izzy/xemu
0
0
Fork 0
mirror of https://github.com/izzy2lost/xemu.git synced 2026-07-06 00:20:22 -07:00
Code Issues Packages Projects Releases Wiki Activity
112,225 Commits 2 Branches 7 Tags
2ee80bce4f7cf2ef78f996ea608755d4e97c94de
Commit Graph
112225 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mark Cave-Ayland ffa3a5f2be esp.c: update esp_fifo_{push, pop}() to call esp_update_drq() 
This ensures that the DRQ line is always set correctly when reading/writing
single bytes to/from the FIFO.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-16-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 743d873645 esp.c: introduce esp_update_drq() and update esp_fifo_{push, pop}_buf() to use it 
This new function sets the DRQ line correctly according to the current transfer
mode, direction and FIFO contents. Update esp_fifo_push_buf() and esp_fifo_pop_buf()
to use it so that DRQ is always set correctly when reading/writing multiple bytes
to/from the FIFO.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-15-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 2c1017bfc2 esp.c: move esp_set_phase() and esp_get_phase() towards the beginning of the file 
This allows these functions to be used earlier in the file without needing a
separate forward declaration.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-14-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 3cc70889a3 esp.c: prevent cmdfifo overflow in esp_cdb_ready() 
During normal use the cmdfifo will never wrap internally and cmdfifo_cdb_offset
will always indicate the start of the SCSI CDB. However it is possible that a
malicious guest could issue an invalid ESP command sequence such that cmdfifo
wraps internally and cmdfifo_cdb_offset could point beyond the end of the FIFO
data buffer.

Add an extra check to fifo8_peek_buf() to ensure that if the cmdfifo has wrapped
internally then esp_cdb_ready() will exit rather than allow scsi_cdb_length() to
access data outside the cmdfifo data buffer.

Reported-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240324191707.623175-13-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 5aa0df4067 esp.c: rework esp_cdb_length() into esp_cdb_ready() 
The esp_cdb_length() function is only used as part of a calculation to determine
whether the cmdfifo contains an entire SCSI CDB. Rework esp_cdb_length() into a
new esp_cdb_ready() function which both enables us to handle the case where
scsi_cdb_length() returns -1, plus simplify the logic for its callers.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240324191707.623175-12-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 5a50644e47 esp.c: don't assert() if FIFO empty when executing non-DMA SELATNS 
The current logic assumes that at least 1 byte is present in the FIFO when
executing a non-DMA SELATNS command, but this may not be the case if the
guest executes an invalid ESP command sequence.

Reported-by: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240324191707.623175-11-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 266170f91f esp.c: introduce esp_fifo_push_buf() function for pushing to the FIFO 
Instead of pushing data into the FIFO directly with fifo8_push_all(), add a new
esp_fifo_push_buf() function and use it accordingly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-10-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland da8381260b esp.c: change esp_fifo_pop_buf() to take ESPState 
Now that all users of esp_fifo_pop_buf() operate on the main FIFO there is no
need to pass the FIFO explicitly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-9-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 1f46d1c3a5 esp.c: use esp_fifo_push() instead of fifo8_push() 
There are still a few places that use fifo8_push() instead of esp_fifo_push() in
order to push a value into the FIFO. Update those places to use esp_fifo_push()
instead.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-8-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 61fa150d12 esp.c: change esp_fifo_pop() to take ESPState 
Now that all users of esp_fifo_pop() operate on the main FIFO there is no need
to pass the FIFO explicitly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-7-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 0e7dbe29c2 esp.c: change esp_fifo_push() to take ESPState 
Now that all users of esp_fifo_push() operate on the main FIFO there is no need
to pass the FIFO explicitly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-6-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 1828000b48 esp.c: replace cmdfifo use of esp_fifo_pop() in do_message_phase() 
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20240324191707.623175-5-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland 2260402be1 esp.c: replace esp_fifo_pop_buf() with esp_fifo8_pop_buf() in do_message_phase() 
The aim is to restrict the esp_fifo_*() functions so that they only operate on
the hardware FIFO. When reading from cmdfifo in do_message_phase() use the
underlying esp_fifo8_pop_buf() function directly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240324191707.623175-4-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland f87d048705 esp.c: replace esp_fifo_pop_buf() with esp_fifo8_pop_buf() in do_command_phase() 
The aim is to restrict the esp_fifo_*() functions so that they only operate on
the hardware FIFO. When reading from cmdfifo in do_command_phase() use the
underlying esp_fifo8_pop_buf() function directly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240324191707.623175-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Mark Cave-Ayland d103d0db71 esp.c: move esp_fifo_pop_buf() internals to new esp_fifo8_pop_buf() function 
Update esp_fifo_pop_buf() to be a simple wrapper onto the new esp_fifo8_pop_buf()
function.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20240324191707.623175-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 2024-04-04 15:17:53 +01:00
Zheyu MaandStefan Hajnoczi bbdf902366 block/virtio-blk: Fix memory leak from virtio_blk_zone_report 
This modification ensures that in scenarios where the buffer size is
insufficient for a zone report, the function will now properly set an
error status and proceed to a cleanup label, instead of merely
returning.

