summaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)AuthorFilesLines
2015-01-19ui: Add dpy_gfx_check_format() to check backend shared surface supportBenjamin Herrenschmidt1-4/+14
This allows VGA to decide whether to use a shared surface based on whether the UI backend supports the format or not. Backends that don't provide the new callback fallback to native 32 bpp which is equivalent to what was supported before. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> [ kraxel: fix console check, allow only 32 bpp as fallback ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-15blizzard: do not depend on VGA internalsPaolo Bonzini1-1/+0
There is nothing that is used by this ARM-specific device. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-12-17Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20141216-1' into ↵Peter Maydell4-19/+42
staging cirrus hwcursor fixes. set secondary-vga category. # gpg: Signature made Tue 16 Dec 2014 14:44:09 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vga-20141216-1: vga: set catagory bit for secondary vga device move hw cursor pos from cirrus to vga cirrus: Force use of shadow pixmap when HW cursor is enabled vga: Add mechanism to force the use of a shadow surface Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-12-16vga: set catagory bit for secondary vga deviceGonglei1-0/+1
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-16move hw cursor pos from cirrus to vgaGerd Hoffmann2-16/+17
2014-12-16cirrus: Force use of shadow pixmap when HW cursor is enabledBenjamin Herrenschmidt1-1/+8
The HW cursor cannot be painted on a shared surface. This fixes HW cursor display in Windows NT 4.0 and Windows 98. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-16vga: Add mechanism to force the use of a shadow surfaceBenjamin Herrenschmidt2-2/+16
This prevents surface sharing which will be necessary to fix cirrus HW cursor support. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-16spice: reduce refresh rate in native modeGerd Hoffmann1-0/+3
Now that cursor updates are out of the way qxl needs the refresh timer only when when running in vga mode, for dirty bitmap checking. In native qxl mode the guest will notify us, so we don't need to poll and can use the idle interval (one refresh wakeup every few seconds). Cc: Marc-André Lureau <marcandre.lureau@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-16spice: use bottom half instead of refresh timer for cursor updatesGerd Hoffmann2-4/+3
Calling directly doesn't work due to the qxl-render code running in spice server thread context. Meanwhile bottom half scheduling is thread-safe though, so we can use that to kick a cursor update in main i/o thread context. Cc: Marc-André Lureau <marcandre.lureau@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-01cirrus: don't overflow CirrusVGAState->cirrus_bltbufGerd Hoffmann1-0/+4
This is CVE-2014-8106. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-12-01cirrus: fix blit region checkGerd Hoffmann1-17/+44
Issues: * Doesn't check pitches correctly in case it is negative. * Doesn't check width at all. Turn macro into functions while being at it, also factor out the check for one region which we then can simply call twice for src + dst. This is CVE-2014-8106. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2014-10-29vmware-vga: use vmsvga_verify_rect in vmsvga_fill_rectGerd Hoffmann1-7/+10
Add verification to vmsvga_fill_rect, re-enable HW_FILL_ACCEL. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
2014-10-29vmware-vga: use vmsvga_verify_rect in vmsvga_copy_rectGerd Hoffmann1-6/+14
Add verification to vmsvga_copy_rect, re-enable HW_RECT_ACCEL. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
2014-10-28vmware-vga: use vmsvga_verify_rect in vmsvga_update_rectGerd Hoffmann1-28/+4
Switch vmsvga_update_rect over to use vmsvga_verify_rect. Slight change in behavior: We don't try to automatically fixup rectangles any more. In case we find invalid update requests we'll do a full-screen update instead. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
2014-10-28vmware-vga: add vmsvga_verify_rectGerd Hoffmann1-1/+52
Add verification function for rectangles, returning true if verification passes and false otherwise. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
2014-10-28vmware-vga: CVE-2014-3689: turn off hw accelGerd Hoffmann1-0/+2
