046a42c-6fe2-441c-8c8c-71466251a162

hardware cursor depth = 15 fix


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@906 c046a42c-6fe2-441c-8c8c-71466251a162

generic hardware cursor support


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@903 c046a42c-6fe2-441c-8c8c-71466251a162