From patchwork Fri Nov 25 15:40:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628555 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp1190769pvb; Fri, 25 Nov 2022 07:41:58 -0800 (PST) X-Google-Smtp-Source: AA0mqf6E2jjyZNTRIz3K0HIrMYscxFPX7h341AI5l3tKfrMmjX3ClpyjcjBzBt+Re+7QYgfE9bv2 X-Received: by 2002:a05:620a:1a9b:b0:6fb:f366:57df with SMTP id bl27-20020a05620a1a9b00b006fbf36657dfmr16546017qkb.558.1669390918337; Fri, 25 Nov 2022 07:41:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669390918; cv=none; d=google.com; s=arc-20160816; b=RXF9pRha+tnwp3nDs2QaBrYd6lB3WGK7169naKrqAhaukpS607uOXnCwAkWBU4kkLd XYMkDazZ79jkFzdZ4zvkQEmgt0ybFRdAYNuHI9dbKKPn0YeIvnh5pRDNJi6k0znloE9b PsAJyqEmApS/f1CfS4yIEgdFsnzfUR4bNphHoc3xl9KcDytqkgbRHF7YtbQgpqH+nETV +dfQy8pKTDgIXKrP07YPh8bLOPFp4QBDNtOVQdtlQcQnzLhpjDRw/v2edjlbA5Yb+Iuf 4qoIhn1wEJN/37WVT6JPjOQpyQr5ticRUSU4QCq+CFq0T5NkOVZrf0f2n5uxluXPgVSr mbJQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=89ZpvryiYhZAje4rWrjV3F2Dni2cZJzpsnzs0iAtxKs=; b=Xd70bYTbBii/EZxpMyI/Wo6F4MAUUj1PMpTxTzSeegoX/gvjAxFKWSy9+ggrz0UO2O EfHPeFRypAbtka1BdnVQrLK1eKA4U9Nvnjv9RvZeIPO+T6VwoFDg3EaBuxfxgFYfI14S fmpKi9UXcJ7e0E3YPgr1PM3afrWZk25nbyMab2t454Iu8p6vxWHUcvhljxaK0JaQksN2 +B7EYCQIR+IX/xAJP94pD9DxB+x3RgIxIRHBP90fqVx2OuB5CH1uAPjjZKJOAZJGpO1b w714JP/oM39WCvQ2GTstRCTlRw3xeJdJQFLfvVcpdF04LW4jJNtMtTG7udaXUPYul8sp 9OQw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fuJ7OZQg; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id i19-20020ac87653000000b00398f4fb7a6fsi2459564qtr.216.2022.11.25.07.41.58 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 25 Nov 2022 07:41:58 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fuJ7OZQg; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oyaol-0001gU-Ni; Fri, 25 Nov 2022 10:40:43 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oyaoj-0001gD-4V for qemu-devel@nongnu.org; Fri, 25 Nov 2022 10:40:42 -0500 Received: from mail-wr1-x435.google.com ([2a00:1450:4864:20::435]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oyaoh-0005o2-K5 for qemu-devel@nongnu.org; Fri, 25 Nov 2022 10:40:40 -0500 Received: by mail-wr1-x435.google.com with SMTP id i12so7387009wrb.0 for ; Fri, 25 Nov 2022 07:40:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=89ZpvryiYhZAje4rWrjV3F2Dni2cZJzpsnzs0iAtxKs=; b=fuJ7OZQgYbClEpvKGXKsXwpBvhvhOdUWRVAHCJbvUcbfrQ9S1wosrnD4ak07vFnFJs +2jl+Jh3S526B1GBKp02KoLoS/l3ANX7hSSjhlnc/yQkpfoBGX8Kdom+i9jUg2/Cahwg L2fFXTtyQYWvZfMZO1TiWoP9Km1YgtzF7EjQ6eOBZynAXritykF3a6Jn60K9oEd/Mbdq 019I1tYX6OtfqxzACQf7Hnw6oHr2qCegnPmbsrL+spV2O5QPbKCtoLjrinFyHXt0NVEa vzFGUkDX/mkbaK+H277eNcOusrQCiTMsNnLnZyNlfeh4D+eEDmYWHQ2greaid8KERWy/ Einw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=89ZpvryiYhZAje4rWrjV3F2Dni2cZJzpsnzs0iAtxKs=; b=W8+oI5De1MKaXG6Wsl5qaAFVhDVA4BY/bH+JZyRul5KzBtMy9VoQOpDJL+Eo1zRn6Q sVRbuFtv78vEqpSoTsXkKvzBoK1+HJMpQ7xqvLRJ2bu06x8rchqTW08sVnM+hFKXuryD i8Jv8ksojYo/Fj72zZUa0K9/o4fegii0X+e+HBejjVdkIZDOHS7a+kGOuJSPBvA+HX9Y wEFs0DimsTFj+PTJeurEZQgyEaMib+BUtq7/b7cWdCppnn94CU5qrF9wAowQrpvaDi/n In1bdZtmeBtKQkJeIpQVx+W8Jj1GmvbdQ9Oo8VflOBIa9pN1Eo5kfwmF8RTu3AHQxKTP /uOg== X-Gm-Message-State: ANoB5pmZVkO8Mmgq++5s6YwbFXv3oYQV+Y1EN2dRvxPUNLOn5DYo2aFi