34b321
From 40d4a0ec487abcde65d4175dde0c9dda45b570f9 Mon Sep 17 00:00:00 2001
607880
From: Gerd Hoffmann <kraxel@redhat.com>
607880
Date: Thu, 16 Jun 2016 15:30:11 +0200
34b321
Subject: [PATCH 2/2] vga: add sr_vbe register set
607880
607880
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
607880
Message-id: <1466091011-8095-2-git-send-email-kraxel@redhat.com>
607880
Patchwork-id: 70639
607880
O-Subject: [RHEL-7.3 qemu-kvm PATCH 1/1] vga: add sr_vbe register set
34b321
Bugzilla: 1346982
607880
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
607880
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
607880
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
607880
607880
Commit "fd3c136 vga: make sure vga register setup for vbe stays intact
607880
(CVE-2016-3712)." causes a regression.  The win7 installer is unhappy
607880
because it can't freely modify vga registers any more while in vbe mode.
607880
607880
This patch introduces a new sr_vbe register set.  The vbe_update_vgaregs
607880
will fill sr_vbe[] instead of sr[].  Normal vga register reads and
607880
writes go to sr[].  Any sr register read access happens through a new
607880
sr() helper function which will read from sr_vbe[] with vbe active and
607880
from sr[] otherwise.
607880
607880
This way we can allow guests update sr[] registers as they want, without
607880
allowing them disrupt vbe video modes that way.
607880
607880
Cc: qemu-stable@nongnu.org
607880
Reported-by: Thomas Lamprecht <thomas@lamprecht.org>
607880
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
607880
Message-id: 1463475294-14119-1-git-send-email-kraxel@redhat.com
607880
(cherry picked from commit 94ef4f337fb614f18b765a8e0e878a4c23cdedcd)
607880
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
607880
607880
Conflicts:
607880
	hw/display/vga.c
607880
607880
[ RHEL-7 note: context differences in vga_update_memory_access ]
607880
---
607880
 hw/display/vga.c     | 50 ++++++++++++++++++++++++++++----------------------
607880
 hw/display/vga_int.h |  1 +
607880
 2 files changed, 29 insertions(+), 22 deletions(-)
607880
607880
diff --git a/hw/display/vga.c b/hw/display/vga.c
607880
index f049b26..4e3c3f3 100644
607880
--- a/hw/display/vga.c
607880
+++ b/hw/display/vga.c
607880
@@ -173,6 +173,11 @@ static inline bool vbe_enabled(VGACommonState *s)
607880
     return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED;
607880
 }
607880
 
607880
+static inline uint8_t sr(VGACommonState *s, int idx)
607880
+{
607880
+    return vbe_enabled(s) ? s->sr_vbe[idx] : s->sr[idx];
607880
+}
607880
+
607880
 static void vga_update_memory_access(VGACommonState *s)
607880
 {
607880
     MemoryRegion *region, *old_region = s->chain4_alias;
607880
@@ -180,8 +185,8 @@ static void vga_update_memory_access(VGACommonState *s)
607880
 
607880
     s->chain4_alias = NULL;
607880
 
607880
-    if ((s->sr[VGA_SEQ_PLANE_WRITE] & VGA_SR02_ALL_PLANES) ==
607880
-        VGA_SR02_ALL_PLANES && s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
607880
+    if ((sr(s, VGA_SEQ_PLANE_WRITE) & VGA_SR02_ALL_PLANES) ==
607880
+        VGA_SR02_ALL_PLANES && sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
607880
         offset = 0;
607880
         switch ((s->gr[VGA_GFX_MISC] >> 2) & 3) {
607880
         case 0:
607880
@@ -257,7 +262,7 @@ static void vga_precise_update_retrace_info(VGACommonState *s)
607880
           ((s->cr[VGA_CRTC_OVERFLOW] >> 6) & 2)) << 8);
607880
     vretr_end_line = s->cr[VGA_CRTC_V_SYNC_END] & 0xf;
607880
 
