From patchwork Mon Nov 28 13:48:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 13057536 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A060FC4167D for ; Mon, 28 Nov 2022 13:49:48 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeV2-0004tP-OE; Mon, 28 Nov 2022 08:48:44 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeV1-0004t9-7a for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:43 -0500 Received: from mail-wm1-x329.google.com ([2a00:1450:4864:20::329]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeUz-0000Hq-6i for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:42 -0500 Received: by mail-wm1-x329.google.com with SMTP id ay14-20020a05600c1e0e00b003cf6ab34b61so11674651wmb.2 for ; Mon, 28 Nov 2022 05:48:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=kYL3A7aqILslZh5SGQrbc1YKknxmIPXfWsAic8JV3eiYGqioyfBs1QYZIo/8AXiWg2 uQNo3+QQAiysWtOPy9hfbqC2CteMNFMAFb3Y6ytJtU54YHibyfIyeCw0htqJ9ZJ3qU+u NUBh5ZDavUvFSEmB44qTi40s4sweglbNe1UnBuS+Fe+HDCiFkpUlliyWRdcgynkRRKrA uK0YksAzKypQe/QPb31YY3D4CP9LlVD6gl61rfrLF/Ztcu9YAMj3S91HzuhaYgiANv7X ZUYhSQZ6F1+3PAkdbzxx3SLSg6z+BzO+pdaTPAqFyUdblZPa56XVOtl0bo9A0QxA6fEK M12g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=qnHTv13hOtVD8I2sU1nRtexknntVAF0U2qO7IVldXK8AwRXjUQjbJxAh7B7FH54cU5 TTGM8M7Gm2uR4oFG6aZE1NVv57njHlQNX6drpvUmuAjukfWisu3Iiyx1fWdS7/7jVnPy I0vTkNlbjtoU1HEhPcCp7Jnv/qyYpNJOyosI78NWZDExGoYtjRZfzP9At33zEYfVUXnq Pm+iVvPy29Uq19EwIzC3+ib/IiVFzBp89pZ/O8LqHy7ZJqtDFpDHy8T2gnYShVuBxaDA qqbDAvLDpDX4hDbVE4HQFjauC1hF/BlZmDiLmq2o1dYlOLvnQ3QVP+ety9FVJY1g/cJ3 v2aw== X-Gm-Message-State: ANoB5pmsOMyXD3WEjTXhucI+j3TWT8waeNA/STk7BWSg6xybBtzsoEDe RY1ndq+dWQEYyJfKuPn6JUEthA== X-Google-Smtp-Source: AA0mqf6Ei0MXNrSlqz/ppQBRb1UBW2uc/JNwDJA9jv7WL9kSBr5qJoR/Fb4fy7Z9PTP5RGdKGtcCDQ== X-Received: by 2002:a05:600c:3b8f:b0:3d0:2485:c06a with SMTP id n15-20020a05600c3b8f00b003d02485c06amr27019175wms.26.1669643319634; Mon, 28 Nov 2022 05:48:39 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id s11-20020a5d69cb000000b002366f9bd717sm12819084wrw.45.2022.11.28.05.48.38 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:38 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [PATCH-for-7.2 1/5] hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler Date: Mon, 28 Nov 2022 14:48:28 +0100 Message-Id: <20221128134832.84867-2-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::329; envelope-from=philmd@linaro.org; helo=mail-wm1-x329.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Only 3 command types are logged: no need to call qxl_phys2virt() for the other types. Using different cases will help to pass different structure sizes to qxl_phys2virt() in a pair of commits. Reviewed-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl-logger.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 68bfa47568..1bcf803db6 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -247,6 +247,16 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) qxl_name(qxl_type, ext->cmd.type), compat ? "(compat)" : ""); + switch (ext->cmd.type) { + case QXL_CMD_DRAW: + break; + case QXL_CMD_SURFACE: + break; + case QXL_CMD_CURSOR: + break; + default: + goto out; + } data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); if (!data) { return 1; @@ -269,6 +279,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) qxl_log_cmd_cursor(qxl, data, ext->group_id); break; } +out: fprintf(stderr, "\n"); return 0; } From patchwork Mon Nov 28 13:48:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 13057539 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B3AFBC433FE for ; Mon, 28 Nov 2022 13:49:48 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVB-0004vg-Ji; Mon, 28 Nov 2022 08:48:53 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeV5-0004u1-D9 for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:47 -0500 Received: from mail-wm1-x336.google.com ([2a00:1450:4864:20::336]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeV3-0000Ih-Tv for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:47 -0500 Received: by mail-wm1-x336.google.com with SMTP id t25-20020a1c7719000000b003cfa34ea516so9488092wmi.1 for ; Mon, 28 Nov 2022 05:48:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=Oby9ef7PoHRY6bMl/8OjOSyn41pKYJCZMMbvmgG1Tt3Epu4yFqSKOKTQJzT5P1jHoW p7J8PJy9MbAT++jQ3XUEwL6fWgd3bMytwUUxGQQLzxGvqHsCQ8P6CDXKjlNDdBPfpis0 CwU8XQOlvz0C/XpZkvNMG3T/sxOkq6XY7GGGX13PDHhLs+z9qiJoP9zzlurlp8cLKzGD 0I3KnJSMpWqbe/vIaWpMyKKYk40L0TS5evntWecPeRau/D5MIewzD3IxQ6YnzRAhKYg1 MAt/mzbY2Wn7P3hIGPipt85/A3rstEj5nmDmxWXAvURhVk6slODpLon5QiFFqU6wEotI bXWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=RvwB5TaySx/M6s+g6Br//1qgVxMlDsAkf7WYcboXiU1lwaLiUWqyz3vokJYaAE7H5X NQDY+9akq/nBIYKhgzjtZ+JXWaB7Qexo3wVMGafyHEtCc4RtBFh5Bk9b4EdWT26GksmM a26iouB2SI3M/dcGHqUUEu4Rk93l3enxYex5hJ6KCXXBXgq7emJcMgkZun3VvNyvvPgj C2JkVW2mHMYPeE3zv1EFXKwKx75q58aLtY9rQfyQkcyO26lGQNRNo5VpzlFaq98ConNg pId/wUYbEIt/Fk43MiYm+Ye3OA6Ghd740ufpB1D6rkpTvM3SDL4uQ1r8k2kmYXsCgM+7 d27Q== X-Gm-Message-State: ANoB5pme4Xbc8AlIOzFkiohxL/NbSeqZRmzv+hEF/QjlfmgXJCkcDglg D83DqJVUKOCUGN3Vo/Ug/3uOUNcBnwjJuz6m X-Google-Smtp-Source: AA0mqf6KFrzWvTKmyO4x9YlmsAGTxb68w+/KUZuGlVnvhdNVi9FtFMFMR0lUjWN+rWFO72MNNdVPzQ== X-Received: by 2002:a05:600c:1f0f:b0:3d0:2a82:1cb2 with SMTP id bd15-20020a05600c1f0f00b003d02a821cb2mr23452111wmb.206.1669643324692; Mon, 28 Nov 2022 05:48:44 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id u22-20020a7bc056000000b003c6c1686b10sm18591855wmc.7.2022.11.28.05.48.43 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:44 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [PATCH-for-7.2 2/5] hw/display/qxl: Document qxl_phys2virt() Date: Mon, 28 Nov 2022 14:48:29 +0100 Message-Id: <20221128134832.84867-3-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::336; envelope-from=philmd@linaro.org; helo=mail-wm1-x336.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Reviewed-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/hw/display/qxl.h b/hw/display/qxl.h index e74de9579d..78b3a6c9ba 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -147,6 +147,25 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) #define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1) /* qxl.c */ +/** + * qxl_phys2virt: Get a pointer within a PCI VRAM memory region. + * + * @qxl: QXL device + * @phys: physical offset of buffer within the VRAM + * @group_id: memory slot group + * + * Returns a host pointer to a buffer placed at offset @phys within the + * active slot @group_id of the PCI VGA RAM memory region associated with + * the @qxl device. If the slot is inactive, or the offset is out + * of the memory region, returns NULL. + * + * Use with care; by the time this function returns, the returned pointer is + * not protected by RCU anymore. If the caller is not within an RCU critical + * section and does not hold the iothread lock, it must have other means of + * protecting the pointer, such as a reference to the region that includes + * the incoming ram_addr_t. + * + */ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); From patchwork Mon Nov 28 13:48:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 13057540 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 54F98C43217 for ; Mon, 28 Nov 2022 13:50:30 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVE-0004wB-C8; Mon, 28 Nov 2022 08:48:56 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVC-0004w1-Fe for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:54 -0500 Received: from mail-wm1-x331.google.com ([2a00:1450:4864:20::331]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVA-0000JN-KW