* [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats @ 2018-10-08 18:50 Max Reitz 2018-10-08 18:54 ` Max Reitz ` (2 more replies) 0 siblings, 3 replies; 8+ messages in thread From: Max Reitz @ 2018-10-08 18:50 UTC (permalink / raw) To: qemu-devel; +Cc: Max Reitz, Gerd Hoffmann There are some 2D resource formats that can be used through virtio-gpu, but which are not supported by SDL2 when used for a scanout; these are all alpha-channel formats and also XBGR (RGBX in non-BE pixman). Add these formats in the switch converting pixman to SDL format constants so a guest cannot crash the VM by triggering the g_assert_not_reached() with an unsupported format. Signed-off-by: Max Reitz <mreitz@redhat.com> --- ui/sdl2-2d.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ui/sdl2-2d.c b/ui/sdl2-2d.c index 85484407be..c9df72636a 100644 --- a/ui/sdl2-2d.c +++ b/ui/sdl2-2d.c @@ -101,15 +101,24 @@ void sdl2_2d_switch(DisplayChangeListener *dcl, case PIXMAN_r5g6b5: format = SDL_PIXELFORMAT_RGB565; break; + case PIXMAN_a8r8g8b8: case PIXMAN_x8r8g8b8: format = SDL_PIXELFORMAT_ARGB8888; break; + case PIXMAN_a8b8g8r8: + case PIXMAN_x8b8g8r8: + format = SDL_PIXELFORMAT_ABGR8888; + break; + case PIXMAN_r8g8b8a8: case PIXMAN_r8g8b8x8: format = SDL_PIXELFORMAT_RGBA8888; break; case PIXMAN_b8g8r8x8: format = SDL_PIXELFORMAT_BGRX8888; break; + case PIXMAN_b8g8r8a8: + format = SDL_PIXELFORMAT_BGRA8888; + break; default: g_assert_not_reached(); } -- 2.17.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats 2018-10-08 18:50 [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats Max Reitz @ 2018-10-08 18:54 ` Max Reitz 2018-10-10 10:10 ` Gerd Hoffmann 2018-10-12 12:48 ` Gerd Hoffmann 2 siblings, 0 replies; 8+ messages in thread From: Max Reitz @ 2018-10-08 18:54 UTC (permalink / raw) To: qemu-devel; +Cc: Gerd Hoffmann [-- Attachment #1: Type: text/plain, Size: 1627 bytes --] On 08.10.18 20:50, Max Reitz wrote: > There are some 2D resource formats that can be used through virtio-gpu, > but which are not supported by SDL2 when used for a scanout; these are > all alpha-channel formats and also XBGR (RGBX in non-BE pixman). Oops, it's the other way round. The virtio-gpu format is RGBX, and the non-BE pixman (and SDL) constant is XBGR. Max > Add these formats in the switch converting pixman to SDL format > constants so a guest cannot crash the VM by triggering the > g_assert_not_reached() with an unsupported format. > > Signed-off-by: Max Reitz <mreitz@redhat.com> > --- > ui/sdl2-2d.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/ui/sdl2-2d.c b/ui/sdl2-2d.c > index 85484407be..c9df72636a 100644 > --- a/ui/sdl2-2d.c > +++ b/ui/sdl2-2d.c > @@ -101,15 +101,24 @@ void sdl2_2d_switch(DisplayChangeListener *dcl, > case PIXMAN_r5g6b5: > format = SDL_PIXELFORMAT_RGB565; > break; > + case PIXMAN_a8r8g8b8: > case PIXMAN_x8r8g8b8: > format = SDL_PIXELFORMAT_ARGB8888; > break; > + case PIXMAN_a8b8g8r8: > + case PIXMAN_x8b8g8r8: > + format = SDL_PIXELFORMAT_ABGR8888; > + break; > + case PIXMAN_r8g8b8a8: > case PIXMAN_r8g8b8x8: > format = SDL_PIXELFORMAT_RGBA8888; > break; > case PIXMAN_b8g8r8x8: > format = SDL_PIXELFORMAT_BGRX8888; > break; > + case PIXMAN_b8g8r8a8: > + format = SDL_PIXELFORMAT_BGRA8888; > + break; > default: > g_assert_not_reached(); > } > [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats 2018-10-08 18:50 [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats Max Reitz 2018-10-08 18:54 ` Max Reitz @ 2018-10-10 10:10 ` Gerd Hoffmann 2018-10-10 17:35 ` Max Reitz 2018-10-12 12:48 ` Gerd Hoffmann 2 siblings, 1 reply; 8+ messages in thread From: Gerd Hoffmann @ 2018-10-10 