From mboxrd@z Thu Jan  1 00:00:00 1970
From: Anthony Liguori <aliguori@us.ibm.com>
Subject: Re: cirrusfb division by zero
Date: Wed, 30 Apr 2008 13:08:29 -0500
Message-ID: <4818B59D.7070205@us.ibm.com>
References: <20080430163640.GB25309@dmt>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Cc: kvm-devel <kvm-devel@lists.sourceforge.net>,
	Alan Pevec <apevec@redhat.com>
To: Marcelo Tosatti <mtosatti@redhat.com>
Return-path: <kvm-devel-bounces@lists.sourceforge.net>
In-Reply-To: <20080430163640.GB25309@dmt>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/kvm-devel>,
	<mailto:kvm-devel-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=kvm-devel>
List-Post: <mailto:kvm-devel@lists.sourceforge.net>
List-Help: <mailto:kvm-devel-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/kvm-devel>,
	<mailto:kvm-devel-request@lists.sourceforge.net?subject=subscribe>
Sender: kvm-devel-bounces@lists.sourceforge.net
Errors-To: kvm-devel-bounces@lists.sourceforge.net
List-Id: kvm.vger.kernel.org

Marcelo Tosatti wrote:
> Anthony, 
>
> The following sequence crashes F9 guests, when using VNC:
>
> # modprobe cirrusfb
> # vbetool post
>
> Results in Floating point exception at:
>
> cirrus_do_copy()
> {
>
>     depth = s->get_bpp((VGAState *)s) / 8 
>     ...
>     sx = (src % (width * depth)) / depth;
>     ...
> }
>
> Problem is that ->get_bpp returns 0.
>
> Following band-aid "fixes it" (coff). I have no idea if its correct
> though ?
>   

It suggests something is very broken.  get_bpp only is supposed to 
return 0 when in VGA mode.  I don't think blitting should happen when in 
VGA mode.  Applying the patch is not a bad idea but what was the guest 
doing when this happened?  Was it in the process of transitioning from 
one mode to another?

Regards,

Anthony Liguori

> "vbetool post" corrupts both SDL and VNC displays when using cirrusfb,
> but seems a separate problem.
>
>
> diff --git a/qemu/hw/cirrus_vga.c b/qemu/hw/cirrus_vga.c
> index e14ec35..9f860ff 100644
> --- a/qemu/hw/cirrus_vga.c
> +++ b/qemu/hw/cirrus_vga.c
> @@ -709,6 +709,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, in     int notify = 0;
>
>      depth = s->get_bpp((VGAState *)s) / 8;
> +    if (!depth)
> +        depth = 1;
>      s->get_resolution((VGAState *)s, &width, &height);
>
>      /* extra x, y */
>
>   


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone