aboutsummaryrefslogtreecommitdiff
path: root/hw/display
AgeCommit message (Collapse)Author
2017-04-24vga: add vga_scanline_invalidated helperGerd Hoffmann
Add vga_scanline_invalidated helper to check whenever a scanline was invalidated. Add a sanity check to fix OOB read access for display heights larger than 2048. Only cirrus uses this, for hardware cursor rendering, so having this work properly for the first 2048 scanlines only shouldn't be a problem as the cirrus can't handle large resolutions anyway. Also changing the invalidated_y_table size would break live migration. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170421091632.30900-4-kraxel@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-24virtio-gpu: replace PIXMAN_* by PIXMAN_BE_*Laurent Vivier
This avoids a "#ifdef HOST_WORDS_BIGENDIAN" and this is the purpose of PIXMAN_BE_* macros. Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Sahid Orentino Ferdjaoui <sahid.ferdjaoui@redhat.com> Message-id: 20170403114044.15762-1-lvivier@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: switch to load_image_mr() and remove prom_addr hackMark Cave-Ayland
Previous to the existence of load_image_mr(), the only way to load in the FCode ROM image was to pass in its physical address via qdev properties and use load_image_targphys(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: use tcx_set_dirty() for accelerated opsMark Cave-Ayland
Rather than calling memory_region_set_dirty() directly, make sure that we call tcx_set_dirty() instead. This ensures that the 24-bit plane and cplane are also invalidated correctly. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove primitives for non-32-bit surfacesMark Cave-Ayland
As all surfaces in QEMU are now either shared or 32-bit ARGB regardless of the guest depth, remove all non-32-bit primitives from tcx_update_display() and consequence their implementation which are no longer required. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove TARGET_PAGE_SIZE from tcx24_update_display()Mark Cave-Ayland
Now that page alignment is handled by the memory API, there is no need to duplicate the code 4 times (4 * 1024 == 4096 == TARGET_PAGE_SIZE). Finally we have now removed all traces of TARGET_PAGE_SIZE. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove TARGET_PAGE_SIZE from tcx_update_display()Mark Cave-Ayland
Now that page alignment is handled by the memory API, there is no need to duplicate the code 4 times (4 * 1024 == 4096 == TARGET_PAGE_SIZE). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: remove page24 and cpage from tcx24_update_display()Mark Cave-Ayland
Since all of the tcx_*_dirty() functions now calculate the 24-bit and cplane offsets themselves from the base address, these variables are no longer needed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: alter tcx24_reset_dirty() to accept address and length parametersMark Cave-Ayland
This can now be used by both the 8-bit and 24-bit display code, so rename to tcx_check_dirty(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: alter tcx24_check_dirty() to accept address and length parametersMark Cave-Ayland
This can now be used by both the 8-bit and 24-bit display code, so rename to tcx_check_dirty(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: ensure tcx_set_dirty() also invalidates the 24-bit plane and cplaneMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21tcx: alter tcx_set_dirty() to accept address and length parametersMark Cave-Ayland
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21cg3: switch to load_image_mr() and remove prom-addr hackMark Cave-Ayland
Previous to the existence of load_image_mr(), the only way to load in the FCode ROM image was to pass in its physical address via qdev properties and use load_image_targphys(). Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2017-04-21cg3: fix up size parameter for memory_region_get_dirty()Mark Cave-Ayland
The code was incorrectly calculating the end address rather than the size of the required region. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-21cg3: remove TARGET_PAGE_SIZE rounding on dirty page detectionMark Cave-Ayland
This was an artifact from very early versions of the code from before the memory API and is no longer needed. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
2017-04-11qxl: add migration blocker to avoid pre-save assertGerd Hoffmann
Cc: 1635339@bugs.launchpad.net Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170410113131.2585-1-kraxel@redhat.com
2017-04-07qxl: switch display on entering VGAMarc-André Lureau
