diff options
author | Peter Maydell <peter.maydell@linaro.org> | 2021-09-01 10:57:30 +0100 |
---|---|---|
committer | Peter Maydell <peter.maydell@linaro.org> | 2021-09-01 10:57:30 +0100 |
commit | 783aa010ade5e2f8dd33a654882f2a14ab96c0a1 (patch) | |
tree | 48baaa37a61a47c78a1f706d9789fdaa0cf5112a | |
parent | ec397e90d21269037280633b6058d1f280e27667 (diff) | |
parent | 01f750f5fef1afd8f6abc0548910f87d473e26d5 (diff) | |
download | qemu-783aa010ade5e2f8dd33a654882f2a14ab96c0a1.zip qemu-783aa010ade5e2f8dd33a654882f2a14ab96c0a1.tar.gz qemu-783aa010ade5e2f8dd33a654882f2a14ab96c0a1.tar.bz2 |
Merge remote-tracking branch 'remotes/kraxel/tags/vga-20210901-pull-request' into staging
vga: misc fixes and cleanups.
# gpg: Signature made Wed 01 Sep 2021 05:18:46 BST
# gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138
* remotes/kraxel/tags/vga-20210901-pull-request:
hw/display/artist: Fix bug in coordinate extraction in artist_vram_read() and artist_vram_write()
hw/display/xlnx_dp: fix an out-of-bounds read in xlnx_dp_read
vga: don't abort when adding a duplicate isa-vga device
ui/console: Restrict udmabuf_fd() to Linux
hw/display: Restrict virtio-gpu-udmabuf stubs to !Linux
virtio-gpu: no point of checking res->iov
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r-- | hw/display/artist.c | 8 | ||||
-rw-r--r-- | hw/display/meson.build | 3 | ||||
-rw-r--r-- | hw/display/vga-isa.c | 10 | ||||
-rw-r--r-- | hw/display/virtio-gpu-udmabuf-stubs.c (renamed from stubs/virtio-gpu-udmabuf.c) | 0 | ||||
-rw-r--r-- | hw/display/virtio-gpu.c | 2 | ||||
-rw-r--r-- | hw/display/xlnx_dp.c | 6 | ||||
-rw-r--r-- | include/ui/console.h | 2 | ||||
-rw-r--r-- | stubs/meson.build | 1 | ||||
-rw-r--r-- | tests/qtest/fuzz-xlnx-dp-test.c | 33 | ||||
-rw-r--r-- | tests/qtest/meson.build | 1 | ||||
-rw-r--r-- | ui/meson.build | 6 | ||||
-rw-r--r-- | ui/udmabuf.c | 11 |
12 files changed, 62 insertions, 21 deletions
diff --git a/hw/display/artist.c b/hw/display/artist.c index aa7bd59..21b7fd1 100644 --- a/hw/display/artist.c +++ b/hw/display/artist.c @@ -1170,8 +1170,8 @@ static void artist_vram_write(void *opaque, hwaddr addr, uint64_t val, } buf = vram_write_buffer(s); - posy = ADDR_TO_Y(addr); - posx = ADDR_TO_X(addr); + posy = ADDR_TO_Y(addr >> 2); + posx = ADDR_TO_X(addr >> 2); if (!buf->size) { return; @@ -1232,8 +1232,8 @@ static uint64_t artist_vram_read(void *opaque, hwaddr addr, unsigned size) return 0; } - posy = ADDR_TO_Y(addr); - posx = ADDR_TO_X(addr); + posy = ADDR_TO_Y(addr >> 2); + posx = ADDR_TO_X(addr >> 2); if (posy > buf->height || posx > buf->width) { return 0; diff --git a/hw/display/meson.build b/hw/display/meson.build index 1e6b707..861c43f 100644 --- a/hw/display/meson.build +++ b/hw/display/meson.build @@ -56,7 +56,8 @@ if config_all_devices.has_key('CONFIG_VIRTIO_GPU') virtio_gpu_ss = ss.source_set() virtio_gpu_ss.add(when: 'CONFIG_VIRTIO_GPU', if_true: [files('virtio-gpu-base.c', 'virtio-gpu.c'), pixman]) - virtio_gpu_ss.add(when: 'CONFIG_LINUX', if_true: files('virtio-gpu-udmabuf.c')) + virtio_gpu_ss.add(when: 'CONFIG_LINUX', if_true: files('virtio-gpu-udmabuf.c'), + if_false: files('virtio-gpu-udmabuf-stubs.c')) virtio_gpu_ss.add(when: 'CONFIG_VHOST_USER_GPU', if_true: files('vhost-user-gpu.c')) hw_display_modules += {'virtio-gpu': virtio_gpu_ss} diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c index 90851e7..8cea84f 100644 --- a/hw/display/vga-isa.c +++ b/hw/display/vga-isa.c @@ -33,6 +33,7 @@ #include "hw/loader.h" #include "hw/qdev-properties.h" #include "qom/object.h" +#include "qapi/error.h" #define TYPE_ISA_VGA "isa-vga" OBJECT_DECLARE_SIMPLE_TYPE(ISAVGAState, ISA_VGA) @@ -61,6 +62,15 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp) MemoryRegion *vga_io_memory; const MemoryRegionPortio *vga_ports, *vbe_ports; + /* + * make sure this device is not being added twice, if so + * exit without crashing qemu + */ + if (object_resolve_path_type("", TYPE_ISA_VGA, NULL)) { + error_setg(errp, "at most one %s device is permitted", TYPE_ISA_VGA); + return; + } + s->global_vmstate = true; vga_common_init(s, OBJECT(dev)); s->legacy_address_space = isa_address_space(isadev); diff --git a/stubs/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf-stubs.c index 81f6614..81f6614 100644 --- a/stubs/virtio-gpu-udmabuf.c +++ b/hw/display/virtio-gpu-udmabuf-stubs.c diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 990e71f..72da5bf 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -362,7 +362,7 @@ static void virtio_gpu_resource_create_blob(VirtIOGPU *g, ret = virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(cblob), cmd, &res->addrs, &res->iov, &res->iov_cnt); - if (ret != 0 || res->iov) { + if (ret != 0) { cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC; g_free(res); return; diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c index 2bb7a54..9bb781e 100644 --- a/hw/display/xlnx_dp.c +++ b/hw/display/xlnx_dp.c @@ -714,7 +714,11 @@ static uint64_t xlnx_dp_read(void *opaque, hwaddr offset, unsigned size) break; default: assert(offset <= (0x3AC >> 2)); - ret = s->core_registers[offset]; + if (offset == (0x3A8 >> 2) || offset == (0x3AC >> 2)) { + ret = s->core_registers[DP_INT_MASK]; + } else { + ret = s->core_registers[offset]; + } break; } diff --git a/include/ui/console.h b/include/ui/console.h index b30b639..3be2149 100644 --- a/include/ui/console.h +++ b/include/ui/console.h @@ -471,7 +471,9 @@ bool vnc_display_reload_certs(const char *id, Error **errp); /* input.c */ int index_from_key(const char *key, size_t key_length); +#ifdef CONFIG_LINUX /* udmabuf.c */ int udmabuf_fd(void); +#endif #endif diff --git a/stubs/meson.build b/stubs/meson.build index 717bfa9..275ac89 100644 --- a/stubs/meson.build +++ b/stubs/meson.build @@ -52,7 +52,6 @@ if have_system stub_ss.add(files('semihost.c')) stub_ss.add(files('usb-dev-stub.c')) stub_ss.add(files('xen-hw-stub.c')) - stub_ss.add(files('virtio-gpu-udmabuf.c')) else stub_ss.add(files('qdev.c')) endif diff --git a/tests/qtest/fuzz-xlnx-dp-test.c b/tests/qtest/fuzz-xlnx-dp-test.c new file mode 100644 index 0000000..69eb6c0 --- /dev/null +++ b/tests/qtest/fuzz-xlnx-dp-test.c @@ -0,0 +1,33 @@ +/* + * QTest fuzzer-generated testcase for xlnx-dp display device + * + * Copyright (c) 2021 Qiang Liu <cyruscyliu@gmail.com> + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "qemu/osdep.h" +#include "libqos/libqtest.h" + +/* + * This used to trigger the out-of-bounds read in xlnx_dp_read + */ +static void test_fuzz_xlnx_dp_0x3ac(void) +{ + QTestState *s = qtest_init("-M xlnx-zcu102 -display none "); + qtest_readl(s, 0xfd4a03ac); + qtest_quit(s); +} + +int main(int argc, char **argv) +{ + const char *arch = qtest_get_arch(); + + g_test_init(&argc, &argv, NULL); + + if (strcmp(arch, "aarch64") == 0) { + qtest_add_func("fuzz/test_fuzz_xlnx_dp/3ac", test_fuzz_xlnx_dp_0x3ac); + } + + return g_test_run(); +} diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index 2bc3efd..757bb84 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -187,6 +187,7 @@ qtests_aarch64 = \ 'numa-test', 'boot-serial-test', 'xlnx-can-test', + 'fuzz-xlnx-dp-test', 'migration-test'] qtests_s390x = \ diff --git a/ui/meson.build b/ui/meson.build index a3a187d..7d25c1b 100644 --- a/ui/meson.build +++ b/ui/meson.build @@ -12,12 +12,14 @@ softmmu_ss.add(files( 'kbd-state.c', 'keymaps.c', 'qemu-pixman.c', - 'udmabuf.c', )) softmmu_ss.add([spice_headers, files('spice-module.c')]) softmmu_ss.add(when: spice_protocol, if_true: files('vdagent.c')) -softmmu_ss.add(when: 'CONFIG_LINUX', if_true: files('input-linux.c')) +softmmu_ss.add(when: 'CONFIG_LINUX', if_true: files( + 'input-linux.c', + 'udmabuf.c', +)) softmmu_ss.add(when: cocoa, if_true: files('cocoa.m')) vnc_ss = ss.source_set() diff --git a/ui/udmabuf.c b/ui/udmabuf.c index 23abe1e..cebceb2 100644 --- a/ui/udmabuf.c +++ b/ui/udmabuf.c @@ -8,8 +8,6 @@ #include "qapi/error.h" #include "ui/console.h" -#ifdef CONFIG_LINUX - #include <fcntl.h> #include <sys/ioctl.h> @@ -29,12 +27,3 @@ int udmabuf_fd(void) } return udmabuf; } - -#else - -int udmabuf_fd(void) -{ - return -1; -} - -#endif |