[pve-devel] [PATCH kvm] add fix for freezing win7 with VGA #991
Thomas Lamprecht
t.lamprecht at proxmox.com
Tue May 17 12:38:04 CEST 2016
This fixes the issue for SeaBIOS, UEFI (OVMF) still has problems.
Signed-off-by: Thomas Lamprecht <t.lamprecht at proxmox.com>
---
.../extra/0001-vga-add-sr_vbe-register-set.patch | 234 +++++++++++++++++++++
debian/patches/series | 1 +
2 files changed, 235 insertions(+)
create mode 100644 debian/patches/extra/0001-vga-add-sr_vbe-register-set.patch
diff --git a/debian/patches/extra/0001-vga-add-sr_vbe-register-set.patch b/debian/patches/extra/0001-vga-add-sr_vbe-register-set.patch
new file mode 100644
index 0000000..483e968
--- /dev/null
+++ b/debian/patches/extra/0001-vga-add-sr_vbe-register-set.patch
@@ -0,0 +1,234 @@
+From 838ff135013302a85478ec3dd96d8ad985d1f01d Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel at redhat.com>
+Date: Tue, 17 May 2016 10:54:54 +0200
+Subject: [PATCH] vga: add sr_vbe register set
+
+Commit "fd3c136 vga: make sure vga register setup for vbe stays intact
+(CVE-2016-3712)." causes a regression. The win7 installer is unhappy
+because it can't freely modify vga registers any more while in vbe mode.
+
+This patch introduces a new sr_vbe register set. The vbe_update_vgaregs
+will fill sr_vbe[] instead of sr[]. Normal vga register reads and
+writes go to sr[]. Any sr register read access happens through a new
+sr() helper function which will read from sr_vbe[] with vbe active and
+from sr[] otherwise.
+
+This way we can allow guests update sr[] registers as they want, without
+allowing them disrupt vbe video modes that way.
+
+Reported-by: Thomas Lamprecht <thomas at lamprecht.org>
+Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
+---
+ hw/display/vga.c | 50 ++++++++++++++++++++++++++++----------------------
+ hw/display/vga_int.h | 1 +
+ 2 files changed, 29 insertions(+), 22 deletions(-)
+
+diff --git a/hw/display/vga.c b/hw/display/vga.c
+index 679070e..25d8bff 100644
+--- a/hw/display/vga.c
++++ b/hw/display/vga.c
+@@ -147,6 +147,11 @@ static inline bool vbe_enabled(VGACommonState *s)
+ return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED;
+ }
+
++static inline uint8_t sr(VGACommonState *s, int idx)
++{
++ return vbe_enabled(s) ? s->sr_vbe[idx] : s->sr[idx];
++}
++
+ static void vga_update_memory_access(VGACommonState *s)
+ {
+ hwaddr base, offset, size;
+@@ -161,8 +166,8 @@ static void vga_update_memory_access(VGACommonState *s)
+ s->has_chain4_alias = false;
+ s->plane_updated = 0xf;
+ }
+- if ((s->sr[VGA_SEQ_PLANE_WRITE] & VGA_SR02_ALL_PLANES) ==
+- VGA_SR02_ALL_PLANES && s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
++ if ((sr(s, VGA_SEQ_PLANE_WRITE) & VGA_SR02_ALL_PLANES) ==
++ VGA_SR02_ALL_PLANES && sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
+ offset = 0;
+ switch ((s->gr[VGA_GFX_MISC] >> 2) & 3) {
+ case 0:
+@@ -232,7 +237,7 @@ static void vga_precise_update_retrace_info(VGACommonState *s)
+ ((s->cr[VGA_CRTC_OVERFLOW] >> 6) & 2)) << 8);
+ vretr_end_line = s->cr[VGA_CRTC_V_SYNC_END] & 0xf;
+
+- clocking_mode = (s->sr[VGA_SEQ_CLOCK_MODE] >> 3) & 1;
++ clocking_mode = (sr(s, VGA_SEQ_CLOCK_MODE) >> 3) & 1;
+ clock_sel = (s->msr >> 2) & 3;
+ dots = (s->msr & 1) ? 8 : 9;
+
+@@ -484,7 +489,6 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val)
+ printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
+ #endif
+ s->sr[s->sr_index] = val & sr_mask[s->sr_index];
+- vbe_update_vgaregs(s);
+ if (s->sr_index == VGA_SEQ_CLOCK_MODE) {
+ s->update_retrace_info(s);
+ }
+@@ -678,13 +682,13 @@ static void vbe_update_vgaregs(VGACommonState *s)
+
+ if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) {
+ shift_control = 0;
+- s->sr[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */
++ s->sr_vbe[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */
+ } else {
+ shift_control = 2;
+ /* set chain 4 mode */
+- s->sr[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M;
++ s->sr_vbe[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M;
+ /* activate all planes */
+- s->sr[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES;
++ s->sr_vbe[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES;
+ }
+ s->gr[VGA_GFX_MODE] = (s->gr[VGA_GFX_MODE] & ~0x60) |
+ (shift_control << 5);
+@@ -834,7 +838,7 @@ uint32_t vga_mem_readb(VGACommonState *s, hwaddr addr)
+ break;
+ }
+
+- if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
++ if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
+ /* chain 4 mode : simplest access */
+ assert(addr < s->vram_size);
+ ret = s->vram_ptr[addr];
+@@ -902,11 +906,11 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
+ break;
+ }
+
+- if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) {
++ if (sr(s, VGA_SEQ_MEMORY_MODE) & VGA_SR04_CHN_4M) {
+ /* chain 4 mode : simplest access */
+ plane = addr & 3;
+ mask = (1 << plane);
+- if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) {
++ if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
+ assert(addr < s->vram_size);
+ s->vram_ptr[addr] = val;
+ #ifdef DEBUG_VGA_MEM
+@@ -919,7 +923,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
+ /* odd/even mode (aka text mode mapping) */
+ plane = (s->gr[VGA_GFX_PLANE_READ] & 2) | (addr & 1);
+ mask = (1 << plane);
+- if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) {
++ if (sr(s, VGA_SEQ_PLANE_WRITE) & mask) {
+ addr = ((addr & ~1) << 1) | plane;
+ if (addr >= s->vram_size) {
+ return;
+@@ -994,7 +998,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
+
+ do_write:
+ /* mask data according to sr[2] */
+- mask = s->sr[VGA_SEQ_PLANE_WRITE];
++ mask = sr(s, VGA_SEQ_PLANE_WRITE);
+ s->plane_updated |= mask; /* only used to detect font change */
+ write_mask = mask16[mask];
+ if (addr * sizeof(uint32_t) >= s->vram_size) {
+@@ -1150,10 +1154,10 @@ static void vga_get_text_resolution(VGACommonState *s, int *pwidth, int *pheight
+ /* total width & height */
+ cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
+ cwidth = 8;
+- if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) {
++ if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
+ cwidth = 9;
+ }
+- if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) {
++ if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
+ cwidth = 16; /* NOTE: no 18 pixel wide */
+ }
+ width = (s->cr[VGA_CRTC_H_DISP] + 1);
+@@ -1195,7 +1199,7 @@ static void vga_draw_text(VGACommonState *s, int full_update)
+ int64_t now = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
+
+ /* compute font data address (in plane 2) */
+- v = s->sr[VGA_SEQ_CHARACTER_MAP];
++ v = sr(s, VGA_SEQ_CHARACTER_MAP);
+ offset = (((v >> 4) & 1) | ((v << 1) & 6)) * 8192 * 4 + 2;