for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:54 -0500 Received: by mail-wm1-x331.google.com with SMTP id c65-20020a1c3544000000b003cfffd00fc0so11695181wma.1 for ; Mon, 28 Nov 2022 05:48:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=HxlkcG019F78hDHWklx7b3JvpZQDvFiwRQqjOn04g5BYWdnFoEpaSEooBeXLfZ55SU PYj0gXwSmKBTHbxsLeeFFYOpB5Dbk8ANQ7VonQoIuG8chMEm4+ZDra45OfAzmLwk1vAo /gKpMiXIFgGWOLCRdLeG3wwSavuLkN1qbAAwsRJuNc41kWg3PGw33SYX3MhsjuSU0kKO YmfyoaOzjW0CAGTM6u/Z/cn+FcZwl96dAQfYTXKUZEu6SvKUKYvGRnXSG6iE8AeqJVah 0QpxMYugczZtn5+8xDQFyGuKYBBgv0kz0XdQeWagQ9SfHQbzEM9snmePvq8JydJtrr3g fvpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=bYyoxW2gSD2sj+q5rMtRhXCDf33R8qp7wbZUEbd7pgEkgPk1oWgixfKJZTtDISGFZD ZVLQ2nsHpseIKfRyLhuGO3xloTlrdqVqqf48OC2x38BJePZYKSGzaCmdbW/k9xkGn06p o67+Jt6CXDJgfqMywvSmrUvqEpJKHvjgq+rYayJDS85zN5UbKKcjo5TVls8wtRrPPVJB W9au15Xl8G9iUw9k6lVpKcO7oM3JGIN+kKeZ2l65d7ai2SuhDLD8uBE1Mt9RzJdOUdZp vV7IrZJhI2bvRCapQGetR6tXp+KrenvjeTN+46ZKLY98DTanyPtnUJvVl0bSQLhTyc+s 9zaw== X-Gm-Message-State: ANoB5pkdGhajNXQu6nQX8wimyXoRu14eQR2/wQH1zmuxiV49965I8rkF 6krkeQN3NO2gW+h6O3nYBIA2IA== X-Google-Smtp-Source: AA0mqf6v/FiRff+w8ZT3jUeK8YB3FscRk4cFB5qErh9WzMDufleXNE/TiebhtBV2UZCMap1YzX6WlA== X-Received: by 2002:a7b:cb91:0:b0:3c6:cb54:ef66 with SMTP id m17-20020a7bcb91000000b003c6cb54ef66mr27123949wmi.90.1669643329584; Mon, 28 Nov 2022 05:48:49 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id a12-20020adfe5cc000000b0022cc3e67fc5sm10674115wrn.65.2022.11.28.05.48.48 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:49 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 3/5] hw/display/qxl: Pass requested buffer size to qxl_phys2virt() Date: Mon, 28 Nov 2022 14:48:30 +0100 Message-Id: <20221128134832.84867-4-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::331; envelope-from=philmd@linaro.org; helo=mail-wm1-x331.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Currently qxl_phys2virt() doesn't check for buffer overrun. In order to do so in the next commit, pass the buffer size as argument. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Marc-André Lureau --- RFC: Please double-check qxl_render_update_area_unlocked() --- hw/display/qxl-logger.c | 11 ++++++++--- hw/display/qxl-render.c | 12 ++++++++---- hw/display/qxl.c | 14 +++++++++----- hw/display/qxl.h | 4 +++- 4 files changed, 28 insertions(+), 13 deletions(-) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 1bcf803db6..35c38f6252 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -106,7 +106,7 @@ static int qxl_log_image(PCIQXLDevice *qxl, QXLPHYSICAL addr, int group_id) QXLImage *image; QXLImageDescriptor *desc; - image = qxl_phys2virt(qxl, addr, group_id); + image = qxl_phys2virt(qxl, addr, group_id, sizeof(QXLImage)); if (!image) { return 1; } @@ -214,7 +214,8 @@ int qxl_log_cmd_cursor(PCIQXLDevice *qxl, QXLCursorCmd *cmd, int group_id) cmd->u.set.position.y, cmd->u.set.visible ? "yes" : "no", cmd->u.set.shape); - cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id); + cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } @@ -236,6 +237,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) { bool compat = ext->flags & QXL_COMMAND_FLAG_COMPAT; void *data; + size_t datasz; int ret; if (!qxl->cmdlog) { @@ -249,15 +251,18 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) switch (ext->cmd.type) { case QXL_CMD_DRAW: + datasz = compat ? sizeof(QXLCompatDrawable) : sizeof(QXLDrawable); break; case QXL_CMD_SURFACE: + datasz = sizeof(QXLSurfaceCmd); break; case QXL_CMD_CURSOR: + datasz = sizeof(QXLCursorCmd); break; default: goto out; } - data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, datasz); if (!data) { return 1; } diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index ca217004bf..0a4bfa8aa6 