607880
-    clocking_mode = (s->sr[VGA_SEQ_CLOCK_MODE] >> 3) & 1;
607880
+    clocking_mode = (sr(s, VGA_SEQ_CLOCK_MODE) >> 3) & 1;
607880
     clock_sel = (s->msr >> 2) & 3;
607880
     dots = (s->msr & 1) ? 8 : 9;
607880
 
607880
@@ -513,7 +518,6 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
607880
         printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
607880
 #endif
607880
         s->sr[s->sr_index] = val & sr_mask[s->sr_index];
607880
-        vbe_update_vgaregs(s);
607880
         if (s->sr_index == VGA_SEQ_CLOCK_MODE) {
607880
             s->update_retrace_info(s);
607880
         }
607880
@@ -707,13 +711,13 @@ static void vbe_update_vgaregs(VGACommonState *s)
607880
 
607880
     if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) {
607880
         shift_control = 0;
607880
-        s->sr[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */
607880
+        s->sr_vbe[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */
607880
     } else {
607880
         shift_control = 2;
607880
         /* set chain 4 mode */
607880
-        s->sr[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M;
607880
+        s->sr_vbe[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M;
607880
         /* activate all planes */
607880
-        s->sr[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES;
607880
+        s->sr_vbe[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES;
607880
     }
607880
     s->gr[VGA_GFX_MODE] = (s->gr[VGA_GFX_MODE] & ~0x60) |
607880
         (shift_control << 5);
607880
@@ -863,7 +867,7 @@ uint32_t vga_mem_readb(VGACommonState *s, hwaddr addr)
607880
         break;
607880
     }
607880
 
607880
-    if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
607880
+    if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
607880
         /* chain 4 mode : simplest access */
607880
         assert(addr < s->vram_size);
607880
         ret = s->vram_ptr[addr];
607880
@@ -931,11 +935,11 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
607880
         break;
607880
     }
607880
 
607880
-    if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
607880
+    if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
607880
         /* chain 4 mode : simplest access */
607880
         plane = addr & 3;
607880
         mask = (1 << plane);
607880
-        if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) {
607880
+        if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
607880
             assert(addr < s->vram_size);
607880
             s->vram_ptr[addr] = val;
607880
 #ifdef DEBUG_VGA_MEM
607880
@@ -948,7 +952,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
607880
         /* odd/even mode (aka text mode mapping) */
607880
         plane = (s->gr[VGA_GFX_PLANE_READ] & 2) | (addr & 1);
607880
         mask = (1 << plane);
607880
-        if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) {
607880
+        if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
607880
             addr = ((addr & ~1) << 1) | plane;
607880
             if (addr >= s->vram_size) {
607880
                 return;
607880
@@ -1023,7 +1027,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
607880
 
607880
     do_write:
607880
         /* mask data according to sr[2] */
607880
-        mask = s->sr[VGA_SEQ_PLANE_WRITE];
607880
+        mask = sr(s, VGA_SEQ_PLANE_WRITE);
607880
         s->plane_updated |= mask; /* only used to detect font change */
607880
         write_mask = mask16[mask];
607880
         if (addr * sizeof(uint32_t) >= s->vram_size) {
607880
@@ -1314,10 +1318,10 @@ static void vga_get_text_resolution(VGACommonState *s, int *pwidth, int *pheight
607880
     /* total width & height */
607880
     cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
607880
     cwidth = 8;
607880
-    if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) {
607880
+    if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
607880
         cwidth = 9;
607880
     }
607880
-    if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) {
607880
+    if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
607880
         cwidth = 16; /* NOTE: no 18 pixel wide */
607880
     }
607880
     width = (s->cr[VGA_CRTC_H_DISP] + 1);
607880
@@ -1373,7 +1377,7 @@ static void vga_draw_text(VGACommonState *s, int full_update)
607880
     int64_t now = qemu_get_clock_ms(vm_clock);
607880
 
