File CVE-2017-13672-qemuu-vga-helper.patch of Package xen.11298

Subject: vbe: make bochs dispi interface return the correct memory size with qxl
From: Gerd Hoffmann kraxel@redhat.com Tue Aug 26 14:16:30 2014 +0200
Date: Thu Sep 4 08:22:48 2014 +0200:
Git: 54a85d462447c1cb8a1638578a7fd086350b4d2d

VgaState->vram_size is the size of the pci bar.  In case of qxl not the
whole pci bar can be used as vga framebuffer.  Add a new variable
vbe_size to handle that case.  By default (if unset) it equals
vram_size, but qxl can set vbe_size to something else.

This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results
and sanity checks are done with the correct size too.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/display/qxl.c
===================================================================
--- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/display/qxl.c
+++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/display/qxl.c
@@ -2060,6 +2060,7 @@ static int qxl_init_primary(PCIDevice *d
 
     qxl->id = 0;
     qxl_init_ramsize(qxl);
+    vga->vbe_size = qxl->vgamem_size;
     vga->vram_size_mb = qxl->vga.vram_size >> 20;
     vga_common_init(vga, OBJECT(dev));
     vga_init(vga, OBJECT(dev),
Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/display/vga.c
===================================================================
--- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/display/vga.c
+++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/display/vga.c
@@ -756,7 +756,7 @@ uint32_t vbe_ioport_read_data(void *opaq
             val = s->vbe_regs[s->vbe_index];
         }
     } else if (s->vbe_index == VBE_DISPI_INDEX_VIDEO_MEMORY_64K) {
-        val = s->vram_size / (64 * 1024);
+        val = s->vbe_size / (64 * 1024);
     } else {
         val = 0;
     }
@@ -2361,6 +2361,9 @@ void vga_common_init(VGACommonState *s,
         s->vram_size <<= 1;
     }
     s->vram_size_mb = s->vram_size >> 20;
+    if (!s->vbe_size) {
+        s->vbe_size = s->vram_size;
+    }
 
     s->is_vbe_vmstate = 1;
     memory_region_init_ram(&s->vram, obj, "vga.vram", s->vram_size);
Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/display/vga_int.h
===================================================================
--- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/display/vga_int.h
+++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/display/vga_int.h
@@ -93,6 +93,7 @@ typedef struct VGACommonState {
     MemoryRegion vram_vbe;
     uint32_t vram_size;
     uint32_t vram_size_mb; /* property */
+    uint32_t vbe_size;
     uint32_t latch;
     MemoryRegion *chain4_alias;
     uint8_t sr_index;