Hi,
On Fri, Dec 20, 2019 at 05:36:36PM +0100, Helge Deller wrote:
> On 20.12.19 08:26, Helge Deller wrote:
> > On 19.12.19 01:28, Richard Henderson wrote:
> >> On 11/3/19 10:56 AM, Sven Schnelle wrote:
> >>> This adds emulation of Artist graphics good enough
> >>> to get a Text console on both Linux and HP-UX. The
> >>> X11 server from HP-UX also works.
> >>>
> >>> Signed-off-by: Sven Schnelle <sv...@stackframe.org>
> >>> ---
> >>> hw/display/Kconfig | 4 +
> >>> hw/display/Makefile.objs | 1 +
> >>> hw/display/artist.c | 1449 ++++++++++++++++++++++++++++++++++++++
> >>> hw/display/trace-events | 9 +
> >>> hw/hppa/Kconfig | 1 +
> >>> hw/hppa/hppa_hardware.h | 1 +
> >>> hw/hppa/machine.c | 9 +
> >>> 7 files changed, 1474 insertions(+)
> >>> create mode 100644 hw/display/artist.c
> >>
> >> Seems to have some problems rebased upon master:
> >>
> >> ...
> >
> > Richard, the attached patch (for seabios-hppa) fixes it for me.
> > Can you test as well?
> > It fixes the sti text column to go out-of-range and thus outside the
> > framebuffer memory.
>
> The attached patch is even better.
> It always wraps to the next line (or scrolls the screen if necessary) if
> the end of the line has been reached.
>
> Helge
> diff --git a/src/parisc/sti.c b/src/parisc/sti.c
> index 7935770..61e7002 100644
> --- a/src/parisc/sti.c
> +++ b/src/parisc/sti.c
> @@ -168,5 +168,10 @@ void sti_putc(const char c)
> }
> return;
> }
> +
> + /* wrap to next line or scroll screen if EOL reached */
> + if (col >= ((sti_glob_cfg.onscreen_x / font->width) - 1))
> + sti_putc('\n');
> +
> sti_putchar(rom, row, col++, c);
> }
Besides this, the root cause is the out-of-bounds check in vram_bit_write():
This fixes the crash for me. I'll resend an updated version later. Thanks for
helping debugging this issue!
diff --git a/hw/display/artist.c b/hw/display/artist.c
index 1d6c7d5d76..13c770e795 100644
--- a/hw/display/artist.c
+++ b/hw/display/artist.c
@@ -360,7 +360,7 @@ static void vram_bit_write(ARTISTState *s, int posx, int
posy, bool incr_x,
return;
}
- if (posy * width + posx > buf->size) {
+ if (posy * width + posx >= buf->size) {
qemu_log("write outside bounds: wants %dx%d, max size %dx%d\n",
posx, posy, width, height);
return;
Regards
Sven
