From: Gerd Hoffmann <kraxel@redhat.com>
To: Sven Schnelle <svens@stackframe.org>
Cc: "Helge Deller" <deller@gmx.de>,
"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
qemu-devel@nongnu.org
Subject: Re: [PATCH 3/3] hw/display/artist: rewrite vram access mode handling
Date: Tue, 25 Jan 2022 09:25:52 +0100 [thread overview]
Message-ID: <20220125082552.uupa7yyqdnpxgopw@sirius.home.kraxel.org> (raw)
In-Reply-To: <20220121221619.1069447-4-svens@stackframe.org>
Hi,
> +static void artist_vram_write4(ARTISTState *s, struct vram_buffer *buf,
> + uint32_t offset, uint32_t data)
> +static int get_vram_offset(ARTISTState *s, struct vram_buffer *buf,
> + int pos, int posy)
> + case 0x13a0:
> + artist_vram_write4(s, buf, get_vram_offset(s, buf, pos >> 2, posy),
> + data);
That is asking for trouble.
You should pass around offsets not pointers. An offset can trivially be
checked whenever it is within the valid range (i.e. smaller than vram
size), or it can be masked to strip off high bits when accessing virtual
vram. You need that for robustness and security reasons (i.e. make sure
the guest can't write to host memory by tricking your get_vram_offset
calculations).
grep cirrus for 'cirrus_addr_mask' to see sample code.
take care,
Gerd
next prev parent reply other threads:[~2022-01-25 8:33 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-21 22:16 [PATCH 0/3] hw/display/artist: cursor & buffer mode fixes Sven Schnelle
2022-01-21 22:16 ` [PATCH 1/3] hw/display/artist: fix cursor position Sven Schnelle
2022-01-21 22:16 ` [PATCH 2/3] hw/display/artist: allow to disable/enable cursor Sven Schnelle
2022-01-25 8:11 ` Gerd Hoffmann
2022-01-21 22:16 ` [PATCH 3/3] hw/display/artist: rewrite vram access mode handling Sven Schnelle
2022-01-25 8:25 ` Gerd Hoffmann [this message]
2022-01-25 16:29 ` Sven Schnelle
2022-01-26 9:08 ` Gerd Hoffmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220125082552.uupa7yyqdnpxgopw@sirius.home.kraxel.org \
--to=kraxel@redhat.com \
--cc=deller@gmx.de \
--cc=f4bug@amsat.org \
--cc=qemu-devel@nongnu.org \
--cc=svens@stackframe.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).