Quick & easy stopgap for CVE-2014-3689: We just compile out the hardware acceleration functions which lack sanity checks. Thankfully we have capability bits for them (SVGA_CAP_RECT_COPY and SVGA_CAP_RECT_FILL), so guests should deal just fine, in theory. Subsequent patches will add the missing checks and re-enable the hardware acceleration emulation. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Don Koch <dkoch@verizon.com>
2014-10-22Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell1-1/+3
Block patches # gpg: Signature made Mon 20 Oct 2014 13:04:09 BST using RSA key ID C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" * remotes/kevin/tags/for-upstream: (28 commits) block: Make device model's references to BlockBackend strong block: Lift device model API into BlockBackend blockdev: Convert qmp_eject(), qmp_change_blockdev() to BlockBackend block/qapi: Convert qmp_query_block() to BlockBackend blockdev: Fix blockdev-add not to create DriveInfo blockdev: Drop superfluous DriveInfo member id pc87312: Drop unused members of PC87312State ide: Complete conversion from BlockDriverState to BlockBackend hw: Convert from BlockDriverState to BlockBackend, mostly virtio-blk: Rename VirtIOBlkConf variables to conf virtio-blk: Drop redundant VirtIOBlock member conf block: Rename BlockDriverCompletionFunc to BlockCompletionFunc block: Rename BlockDriverAIOCB* to BlockAIOCB* block: Eliminate DriveInfo member bdrv, use blk_by_legacy_dinfo() block: Merge BlockBackend and BlockDriverState name spaces block: Eliminate BlockDriverState member device_name[] block: Eliminate bdrv_iterate(), use bdrv_next() blockdev: Eliminate drive_del() block: Make BlockBackend own its BlockDriverState block: Code motion to get rid of stubs/blockdev.c ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-10-22Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20141015-1' into ↵Peter Maydell1-0/+5
staging qxl: keep going if reaching guest bug on empty area # gpg: Signature made Wed 15 Oct 2014 11:45:37 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/spice/tags/pull-spice-20141015-1: qxl: keep going if reaching guest bug on empty area Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-10-20hw: Convert from BlockDriverState to BlockBackend, mostlyMarkus Armbruster1-1/+1
Device models should access their block backends only through the block-backend.h API. Convert them, and drop direct includes of inappropriate headers. Just four uses of BlockDriverState are left: * The Xen paravirtual block device backend (xen_disk.c) opens images itself when set up via xenbus, bypassing blockdev.c. I figure it should go through qmp_blockdev_add() instead. * Device model "usb-storage" prompts for keys. No other device model does, and this one probably shouldn't do it, either. * ide_issue_trim_cb() uses bdrv_aio_discard() instead of blk_aio_discard() because it fishes its backend out of a BlockAIOCB, which has only the BlockDriverState. * PC87312State has an unused BlockDriverState[] member. The next two commits take care of the latter two. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-10-20block: Eliminate DriveInfo member bdrv, use blk_by_legacy_dinfo()Markus Armbruster1-1/+3
The patch is big, but all it really does is replacing dinfo->bdrv by blk_bs(blk_by_legacy_dinfo(dinfo)) The replacement is repetitive, but the conversion of device models to BlockBackend is imminent, and will shorten it to just blk_legacy_dinfo(dinfo). Line wrapping muddies the waters a bit. I also omit tests whether dinfo->bdrv is null, because it never is. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Benoît Canet <benoit.canet@nodalink.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-10-15hw/display/vga: Remove unused arrays dmask4 and dmask16Peter Maydell1-26/+0
Following cleanup of the vga device code in commit d2e043a8041, the arrays dmask4 and dmask16 are now unused. gcc doesn't warn about this, but clang does; remove them. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-10-15vga-pci: add qext region to mmioGerd Hoffmann1-0/+70
Add a qemu extented register range to the standard vga mmio bar. Right nowe there are two registers: One readonly register returning the size of the region (so we can easily add more registers there if needed) and one endian control register, so guests (especially ppc) can flip the framebuffer endianness as they need it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-10-15qxl: keep going if reaching guest bug on empty areaMarc-André Lureau1-0/+5
