From patchwork Mon Nov 28 13:48:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628988 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp2960955pvb; Mon, 28 Nov 2022 05:49:48 -0800 (PST) X-Google-Smtp-Source: AA0mqf6a9a0MrXOCgajiy4fPUEnOtlzEt3qWLWK4Vutb1fbTIf1sWWdxweKxnQlQF/v+oRfv8hJ3 X-Received: by 2002:ac8:498a:0:b0:3a5:1c61:230c with SMTP id f10-20020ac8498a000000b003a51c61230cmr34533687qtq.29.1669643388477; Mon, 28 Nov 2022 05:49:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669643388; cv=none; d=google.com; s=arc-20160816; b=IO0XG4+WFeqNnMEGxlWN9Ghve1+KujwBBgELjabi50fcI/M9iZ764rvpfwiMTvHVsW 0OF2njAC3EQH5Z7s7Kv3EeKQ1YdYc38NSFuW20DO6e+78p34FFnFYgI8LubMslCqF5eZ OmoZLpdjWChUXe66kENi7mxIpkwajFyMzx6mYSuru1zgJ/zD7J0s8uaXCPOiTR38K7ul 9QbEcmdw7RRE1qkG0T/zxu2M23ZzKXxTWSG35/Two4E4RIM9SoFrAlJWAAR1GROp0E8+ CcZKXjeDsqvJczk+fdZj8zuYxld/xIGvWWKiLtBzoH8BEd46Exu8G5dJxSredYb3+oKG /yLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=OO2vmfFX39quPUGlCLdPg4Q6N1oEzdAB2g2d0ruq8Jje5DHhP9VpRiWe8hRIYacASH pAj53G7W4HPuDpKDslKduij7h4FrBz+tmUSDEpnLWzWzvPJtF+OCon/snaYBqCcZKynV kjhRbu4PjJI4Gp8mogo4RJzcMRAAM1KzMOZFGlfTgWzutOvhtEoAmI2tEHuOUNHj9V5k cb5Aa4rHOX8iWFDyGcU9luqXKgL1nZD2lmI43NoIfmkZS7L1VNZh2gpnFf8+B4VGO9Ug anwJ8rz44MVr0HyJ6JpKq/1OuVluzKFl3ve1cs7ng47djd1jqziaPxWnnDPHzv5YZBgl 3hYA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=kYL3A7aq; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6-20020a05621420c600b004c6e2c3972fsi7015822qve.584.2022.11.28.05.49.48 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 28 Nov 2022 05:49:48 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=kYL3A7aq; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeV2-0004tP-OE; Mon, 28 Nov 2022 08:48:44 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeV1-0004t9-7a for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:43 -0500 Received: from mail-wm1-x329.google.com ([2a00:1450:4864:20::329]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeUz-0000Hq-6i for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:42 -0500 Received: by mail-wm1-x329.google.com with SMTP id ay14-20020a05600c1e0e00b003cf6ab34b61so11674651wmb.2 for ; Mon, 28 Nov 2022 05:48:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=kYL3A7aqILslZh5SGQrbc1YKknxmIPXfWsAic8JV3eiYGqioyfBs1QYZIo/8AXiWg2 uQNo3+QQAiysWtOPy9hfbqC2CteMNFMAFb3Y6ytJtU54YHibyfIyeCw0htqJ9ZJ3qU+u NUBh5ZDavUvFSEmB44qTi40s4sweglbNe1UnBuS+Fe+HDCiFkpUlliyWRdcgynkRRKrA uK0YksAzKypQe/QPb31YY3D4CP9LlVD6gl61rfrLF/Ztcu9YAMj3S91HzuhaYgiANv7X ZUYhSQZ6F1+3PAkdbzxx3SLSg6z+BzO+pdaTPAqFyUdblZPa56XVOtl0bo9A0QxA6fEK M12g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=iYHeDZzoQ050kMmL2gly3nfjXqnhqur/NbBZzIah+Ds=; b=qnHTv13hOtVD8I2sU1nRtexknntVAF0U2qO7IVldXK8AwRXjUQjbJxAh7B7FH54cU5 TTGM8M7Gm2uR4oFG6aZE1NVv57njHlQNX6drpvUmuAjukfWisu3Iiyx1fWdS7/7jVnPy I0vTkNlbjtoU1HEhPcCp7Jnv/qyYpNJOyosI78NWZDExGoYtjRZfzP9At33zEYfVUXnq Pm+iVvPy29Uq19EwIzC3+ib/IiVFzBp89pZ/O8LqHy7ZJqtDFpDHy8T2gnYShVuBxaDA qqbDAvLDpDX4hDbVE4HQFjauC1hF/BlZmDiLmq2o1dYlOLvnQ3QVP+ety9FVJY1g/cJ3 v2aw== X-Gm-Message-State: ANoB5pmsOMyXD3WEjTXhucI+j3TWT8waeNA/STk7BWSg6xybBtzsoEDe RY1ndq+dWQEYyJfKuPn6JUEthA== X-Received: by 2002:a05:600c:3b8f:b0:3d0:2485:c06a with SMTP id n15-20020a05600c3b8f00b003d02485c06amr27019175wms.26.1669643319634; Mon, 28 Nov 2022 05:48:39 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id s11-20020a5d69cb000000b002366f9bd717sm12819084wrw.45.2022.11.28.05.48.38 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:38 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [PATCH-for-7.2 1/5] hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler Date: Mon, 28 Nov 2022 14:48:28 +0100 Message-Id: <20221128134832.84867-2-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::329; envelope-from=philmd@linaro.org; helo=mail-wm1-x329.