aboutsummaryrefslogtreecommitdiff
path: root/hw/display/ati_2d.c
AgeCommit message (Collapse)Author
2023-11-07hw/display/ati: allow compiling without PIXMANMarc-André Lureau
Change the "x-pixman" property default value and use the fallback path when PIXMAN support is disabled. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: BALATON Zoltan <balaton@eik.bme.hu>
2023-11-06ati-vga: Implement fallback for pixman routinesBALATON Zoltan
Pixman routines can fail if no implementation is available and it will become optional soon so add fallbacks when pixman does not work. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <ed0fba3f74e48143f02228b83bf8796ca49f3e7d.1698871239.git.balaton@eik.bme.hu>
2022-11-10display: include dependencies explicitlyMichael S. Tsirkin
acpi-vga-stub.c pulls in vga_int.h However that currently pulls in ui/console.h which breaks e.g. on systems without pixman. It's better to remove ui/console.h from vga_int.h and directly include it where it's used. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20221109222112.74519-1-mst@redhat.com> Tested-by: Laurent Vivier <lvivier@redhat.com> Reported-by: Miroslav Rezanina <mrezanin@redhat.com> Reported-by: Frederic Bezies <fredbezies@gmail.com> Reported-by: Laurent Vivier <lvivier@redhat.com> Fixes: cfead31326 ("AcpiDevAmlIf interface to build VGA device descs") Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2022-09-27hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638)Philippe Mathieu-Daudé
When building QEMU with DEBUG_ATI defined then running with '-device ati-vga,romfile="" -d unimp,guest_errors -trace ati\*' we get: ati_mm_write 4 0x16c0 DP_CNTL <- 0x1 ati_mm_write 4 0x146c DP_GUI_MASTER_CNTL <- 0x2 ati_mm_write 4 0x16c8 DP_MIX <- 0xff0000 ati_mm_write 4 0x16c4 DP_DATATYPE <- 0x2 ati_mm_write 4 0x224 CRTC_OFFSET <- 0x0 ati_mm_write 4 0x142c DST_PITCH_OFFSET <- 0xfe00000 ati_mm_write 4 0x1420 DST_Y <- 0x3fff ati_mm_write 4 0x1410 DST_HEIGHT <- 0x3fff ati_mm_write 4 0x1588 DST_WIDTH_X <- 0x3fff3fff ati_2d_blt: vram:0x7fff5fa00000 addr:0 ds:0x7fff61273800 stride:2560 bpp:32 rop:0xff ati_2d_blt: 0 0 0, 0 127 0, (0,0) -> (16383,16383) 16383x16383 > ^ ati_2d_blt: pixman_fill(dst:0x7fff5fa00000, stride:254, bpp:8, x:16383, y:16383, w:16383, h:16383, xor:0xff000000) Thread 3 "qemu-system-i38" received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff7f62ce0 in sse2_fill.lto_priv () at /lib64/libpixman-1.so.0 #1 0x00007ffff7f09278 in pixman_fill () at /lib64/libpixman-1.so.0 #2 0x0000555557b5a9af in ati_2d_blt (s=0x631000028800) at hw/display/ati_2d.c:196 #3 0x0000555557b4b5a2 in ati_mm_write (opaque=0x631000028800, addr=5512, data=1073692671, size=4) at hw/display/ati.c:843 #4 0x0000555558b90ec4 in memory_region_write_accessor (mr=0x631000039cc0, addr=5512, ..., size=4, ...) at softmmu/memory.c:492 Commit 584acf34cb0 ("ati-vga: Fix reverse bit blts") introduced the local dst_x and dst_y which adjust the (x, y) coordinates depending on the direction in the SRCCOPY ROP3 operation, but forgot to address the same issue for the PATCOPY, BLACKNESS and WHITENESS operations, which also call pixman_fill(). Fix that now by using the adjusted coordinates in the pixman_fill call, and update the related debug printf(). Reported-by: Qiang Liu <qiangliu@zju.edu.cn> Fixes: 584acf34cb0 ("ati-vga: Fix reverse bit blts") Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20210906153103.1661195-1-philmd@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-11-04ati: check x y display parameter valuesPrasad J Pandit
The source and destination x,y display parameters in ati_2d_blt() may run off the vga limits if either of s->regs.[src|dst]_[xy] is zero. Check the parameter values to avoid potential crash. Reported-by: Gaoning Pan <pgn@zju.edu.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-id: 20201021103818.1704030-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2020-04-07ati-vga: Fix checks in ati_2d_blt() to avoid crashBALATON Zoltan
In some corner cases (that never happen during normal operation but a malicious guest could program wrong values) pixman functions were called with parameters that result in a crash. Fix this and add more checks to disallow such cases. Reported-by: Ziming Zhang <ezrakiez@gmail.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-07-05ati-vga: Fix reverse bit bltsBALATON Zoltan