Xorg server hangs when using xfig and typing a text with space: #0 qxl_wait_for_io_command (qxl=<value optimized out>) at qxl_io.c:47 #1 0x00007f826a49a299 in qxl_download_box (surface=0x221d030, x1=231, y1=259, x2=<value optimized out>, y2=<value optimized out>) at qxl_surface.c:143 while (!(ram_header->int_pending & QXL_INTERRUPT_IO_CMD)) usleep (1); The QXL driver is calling QXL_IO_UPDATE_AREA with an empty area. This is a guest bug. The call is async and no ack is sent back on guest bug, so the X server will hang. The driver should be improved to avoid this situation and also to abort on QXL_INTERRUPT_ERROR. This will be a different patch series for the driver. However, it is simple enough to keep qemu running on empty areas update, which is what this patch provides. https://bugzilla.redhat.com/show_bug.cgi?id=1151363 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-30vga: Add endian to vmstateBenjamin Herrenschmidt2-4/+39
Include the endian state in the migration stream as an optional subsection which we only include when the endian isn't the default, thus enabling backward compatibility of the common case. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Changes by kraxel: * Remove bochs dispi interface changes. We'll do that in a different way to make sure we don't conflict with possible future bochs dispi interface changes. * keep live migration bits. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Make fb endian a common state variableBenjamin Herrenschmidt2-13/+20
And initialize it based on target endian Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Rename vga_template.h to vga-helpers.hBenjamin Herrenschmidt2-1/+1
It's no longer a template, we only instanciate the file once. Keep it a #included file so the functions remain static. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Remove some "should be done in BIOS" commentsBenjamin Herrenschmidt1-4/+2
Not all platforms have a VGA BIOS, powerpc typically relies on using the DISPI interface to initialize the card. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30cirrus: Remove non-32bpp cursor drawingBenjamin Herrenschmidt2-130/+36
We only draw cursor on non-shared surfaces (so it seems...) and these are always 32bpp Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Simplify vga_draw_blank() a bitBenjamin Herrenschmidt1-7/+2
The test for surface_bits_per_pixel() isn't necessary anymore, the 8bpp case never happens. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Remove rgb_to_pixel indirectionBenjamin Herrenschmidt3-29/+19
We always use rgb_to_pixel32 nowadays. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Separate LE and BE conversion functionsBenjamin Herrenschmidt2-40/+112
Provide different functions for converting from an LE vs a BE framebuffer. We cannot rely on the simple cases always being shared surfaces since cirrus will need to always shadow for cursor emulation, so we need the full set of functions to be able to later handle runtime switching. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\ Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Remove remainder of old conversion cruftBenjamin Herrenschmidt2-178/+95
All the macros used to generate different versions of vga_template.h are now unnecessary, take them all out and remove the _32 suffix from most functions. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30vga: Start cutting out non-32bpp conversion supportBenjamin Herrenschmidt1-236/+22
Nowadays, we either share a surface with the host, or we create a 32bpp ARGB console surface. So we only need to draw/convert to 32bpp, enabling us to remove all but one instance of vga_template.h inclusion (to be further cleaned up), rgb_to_pixel_* etc... Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2014-09-30Merge remote-tracking branch ↵Peter Maydell2-16/+0
'remotes/pmaydell/tags/pull-target-arm-20140929' into staging target-arm: * more EL2/EL3 preparation work * don't handle c15_cpar changes via tb_flush() * fix some unused function warnings in ARM devices * build the GDB XML for 32 bit CPUs into qemu-*-aarch64 * implement guest breakpoint support # gpg: Signature made Mon 29 Sep 2014 19:25:37 BST using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20140929: target-arm: Add support for VIRQ and VFIQ target-arm: Add IRQ and FIQ routing to EL2 and 3 target-arm: A64: Emulate the SMC insn target-arm: Add a Hypervisor Trap exception type target-arm: A64: Emulate the HVC insn target-arm: A64: Correct updates to FAR and ESR on exceptions target-arm: Don't take interrupts