From 5e08a5888907be658dfaaa29f2948f19bd16fdd6 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 28 Feb 2013 15:03:04 +0100
Subject: [PATCH] console: rework DisplaySurface handling [dcl/ui side]

Replace the dpy_gfx_resize and dpy_gfx_setdata DisplayChangeListener
callbacks with a dpy_gfx_switch callback which notifies the ui code
when the framebuffer backing storage changes.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit c12aeb860c63ba83190f962e2f0a1c5fe18ad3a6)
[BR: BSC#1026612 CVE-2017-2633 (infrastructure patch)]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 hw/qxl.c                   |  9 +++++----
 include/ui/console.h       |  7 +++----
 include/ui/spice-display.h |  3 ++-
 ui/cocoa.m                 | 13 ++++---------
 ui/console.c               |  8 ++++----
 ui/sdl.c                   | 10 +++++-----
 ui/spice-display.c         | 12 +++++++-----
 ui/vnc.c                   | 21 +++++----------------
 8 files changed, 35 insertions(+), 48 deletions(-)

diff --git a/hw/qxl.c b/hw/qxl.c
index 77bb3706c7..5533c52431 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -1875,11 +1875,12 @@ static void display_update(DisplayChangeListener *dcl,
     }
 }
 
-static void display_resize(DisplayChangeListener *dcl,
-                           struct DisplayState *ds)
+static void display_switch(DisplayChangeListener *dcl,
+                           struct DisplayState *ds,
+                           struct DisplaySurface *surface)
 {
     if (qxl0->mode == QXL_MODE_VGA) {
-        qemu_spice_display_resize(&qxl0->ssd);
+        qemu_spice_display_switch(&qxl0->ssd, surface);
     }
 }
 
@@ -1898,7 +1899,7 @@ static void display_refresh(DisplayChangeListener *dcl,
 static DisplayChangeListenerOps display_listener_ops = {
     .dpy_name        = "spice/qxl",
     .dpy_gfx_update  = display_update,
-    .dpy_gfx_resize  = display_resize,
+    .dpy_gfx_switch  = display_switch,
     .dpy_refresh     = display_refresh,
 };
 
diff --git a/include/ui/console.h b/include/ui/console.h
index 4cd0109f6e..bdcfb707d6 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -156,10 +156,9 @@ typedef struct DisplayChangeListenerOps {
     void (*dpy_gfx_update)(DisplayChangeListener *dcl,
                            struct DisplayState *s,
                            int x, int y, int w, int h);
-    void (*dpy_gfx_resize)(DisplayChangeListener *dcl,
-                           struct DisplayState *s);
-    void (*dpy_gfx_setdata)(DisplayChangeListener *dcl,
-                            struct DisplayState *s);
+    void (*dpy_gfx_switch)(DisplayChangeListener *dcl,
+                           struct DisplayState *s,
+                           struct DisplaySurface *new_surface);
     void (*dpy_text_cursor)(DisplayChangeListener *dcl,
                             struct DisplayState *s,
                             int x, int y);
diff --git a/include/ui/spice-display.h b/include/ui/spice-display.h
index f2752aa25a..82f8246650 100644
--- a/include/ui/spice-display.h
+++ b/include/ui/spice-display.h
@@ -117,7 +117,8 @@ void qemu_spice_display_init_common(SimpleSpiceDisplay *ssd, DisplayState *ds);
 
 void qemu_spice_display_update(SimpleSpiceDisplay *ssd,
                                int x, int y, int w, int h);
-void qemu_spice_display_resize(SimpleSpiceDisplay *ssd);
+void qemu_spice_display_switch(SimpleSpiceDisplay *ssd,
+                               DisplaySurface *surface);
 void qemu_spice_display_refresh(SimpleSpiceDisplay *ssd);
 void qemu_spice_cursor_refresh_unlocked(SimpleSpiceDisplay *ssd);
 
diff --git a/ui/cocoa.m b/ui/cocoa.m
index b1fb30e7f9..73843f447c 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -988,8 +988,9 @@ static void cocoa_update(DisplayChangeListener *dcl,
     [cocoaView setNeedsDisplayInRect:rect];
 }
 