Since commit cd958edb1fae85d, same size console resize is skipped. This change broke QXL incoming migration in VGA mode, qemu_spice_display_switch() is no longer called during qxl_post_load(), because default message surface is of the same size, and during displaychangelistener registration, PCIQXLDevice.mode is QXL_MODE_UNDEFINED. This triggers a later crash on refresh: ==2634== Invalid read of size 4 ==3516== at 0x65F3050: pixman_image_get_data (in /usr/lib64/libpixman-1.so.0.34.0) ==3516== by 0x6F0CEB: qemu_spice_create_update (spice-display.c:215) ==3516== by 0x6F1CC7: qemu_spice_display_refresh (spice-display.c:502) ==3516== by 0x58CF77: display_refresh (qxl.c:1948) ==3516== by 0x6E8084: do_safe_dpy_refresh (console.c:1591) ==3516== by 0x6E80D5: dpy_refresh (console.c:1604) ==3516== by 0x6E4508: gui_update (console.c:201) ==3516== by 0x81898E: timerlist_run_timers (qemu-timer.c:536) ==3516== by 0x8189D6: qemu_clock_run_timers (qemu-timer.c:547) ==3516== by 0x818D98: qemu_clock_run_all_timers (qemu-timer.c:662) ==3516== by 0x81952A: main_loop_wait (main-loop.c:514) ==3516== by 0x4ADD29: main_loop (vl.c:1898) One way to solve this is to explicitely call qemu_spice_display_switch() on entering VGA mode, which is called during qxl_post_load(). Fixes: "null pointer access on migration resume of systemrescuecd boot menu with qxl-vga" https://bugs.launchpad.net/qemu/+bug/1679126 https://bugzilla.redhat.com/show_bug.cgi?id=1438566 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20170406120513.638-4-marcandre.lureau@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-27cirrus: fix PUTPIXEL macroGerd Hoffmann
Should be "c" not "col". The macro is used with "col" as third parameter everywhere, so this tyops doesn't break something. Fixes: 026aeffcb4752054830ba203020ed6eb05bcaba8 Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 1490168303-24588-1-git-send-email-kraxel@redhat.com
2017-03-21add opengl_cflags to QEMU_CFLAGSGerd Hoffmann
... and drop OPENGL_CFLAGS from Makefiles. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1490079888-29029-1-git-send-email-kraxel@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-20Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
fixes for 2.9-rc1, plus removal of -mno-cygwin references # gpg: Signature made Mon 20 Mar 2017 11:25:07 GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hax: fix breakage in locking configure: remove Cygwin xen: do not build backends for targets that do not support xen qemu-ga: obey LISTEN_PID when using systemd socket activation Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-19xen: do not build backends for targets that do not support xenStefano Stabellini
Change Makefile.objs to use CONFIG_XEN instead of CONFIG_XEN_BACKEND, so that the Xen backends are only built for targets that support Xen. Set CONFIG_XEN in the toplevel Makefile to ensure that files that are built only once pick up Xen support properly. Signed-off-by: Stefano Stabellini <stefano@aporeto.com> Tested-by: Greg Kurz <groug@kaod.org> Reviewed-by: Greg Kurz <groug@kaod.org> CC: pbonzini@redhat.com CC: peter.maydell@linaro.org CC: rth@twiddle.net CC: stefanha@redhat.com Message-Id: <1489694518-16978-1-git-send-email-sstabellini@kernel.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-17cirrus: fix off-by-one in cirrus_bitblt_rop_bkwd_transp_*_16Gerd Hoffmann
The switch from pointers to addresses (commit 026aeffcb4752054830ba203020ed6eb05bcaba8 and ffaf857778286ca54e3804432a2369a279e73aa7) added a off-by-one bug to 16bit backward blits. Fix. Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Li Qiang <liqiang6-s@360.cn> Message-id: 1489735296-19047-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: stop passing around src pointers in the blitterGerd Hoffmann
Does basically the same as "cirrus: stop passing around dst pointers in the blitter", just for the src pointer instead of the dst pointer. For the src we have to care about cputovideo blits though and fetch the data from s->cirrus_bltbuf instead of vga memory. The cirrus_src*() helper functions handle that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489584487-3489-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: stop passing around dst pointers in the blitterGerd Hoffmann
Instead pass around the address (aka offset into vga memory). Calculate the pointer in the rop_* functions, after applying the mask to the address, to make sure the address stays within the valid range. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489574872-8679-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: fix cirrus_invalidate_regionGerd Hoffmann
off_cur_end is exclusive, so off_cur_end == cirrus_addr_mask is valid. Fix calculation to make sure to allow that, otherwise the assert added by commit f153b563f8cf121aebf5a2fff5f0110faf58ccb3 can trigger for valid blits. Test case: boot windows nt 4.0 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489579606-26020-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: add option to disable blitterGerd Hoffmann
