From: Leonid Shatz <leonid.sh...@oracle.com>
We parse the command structure, but ignore the hint given by command.
Without doing so, command FIFO could get out of sync and cause
vmware-svga device to hang.
>From Linux kernel drivers/gpu/drm/vmwgfx/device_include/svga_reg.h:
/*
* SVGA_CMD_FRONT_ROP_FILL --
*
* This is a hint which tells the SVGA device that the driver has
* just filled a rectangular region of the GFB with a solid
* color. Instead of reading these pixels from the GFB, the device
* can assume that they all equal 'color'. This is primarily used
* for remote desktop protocols.
*
* Availability:
* SVGA_FIFO_CAP_ACCELFRONT
*/
typedef
struct {
uint32 color; /* In the same format as the GFB */
uint32 x;
uint32 y;
uint32 width;
uint32 height;
uint32 rop; /* Must be SVGA_ROP_COPY */
}
SVGAFifoCmdFrontRopFill;
Signed-off-by: Leonid Shatz <leonid.sh...@oracle.com>
Reviewed-by: Darren Kenny <darren.ke...@oracle.com>
Signed-off-by: Liran Alon <liran.a...@oracle.com>
---
hw/display/vmware_vga.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
index d3a78809673d..fab6443a87e2 100644
--- a/hw/display/vmware_vga.c
+++ b/hw/display/vmware_vga.c
@@ -693,6 +693,14 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
goto badcmd;
#endif
+ case SVGA_CMD_FRONT_ROP_FILL:
+ len -= 1;
+ if (len < 0) {
+ goto rewind;
+ }
+ args = 6;
+ goto ignoredcmd;
+
/*
* Deprecated commands are neither documented in VMware SVGA
development kit
* nor in Linux kernel vmware-svga driver source code.
@@ -759,7 +767,6 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
*/
case SVGA_CMD_SURFACE_FILL:
case SVGA_CMD_SURFACE_COPY:
- case SVGA_CMD_FRONT_ROP_FILL:
case SVGA_CMD_FENCE:
case SVGA_CMD_INVALID_CMD:
break; /* Nop */
--
1.9.1