wfRiM3MXU5io505XO7JyxtD2D9H/oDcZyQ== X-Received: by 2002:adf:f60f:0:b0:22e:6564:e987 with SMTP id t15-20020adff60f000000b0022e6564e987mr23890818wrp.401.1669390837326; Fri, 25 Nov 2022 07:40:37 -0800 (PST) Received: from localhost.localdomain ([185.126.107.38]) by smtp.gmail.com with ESMTPSA id h16-20020a05600c315000b003cfb7c02542sm6072179wmo.11.2022.11.25.07.40.36 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 25 Nov 2022 07:40:36 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Mauro Matteo Cascella , Gerd Hoffmann , Peter Maydell , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Alexander Bulekov , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 1/4] hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler Date: Fri, 25 Nov 2022 16:40:27 +0100 Message-Id: <20221125154030.42108-2-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221125154030.42108-1-philmd@linaro.org> References: <20221125154030.42108-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::435; envelope-from=philmd@linaro.org; helo=mail-wr1-x435.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Only 3 command types are logged: no need to call qxl_phys2virt() for the other types. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Marc-André Lureau --- hw/display/qxl-logger.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 68bfa47568..1bcf803db6 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -247,6 +247,16 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) qxl_name(qxl_type, ext->cmd.type), compat ? "(compat)" : ""); + switch (ext->cmd.type) { + case QXL_CMD_DRAW: + break; + case QXL_CMD_SURFACE: + break; + case QXL_CMD_CURSOR: + break; + default: + goto out; + } data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); if (!data) { return 1; @@ -269,6 +279,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) qxl_log_cmd_cursor(qxl, data, ext->group_id); break; } +out: fprintf(stderr, "\n"); return 0; } From patchwork Fri Nov 25 15:40:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628554 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp1190745pvb; Fri, 25 Nov 2022 07:41:57 -0800 (PST) X-Google-Smtp-Source: AA0mqf67JdDf9GfGtN9NsD/O+9PCRoSVfIvWiWFnwZ0iPlV9E9RINvt7M4fD3bPg3c3DvJIfMGN4 X-Received: by 2002:a37:c54:0:b0:6ee:82bf:188d with SMTP id 81-20020a370c54000000b006ee82bf188dmr33802780qkm.744.1669390917456; Fri, 25 Nov 2022 07:41:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669390917; cv=none; d=google.com; s=arc-20160816; b=LO3Ryvmkg7A6nq7cC6iRrHz2QnIjCv4jOF6HJ8k9u7S7algeFxC80/xWJYh+5hT6jy MFetuy/g4G2OvG1P+5TWwlGcowNfFFDlYBm/jZbXp54y/KZE0bMORNNZ9Ztes3rSr38Z Ln6ubyeXFpaP4pzrVmTgknqbfbtH6zm7Ljj384AUwmHzL7lrf4jib4U7HbZlmmMl/wXW OIo6yhRcOL0fIOD5seiKtEjiBEYuj+4pLzFJRRTkEwHn2V+rsdkVyKRToJUMinIpeOdy vGc/24fsCnEl6nXw9gMohGJ4Ncby7WZu2E6dWg0sh5HmeoSK35ogqD3qIdmfZwr3X5SD K2Ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=vuC2Vc1/RmRd2o01cfm9ZesNvyFbkIRS/scjQ5wTRCY=; b=ZNAtM5IKVddtRI7pDFeoK7LkAoqX9NfHYdz6Mqo7+HQWJn6ex/e/JK3ogw2+JGfCmo jMZIC3RpsSqWf0s2k4CaD66a18qsBDtuhTZvIiGTTL2n3yjWZcJ54p2Z5vu5Fm3ErPuY OzgP1Cx1Eebfci6Tjbl4Pk5C2vQzm8bZohzKNrmMMopaOajJS8XM0wTXgJIjO+3p3HG/ 6Hxvm4H5PbQfkjA6nEb06U6Vf/J9xJm7TZONQhEkXctBQCSY9qrd0UedVxuqEp82idw6 