summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--hw/display/artist.c8
-rw-r--r--hw/display/meson.build3
-rw-r--r--hw/display/vga-isa.c10
-rw-r--r--hw/display/virtio-gpu-udmabuf-stubs.c (renamed from stubs/virtio-gpu-udmabuf.c)0
-rw-r--r--hw/display/virtio-gpu.c2
-rw-r--r--hw/display/xlnx_dp.c6
-rw-r--r--include/ui/console.h2
-rw-r--r--stubs/meson.build1
-rw-r--r--tests/qtest/fuzz-xlnx-dp-test.c33
-rw-r--r--tests/qtest/meson.build1
-rw-r--r--ui/meson.build6
-rw-r--r--ui/udmabuf.c11
12 files changed, 62 insertions, 21 deletions
diff --git a/hw/display/artist.c b/hw/display/artist.c
index aa7bd594aa..21b7fd1b44 100644
--- a/hw/display/artist.c
+++ b/hw/display/artist.c
@@ -1170,8 +1170,8 @@ static void artist_vram_write(void *opaque, hwaddr addr, uint64_t val,
}
buf = vram_write_buffer(s);
- posy = ADDR_TO_Y(addr);
- posx = ADDR_TO_X(addr);
+ posy = ADDR_TO_Y(addr >> 2);
+ posx = ADDR_TO_X(addr >> 2);
if (!buf->size) {
return;
@@ -1232,8 +1232,8 @@ static uint64_t artist_vram_read(void *opaque, hwaddr addr, unsigned size)
return 0;
}
- posy = ADDR_TO_Y(addr);
- posx = ADDR_TO_X(addr);
+ posy = ADDR_TO_Y(addr >> 2);
+ posx = ADDR_TO_X(addr >> 2);
if (posy > buf->height || posx > buf->width) {
return 0;
diff --git a/hw/display/meson.build b/hw/display/meson.build
index 1e6b707d3c..861c43ff98 100644
--- a/hw/display/meson.build
+++ b/hw/display/meson.build
@@ -56,7 +56,8 @@ if config_all_devices.has_key('CONFIG_VIRTIO_GPU')
virtio_gpu_ss = ss.source_set()
virtio_gpu_ss.add(when: 'CONFIG_VIRTIO_GPU',
if_true: [files('virtio-gpu-base.c', 'virtio-gpu.c'), pixman])
- virtio_gpu_ss.add(when: 'CONFIG_LINUX', if_true: files('virtio-gpu-udmabuf.c'))
+ virtio_gpu_ss.add(when: 'CONFIG_LINUX', if_true: files('virtio-gpu-udmabuf.c'),
+ if_false: files('virtio-gpu-udmabuf-stubs.c'))
virtio_gpu_ss.add(when: 'CONFIG_VHOST_USER_GPU', if_true: files('vhost-user-gpu.c'))
hw_display_modules += {'virtio-gpu': virtio_gpu_ss}
diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
index 90851e730b..8cea84f2be 100644
--- a/hw/display/vga-isa.c
+++ b/hw/display/vga-isa.c
@@ -33,6 +33,7 @@
#include "hw/loader.h"
#include "hw/qdev-properties.h"
#include "qom/object.h"
+#include "qapi/error.h"
#define TYPE_ISA_VGA "isa-vga"
OBJECT_DECLARE_SIMPLE_TYPE(ISAVGAState, ISA_VGA)
@@ -61,6 +62,15 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
MemoryRegion *vga_io_memory;
const MemoryRegionPortio *vga_ports, *vbe_ports;
+ /*
+ * make sure this device is not being added twice, if so
+ * exit without crashing qemu
+ */
+ if (object_resolve_path_type("", TYPE_ISA_VGA, NULL)) {
+ error_setg(errp, "at most one %s device is permitted", TYPE_ISA_VGA);
+ return;
+ }
+
s->global_vmstate = true;
vga_common_init(s, OBJECT(dev));
s->legacy_address_space = isa_address_space(isadev);
diff --git a/stubs/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf-stubs.c
index 81f661441a..81f661441a 100644
--- a/stubs/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf-stubs.c
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 990e71fd40..72da5bf500 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -362,7 +362,7 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU *g,
ret = virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(cblob),
cmd, &res->addrs, &res->iov,
&res->iov_cnt);
- if (ret != 0 || res->iov) {
+ if (ret != 0) {
cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
