[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 8/8] ramfb: fix size calculation
From: |
Gerd Hoffmann |
Subject: |
[PULL 8/8] ramfb: fix size calculation |
Date: |
Mon, 18 May 2020 17:12:55 +0200 |
size calculation isn't correct with guest-supplied stride, the last
display line isn't accounted for correctly.
For the typical case of stride > linesize (add padding) we error on the
safe side (calculated size is larger than actual size).
With stride < linesize (scanlines overlap) the calculated size is
smaller than the actual size though so our guest memory mapping might
end up being too small.
While being at it also fix ramfb_create_display_surface to use hwaddr
for the parameters. That way all calculation are done with hwaddr type
and we can't get funny effects from type castings.
Signed-off-by: Gerd Hoffmann <address@hidden>
Acked-by: Laszlo Ersek <address@hidden>
Message-id: address@hidden
---
hw/display/ramfb.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c
index 52dae78db48f..79b9754a5820 100644
--- a/hw/display/ramfb.c
+++ b/hw/display/ramfb.c
@@ -44,10 +44,10 @@ static void ramfb_unmap_display_surface(pixman_image_t
*image, void *unused)
static DisplaySurface *ramfb_create_display_surface(int width, int height,
pixman_format_code_t
format,
- int linesize, uint64_t
addr)
+ hwaddr stride, hwaddr addr)
{
DisplaySurface *surface;
- hwaddr size;
+ hwaddr size, mapsize, linesize;
void *data;
if (width < 16 || width > VBE_DISPI_MAX_XRES ||
@@ -55,19 +55,20 @@ static DisplaySurface *ramfb_create_display_surface(int
width, int height,
format == 0 /* unknown format */)
return NULL;
- if (linesize == 0) {
- linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
+ linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
+ if (stride == 0) {
+ stride = linesize;
}
- size = (hwaddr)linesize * height;
- data = cpu_physical_memory_map(addr, &size, false);
- if (size != (hwaddr)linesize * height) {
- cpu_physical_memory_unmap(data, size, 0, 0);
+ mapsize = size = stride * (height - 1) + linesize;
+ data = cpu_physical_memory_map(addr, &mapsize, false);
+ if (size != mapsize) {
+ cpu_physical_memory_unmap(data, mapsize, 0, 0);
return NULL;
}
surface = qemu_create_displaysurface_from(width, height,
- format, linesize, data);
+ format, stride, data);
pixman_image_set_destroy_function(surface->image,
ramfb_unmap_display_surface, NULL);
--
2.18.4
- [PULL 0/8] Vga 20200518 patches, Gerd Hoffmann, 2020/05/18
- [PULL 3/8] Revert "hw/display/ramfb: initialize fw-config space with xres/ yres", Gerd Hoffmann, 2020/05/18
- [PULL 8/8] ramfb: fix size calculation,
Gerd Hoffmann <=
- [PULL 5/8] ramfb: drop leftover debug message, Gerd Hoffmann, 2020/05/18
- [PULL 7/8] ramfb: add sanity checks to ramfb_create_display_surface, Gerd Hoffmann, 2020/05/18
- [PULL 2/8] hw/display: Include local 'framebuffer.h', Gerd Hoffmann, 2020/05/18
- [PULL 1/8] ati-vga: Do not allow unaligned access via index register, Gerd Hoffmann, 2020/05/18
- [PULL 4/8] Revert "hw/display/ramfb: lock guest resolution after it's set", Gerd Hoffmann, 2020/05/18
- [PULL 6/8] ramfb: don't update RAMFBState on errors, Gerd Hoffmann, 2020/05/18
- Re: [PULL 0/8] Vga 20200518 patches, Peter Maydell, 2020/05/18