Blame SOURCES/kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch

9ae3a8
From 3c18025a495a2c105c2c33051ece0f3525d1e0c4 Mon Sep 17 00:00:00 2001
9ae3a8
From: Gerd Hoffmann <kraxel@redhat.com>
9ae3a8
Date: Thu, 28 Apr 2016 16:07:32 +0200
9ae3a8
Subject: [PATCH 27/27] vga: make sure vga register setup for vbe stays intact.
9ae3a8
9ae3a8
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
9ae3a8
Message-id: <1461859652-20918-7-git-send-email-kraxel@redhat.com>
9ae3a8
Patchwork-id: 70297
9ae3a8
O-Subject: [virt-devel] [RHEL-7.3 qemu-kvm PATCH 6/6] vga: make sure vga register setup for vbe stays intact.
9ae3a8
Bugzilla: 1331413
9ae3a8
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
9ae3a8
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
9ae3a8
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
9ae3a8
9ae3a8
Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT
9ae3a8
registers, to make sure the vga registers will always have the
9ae3a8
values needed by vbe mode.  This makes sure the sanity checks
9ae3a8
applied by vbe_fixup_regs() are effective.
9ae3a8
9ae3a8
Without this guests can muck with shift_control, can turn on planar
9ae3a8
vga modes or text mode emulation while VBE is active, making qemu
9ae3a8
take code paths meant for CGA compatibility, but with the very
9ae3a8
large display widths and heigts settable using VBE registers.
9ae3a8
9ae3a8
Which is good for one or another buffer overflow.  Not that
9ae3a8
critical as they typically read overflows happening somewhere
9ae3a8
in the display code.  So guests can DoS by crashing qemu with a
9ae3a8
segfault, but it is probably not possible to break out of the VM.
9ae3a8
9ae3a8
Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
9ae3a8
Reported-by: P J P <ppandit@redhat.com>
9ae3a8
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
9ae3a8
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
9ae3a8
---
9ae3a8
 hw/display/vga.c | 6 ++++++
9ae3a8
 1 file changed, 6 insertions(+)
9ae3a8
9ae3a8
diff --git a/hw/display/vga.c b/hw/display/vga.c
9ae3a8
index ee3c0c0..f049b26 100644
9ae3a8
--- a/hw/display/vga.c
9ae3a8
+++ b/hw/display/vga.c
9ae3a8
@@ -166,6 +166,8 @@ static uint32_t expand4[256];
9ae3a8
 static uint16_t expand2[256];
9ae3a8
 static uint8_t expand4to8[16];
9ae3a8
 
9ae3a8
+static void vbe_update_vgaregs(VGACommonState *s);
9ae3a8
+
9ae3a8
 static inline bool vbe_enabled(VGACommonState *s)
9ae3a8
 {
9ae3a8
     return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED;
9ae3a8
@@ -511,6 +513,7 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
9ae3a8
         printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
9ae3a8
 #endif
9ae3a8
         s->sr[s->sr_index] = val & sr_mask[s->sr_index];
9ae3a8
+        vbe_update_vgaregs(s);
9ae3a8
         if (s->sr_index == VGA_SEQ_CLOCK_MODE) {
9ae3a8
             s->update_retrace_info(s);
9ae3a8
         }
9ae3a8
@@ -542,6 +545,7 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
9ae3a8
         printf("vga: write GR%x = 0x%02x\n", s->gr_index, val);
9ae3a8
 #endif
9ae3a8
         s->gr[s->gr_index] = val & gr_mask[s->gr_index];
9ae3a8
+        vbe_update_vgaregs(s);
9ae3a8
         vga_update_memory_access(s);
9ae3a8
         break;
9ae3a8
     case VGA_CRT_IM:
9ae3a8
@@ -560,10 +564,12 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
9ae3a8
             if (s->cr_index == VGA_CRTC_OVERFLOW) {
9ae3a8
                 s->cr[VGA_CRTC_OVERFLOW] = (s->cr[VGA_CRTC_OVERFLOW] & ~0x10) |
9ae3a8
                     (val & 0x10);
9ae3a8
+                vbe_update_vgaregs(s);
9ae3a8
             }
9ae3a8
             return;
9ae3a8
         }
9ae3a8
         s->cr[s->cr_index] = val;
9ae3a8
+        vbe_update_vgaregs(s);
9ae3a8
 
9ae3a8
         switch(s->cr_index) {
9ae3a8
         case VGA_CRTC_H_TOTAL:
9ae3a8
-- 
9ae3a8
1.8.3.1
9ae3a8