Blame SOURCES/kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch

12e206
From 1ac530769380bb6e481e97502925b656efdfa8fc Mon Sep 17 00:00:00 2001
12e206
From: Gerd Hoffmann <kraxel@redhat.com>
12e206
Date: Thu, 5 Oct 2017 14:51:19 +0200
12e206
Subject: [PATCH 07/11] vga: stop passing pointers to vga_draw_line* functions
12e206
12e206
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
12e206
Message-id: <20171005145119.15277-8-kraxel@redhat.com>
12e206
Patchwork-id: 76828
12e206
O-Subject: [RHEL-7.5 qemu-kvm PATCH 7/7] vga: stop passing pointers to vga_draw_line* functions
12e206
Bugzilla: 1501294
12e206
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
12e206
RH-Acked-by: Thomas Huth <thuth@redhat.com>
12e206
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
12e206
12e206
Instead pass around the address (aka offset into vga memory).
12e206
Add vga_read_* helper functions which apply vbe_size_mask to
12e206
the address, to make sure the address stays within the valid
12e206
range, similar to the cirrus blitter fixes (commits ffaf857778
12e206
and 026aeffcb4).
12e206
12e206
Impact:  DoS for privileged guest users.  qemu crashes with
12e206
a segfault, when hitting the guard page after vga memory
12e206
allocation, while reading vga memory for display updates.
12e206
12e206
Fixes: CVE-2017-13672
12e206
Cc: P J P <ppandit@redhat.com>
12e206
Reported-by: David Buchanan <d@vidbuchanan.co.uk>
12e206
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
12e206
Message-id: 20170828122906.18993-1-kraxel@redhat.com
12e206
(cherry picked from commit 3d90c6254863693a6b13d918d2b8682e08bbc681)
12e206
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
12e206
---
12e206
 hw/display/vga-helpers.h | 202 ++++++++++++++++++++++++++---------------------
12e206
 hw/display/vga.c         |   5 +-
12e206
 hw/display/vga_int.h     |   1 +
12e206
 3 files changed, 114 insertions(+), 94 deletions(-)
12e206
12e206
diff --git a/hw/display/vga-helpers.h b/hw/display/vga-helpers.h
12e206
index 94f6de2..5a752b3 100644
12e206
--- a/hw/display/vga-helpers.h
12e206
+++ b/hw/display/vga-helpers.h
12e206
@@ -95,20 +95,46 @@ static void vga_draw_glyph9(uint8_t *d, int linesize,
12e206
     } while (--h);
12e206
 }
12e206
 
12e206
+static inline uint8_t vga_read_byte(VGACommonState *vga, uint32_t addr)
12e206
+{
12e206
+    return vga->vram_ptr[addr & vga->vbe_size_mask];
12e206
+}
12e206
+
12e206
+static inline uint16_t vga_read_word_le(VGACommonState *vga, uint32_t addr)
12e206
+{
12e206
+    uint32_t offset = addr & vga->vbe_size_mask & ~1;
12e206
+    uint16_t *ptr = (uint16_t *)(vga->vram_ptr + offset);
12e206
+    return lduw_le_p(ptr);
12e206
+}
12e206
+
12e206
+static inline uint16_t vga_read_word_be(VGACommonState *vga, uint32_t addr)
12e206
+{
12e206
+    uint32_t offset = addr & vga->vbe_size_mask & ~1;
12e206
+    uint16_t *ptr = (uint16_t *)(vga->vram_ptr + offset);
12e206
+    return lduw_be_p(ptr);
12e206
+}
12e206
+
12e206
+static inline uint32_t vga_read_dword_le(VGACommonState *vga, uint32_t addr)
12e206
+{
12e206
+    uint32_t offset = addr & vga->vbe_size_mask & ~3;
12e206
+    uint32_t *ptr = (uint32_t *)(vga->vram_ptr + offset);
12e206
+    return ldl_le_p(ptr);
12e206
+}
12e206
+
12e206
 /*
12e206
  * 4 color mode
12e206
  */
12e206
-static void vga_draw_line2(VGACommonState *s1, uint8_t *d,
12e206
-                           const uint8_t *s, int width)
12e206
+static void vga_draw_line2(VGACommonState *vga, uint8_t *d,
12e206
+                           uint32_t addr, int width)
12e206
 {
12e206
     uint32_t plane_mask, *palette, data, v;
12e206
     int x;
12e206
 