g_free(res);
return;
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 2bb7a5441a..9bb781e312 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -714,7 +714,11 @@ static uint64_t xlnx_dp_read(void *opaque, hwaddr offset, unsigned size)
break;
default:
assert(offset <= (0x3AC >> 2));
- ret = s->core_registers[offset];
+ if (offset == (0x3A8 >> 2) || offset == (0x3AC >> 2)) {
+ ret = s->core_registers[DP_INT_MASK];
+ } else {
+ ret = s->core_registers[offset];
+ }
break;
}
diff --git a/include/ui/console.h b/include/ui/console.h
index b30b63976a..3be21497a2 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -471,7 +471,9 @@ bool vnc_display_reload_certs(const char *id, Error **errp);
/* input.c */
int index_from_key(const char *key, size_t key_length);
+#ifdef CONFIG_LINUX
/* udmabuf.c */
int udmabuf_fd(void);
+#endif
#endif
diff --git a/stubs/meson.build b/stubs/meson.build
index 717bfa9a99..275ac89c16 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -52,7 +52,6 @@ if have_system
stub_ss.add(files('semihost.c'))
stub_ss.add(files('usb-dev-stub.c'))
stub_ss.add(files('xen-hw-stub.c'))
- stub_ss.add(files('virtio-gpu-udmabuf.c'))
else
stub_ss.add(files('qdev.c'))
endif
diff --git a/tests/qtest/fuzz-xlnx-dp-test.c b/tests/qtest/fuzz-xlnx-dp-test.c
new file mode 100644
index 0000000000..69eb6c0eb1
--- /dev/null
+++ b/tests/qtest/fuzz-xlnx-dp-test.c
@@ -0,0 +1,33 @@
+/*
+ * QTest fuzzer-generated testcase for xlnx-dp display device
+ *
+ * Copyright (c) 2021 Qiang Liu <cyruscyliu@gmail.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "libqos/libqtest.h"
+
+/*
+ * This used to trigger the out-of-bounds read in xlnx_dp_read
+ */
+static void test_fuzz_xlnx_dp_0x3ac(void)
+{
+ QTestState *s = qtest_init("-M xlnx-zcu102 -display none ");
+ qtest_readl(s, 0xfd4a03ac);
+ qtest_quit(s);
+}
+
+int main(int argc, char **argv)
+{
+ const char *arch = qtest_get_arch();
+
+ g_test_init(&argc, &argv, NULL);
+
+ if (strcmp(arch, "aarch64") == 0) {
+ qtest_add_func("fuzz/test_fuzz_xlnx_dp/3ac", test_fuzz_xlnx_dp_0x3ac);
+ }
+
+ return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 2bc3efd49f..757bb8499a 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -187,6 +187,7 @@ qtests_aarch64 = \
'numa-test',
'boot-serial-test',
'xlnx-can-test',
+ 'fuzz-xlnx-dp-test',
'migration-test']
qtests_s390x = \
diff --git a/ui/meson.build b/ui/meson.build
index a3a187d633..7d25c1b95b 100644
--- a/ui/meson.build
+++ b/ui/meson.build
@@ -12,12 +12,14 @@ softmmu_ss.add(files(
'kbd-state.c',
'keymaps.c',
'qemu-pixman.c',
- 'udmabuf.c',
))
softmmu_ss.add([spice_headers, files('spice-module.c')])
softmmu_ss.add(when: spice_protocol, if_true: files('vdagent.c'))
-softmmu_ss.add(when: 'CONFIG_LINUX', if_true: files('input-linux.c'))
+softmmu_ss.add(when: 'CONFIG_LINUX', if_true: files(
+ 'input-linux.c',
+ 'udmabuf.c',
+))
softmmu_ss.add(when: cocoa, if_true: files('cocoa.m'))
vnc_ss = ss.source_set()
diff --git a/ui/udmabuf.c b/ui/udmabuf.c
index 23abe1e7eb..cebceb2610 100644
--- a/ui/udmabuf.c
+++ b/ui/udmabuf.c
@@ -8,8 +8,6 @@
#include "qapi/error.h"
#include "ui/console.h"
-#ifdef CONFIG_LINUX
-
#include <fcntl.h>
#include <sys/ioctl.h>
@@ -29,12 +27,3 @@ int udmabuf_fd(void)
}
return udmabuf;
}
-
-#else
-
-int udmabuf_fd(void)
-{
- return -1;
-}
-
-#endif
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-29 20:56:57 +0100