32790f
From ef0563a3c3f32680e0584821eccd9a205e371b34 Mon Sep 17 00:00:00 2001
32790f
From: Jon Maloy <jmaloy@redhat.com>
32790f
Date: Mon, 5 Dec 2022 15:32:55 -0500
32790f
Subject: [PATCH 3/6] hw/display/qxl: Document qxl_phys2virt()
32790f
MIME-Version: 1.0
32790f
Content-Type: text/plain; charset=UTF-8
32790f
Content-Transfer-Encoding: 8bit
32790f
32790f
RH-Author: Jon Maloy <jmaloy@redhat.com>
32790f
RH-MergeRequest: 242: hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler
32790f
RH-Bugzilla: 2152085
32790f
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
32790f
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
32790f
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
32790f
RH-Commit: [2/5] 8d1045449270a3aef4bc4b39c61da1592b83259a (jmaloy/jons-qemu-kvm)
32790f
32790f
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2152085
32790f
CVE: CVE-2022-4144
32790f
Upstream: Merged
32790f
32790f
commit b1901de83a9456cde26fc755f71ca2b7b3ef50fc
32790f
Author: Philippe Mathieu-Daudé <philmd@linaro.org>
32790f
Date:   Mon Nov 28 21:27:38 2022 +0100
32790f
32790f
    hw/display/qxl: Document qxl_phys2virt()
32790f
32790f
    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
32790f
    Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
32790f
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
32790f
    Message-Id: <20221128202741.4945-3-philmd@linaro.org>
32790f
32790f
(cherry picked from commit b1901de83a9456cde26fc755f71ca2b7b3ef50fc)
32790f
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
32790f
---
32790f
 hw/display/qxl.h | 19 +++++++++++++++++++
32790f
 1 file changed, 19 insertions(+)
32790f
32790f
diff --git a/hw/display/qxl.h b/hw/display/qxl.h
32790f
index 30d21f4d0b..c938f88a2f 100644
32790f
--- a/hw/display/qxl.h
32790f
+++ b/hw/display/qxl.h
32790f
@@ -147,6 +147,25 @@ OBJECT_DECLARE_SIMPLE_TYPE(PCIQXLDevice, PCI_QXL)
32790f
 #define QXL_DEFAULT_REVISION (QXL_REVISION_STABLE_V12 + 1)
32790f
 
32790f
 /* qxl.c */
32790f
+/**
32790f
+ * qxl_phys2virt: Get a pointer within a PCI VRAM memory region.
32790f
+ *
32790f
+ * @qxl: QXL device
32790f
+ * @phys: physical offset of buffer within the VRAM
32790f
+ * @group_id: memory slot group
32790f
+ *
32790f
+ * Returns a host pointer to a buffer placed at offset @phys within the
32790f
+ * active slot @group_id of the PCI VGA RAM memory region associated with
32790f
+ * the @qxl device. If the slot is inactive, or the offset is out
32790f
+ * of the memory region, returns NULL.
32790f
+ *
32790f
+ * Use with care; by the time this function returns, the returned pointer is
32790f
+ * not protected by RCU anymore.  If the caller is not within an RCU critical
32790f
+ * section and does not hold the iothread lock, it must have other means of
32790f
+ * protecting the pointer, such as a reference to the region that includes
32790f
+ * the incoming ram_addr_t.
32790f
+ *
32790f
+ */
32790f
 void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL phys, int group_id);
32790f
 void qxl_set_guest_bug(PCIQXLDevice *qxl, const char *msg, ...)
32790f
     GCC_FMT_ATTR(2, 3);
32790f
-- 
32790f
2.37.3
32790f