The pixman library only supports blts with left to right, top to bottom order but the ATI VGA engine can also do different directions. Fix support for these via a temporary buffer for now. This fixes rendering issues related to such blts (such as moving windows) but some other glitches still remain. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: e21855faaeb30d7b1771f084f283f6a30bedb1a3.1562227303.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-07-05ati-vga: Fix frame buffer endianness for big endian targetBALATON Zoltan
The extended mode frame buffer should be little endian even when emulating big endian machine (such as PPC). This fixes color problems with MorphOS. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 439aa85061f103446df7b42632d730971a372432.1562151410.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-07-05ati-vga: Improve readability of ati_2d_blt functionBALATON Zoltan
Move common parts before the switch to remove code duplication and improve readibility. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 04b67ff483223d4722b0b044192558e7d17b36b5.1562151410.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-06-28ati-vga: Fixes to offset and pitch registersBALATON Zoltan
Fix bit masks of registers for offset and pitch and also handle default values for both R128P and RV100. This improves picture a bit but does not resolve all problems yet so there might be some more bugs somewhere. Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Message-id: 20190624100005.7A1CA746395@zero.eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-05-13Clean up includesMarkus Armbruster
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes, with the changes to the following files manually reverted: contrib/libvhost-user/libvhost-user-glib.h contrib/libvhost-user/libvhost-user.c contrib/libvhost-user/libvhost-user.h linux-user/mips64/cpu_loop.c linux-user/mips64/signal.c linux-user/sparc64/cpu_loop.c linux-user/sparc64/signal.c linux-user/x86_64/cpu_loop.c linux-user/x86_64/signal.c slirp/src/* target/s390x/gen-features.c tests/fp/platform.h tests/migration/s390x/a-b-bios.c tests/test-rcu-simpleq.c tests/test-rcu-tailq.c tests/uefi-test-tools/UefiTestToolsPkg/BiosTablesTest/BiosTablesTest.c We're in the process of spinning out slirp/. tests/fp/platform.h is has to include qemu/osdep.h because tests/fp/berkeley-softfloat-3/ and tests/fp/berkeley-testfloat-3/ don't. tests/uefi-test-tools/ is guest software. The remaining reverts are the same as in commit b7d89466dde. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190313162812.8885-1-armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> [Revert change to tests/fp/platform.h, adjust commit message]
2019-05-07ati-vga: Fix check for blt outside vramBALATON Zoltan
Fix the check preventing calling pixman functions that would access memory outside allocated vram. The r128 X driver sometimes seem to try blits that span outside vram, this check prevents crashing QEMU in that case. (The r128 X driver may have problems even on real hardware so I'm not sure if it's a client bug or emulation problem but at least QEMU should survive.) Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Tested-by: Andrew Randrianasulu <randrianasulu@gmail.com> Message-Id: <20190409110732.5C5FF7465DB@zero.eik.bme.hu> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-03-11hw/display: Add basic ATI VGA emulationBALATON Zoltan
At least two machines, the PPC mac99 and MIPS fulong2e, have an ATI gfx chip by default (Rage 128 Pro and M6/RV100 respectively) and guests running on these and the PMON2000 firmware of the fulong2e expect this to be available. Fortunately these are very similar chips so they can be mostly emulated in the same device model. This patch adds basic emulation of these ATI VGA chips. While this is incomplete and currently only enough to run the MIPS firmware and get framebuffer output with Linux, it allows the fulong2e board to work more like the real hardware and having it in QEMU in this state provides a way to experiment with it and allows others to contribute to improve it. It is compiled for all archs but only the fulong2e (which currently has no display output at all) is set to use it by default (in a separate patch). Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Acked-by: Aleksandar Markovic <amarkovic@wavecomp.com> Tested-by: Andrew Randrianasulu <randrianasulu@gmail.com> Tested-by: Howard Spoelstra <hsp.cat7@gmail.com> Message-id: 0b1b7c22873a6e37627261b04fb687412b25ff4f.1552152100.git.balaton@eik.bme.hu Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>