aboutsummaryrefslogtreecommitdiff
path: root/hw/display/cirrus_vga.c
AgeCommit message (Collapse)AuthorFilesLines
2017-03-16cirrus: stop passing around src pointers in the blitterGerd Hoffmann1-12/+49
Does basically the same as "cirrus: stop passing around dst pointers in the blitter", just for the src pointer instead of the dst pointer. For the src we have to care about cputovideo blits though and fetch the data from s->cirrus_bltbuf instead of vga memory. The cirrus_src*() helper functions handle that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489584487-3489-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: stop passing around dst pointers in the blitterGerd Hoffmann1-11/+9
Instead pass around the address (aka offset into vga memory). Calculate the pointer in the rop_* functions, after applying the mask to the address, to make sure the address stays within the valid range. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489574872-8679-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: fix cirrus_invalidate_regionGerd Hoffmann1-3/+3
off_cur_end is exclusive, so off_cur_end == cirrus_addr_mask is valid. Fix calculation to make sure to allow that, otherwise the assert added by commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3 can trigger for valid blits. Test case: boot windows nt 4.0 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489579606-26020-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: add option to disable blitterGerd Hoffmann1-0/+9
Ok, we have this beast in the cirrus code which is not used at all by modern guests, except when you try to find security holes in qemu. So, add an option to disable blitter altogether. Guests released within the last ten years should not show any rendering issues if you turn off blitter support. There are no known bugs in the cirrus blitter code. But in the past we hoped a few times already that we've finally nailed the last issue. So having some easy way to mitigate in case yet another blitter issue shows up certainly makes me sleep a bit better at night. For completeness: The by far better way to mitigate is to switch away from cirrus and use stdvga instead. Or something more modern like virtio-vga in case your guest has support for it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494540-15745-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: switch to 4 MB video memory by defaultGerd Hoffmann1-2/+2
Quoting cirrus source code: Follow real hardware, cirrus card emulated has 4 MB video memory. Also accept 8 MB/16 MB for backward compatibility. So just use 4MB by default. We decided to leave that at 8MB by default a while ago, for live migration compatibility reasons. But we have compat properties to handle that, so that isn't a compeling reason. This also removes some sanity check inconsistencies in the cirrus code. Some places check against the allocated video memory, some places check against the 4MB physical hardware has. Guest code can trigger asserts because of that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494514-15606-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus/vnc: zap bitblit support from console code.Gerd Hoffmann1-9/+3
There is a special code path (dpy_gfx_copy) to allow graphic emulation notify user interface code about bitblit operations carryed out by guests. It is supported by cirrus and vnc server. The intended purpose is to optimize display scrolls and just send over the scroll op instead of a full display update. This is rarely used these days though because modern guests simply don't use the cirrus blitter any more. Any linux guest using the cirrus drm driver doesn't. Any windows guest newer than winxp doesn't ship with a cirrus driver any more and thus uses the cirrus as simple framebuffer. So this code tends to bitrot and bugs can go unnoticed for a long time. See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV" which fixes a bug lingering in the code for almost a year, added by commit "c7628bf vnc: only alloc server surface with clients connected". Also the vnc server will throttle the frame rate in case it figures the network can't keep up (send buffers are full). This doesn't work with dpy_gfx_copy, for any copy operation sent to the vnc client we have to send all outstanding updates beforehand, otherwise the vnc client might run the client side blit on outdated data and thereby corrupt the display. So this dpy_gfx_copy "optimization" might even make things worse on slow network links. Lets kill it once for all. Oh, and one more reason: Turns out (after writing the patch) we have a security bug in that code path ... Fixes: CVE-2016-9603 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494419-14340-1-git-send-email-kraxel@redhat.com
2017-02-24cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)Gerd Hoffmann1-0/+8
CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination and blit width, at all. Oops. Fix it. Security impact: high. The missing blit destination check allows to write to host memory. Basically same as CVE-2014-8106 for the other blit variants. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-10Revert "cirrus: allow zero source pitch in pattern fill rops"Gerd Hoffmann1-18/+8
This reverts commit 5858dd1801883309bdd208d72ddb81c4e9fee30c. Conflicts: hw/display/cirrus_vga.c Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-2-git-send-email-kraxel@redhat.com
2017-02-10cirrus: fix patterncopy checksGerd Hoffmann1-6/+30