Ok, we have this beast in the cirrus code which is not used at all by modern guests, except when you try to find security holes in qemu. So, add an option to disable blitter altogether. Guests released within the last ten years should not show any rendering issues if you turn off blitter support. There are no known bugs in the cirrus blitter code. But in the past we hoped a few times already that we've finally nailed the last issue. So having some easy way to mitigate in case yet another blitter issue shows up certainly makes me sleep a bit better at night. For completeness: The by far better way to mitigate is to switch away from cirrus and use stdvga instead. Or something more modern like virtio-vga in case your guest has support for it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494540-15745-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus: switch to 4 MB video memory by defaultGerd Hoffmann
Quoting cirrus source code: Follow real hardware, cirrus card emulated has 4 MB video memory. Also accept 8 MB/16 MB for backward compatibility. So just use 4MB by default. We decided to leave that at 8MB by default a while ago, for live migration compatibility reasons. But we have compat properties to handle that, so that isn't a compeling reason. This also removes some sanity check inconsistencies in the cirrus code. Some places check against the allocated video memory, some places check against the 4MB physical hardware has. Guest code can trigger asserts because of that. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494514-15606-1-git-send-email-kraxel@redhat.com
2017-03-16cirrus/vnc: zap bitblit support from console code.Gerd Hoffmann
There is a special code path (dpy_gfx_copy) to allow graphic emulation notify user interface code about bitblit operations carryed out by guests. It is supported by cirrus and vnc server. The intended purpose is to optimize display scrolls and just send over the scroll op instead of a full display update. This is rarely used these days though because modern guests simply don't use the cirrus blitter any more. Any linux guest using the cirrus drm driver doesn't. Any windows guest newer than winxp doesn't ship with a cirrus driver any more and thus uses the cirrus as simple framebuffer. So this code tends to bitrot and bugs can go unnoticed for a long time. See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV" which fixes a bug lingering in the code for almost a year, added by commit "c7628bf vnc: only alloc server surface with clients connected". Also the vnc server will throttle the frame rate in case it figures the network can't keep up (send buffers are full). This doesn't work with dpy_gfx_copy, for any copy operation sent to the vnc client we have to send all outstanding updates beforehand, otherwise the vnc client might run the client side blit on outdated data and thereby corrupt the display. So this dpy_gfx_copy "optimization" might even make things worse on slow network links. Lets kill it once for all. Oh, and one more reason: Turns out (after writing the patch) we have a security bug in that code path ... Fixes: CVE-2016-9603 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1489494419-14340-1-git-send-email-kraxel@redhat.com
2017-03-16fix :cirrus_vga fix OOB read case qemu Segmentation faulthangaohuai
check the validity of parameters in cirrus_bitblt_rop_fwd_transp_xxx and cirrus_bitblt_rop_fwd_xxx to avoid the OOB read which causes qemu Segmentation fault. After the fix, we will touch the assert in cirrus_invalidate_region: assert(off_cur_end >= off_cur); Signed-off-by: fangying <fangying1@huawei.com> Signed-off-by: hangaohuai <hangaohuai@huawei.com> Message-id: 20170314063919.16200-1-hangaohuai@huawei.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-03-09qxl: clear guest_cursor on QXL_CURSOR_HIDEGerd Hoffmann
Make sure we don't leave guest_cursor pointing into nowhere. This might lead to (rare) live migration failures, due to target trying to restore the cursor from the stale pointer. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1421788 Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1488789111-27340-1-git-send-email-kraxel@redhat.com
2017-02-28Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2017-02-28 # gpg: Signature made Tue 28 Feb 2017 06:43:55 GMT # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: syscall: fixed mincore(2) not failing with ENOMEM hw/acpi/tco.c: fix tco timer stop lm32: milkymist-tmu2: fix a third integer overflow qemu-options.hx: add missing id=chr0 chardev argument in vhost-user example Update copyright year tests/prom-env: Enable the test for the sun4u machine, too cadence_gem: Remove unused parameter debug message register: fix incorrect read mask ide: remove undefined behavior in ide-test CODING_STYLE: Mention preferred comment form hw/core/register: Mark the device with cannot_instantiate_with_device_add_yet hw/core/or-irq: Mark the device with cannot_instantiate_with_device_add_yet softfloat: Use correct type in float64_to_uint64_round_to_zero() target/s390x: Fix typo Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-28lm32: milkymist-tmu2: fix a third integer overflowPeter Maydell