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Only 3 command types are logged: no need to call qxl_phys2virt() for the other types. Using different cases will help to pass different structure sizes to qxl_phys2virt() in a pair of commits. Reviewed-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl-logger.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 68bfa47568..1bcf803db6 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -247,6 +247,16 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) qxl_name(qxl_type, ext->cmd.type), compat ? "(compat)" : ""); + switch (ext->cmd.type) { + case QXL_CMD_DRAW: + break; + case QXL_CMD_SURFACE: + break; + case QXL_CMD_CURSOR: + break; + default: + goto out; + } data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); if (!data) { return 1; @@ -269,6 +279,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) qxl_log_cmd_cursor(qxl, data, ext->group_id); break; } +out: fprintf(stderr, "\n"); return 0; } From patchwork Mon Nov 28 13:48:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628990 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp2960959pvb; Mon, 28 Nov 2022 05:49:48 -0800 (PST) X-Google-Smtp-Source: AA0mqf6oX/rXLNUW47P1RgudCNu95E+0MbUdMq5y91h5uO3I5JF3LOPw5jAAVKxOwWU8L4x+n7te X-Received: by 2002:a05:620a:6d7:b0:6fa:a605:ea6c with SMTP id 23-20020a05620a06d700b006faa605ea6cmr45394907qky.465.1669643388708; Mon, 28 Nov 2022 05:49:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669643388; cv=none; d=google.com; s=arc-20160816; b=WAEVHhWUEp65uCemJI2iaDD0BTj1KvI6icLr5vVVtDhGA8qhrmC1tsDPYzc1csMWQX kFtPxxpEe2X0m8gdIG9mvEI+Aj/b+fpacIO6JF7RXJQ4wPo1m/r9TxvjOp9ToYhTNfIR /On5w/6rjLhsKYnH7ywLJ5CaWHVRoO8PwyHPaqix9X/AEFJtjqaAYjQbdWJyEU2LFcm+ 6BQHiL+GvXqKbhGAY+BIUUycgcjjdVEId98ENv9uMViA0hf2AjYkdVrRNwnt1Tvpa1Mz J7xDFRsrgnvlPOM4Dx+fzgI8v2sEKBVfUAbvIqddogdCLrnYr1YQFtQZrqfaXTK8VZk7 G3OQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=MQbQkx5pgH1jpFlaYKoSUiLHDRlmv6MyNtge9XzpMGIXaIzRRX4OdxIy8BRseLFhQw poP6hj9FbcGBGkPlh+A34u4eoozmo4Z8G3+CfbxUfCUpjCuey6JpcJToowKqm9wsfiG0 D7u38DHkQ5EGEWC+YrTkwmf+Xry1OFi+EMDJKU3tkFdm3DbATDAMz3ozqGUDEWOV0t6J E12jfPOEtdYmI2tgujXGbmz11ZlCOxnEAJUyUyL/6BVfaxWm1R9FLAB0BgNKWlRYWlP6 cGArazjKypvqedE6oZepCEXnLT1IKgUPNyVXoBPBOQ+nSvHvvp0elzSWtwNzJWPe3nMx GAJA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Oby9ef7P; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id v6-20020ac87486000000b003a4ea215bfcsi7096377qtq.582.2022.11.28.05.49.48 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 28 Nov 2022 05:49:48 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Oby9ef7P; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVB-0004vg-Ji; Mon, 28 Nov 2022 08:48:53 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeV5-0004u1-D9 for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:47 -0500 Received: from mail-wm1-x336.google.com ([2a00:1450:4864:20::336]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeV3-0000Ih-Tv for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:47 -0500 Received: by mail-wm1-x336.google.com with SMTP id t25-20020a1c7719000000b003cfa34ea516so9488092wmi.1 for ; Mon, 28 Nov 2022 05:48:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=Oby9ef7PoHRY6bMl/8OjOSyn41pKYJCZMMbvmgG1Tt3Epu4yFqSKOKTQJzT5P1jHoW p7J8PJy9MbAT++jQ3XUEwL6fWgd3bMytwUUxGQQLzxGvqHsCQ8P6CDXKjlNDdBPfpis0 CwU8XQOlvz0C/XpZkvNMG3T/sxOkq6XY7GGGX13PDHhLs+z9qiJoP9zzlurlp8cLKzGD 0I3KnJSMpWqbe/vIaWpMyKKYk40L0TS5evntWecPeRau/D5MIewzD3IxQ6YnzRAhKYg1 MAt/mzbY2Wn7P3hIGPipt85/A3rstEj5nmDmxWXAvURhVk6slODpLon5QiFFqU6wEotI bXWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=W0LmLK78PoGRSMUT27s353jmU2diODdc3ZkNcicNIYI=; b=RvwB5TaySx/M6s+g6Br//1qgVxMlDsAkf7WYcboXiU1lwaLiUWqyz3vokJYaAE7H5X NQDY+9akq/nBIYKhgzjtZ+JXWaB7Qexo3wVMGafyHEtCc4RtBFh5Bk9b4EdWT26GksmM a26iouB2SI3M/dcGHqUUEu4Rk93l3enxYex5hJ6KCXXBXgq7emJcMgkZun3VvNyvvPgj C2JkVW2mHMYPeE3zv1EFXKwKx75q58aLtY9rQfyQkcyO26lGQNRNo5VpzlFaq98ConNg