summary refs log tree commit diff stats
path: root/hw/display/cirrus_vga.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* cirrus: fix oob access issue (CVE-2017-2615)Li Qiang2017-02-021-4/+3
| | | | | | | | | | | | | | | | | | | | | When doing bitblt copy in backward mode, we should minus the blt width first just like the adding in the forward mode. This can avoid the oob access of the front of vga's vram. Signed-off-by: Li Qiang <liqiang6-s@360.cn> { kraxel: with backward blits (negative pitch) addr is the topmost address, so check it as-is against vram size ] Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106) Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com Reviewed-by: Laszlo Ersek <lersek@redhat.com>
* cirrus: fix blit address mask handlingGerd Hoffmann2017-02-011-13/+12
| | | | | | | | | | Apply the cirrus_addr_mask to cirrus_blt_dstaddr and cirrus_blt_srcaddr right after assigning them, in cirrus_bitblt_start(), instead of having this all over the place in the cirrus code, and missing a few places. Reported-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485338996-17095-1-git-send-email-kraxel@redhat.com
* cirrus: allow zero source pitch in pattern fill ropsWolfgang Bumiller2017-02-011-8/+19
| | | | | | | | | | | The rops used by cirrus_bitblt_common_patterncopy only use the destination pitch, so the source pitch shoul allowed to be zero and the blit with used for the range check around the source address. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485272138-23249-1-git-send-email-w.bumiller@proxmox.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus: handle negative pitch in cirrus_invalidate_region()Wolfgang Bumiller2017-02-011-0/+5
| | | | | | | | | | | | | | | | | | | | | | cirrus_invalidate_region() calls memory_region_set_dirty() on a per-line basis, always ranging from off_begin to off_begin+bytesperline. With a negative pitch off_begin marks the top most used address and thus we need to do an initial shift backwards by a line for negative pitches of backward blits, otherwise the first iteration covers the line going from the start offset forwards instead of backwards. Additionally since the start address is inclusive, if we shift by a full `bytesperline` we move to the first address *not* included in the blit, so we only shift by one less than bytesperline. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485352137-29367-1-git-send-email-w.bumiller@proxmox.com [ kraxel: codestyle fixes ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* display: cirrus: ignore source pitch value as needed in blit_is_unsafeBruce Rogers2017-01-111-4/+7
| | | | | | | | | | | | Commit 4299b90 added a check which is too broad, given that the source pitch value is not required to be initialized for solid fill operations. This patch refines the blit_is_unsafe() check to ignore source pitch in that case. After applying the above commit as a security patch, we noticed the SLES 11 SP4 guest gui failed to initialize properly. Signed-off-by: Bruce Rogers <brogers@suse.com> Message-id: 20170109203520.5619-1-brogers@suse.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* display: cirrus: check vga bits per pixel(bpp) valuePrasad J Pandit2016-12-051-4/+10
| | | | | | | | | | | | In Cirrus CLGD 54xx VGA Emulator, if cirrus graphics mode is VGA, 'cirrus_get_bpp' returns zero(0), which could lead to a divide by zero error in while copying pixel data. The same could occur via blit pitch values. Add check to avoid it. Reported-by: Huawei PSIRT <psirt@huawei.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 1476776717-24807-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* include/qemu/osdep.h: Don't include qapi/error.hMarkus Armbruster2016-03-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: Markus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cirrus_vga: fix off-by-one in blit_region_is_unsafePaolo Bonzini2016-03-011-2/+2
| | | | | | | | | | | | | | | | The "max" value is being compared with >=, but addr + width points to the first byte that will _not_ be copied. Laszlo suggested using a "greater than" comparison, instead of subtracting one like it is already done above for the height, so that max remains always positive. The mistake is "safe"---it will reject some blits, but will never cause out-of-bounds writes. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1455121059-18280-1-git-send-email-pbonzini@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw/display: Clean up includesPeter Maydell2016-01-291-0/+1
| | | | | | | | | | Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-21-git-send-email-peter.maydell@linaro.org
* cirrus_vga: QOMifyGonglei2015-05-191-2/+6
| | | | | | | QOMify pci-cirrus-vga like isa-cirrus-vga device. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus-vga: Convert to realizeMarkus Armbruster2015-02-261-6/+5
| | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
* isa: remove isa_mem_base variableHervé Poussineau2015-02-131-1/+1
| | | | | | | Now that isa_mem_base variable is always 0, we can remove its usage. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
* move hw cursor pos from cirrus to vgaGerd Hoffmann2014-12-161-16/+15
|
* cirrus: Force use of shadow pixmap when HW cursor is enabledBenjamin Herrenschmidt2014-12-161-1/+8
| | | | | | | | The HW cursor cannot be painted on a shared surface. This fixes HW cursor display in Windows NT 4.0 and Windows 98. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus: don't overflow CirrusVGAState->cirrus_bltbufGerd Hoffmann2014-12-011-0/+4
| | | | | | This is CVE-2014-8106. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus: fix blit region checkGerd Hoffmann2014-12-011-17/+44
| | | | | | | | | | | | | | | Issues: * Doesn't check pitches correctly in case it is negative. * Doesn't check width at all. Turn macro into functions while being at it, also factor out the check for one region which we then can simply call twice for src + dst. This is CVE-2014-8106. Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