Don't truncate the multiplication and do a 64 bit one instead because the result is stored in a 64 bit variable. This fixes a similar coverity warning to commits 237a8650d640 and 4382fa655498, in a similar way, and is the final third of the fix for coverity CID 1167561 (hopefully!). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Acked-by: Michael Walle <michael@walle.cc> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-02-27virtio-gpu: use dpy_gl_scanout_disableGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-4-git-send-email-kraxel@redhat.com
2017-02-27console: rename dpy_gl_scanout to dpy_gl_scanout_textureGerd Hoffmann
We'll add a variant which accepts dmabufs soon. Change the name so we can easily disturgish the two variants. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 1487669841-13668-2-git-send-email-kraxel@redhat.com
2017-02-24cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)Gerd Hoffmann
CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination and blit width, at all. Oops. Fix it. Security impact: high. The missing blit destination check allows to write to host memory. Basically same as CVE-2014-8106 for the other blit variants. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-13migration: consolidate VMStateField.startHalil Pasic
The member VMStateField.start is used for two things, partial data migration for VBUFFER data (basically provide migration for a sub-buffer) and for locating next in QTAILQ. The implementation of the VBUFFER feature is broken when VMSTATE_ALLOC is used. This however goes unnoticed because actually partial migration for VBUFFER is not used at all. Let's consolidate the usage of VMStateField.start by removing support for partial migration for VBUFFER. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Message-Id: <20170203175217.45562-1-pasic@linux.vnet.ibm.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-02-10Revert "cirrus: allow zero source pitch in pattern fill rops"Gerd Hoffmann
This reverts commit 5858dd1801883309bdd208d72ddb81c4e9fee30c. Conflicts: hw/display/cirrus_vga.c Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-2-git-send-email-kraxel@redhat.com
2017-02-10cirrus: fix patterncopy checksGerd Hoffmann
The blit_region_is_unsafe checks don't work correctly for the patterncopy source. It's a fixed-sized region, which doesn't depend on cirrus_blt_{width,height}. So go do the check in cirrus_bitblt_common_patterncopy instead, then tell blit_is_unsafe that it doesn't need to verify the source. Also handle the case where we blit from cirrus_bitbuf correctly. This patch replaces 5858dd1801883309bdd208d72ddb81c4e9fee30c. Security impact: I think for the most part error on the safe side this time, refusing blits which should have been allowed. Only exception is placing the blit source at the end of the video ram, so cirrus_blt_srcaddr + 256 goes beyond the end of video memory. But even in that case I'm not fully sure this actually allows read access to host memory. To trick the commit 5858dd18 security checks one has to pick very small cirrus_blt_{width,height} values, which in turn implies only a fraction of the blit source will actually be used. Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1486645341-5010-1-git-send-email-kraxel@redhat.com
2017-02-10cirrus: replace debug printf with trace pointsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-2-git-send-email-kraxel@redhat.com
2017-02-10vga: replace debug printf with trace pointsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 1486561893-26470-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix resource leak in virgl_cmd_resource_unrefGerd Hoffmann
When the guest sends VIRTIO_GPU_CMD_RESOURCE_UNREF without detaching the backing storage beforehand (VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING) we'll leak memory. This patch fixes it for 3d mode, simliar to the 2d mode fix in commit "b8e2392 virtio-gpu: call cleanup mapping function in resource destroy". Reported-by: 李强 <liqiang6-s@360.cn> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485167210-4757-1-git-send-email-kraxel@redhat.com
2017-02-10virtio-gpu: fix memory leak in set scanoutLi Qiang
In virtio_gpu_set_scanout function, when creating the 'rect' its refcount is set to 2, by pixman_image_create_bits and qemu_create_displaysurface_pixman function. This can lead a memory leak issues. This patch avoid this issue. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 5884626f.5b2f6b0a.1bfff.3037@mx.google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-03Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20170202-2' into ↵Peter Maydell