+ if (offset != s->font_offsets[0]) {
+ s->font_offsets[0] = offset;
+@@ -1504,11 +1508,11 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
+ }
+
+ if (shift_control == 0) {
+- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
++ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
+ disp_width <<= 1;
+ }
+ } else if (shift_control == 1) {
+- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
++ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
+ disp_width <<= 1;
+ }
+ }
+@@ -1572,7 +1576,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
+
+ if (shift_control == 0) {
+ full_update |= update_palette16(s);
+- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
++ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
+ v = VGA_DRAW_LINE4D2;
+ } else {
+ v = VGA_DRAW_LINE4;
+@@ -1580,7 +1584,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
+ bits = 4;
+ } else if (shift_control == 1) {
+ full_update |= update_palette16(s);
+- if (s->sr[VGA_SEQ_CLOCK_MODE] & 8) {
++ if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
+ v = VGA_DRAW_LINE2D2;
+ } else {
+ v = VGA_DRAW_LINE2;
+@@ -1627,7 +1631,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
+ #if 0
+ printf("w=%d h=%d v=%d line_offset=%d cr[0x09]=0x%02x cr[0x17]=0x%02x linecmp=%d sr[0x01]=0x%02x\n",
+ width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE],
+- s->line_compare, s->sr[VGA_SEQ_CLOCK_MODE]);
++ s->line_compare, sr(s, VGA_SEQ_CLOCK_MODE));
+ #endif
+ addr1 = (s->start_addr * 4);
+ bwidth = (width * bits + 7) / 8;
+@@ -1779,6 +1783,7 @@ void vga_common_reset(VGACommonState *s)
+ {
+ s->sr_index = 0;
+ memset(s->sr, '\0', sizeof(s->sr));
++ memset(s->sr_vbe, '\0', sizeof(s->sr_vbe));
+ s->gr_index = 0;
+ memset(s->gr, '\0', sizeof(s->gr));
+ s->ar_index = 0;
+@@ -1881,10 +1886,10 @@ static void vga_update_text(void *opaque, console_ch_t *chardata)
+ /* total width & height */
+ cheight = (s->cr[VGA_CRTC_MAX_SCAN] & 0x1f) + 1;
+ cw = 8;
+- if (!(s->sr[VGA_SEQ_CLOCK_MODE] & VGA_SR01_CHAR_CLK_8DOTS)) {
++ if (!(sr(s, VGA_SEQ_CLOCK_MODE) & VGA_SR01_CHAR_CLK_8DOTS)) {
+ cw = 9;
+ }
+- if (s->sr[VGA_SEQ_CLOCK_MODE] & 0x08) {
++ if (sr(s, VGA_SEQ_CLOCK_MODE) & 0x08) {
+ cw = 16; /* NOTE: no 18 pixel wide */
+ }
+ width = (s->cr[VGA_CRTC_H_DISP] + 1);
+@@ -2050,6 +2055,7 @@ static int vga_common_post_load(void *opaque, int version_id)
+
+ /* force refresh */
+ s->graphic_mode = -1;
++ vbe_update_vgaregs(s);
+ return 0;
+ }
+
+diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
+index 40ba6a4..103cac2 100644
+--- a/hw/display/vga_int.h
++++ b/hw/display/vga_int.h
+@@ -99,6 +99,7 @@ typedef struct VGACommonState {
+ MemoryRegion chain4_alias;
+ uint8_t sr_index;
+ uint8_t sr[256];
++ uint8_t sr_vbe[256];
+ uint8_t gr_index;
+ uint8_t gr[256];
+ uint8_t ar_index;
+--
+2.1.4
+
diff --git a/debian/patches/series b/debian/patches/series
index bf17da7..6d0d70b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -53,3 +53,4 @@ extra/CVE-2016-2858-0004-rng-add-request-queue-support-to-rng-random.patch
extra/0005-virtio-rng-ask-for-more-data-if-queue-is-not-fully-d.patch
extra/0001-target-i386-do-not-read-write-MSR_TSC_AUX-from-KVM-i.patch
extra/0001-i386-kvmvapic-initialise-imm32-variable.patch
+extra/0001-vga-add-sr_vbe-register-set.patch
--
2.1.4
More information about the pve-devel
mailing list