mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
staging-7.2
qemu/hw/misc
History
Peter Maydell 5d64275517 hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE 
The documentation of the "Set palette" mailbox property at
https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface#set-palette
says it has the form:

    Length: 24..1032
    Value:
        u32: offset: first palette index to set (0-255)
        u32: length: number of palette entries to set (1-256)
        u32...: RGBA palette values (offset to offset+length-1)

We get this wrong in a couple of ways:
 * we aren't checking the offset and length are in range, so the guest
   can make us spin for a long time by providing a large length
 * the bounds check on our loop is wrong: we should iterate through
   'length' palette entries, not 'length - offset' entries

Fix the loop to implement the bounds checks and get the loop
condition right. In the process, make the variables local to
this switch case, rather than function-global, so it's clearer
what type they are when reading the code.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240723131029.1159908-2-peter.maydell@linaro.org
(cherry picked from commit 0892fffc2a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: context fix due to lack of
 v9.0.0-1812-g5d5f1b60916a "hw/misc: Implement mailbox properties for customer OTP and device specific private keys"
 v8.0.0-1924-g251918266666 "hw/misc/bcm2835_property: Use 'raspberrypi-fw-defs.h' definitions"
 also remove now-unused local `n' variable which gets removed in the next change in this file,
 v9.0.0-2720-g32f1c201eedf "hw/misc/bcm2835_property: Avoid overflow in OTP access properties")
2024-08-02 10:19:03 +03:00
..
macio hw: replace most qemu_bh_new calls with qemu_bh_new_guarded 2023-09-11 10:53:50 +03:00
a9scu.c hw/misc/a9scu: Report unimplemented accesses with qemu_log_mask(UNIMP) 2020-09-14 14:23:19 +01:00
allwinner-cpucfg.c hw/arm/allwinner: add CPU Configuration module 2020-03-12 16:27:33 +00:00
allwinner-h3-ccu.c hw/arm/allwinner-h3: add Clock Control Unit 2020-03-12 16:27:33 +00:00
allwinner-h3-dramc.c hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address 2020-03-30 13:18:58 +01:00
allwinner-h3-sysctrl.c hw/arm/allwinner-h3: add System Control module 2020-03-12 16:27:33 +00:00
allwinner-sid.c qdev: Move softmmu properties to qdev-properties-system.h 2020-12-18 15:20:17 -05:00
applesmc.c hw/misc/applesmc: Fix memory leak in reset() handler 2024-04-10 19:38:01 +03:00
arm11scu.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
arm_integrator_debug.c arm: Update infocenter.arm.com URLs 2021-02-11 11:50:14 +00:00
arm_l2x0.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
arm_sysctl.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
armsse-cpu-pwrctrl.c hw/misc/sse-cpu-pwrctrl: Implement SSE-300 CPU<N>_PWRCTRL register block 2021-03-08 17:20:02 +00:00
armsse-cpuid.c hw/arm/mps2: Update old infocenter.arm.com URLs 2021-03-08 11:54:16 +00:00
armsse-mhu.c hw/arm/mps2: Update old infocenter.arm.com URLs 2021-03-08 11:54:16 +00:00
armv7m_ras.c arm: Move M-profile RAS register block into its own device 2021-09-01 11:08:18 +01:00
aspeed_hace.c aspeed/hace: Initialize g_autofree pointer 2023-06-16 16:15:56 +03:00
aspeed_i3c.c hw/misc/aspeed_i3c.c: Introduce a dummy AST2600 I3C model. 2022-01-20 11:47:53 +00:00
aspeed_lpc.c hw/misc: Model KCS devices in the Aspeed LPC controller 2021-03-09 12:01:28 +01:00
aspeed_peci.c hw/misc/aspeed: Add PECI controller 2022-06-30 09:21:14 +02:00
aspeed_sbc.c aspeed: sbc: Allow per-machine settings 2022-07-14 16:24:38 +02:00
aspeed_scu.c aspeed/scu: Add trace events for read ops 2022-06-30 09:21:13 +02:00
aspeed_sdmc.c aspeed/sdmc: Add trace events 2022-02-26 18:40:51 +01:00