10:10 UTC (permalink / raw) To: Max Reitz; +Cc: qemu-devel On Mon, Oct 08, 2018 at 08:50:13PM +0200, Max Reitz wrote: > There are some 2D resource formats that can be used through virtio-gpu, Ahem, not really. XRGB is the only one which works in practice, and virtio-gpu kms driver will stop advertising anything else soon (patches should land upstream with the next merge window). > Add these formats in the switch converting pixman to SDL format > constants so a guest cannot crash the VM by triggering the > g_assert_not_reached() with an unsupported format. Do you have a reproducer for that? There is sdl2_2d_check_format() which reports the supported formats. If we hit sdl2_2d_switch() with a format not whitelisted by sdl2_2d_check_format() we have a bug somewhere in qemu ... cheers, Gerd ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats 2018-10-10 10:10 ` Gerd Hoffmann @ 2018-10-10 17:35 ` Max Reitz 2018-10-10 17:53 ` Max Reitz 2018-10-11 7:45 ` Gerd Hoffmann 0 siblings, 2 replies; 8+ messages in thread From: Max Reitz @ 2018-10-10 17:35 UTC (permalink / raw) To: Gerd Hoffmann; +Cc: qemu-devel [-- Attachment #1: Type: text/plain, Size: 2124 bytes --] On 10.10.18 12:10, Gerd Hoffmann wrote: > On Mon, Oct 08, 2018 at 08:50:13PM +0200, Max Reitz wrote: >> There are some 2D resource formats that can be used through virtio-gpu, > > Ahem, not really. XRGB is the only one which works in practice, and > virtio-gpu kms driver will stop advertising anything else soon (patches > should land upstream with the next merge window). OK, if virtio-gpu didn't support anything else, that'd be a fix, too. But it sounds like you're talking about the Linux driver, I'm not. This is not about Linux applications being able to abuse the Linux driver to crash the VM, this is about malicious drivers (not necessarily Linux drivers). >> Add these formats in the switch converting pixman to SDL format >> constants so a guest cannot crash the VM by triggering the >> g_assert_not_reached() with an unsupported format. > > Do you have a reproducer for that? I have attached two RISC-V kernels, one (kernel-rgbx) setting VIRTIO_GPU_FORMAT_R8G8B8X8_UNORM, the other (kernel-bgra) setting VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM. Both crash qemu: $ $QEMU/build/riscv64-softmmu/qemu-system-riscv64 -kernel kernel-rgbx \ -serial stdio -M virt -device virtio-gpu-device [platform-virt] Virt platform detected [virtio-gpu] Found device @0x10008000 [virtio-gpu] Scanout 0: 0x0:1024x768 ** ERROR:$QEMU/ui/sdl2-2d.c:114:sdl2_2d_switch: code should not be reached [1] 7151 abort (core dumped) So this is not about a misbehaving Linux driver but about an own driver. Of course, if you can insert kernel code, there's noone stopping you from hitting that assertion with Linux, too. > There is sdl2_2d_check_format() which reports the supported formats. > If we hit sdl2_2d_switch() with a format not whitelisted by > sdl2_2d_check_format() we have a bug somewhere in qemu ... I suppose the other solution would be for virtio_gpu_set_scanout() to check whether the resource's format can actually be used for that display. Or in virtio_gpu_resource_create_2d(), I don't know whether it's possible to use resources in other formats at all. Max [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats 2018-10-10 17:35 ` Max Reitz @ 2018-10-10 17:53 ` Max Reitz 2018-10-11 7:45 ` Gerd Hoffmann 1 sibling, 0 replies; 8+ messages in thread From: Max Reitz @ 2018-10-10 17:53 UTC (permalink / raw) To: Gerd Hoffmann; +Cc: qemu-devel [-- Attachment #1.1: Type: text/plain, Size: 2266 bytes --] On 10.10.18 19:35, Max Reitz