targeting lower ELs target-arm: Break out exception masking to a separate func target-arm: A64: Refactor aarch64_cpu_do_interrupt target-arm: Add SCR_EL3 target-arm: Add HCR_EL2 target-arm: Don't handle c15_cpar changes via tb_flush() hw/input/tsc210x.c: Delete unused array tsc2101_rates hw/display/pxa2xx_lcd.c: Remove unused function pxa2xx_dma_rdst_set hw/intc/imx_avic.c: Remove unused function imx_avic_set_prio() hw/display/blizzard.c: Delete unused function blizzard_rgb2yuv configure: Build GDB XML for 32 bit ARM CPUs into qemu aarch64 binaries target-arm: Implement handling of breakpoint firing target-arm: Implement setting guest breakpoints Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-29hw/display/pxa2xx_lcd.c: Remove unused function pxa2xx_dma_rdst_setPeter Maydell1-8/+0
The function pxa2xx_dma_rdst_set() is unused; delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410723223-17711-4-git-send-email-peter.maydell@linaro.org
2014-09-29hw/display/blizzard.c: Delete unused function blizzard_rgb2yuvPeter Maydell1-8/+0
The function blizzard_rgb2yuv() is unused; delete it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1410723223-17711-2-git-send-email-peter.maydell@linaro.org
2014-09-29qxl: use graphic_console_set_hwopsGerd Hoffmann1-40/+9
Simply switch function pointers when entering/leaving vga mode. Allows to remove wrapper functions which do nothing but dispatch calls depending on the current qxl mode. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23tcx: Implement hardware accelerationMark Cave-Ayland1-118/+559
The S24/TCX framebuffer is a mildly accelerated video card with blitter, stippler and hardware cursor. * Solaris and NetBSD 6.x use all the hardware acceleration features * The Xorg driver (used by Linux) can use the hardware cursor only This patch implements hardware acceleration in both 8 bit and 24 bit modes. It is based on the NetBSD driver sources and from tests with Solaris. Signed-off-by: Olivier Danet <odanet@caramail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2014-09-12Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell7-11/+17
- Memory: improve error reporting and avoid crashes on hotplug - Build: fixing block/iscsi.so and ranlib warnings on Mac OS X - Migration fixes for x86 - The odd KVM patch. # gpg: Signature made Thu 11 Sep 2014 11:21:10 BST using RSA key ID 9B4D86F2 # gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>" # gpg: aka "Paolo Bonzini <bonzini@gnu.org>" * remotes/bonzini/tags/for-upstream: (21 commits) gdbstub: init mon_chr through qemu_chr_alloc pckbd: adding new fields to vmstate mc146818rtc: add missed field to vmstate piix: do not set irq while loading vmstate serial: fixing vmstate for save/restore parallel: adding vmstate for save/restore fdc: adding vmstate for save/restore cpu: init vmstate for ticks and clock offset apic_common: vapic_paddr synchronization fix vl: use QLIST_FOREACH_SAFE to visit change state handlers exec: add parameter errp to gethugepagesize exec: report error when memory < hpagesize hostmem-ram: don't exit qemu if size of memory-backend-ram is way too big memory: add parameter errp to memory_region_init_rom_device memory: add parameter errp to memory_region_init_ram exec: add parameter errp to qemu_ram_alloc and qemu_ram_alloc_from_ptr rules.mak: Fix DSO build by pulling in archive symbols util: Don't link host-utils.o if it's empty util: Move general qemu_getauxval to util/getauxval.c trace: Only link generated-tracers.o with "simple" backend ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-11Merge remote-tracking branch 'remotes/kraxel/tags/pull-console-20140905-2' ↵Peter Maydell4-12/+21
into staging console: pixman switchover continued, add some infrastructure to make it easier using pixman in display device emulation. # gpg: Signature made Fri 05 Sep 2014 14:38:57 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-console-20140905-2: console: Remove unused QEMU_BIG_ENDIAN_FLAG console: add qemu_pixman_linebuf_copy console: add dpy_gfx_update_dirty console: add qemu_create_displaysurface_guestmem console: stop using PixelFormat console: reimplement qemu_default_pixelformat console: add qemu_default_pixman_format console: add qemu_pixelformat_from_pixman Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-09memory: add parameter errp to memory_region_init_ramHu Tao7-11/+17
Add parameter errp to memory_region_init_ram and update all call sites to pass in &error_abort. Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-05console: stop using PixelFormatGerd Hoffmann4-12/+21