aspeed_xdma.c hw/misc/aspeed_xdma: Add AST2600 support 2021-05-01 10:03:52 +02:00
auxbus.c qbus: Rename qbus_create() to qbus_new() 2021-09-30 13:44:08 +01:00
avr_power.c hw/misc: avr: Add limited support for power reduction device 2020-07-11 11:02:05 +02:00
bcm2835_cprman.c clock: Add ClockEvent parameter to callbacks 2021-03-08 17:20:01 +00:00
bcm2835_mbox.c Mark remaining global TypeInfo instances as const 2022-02-21 13:30:20 +00:00
bcm2835_mphi.c raspi: add BCM2835 SOC MPHI emulation 2020-06-05 17:23:09 +01:00
bcm2835_powermgt.c Mark remaining global TypeInfo instances as const 2022-02-21 13:30:20 +00:00
bcm2835_property.c hw/misc/bcm2835_property: Fix handling of FRAMEBUFFER_SET_PALETTE 2024-08-02 10:19:03 +03:00
bcm2835_rng.c Mark remaining global TypeInfo instances as const 2022-02-21 13:30:20 +00:00
bcm2835_thermal.c hw/misc/bcm2835_thermal: Add a dummy BCM2835 thermal sensor 2019-10-25 13:09:27 +01:00
cbus.c Drop useless casts from g_malloc() & friends to pointer 2022-10-22 23:15:40 +02:00
debugexit.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
eccmemctl.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
edu.c qemu/atomic.h: rename atomic_ to qatomic_ 2020-09-23 16:07:44 +01:00
empty_slot.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
exynos4210_clk.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
exynos4210_pmu.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
exynos4210_rng.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
grlib_ahb_apb_pnp.c hw/misc/grlib_ahb_apb_pnp: Support 8 and 16 bit accesses 2022-08-08 23:43:11 +02:00
imx6_ccm.c hw/msic: imx6_ccm: Correct register value for silicon type 2021-01-08 15:13:39 +00:00
imx6_src.c Use g_new() & friends where that makes obvious sense 2022-03-21 15:44:44 +01:00
imx6ul_ccm.c i.MX6ul: Fix bad printf format specifiers 2020-12-10 11:44:55 +00:00
imx7_ccm.c imx7-ccm: add digprog mmio write method 2021-02-08 15:15:32 +01:00
imx7_gpr.c Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
imx7_snvs.c hw: Do not include qemu/log.h if it is not necessary 2021-05-02 17:24:50 +02:00
imx25_ccm.c i.MX25: Fix bad printf format specifiers 2020-12-10 11:44:55 +00:00
imx31_ccm.c i.MX31: Fix bad printf format specifiers 2020-12-10 11:44:55 +00:00
imx_ccm.c hw: Do not include qemu/log.h if it is not necessary 2021-05-02 17:24:50 +02:00
imx_rngc.c hw: replace most qemu_bh_new calls with qemu_bh_new_guarded 2023-09-11 10:53:50 +03:00
iotkit-secctl.c misc: fix commonly doubled up words 2022-08-01 11:58:02 +02:00
iotkit-sysctl.c misc: fix commonly doubled up words 2022-08-01 11:58:02 +02:00
iotkit-sysinfo.c hw/misc/iotkit-sysinfo.c: Implement SYS_CONFIG1 and IIDR 2021-03-08 17:20:01 +00:00
ivshmem.c Use g_unix_set_fd_nonblocking() 2022-05-03 15:17:30 +04:00
Kconfig lasi: move from hw/hppa to hw/misc 2022-05-08 18:52:37 +01:00
lasi.c lasi: move from hw/hppa to hw/misc 2022-05-08 18:52:37 +01:00
led.c misc/led: LED state is set opposite of what is expected 2023-10-31 20:39:03 +03:00
mac_via.c trivial: Fix duplicated words 2022-08-01 11:58:02 +02:00
mchp_pfsoc_dmc.c hw: Remove superfluous includes of hw/hw.h 2021-05-02 17:24:50 +02:00
mchp_pfsoc_ioscb.c hw: Remove superfluous includes of hw/hw.h 2021-05-02 17:24:50 +02:00
mchp_pfsoc_sysreg.c hw: Remove superfluous includes of hw/hw.h 2021-05-02 17:24:50 +02:00
meson.build hw/misc/aspeed: Add PECI controller 2022-06-30 09:21:14 +02:00
mips_cmgcr.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
mips_cpc.c hw/mips: Fix Lesser GPL version number 2020-11-03 16:51:13 +01:00
mips_itu.c compiler.h: replace QEMU_NORETURN with G_NORETURN 2022-04-21 17:03:51 +04:00
mos6522.c monitor: expose monitor_puts to rest of code 2022-10-06 11:53:40 +01:00
mps2-fpgaio.c hw/misc/mps2-fpgaio: Support AN547 DBGCTRL register 2021-03-08 17:20:03 +00:00
