1. Patchew
  2. QEMU
  3. [PATCH 0/2] xlnx-dp: fix a couple of fuzzer bugs
  4. View patch

[PATCH 2/2] hw/display/xlnx_dp: Don't abort for unsupported graphics formats

Peter Maydell posted 2 patches 1 week, 1 day ago
Maintainers: Alistair Francis <alistair@alistair23.me>, "Edgar E. Iglesias" <edgar.iglesias@gmail.com>, Peter Maydell <peter.maydell@linaro.org>
[PATCH 2/2] hw/display/xlnx_dp: Don't abort for unsupported graphics formats
Posted by Peter Maydell 1 week, 1 day ago 
If the guest writes an invalid or unsupported value to the
AV_BUF_FORMAT register, currently we abort().  Instead, log this as
either a guest error or an unimplemented error and continue.

The existing code treats DP_NL_VID_CB_Y0_CR_Y1 as x8b8g8r8
via a "case 0" that does not use the enum constant name for some
reason; we leave that alone beyond adding a comment about the
weird code.

Documentation of this register seems to be at:
https://docs.amd.com/r/en-US/ug1087-zynq-ultrascale-registers/AV_BUF_FORMAT-DISPLAY_PORT-Register

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1415
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/xlnx_dp.c | 53 +++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 48 insertions(+), 5 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index c2bf692e7b1..d8119a56292 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -665,14 +665,28 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
     case DP_GRAPHIC_BGR888:
         s->g_plane.format = PIXMAN_b8g8r8;
         break;
+    case DP_GRAPHIC_RGBA5551:
+    case DP_GRAPHIC_RGBA4444:
+    case DP_GRAPHIC_8BPP:
+    case DP_GRAPHIC_4BPP:
+    case DP_GRAPHIC_2BPP:
+    case DP_GRAPHIC_1BPP:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented graphic format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
+        s->g_plane.format = PIXMAN_r8g8b8a8;
+        break;
     default:
-        error_report("%s: unsupported graphic format %u", __func__,
-                     s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid graphic format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
+        s->g_plane.format = PIXMAN_r8g8b8a8;
         abort();
     }
 
     switch (s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK) {
     case 0:
+        /* This is DP_NL_VID_CB_Y0_CR_Y1 ??? */
         s->v_plane.format = PIXMAN_x8b8g8r8;
         break;
     case DP_NL_VID_Y0_CB_Y1_CR:
@@ -681,10 +695,39 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
     case DP_NL_VID_RGBA8880:
         s->v_plane.format = PIXMAN_x8b8g8r8;
         break;
+    case DP_NL_VID_CR_Y0_CB_Y1:
+    case DP_NL_VID_Y0_CR_Y1_CB:
+    case DP_NL_VID_YV16:
+    case DP_NL_VID_YV24:
+    case DP_NL_VID_YV16CL:
+    case DP_NL_VID_MONO:
+    case DP_NL_VID_YV16CL2:
+    case DP_NL_VID_YUV444:
+    case DP_NL_VID_RGB888:
+    case DP_NL_VID_RGB888_10BPC:
+    case DP_NL_VID_YUV444_10BPC:
+    case DP_NL_VID_YV16CL2_10BPC:
+    case DP_NL_VID_YV16CL_10BPC:
+    case DP_NL_VID_YV16_10BPC:
+    case DP_NL_VID_YV24_10BPC:
+    case DP_NL_VID_Y_ONLY_10BPC:
+    case DP_NL_VID_YV16_420:
+    case DP_NL_VID_YV16CL_420:
+    case DP_NL_VID_YV16CL2_420:
+    case DP_NL_VID_YV16_420_10BPC:
+    case DP_NL_VID_YV16CL_420_10BPC:
+    case DP_NL_VID_YV16CL2_420_10BPC:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented video format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
+        s->v_plane.format = PIXMAN_x8b8g8r8;
+        break;
     default:
-        error_report("%s: unsupported video format %u", __func__,
-                     s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
-        abort();
+        qemu_log_mask(LOG_UNIMP, "%s: invalid video format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
+        s->v_plane.format = PIXMAN_x8b8g8r8;
+        break;
     }
 
     xlnx_dp_recreate_surface(s);
-- 
2.43.0
Re: [PATCH 2/2] hw/display/xlnx_dp: Don't abort for unsupported graphics formats
Posted by Philippe Mathieu-Daudé 5 days, 1 hour ago 
Hi,