k0l2cPh/VvVHzirblpCdvZ7n1gVx4L7ICUDWpJr+SRz8Rkuw5V+IOB1nkv5FroP6fVWa xGnQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="I/9SQuXy"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d5-20020ac80605000000b0039ceb3ab9f0si2244203qth.720.2022.11.25.07.41.57 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 25 Nov 2022 07:41:57 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="I/9SQuXy"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oyaop-0001gu-Vz; Fri, 25 Nov 2022 10:40:48 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oyaoo-0001gm-Ip for qemu-devel@nongnu.org; Fri, 25 Nov 2022 10:40:46 -0500 Received: from mail-wr1-x42d.google.com ([2a00:1450:4864:20::42d]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oyaom-0005rp-MR for qemu-devel@nongnu.org; Fri, 25 Nov 2022 10:40:45 -0500 Received: by mail-wr1-x42d.google.com with SMTP id bs21so7317901wrb.4 for ; Fri, 25 Nov 2022 07:40:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=vuC2Vc1/RmRd2o01cfm9ZesNvyFbkIRS/scjQ5wTRCY=; b=I/9SQuXyN+iIGqpReDcRx2sFMzrF8TmVJWLrD00x/QDUTp1bRuJF6sr8M0wW1Q6gbZ Wla2WHSrGyfgTbc1Oy7X2cBtrqsodJoFgMqR5iYE+AxsZ8Whyg9IrQOSeMAcmgI6606C d89d4f1U/6DI9tbU35CXp6Re3JV8gwWc75fZGpRKJF48K/bcRt7kPGPYBCKe5NSsDCAW AIP2LkyQ3lYlWY5V+1Hoi+fY5itrMtJ1Y4XlPDPYnaB0twOuSEHc7s6Go1CbXmaJEimz 4XvNXWtQHQsw6t9DYqP40xYK2rFVy7rdtf3EBglnPbFZdlolSu9i4ciwRRY8LuPdtE2U G/5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=vuC2Vc1/RmRd2o01cfm9ZesNvyFbkIRS/scjQ5wTRCY=; b=3rZiohcnfSddd5TX7b9DHAdVmPnyjzL0kiysUsza7uDei3b7q0PcjdIx8y2CiPS70/ hb16KAXxt6JlybBUkPaeXPkXFkBqnRgdFuKRdHI5bKb5Jo6kDSGzdDWf1tNHXy7/ob+z Bpu3G2Z1UTgv0YfVDaEiW9xL+4mpdUkm7EdoxdPjNmliqnNKhuz8a2XCKruvEzWQsh18 tbCQUlqPQWLZUt5zxCQgA2MeXG+aJhoZagWCCLkjvbw3gzcZYJmkm74lB8OM7B2Axz/8 iDhTsXcSWlmJHpITh0kGZi71yNwrJVUtMclM5Eplh4PJaocCIfVi1i6B5xgvGUmAv5dW 1eLw== X-Gm-Message-State: ANoB5pkcHZ9cCoiPtpRrrgajzMIWpXknAOepNTGmZNov+8nKGyUBPJTq GJezm3UFwZVq8eTpJ4wgD3WcUZdypQsgVw== X-Received: by 2002:a5d:6b0e:0:b0:236:7439:61e7 with SMTP id v14-20020a5d6b0e000000b00236743961e7mr15787301wrw.611.1669390842989; Fri, 25 Nov 2022 07:40:42 -0800 (PST) Received: from localhost.localdomain ([185.126.107.38]) by smtp.gmail.com with ESMTPSA id r6-20020a05600c458600b003cfd4a50d5asm9933010wmo.34.2022.11.25.07.40.41 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 25 Nov 2022 07:40:42 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Mauro Matteo Cascella , Gerd Hoffmann , Peter Maydell , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Alexander Bulekov , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 2/4] hw/display/qxl: Document qxl_phys2virt() Date: Fri, 25 Nov 2022 16:40:28 +0100 Message-Id: <20221125154030.42108-3-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221125154030.42108-1-philmd@linaro.org> References: <20221125154030.42108-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::42d; envelope-from=philmd@linaro.org; helo=mail-wr1-x42d.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Marc-André Lureau --- hw/display/qxl.