mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vga: add sr_vbe register set

Browse Source 
Commit "fd3c136 vga: make sure vga register setup for vbe stays intact
(CVE-2016-3712)." causes a regression.  The win7 installer is unhappy
because it can't freely modify vga registers any more while in vbe mode.

This patch introduces a new sr_vbe register set.  The vbe_update_vgaregs
will fill sr_vbe[] instead of sr[].  Normal vga register reads and
writes go to sr[].  Any sr register read access happens through a new
sr() helper function which will read from sr_vbe[] with vbe active and
from sr[] otherwise.

This way we can allow guests update sr[] registers as they want, without
allowing them disrupt vbe video modes that way.

Cc: qemu-stable@nongnu.org
Reported-by: Thomas Lamprecht <thomas@lamprecht.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com
This commit is contained in:
Gerd Hoffmann 2016-05-17 10:54:54 +02:00
parent 6b860806c0
commit 94ef4f337f
2 changed files with 29 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
hw/display/vga.c
View File

@ -149,6 +149,11 @@ static inline bool vbe_enabled(VGACommonState *s)
return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED; return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED;
} }
static inline uint8_t sr(VGACommonState *s, int idx)
{
return vbe_enabled(s) ? s->sr_vbe[idx] : s->sr[idx];
}
static void vga_update_memory_access(VGACommonState *s) static void vga_update_memory_access(VGACommonState *s)
{ {
hwaddr base, offset, size; hwaddr base, offset, size;
@ -163,8 +168,8 @@ static void vga_update_memory_access(VGACommonState *s)
s->has_chain4_alias = false; s->has_chain4_alias = false;
s->plane_updated = 0xf; s->plane_updated = 0xf;
} }
if ((s->sr[VGA_SEQ_PLANE_WRITE] & VGA_SR02_ALL_PLANES) == if ((sr(s, VGA_SEQ_PLANE_WRITE) & VGA_SR02_ALL_PLANES) ==
VGA_SR02_ALL_PLANES && s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) { VGA_SR02_ALL_PLANES && sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
offset = 0; offset = 0;
switch ((s->gr[VGA_GFX_MISC] >> 2) & 3) { switch ((s->gr[VGA_GFX_MISC] >> 2) & 3) {
case 0: case 0:
@ -234,7 +239,7 @@ static void vga_precise_update_retrace_info(VGACommonState *s)
((s->cr[VGA_CRTC_OVERFLOW] >> 6) & 2)) << 8); ((s->cr[VGA_CRTC_OVERFLOW] >> 6) & 2)) << 8);
vretr_end_line = s->cr[VGA_CRTC_V_SYNC_END] & 0xf; vretr_end_line = s->cr[VGA_CRTC_V_SYNC_END] & 0xf;
clocking_mode = (s->sr[VGA_SEQ_CLOCK_MODE] >> 3) & 1; clocking_mode = (sr(s, VGA_SEQ_CLOCK_MODE) >> 3) & 1;
clock_sel = (s->msr >> 2) & 3; clock_sel = (s->msr >> 2) & 3;
dots = (s->msr & 1) ? 8 : 9; dots = (s->msr & 1) ? 8 : 9;
@ -486,7 +491,6 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
printf("vga: write SR%x = 0x%02x\n", s->sr_index, val); printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
#endif #endif
s->sr[s->sr_index] = val & sr_mask[s->sr_index]; s->sr[s->sr_index] = val & sr_mask[s->sr_index];
vbe_update_vgaregs(s);
if (s->sr_index == VGA_SEQ_CLOCK_MODE) { if (s->sr_index == VGA_SEQ_CLOCK_MODE) {
s->update_retrace_info(s); s->update_retrace_info(s);
} }
@ -680,13 +684,13 @@ static void vbe_update_vgaregs(VGACommonState *s)
if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) { if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) {
shift_control = 0; shift_control = 0;
s->sr[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */ s->sr_vbe[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */
} else { } else {
shift_control = 2; shift_control = 2;
/* set chain 4 mode */ /* set chain 4 mode */
s->sr[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M; s->sr_vbe[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M;