On 6/11/25 15:52, Peter Maydell wrote:
> If the guest writes an invalid or unsupported value to the
> AV_BUF_FORMAT register, currently we abort().  Instead, log this as
> either a guest error or an unimplemented error and continue.
> 
> The existing code treats DP_NL_VID_CB_Y0_CR_Y1 as x8b8g8r8
> via a "case 0" that does not use the enum constant name for some
> reason; we leave that alone beyond adding a comment about the
> weird code.
> 
> Documentation of this register seems to be at:
> https://docs.amd.com/r/en-US/ug1087-zynq-ultrascale-registers/AV_BUF_FORMAT-DISPLAY_PORT-Register
> 
> Cc: qemu-stable@nongnu.org
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1415
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>   hw/display/xlnx_dp.c | 53 +++++++++++++++++++++++++++++++++++++++-----
>   1 file changed, 48 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
> index c2bf692e7b1..d8119a56292 100644
> --- a/hw/display/xlnx_dp.c
> +++ b/hw/display/xlnx_dp.c
> @@ -665,14 +665,28 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
>       case DP_GRAPHIC_BGR888:
>           s->g_plane.format = PIXMAN_b8g8r8;
>           break;
> +    case DP_GRAPHIC_RGBA5551:
> +    case DP_GRAPHIC_RGBA4444:
> +    case DP_GRAPHIC_8BPP:
> +    case DP_GRAPHIC_4BPP:
> +    case DP_GRAPHIC_2BPP:
> +    case DP_GRAPHIC_1BPP:
> +        qemu_log_mask(LOG_UNIMP, "%s: unimplemented graphic format %u",
> +                      __func__,
> +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> +        s->g_plane.format = PIXMAN_r8g8b8a8;
> +        break;
>       default:
> -        error_report("%s: unsupported graphic format %u", __func__,
> -                     s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> +        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid graphic format %u",
> +                      __func__,
> +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> +        s->g_plane.format = PIXMAN_r8g8b8a8;
>           abort();

Don't we want to remove this abort() call?

Otherwise,

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

>       }
Re: [PATCH 2/2] hw/display/xlnx_dp: Don't abort for unsupported graphics formats
Posted by Peter Maydell 4 days, 22 hours ago 
On Sun, 9 Nov 2025 at 13:40, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
>
> Hi,
>
> On 6/11/25 15:52, Peter Maydell wrote:
> > If the guest writes an invalid or unsupported value to the
> > AV_BUF_FORMAT register, currently we abort().  Instead, log this as
> > either a guest error or an unimplemented error and continue.
> >
> > The existing code treats DP_NL_VID_CB_Y0_CR_Y1 as x8b8g8r8
> > via a "case 0" that does not use the enum constant name for some
> > reason; we leave that alone beyond adding a comment about the
> > weird code.
> >
> > Documentation of this register seems to be at:
> > https://docs.amd.com/r/en-US/ug1087-zynq-ultrascale-registers/AV_BUF_FORMAT-DISPLAY_PORT-Register
> >
> > Cc: qemu-stable@nongnu.org
> > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1415
> > Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> > ---
> >   hw/display/xlnx_dp.c | 53 +++++++++++++++++++++++++++++++++++++++-----
> >   1 file changed, 48 insertions(+), 5 deletions(-)
> >
> > diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
> > index c2bf692e7b1..d8119a56292 100644
> > --- a/hw/display/xlnx_dp.c
> > +++ b/hw/display/xlnx_dp.c
> > @@ -665,14 +665,28 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
> >       case DP_GRAPHIC_BGR888:
> >           s->g_plane.format = PIXMAN_b8g8r8;
> >           break;
> > +    case DP_GRAPHIC_RGBA5551:
> > +    case DP_GRAPHIC_RGBA4444:
> > +    case DP_GRAPHIC_8BPP:
> > +    case DP_GRAPHIC_4BPP:
> > +    case DP_GRAPHIC_2BPP:
> > +    case DP_GRAPHIC_1BPP:
> > +        qemu_log_mask(LOG_UNIMP, "%s: unimplemented graphic format %u",
> > +                      __func__,
> > +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> > +        s->g_plane.format = PIXMAN_r8g8b8a8;
> > +        break;
> >       default:
> > -        error_report("%s: unsupported graphic format %u", __func__,
> > -                     s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> > +        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid graphic format %u",
> > +                      __func__,
> > +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> > +        s->g_plane.format = PIXMAN_r8g8b8a8;
> >           abort();
>
> Don't we want to remove this abort() call?

Whoops, yes. (The test case in the bug goes through the LOG_UNIMP
arm rather than the LOG_GUEST_ERROR one, so I didn't spot this.)