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/hw/display/qxl.h b/hw/display/qxl.h index e74de9579d..78b3a6c9ba 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -147,6 +147,25 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) #define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1) /* qxl.c */ +/** + * qxl_phys2virt: Get a pointer within a PCI VRAM memory region. + * + * @qxl: QXL device + * @phys: physical offset of buffer within the VRAM + * @group_id: memory slot group + * + * Returns a host pointer to a buffer placed at offset @phys within the + * active slot @group_id of the PCI VGA RAM memory region associated with + * the @qxl device. If the slot is inactive, or the offset is out + * of the memory region, returns NULL. + * + * Use with care; by the time this function returns, the returned pointer is + * not protected by RCU anymore. If the caller is not within an RCU critical + * section and does not hold the iothread lock, it must have other means of + * protecting the pointer, such as a reference to the region that includes + * the incoming ram_addr_t. + * + */ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); From patchwork Fri Nov 25 17:31:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628563 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp1274213pvb; Fri, 25 Nov 2022 09:32:53 -0800 (PST) X-Google-Smtp-Source: AA0mqf5OIBAV+635MuJh45b3oY3b5KSHUpTkx4+RvGPQprIM5GolOkjQ4JpizWnpKaPuf4QCpgMJ X-Received: by 2002:a37:486:0:b0:6fb:c2b7:bd0f with SMTP id 128-20020a370486000000b006fbc2b7bd0fmr34886524qke.69.1669397573383; Fri, 25 Nov 2022 09:32:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669397573; cv=none; d=google.com; s=arc-20160816; b=G/3+duwLP9xiUBvTc3iNpLj/Zd0J7nzjaWhnRCZ07wI8pbNg7L8Gy90CdSi5lqHxvS z424q8MQvEv13+p4bDBeT78aJ2qWwcTcWzZw4yZvCOoYxtOtYDAJRI9iVQcDLsAHVFVg 6zg2KA493r4/a3fQVcrZqTM+CVj/aDslHzcN5UHlWixNSyqFKSKT/e+N/b+YRGWdtHN0 PPl6tqEiJ1Ge4F72gqyrnH9/Fvjm065ZgWam3eGH8lYEENy9sPClaCWcLGm9/Rd/p43R 1vuHhcf4mZ+/TfOPOjz9FumpGbvFLRBRUz7elE8FYjjzQimQ59WhSxI6Enq0GFnOOuqH 2Qmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=b0IH76EKIQ1ruWEmDG0NlyHxpybLvAmwKT4oazPX1RE=; b=0g8xOvWZSWX5IQ20REy/r1uDGku+VV8evsaKqIfQSQaj4TClBSPmNwTCpZOh9nkCo4 4GwR1T8WOZCQEQ6PVXYASF6SlTNYJA7rxdqTNT2J5jmJhFF9TT5p0ucQmNISiMBhncLH h+YaMvNq+XzKdRhX2/Hp9WHGIVzaw9T/H90UlMmOxXA0lE/gzA9dxFaSyJEBYxxbCdR1 n3KrLvUv5Ic1DOp2x0FPZQn0gqlAY9IldvzMdc2mN9N4UknudQ+zhRfd3HRd3mp7Jbji Q8AunkC3vhMKHz/Zbbff3HN1n1M7DA+YYsOaGUutiUVN6xKrcgXOSe+v3cvvEsWQhQ7W W6vA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=zYIywXdf; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id x22-20020ac87ed6000000b00399f4740695si2504626qtj.124.2022.11.25.09.32.53 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 25 Nov 2022 09:32:53 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=zYIywXdf; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oycY1-000525-Bo; Fri, 25 Nov 2022 12:31:33 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oycXz-0004zS-Ke for qemu-devel@nongnu.org; Fri, 25 Nov 2022 12:31:31 -0500 Received: from mail-wr1-x42e.google.com ([2a00:1450:4864:20::42e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oycXv-0004bv-IC for qemu-devel@nongnu.org; Fri, 25 Nov 2022 12:31:30 -0500 Received: by mail-wr1-x42e.google.com with SMTP id i12so7850019wrb.0 for ; Fri, 25 Nov 2022 