From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 12 Nov 2024 13:13:35 +0000 (+0100)
Subject: x86/HVM: drop stdvga's "gr[]" struct member
X-Git-Tag: RELEASE-4.16.7~6
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=8c1b3581b0b1ac81ad3feb26279f261510eb4389;p=xen.git

x86/HVM: drop stdvga's "gr[]" struct member

No consumers are left, hence the producer and the array itself can also
go away. The static gr_mask[] is then orphaned and hence needs dropping,
too.

This is part of XSA-463 / CVE-2024-45818

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
(cherry picked from commit b16c0966a17f19c0e55ed0b9baa28191d2590178)
---

diff --git a/xen/arch/x86/hvm/stdvga.c b/xen/arch/x86/hvm/stdvga.c
index 138ced229d..edcc456d1f 100644
--- a/xen/arch/x86/hvm/stdvga.c
+++ b/xen/arch/x86/hvm/stdvga.c
@@ -50,18 +50,6 @@ static const uint8_t sr_mask[8] = {
     (uint8_t)~0x00,
 };
 
-static const uint8_t gr_mask[9] = {
-    (uint8_t)~0xf0, /* 0x00 */
-    (uint8_t)~0xf0, /* 0x01 */
-    (uint8_t)~0xf0, /* 0x02 */
-    (uint8_t)~0xe0, /* 0x03 */
-    (uint8_t)~0xfc, /* 0x04 */
-    (uint8_t)~0x84, /* 0x05 */
-    (uint8_t)~0xf0, /* 0x06 */
-    (uint8_t)~0xf0, /* 0x07 */
-    (uint8_t)~0x00, /* 0x08 */
-};
-
 static int stdvga_outb(uint64_t addr, uint8_t val)
 {
     struct hvm_hw_stdvga *s = &current->domain->arch.hvm.stdvga;
@@ -83,12 +71,6 @@ static int stdvga_outb(uint64_t addr, uint8_t val)
         s->gr_index = val;
         break;
 
-    case 0x3cf:                 /* graphics data register */
-        rc = (s->gr_index < sizeof(s->gr));
-        if ( rc )
-            s->gr[s->gr_index] = val & gr_mask[s->gr_index];
-        break;
-
     default:
         rc = 0;
         break;
diff --git a/xen/include/asm-x86/hvm/io.h b/xen/include/asm-x86/hvm/io.h
index 7bd1fa113e..375c12a466 100644
--- a/xen/include/asm-x86/hvm/io.h
+++ b/xen/include/asm-x86/hvm/io.h
@@ -125,7 +125,6 @@ struct hvm_hw_stdvga {
     uint8_t sr_index;
     uint8_t sr[8];
     uint8_t gr_index;
-    uint8_t gr[9];
     struct page_info *vram_page[64];  /* shadow of 0xa0000-0xaffff */
     spinlock_t lock;
 };