On Sun, 25 Oct 2026 at 11:08, Peter Maydell <[email protected]> wrote: > > The xlnx_dpdma DMA engine allows the guest to do DMA to host buffers > for audio and graphics data. These buffers are set up by the xlnx_dp > device, which calls xlnx_dpdma_set_host_data_location() to tell the > DMA engine where they are. However, this API doesn't provide any way > to say how big the host buffers are, and the DMA engine does not > check whether the guest is trying to write off the end of the buffer. > > Add a length argument to xlnx_dpdma_set_host_data_location(), and > bounds check the guest's DMA writes against it. The DPDMA ISR has > bits for each channel for "descriptor payload is too large", so we > report such overflows there. > > Cc: [email protected] > Fixes: d3c6369a96a8 ("introduce xlnx-dpdma") > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4134 > Signed-off-by: Peter Maydell <[email protected]> > ---
Applied to target-arm.next, thanks. -- PMM