wrote: > On 10.10.18 12:10, Gerd Hoffmann wrote: >> On Mon, Oct 08, 2018 at 08:50:13PM +0200, Max Reitz wrote: >>> There are some 2D resource formats that can be used through virtio-gpu, >> >> Ahem, not really. XRGB is the only one which works in practice, and >> virtio-gpu kms driver will stop advertising anything else soon (patches >> should land upstream with the next merge window). > > OK, if virtio-gpu didn't support anything else, that'd be a fix, too. > But it sounds like you're talking about the Linux driver, I'm not. > > This is not about Linux applications being able to abuse the Linux > driver to crash the VM, this is about malicious drivers (not necessarily > Linux drivers). > >>> Add these formats in the switch converting pixman to SDL format >>> constants so a guest cannot crash the VM by triggering the >>> g_assert_not_reached() with an unsupported format. >> >> Do you have a reproducer for that? > > I have attached two RISC-V kernels, one (kernel-rgbx) setting > VIRTIO_GPU_FORMAT_R8G8B8X8_UNORM, the other (kernel-bgra) setting > VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM. Both crash qemu: Of course I hadn't. > $ $QEMU/build/riscv64-softmmu/qemu-system-riscv64 -kernel kernel-rgbx \ > -serial stdio -M virt -device virtio-gpu-device > [platform-virt] Virt platform detected > [virtio-gpu] Found device @0x10008000 > [virtio-gpu] Scanout 0: 0x0:1024x768 > ** > ERROR:$QEMU/ui/sdl2-2d.c:114:sdl2_2d_switch: code should not be reached > [1] 7151 abort (core dumped) > > So this is not about a misbehaving Linux driver but about an own driver. > Of course, if you can insert kernel code, there's noone stopping you > from hitting that assertion with Linux, too. > >> There is sdl2_2d_check_format() which reports the supported formats. >> If we hit sdl2_2d_switch() with a format not whitelisted by >> sdl2_2d_check_format() we have a bug somewhere in qemu ... > > I suppose the other solution would be for virtio_gpu_set_scanout() to > check whether the resource's format can actually be used for that > display. Or in virtio_gpu_resource_create_2d(), I don't know whether > it's possible to use resources in other formats at all. > > Max > [-- Attachment #1.2: kernel-rgbx.xz --] [-- Type: application/x-xz, Size: 16592 bytes --] [-- Attachment #1.3: kernel-bgra.xz --] [-- Type: application/x-xz, Size: 16612 bytes --] [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats 2018-10-10 17:35 ` Max Reitz 2018-10-10 17:53 ` Max Reitz @ 2018-10-11 7:45 ` Gerd Hoffmann 1 sibling, 0 replies; 8+ messages in thread From: Gerd Hoffmann @ 2018-10-11 7:45 UTC (permalink / raw) To: Max Reitz; +Cc: qemu-devel On Wed, Oct 10, 2018 at 07:35:06PM +0200, Max Reitz wrote: > On 10.10.18 12:10, Gerd Hoffmann wrote: > > On Mon, Oct 08, 2018 at 08:50:13PM +0200, Max Reitz wrote: > >> There are some 2D resource formats that can be used through virtio-gpu, > > > > Ahem, not really. XRGB is the only one which works in practice, and > > virtio-gpu kms driver will stop advertising anything else soon (patches > > should land upstream with the next merge window). > > OK, if virtio-gpu didn't support anything else, that'd be a fix, too. > But it sounds like you're talking about the Linux driver, I'm not. > > This is not about Linux applications being able to abuse the Linux > driver to crash the VM, this is about malicious drivers (not necessarily > Linux drivers). > > >> Add these formats in the switch converting pixman to SDL format > >> constants so a guest cannot crash the VM by triggering the > >> g_assert_not_reached() with an unsupported format. > > > > Do you have a reproducer for