From patchwork Tue Apr 4 10:23:08 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 9661253 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 99BC0602B9 for ; Tue, 4 Apr 2017 10:26:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8B5F828307 for ; Tue, 4 Apr 2017 10:26:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7F0BD2849D; Tue, 4 Apr 2017 10:26:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 171D728307 for ; Tue, 4 Apr 2017 10:26:29 +0000 (UTC) Received: from localhost ([::1]:34819 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cvLfP-0003iT-QZ for patchwork-qemu-devel@patchwork.kernel.org; Tue, 04 Apr 2017 06:26:27 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54139) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cvLcY-00026m-LM for qemu-devel@nongnu.org; Tue, 04 Apr 2017 06:23:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cvLcT-0002CH-He for qemu-devel@nongnu.org; Tue, 04 Apr 2017 06:23:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34224) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cvLcT-0002A4-An for qemu-devel@nongnu.org; Tue, 04 Apr 2017 06:23:25 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A247F5147C; Tue, 4 Apr 2017 10:23:23 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com A247F5147C Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=kraxel@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com A247F5147C Received: from nilsson.home.kraxel.org (ovpn-116-84.ams2.redhat.com [10.36.116.84]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3DE178BE29; Tue, 4 Apr 2017 10:23:21 +0000 (UTC) Received: by nilsson.home.kraxel.org (Postfix, from userid 500) id 2505C80C94; Tue, 4 Apr 2017 12:23:20 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Tue, 4 Apr 2017 12:23:08 +0200 Message-Id: <20170404102315.24923-4-kraxel@redhat.com> In-Reply-To: <20170404102315.24923-1-kraxel@redhat.com> References: <20170404102315.24923-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 04 Apr 2017 10:23:23 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH 03/10] vga: add vga_scanline_invalidated helper X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?Alex=20Benn=C3=A9e?= , Paolo Bonzini , Mark Cave-Ayland , Gerd Hoffmann Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP Add vga_scanline_invalidated helper to check whenever a scanline was invalidated. Add a sanity check to fix OOB read access for display heights larger than 2048. Only cirrus uses this, for hardware cursor rendering, so having this work properly for the first 2048 scanlines only shouldn't be a problem as the cirrus can't handle large resolutions anyway. Also changing the invalidated_y_table size would break live migration. Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index 69c3e1d..f320946 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1434,6 +1434,14 @@ void vga_invalidate_scanlines(VGACommonState *s, int y1, int y2) } } +static bool vga_scanline_invalidated(VGACommonState *s, int y) +{ + if (y >= VGA_MAX_HEIGHT) { + return false; + } + return s->invalidated_y_table[y >> 5] |= 1 << (y & 0x1f); +} + void vga_sync_dirty_bitmap(VGACommonState *s) { memory_region_sync_dirty_bitmap(&s->vram); @@ -1638,8 +1646,8 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) page1 = addr + bwidth - 1; update |= memory_region_get_dirty(&s->vram, page0, page1 - page0, DIRTY_MEMORY_VGA); - /* explicit invalidation for the hardware cursor */ - update |= (s->invalidated_y_table[y >> 5] >> (y & 0x1f)) & 1; + /* explicit invalidation for the hardware cursor (cirrus only) */ + update |= vga_scanline_invalidated(s, y); if (update) { if (y_start < 0) y_start = y; @@ -1686,7 +1694,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update) page_max - page_min, DIRTY_MEMORY_VGA); } - memset(s->invalidated_y_table, 0, ((height + 31) >> 5) * 4); + memset(s->invalidated_y_table, 0, sizeof(s->invalidated_y_table)); } static void vga_draw_blank(VGACommonState *s, int full_update)