aboutsummaryrefslogtreecommitdiff
path: root/hw/display
diff options
context:
space:
mode:
authorGerd Hoffmann <kraxel@redhat.com>2020-04-29 13:52:36 +0200
committerGerd Hoffmann <kraxel@redhat.com>2020-05-18 15:43:51 +0200
commit3fcf15df0073a76d37e2816597771d4c9763e413 (patch)
treef0975d07b7c1062416c7c8555c8c9cb1ad1d7ac2 /hw/display
parent819c83e27895472befbfee67d3d7d089c61d7fbd (diff)
downloadqemu-3fcf15df0073a76d37e2816597771d4c9763e413.zip
qemu-3fcf15df0073a76d37e2816597771d4c9763e413.tar.gz
qemu-3fcf15df0073a76d37e2816597771d4c9763e413.tar.bz2
ramfb: fix size calculation
size calculation isn't correct with guest-supplied stride, the last display line isn't accounted for correctly. For the typical case of stride > linesize (add padding) we error on the safe side (calculated size is larger than actual size). With stride < linesize (scanlines overlap) the calculated size is smaller than the actual size though so our guest memory mapping might end up being too small. While being at it also fix ramfb_create_display_surface to use hwaddr for the parameters. That way all calculation are done with hwaddr type and we can't get funny effects from type castings. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 20200429115236.28709-7-kraxel@redhat.com
Diffstat (limited to 'hw/display')
-rw-r--r--hw/display/ramfb.c19
1 files changed, 10 insertions, 9 deletions
diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c
index 52dae78..79b9754 100644
--- a/hw/display/ramfb.c
+++ b/hw/display/ramfb.c
@@ -44,10 +44,10 @@ static void ramfb_unmap_display_surface(pixman_image_t *image, void *unused)
static DisplaySurface *ramfb_create_display_surface(int width, int height,
pixman_format_code_t format,
- int linesize, uint64_t addr)
+ hwaddr stride, hwaddr addr)
{
DisplaySurface *surface;
- hwaddr size;
+ hwaddr size, mapsize, linesize;
void *data;
if (width < 16 || width > VBE_DISPI_MAX_XRES ||
@@ -55,19 +55,20 @@ static DisplaySurface *ramfb_create_display_surface(int width, int height,
format == 0 /* unknown format */)
return NULL;
- if (linesize == 0) {
- linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
+ linesize = width * PIXMAN_FORMAT_BPP(format) / 8;
+ if (stride == 0) {
+ stride = linesize;
}
- size = (hwaddr)linesize * height;
- data = cpu_physical_memory_map(addr, &size, false);
- if (size != (hwaddr)linesize * height) {
- cpu_physical_memory_unmap(data, size, 0, 0);
+ mapsize = size = stride * (height - 1) + linesize;
+ data = cpu_physical_memory_map(addr, &mapsize, false);
+ if (size != mapsize) {
+ cpu_physical_memory_unmap(data, mapsize, 0, 0);
return NULL;
}
surface = qemu_create_displaysurface_from(width, height,
- format, linesize, data);
+ format, stride, data);
pixman_image_set_destroy_function(surface->image,
ramfb_unmap_display_surface, NULL);