Skip to content

Commit 786fd79

Browse files
pm215pm215
committed
Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging
* lsi53c895a: fix assertion failure with invalid Block Move * vga: fix assertion failure with 4- and 16-color modes * remove unnecessary assignment # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmYNKboUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNMDgf/Wgw+qNkNooAhEH1V5l0xdyiF4QQU # stz4kcKdWkQB5dsVy8utC3nN2baRFPgj6Utr2e8FqzxGuY8qYL3olh8k1ygiFiFz # joSOxAlBuRUOsJq90EJUyGeFykJ/F/neJ2n6VjOtKyry9c8PnInjmuNMFYsxeLow # j1VF6defALut/8wvxPm5WmfFzS1Hv3I9k/GqKSlAjNpY2COlibshEoNFuZZtpfeI # JnUL5oB+sICoZH2/mM5a9Nv2z0NCHAwKF7alXVjfHWvdaRQO6bLlraDmPXmh0ZMY # MsoULMQaeZCtC0vfc8XJZj/C/s2iO14gfqA23/mfGCLalyo7l1yh4e6JyQ== # =xDOl # -----END PGP SIGNATURE----- # gpg: Signature made Wed 03 Apr 2024 11:04:42 BST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: pc_q35: remove unnecessary m->alias assignment lsi53c895a: avoid out of bounds access to s->msg[] vga: do not treat horiz pel panning value of 8 as "enabled" vga: adjust dirty memory region if pel panning is active vga: move computation of dirty memory region later vga: merge conditionals on shift control register Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2 parents e5c6528 + 8fc4bdc commit 786fd79

File tree

3 files changed

+85
-81
lines changed

3 files changed

+85
-81
lines changed

‎hw/display/vga.c‎

Lines changed: 73 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1501,31 +1501,6 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
15011501
disp_width = width;
15021502
depth = s->get_bpp(s);
15031503

1504-
region_start = (s->params.start_addr * 4);
1505-
region_end = region_start + (ram_addr_t)s->params.line_offset * height;
1506-
region_end += width * depth / 8; /* scanline length */
1507-
region_end -= s->params.line_offset;
1508-
if (region_end > s->vbe_size || depth == 0 || depth == 15) {
1509-
/*
1510-
* We land here on:
1511-
* - wraps around (can happen with cirrus vbe modes)
1512-
* - depth == 0 (256 color palette video mode)
1513-
* - depth == 15
1514-
*
1515-
* Take the safe and slow route:
1516-
* - create a dirty bitmap snapshot for all vga memory.
1517-
* - force shadowing (so all vga memory access goes
1518-
* through vga_read_*() helpers).
1519-
*
1520-
* Given this affects only vga features which are pretty much
1521-
* unused by modern guests there should be no performance
1522-
* impact.
1523-
*/
1524-
region_start = 0;
1525-
region_end = s->vbe_size;
1526-
force_shadow = true;
1527-
}
1528-
15291504
/* bits 5-6: 0 = 16-color mode, 1 = 4-color mode, 2 = 256-color mode. */
15301505
shift_control = (s->gr[VGA_GFX_MODE] >> 5) & 3;
15311506
double_scan = (s->cr[VGA_CRTC_MAX_SCAN] >> 7);
@@ -1546,13 +1521,86 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
15461521
}
15471522

15481523
if (shift_control == 0) {
1524+
full_update |= update_palette16(s);
15491525
if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
15501526
disp_width <<= 1;
1527+
v = VGA_DRAW_LINE4D2;
1528+
} else {
1529+
v = VGA_DRAW_LINE4;
15511530
}
1531+
bits = 4;
1532+
15521533
} else if (shift_control == 1) {
1534+
full_update |= update_palette16(s);
15531535
if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
15541536
disp_width <<= 1;
1537+
v = VGA_DRAW_LINE2D2;
1538+
} else {
1539+
v = VGA_DRAW_LINE2;
15551540
}
1541+
bits = 4;
1542+
1543+
} else {
1544+
switch (depth) {
1545+
default:
1546+
case 0:
1547+
full_update |= update_palette256(s);
1548+
v = VGA_DRAW_LINE8D2;
1549+
bits = 4;
1550+
break;
1551+
case 8:
1552+
full_update |= update_palette256(s);
1553+
v = VGA_DRAW_LINE8;
1554+
bits = 8;
1555+
break;
1556+
case 15:
1557+
v = s->big_endian_fb ? VGA_DRAW_LINE15_BE : VGA_DRAW_LINE15_LE;
1558+
bits = 16;
1559+
break;
1560+
case 16:
1561+
v = s->big_endian_fb ? VGA_DRAW_LINE16_BE : VGA_DRAW_LINE16_LE;
1562+
bits = 16;
1563+
break;
1564+
case 24:
1565+
v = s->big_endian_fb ? VGA_DRAW_LINE24_BE : VGA_DRAW_LINE24_LE;
1566+
bits = 24;
1567+
break;
1568+
case 32:
1569+
v = s->big_endian_fb ? VGA_DRAW_LINE32_BE : VGA_DRAW_LINE32_LE;
1570+
bits = 32;
1571+
break;
1572+
}
1573+
}
1574+
1575+
/* Horizontal pel panning bit 3 is only used in text mode. */
1576+
hpel = bits <= 8 ? s->params.hpel & 7 : 0;
1577+
1578+
region_start = (s->params.start_addr * 4);
1579+
region_end = region_start + (ram_addr_t)s->params.line_offset * height;
1580+
region_end += width * depth / 8; /* scanline length */
1581+
region_end -= s->params.line_offset;
1582+
if (hpel) {
1583+
region_end += 4;
1584+
}
1585+
if (region_end > s->vbe_size || depth == 0 || depth == 15) {
1586+
/*
1587+
* We land here on:
1588+
* - wraps around (can happen with cirrus vbe modes)
1589+
* - depth == 0 (256 color palette video mode)
1590+
* - depth == 15
1591+
*
1592+
* Take the safe and slow route:
1593+
* - create a dirty bitmap snapshot for all vga memory.
1594+
* - force shadowing (so all vga memory access goes
1595+
* through vga_read_*() helpers).
1596+
*
1597+
* Given this affects only vga features which are pretty much
1598+
* unused by modern guests there should be no performance
1599+
* impact.
1600+
*/
1601+
region_start = 0;
1602+
region_end = s->vbe_size;
1603+
force_shadow = true;
15561604
}
15571605