-static void cocoa_resize(DisplayChangeListener *dcl,
-                         DisplayState *ds)
+static void cocoa_switch(DisplayChangeListener *dcl,
+                         DisplayState *ds,
+                         DisplaySurface *surface)
 {
     COCOA_DEBUG("qemu_cocoa: cocoa_resize\n");
 
@@ -1023,11 +1024,6 @@ static void cocoa_refresh(DisplayChangeListener *dcl,
     vga_hw_update();
 }
 
-static void cocoa_setdata(DisplayState *ds)
-{
-    [cocoaView updateDataOffset:ds];
-}
-
 static void cocoa_cleanup(void)
 {
     COCOA_DEBUG("qemu_cocoa: cocoa_cleanup\n");
@@ -1037,8 +1033,7 @@ static void cocoa_cleanup(void)
 static const DisplayChangeListenerOps dcl_ops = {
     .dpy_name          = "cocoa",
     .dpy_gfx_update = cocoa_update;
-    .dpy_gfx_resize = cocoa_resize;
-    .dpy_gfx_setdata = cocoa_setdata;
+    .dpy_gfx_switch = cocoa_switch;
     .dpy_refresh = cocoa_refresh;
 };
 
diff --git a/ui/console.c b/ui/console.c
index 6694489418..8673fe3738 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -1372,8 +1372,8 @@ void register_displaychangelistener(DisplayState *ds,
     dcl->ds = ds;
     QLIST_INSERT_HEAD(&ds->listeners, dcl, next);
     gui_setup_refresh(ds);
-    if (dcl->ops->dpy_gfx_resize) {
-        dcl->ops->dpy_gfx_resize(dcl, ds);
+    if (dcl->ops->dpy_gfx_switch) {
+        dcl->ops->dpy_gfx_switch(dcl, ds, ds->surface);
     }
 }
 
@@ -1413,8 +1413,8 @@ void dpy_gfx_replace_surface(DisplayState *s,
 
     s->surface = surface;
     QLIST_FOREACH(dcl, &s->listeners, next) {
-        if (dcl->ops->dpy_gfx_resize) {
-            dcl->ops->dpy_gfx_resize(dcl, s);
+        if (dcl->ops->dpy_gfx_switch) {
+            dcl->ops->dpy_gfx_switch(dcl, s, surface);
         }
     }
     qemu_free_displaysurface(old_surface);
diff --git a/ui/sdl.c b/ui/sdl.c
index fc4dc1b18d..85eefdf4ab 100644
--- a/ui/sdl.c
+++ b/ui/sdl.c
@@ -117,8 +117,9 @@ static void do_sdl_resize(int width, int height, int bpp)
     }
 }
 
-static void sdl_resize(DisplayChangeListener *dcl,
-                       DisplayState *ds)
+static void sdl_switch(DisplayChangeListener *dcl,
+                       DisplayState *ds,
+                       DisplaySurface *surface)
 {
     if (!scaling_active) {
         do_sdl_resize(ds_get_width(ds), ds_get_height(ds), 0);
@@ -513,7 +514,7 @@ static void handle_keydown(DisplayState *ds, SDL_Event *ev)
         case 0x16: /* 'u' key on US keyboard */
             if (scaling_active) {
                 scaling_active = 0;
-                sdl_resize(dcl, ds);
+                sdl_switch(dcl, ds, ds->surface);
                 vga_hw_invalidate();
                 vga_hw_update();
             }
@@ -856,9 +857,8 @@ static void sdl_cleanup(void)
 static const DisplayChangeListenerOps dcl_ops = {
     .dpy_name          = "sdl",
     .dpy_gfx_update    = sdl_update,
-    .dpy_gfx_resize    = sdl_resize,
+    .dpy_gfx_switch    = sdl_switch,
     .dpy_refresh       = sdl_refresh,
-    .dpy_gfx_setdata   = sdl_setdata,
     .dpy_mouse_set     = sdl_mouse_warp,
     .dpy_cursor_define = sdl_mouse_define,
 };
diff --git a/ui/spice-display.c b/ui/spice-display.c
index b6528fae78..2c4b28d2b9 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -367,7 +367,8 @@ void qemu_spice_display_update(SimpleSpiceDisplay *ssd,
     qemu_spice_rect_union(&ssd->dirty, &update_area);
 }
 