12e206
-    palette = s1->last_palette;
12e206
-    plane_mask = mask16[s1->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
+    palette = vga->last_palette;
12e206
+    plane_mask = mask16[vga->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
     width >>= 3;
12e206
     for(x = 0; x < width; x++) {
12e206
-        data = ((uint32_t *)s)[0];
12e206
+        data = vga_read_dword_le(vga, addr);
12e206
         data &= plane_mask;
12e206
         v = expand2[GET_PLANE(data, 0)];
12e206
         v |= expand2[GET_PLANE(data, 2)] << 2;
12e206
@@ -124,7 +150,7 @@ static void vga_draw_line2(VGACommonState *s1, uint8_t *d,
12e206
         ((uint32_t *)d)[6] = palette[(v >> 4) & 0xf];
12e206
         ((uint32_t *)d)[7] = palette[(v >> 0) & 0xf];
12e206
         d += 32;
12e206
-        s += 4;
12e206
+        addr += 4;
12e206
     }
12e206
 }
12e206
 
12e206
@@ -134,17 +160,17 @@ static void vga_draw_line2(VGACommonState *s1, uint8_t *d,
12e206
 /*
12e206
  * 4 color mode, dup2 horizontal
12e206
  */
12e206
-static void vga_draw_line2d2(VGACommonState *s1, uint8_t *d,
12e206
-                             const uint8_t *s, int width)
12e206
+static void vga_draw_line2d2(VGACommonState *vga, uint8_t *d,
12e206
+                             uint32_t addr, int width)
12e206
 {
12e206
     uint32_t plane_mask, *palette, data, v;
12e206
     int x;
12e206
 
12e206
-    palette = s1->last_palette;
12e206
-    plane_mask = mask16[s1->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
+    palette = vga->last_palette;
12e206
+    plane_mask = mask16[vga->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
     width >>= 3;
12e206
     for(x = 0; x < width; x++) {
12e206
-        data = ((uint32_t *)s)[0];
12e206
+        data = vga_read_dword_le(vga, addr);
12e206
         data &= plane_mask;
12e206
         v = expand2[GET_PLANE(data, 0)];
12e206
         v |= expand2[GET_PLANE(data, 2)] << 2;
12e206
@@ -160,24 +186,24 @@ static void vga_draw_line2d2(VGACommonState *s1, uint8_t *d,
12e206
         PUT_PIXEL2(d, 6, palette[(v >> 4) & 0xf]);
12e206
         PUT_PIXEL2(d, 7, palette[(v >> 0) & 0xf]);
12e206
         d += 64;
12e206
-        s += 4;
12e206
+        addr += 4;
12e206
     }
12e206
 }
12e206
 
12e206
 /*
12e206
  * 16 color mode
12e206
  */
12e206
-static void vga_draw_line4(VGACommonState *s1, uint8_t *d,
12e206
-                           const uint8_t *s, int width)
12e206
+static void vga_draw_line4(VGACommonState *vga, uint8_t *d,
12e206
+                           uint32_t addr, int width)
12e206
 {
12e206
     uint32_t plane_mask, data, v, *palette;
12e206
     int x;
12e206
 
12e206
-    palette = s1->last_palette;
12e206
-    plane_mask = mask16[s1->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
+    palette = vga->last_palette;
12e206
+    plane_mask = mask16[vga->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
     width >>= 3;
12e206
     for(x = 0; x < width; x++) {
12e206
-        data = ((uint32_t *)s)[0];
12e206
+        data = vga_read_dword_le(vga, addr);
12e206
         data &= plane_mask;
12e206
         v = expand4[GET_PLANE(data, 0)];
12e206
         v |= expand4[GET_PLANE(data, 1)] << 1;
12e206
@@ -192,24 +218,24 @@ static void vga_draw_line4(VGACommonState *s1, uint8_t *d,
12e206
         ((uint32_t *)d)[6] = palette[(v >> 4) & 0xf];
12e206
         ((uint32_t *)d)[7] = palette[(v >> 0) & 0xf];
12e206
         d += 32;
12e206
-        s += 4;
12e206
+        addr += 4;
12e206
     }
12e206
 }
12e206
 
