File CVE-2014-3615-qemu-54a85d46.patch of Package xen.612

Subject: vbe: make bochs dispi interface return the correct memory size with qxl
From: Gerd Hoffmann kraxel@redhat.com Tue Aug 26 14:16:30 2014 +0200
Date: Thu Sep 4 08:22:48 2014 +0200:
Git: 54a85d462447c1cb8a1638578a7fd086350b4d2d

VgaState->vram_size is the size of the pci bar.  In case of qxl not the
whole pci bar can be used as vga framebuffer.  Add a new variable
vbe_size to handle that case.  By default (if unset) it equals
vram_size, but qxl can set vbe_size to something else.

This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results
and sanity checks are done with the correct size too.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

Index: xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/display/qxl.c
===================================================================
--- xen-4.4.1-testing.orig/tools/qemu-xen-dir-remote/hw/display/qxl.c
+++ xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/display/qxl.c
@@ -2069,6 +2069,7 @@ static int qxl_init_primary(PCIDevice *d
 
     qxl->id = 0;
     qxl_init_ramsize(qxl);
+    vga->vbe_size = qxl->vgamem_size;
     vga->vram_size_mb = qxl->vga.vram_size >> 20;
     vga_common_init(vga, OBJECT(dev));
     vga_init(vga, OBJECT(dev),
Index: xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/display/vga.c
===================================================================
--- xen-4.4.1-testing.orig/tools/qemu-xen-dir-remote/hw/display/vga.c
+++ xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/display/vga.c
@@ -614,7 +614,7 @@ uint32_t vbe_ioport_read_data(void *opaq
             val = s->vbe_regs[s->vbe_index];
         }
     } else if (s->vbe_index == VBE_DISPI_INDEX_VIDEO_MEMORY_64K) {
-        val = s->vram_size / (64 * 1024);
+        val = s->vbe_size / (64 * 1024);
     } else {
         val = 0;
     }
@@ -753,7 +753,7 @@ void vbe_ioport_write_data(void *opaque,
                     line_offset = w >> 1;
                 else
                     line_offset = w * ((s->vbe_regs[VBE_DISPI_INDEX_BPP] + 7) >> 3);
-                h = s->vram_size / line_offset;
+                h = s->vbe_size / line_offset;
                 /* XXX: support weird bochs semantics ? */
                 if (h < s->vbe_regs[VBE_DISPI_INDEX_YRES])
                     return;
@@ -2291,6 +2291,9 @@ void vga_common_init(VGACommonState *s,
         s->vram_size <<= 1;
     }
     s->vram_size_mb = s->vram_size >> 20;
+    if (!s->vbe_size) {
+        s->vbe_size = s->vram_size;
+    }
 
     s->is_vbe_vmstate = 1;
     memory_region_init_ram(&s->vram, obj, "vga.vram", s->vram_size);
Index: xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/display/vga_int.h
===================================================================
--- xen-4.4.1-testing.orig/tools/qemu-xen-dir-remote/hw/display/vga_int.h
+++ xen-4.4.1-testing/tools/qemu-xen-dir-remote/hw/display/vga_int.h
@@ -93,6 +93,7 @@ typedef struct VGACommonState {
     MemoryRegion vram_vbe;
     uint32_t vram_size;
     uint32_t vram_size_mb; /* property */
+    uint32_t vbe_size;
     uint32_t latch;
     MemoryRegion *chain4_alias;
     uint8_t sr_index;