|
Bernhard M. Wiedemann |
399b1f |
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
|
|
Bernhard M. Wiedemann |
399b1f |
Date: Mon, 28 Nov 2022 21:27:38 +0100
|
|
Bernhard M. Wiedemann |
399b1f |
Subject: hw/display/qxl: Document qxl_phys2virt()
|
|
Bernhard M. Wiedemann |
399b1f |
MIME-Version: 1.0
|
|
Bernhard M. Wiedemann |
399b1f |
Content-Type: text/plain; charset=UTF-8
|
|
Bernhard M. Wiedemann |
399b1f |
Content-Transfer-Encoding: 8bit
|
|
Bernhard M. Wiedemann |
399b1f |
|
|
Bernhard M. Wiedemann |
399b1f |
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
Bernhard M. Wiedemann |
399b1f |
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
Bernhard M. Wiedemann |
399b1f |
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Bernhard M. Wiedemann |
399b1f |
Message-Id: <20221128202741.4945-3-philmd@linaro.org>
|
|
Bernhard M. Wiedemann |
399b1f |
(cherry picked from commit b1901de83a9456cde26fc755f71ca2b7b3ef50fc)
|
|
Bernhard M. Wiedemann |
399b1f |
Resolves: bsc#1205808
|
|
Bernhard M. Wiedemann |
399b1f |
Fixes: CVE-2022-4144
|
|
Bernhard M. Wiedemann |
399b1f |
Signed-off-by: Dario Faggioli <dfaggioli@suse.com>
|
|
Bernhard M. Wiedemann |
399b1f |
---
|
|
Bernhard M. Wiedemann |
399b1f |
hw/display/qxl.h | 19 +++++++++++++++++++
|
|
Bernhard M. Wiedemann |
399b1f |
1 file changed, 19 insertions(+)
|
|
Bernhard M. Wiedemann |
399b1f |
|
|
Bernhard M. Wiedemann |
399b1f |
diff --git a/hw/display/qxl.h b/hw/display/qxl.h
|
|
Bernhard M. Wiedemann |
399b1f |
index e74de9579df3db6e3b6924b1a8c2..78b3a6c9ba8e3a598d6553867a6c 100644
|
|
Bernhard M. Wiedemann |
399b1f |
--- a/hw/display/qxl.h
|
|
Bernhard M. Wiedemann |
399b1f |
+++ b/hw/display/qxl.h
|
|
Bernhard M. Wiedemann |
399b1f |
@@ -147,6 +147,25 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL)
|
|
Bernhard M. Wiedemann |
399b1f |
#define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1)
|
|
Bernhard M. Wiedemann |
399b1f |
|
|
Bernhard M. Wiedemann |
399b1f |
/* qxl.c */
|
|
Bernhard M. Wiedemann |
399b1f |
+/**
|
|
Bernhard M. Wiedemann |
399b1f |
+ * qxl_phys2virt: Get a pointer within a PCI VRAM memory region.
|
|
Bernhard M. Wiedemann |
399b1f |
+ *
|
|
Bernhard M. Wiedemann |
399b1f |
+ * @qxl: QXL device
|
|
Bernhard M. Wiedemann |
399b1f |
+ * @phys: physical offset of buffer within the VRAM
|
|
Bernhard M. Wiedemann |
399b1f |
+ * @group_id: memory slot group
|
|
Bernhard M. Wiedemann |
399b1f |
+ *
|
|
Bernhard M. Wiedemann |
399b1f |
+ * Returns a host pointer to a buffer placed at offset @phys within the
|
|
Bernhard M. Wiedemann |
399b1f |
+ * active slot @group_id of the PCI VGA RAM memory region associated with
|
|
Bernhard M. Wiedemann |
399b1f |
+ * the @qxl device. If the slot is inactive, or the offset is out
|
|
Bernhard M. Wiedemann |
399b1f |
+ * of the memory region, returns NULL.
|
|
Bernhard M. Wiedemann |
399b1f |
+ *
|
|
Bernhard M. Wiedemann |
399b1f |
+ * Use with care; by the time this function returns, the returned pointer is
|
|
Bernhard M. Wiedemann |
399b1f |
+ * not protected by RCU anymore. If the caller is not within an RCU critical
|
|
Bernhard M. Wiedemann |
399b1f |
+ * section and does not hold the iothread lock, it must have other means of
|
|
Bernhard M. Wiedemann |
399b1f |
+ * protecting the pointer, such as a reference to the region that includes
|
|
Bernhard M. Wiedemann |
399b1f |
+ * the incoming ram_addr_t.
|
|
Bernhard M. Wiedemann |
399b1f |
+ *
|
|
Bernhard M. Wiedemann |
399b1f |
+ */
|
|
Bernhard M. Wiedemann |
399b1f |
void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id);
|
|
Bernhard M. Wiedemann |
399b1f |
void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...)
|
|
Bernhard M. Wiedemann |
399b1f |
G_GNUC_PRINTF(2, 3);
|