12e206
 /*
12e206
  * 16 color mode, dup2 horizontal
12e206
  */
12e206
-static void vga_draw_line4d2(VGACommonState *s1, uint8_t *d,
12e206
-                             const uint8_t *s, int width)
12e206
+static void vga_draw_line4d2(VGACommonState *vga, uint8_t *d,
12e206
+                             uint32_t addr, int width)
12e206
 {
12e206
     uint32_t plane_mask, data, v, *palette;
12e206
     int x;
12e206
 
12e206
-    palette = s1->last_palette;
12e206
-    plane_mask = mask16[s1->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
+    palette = vga->last_palette;
12e206
+    plane_mask = mask16[vga->ar[VGA_ATC_PLANE_ENABLE] & 0xf];
12e206
     width >>= 3;
12e206
     for(x = 0; x < width; x++) {
12e206
-        data = ((uint32_t *)s)[0];
12e206
+        data = vga_read_dword_le(vga, addr);
12e206
         data &= plane_mask;
12e206
         v = expand4[GET_PLANE(data, 0)];
12e206
         v |= expand4[GET_PLANE(data, 1)] << 1;
12e206
@@ -224,7 +250,7 @@ static void vga_draw_line4d2(VGACommonState *s1, uint8_t *d,
12e206
         PUT_PIXEL2(d, 6, palette[(v >> 4) & 0xf]);
12e206
         PUT_PIXEL2(d, 7, palette[(v >> 0) & 0xf]);
12e206
         d += 64;
12e206
-        s += 4;
12e206
+        addr += 4;
12e206
     }
12e206
 }
12e206
 
12e206
@@ -233,21 +259,21 @@ static void vga_draw_line4d2(VGACommonState *s1, uint8_t *d,
12e206
  *
12e206
  * XXX: add plane_mask support (never used in standard VGA modes)
12e206
  */
12e206
-static void vga_draw_line8d2(VGACommonState *s1, uint8_t *d,
12e206
-                             const uint8_t *s, int width)
12e206
+static void vga_draw_line8d2(VGACommonState *vga, uint8_t *d,
12e206
+                             uint32_t addr, int width)
12e206
 {
12e206
     uint32_t *palette;
12e206
     int x;
12e206
 
12e206
-    palette = s1->last_palette;
12e206
+    palette = vga->last_palette;
12e206
     width >>= 3;
12e206
     for(x = 0; x < width; x++) {
12e206
-        PUT_PIXEL2(d, 0, palette[s[0]]);
12e206
-        PUT_PIXEL2(d, 1, palette[s[1]]);
12e206
-        PUT_PIXEL2(d, 2, palette[s[2]]);
12e206
-        PUT_PIXEL2(d, 3, palette[s[3]]);
12e206
+        PUT_PIXEL2(d, 0, palette[vga_read_byte(vga, addr + 0)]);
12e206
+        PUT_PIXEL2(d, 1, palette[vga_read_byte(vga, addr + 1)]);
12e206
+        PUT_PIXEL2(d, 2, palette[vga_read_byte(vga, addr + 2)]);
12e206
+        PUT_PIXEL2(d, 3, palette[vga_read_byte(vga, addr + 3)]);
12e206
         d += 32;
12e206
-        s += 4;
12e206
+        addr += 4;
12e206
     }
12e206
 }
12e206
 
12e206
@@ -256,63 +282,63 @@ static void vga_draw_line8d2(VGACommonState *s1, uint8_t *d,
12e206
  *
12e206
  * XXX: add plane_mask support (never used in standard VGA modes)
12e206
  */
12e206
-static void vga_draw_line8(VGACommonState *s1, uint8_t *d,
12e206
-                           const uint8_t *s, int width)
12e206
+static void vga_draw_line8(VGACommonState *vga, uint8_t *d,
12e206
+                           uint32_t addr, int width)
12e206
 {
12e206
     uint32_t *palette;
12e206
     int x;
12e206
 