607880
     /* compute font data address (in plane 2) */
607880
-    v = s->sr[VGA_SEQ_CHARACTER_MAP];
607880
+    v = sr(s, VGA_SEQ_CHARACTER_MAP);
607880
     offset = (((v >> 4) & 1) | ((v << 1) & 6)) * 8192 * 4 + 2;
607880
     if (offset != s->font_offsets[0]) {
607880
         s->font_offsets[0] = offset;
607880
@@ -1744,11 +1748,11 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
607880
     }
607880
 
607880
     if (shift_control == 0) {
607880
-        if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
607880
+        if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
607880
             disp_width <<= 1;
607880
         }
607880
     } else if (shift_control == 1) {
607880
-        if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
607880
+        if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
607880
             disp_width <<= 1;
607880
         }
607880
     }
607880
@@ -1788,7 +1792,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
607880
 
607880
     if (shift_control == 0) {
607880
         full_update |= update_palette16(s);
607880
-        if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
607880
+        if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
607880
             v = VGA_DRAW_LINE4D2;
607880
         } else {
607880
             v = VGA_DRAW_LINE4;
607880
@@ -1796,7 +1800,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
607880
         bits = 4;
607880
     } else if (shift_control == 1) {
607880
         full_update |= update_palette16(s);
607880
-        if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
607880
+        if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
607880
             v = VGA_DRAW_LINE2D2;
607880
         } else {
607880
             v = VGA_DRAW_LINE2;
607880
@@ -1844,7 +1848,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
607880
 #if 0
607880
     printf("w=%d h=%d v=%d line_offset=%d cr[0x09]=0x%02x cr[0x17]=0x%02x linecmp=%d sr[0x01]=0x%02x\n",
607880
            width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE],
607880
-           s->line_compare, s->sr[VGA_SEQ_CLOCK_MODE]);
607880
+           s->line_compare, sr(s, VGA_SEQ_CLOCK_MODE));
607880
 #endif
607880
     addr1 = (s->start_addr * 4);
607880
     bwidth = (width * bits + 7) / 8;
607880
@@ -2003,6 +2007,7 @@ void vga_common_reset(VGACommonState *s)
607880
 {
607880
     s->sr_index = 0;
607880
     memset(s->sr, '\0', sizeof(s->sr));
607880
+    memset(s->sr_vbe, '\0', sizeof(s->sr_vbe));
607880
     s->gr_index = 0;
607880
     memset(s->gr, '\0', sizeof(s->gr));
607880
     s->ar_index = 0;
607880
@@ -2104,10 +2109,10 @@ static void vga_update_text(void *opaque, console_ch_t *chardata)
607880
         /* total width & height */
607880
         cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
607880
         cw = 8;
607880
-        if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) {
607880
+        if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
607880
             cw = 9;
607880
         }
607880
-        if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) {
607880
+        if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
607880
             cw = 16; /* NOTE: no 18 pixel wide */
607880
         }
607880
         width = (s->cr[VGA_CRTC_H_DISP] + 1);
607880
@@ -2273,6 +2278,7 @@ static int vga_common_post_load(void *opaque, int version_id)
607880
 
607880
     /* force refresh */
607880
     s->graphic_mode = -1;
607880
+    vbe_update_vgaregs(s);
607880
     return 0;
607880
 }
607880
 
607880
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
607880
index 5a2f466..7c758ac 100644
607880
--- a/hw/display/vga_int.h
607880
+++ b/hw/display/vga_int.h
607880
@@ -98,6 +98,7 @@ typedef struct VGACommonState {
607880
     MemoryRegion *chain4_alias;
607880
     uint8_t sr_index;
607880
     uint8_t sr[256];
607880
+    uint8_t sr_vbe[256];
607880
     uint8_t gr_index;
607880
     uint8_t gr[256];
607880
     uint8_t ar_index;
607880
-- 
607880
1.8.3.1
607880