mps2-scc.c hw/misc/mps2-scc: Free MPS2SCC::oscclk[] array on finalize() 2023-12-20 19:11:10 +03:00
msf2-sysreg.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
mst_fpga.c hw/arm: Constify VMStateDescription 2021-05-02 17:24:50 +02:00
npcm7xx_clk.c hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init() 2022-03-18 10:55:15 +00:00
npcm7xx_gcr.c hw/*: Use type casting for SysBusDevice in NPCM7XX 2021-01-12 21:19:02 +00:00
npcm7xx_mft.c hw/misc: Add NPCM7XX MFT Module 2021-03-12 12:48:56 +00:00
npcm7xx_pwm.c hw/misc: Add GPIOs for duty in NPCM7xx PWM 2021-03-12 12:48:56 +00:00
npcm7xx_rng.c hw/*: Use type casting for SysBusDevice in NPCM7XX 2021-01-12 21:19:02 +00:00
nrf51_rng.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
omap_clk.c Include hw/irq.h a lot less 2019-08-16 13:31:52 +02:00
omap_gpmc.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
omap_l4.c misc: Replace zero-length arrays with flexible array member (automatic) 2020-03-16 22:07:42 +01:00
omap_sdrc.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
omap_tap.c Replace all occurances of __FUNCTION__ with __func__ 2018-01-22 09:46:18 +01:00
pc-testdev.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
pca9552.c misc/pca9552: Fix LED status register indexing in pca955x_get_led() 2021-09-20 08:50:59 +02:00
pci-testdev.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
pvpanic-isa.c acpi: pvpanic-isa: use AcpiDevAmlIfClass:build_dev_aml to provide device's AML 2022-06-09 19:32:49 -04:00
pvpanic-pci.c hw/misc/pvpanic: Use standard headers instead 2022-03-06 05:08:23 -05:00
pvpanic.c hw/misc/pvpanic: Use standard headers instead 2022-03-06 05:08:23 -05:00
sbsa_ec.c Remove qemu-common.h include from most units 2022-04-06 14:31:55 +02:00
sga.c hw/misc: deprecate the 'sga' device 2021-11-02 17:24:18 +01:00
sifive_e_prci.c hw: Remove superfluous includes of hw/hw.h 2021-05-02 17:24:50 +02:00
sifive_test.c hw: Remove superfluous includes of hw/hw.h 2021-05-02 17:24:50 +02:00
sifive_u_otp.c block: Change blk_{pread,pwrite}() param order 2022-07-12 12:14:56 +02:00
sifive_u_prci.c hw/riscv: Move sifive_u_prci model to hw/misc 2020-09-09 15:54:19 -07:00
slavio_misc.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
stm32f2xx_syscfg.c hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ 2020-11-10 11:03:48 +00:00
stm32f4xx_exti.c hw/misc: Add the STM32F4xx EXTI device 2020-01-17 14:09:29 +00:00
stm32f4xx_syscfg.c hw/misc/stm32f4xx_syscfg: Fix copy/paste error 2020-01-23 15:34:04 +00:00
trace-events hw/misc/grlib_ahb_apb_pnp: Support 8 and 16 bit accesses 2022-08-08 23:43:11 +02:00
trace.h trace: switch position of headers to what Meson requires 2020-08-21 06:18:24 -04:00
tz-mpc.c memory: Add IOMMUTLBEvent 2020-12-08 13:48:57 -05:00
tz-msc.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
tz-ppc.c tz-ppc: add dummy read/write methods 2021-02-08 15:15:32 +01:00
unimp.c hw/misc/unimp: Display the offset with width of the region size 2020-08-28 10:02:46 +01:00
virt_ctrl.c hw/m68k: Fix typo in SPDX tag 2021-11-09 10:11:27 +01:00
vmcoreinfo.c hw/misc/vmcoreinfo: Add comment about reset handler 2019-10-15 18:18:08 -03:00
xlnx-versal-crl.c hw/misc: Add a model of the Xilinx Versal CRL 2022-04-21 11:37:03 +01:00
xlnx-versal-pmc-iou-slcr.c hw/misc: Add a model of Versal's PMC SLCR 2022-01-28 14:29:46 +00:00
xlnx-versal-xramc.c hw/misc: versal: Add a model of the XRAM controller 2021-03-12 12:40:09 +00:00
xlnx-zynqmp-apu-ctrl.c hw/misc: Add a model of the Xilinx ZynqMP APU Control 2022-03-18 11:31:20 +00:00
xlnx-zynqmp-crf.c hw/misc: Add a model of the Xilinx ZynqMP CRF 2022-03-18 11:31:20 +00:00
zynq_slcr.c hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase 2021-09-13 16:07:20 +01:00