The following ASAN log reveals it:

==1767400==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 312 byte(s) in 1 object(s) allocated from:
    #0 0x64ac7b3280cd in malloc llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3
    #1 0x735b02fb9738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738)
    #2 0x64ac7d23be96 in virtqueue_split_pop hw/virtio/virtio.c:1612:12
    #3 0x64ac7d23728a in virtqueue_pop hw/virtio/virtio.c:1783:16
    #4 0x64ac7cfcaacd in virtio_blk_get_request hw/block/virtio-blk.c:228:27
    #5 0x64ac7cfca7c7 in virtio_blk_handle_vq hw/block/virtio-blk.c:1123:23
    #6 0x64ac7cfecb95 in virtio_blk_handle_output hw/block/virtio-blk.c:1157:5

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Message-id: 20240404120040.1951466-1-zheyuma97@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 2024-04-04 09:29:42 -04:00
Peter Maydell 786fd793b8 Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging 
* lsi53c895a: fix assertion failure with invalid Block Move
* vga: fix assertion failure with 4- and 16-color modes
* remove unnecessary assignment

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmYNKboUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroNMDgf/Wgw+qNkNooAhEH1V5l0xdyiF4QQU
# stz4kcKdWkQB5dsVy8utC3nN2baRFPgj6Utr2e8FqzxGuY8qYL3olh8k1ygiFiFz
# joSOxAlBuRUOsJq90EJUyGeFykJ/F/neJ2n6VjOtKyry9c8PnInjmuNMFYsxeLow
# j1VF6defALut/8wvxPm5WmfFzS1Hv3I9k/GqKSlAjNpY2COlibshEoNFuZZtpfeI
# JnUL5oB+sICoZH2/mM5a9Nv2z0NCHAwKF7alXVjfHWvdaRQO6bLlraDmPXmh0ZMY
# MsoULMQaeZCtC0vfc8XJZj/C/s2iO14gfqA23/mfGCLalyo7l1yh4e6JyQ==
# =xDOl
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 03 Apr 2024 11:04:42 BST
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
  pc_q35: remove unnecessary m->alias assignment
  lsi53c895a: avoid out of bounds access to s->msg[]
  vga: do not treat horiz pel panning value of 8 as "enabled"
  vga: adjust dirty memory region if pel panning is active
  vga: move computation of dirty memory region later
  vga: merge conditionals on shift control register

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 2024-04-03 12:52:03 +01:00
Peter Maydell e5c6528dce Update version for v9.0.0-rc2 release 
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 2024-04-02 20:59:43 +01:00
Paolo Bonzini 8fc4bdc537 pc_q35: remove unnecessary m->alias assignment 
The assignment is already inherited from pc-q35-8.2.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2024-04-02 18:08:59 +02:00
Paolo Bonzini e497e6a557 lsi53c895a: avoid out of bounds access to s->msg[] 
If no bytes are there to process in the message in phase,
the input data latch (s->sidl) is set to s->msg[-1].  Just
do nothing since no DMA is performed.

Reported-by: Chuhong Yuan <hslester96@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2024-04-02 18:08:59 +02:00
Paolo Bonzini 1d1ee7e0a1 vga: do not treat horiz pel panning value of 8 as "enabled" 
Horizontal pel panning bit 3 is only used in text mode.  In graphics
mode, it can be treated as if it was zero, thus not extending the
dirty memory region.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2024-04-02 18:08:59 +02:00
Paolo Bonzini 3b6d2b1962 vga: adjust dirty memory region if pel panning is active 
When pel panning is active, one more byte is read from each of the VGA
memory planes.  This has to be accounted in the computation of region_end,
otherwise vga_draw_graphic() fails an assertion:

qemu-system-i386: ../system/physmem.c:946: cpu_physical_memory_snapshot_get_dirty: Assertion `start + length <= snap->end' failed.