staging cirrus: multiple bugfixes, including CVE-2017-2615 fix. # gpg: Signature made Thu 02 Feb 2017 15:03:35 GMT # gpg: using RSA key 0x4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * remotes/kraxel/tags/pull-vga-20170202-2: cirrus: fix oob access issue (CVE-2017-2615) cirrus: fix blit address mask handling cirrus: allow zero source pitch in pattern fill rops cirrus: handle negative pitch in cirrus_invalidate_region() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-02Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' ↵Peter Maydell
into staging # gpg: Signature made Wed 01 Feb 2017 13:44:32 GMT # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/tracing-pull-request: trace: clean up trace-events files qapi: add missing trace_visit_type_enum() call trace: improve error reporting when parsing simpletrace header trace: update docs to reflect new code generation approach trace: switch to modular code generation for sub-directories trace: move setting of group name into Makefiles trace: move hw/i386/xen events to correct subdir trace: move hw/xen events to correct subdir trace: move hw/block/dataplane events to correct subdir make: move top level dir to end of include search path # Conflicts: # Makefile Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-02cirrus: fix oob access issue (CVE-2017-2615)Li Qiang
When doing bitblt copy in backward mode, we should minus the blt width first just like the adding in the forward mode. This can avoid the oob access of the front of vga's vram. Signed-off-by: Li Qiang <liqiang6-s@360.cn> { kraxel: with backward blits (negative pitch) addr is the topmost address, so check it as-is against vram size ] Cc: qemu-stable@nongnu.org Cc: P J P <ppandit@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Wolfgang Bumiller <w.bumiller@proxmox.com> Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106) Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com Reviewed-by: Laszlo Ersek <lersek@redhat.com>
2017-02-01cirrus: fix blit address mask handlingGerd Hoffmann
Apply the cirrus_addr_mask to cirrus_blt_dstaddr and cirrus_blt_srcaddr right after assigning them, in cirrus_bitblt_start(), instead of having this all over the place in the cirrus code, and missing a few places. Reported-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 1485338996-17095-1-git-send-email-kraxel@redhat.com
2017-02-01cirrus: allow zero source pitch in pattern fill ropsWolfgang Bumiller
The rops used by cirrus_bitblt_common_patterncopy only use the destination pitch, so the source pitch shoul allowed to be zero and the blit with used for the range check around the source address. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485272138-23249-1-git-send-email-w.bumiller@proxmox.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-02-01cirrus: handle negative pitch in cirrus_invalidate_region()Wolfgang Bumiller
cirrus_invalidate_region() calls memory_region_set_dirty() on a per-line basis, always ranging from off_begin to off_begin+bytesperline. With a negative pitch off_begin marks the top most used address and thus we need to do an initial shift backwards by a line for negative pitches of backward blits, otherwise the first iteration covers the line going from the start offset forwards instead of backwards. Additionally since the start address is inclusive, if we shift by a full `bytesperline` we move to the first address *not* included in the blit, so we only shift by one less than bytesperline. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-id: 1485352137-29367-1-git-send-email-w.bumiller@proxmox.com [ kraxel: codestyle fixes ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2017-01-31trace: clean up trace-events filesStefan Hajnoczi
There are a number of unused trace events that scripts/cleanup-trace-events.pl finds. The "hw/vfio/pci-quirks.c" filename was typoed and "qapi/qapi-visit-core.c" was missing the qapi/ directory prefix. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 20170126171613.1399-3-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-01-31qxl: switch to constants within BUILD_BUG_ONMichael S. Tsirkin
We are switching BUILD_BUG_ON to verify that it's parameter is a compile-time constant, and it turns out that some gcc versions (specifically gcc (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 20160609) are not smart enough to figure it out for expressions involving local variables. This is harmless but means that the check is ineffective for these platforms. To fix, replace variables with macros. Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-17 06:53:49 +0000