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -107,7 +107,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) qxl->guest_primary.resized = 0; qxl->guest_primary.data = qxl_phys2virt(qxl, qxl->guest_primary.surface.mem, - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, + qxl->guest_primary.abs_stride + * height); if (!qxl->guest_primary.data) { goto end; } @@ -228,7 +230,7 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, if (offset == size) { return; } - chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id); + chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id, bytes); if (!chunk) { return; } @@ -295,7 +297,8 @@ fail: /* called from spice server thread context only */ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) { - QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLCursorCmd)); QXLCursor *cursor; QEMUCursor *c; @@ -314,7 +317,8 @@ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) } switch (cmd->type) { case QXL_CURSOR_SET: - cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id); + cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 5b10f697f1..231d733250 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -274,7 +274,8 @@ static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay) QXL_IO_MONITORS_CONFIG_ASYNC)); } - cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST); + cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST, + sizeof(QXLMonitorsConfig)); if (cfg != NULL && cfg->count == 1) { qxl->guest_primary.resized = 1; qxl->guest_head0_width = cfg->heads[0].width; @@ -459,7 +460,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) switch (le32_to_cpu(ext->cmd.type)) { case QXL_CMD_SURFACE: { - QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLSurfaceCmd)); if (!cmd) { return 1; @@ -494,7 +496,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) } case QXL_CMD_CURSOR: { - QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLCursorCmd)); if (!cmd) { return 1; @@ -1456,7 +1459,8 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, } /* can be also called from spice server thread context */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, + size_t size) { uint64_t offset; uint32_t slot; @@ -1964,7 +1968,7 @@ static void qxl_dirty_surfaces(PCIQXLDevice *qxl) } cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i], - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, sizeof(QXLSurfaceCmd)); assert(cmd); assert(cmd->type == QXL_SURFACE_CMD_CREATE); qxl_dirty_one_surface(qxl, cmd->u.surface_create.data, diff --git a/hw/display/qxl.h b/hw/display/qxl.h index 78b3a6c9ba..bf03138ab4 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -153,6 +153,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * @qxl: QXL device * @phys: physical offset of buffer within the VRAM * @group_id: memory slot group + * @size: size of the buffer * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with @@ -166,7 +167,8 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * the incoming ram_addr_t. * */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id, + size_t size); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); From patchwork Mon Nov 28 13:48:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 13057537 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8A3BBC43217 for ; Mon, 28 Nov 2022 13:49:48 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVH-0004yl-H2; Mon, 28 Nov 2022 08:48:59 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVG-0004xN-09 for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:58 -0500 Received: from mail-wr1-x434.google.com ([2a00:1450:4864:20::434]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVE-0000Jt-9l for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:57 -0500 Received: by mail-wr1-x434.google.com