OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

ramfb: fix size calculation

Browse Source 
size calculation isn't correct with guest-supplied stride, the last
display line isn't accounted for correctly.

For the typical case of stride > linesize (add padding) we error on the
safe side (calculated size is larger than actual size).

With stride < linesize (scanlines overlap) the calculated size is
smaller than the actual size though so our guest memory mapping might
end up being too small.

While being at it also fix ramfb_create_display_surface to use hwaddr
for the parameters.  That way all calculation are done with hwaddr type
and we can't get funny effects from type castings.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20200429115236.28709-7-kraxel@redhat.com
This commit is contained in:
Gerd Hoffmann 2020-04-29 13:52:36 +02:00
parent 819c83e278
commit 3fcf15df00
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
hw/display/ramfb.c
View File

@ -44,10 +44,10 @@ static void ramfb_unmap_display_surface(pixman_image_t *image, void *unused)
static DisplaySurface *ramfb_create_display_surface(int width, int height,
pixman_format_code_t format,
int linesize, uint64_t addr)
hwaddr stride, hwaddr addr)
{
DisplaySurface *surface;
hwaddr size;
hwaddr size, mapsize, linesize;
void *data;
if (width < 16 || width > VBE_DISPI_MAX_XRES ||
@ -55,19 +55,20 @@ static DisplaySurface *ramfb_create_display_surface(int width, int height,
format == 0 /* unknown format */)
return NULL;
if (linesize == 0) {
linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
if (stride == 0) {
stride = linesize;
}
size = (hwaddr)linesize * height;
data = cpu_physical_memory_map(addr, &size, false);
if (size != (hwaddr)linesize * height) {
cpu_physical_memory_unmap(data, size, 0, 0);
mapsize = size = stride * (height - 1) + linesize;
data = cpu_physical_memory_map(addr, &mapsize, false);
if (size != mapsize) {
cpu_physical_memory_unmap(data, mapsize, 0, 0);
return NULL;
}
surface = qemu_create_displaysurface_from(width, height,
format, linesize, data);
format, stride, data);
pixman_image_set_destroy_function(surface->image,
ramfb_unmap_display_surface, NULL);