/* activate all planes */ /* activate all planes */
s->sr[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES; s->sr_vbe[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES;
} }
s->gr[VGA_GFX_MODE] = (s->gr[VGA_GFX_MODE] & ~0x60) | s->gr[VGA_GFX_MODE] = (s->gr[VGA_GFX_MODE] & ~0x60) |
(shift_control << 5); (shift_control << 5);
@ -836,7 +840,7 @@ uint32_t vga_mem_readb(VGACommonState *s, hwaddr addr)
break; break;
} }
if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) { if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
/* chain 4 mode : simplest access */ /* chain 4 mode : simplest access */
assert(addr < s->vram_size); assert(addr < s->vram_size);
ret = s->vram_ptr[addr]; ret = s->vram_ptr[addr];
@ -904,11 +908,11 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
break; break;
} }
if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) { if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
/* chain 4 mode : simplest access */ /* chain 4 mode : simplest access */
plane = addr & 3; plane = addr & 3;
mask = (1 << plane); mask = (1 << plane);
if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) { if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
assert(addr < s->vram_size); assert(addr < s->vram_size);
s->vram_ptr[addr] = val; s->vram_ptr[addr] = val;
#ifdef DEBUG_VGA_MEM #ifdef DEBUG_VGA_MEM
@ -921,7 +925,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
/* odd/even mode (aka text mode mapping) */ /* odd/even mode (aka text mode mapping) */
plane = (s->gr[VGA_GFX_PLANE_READ] & 2) | (addr & 1); plane = (s->gr[VGA_GFX_PLANE_READ] & 2) | (addr & 1);
mask = (1 << plane); mask = (1 << plane);
if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) { if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
addr = ((addr & ~1) << 1) | plane; addr = ((addr & ~1) << 1) | plane;
if (addr >= s->vram_size) { if (addr >= s->vram_size) {
return; return;
@ -996,7 +1000,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
do_write: do_write:
/* mask data according to sr[2] */ /* mask data according to sr[2] */
mask = s->sr[VGA_SEQ_PLANE_WRITE]; mask = sr(s, VGA_SEQ_PLANE_WRITE);
s->plane_updated |= mask; /* only used to detect font change */ s->plane_updated |= mask; /* only used to detect font change */
write_mask = mask16[mask]; write_mask = mask16[mask];
if (addr * sizeof(uint32_t) >= s->vram_size) { if (addr * sizeof(uint32_t) >= s->vram_size) {
@ -1152,10 +1156,10 @@ static void vga_get_text_resolution(VGACommonState *s, int *pwidth, int *pheight
/* total width & height */ /* total width & height */
cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1; cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
cwidth = 8; cwidth = 8;
if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) { if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
cwidth = 9; cwidth = 9;
} }
if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) { if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
cwidth = 16; /* NOTE: no 18 pixel wide */ cwidth = 16; /* NOTE: no 18 pixel wide */
} }
width = (s->cr[VGA_CRTC_H_DISP] + 1); width = (s->cr[VGA_CRTC_H_DISP] + 1);
@ -1197,7 +1201,7 @@ static void vga_draw_text(VGACommonState *s, int full_update)
int64_t now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL); int64_t now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
/* compute font data address (in plane 2) */ /* compute font data address (in plane 2) */
v = s->sr[VGA_SEQ_CHARACTER_MAP]; v = sr(s, VGA_SEQ_CHARACTER_MAP);
offset = (((v >> 4) & 1) | ((v << 1) & 6)) * 8192 * 4 + 2; offset = (((v >> 4) & 1) | ((v << 1) & 6)) * 8192 * 4 + 2;
