From 068c531fb968ec04509b85f524d0745e6acf5449 Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Mon, 5 Dec 2022 15:32:55 -0500 Subject: [PATCH 2/5] hw/display/qxl: Document qxl_phys2virt() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Jon Maloy RH-MergeRequest: 240: hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler RH-Bugzilla: 2148545 RH-Acked-by: Gerd Hoffmann RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Marc-André Lureau RH-Commit: [2/5] f84c0b379022c527fc2508a242443d86454944c0 (jmaloy/jons-qemu-kvm) BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2148545 CVE: CVE-2022-4144 Upstream: Merged commit b1901de83a9456cde26fc755f71ca2b7b3ef50fc Author: Philippe Mathieu-Daudé Date: Mon Nov 28 21:27:38 2022 +0100 hw/display/qxl: Document qxl_phys2virt() Reviewed-by: Marc-André Lureau Signed-off-by: Philippe Mathieu-Daudé Signed-off-by: Stefan Hajnoczi Message-Id: <20221128202741.4945-3-philmd@linaro.org> (cherry picked from commit b1901de83a9456cde26fc755f71ca2b7b3ef50fc) Signed-off-by: Jon Maloy --- hw/display/qxl.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/hw/display/qxl.h b/hw/display/qxl.h index 30d21f4d0b..c938f88a2f 100644 --- a/hw/display/qxl.h +++ b/hw/display/qxl.h @@ -147,6 +147,25 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL) #define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1) /* qxl.c */ +/** + * qxl_phys2virt: Get a pointer within a PCI VRAM memory region. + * + * @qxl: QXL device + * @phys: physical offset of buffer within the VRAM + * @group_id: memory slot group + * + * Returns a host pointer to a buffer placed at offset @phys within the + * active slot @group_id of the PCI VGA RAM memory region associated with + * the @qxl device. If the slot is inactive, or the offset is out + * of the memory region, returns NULL. + * + * Use with care; by the time this function returns, the returned pointer is + * not protected by RCU anymore. If the caller is not within an RCU critical + * section and does not hold the iothread lock, it must have other means of + * protecting the pointer, such as a reference to the region that includes + * the incoming ram_addr_t. + * + */ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id); void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...) GCC_FMT_ATTR(2, 3); -- 2.37.3