The blit_region_is_unsafe checks don't work correctly for the patterncopy source. It's a fixed-sized region, which doesn't depend on cirrus_blt_{width,height}. So go do the check in cirrus_bitblt_common_patterncopy instead, then tell blit_is_unsafe that it doesn't need to verify the source. Also handle the case where we blit from cirrus_bitbuf correctly. This patch replaces 5858dd1801883309bdd208d72ddb81c4e9fee30c. Security impact: I think for the most part error on the safe side this time, refusing blits which should have been allowed. Only exception is placing the blit source at the end of the video ram, so cirrus_blt_srcaddr + 256 goes beyond the end of video memory. But even in that case I'm not fully sure this actually allows read access to host memory. To trick the commit 5858dd18 security checks one has to pick very small cirrus_blt_{width,height} values, which in turn implies only a fraction of the blit source will actually be used. Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-1-git-send-email-kraxel@redhat.com
2017-02-10cirrus: replace debug printf with trace pointsGerd Hoffmann1-6/+5
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-2-git-send-email-kraxel@redhat.com
2017-02-02cirrus: fix oob access issue (CVE-2017-2615)Li Qiang1-4/+3
When doing bitblt copy in backward mode, we should minus the blt width first just like the adding in the forward mode. This can avoid the oob access of the front of vga's vram. Signed-off-by: Li Qiang <liqiang6-s@360.cn> { kraxel: with backward blits (negative pitch) addr is the topmost address, so check it as-is against vram size ] Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106) Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2017-02-01cirrus: fix blit address mask handlingGerd Hoffmann1-13/+12
Apply the cirrus_addr_mask to cirrus_blt_dstaddr and cirrus_blt_srcaddr right after assigning them, in cirrus_bitblt_start(), instead of having this all over the place in the cirrus code, and missing a few places. Reported-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485338996-17095-1-git-send-email-kraxel@redhat.com
2017-02-01cirrus: allow zero source pitch in pattern fill ropsWolfgang Bumiller1-8/+19
The rops used by cirrus_bitblt_common_patterncopy only use the destination pitch, so the source pitch shoul allowed to be zero and the blit with used for the range check around the source address. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485272138-23249-1-git-send-email-w.bumiller@proxmox.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-01cirrus: handle negative pitch in cirrus_invalidate_region()Wolfgang Bumiller1-0/+5
cirrus_invalidate_region() calls memory_region_set_dirty() on a per-line basis, always ranging from off_begin to off_begin+bytesperline. With a negative pitch off_begin marks the top most used address and thus we need to do an initial shift backwards by a line for negative pitches of backward blits, otherwise the first iteration covers the line going from the start offset forwards instead of backwards. Additionally since the start address is inclusive, if we shift by a full `bytesperline` we move to the first address *not* included in the blit, so we only shift by one less than bytesperline. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485352137-29367-1-git-send-email-w.bumiller@proxmox.com [ kraxel: codestyle fixes ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-11display: cirrus: ignore source pitch value as needed in blit_is_unsafeBruce Rogers1-4/+7
Commit 4299b90 added a check which is too broad, given that the source pitch value is not required to be initialized for solid fill operations. This patch refines the blit_is_unsafe() check to ignore source pitch in that case. After applying the above commit as a security patch, we noticed the SLES 11 SP4 guest gui failed to initialize properly. Signed-off-by: Bruce Rogers <brogers@suse.com> Message-id: 20170109203520.5619-1-brogers@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-12-05display: cirrus: check vga bits per pixel(bpp) valuePrasad J Pandit1-4/+10
In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA, 'cirrus_get_bpp' returns zero(0), which could lead to a divide by zero error in while copying pixel data. The same could occur via blit pitch values. Add check to avoid it. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-03-22include/qemu/osdep.h: Don't include qapi/error.hMarkus Armbruster1-0/+1
Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: Markus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-01cirrus_vga: fix off-by-one in blit_region_is_unsafePaolo Bonzini1-2/+2
The "max" value is being compared with >=, but addr + width points to the first byte that will _not_ be copied. Laszlo suggested using a "greater than" comparison, instead of subtracting one like it is already done above for the height, so that max remains always positive. The mistake is "safe"---it will reject some blits, but will never cause out-of-bounds writes. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-01-29hw/display: Clean up includesPeter Maydell1-0/+1
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-21-git-send-email-peter.maydell@linaro.org
2015-05-19cirrus_vga: QOMifyGonglei1-2/+6
QOMify pci-cirrus-vga like isa-cirrus-vga device. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-26cirrus-vga: Convert to realizeMarkus Armbruster1-6/+5
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-02-13isa: remove isa_mem_base variableHervé Poussineau1-1/+1
Now that isa_mem_base variable is always 0, we can remove its usage. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
2014-12-16move hw cursor pos from cirrus to vgaGerd Hoffmann1-16/+15
2014-12-16cirrus: Force use of shadow pixmap when HW cursor is enabledBenjamin Herrenschmidt1-1/+8
The HW cursor cannot be painted on a shared surface. This fixes HW cursor display in Windows NT 4.0 and Windows 98. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-01cirrus: don't overflow CirrusVGAState->cirrus_bltbufGerd Hoffmann1-0/+4