* cirrus: Remove non-32bpp cursor drawingBenjamin Herrenschmidt2014-09-301-28/+36
| | | | | | | | | We only draw cursor on non-shared surfaces (so it seems...) and these are always 32bpp Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* vga: Remove rgb_to_pixel indirectionBenjamin Herrenschmidt2014-09-301-6/+9
| | | | | | | | We always use rgb_to_pixel32 nowadays. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
* cirrus: Fix build of debug codeBenjamin Herrenschmidt2014-07-111-4/+4
| | | | | | | Use PRIu64 to print uint64_t Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* cirrus_vga: adding sanity check for vram sizeGonglei2014-07-111-0/+16
| | | | | | | | | | | when configure a invalid vram size for cirrus card, such as less 2 MB, which will crash qemu. Follow the real hardware, the cirrus card has 4 MB video memory. Also for backward compatibility, accept 8 MB and 16 MB vram size. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela2014-06-161-4/+2
| | | | | | | | | | | | | | | | | | | | | After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
* vga: allow non-global vmstateGerd Hoffmann2014-04-281-2/+2
| | | | | | | | Need a way to opt-out from vga.vram being global vmstate, for secondary vga cards. Add a bool parameter to vga_common_init to support this. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* console: add head to index to qemu consoles.Gerd Hoffmann2014-03-051-2/+2
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* qdev:pci: refactor PCIDevice to use generic "hotpluggable" propertyIgor Mammedov2014-02-101-1/+1
| | | | | | | | | Get rid of PCIDevice specific PCIDeviceClass.no_hotplug and use generic DeviceClass.hotpluggable field instead. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
* cirrus: Mark vga io region as coalesced MMIO flushingJan Kiszka2013-10-171-2/+1
| | | | | | | | This allows to remove the explicit qemu_flush_coalesced_mmio_buffer calls - the memory core will invoke them now. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* devices: Associate devices to their logical categoryMarcel Apfelbaum2013-07-291-0/+2
| | | | | | | | | The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* hw/d*: pass owner to memory_region_init* functionsPaolo Bonzini2013-07-041-1/+1
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vga: pass owner to cirrus_init_commonPaolo Bonzini2013-07-041-10/+12
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* vga: pass owner to vga_common_initPaolo Bonzini2013-07-041-2/+2
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* memory: add owner argument to initialization functionsPaolo Bonzini2013-07-041-8/+8
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* isa: Use realizefn for ISADeviceAndreas Färber2013-06-071-6/+6
| | | | | | | | Drop ISADeviceClass::init and the resulting no-op initfn and let children implement their own realizefn. Adapt error handling. Split off an instance_init where sensible. Signed-off-by: Andreas Färber <afaerber@suse.de>
* Remove unnecessary break statementsStefan Weil2013-06-011-1/+0
| | | | | | | | | | | | | | | | | Fix these warnings from cppcheck: hw/display/cirrus_vga.c:2603: hw/sd/sd.c:348: hw/timer/exynos4210_mct.c:1033: target-arm/translate.c:9886: target-s390x/mem_helper.c:518: target-unicore32/translate.c:1936: style: Consecutive return, break, continue, goto or throw statements are unnecessary. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* cirrus_vga: QOM'ify ISA Cirrus VGAAndreas Färber2013-04-291-5/+10
| | | | | | | | | | | Introduce type constant and cast macro to obsolete DO_UPCAST(). Prepares for ISA realizefn. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Andreas Färber <afaerber@suse.de> Message-id: 1367093935-29091-3-git-send-email-afaerber@suse.de Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* console: add device link to QemuConsolesGerd Hoffmann2013-04-251-2/+2
| | | | | | So it is possible to figure which qemu console displays which device. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* console: add GraphicHwOpsGerd Hoffmann2013-04-161-6/+2
| | | | | | | Pass a single GraphicHwOps struct pointer to graphic_console_init, instead of a bunch of function pointers. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* console: simplify screendumpGerd Hoffmann2013-04-161-2/+2
| | | | | | | | | | | | | | | | | | | Screendumps are alot simpler as we can update non-active QemuConsoles now. So we only need to update the QemuConsole we want write out, then dump the DisplaySurface content into a ppm file. Done. No console switching needed. No special support code in the gfx card emulation needed. Zap it all. Also move ppm_save out of the vga code and next to the qmp_screendump function. For now screen dumping is limited to console #0 (like it used to be), even though it is dead simple to extend it to other consoles. I wanna finish the console cleanup before setting new qapi interfaces into stone. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Igor Mitsyanko <i.mitsyanko@gmail.com>
* console: rename vga_hw_*, add QemuConsole paramGerd Hoffmann2013-04-161-1/+1
| | | | | | | | | | | | Add QemuConsole parameter to vga_hw_*, so the interface allows to update non-active consoles (the actual code can't handle this yet, see next patch). Passing NULL is allowed and updates the active console, like the functions do today. While touching all vga_hw_* calls anyway rename that to the functions to hardware-neutral graphics_hw_* Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* hw: move private headers to hw/ subdirectories.Paolo Bonzini2013-04-081-19/+19
| | | | | | | Many headers are used only in a single directory. These can be kept in hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw: move target-independent files to subdirectoriesPaolo Bonzini2013-04-081-0/+3021
This patch tackles all files that are compiled once, moving them to subdirectories of hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>