pId/wUYbEIt/Fk43MiYm+Ye3OA6Ghd740ufpB1D6rkpTvM3SDL4uQ1r8k2kmYXsCgM+7 d27Q== X-Gm-Message-State: ANoB5pme4Xbc8AlIOzFkiohxL/NbSeqZRmzv+hEF/QjlfmgXJCkcDglg D83DqJVUKOCUGN3Vo/Ug/3uOUNcBnwjJuz6m X-Received: by 2002:a05:600c:1f0f:b0:3d0:2a82:1cb2 with SMTP id bd15-20020a05600c1f0f00b003d02a821cb2mr23452111wmb.206.1669643324692; Mon, 28 Nov 2022 05:48:44 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id u22-20020a7bc056000000b003c6c1686b10sm18591855wmc.7.2022.11.28.05.48.43 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:44 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [PATCH-for-7.2 2/5] hw/display/qxl: Document qxl_phys2virt() Date: Mon, 28 Nov 2022 14:48:29 +0100 Message-Id: <20221128134832.84867-3-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::336; envelope-from=philmd@linaro.org; helo=mail-wm1-x336.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Reviewed-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/hw/display/qxl.h b/hw/display/qxl.h index e74de9579d..78b3a6c9ba 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -147,6 +147,25 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) #define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1) /* qxl.c */ +/** + * qxl_phys2virt: Get a pointer within a PCI VRAM memory region. + * + * @qxl: QXL device + * @phys: physical offset of buffer within the VRAM + * @group_id: memory slot group + * + * Returns a host pointer to a buffer placed at offset @phys within the + * active slot @group_id of the PCI VGA RAM memory region associated with + * the @qxl device. If the slot is inactive, or the offset is out + * of the memory region, returns NULL. + * + * Use with care; by the time this function returns, the returned pointer is + * not protected by RCU anymore. If the caller is not within an RCU critical + * section and does not hold the iothread lock, it must have other means of + * protecting the pointer, such as a reference to the region that includes + * the incoming ram_addr_t. + * + */ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); From patchwork Mon Nov 28 13:48:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628992 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp2961376pvb; Mon, 28 Nov 2022 05:50:30 -0800 (PST) X-Google-Smtp-Source: AA0mqf6Cj9fO/Mv182pyoTgaoRRIxKyDLqwz7/OzwzvLry3LGUU5YDrs5/94hHXCP5dVyS2XewEq X-Received: by 2002:a37:ac11:0:b0:6fa:546e:52c2 with SMTP id e17-20020a37ac11000000b006fa546e52c2mr45357623qkm.382.1669643430030; Mon, 28 Nov 2022 05:50:30 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669643430; cv=none; d=google.com; s=arc-20160816; b=g1SvdpZuX5Clesdl+xSCcSTia0wm5K4aJreBGq3GPm00GudSC6ZpPWq8QPICK0h77f 1gQv3HZ2azsg0jSnOH0mVeNogv4z1yVPLZXux3olEm/pY2X4zQCPyAXKvOnrlrWnFy2A X1aiYsssnw+ZRfPXQmzgl52aJ+o+X8CpOK+Q4mIvsDmuCTKOZDQ2IFL3BesHkMs/7Te8 zxFjEqMIFq7utlPXKQ9orhjbaZ5WXGcTDRC3684Azb5kBi//km8tokdDERaUbD6R+U60 QavtFeSn82rTeBxhRqXe+Bs+F6m0rEY+yzg+Mut5iYP4EOPXIrzqOq8JDaFeFZs7rVkf gcUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=S7D+d8eEFQLQo0a3Gz63sFJ0FG/+mr7I9TtlhyLQ2/SgT2IZMMnrwq0Zjt97wrlXoa 4UrAZnGBSfbB3ZSD44ONvPsJiui+8hkghkvGAb1HMJ8yd4P3pyxg2sIdn0Gymxdocpey Ef4s7kjygNGaTn3hdH7jTmr9HKLd6buI9KDwmfpeVpZuckyMWfZ/FkV+j0yf7uUjQa01 jV5ClIMpxkzyocgeAv975Gj7oVfsFfNfti9EQFh7LHD2SGC4SVukRjSIoIrm6GohNJv1 EsaDw/ILJoCllDS4QjrwU3ctOfYr/7cyRWv2VWSbHzTql+MkJLUkszA57mHx12zDYB8L Uimg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=HxlkcG01; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id w7-20020a05620a444700b006fc447eebeesi7346758qkp.564.2022.11.28.05.50.29 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 28 Nov 2022 05:50:30 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=HxlkcG01; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVE-0004wB-C8; Mon, 28 Nov 2022 08:48:56 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVC-0004w1-Fe for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:54 -0500 Received: from mail-wm1-x331.google.com ([2a00:1450:4864:20::331]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVA-0000JN-KW for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:54 -0500 Received: by mail-wm1-x331.google.com with SMTP id c65-20020a1c3544000000b003cfffd00fc0so11695181wma.1 for ; Mon, 28 Nov 2022 05:48:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=HxlkcG019F78hDHWklx7b3JvpZQDvFiwRQqjOn04g5BYWdnFoEpaSEooBeXLfZ55SU PYj0gXwSmKBTHbxsLeeFFYOpB5Dbk8ANQ7VonQoIuG8chMEm4+ZDra45OfAzmLwk1vAo /gKpMiXIFgGWOLCRdLeG3wwSavuLkN1qbAAwsRJuNc41kWg3PGw33SYX3MhsjuSU0kKO YmfyoaOzjW0CAGTM6u/Z/cn+FcZwl96dAQfYTXKUZEu6SvKUKYvGRnXSG6iE8AeqJVah 0QpxMYugczZtn5+8xDQFyGuKYBBgv0kz0XdQeWagQ9SfHQbzEM9snmePvq8JydJtrr3g fvpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cLBqjxMlolU+cJ4fFCwWxvJIFOEEf1cRd8fhzl0z5Pw=; b=bYyoxW2gSD2sj+q5rMtRhXCDf33R8qp7wbZUEbd7pgEkgPk1oWgixfKJZTtDISGFZD ZVLQ2nsHpseIKfRyLhuGO3xloTlrdqVqqf48OC2x38BJePZYKSGzaCmdbW/k9xkGn06p o67+Jt6CXDJgfqMywvSmrUvqEpJKHvjgq+rYayJDS85zN5UbKKcjo5TVls8wtRrPPVJB W9au15Xl8G9iUw9k6lVpKcO7oM3JGIN+kKeZ2l65d7ai2SuhDLD8uBE1Mt9RzJdOUdZp vV7IrZJhI2bvRCapQGetR6tXp+KrenvjeTN+46ZKLY98DTanyPtnUJvVl0bSQLhTyc+s 9zaw== X-Gm-Message-State: ANoB5pkdGhajNXQu6nQX8wimyXoRu14eQR2/wQH1zmuxiV49965I8rkF 6krkeQN3NO2gW+h6O3nYBIA2IA== X-Received: by 2002:a7b:cb91:0:b0:3c6:cb54:ef66 with SMTP id m17-20020a7bcb91000000b003c6cb54ef66mr27123949wmi.90.1669643329584; Mon, 28 Nov 2022 05:48:49 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id a12-20020adfe5cc000000b0022cc3e67fc5sm10674115wrn.65.2022.11.28.05.48.48 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:49 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 3/5] hw/display/qxl: Pass requested buffer size to qxl_phys2virt() Date: Mon, 28 Nov 2022 14:48:30 +0100 Message-Id: <20221128134832.84867-4-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::331; envelope-from=philmd@linaro.org; helo=mail-wm1-x331.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Currently qxl_phys2virt() doesn't check for buffer overrun. In order to do so in the next commit, pass the buffer size as argument. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Marc-André Lureau --- RFC: Please double-check qxl_render_update_area_unlocked() --- hw/display/qxl-logger.c | 11 ++++++++--- hw/display/qxl-render.c | 12 ++++++++---- hw/display/qxl.c | 14 +++++++++----- hw/display/qxl.h | 4 +++- 4 files changed, 28 insertions(+), 13 deletions(-) diff --git a/hw/display/qxl-logger.c b/hw/display/qxl-logger.c index 1bcf803db6..35c38f6252 100644 --- a/hw/display/qxl-logger.c +++ b/hw/display/qxl-logger.c @@ -106,7 +106,7 @@ static int qxl_log_image(PCIQXLDevice *qxl, QXLPHYSICAL addr, int group_id) QXLImage *image; QXLImageDescriptor *desc; - image = qxl_phys2virt(qxl, addr, group_id); + image = qxl_phys2virt(qxl, addr, group_id, sizeof(QXLImage)); if (!image) { return 1; } @@ -214,7 +214,8 @@ int qxl_log_cmd_cursor(PCIQXLDevice *qxl, QXLCursorCmd *cmd, int group_id) cmd->u.set.position.y, cmd->u.set.visible ? "yes" : "no", cmd->u.set.shape); - cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id); + cursor = qxl_phys2virt(qxl, cmd->u.set.shape, group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } @@ -236,6 +237,7 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) { bool compat = ext->flags & QXL_COMMAND_FLAG_COMPAT; void *data; + size_t datasz; int ret; if (!qxl->cmdlog) { @@ -249,15 +251,18 @@ int qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) switch (ext->cmd.type) { case QXL_CMD_DRAW: + datasz = compat ? sizeof(QXLCompatDrawable) : sizeof(QXLDrawable); break; case QXL_CMD_SURFACE: + datasz = sizeof(QXLSurfaceCmd); break; case QXL_CMD_CURSOR: + datasz = sizeof(QXLCursorCmd); break; default: goto out; } - data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, datasz); if (!data) { return 1; } diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c index ca217004bf..0a4bfa8aa6 100644 --- a/hw/display/qxl-render.c +++ b/hw/display/qxl-render.c @@ -107,7 +107,9 @@ static void qxl_render_update_area_unlocked(PCIQXLDevice *qxl) qxl->guest_primary.resized = 0; qxl->guest_primary.data = qxl_phys2virt(qxl, qxl->guest_primary.surface.mem, - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, + qxl->guest_primary.abs_stride + * height); if (!qxl->guest_primary.data) { goto end; } @@ -228,7 +230,7 @@ static void qxl_unpack_chunks(void *dest, size_t size, PCIQXLDevice *qxl, if (offset == size) { return; } - chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id); + chunk = qxl_phys2virt(qxl, chunk->next_chunk, group_id, bytes); if (!chunk) { return; } @@ -295,7 +297,8 @@ fail: /* called from spice server thread context only */ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) { - QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLCursorCmd)); QXLCursor *cursor; QEMUCursor *c; @@ -314,7 +317,8 @@ int qxl_render_cursor(PCIQXLDevice *qxl, QXLCommandExt *ext) } switch (cmd->type) { case QXL_CURSOR_SET: - cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id); + cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, + sizeof(QXLCursor)); if (!cursor) { return 1; } diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 5b10f697f1..231d733250 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -274,7 +274,8 @@ static void qxl_spice_monitors_config_async(PCIQXLDevice *qxl, int replay) QXL_IO_MONITORS_CONFIG_ASYNC)); } - cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST); + cfg = qxl_phys2virt(qxl, qxl->guest_monitors_config, MEMSLOT_GROUP_GUEST, + sizeof(QXLMonitorsConfig)); if (cfg != NULL && cfg->count == 1) { qxl->guest_primary.resized = 1; qxl->guest_head0_width = cfg->heads[0].width; @@ -459,7 +460,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) switch (le32_to_cpu(ext->cmd.type)) { case QXL_CMD_SURFACE: { - QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLSurfaceCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLSurfaceCmd)); if (!cmd) { return 1; @@ -494,7 +496,8 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) } case QXL_CMD_CURSOR: { - QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); + QXLCursorCmd *cmd = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id, + sizeof(QXLCursorCmd)); if (!cmd) { return 1; @@ -1456,7 +1459,8 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, } /* can be also called from spice server thread context */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, + size_t size) { uint64_t offset; uint32_t slot; @@ -1964,7 +1968,7 @@ static void qxl_dirty_surfaces(PCIQXLDevice *qxl) } cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i], - MEMSLOT_GROUP_GUEST); + MEMSLOT_GROUP_GUEST, sizeof(QXLSurfaceCmd)); assert(cmd); assert(cmd->type == QXL_SURFACE_CMD_CREATE); qxl_dirty_one_surface(qxl, cmd->u.surface_create.data, diff --git a/hw/display/qxl.h b/hw/display/qxl.h index 78b3a6c9ba..bf03138ab4 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -153,6 +153,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * @qxl: QXL device * @phys: physical offset of buffer within the VRAM * @group_id: memory slot group + * @size: size of the buffer * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with @@ -166,7 +167,8 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * the incoming ram_addr_t. * */ -void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); +void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id, + size_t size); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) G_GNUC_PRINTF(2, 3); From patchwork Mon Nov 28 13:48:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628989 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp2960957pvb; Mon, 28 Nov 2022 05:49:48 -0800 (PST) X-Google-Smtp-Source: AA0mqf7/RDckF9OhWL3OBm4jmpcHiUajFET3RYEH4zZQQ3uRYssWSBcwnil+2TjPNL6tRdOXGAaR X-Received: by 2002:a05:6214:4290:b0:4bb:5d3a:bdad with SMTP id og16-20020a056214429000b004bb5d3abdadmr29147726qvb.26.1669643388562; Mon, 28 Nov 2022 05:49:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669643388; cv=none; d=google.com; s=arc-20160816; b=jq8KFVO39LeaXIUbFy3F0fq47qshNcu71g+syAen7MqMJh+JoQ7GMphf+XqjEpkovo bs4usqXk0od87osIu8Ei4dhRAW++o5Q85qnb2PFJE94S3BowkhACymXj1G37Q1CI/ayf sl20GIWlu1s+A8bqJPi5uiz5G8p9S1gjHn42tBYodcKf0jwMsr5ykaUAg3fpmye3cfn/ evTsXSf5SU8yUBwYCCUYr3qcf7EMThfOLQFwKBMPmDOUYV1MIbtEWSxtxMWyYTK9EVDr JMSH4wG63C7JqwZaUzCCIzn49FB2uSB/LAL/AHXEzAJNA72MfZcn71GeC7TpeC9t2sFX fXHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=g3fCJyYwSedWhXfNerSPhzSg89ZMZxiPa2PBLeHLu3zR/jHsQ/faU9s0LGVBF5roUG 2iJDlw0rgtSpgO4QvDAOhEhFCSMa0ty/AT8IMzXjPfDdhWVyxmtEWWqBQ/yw9B51Fmes TYTFwlR9mLXIj5Ty3Kd+tUXgOpFKM18r5pdIbIeWaWivmJbOOd2ArinQyyQI0wTCP1ik HW4J2OacD/xqFFbZD516o7rTElXQl+oiruim9wgaFVQtMX9Lv1/LZaaSWj/B4YrInT+L dIKuD3FtdTF3JvhXvSluzBYpwitRHQEWieeIdf58S1YIHeRB9VDPcaju1FQYc7ZGYVO1 zbeQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rtgMN5Pw; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id x20-20020ac87ed4000000b003a2c2ec29e8si6699413qtj.194.2022.11.28.05.49.48 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 28 Nov 2022 05:49:48 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rtgMN5Pw; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVH-0004yl-H2; Mon, 28 Nov 2022 08:48:59 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVG-0004xN-09 for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:58 -0500 Received: from mail-wr1-x434.google.com ([2a00:1450:4864:20::434]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVE-0000Jt-9l for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:48:57 -0500 Received: by mail-wr1-x434.google.com with SMTP id g12so16877168wrs.10 for ; Mon, 28 Nov 2022 05:48:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=rtgMN5PwHDJ4483KQ5llJcVXxtK9fVGm60c5eWEbrX3MKDl2fKksm9eD4V4RKe/VoN zV5ws3igg5SdydWqYU3AUIZX4Al46H9DjmgG5Z7ab6RJMzuYjMM9YvKW9AFtENzg0ggX yAEqvcSMpweFZ67UsFVVdRFvGswg/BCQIByu7MCUobGrVV1LLRkzTXGyG4t5GidXL6kW 0m3IkGyQMpLmjLyuwVB5uNVJiSD5BnK9NYSpNJOKvkIre/QOcYX6JGnjp/jFDbRv+3wV 9qao2u2ETGfQ4AQVzLuMVj+A7gJrI87NzIbCtLbsu9fAkEpafyxyodx3qRW0tNs9Qz0p CFBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mjNbgTf1E7AI00TEfhwYXvMQtqcc4snLWTKJDvPZcks=; b=de+EXQpaUyZbzYoB1OppY3S6Xt6zCmX7uVWzQNxuO7hhvueCzVqFfPL4U1lfZQzBJ8 7jLVS1oG20FptRiQnb2Xuk9lDbYcoNLCHm5hiENW0WDfXnvCSYTDt5XZ1yZ22Kd385WL SmKHTRy+lwf166Pj/Qwi+HzbD+Y56/OUwc8XIku/lOLsD9hwsZBiix+BKsU+b7M6/7Ef ICmV4z8I6nIK6+ewT2YfgcdpaNwAoVVIqoaIoINcC8CajMZNnir/KHUFr38fpXP7hT2D b3Eef9pDp+G6F5aLgCEBQCJ44K6jogDR222+tisJ9MjmUGhKuLuLy+0Rkbg7xJmgYLYj f1Ew== X-Gm-Message-State: ANoB5pnmCA3N31VU6wBod3ONmZ11HfFz8aWpnYUYILpfCD8eWff7Ee+O tu9d/ywEgGGXUtgtxbtCUU/rfA== X-Received: by 2002:adf:e68a:0:b0:242:1926:7838 with SMTP id r10-20020adfe68a000000b0024219267838mr2461131wrm.200.1669643334893; Mon, 28 Nov 2022 05:48:54 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id q4-20020adff944000000b002366c3eefccsm10955690wrr.109.2022.11.28.05.48.53 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:54 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [RFC PATCH-for-7.2 4/5] hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) Date: Mon, 28 Nov 2022 14:48:31 +0100 Message-Id: <20221128134832.84867-5-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::434; envelope-from=philmd@linaro.org; helo=mail-wr1-x434.