09:31:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=b0IH76EKIQ1ruWEmDG0NlyHxpybLvAmwKT4oazPX1RE=; b=zYIywXdfp+50h2wkHdcH/v24KiGgrNy+QHDIzR436WMAv0OHOIa1vvEjtTbsJJL4ld tzuW2LjLFjGmjEeTXQ2vDT/6YK/oXeZsAeekA++o5yhvuABkO1yAyx+1PemT46574+7X KiOYBTZLcXgjlOZlwsUx6KFD/LlbFerkQLT6Fs4NNRPtrIZdEgzWX+6kYgvYaEMPgeXl SOB9ucaCQY2jzx/8AKP+Udxtc6gSlZMGa7ZaMjSSkjGKQWYDqRSauiCjCSnloThLhRPn uMdSfPah7WLY9G+JbStLEPTOYmj7bTxvhB2YGUzvuhdWO4Gkp+HIBRTDFbUtMUni6xQ1 NBeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=b0IH76EKIQ1ruWEmDG0NlyHxpybLvAmwKT4oazPX1RE=; b=JUSrmqGK89yZoivXhn133gQAWEHRjOOcDR8UcZ3s5kT1idhkrxZj8sz1Mr+vqJMyD+ iJKJEkAqHXjH6q8t5qMwD7ewYRku6ey9m51pLmAujtIDxweLL2p0rWPtMrQsNn6CgFpb p+uAYZnqe8D9dDN8JXTz879BGlj+Xq0qbiSwo9sQYlwFbRyzLvFFshNN9qdxOXav/rHP OtoW3IC2FaZjZGAYZOmr8FNAUFw+ikHAsSMBwSUyUd4YuD9qJeQsUpiukg49pBFydmle xh2y57bEF9GqIDnaAJqwRXxKwcrhEbvPgIOJlNb9GE7+nIgajCB/GgpM/F03XOguYwyI kkNg== X-Gm-Message-State: ANoB5pk+9TxQMhg6SXcZvtdwfMuQvkMTZ6Or4jwSFOrC3Jj38Fi6ZA3d 2Coq2RifFF03PxvLvWT+/YwOKfW/4JDV2Q== X-Received: by 2002:a05:6000:104c:b0:23a:5a31:29eb with SMTP id c12-20020a056000104c00b0023a5a3129ebmr17478120wrx.679.1669397485636; Fri, 25 Nov 2022 09:31:25 -0800 (PST) Received: from localhost.localdomain ([185.126.107.38]) by smtp.gmail.com with ESMTPSA id h12-20020a056000000c00b00241cfa9333fsm4472919wrx.5.2022.11.25.09.31.24 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 25 Nov 2022 09:31:25 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Mauro Matteo Cascella , Alexander Bulekov , Peter Maydell , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 3/4] hw/display/qxl: Pass requested buffer size to qxl_phys2virt() Date: Fri, 25 Nov 2022 18:31:18 +0100 Message-Id: <20221125173119.46665-1-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221125154030.42108-1-philmd@linaro.org> References: <20221125154030.42108-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::42e; envelope-from=philmd@linaro.org; helo=mail-wr1-x42e.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Currently qxl_phys2virt() doesn't check for buffer overrun. In order to do so in the next commit, pass the buffer size as argument. Signed-off-by: Philippe Mathieu-Daudé --- RFC: Please double-check qxl_render_update_area_unlocked() --- hw/display/qxl-logger.c | 11 ++++++++--- hw/display/qxl-render.c | 11 +++++++---- hw/display/qxl.c | 14 +++++++++----- hw/display/qxl.h | 4 +++- 4 files changed, 27 insertions(+), 13 deletions(-) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 1bcf803db6..35c38f6252 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -106,7 +106,7 @@ static int qxl_log_image(PCIQXLDevice *qxl, QXLPHYSICAL addr, int group_id) QXLImage *image; QXLImageDescriptor *desc; - image = qxl_phys2virt(qxl, addr, group_id); + image = qxl_phys2virt(qxl, addr, group_id, sizeof(QXLImage)); if (!image) { return 1; } @@ -214,7 +214,8 @@ int qxl_log_cmd_cursor(PCIQXLDevice *qxl, QXLCursorCmd *cmd, int group_id) cmd->u.set.position.y, cmd->u.set.visible ? "yes" : "no", cmd->u.set.shape); - cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id); + cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } @@ -236,6 +237,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) { bool