with SMTP id g12so16877168wrs.10 for ; Mon, 28 Nov 2022 05:48:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=rtgMN5PwHDJ4483KQ5llJcVXxtK9fVGm60c5eWEbrX3MKDl2fKksm9eD4V4RKe/VoN zV5ws3igg5SdydWqYU3AUIZX4Al46H9DjmgG5Z7ab6RJMzuYjMM9YvKW9AFtENzg0ggX yAEqvcSMpweFZ67UsFVVdRFvGswg/BCQIByu7MCUobGrVV1LLRkzTXGyG4t5GidXL6kW 0m3IkGyQMpLmjLyuwVB5uNVJiSD5BnK9NYSpNJOKvkIre/QOcYX6JGnjp/jFDbRv+3wV 9qao2u2ETGfQ4AQVzLuMVj+A7gJrI87NzIbCtLbsu9fAkEpafyxyodx3qRW0tNs9Qz0p CFBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=de+EXQpaUyZbzYoB1OppY3S6Xt6zCmX7uVWzQNxuO7hhvueCzVqFfPL4U1lfZQzBJ8 7jLVS1oG20FptRiQnb2Xuk9lDbYcoNLCHm5hiENW0WDfXnvCSYTDt5XZ1yZ22Kd385WL SmKHTRy+lwf166Pj/Qwi+HzbD+Y56/OUwc8XIku/lOLsD9hwsZBiix+BKsU+b7M6/7Ef ICmV4z8I6nIK6+ewT2YfgcdpaNwAoVVIqoaIoINcC8CajMZNnir/KHUFr38fpXP7hT2D b3Eef9pDp+G6F5aLgCEBQCJ44K6jogDR222+tisJ9MjmUGhKuLuLy+0Rkbg7xJmgYLYj f1Ew== X-Gm-Message-State: ANoB5pnmCA3N31VU6wBod3ONmZ11HfFz8aWpnYUYILpfCD8eWff7Ee+O tu9d/ywEgGGXUtgtxbtCUU/rfA== X-Google-Smtp-Source: AA0mqf6bfQUmfL/pPILkqaumYha/XFflvy3Tn7+T4HxgqTC0YB75ORSEU6MWivN5KZOsFz/ke9h/xA== X-Received: by 2002:adf:e68a:0:b0:242:1926:7838 with SMTP id r10-20020adfe68a000000b0024219267838mr2461131wrm.200.1669643334893; Mon, 28 Nov 2022 05:48:54 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id q4-20020adff944000000b002366c3eefccsm10955690wrr.109.2022.11.28.05.48.53 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:54 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 4/5] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) Date: Mon, 28 Nov 2022 14:48:31 +0100 Message-Id: <20221128134832.84867-5-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::434; envelope-from=philmd@linaro.org; helo=mail-wr1-x434.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Have qxl_get_check_slot_offset() return false if the requested buffer size does not fit within the slot memory region. Similarly qxl_phys2virt() now returns NULL in such case, and qxl_dirty_one_surface() aborts. This avoids buffer overrun in the host pointer returned by memory_region_get_ram_ptr(). Fixes: CVE-2022-4144 (out-of-bounds read) Reported-by: Wenxu Yin (@awxylitol) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336 Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl.c | 22 ++++++++++++++++++---- hw/display/qxl.h | 2 +- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 231d733250..afa157d327 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1424,11 +1424,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d) /* can be also called from spice server thread context */ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, - uint32_t *s, uint64_t *o) + uint32_t *s, uint64_t *o, + size_t size_requested) { uint64_t phys = le64_to_cpu(pqxl); uint32_t slot = (phys >> (64 - 8)) & 0xff; uint64_t offset = phys & 0xffffffffffff; + uint64_t size_available; if (slot >= NUM_MEMSLOTS) { qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot, @@ -1453,6 +1455,18 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, return false; } + size_available = memory_region_size(qxl->guest_slots[slot].mr); + assert(qxl->guest_slots[slot].offset + offset < size_available); + size_available -= qxl->guest_slots[slot].offset + offset; + if (size_requested > size_available) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" size %zu: " + "overrun by %"PRIu64" bytes\n", + slot, offset, size_requested, + size_requested - size_available); + return false; + } + *s = slot; *o = offset; return true; @@ -1471,7 +1485,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, offset = le64_to_cpu(pqxl) & 0xffffffffffff; return (void *)(intptr_t)offset; case MEMSLOT_GROUP_GUEST: - if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) { + if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) { return