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Have qxl_get_check_slot_offset() return false if the requested buffer size does not fit within the slot memory region. Similarly qxl_phys2virt() now returns NULL in such case, and qxl_dirty_one_surface() aborts. This avoids buffer overrun in the host pointer returned by memory_region_get_ram_ptr(). Fixes: CVE-2022-4144 (out-of-bounds read) Reported-by: Wenxu Yin (@awxylitol) Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1336 Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl.c | 22 ++++++++++++++++++---- hw/display/qxl.h | 2 +- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index 231d733250..afa157d327 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1424,11 +1424,13 @@ static void qxl_reset_surfaces(PCIQXLDevice *d) /* can be also called from spice server thread context */ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, - uint32_t *s, uint64_t *o) + uint32_t *s, uint64_t *o, + size_t size_requested) { uint64_t phys = le64_to_cpu(pqxl); uint32_t slot = (phys >> (64 - 8)) & 0xff; uint64_t offset = phys & 0xffffffffffff; + uint64_t size_available; if (slot >= NUM_MEMSLOTS) { qxl_set_guest_bug(qxl, "slot too large %d >= %d", slot, @@ -1453,6 +1455,18 @@ static bool qxl_get_check_slot_offset(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, return false; } + size_available = memory_region_size(qxl->guest_slots[slot].mr); + assert(qxl->guest_slots[slot].offset + offset < size_available); + size_available -= qxl->guest_slots[slot].offset + offset; + if (size_requested > size_available) { + qxl_set_guest_bug(qxl, + "slot %d offset %"PRIu64" size %zu: " + "overrun by %"PRIu64" bytes\n", + slot, offset, size_requested, + size_requested - size_available); + return false; + } + *s = slot; *o = offset; return true; @@ -1471,7 +1485,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id, offset = le64_to_cpu(pqxl) & 0xffffffffffff; return (void *)(intptr_t)offset; case MEMSLOT_GROUP_GUEST: - if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset)) { + if (!qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size)) { return NULL; } ptr = memory_region_get_ram_ptr(qxl->guest_slots[slot].mr); @@ -1937,9 +1951,9 @@ static void qxl_dirty_one_surface(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, uint32_t slot; bool rc; - rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset); - assert(rc == true); size = (uint64_t)height * abs(stride); + rc = qxl_get_check_slot_offset(qxl, pqxl, &slot, &offset, size); + assert(rc == true); trace_qxl_surfaces_dirty(qxl->id, offset, size); qxl_set_dirty(qxl->guest_slots[slot].mr, qxl->guest_slots[slot].offset + offset, diff --git a/hw/display/qxl.h b/hw/display/qxl.h index bf03138ab4..7894bd5134 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -157,7 +157,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) * * Returns a host pointer to a buffer placed at offset @phys within the * active slot @group_id of the PCI VGA RAM memory region associated with - * the @qxl device. If the slot is inactive, or the offset is out + * the @qxl device. If the slot is inactive, or the offset + size are out * of the memory region, returns NULL. * * Use with care; by the time this function returns, the returned pointer is From patchwork Mon Nov 28 13:48:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 628993 Delivered-To: patch@linaro.org Received: by 2002:a17:522:c983:b0:460:3032:e3c4 with SMTP id kr3csp2961815pvb; Mon, 28 Nov 2022 05:51:06 -0800 (PST) X-Google-Smtp-Source: AA0mqf4qG9dQGon5L7Da2wS5DjFrKJDVzbSqcj/eJfFQbJ26kq74JxK/ESS+AjptUlHAbwiLEwJo X-Received: by 2002:ac8:66cc:0:b0:39c:c7a1:9aca with SMTP id m12-20020ac866cc000000b0039cc7a19acamr31740557qtp.158.1669643465833; Mon, 28 Nov 2022 05:51:05 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669643465; cv=none; d=google.com; s=arc-20160816; b=NfW3mtWkHWObX+1uU06xp6XOgkblzeALrQYp8ezzVvV1L+HBUvcgcoAxZFB1BEzUWc t/3aVze6whcbBWaHNRy7GNk9jf01pR6CGJVOSC2W/cxZbj+COCIxr5Iy0vt9GWjUR7to HFaYwbxlKMv6nbP81iMk+tjeuu7O7NLlR/OxtHEfBzYpycOZSGu7VWBonlFr2IfR85J0 4AGL1Qc+NLE2UAdC3OFEQrqpc2hU2bnnLucmQkRUmlk7YwR0AShRRl/LMAW71t4RjcHO w1Qu78qWSXyHXjYG/pxGdMU4uR1xsCgutP4Lgw/8QGeJDV+Ai/EAzMSjr1XfLxNXydWY RWPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=LOFhJ6ecGIYqYIHVqdbM/RSzSAlsHPgHbfuqrGknGPx+9aOL2AoEQ2dDFo1QDzmk5W 0+MrJWbfI77ssAKVajid/x9a9zbQAwbIE1fZGR5HzVCxYeFXuCAufqybbQLJdAjx/CHd iBCoJBo+iax5OnEVSw6zMgL0Nyigi1fQf1GnoDxtrF5QetV3k0OE8gQKgsmgyA1wHB86 fSIUK3o5+8T4QGrEKMX/daGlMDRlAGav6aUV4m2Qh3Yy4DW3jS0q3+732qmiMIZBYp+I uyHjxmRXHV8+6MDiee8Wqn7eCjsj9W9pjLGBvyYOyHyGB3RAd+HWmXz8LzItmUNegl+E XE/A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=u7kjgjDT; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id v10-20020a05620a440a00b006fa60dc867esi7377023qkp.572.2022.11.28.05.51.05 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 28 Nov 2022 05:51:05 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=u7kjgjDT; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ozeVP-00050j-4J; Mon, 28 Nov 2022 08:49:07 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ozeVK-0004zm-Mz for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:49:04 -0500 Received: from mail-wr1-x42a.google.com ([2a00:1450:4864:20::42a]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ozeVJ-0000KL-6d for qemu-devel@nongnu.org; Mon, 28 Nov 2022 08:49:02 -0500 Received: by mail-wr1-x42a.google.com with SMTP id b12so16933107wrn.2 for ; Mon, 28 Nov 2022 05:49:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=u7kjgjDTgjTvxi4mknc59fI7NJa892rSTq3VdryfY7+y62JcQYQ/kDQe562HyViDgK I0BR+pPTd8iIpxTohjrOpdqMkQFoXdP7/gFWLDLlD+yoHDXWgHLcU0xOsO3HaTXlVAGd LbSTtrX1T0RNFXLugfvfZHtGevxGh4ja+BWrFGIqdewyFnnEXrC+MrPolyHrl3O2v3LT AUDbSiqis6tmxJyrfNqxUJqOd+Uo9nkWRrdAIjHAtCoE7Kfz6QmTPL2U7dPOnKfxUB+F 1qD/NB4UmsLtpNb9MqLWgz+WQF0k/zlkUpJ8mHH7GpwRDNsPU0PJw9VUSBiClCRsGLow zzPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/R4Inekw/oUXtvtZ44ZwPbcG/FwqT8jbw12rj3DWxAg=; b=tww5s3+NFMXNLUe1fxp5pHsJsdxPakgtKccZ8Z3TjscKBIUdjGweNic+kbCXohSrb2 Y2CTpCY5gXqxBCy1mVjOGp4C6BQ/5lIdF5UT+gPx+I5ZY11HKa5GdpWghQ8FJ/HPGLej Vow5Z1ixkr/UvOSBa0p/ZzX4XXETSQT2RJAKV3ags4lCsdbChB8voQUGOrIle4qVysCD 5TsKzYl9GjABv9rx3KxJZTNZHb5xvJ6YbiBTdFisbctWE6mghKxApR+fui4NDL6cQPph 9P7Olx42n8V9njAH55XUoGQ4+9P7Kl6WkG+4sogfaP67zEyLRM2DN4TvPC4IKSi0btGi MUww== X-Gm-Message-State: ANoB5pmYoes3gnEPkG/oonkwpUWvK/D6RS8aqnG6M9hsV/4ivkuFNnmf H8WakraRYAR7DMXDokwmwUkGdw== X-Received: by 2002:adf:f0d1:0:b0:242:285:6b21 with SMTP id x17-20020adff0d1000000b0024202856b21mr11735439wro.35.1669643339906; Mon, 28 Nov 2022 05:48:59 -0800 (PST) Received: from localhost.localdomain ([81.0.6.76]) by smtp.gmail.com with ESMTPSA id v8-20020adfebc8000000b00236545edc91sm10979357wrn.76.2022.11.28.05.48.58 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 28 Nov 2022 05:48:59 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , qemu-devel@nongnu.org Cc: Alexander Bulekov , Peter Maydell , Gerd Hoffmann , Mauro Matteo Cascella , Paolo Bonzini , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Subject: [PATCH-for-8.0 5/5] hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion Date: Mon, 28 Nov 2022 14:48:32 +0100 Message-Id: <20221128134832.84867-6-philmd@linaro.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221128134832.84867-1-philmd@linaro.org> References: <20221128134832.84867-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::42a; envelope-from=philmd@linaro.org; helo=mail-wr1-x42a.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Signed-off-by: Philippe Mathieu-Daudé --- hw/display/qxl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/display/qxl.c b/hw/display/qxl.c index afa157d327..8468513f41 100644 --- a/hw/display/qxl.c +++ b/hw/display/qxl.c @@ -1384,6 +1384,7 @@ static int qxl_add_memslot(PCIQXLDevice *d, uint32_t slot_id, uint64_t delta, qxl_set_guest_bug(d, "%s: pci_region = %d", __func__, pci_region); return 1; } + assert(guest_end - pci_start <= memory_region_size(mr)); virt_start = (intptr_t)memory_region_get_ram_ptr(mr); memslot.slot_id = slot_id;