Reported-by: Helge Konetzka <hk@zapateado.de>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2244
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2024-04-02 18:08:59 +02:00
Paolo Bonzini 3826a372e4 vga: move computation of dirty memory region later 
Move the computation of region_start and region_end after the value of
"bits" is known.  This makes it possible to distinguish modes that
support horizontal pel panning from modes that do not.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2024-04-02 18:08:59 +02:00
Paolo Bonzini 5c00acebb6 vga: merge conditionals on shift control register 
There are two sets of conditionals using the shift control bits: one to
verify the palette and adjust disp_width, one to compute the "v" and
"bits" variables.  Merge them into one, with the extra benefit that
we now have the "bits" value available early and can use it to
compute region_end.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2024-04-02 18:08:59 +02:00
Peter Maydell 5456f2e235 Merge tag 'hw-misc-20240402' of https://github.com/philmd/qemu into staging 
Misc HW patch queue

- MAINTAINERS updates (Zhao, Glenn)
- Replace incorrect mentions of 'softmmu' by 'system' (Phil)
- Avoid using inlined functions with external linkage (Phil)
- Restrict CXL to x86 PC PCI-based machines (Phil)
- Remove unnecessary NULL check in bdrv_pad_request (Kevin)
- Fix a pair of -Werror=maybe-uninitialized (Marc-André)
- Initialize variable in xen_evtchn_soft_reset (Artem)
- Do not access virtio-net tx queue until vhost is started (Yajun)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmYMFMgACgkQ4+MsLN6t
# wN4wNA/+Pr4Qvt7xZ3ai5Ss4LUdFYw+qaw6di9KvHIkti8MlySHdniPraV7Uw2VR
# jrnI5sN488l6yjFQh3VIurrAvql6MruRR1/Pa3bIC4uGzydNVS75B7CA2pmIQ5hl
# Qiy4uQdgMk0dHiKdBjTVSnZaEkJ1+CNYvRK0aQcLUh3Dp/S+oGp6iyq2kWDhhgc6
# wYWDnfUICuYiz+ButXKaeGOhX3kJ6x4XQWKehF7G/DWxj2TWdoo8AchVM0jFe9/w
# W+EiOrdH8dHqJ3vKhsZnE/FuN4SObt1LuzLaNUVz8GVfeDcmek6U/5J6iCoqiRsG
# PbhBSlr87yoz8w4YPXVSGkq/1g1lU5QuK68tAEo0tjx+ipJz9i23QKUGF42YJH9R
# yruyp+cA0KfgyoaOsaXyWFzHRH6N13sIakBUF39B53d/pb5MqSwMjwcFDa6za+bY
# W4DS4T+5gRSmfjgFtdvaFdGJXa51blRttcBbwjcCmpg/1WCRBZoQv2bYNijil1F4
# jL+hrO60eJlaLrdyLDuXNvuOk4QE2qedxJo59oJO1DyGR8jzSN4a92xpasKIaazT
# vlZbRE1S2HPMQhfQIwa1yx2ul+tSXbvdtMyFPzKKNIIqFJcG/7VZLM+zvuFWn82I
# GDExQYJugFSEg9MGvwMeIXDzp5LiuxnIqyMw7GjSUdtsCFXfaDI=
# =Y4gO
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 02 Apr 2024 15:23:04 BST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20240402' of https://github.com/philmd/qemu:
  hw/net/virtio-net: fix qemu set used ring flag even vhost started
  hw/xen_evtchn: Initialize flush_kvm_routes
  gpio/pca955x: Update maintainer email address
  hw/nvme: fix -Werror=maybe-uninitialized
  plugins: fix -Werror=maybe-uninitialized false-positive
  block: Remove unnecessary NULL check in bdrv_pad_request()
  hw/i386/pc: Restrict CXL to PCI-based machines
  MAINTAINERS: Fix error-report.c entry
  qtest/libqos: Reduce size_to_prdtl() declaration scope
  accel/hvf: Un-inline hvf_arch_supports_guest_debug()
  hw/arm/smmu: Avoid using inlined functions with external linkage again
  target/ppc: Rename init_excp_4xx_softmmu() -> init_excp_4xx()
  gdbstub/system: Rename 'user_ctx' argument as 'ctx'
  gdbstub: Correct invalid mentions of 'softmmu' by 'system'
  accel/tcg/plugin: Remove CONFIG_SOFTMMU_GATE definition

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 2024-04-02 16:22:58 +01:00