[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 03/10] vga: add vga_scanline_invalidated helper
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PATCH 03/10] vga: add vga_scanline_invalidated helper |
Date: |
Tue, 4 Apr 2017 12:23:08 +0200 |
Add vga_scanline_invalidated helper to check whenever a scanline was
invalidated. Add a sanity check to fix OOB read access for display
heights larger than 2048.
Only cirrus uses this, for hardware cursor rendering, so having this
work properly for the first 2048 scanlines only shouldn't be a problem
as the cirrus can't handle large resolutions anyway. Also changing the
invalidated_y_table size would break live migration.
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/display/vga.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/hw/display/vga.c b/hw/display/vga.c
index 69c3e1d..f320946 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -1434,6 +1434,14 @@ void vga_invalidate_scanlines(VGACommonState *s, int y1,
int y2)
}
}
+static bool vga_scanline_invalidated(VGACommonState *s, int y)
+{
+ if (y >= VGA_MAX_HEIGHT) {
+ return false;
+ }
+ return s->invalidated_y_table[y >> 5] |= 1 << (y & 0x1f);
+}
+
void vga_sync_dirty_bitmap(VGACommonState *s)
{
memory_region_sync_dirty_bitmap(&s->vram);
@@ -1638,8 +1646,8 @@ static void vga_draw_graphic(VGACommonState *s, int
full_update)
page1 = addr + bwidth - 1;
update |= memory_region_get_dirty(&s->vram, page0, page1 - page0,
DIRTY_MEMORY_VGA);
- /* explicit invalidation for the hardware cursor */
- update |= (s->invalidated_y_table[y >> 5] >> (y & 0x1f)) & 1;
+ /* explicit invalidation for the hardware cursor (cirrus only) */
+ update |= vga_scanline_invalidated(s, y);
if (update) {
if (y_start < 0)
y_start = y;
@@ -1686,7 +1694,7 @@ static void vga_draw_graphic(VGACommonState *s, int
full_update)
page_max - page_min,
DIRTY_MEMORY_VGA);
}
- memset(s->invalidated_y_table, 0, ((height + 31) >> 5) * 4);
+ memset(s->invalidated_y_table, 0, sizeof(s->invalidated_y_table));
}
static void vga_draw_blank(VGACommonState *s, int full_update)
--
2.9.3
- [Qemu-devel] [PATCH 00/10] make display updates thread safe., Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 09/10] tcx: make display updates thread safe, Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 02/10] memory: add support getting and using a dirty bitmap copy., Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 06/10] cg3: fix up size parameter for memory_region_get_dirty(), Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 10/10] [testing] console: remove do_safe_dpy_refresh, Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 03/10] vga: add vga_scanline_invalidated helper,
Gerd Hoffmann <=
- [Qemu-devel] [PATCH 08/10] tcx: introduce tcx_check_dirty() function, Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 05/10] cg3: remove TARGET_PAGE_SIZE rounding on dirty page detection, Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 01/10] bitmap: add bitmap_copy_and_clear_atomic, Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 07/10] cg3: make display updates thread safe, Gerd Hoffmann, 2017/04/04
- [Qemu-devel] [PATCH 04/10] vga: make display updates thread safe., Gerd Hoffmann, 2017/04/04
- Re: [Qemu-devel] [PATCH 00/10] make display updates thread safe., Mark Cave-Ayland, 2017/04/04