-- PMM
Re: [PATCH 2/2] hw/display/xlnx_dp: Don't abort for unsupported graphics formats
Posted by Edgar E. Iglesias 1 week ago 
On Thu, Nov 06, 2025 at 02:52:09PM +0000, Peter Maydell wrote:
> If the guest writes an invalid or unsupported value to the
> AV_BUF_FORMAT register, currently we abort().  Instead, log this as
> either a guest error or an unimplemented error and continue.
> 
> The existing code treats DP_NL_VID_CB_Y0_CR_Y1 as x8b8g8r8
> via a "case 0" that does not use the enum constant name for some
> reason; we leave that alone beyond adding a comment about the
> weird code.
> 
> Documentation of this register seems to be at:
> https://docs.amd.com/r/en-US/ug1087-zynq-ultrascale-registers/AV_BUF_FORMAT-DISPLAY_PORT-Register
> 
> Cc: qemu-stable@nongnu.org
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1415
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>



> ---
>  hw/display/xlnx_dp.c | 53 +++++++++++++++++++++++++++++++++++++++-----
>  1 file changed, 48 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
> index c2bf692e7b1..d8119a56292 100644
> --- a/hw/display/xlnx_dp.c
> +++ b/hw/display/xlnx_dp.c
> @@ -665,14 +665,28 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
>      case DP_GRAPHIC_BGR888:
>          s->g_plane.format = PIXMAN_b8g8r8;
>          break;
> +    case DP_GRAPHIC_RGBA5551:
> +    case DP_GRAPHIC_RGBA4444:
> +    case DP_GRAPHIC_8BPP:
> +    case DP_GRAPHIC_4BPP:
> +    case DP_GRAPHIC_2BPP:
> +    case DP_GRAPHIC_1BPP:
> +        qemu_log_mask(LOG_UNIMP, "%s: unimplemented graphic format %u",
> +                      __func__,
> +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> +        s->g_plane.format = PIXMAN_r8g8b8a8;
> +        break;
>      default:
> -        error_report("%s: unsupported graphic format %u", __func__,
> -                     s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> +        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid graphic format %u",
> +                      __func__,
> +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
> +        s->g_plane.format = PIXMAN_r8g8b8a8;
>          abort();
>      }
>  
>      switch (s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK) {
>      case 0:
> +        /* This is DP_NL_VID_CB_Y0_CR_Y1 ??? */
>          s->v_plane.format = PIXMAN_x8b8g8r8;
>          break;
>      case DP_NL_VID_Y0_CB_Y1_CR:
> @@ -681,10 +695,39 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
>      case DP_NL_VID_RGBA8880:
>          s->v_plane.format = PIXMAN_x8b8g8r8;
>          break;
> +    case DP_NL_VID_CR_Y0_CB_Y1:
> +    case DP_NL_VID_Y0_CR_Y1_CB:
> +    case DP_NL_VID_YV16:
> +    case DP_NL_VID_YV24:
> +    case DP_NL_VID_YV16CL:
> +    case DP_NL_VID_MONO:
> +    case DP_NL_VID_YV16CL2:
> +    case DP_NL_VID_YUV444:
> +    case DP_NL_VID_RGB888:
> +    case DP_NL_VID_RGB888_10BPC:
> +    case DP_NL_VID_YUV444_10BPC:
> +    case DP_NL_VID_YV16CL2_10BPC:
> +    case DP_NL_VID_YV16CL_10BPC:
> +    case DP_NL_VID_YV16_10BPC:
> +    case DP_NL_VID_YV24_10BPC:
> +    case DP_NL_VID_Y_ONLY_10BPC:
> +    case DP_NL_VID_YV16_420:
> +    case DP_NL_VID_YV16CL_420:
> +    case DP_NL_VID_YV16CL2_420:
> +    case DP_NL_VID_YV16_420_10BPC:
> +    case DP_NL_VID_YV16CL_420_10BPC:
> +    case DP_NL_VID_YV16CL2_420_10BPC:
> +        qemu_log_mask(LOG_UNIMP, "%s: unimplemented video format %u",
> +                      __func__,
> +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
> +        s->v_plane.format = PIXMAN_x8b8g8r8;
> +        break;
>      default:
> -        error_report("%s: unsupported video format %u", __func__,
> -                     s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
> -        abort();
> +        qemu_log_mask(LOG_UNIMP, "%s: invalid video format %u",
> +                      __func__,
> +                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
> +        s->v_plane.format = PIXMAN_x8b8g8r8;
> +        break;
>      }
>  
>      xlnx_dp_recreate_surface(s);
> -- 
> 2.43.0
>

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.