that? > > I have attached two RISC-V kernels, one (kernel-rgbx) setting > VIRTIO_GPU_FORMAT_R8G8B8X8_UNORM, the other (kernel-bgra) setting > VIRTIO_GPU_FORMAT_B8G8R8A8_UNORM. Both crash qemu: > > $ $QEMU/build/riscv64-softmmu/qemu-system-riscv64 -kernel kernel-rgbx \ > -serial stdio -M virt -device virtio-gpu-device > [platform-virt] Virt platform detected > [virtio-gpu] Found device @0x10008000 > [virtio-gpu] Scanout 0: 0x0:1024x768 > ** > ERROR:$QEMU/ui/sdl2-2d.c:114:sdl2_2d_switch: code should not be reached > [1] 7151 abort (core dumped) Ok, I see. If sdl2 can support those formats it makes sense to support them, but they must be added to both sdl2_2d_check_format() and sdl2_2d_switch() then. > > There is sdl2_2d_check_format() which reports the supported formats. > > If we hit sdl2_2d_switch() with a format not whitelisted by > > sdl2_2d_check_format() we have a bug somewhere in qemu ... > > I suppose the other solution would be for virtio_gpu_set_scanout() to > check whether the resource's format can actually be used for that > display. Yes, that must be added (independent from the sdl2 patch). > Or in virtio_gpu_resource_create_2d(), I don't know whether > it's possible to use resources in other formats at all. Not directly, they must be converted (using pixman) then. cheers, Gerd ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats 2018-10-08 18:50 [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats Max Reitz 2018-10-08 18:54 ` Max Reitz 2018-10-10 10:10 ` Gerd Hoffmann @ 2018-10-12 12:48 ` Gerd Hoffmann 2018-10-12 13:33 ` Max Reitz 2 siblings, 1 reply; 8+ messages in thread From: Gerd Hoffmann @ 2018-10-12 12:48 UTC (permalink / raw) To: Max Reitz; +Cc: qemu-devel On Mon, Oct 08, 2018 at 08:50:13PM +0200, Max Reitz wrote: > There are some 2D resource formats that can be used through virtio-gpu, > but which are not supported by SDL2 when used for a scanout; these are > all alpha-channel formats and also XBGR (RGBX in non-BE pixman). > > Add these formats in the switch converting pixman to SDL format > constants so a guest cannot crash the VM by triggering the > g_assert_not_reached() with an unsupported format. fixed (sdl2_2d_check_format update) & queued. cheers, Gerd ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats 2018-10-12 12:48 ` Gerd Hoffmann @ 2018-10-12 13:33 ` Max Reitz 0 siblings, 0 replies; 8+ messages in thread From: Max Reitz @ 2018-10-12 13:33 UTC (permalink / raw) To: Gerd Hoffmann; +Cc: qemu-devel [-- Attachment #1: Type: text/plain, Size: 586 bytes --] On 12.10.18 14:48, Gerd Hoffmann wrote: > On Mon, Oct 08, 2018 at 08:50:13PM +0200, Max Reitz wrote: >> There are some 2D resource formats that can be used through virtio-gpu, >> but which are not supported by SDL2 when used for a scanout; these are >> all alpha-channel formats and also XBGR (RGBX in non-BE pixman). >> >> Add these formats in the switch converting pixman to SDL format >> constants so a guest cannot crash the VM by triggering the >> g_assert_not_reached() with an unsupported format. > > fixed (sdl2_2d_check_format update) & queued. Thanks! Max [-- Attachment #2: OpenPGP digital signature --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2018-10-12 13:33 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2018-10-08 18:50 [Qemu-devel] [PATCH] sdl2: Support all virtio-gpu formats Max Reitz 2018-10-08 18:54 ` Max Reitz 2018-10-10 10:10 ` Gerd Hoffmann 2018-10-10 17:35 ` Max Reitz 2018-10-10 17:53 ` Max Reitz 2018-10-11 7:45 ` Gerd Hoffmann 2018-10-12 12:48 ` Gerd Hoffmann 2018-10-12 13:33 ` Max Reitz
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.