With this patch the qemu console core stops using PixelFormat and pixman format codes side-by-side, pixman format code is the primary way to specify the DisplaySurface format: * DisplaySurface stops carrying a PixelFormat field. * qemu_create_displaysurface_from() expects a pixman format now. Functions to convert PixelFormat to pixman_format_code_t (and back) exist for those who still use PixelFormat. As PixelFormat allows easy access to masks and shifts it will probably continue to exist. [ xenfb added by Benjamin Herrenschmidt ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-04vbe: rework sanity checksGerd Hoffmann1-59/+95
Plug a bunch of holes in the bochs dispi interface parameter checking. Add a function doing verification on all registers. Call that unconditionally on every register write. That way we should catch everything, even changing one register affecting the valid range of another register. Some of the holes have been added by commit e9c6149f6ae6873f14a12eea554925b6aa4c4dec. Before that commit the maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES * 32 bpp) has been smaller than the qemu vga memory (8MB) and the checking for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok. Some of the holes have been there forever, such as VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes lacking any verification. Security impact: (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga frame buffer as source -> host memory leak. Memory isn't leaked to the guest but to the vnc client though. (2) Qemu will segfault in case the memory range happens to include unmapped areas -> Guest can DoS itself. The guest can not modify host memory, so I don't think this can be used by the guest to escape. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-09-04vbe: make bochs dispi interface return the correct memory size with qxlGerd Hoffmann3-2/+7
VgaState->vram_size is the size of the pci bar. In case of qxl not the whole pci bar can be used as vga framebuffer. Add a new variable vbe_size to handle that case. By default (if unset) it equals vram_size, but qxl can set vbe_size to something else. This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results and sanity checks are done with the correct size too. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2014-09-01qxl-render: add more sanity checksGerd Hoffmann1-1/+3
Damn, the dirty rectangle values are signed integers. So the checks added by commit 788fbf042fc6d5aaeab56757e6dad622ac5f0c21 are not good enough, we also have to make sure they are not negative. [ Note: There must be something broken in spice-server so we get negative values in the first place. Bug opened: https://bugzilla.redhat.com/show_bug.cgi?id=1135372 ] Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2014-08-18memory: convert memory_region_destroy to object_unparentPaolo Bonzini1-1/+1
Explicitly call object_unparent in the few places where we will re-create the memory region. If the memory region is simply being destroyed as part of device teardown, let QOM handle it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-17vga: do not dynamically allocate chain4_aliasPaolo Bonzini2-15/+12
Instead, add a boolean variable to indicate the presence of the region. This avoids a repeated malloc/free (later we can also avoid the add_child/unparent by changing the offset/size of the alias). Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-11cirrus: Fix host CPU blitsBenjamin Herrenschmidt1-2/+1
Commit b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef "CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke cpu to video blits. When the ROP function is called from cirrus_bitblt_cputovideo_next(), we pass 0 for the pitch but only operate on one line at a time. The added test was tripping because after the initial substraction, the pitch becomes negative. Make the test only trip when the height is larger than one (ie. the pitch is actually used). This fixes HW cursor support in Windows NT4.0 (which otherwise was a white rectangle) and general display of icons in that OS when using 8bpp mode. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus: Fix build of debug codeBenjamin Herrenschmidt1-4/+4
Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-07-11cirrus_vga: adding sanity check for vram sizeGonglei1-0/+16
when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-07-10 03:10:19 +0000