compat = ext->flags & QXL_COMMAND_FLAG_COMPAT; void *data; + size_t datasz; int ret; if (!qxl->cmdlog) { @@ -249,15 +251,18 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) switch (ext->cmd.type) { case QXL_CMD_DRAW: + datasz = compat ? sizeof(QXLCompatDrawable) : sizeof(QXLDrawable); break; case QXL_CMD_SURFACE: + datasz = sizeof(QXLSurfaceCmd); break; case QXL_CMD_CURSOR: + datasz = sizeof(QXLCursorCmd); break; default: goto out; } - data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, datasz); if (!data) { return 1; } diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index ca217004bf..1b0a50c1aa 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -107,7 +107,8 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) qxl->guest_primary.resized = 0; qxl->guest_primary.data = qxl_phys2virt(qxl, qxl->guest_primary.surface.mem, - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, + sizeof(uint32_t) * width * height); if (!qxl->guest_primary.data) { goto end; } @@ -228,7 +229,7 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, if (offset == size) { return; } - chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id); + chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id, bytes); if (!chunk) { return; } @@ -295,7 +296,8 @@ fail: /* called from spice server thread context only */ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) { - QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLCursorCmd)); QXLCursor *cursor; QEMUCursor *c; @@ -314,7 +316,8 @@ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) } switch (cmd->type) { case QXL_CURSOR_SET: - cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id); + cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 5b10f697f1..231d733250 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -274,7 +274,8 @@ static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay) QXL_IO_MONITORS_CONFIG_ASYNC)); } - cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST); + cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST, + sizeof(QXLMonitorsConfig)); if (cfg != NULL && cfg->count == 1) { qxl->guest_primary.resized = 1; qxl->guest_head0_width = cfg->heads[0].width; @@ -459,7 +460,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) switch (le32_to_cpu(ext->cmd.type)) { case QXL_CMD_SURFACE: { - QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLSurfaceCmd)); if (!cmd) { return 1; @@ -494,7 +496,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) } case QXL_CMD_CURSOR: { - QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLCursorCmd)); if (!cmd) { return 1; @@ -1456,7 +1459,8 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, } /* can be also called from spice server thread context */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, + size_t size) { uint64_t offset; uint32_t slot; @@ -1964,7 +1968,7 @@ static void qxl_dirty_surfaces(PCIQXLDevice *qxl) } cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i], - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, sizeof(QXLSurfaceCmd)); assert(cmd); assert(cmd->type == QXL_SURFACE_CMD_CREATE); qxl_dirty_one_surface(qxl, cmd->u.surface_create.data, diff --git