NULL; } ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); @@ -1937,9 +1951,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, uint32_t slot; bool rc; - rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset); - assert(rc == true); size = (uint64_t)height * abs(stride); + rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size); + assert(rc == true); trace_qxl_surfaces_dirty(qxl->id, offset, size); qxl_set_dirty(qxl->guest_slots[slot].mr, qxl->guest_slots[slot].offset + offset, diff --git a/hw/display/qxl.h b/hw/display/qxl.h index bf03138ab4..7894bd5134 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -157,7 +157,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with - * the @qxl device. If the slot is inactive, or the offset is out + * the @qxl device. If the slot is inactive, or the offset + size are out * of the memory region, returns NULL. * * Use with care; by the time this function returns, the returned pointer is From patchwork Mon Nov 28 13:48:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 13057541 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3D70CC43217 for ; Mon, 28 Nov 2022 13:51:06 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVP-00050j-4J; Mon, 28 Nov 2022 08:49:07 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVK-0004zm-Mz for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:49:04 -0500 Received: from mail-wr1-x42a.google.com ([2a00:1450:4864:20::42a]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVJ-0000KL-6d for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:49:02 -0500 Received: by mail-wr1-x42a.google.com with SMTP id b12so16933107wrn.2 for ; Mon, 28 Nov 2022 05:49:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=u7kjgjDTgjTvxi4mknc59fI7NJa892rSTq3VdryfY7+y62JcQYQ/kDQe562HyViDgK I0BR+pPTd8iIpxTohjrOpdqMkQFoXdP7/gFWLDLlD+yoHDXWgHLcU0xOsO3HaTXlVAGd LbSTtrX1T0RNFXLugfvfZHtGevxGh4ja+BWrFGIqdewyFnnEXrC+MrPolyHrl3O2v3LT AUDbSiqis6tmxJyrfNqxUJqOd+Uo9nkWRrdAIjHAtCoE7Kfz6QmTPL2U7dPOnKfxUB+F 1qD/NB4UmsLtpNb9MqLWgz+WQF0k/zlkUpJ8mHH7GpwRDNsPU0PJw9VUSBiClCRsGLow zzPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=tww5s3+NFMXNLUe1fxp5pHsJsdxPakgtKccZ8Z3TjscKBIUdjGweNic+kbCXohSrb2 Y2CTpCY5gXqxBCy1mVjOGp4C6BQ/5lIdF5UT+gPx+I5ZY11HKa5GdpWghQ8FJ/HPGLej Vow5Z1ixkr/UvOSBa0p/ZzX4XXETSQT2RJAKV3ags4lCsdbChB8voQUGOrIle4qVysCD 5TsKzYl9GjABv9rx3KxJZTNZHb5xvJ6YbiBTdFisbctWE6mghKxApR+fui4NDL6cQPph 9P7Olx42n8V9njAH55XUoGQ4+9P7Kl6WkG+4sogfaP67zEyLRM2DN4TvPC4IKSi0btGi MUww== X-Gm-Message-State: ANoB5pmYoes3gnEPkG/oonkwpUWvK/D6RS8aqnG6M9hsV/4ivkuFNnmf H8WakraRYAR7DMXDokwmwUkGdw== X-Google-Smtp-Source: AA0mqf43lFca6m0O+Eo3HPA1DXEIa++geamLZRELxHu4Svn8C4EVNQ9cQUOSplBKEKb76fSuV9glJg== X-Received: by 2002:adf:f0d1:0:b0:242:285:6b21 with SMTP id x17-20020adff0d1000000b0024202856b21mr11735439wro.35.1669643339906; Mon, 28 Nov 2022 05:48:59 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id v8-20020adfebc8000000b00236545edc91sm10979357wrn.76.2022.11.28.05.48.58 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:59 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [PATCH-for-8.0 5/5] hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion Date: Mon, 28 Nov 2022 14:48:32 +0100 Message-Id: <20221128134832.84867-6-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::42a; envelope-from=philmd@linaro.org; helo=mail-wr1-x42a.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index afa157d327..8468513f41 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1384,6 +1384,7 @@ static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta, qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region); return 1; } + assert(guest_end - pci_start <= memory_region_size(mr)); virt_start = (intptr_t)memory_region_get_ram_ptr(mr); memslot.slot_id = slot_id;