if (offset != s->font_offsets[0]) { if (offset != s->font_offsets[0]) {
s->font_offsets[0] = offset; s->font_offsets[0] = offset;
@ -1506,11 +1510,11 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
} }
if (shift_control == 0) { if (shift_control == 0) {
if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) { if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
disp_width <<= 1; disp_width <<= 1;
} }
} else if (shift_control == 1) { } else if (shift_control == 1) {
if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) { if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
disp_width <<= 1; disp_width <<= 1;
} }
} }
@ -1574,7 +1578,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
if (shift_control == 0) { if (shift_control == 0) {
full_update |= update_palette16(s); full_update |= update_palette16(s);
if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) { if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
v = VGA_DRAW_LINE4D2; v = VGA_DRAW_LINE4D2;
} else { } else {
v = VGA_DRAW_LINE4; v = VGA_DRAW_LINE4;
@ -1582,7 +1586,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
bits = 4; bits = 4;
} else if (shift_control == 1) { } else if (shift_control == 1) {
full_update |= update_palette16(s); full_update |= update_palette16(s);
if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) { if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
v = VGA_DRAW_LINE2D2; v = VGA_DRAW_LINE2D2;
} else { } else {
v = VGA_DRAW_LINE2; v = VGA_DRAW_LINE2;
@ -1629,7 +1633,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
#if 0 #if 0
printf("w=%d h=%d v=%d line_offset=%d cr[0x09]=0x%02x cr[0x17]=0x%02x linecmp=%d sr[0x01]=0x%02x\n", printf("w=%d h=%d v=%d line_offset=%d cr[0x09]=0x%02x cr[0x17]=0x%02x linecmp=%d sr[0x01]=0x%02x\n",
width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE], width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE],
s->line_compare, s->sr[VGA_SEQ_CLOCK_MODE]); s->line_compare, sr(s, VGA_SEQ_CLOCK_MODE));
#endif #endif
addr1 = (s->start_addr * 4); addr1 = (s->start_addr * 4);
bwidth = (width * bits + 7) / 8; bwidth = (width * bits + 7) / 8;
@ -1781,6 +1785,7 @@ void vga_common_reset(VGACommonState *s)
{ {
s->sr_index = 0; s->sr_index = 0;
memset(s->sr, '\0', sizeof(s->sr)); memset(s->sr, '\0', sizeof(s->sr));
memset(s->sr_vbe, '\0', sizeof(s->sr_vbe));
s->gr_index = 0; s->gr_index = 0;
memset(s->gr, '\0', sizeof(s->gr)); memset(s->gr, '\0', sizeof(s->gr));
s->ar_index = 0; s->ar_index = 0;
@ -1883,10 +1888,10 @@ static void vga_update_text(void *opaque, console_ch_t *chardata)
/* total width & height */ /* total width & height */
cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1; cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
cw = 8; cw = 8;
if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) { if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
cw = 9; cw = 9;
} }
if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) { if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
cw = 16; /* NOTE: no 18 pixel wide */ cw = 16; /* NOTE: no 18 pixel wide */
} }
width = (s->cr[VGA_CRTC_H_DISP] + 1); width = (s->cr[VGA_CRTC_H_DISP] + 1);
@ -2053,6 +2058,7 @@ static int vga_common_post_load(void *opaque, int version_id)
/* force refresh */ /* force refresh */
s->graphic_mode = -1; s->graphic_mode = -1;
vbe_update_vgaregs(s);
return 0; return 0;
} }

1
hw/display/vga_int.h
View File

@ -98,6 +98,7 @@ typedef struct VGACommonState {
MemoryRegion chain4_alias; MemoryRegion chain4_alias;
uint8_t sr_index; uint8_t sr_index;
uint8_t sr[256]; uint8_t sr[256];
uint8_t sr_vbe[256];
uint8_t gr_index; uint8_t gr_index;
uint8_t gr[256]; uint8_t gr[256];
uint8_t ar_index; uint8_t ar_index;