12e206
-    palette = s1->last_palette;
12e206
+    palette = vga->last_palette;
12e206
     width >>= 3;
12e206
     for(x = 0; x < width; x++) {
12e206
-        ((uint32_t *)d)[0] = palette[s[0]];
12e206
-        ((uint32_t *)d)[1] = palette[s[1]];
12e206
-        ((uint32_t *)d)[2] = palette[s[2]];
12e206
-        ((uint32_t *)d)[3] = palette[s[3]];
12e206
-        ((uint32_t *)d)[4] = palette[s[4]];
12e206
-        ((uint32_t *)d)[5] = palette[s[5]];
12e206
-        ((uint32_t *)d)[6] = palette[s[6]];
12e206
-        ((uint32_t *)d)[7] = palette[s[7]];
12e206
+        ((uint32_t *)d)[0] = palette[vga_read_byte(vga, addr + 0)];
12e206
+        ((uint32_t *)d)[1] = palette[vga_read_byte(vga, addr + 1)];
12e206
+        ((uint32_t *)d)[2] = palette[vga_read_byte(vga, addr + 2)];
12e206
+        ((uint32_t *)d)[3] = palette[vga_read_byte(vga, addr + 3)];
12e206
+        ((uint32_t *)d)[4] = palette[vga_read_byte(vga, addr + 4)];
12e206
+        ((uint32_t *)d)[5] = palette[vga_read_byte(vga, addr + 5)];
12e206
+        ((uint32_t *)d)[6] = palette[vga_read_byte(vga, addr + 6)];
12e206
+        ((uint32_t *)d)[7] = palette[vga_read_byte(vga, addr + 7)];
12e206
         d += 32;
12e206
-        s += 8;
12e206
+        addr += 8;
12e206
     }
12e206
 }
12e206
 
12e206
 /*
12e206
  * 15 bit color
12e206
  */
12e206
-static void vga_draw_line15_le(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line15_le(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
     int w;
12e206
     uint32_t v, r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        v = lduw_le_p((void *)s);
12e206
+        v = vga_read_word_le(vga, addr);
12e206
         r = (v >> 7) & 0xf8;
12e206
         g = (v >> 2) & 0xf8;
12e206
         b = (v << 3) & 0xf8;
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 2;
12e206
+        addr += 2;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
 }
12e206
 
12e206
-static void vga_draw_line15_be(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line15_be(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
     int w;
12e206
     uint32_t v, r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        v = lduw_be_p((void *)s);
12e206
+        v = vga_read_word_be(vga, addr);
12e206
         r = (v >> 7) & 0xf8;
12e206
         g = (v >> 2) & 0xf8;
12e206
         b = (v << 3) & 0xf8;
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 2;
12e206
+        addr += 2;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
 }
12e206
@@ -320,38 +346,38 @@ static void vga_draw_line15_be(VGACommonState *s1, uint8_t *d,
12e206
 /*
12e206
  * 16 bit color
12e206
  */
12e206
-static void vga_draw_line16_le(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line16_le(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
     int w;
12e206
     uint32_t v, r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        v = lduw_le_p((void *)s);
12e206
+        v = vga_read_word_le(vga, addr);
12e206
         r = (v >> 8) & 0xf8;
12e206
         g = (v >> 3) & 0xfc;
12e206
         b = (v << 3) & 0xf8;
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 2;
12e206
+        addr += 2;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
 }
12e206
 
12e206
-static void vga_draw_line16_be(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line16_be(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
     int w;
12e206
     uint32_t v, r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        v = lduw_be_p((void *)s);
12e206
+        v = vga_read_word_be(vga, addr);
12e206
         r = (v >> 8) & 0xf8;
12e206
         g = (v >> 3) & 0xfc;
12e206
         b = (v << 3) & 0xf8;
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 2;
12e206
+        addr += 2;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
 }
12e206
@@ -359,36 +385,36 @@ static void vga_draw_line16_be(VGACommonState *s1, uint8_t *d,
12e206
 /*
12e206
  * 24 bit color
12e206
  */
12e206
-static void vga_draw_line24_le(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line24_le(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
     int w;
12e206
     uint32_t r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        b = s[0];
12e206
-        g = s[1];
12e206
-        r = s[2];
12e206
+        b = vga_read_byte(vga, addr + 0);
12e206
+        g = vga_read_byte(vga, addr + 1);
12e206
+        r = vga_read_byte(vga, addr + 2);
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 3;
12e206
+        addr += 3;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
 }
12e206
 