This is CVE-2014-8106. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-01cirrus: fix blit region checkGerd Hoffmann1-17/+44
Issues: * Doesn't check pitches correctly in case it is negative. * Doesn't check width at all. Turn macro into functions while being at it, also factor out the check for one region which we then can simply call twice for src + dst. This is CVE-2014-8106. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-30cirrus: Remove non-32bpp cursor drawingBenjamin Herrenschmidt1-28/+36
We only draw cursor on non-shared surfaces (so it seems...) and these are always 32bpp Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Remove rgb_to_pixel indirectionBenjamin Herrenschmidt1-6/+9
We always use rgb_to_pixel32 nowadays. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-07-11cirrus: Fix build of debug codeBenjamin Herrenschmidt1-4/+4
Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus_vga: adding sanity check for vram sizeGonglei1-0/+16
when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-06-16savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela1-4/+2
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2014-04-28vga: allow non-global vmstateGerd Hoffmann1-2/+2
Need a way to opt-out from vga.vram being global vmstate, for secondary vga cards. Add a bool parameter to vga_common_init to support this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-03-05console: add head to index to qemu consoles.Gerd Hoffmann1-2/+2
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-02-10qdev:pci: refactor PCIDevice to use generic "hotpluggable" propertyIgor Mammedov1-1/+1
Get rid of PCIDevice specific PCIDeviceClass.no_hotplug and use generic DeviceClass.hotpluggable field instead. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2013-10-17cirrus: Mark vga io region as coalesced MMIO flushingJan Kiszka1-2/+1
This allows to remove the explicit qemu_flush_coalesced_mmio_buffer calls - the memory core will invoke them now. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-29devices: Associate devices to their logical categoryMarcel Apfelbaum1-0/+2
The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-04hw/d*: pass owner to memory_region_init* functionsPaolo Bonzini1-1/+1
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-04vga: pass owner to cirrus_init_commonPaolo Bonzini1-10/+12
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-04vga: pass owner to vga_common_initPaolo Bonzini1-2/+2
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-04memory: add owner argument to initialization functionsPaolo Bonzini1-8/+8
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-06-07isa: Use realizefn for ISADeviceAndreas Färber1-6/+6
Drop ISADeviceClass::init and the resulting no-op initfn and let children implement their own realizefn. Adapt error handling. Split off an instance_init where sensible. Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-06-01Remove unnecessary break statementsStefan Weil1-1/+0
Fix these warnings from cppcheck: hw/display/cirrus_vga.c:2603: hw/sd/sd.c:348: hw/timer/exynos4210_mct.c:1033: target-arm/translate.c:9886: target-s390x/mem_helper.c:518: target-unicore32/translate.c:1936: style: Consecutive return, break, continue, goto or throw statements are unnecessary. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2013-04-29cirrus_vga: QOM'ify ISA Cirrus VGAAndreas Färber1-5/+10
Introduce type constant and cast macro to obsolete DO_UPCAST(). Prepares for ISA realizefn. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Andreas Färber <afaerber@suse.de> Message-id: 1367093935-29091-3-git-send-email-afaerber@suse.de Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-04-25console: add device link to QemuConsolesGerd Hoffmann1-2/+2
So it is possible to figure which qemu console displays which device. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-04-16console: add GraphicHwOpsGerd Hoffmann1-6/+2
Pass a single GraphicHwOps struct pointer to graphic_console_init, instead of a bunch of function pointers. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-04-16console: simplify screendumpGerd Hoffmann1-2/+2
Screendumps are alot simpler as we can update non-active QemuConsoles now. So we only need to update the QemuConsole we want write out, then dump the DisplaySurface content into a ppm file. Done. No console switching needed. No special support code in the gfx card emulation needed. Zap it all. Also move ppm_save out of the vga code and next to the qmp_screendump function. For now screen dumping is limited to console #0 (like it used to be), even though it is dead simple to extend it to other consoles. I wanna finish the console cleanup before setting new qapi interfaces into stone. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Igor Mitsyanko <i.mitsyanko@gmail.com>
2013-04-16console: rename vga_hw_*, add QemuConsole paramGerd Hoffmann1-1/+1
Add QemuConsole parameter to vga_hw_*, so the interface allows to update non-active consoles (the actual code can't handle this yet, see next patch). Passing NULL is allowed and updates the active console, like the functions do today. While touching all vga_hw_* calls anyway rename that to the functions to hardware-neutral graphics_hw_* Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-04-08hw: move private headers to hw/ subdirectories.Paolo Bonzini1-19/+19
Many headers are used only in a single directory. These can be kept in hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-04-08hw: move target-independent files to subdirectoriesPaolo Bonzini1-0/+3021
This patch tackles all files that are compiled once, moving them to subdirectories of hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.1 at 2024-10-01 16:03:03 +0000