From nobody Mon Feb 9 02:27:50 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1490857062244946.5001703368092; Wed, 29 Mar 2017 23:57:42 -0700 (PDT) Received: from localhost ([::1]:34006 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ctU1c-000722-RH for importer@patchew.org; Thu, 30 Mar 2017 02:57:40 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52656) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ctU02-0005ni-N0 for qemu-devel@nongnu.org; Thu, 30 Mar 2017 02:56:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ctTzy-0005cq-Pb for qemu-devel@nongnu.org; Thu, 30 Mar 2017 02:56:02 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34308) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ctTzy-0005ao-6W for qemu-devel@nongnu.org; Thu, 30 Mar 2017 02:55:58 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 60D1067EAC; Thu, 30 Mar 2017 06:55:56 +0000 (UTC) Received: from nilsson.home.kraxel.org (ovpn-116-80.ams2.redhat.com [10.36.116.80]) by smtp.corp.redhat.com (Postfix) with ESMTP id 395595C6CA; Thu, 30 Mar 2017 06:55:54 +0000 (UTC) Received: by nilsson.home.kraxel.org (Postfix, from userid 500) id CD0E380BC9; Thu, 30 Mar 2017 08:55:52 +0200 (CEST) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 60D1067EAC Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=kraxel@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 60D1067EAC From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Thu, 30 Mar 2017 08:55:28 +0200 Message-Id: <1490856931-21732-2-git-send-email-kraxel@redhat.com> In-Reply-To: <1490856931-21732-1-git-send-email-kraxel@redhat.com> References: <1490856931-21732-1-git-send-email-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Thu, 30 Mar 2017 06:55:56 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [RfC PATCH 1/4] vga: add vga_scanline_invalidated helper X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , =?UTF-8?q?Alex=20Benn=C3=A9e?= , Gerd Hoffmann Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Add vga_scanline_invalidated helper to check whenever a scanline was invalidated. Add a sanity check to fix OOB read access for display heights larger than 2048. Only cirrus uses this, for hardware cursor rendering, so having this work properly for the first 2048 scanlines only shouldn't be a problem as the cirrus can't handle large resolutions anyway. Also changing the invalidated_y_table size would break live migration. Signed-off-by: Gerd Hoffmann --- hw/display/vga.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/hw/display/vga.c b/hw/display/vga.c index 69c3e1d..f320946 100644 --- a/hw/display/vga.c +++ b/hw/display/vga.c @@ -1434,6 +1434,14 @@ void vga_invalidate_scanlines(VGACommonState *s, int= y1, int y2) } } =20 +static bool vga_scanline_invalidated(VGACommonState *s, int y) +{ + if (y >=3D VGA_MAX_HEIGHT) { + return false; + } + return s->invalidated_y_table[y >> 5] |=3D 1 << (y & 0x1f); +} + void vga_sync_dirty_bitmap(VGACommonState *s) { memory_region_sync_dirty_bitmap(&s->vram); @@ -1638,8 +1646,8 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) page1 =3D addr + bwidth - 1; update |=3D memory_region_get_dirty(&s->vram, page0, page1 - page0, DIRTY_MEMORY_VGA); - /* explicit invalidation for the hardware cursor */ - update |=3D (s->invalidated_y_table[y >> 5] >> (y & 0x1f)) & 1; + /* explicit invalidation for the hardware cursor (cirrus only) */ + update |=3D vga_scanline_invalidated(s, y); if (update) { if (y_start < 0) y_start =3D y; @@ -1686,7 +1694,7 @@ static void vga_draw_graphic(VGACommonState *s, int f= ull_update) page_max - page_min, DIRTY_MEMORY_VGA); } - memset(s->invalidated_y_table, 0, ((height + 31) >> 5) * 4); + memset(s->invalidated_y_table, 0, sizeof(s->invalidated_y_table)); } =20 static void vga_draw_blank(VGACommonState *s, int full_update) --=20 1.8.3.1