12e206
-static void vga_draw_line24_be(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line24_be(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
     int w;
12e206
     uint32_t r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        r = s[0];
12e206
-        g = s[1];
12e206
-        b = s[2];
12e206
+        r = vga_read_byte(vga, addr + 0);
12e206
+        g = vga_read_byte(vga, addr + 1);
12e206
+        b = vga_read_byte(vga, addr + 2);
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 3;
12e206
+        addr += 3;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
 }
12e206
@@ -396,44 +422,36 @@ static void vga_draw_line24_be(VGACommonState *s1, uint8_t *d,
12e206
 /*
12e206
  * 32 bit color
12e206
  */
12e206
-static void vga_draw_line32_le(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line32_le(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
-#ifndef HOST_WORDS_BIGENDIAN
12e206
-    memcpy(d, s, width * 4);
12e206
-#else
12e206
     int w;
12e206
     uint32_t r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        b = s[0];
12e206
-        g = s[1];
12e206
-        r = s[2];
12e206
+        b = vga_read_byte(vga, addr + 0);
12e206
+        g = vga_read_byte(vga, addr + 1);
12e206
+        r = vga_read_byte(vga, addr + 2);
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 4;
12e206
+        addr += 4;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
-#endif
12e206
 }
12e206
 
12e206
-static void vga_draw_line32_be(VGACommonState *s1, uint8_t *d,
12e206
-                               const uint8_t *s, int width)
12e206
+static void vga_draw_line32_be(VGACommonState *vga, uint8_t *d,
12e206
+                               uint32_t addr, int width)
12e206
 {
12e206
-#ifdef HOST_WORDS_BIGENDIAN
12e206
-    memcpy(d, s, width * 4);
12e206
-#else
12e206
     int w;
12e206
     uint32_t r, g, b;
12e206
 
12e206
     w = width;
12e206
     do {
12e206
-        r = s[1];
12e206
-        g = s[2];
12e206
-        b = s[3];
12e206
+        r = vga_read_byte(vga, addr + 1);
12e206
+        g = vga_read_byte(vga, addr + 2);
12e206
+        b = vga_read_byte(vga, addr + 3);
12e206
         ((uint32_t *)d)[0] = rgb_to_pixel32(r, g, b);
12e206
-        s += 4;
12e206
+        addr += 4;
12e206
         d += 4;
12e206
     } while (--w != 0);
12e206
-#endif
12e206
 }
12e206
diff --git a/hw/display/vga.c b/hw/display/vga.c
12e206
index 4618823..5b0b864 100644
12e206
--- a/hw/display/vga.c
12e206
+++ b/hw/display/vga.c
12e206
@@ -1045,7 +1045,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val)
12e206
 }
12e206
 
12e206
 typedef void vga_draw_line_func(VGACommonState *s1, uint8_t *d,
12e206
-                                const uint8_t *s, int width);
12e206
+                                uint32_t srcaddr, int width);
12e206
 
12e206
 #include "vga-helpers.h"
12e206
 
12e206
@@ -1682,7 +1682,7 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
12e206
             if (page1 > page_max)
12e206
                 page_max = page1;
12e206
             if (!(is_buffer_shared(surface))) {
12e206
-                vga_draw_line(s, d, s->vram_ptr + addr, width);
12e206
+                vga_draw_line(s, d, addr, width);
12e206
                 if (s->cursor_draw_line)
12e206
                     s->cursor_draw_line(s, d, y);
12e206
             }
12e206
@@ -2162,6 +2162,7 @@ void vga_common_init(VGACommonState *s)
12e206
     if (!s->vbe_size) {
12e206
         s->vbe_size = s->vram_size;
12e206
     }
12e206
+    s->vbe_size_mask = s->vbe_size - 1;
12e206
 
12e206
     s->is_vbe_vmstate = 1;
12e206
     memory_region_init_ram(&s->vram, "vga.vram", s->vram_size);
12e206
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
12e206
index 7c758ac..94add2f 100644
12e206
--- a/hw/display/vga_int.h
12e206
+++ b/hw/display/vga_int.h
12e206
@@ -94,6 +94,7 @@ typedef struct VGACommonState {
12e206
     uint32_t vram_size;
12e206
     uint32_t vram_size_mb; /* property */
12e206
     uint32_t vbe_size;
12e206
+    uint32_t vbe_size_mask;
12e206
     uint32_t latch;
12e206
     MemoryRegion *chain4_alias;
12e206
     uint8_t sr_index;
12e206
-- 
12e206
1.8.3.1
12e206