Re: [Qemu-devel] [PATCH 1/2] vga: abort instead of shrinking memory

[Gerd Hoffmann <kraxel@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 286 bytes --]

  Hi,

> > Which command line triggers it?
> 
> The important subset is:
>   -vga qxl -global qxl-vga.vgamem_mb=512

Ah, so the problem is only one place enforces a upper limit, so we can
get an invalid configuration with large values.

Can you try the attached patch?

cheers,
  Gerd


[-- Attachment #2: 0001-spice-fix-qxl-mem-size-checking.patch --]
[-- Type: text/x-patch, Size: 1846 bytes --]

>From 7e5e3f9aa6ccd74ebbf454a0e5e4bddf87978f25 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 17 Feb 2015 11:50:49 +0100
Subject: [PATCH] spice: fix qxl mem size checking

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/qxl.c | 4 ++++
 hw/display/vga.c | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 61df477..c8ca645 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1880,6 +1880,9 @@ static void qxl_init_ramsize(PCIQXLDevice *qxl)
     if (qxl->vgamem_size_mb < 8) {
         qxl->vgamem_size_mb = 8;
     }
+    if (qxl->vgamem_size_mb > 512) {
+        qxl->vgamem_size_mb = 512;
+    }
     qxl->vgamem_size = qxl->vgamem_size_mb * 1024 * 1024;
 
     /* vga ram (bar 0, total) */
@@ -2040,6 +2043,7 @@ static int qxl_init_primary(PCIDevice *dev)
     vga->vbe_size = qxl->vgamem_size;
     vga->vram_size_mb = qxl->vga.vram_size >> 20;
     vga_common_init(vga, OBJECT(dev), true);
+    assert(qxl->vgamem_size < qxl->vga.vram_size);
     vga_init(vga, OBJECT(dev),
              pci_address_space(dev), pci_address_space_io(dev), false);
     portio_list_init(&qxl->vga_port_list, OBJECT(dev), qxl_vga_portio_list,
diff --git a/hw/display/vga.c b/hw/display/vga.c
index ffcfce3..52e86ce 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -2122,10 +2122,10 @@ void vga_common_init(VGACommonState *s, Object *obj, bool global_vmstate)
         expand4to8[i] = v;
     }
 
-    /* valid range: 1 MB -> 256 MB */
+    /* valid range: 1 MB -> 1024 MB */
     s->vram_size = 1024 * 1024;
     while (s->vram_size < (s->vram_size_mb << 20) &&
-           s->vram_size < (256 << 20)) {
+           s->vram_size < (1024 << 20)) {
         s->vram_size <<= 1;
     }
     s->vram_size_mb = s->vram_size >> 20;
-- 
1.8.3.1