15581606
/*
@@ -1607,53 +1655,6 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
16071655
}
16081656
}
16091657

1610-
if (shift_control == 0) {
1611-
full_update |= update_palette16(s);
1612-
if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
1613-
v = VGA_DRAW_LINE4D2;
1614-
} else {
1615-
v = VGA_DRAW_LINE4;
1616-
}
1617-
bits = 4;
1618-
} else if (shift_control == 1) {
1619-
full_update |= update_palette16(s);
1620-
if (sr(s, VGA_SEQ_CLOCK_MODE) & 8) {
1621-
v = VGA_DRAW_LINE2D2;
1622-
} else {
1623-
v = VGA_DRAW_LINE2;
1624-
}
1625-
bits = 4;
1626-
} else {
1627-
switch(s->get_bpp(s)) {
1628-
default:
1629-
case 0:
1630-
full_update |= update_palette256(s);
1631-
v = VGA_DRAW_LINE8D2;
1632-
bits = 4;
1633-
break;
1634-
case 8:
1635-
full_update |= update_palette256(s);
1636-
v = VGA_DRAW_LINE8;
1637-
bits = 8;
1638-
break;
1639-
case 15:
1640-
v = s->big_endian_fb ? VGA_DRAW_LINE15_BE : VGA_DRAW_LINE15_LE;
1641-
bits = 16;
1642-
break;
1643-
case 16:
1644-
v = s->big_endian_fb ? VGA_DRAW_LINE16_BE : VGA_DRAW_LINE16_LE;
1645-
bits = 16;
1646-
break;
1647-
case 24:
1648-
v = s->big_endian_fb ? VGA_DRAW_LINE24_BE : VGA_DRAW_LINE24_LE;
1649-
bits = 24;
1650-
break;
1651-
case 32:
1652-
v = s->big_endian_fb ? VGA_DRAW_LINE32_BE : VGA_DRAW_LINE32_LE;
1653-
bits = 32;
1654-
break;
1655-
}
1656-
}
16571658
vga_draw_line = vga_draw_line_table[v];
16581659

16591660
if (!is_buffer_shared(surface) && s->cursor_invalidate) {
@@ -1665,7 +1666,6 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
16651666
width, height, v, line_offset, s->cr[9], s->cr[VGA_CRTC_MODE],
16661667
s->params.line_compare, sr(s, VGA_SEQ_CLOCK_MODE));
16671668
#endif
1668-
hpel = bits <= 8 ? s->params.hpel : 0;
16691669
addr1 = (s->params.start_addr * 4);
16701670
bwidth = DIV_ROUND_UP(width * bits, 8);
16711671
if (hpel) {

‎hw/i386/pc_q35.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,6 @@ static void pc_q35_8_1_machine_options(MachineClass *m)
393393
{
394394
PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
395395
pc_q35_8_2_machine_options(m);
396-
m->alias = NULL;
397396
pcmc->broken_32bit_mem_addr_check = true;
398397
compat_props_add(m->compat_props, hw_compat_8_1, hw_compat_8_1_len);
399398
compat_props_add(m->compat_props, pc_compat_8_1, pc_compat_8_1_len);

‎hw/scsi/lsi53c895a.c‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -927,13 +927,18 @@ static void lsi_do_msgin(LSIState *s)
927927
assert(len > 0 && len <= LSI_MAX_MSGIN_LEN);
928928
if (len > s->dbc)
929929
len = s->dbc;
930-
pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
931-
/* Linux drivers rely on the last byte being in the SIDL. */
932-
s->sidl = s->msg[len - 1];
933-
s->msg_len -= len;
934-
if (s->msg_len) {
935-
memmove(s->msg, s->msg + len, s->msg_len);
936-
} else {
930+
931+
if (len) {
932+
pci_dma_write(PCI_DEVICE(s), s->dnad, s->msg, len);
933+
/* Linux drivers rely on the last byte being in the SIDL. */
934+
s->sidl = s->msg[len - 1];
935+
s->msg_len -= len;
936+
if (s->msg_len) {
937+
memmove(s->msg, s->msg + len, s->msg_len);
938+
}
939+
}
940+
941+
if (!s->msg_len) {
937942
/* ??? Check if ATN (not yet implemented) is asserted and maybe
938943
switch to PHASE_MO. */
939944
switch (s->msg_action) {

0 commit comments

Comments
 (0)