a/hw/display/qxl.h b/hw/display/qxl.h index 78b3a6c9ba..bf03138ab4 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -153,6 +153,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * @qxl: QXL device * @phys: physical offset of buffer within the VRAM * @group_id: memory slot group + * @size: size of the buffer * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with @@ -166,7 +167,8 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * the incoming ram_addr_t. * */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id, + size_t size); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); From patchwork Fri Nov 25 17:31:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628561 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp1273729pvb; Fri, 25 Nov 2022 09:32:18 -0800 (PST) X-Google-Smtp-Source: AA0mqf5bJ7e04f4Sc3ooxLpOlir70OmFbYKkjeUMnQjVgFexSbfPBsyXhrs2c72bYaGSM9ieKq4x X-Received: by 2002:ae9:e644:0:b0:6f6:ff30:1ff6 with SMTP id x4-20020ae9e644000000b006f6ff301ff6mr19322921qkl.205.1669397538296; Fri, 25 Nov 2022 09:32:18 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669397538; cv=none; d=google.com; s=arc-20160816; b=C5Zk1b11Qbb+VE6NndDuiacljfLF4IxvD/PMpXxiAGBZo7nOtv27aFWMzlsCduILq+ 1RGCggY6IPhUn08L/grT+J/aphQc3TX0Q2Ry56FuoiLezn66uNE055+BxbGtt9ZGGvuu OAxyjQ3ngKv4imE2tmrUv9nxiJ6swm0vDYImCr2p1oB18Cxuk3wOv66OpooNsw5Eex8v SlTQHiZonWQmaXA5qf4ki69QEdmhYz0GgP9oklt8UQy3DqjHjVVQlrwYLZ5NZ9Zl2l/4 z4NqB1Yd/ZwouvGa43bLrsC9N+go9BLtMasmDzP9k6V+OdAMTxipH9mq7mJ56e9ulzsn 1LZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=/bWbtdqAUbu0hq+grjo2KrcGsDO+Qr3IZNc4f7/ntsA=; b=rVUGUyWlxvnDA+TZxM60FlaQbKvUX/plhd1lYIT+Ak4bfHATlGo/5MhWsHOJrgsSb9 5SOd8IkRibiSWQijiZ+32pUoRd0giURzhVEy2hNmItTW1c502a8yJ/8yZ4KEJAcrjuTY dDNlao7lxejzQG/r6/Uct6wQwT/QbZgXxVCTwqMFDWKzGneP7+l2PMtuk+uExHUWZd0b o97h2g2kxU/QEfypFnDu006aAELhIdZHEfyRhYhiOj3ORGIbmtOZHFJiTUi4gwtNlAN8 yv7j2Kkn1C1ng4OGOk/FvNeC/md0Mkm+/DqlTMCUz/HkPar2k2bNoI8RDKlMx/4TyylJ uadA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Y0CNghks; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id i14-20020a05620a248e00b006f3cdab0355si3091975qkn.464.2022.11.25.09.32.18 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Fri, 25 Nov 2022 09:32:18 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Y0CNghks; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oycY5-00056d-LM; Fri, 25 Nov 2022 12:31:37 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oycY4-000562-2e for qemu-devel@nongnu.org; Fri, 25 Nov 2022 12:31:36 -0500 Received: from mail-wr1-x431.google.com ([2a00:1450:4864:20::431]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oycY2-0004dU-9d for qemu-devel@nongnu.org; Fri, 25 Nov 2022 12:31:35 -0500 Received: by mail-wr1-x431.google.com with SMTP id d1so7762595wrs.12 for ; Fri, 25 Nov 2022 09:31:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/bWbtdqAUbu0hq+grjo2KrcGsDO+Qr3IZNc4f7/ntsA=; b=Y0CNghks3gF1uKFAOoKOb6t2IbrM3U17ln8y1FKeR6Tf4keggpf8OiVrOQG3IIpA3O ZVby91vTOYWUrxolPlsS5eWUt8DbLBtpL1/0jl73j3j1LA6kueRqqzYWEMi687qQdNOv qFWkf0V/QVAofNkQQvolovOtZAuBbUmi8xgSVuGbsfdBDhrRx03ZJfy1kCu5A08K7Q5Q FPlYCmqyqGB1+fIvGQ8Lz81Pj+TVgFtzHWFDjEL5NByD3SZoF8AISFNYTcf7/9vLtIP9 