-void qemu_spice_display_resize(SimpleSpiceDisplay *ssd)
+void qemu_spice_display_switch(SimpleSpiceDisplay *ssd,
+                               DisplaySurface *surface)
 {
     SimpleSpiceUpdate *update;
 
@@ -590,10 +591,11 @@ static void display_update(DisplayChangeListener *dcl,
     qemu_spice_display_update(&sdpy, x, y, w, h);
 }
 
-static void display_resize(DisplayChangeListener *dcl,
-                           struct DisplayState *ds)
+static void display_switch(DisplayChangeListener *dcl,
+                           struct DisplayState *ds,
+                           struct DisplaySurface *surface)
 {
-    qemu_spice_display_resize(&sdpy);
+    qemu_spice_display_switch(&sdpy, surface);
 }
 
 static void display_refresh(DisplayChangeListener *dcl,
@@ -605,7 +607,7 @@ static void display_refresh(DisplayChangeListener *dcl,
 static const DisplayChangeListenerOps display_listener_ops = {
     .dpy_name        = "spice",
     .dpy_gfx_update  = display_update,
-    .dpy_gfx_resize  = display_resize,
+    .dpy_gfx_switch  = display_switch,
     .dpy_refresh     = display_refresh,
 };
 
diff --git a/ui/vnc.c b/ui/vnc.c
index 0a3fdd4b8c..f3e842e022 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -574,8 +574,9 @@ void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
     return ptr;
 }
 
-static void vnc_dpy_resize(DisplayChangeListener *dcl,
-                           DisplayState *ds)
+static void vnc_dpy_switch(DisplayChangeListener *dcl,
+                           DisplayState *ds,
+                           DisplaySurface *surface)
 {
     VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
     VncState *vs;
@@ -1972,17 +1973,6 @@ static void pixel_format_message (VncState *vs) {
     vs->write_pixels = vnc_write_pixels_copy;
 }
 
-static void vnc_dpy_setdata(DisplayChangeListener *dcl,
-                            DisplayState *ds)
-{
-    VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
-
-    qemu_pixman_image_unref(vd->guest.fb);
-    vd->guest.fb = pixman_image_ref(ds->surface->image);
-    vd->guest.format = ds->surface->format;
-    vnc_dpy_update(dcl, ds, 0, 0, ds_get_width(ds), ds_get_height(ds));
-}
-
 static void vnc_colordepth(VncState *vs)
 {
     if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
@@ -2694,7 +2684,7 @@ static void vnc_init_timer(VncDisplay *vd)
     vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
     if (vd->timer == NULL && !QTAILQ_EMPTY(&vd->clients)) {
         vd->timer = qemu_new_timer_ms(rt_clock, vnc_refresh, vd);
-        vnc_dpy_resize(&vd->dcl, vd->ds);
+        vnc_dpy_switch(&vd->dcl, vd->ds, vd->ds->surface);
         vnc_refresh(vd);
     }
 }
@@ -2842,8 +2832,7 @@ static void vnc_listen_websocket_read(void *opaque)
 static const DisplayChangeListenerOps dcl_ops = {
     .dpy_name          = "vnc",
     .dpy_gfx_update    = vnc_dpy_update,
-    .dpy_gfx_resize    = vnc_dpy_resize,
-    .dpy_gfx_setdata   = vnc_dpy_setdata,
+    .dpy_gfx_switch    = vnc_dpy_switch,
     .dpy_mouse_set     = vnc_mouse_set,
     .dpy_cursor_define = vnc_dpy_cursor_define,
 };