yDHoRDngDApS/omsHyDVx2ixy3bqQfzJjekmtwID59qXyIvlXYNlH9KOHdDserHIqJCD V9ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/bWbtdqAUbu0hq+grjo2KrcGsDO+Qr3IZNc4f7/ntsA=; b=ay27fsbxmotrpXrqPi5qrbvBD+8SyvscyWaQ68Nh17ZzXiTdjApf5eNmF+/XTUMQ5X gSvztf2NPZiEuNeIEXbYdh4juPmzaWGBpGstxq+rAHAHKSuPnTHq7GyBJR+zukJQXZK+ MWPKTZ3Qfo0wgAttSDB7lwXltrxviWzO9XKAfTf2ve/57kKMb6phEhTSI40AZoBa7WZq Zk5qOmUePM+rD+xMWXHlNbDnllGFOiOKvk/H6KNYoSSJ8jBxm5tfwbSwmyBFf7t2tq01 5+/ozAMm+atvF2jxsksix4snpdJ1EREPaoLzH/Cbyz+WU2zx8A63N4w52fZSN04H2LJu /XZQ== X-Gm-Message-State: ANoB5pncdPa9Ekf1uNi9GS/Fo9yXV1vsLXqeQJLEAmMlwa/STPeTcBVd ZyDQj1TgirMNtKkRUkP+8wffxry7xqGfyw== X-Received: by 2002:adf:f10d:0:b0:241:c0e3:ad9d with SMTP id r13-20020adff10d000000b00241c0e3ad9dmr17182943wro.338.1669397492490; Fri, 25 Nov 2022 09:31:32 -0800 (PST) Received: from localhost.localdomain ([185.126.107.38]) by smtp.gmail.com with ESMTPSA id bx9-20020a5d5b09000000b002365254ea42sm4320358wrb.1.2022.11.25.09.31.31 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 25 Nov 2022 09:31:31 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Mauro Matteo Cascella , Alexander Bulekov , Peter Maydell , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 4/4] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) Date: Fri, 25 Nov 2022 18:31:19 +0100 Message-Id: <20221125173119.46665-2-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221125173119.46665-1-philmd@linaro.org> References: <20221125154030.42108-1-philmd@linaro.org> <20221125173119.46665-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::431; envelope-from=philmd@linaro.org; helo=mail-wr1-x431.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Return NULL if the requested buffer size does not fit within the slot memory region. Reported-by: Wenxu Yin (@awxylitol) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336 Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl.c | 11 ++++++++++- hw/display/qxl.h | 2 +- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 231d733250..e5e162f82d 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1462,7 +1462,7 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, size_t size) { - uint64_t offset; + uint64_t offset, ptr_end_offset; uint32_t slot; void *ptr; @@ -1474,6 +1474,15 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) { return NULL; } + + ptr_end_offset = qxl->guest_slots[slot].offset + offset + size; + if (ptr_end_offset > memory_region_size(qxl->guest_slots[slot].mr)) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" size %zu: " + "overrun by %"PRIu64" bytes\n", + slot, offset, size, ptr_end_offset - offset); + return NULL; + } ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); ptr += qxl->guest_slots[slot].offset; ptr += offset; diff --git a/hw/display/qxl.h b/hw/display/qxl.h index bf03138ab4..7894bd5134 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -157,7 +157,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with - * the @qxl device. If the slot is inactive, or the offset is out + * the @qxl device. If the slot is inactive, or the offset + size are out * of the memory region, returns NULL. * * Use with care; by the time this function returns, the returned pointer is