OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
qemu-e2k/hw
History
Mark Cave-Ayland de7e2cb155 esp: ensure in-flight SCSI requests are always cancelled 
There is currently a check in esp_select() to cancel any in-flight SCSI requests
to ensure that issuing multiple select commands without continuing through the
rest of the ESP state machine ignores all but the last SCSI request. This is
also enforced through the addition of assert()s in esp_transfer_data() and
scsi_read_data().

The get_cmd() function does not call esp_select() when TC == 0 which means it is
possible for a fuzzer to trigger these assert()s by sending a select command when
TC == 0 immediately after a valid SCSI CDB has been submitted.

Since esp_select() is only called from get_cmd(), hoist the check to cancel
in-flight SCSI requests from esp_select() into get_cmd() to ensure it is always
called when executing a select command to initiate a new SCSI request.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Closes: https://gitlab.com/qemu-project/qemu/-/issues/662
Closes: https://gitlab.com/qemu-project/qemu/-/issues/663
Message-Id: <20211101183516.8455-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 		2021-11-02 15:57:27 +01:00
..
9pfs 9pfs: use P9Array in v9fs_walk() 2021-10-27 14:45:22 +02:00
acpi hw/acpi/aml-build: Add PPTT table 2021-10-21 08:03:58 -07:00
adc hw/adc: Add basic Aspeed ADC model 2021-10-12 08:20:08 +02:00
alpha hw/alpha: Provide a PCI-ISA bridge device node 2021-06-28 07:27:32 -07:00
arm Aspeed patches : 2021-10-22 09:02:12 -07:00
audio qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
avr hw/avr/atmega.c: use the avr51 cpu for atmega1280 2021-05-13 19:11:42 +02:00
block qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
char hw/char/sh_serial: Add device id to trace output 2021-10-30 18:39:37 +02:00
core machine: remove the done notifier for dynamic sysbus device type check 2021-11-01 19:44:11 +01:00
cpu cpu/core: Fix "help" of CPU core device types 2021-04-09 16:05:16 -04:00
cris Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
display macfb: add vertical blank interrupt 2021-10-08 13:31:03 +02:00
dma hw/dma: sifive_pdma: Don't run DMA when channel is disclaimed 2021-10-07 08:41:33 +10:00
gpio hw: aspeed_gpio: Fix GPIO array indexing 2021-10-12 08:20:08 +02:00
hppa docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
hyperv qbus: Rename qbus_create() to qbus_new() 2021-09-30 13:44:08 +01:00
i2c aspeed/i2c: QOMify AspeedI2CBus 2021-10-12 08:20:08 +02:00
i386 hw/i386: fix vmmouse registration 2021-11-02 15:57:27 +01:00
ide via-ide: Avoid using isa_get_irq() 2021-10-18 00:41:36 +02:00
input ps2: migration support for command reply queue 2021-09-10 07:32:32 +02:00
intc hw/intc/sh_intc: Remove unneeded local variable initialisers 2021-10-30 18:39:37 +02:00
ipack qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
ipmi ipmi/sim: fix watchdog_expired data type error in IPMIBmcSim struct 2021-07-08 14:15:01 -05:00
isa vt82c686: Add a method to VIA_ISA to raise ISA interrupts 2021-10-18 00:41:36 +02:00
m68k q800: drop 8-bit graphic_depth check for Apple 21 inch display 2021-10-20 16:25:04 +02:00
mem kconfig: split CONFIG_SPARSE_MEM from fuzzing 2021-10-14 09:50:56 +02:00
microblaze Do not include sysemu/sysemu.h if it's not really necessary 2021-05-02 17:24:50 +02:00
mips hw/mips/boston: Add FDT generator 2021-10-18 00:41:36 +02:00
misc mac_via: add GPIO for A/UX mode 2021-10-20 16:18:40 +02:00
net virtio-net: vhost control virtqueue support 2021-10-20 04:44:05 -04:00
nios2 Do not include cpu.h if it's not really necessary 2021-05-02 17:24:51 +02:00
nubus qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
nvme qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
nvram hw/nvram: Fix Memory Leak in Xilinx ZynqMP eFuse device 2021-10-23 18:50:33 +02:00
openrisc Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
pci pci: fix PCI resource reserve capability on BE 2021-10-20 06:18:17 -04:00
pci-bridge qdev: Make DeviceState.id independent of QemuOpts 2021-10-15 16:06:35 +02:00
pci-host hw/sh4: Coding style: White space fixes 2021-10-30 11:46:40 +02:00
pcmcia hw/pcmcia: Do not register PCMCIA type if not required 2021-05-02 17:24:50 +02:00
ppc hw/ppc/ppc4xx_pci: Fix ppc4xx_pci_map_irq() for recent Linux kernels 2021-10-21 11:42:47 +11:00
rdma pvrdma: Fix the ring init error flow (CVE-2021-3608) 2021-07-04 22:47:51 +03:00
remote hw/remote/proxy: Categorize Wireless devices as 'Network' ones 2021-10-04 09:47:26 +02:00
riscv hw/riscv: opentitan: Fixup the PLIC context addresses 2021-10-28 14:39:23 +10:00
rtc docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
rx hw/rx/rx-gdbsim: Do not accept invalid memory size 2021-05-03 10:07:41 +02:00
s390x s390x/ipl: check kernel command line size 2021-10-13 16:20:55 +02:00
scsi esp: ensure in-flight SCSI requests are always cancelled 2021-11-02 15:57:27 +01:00
sd speed/sdhci: Add trace events 2021-10-22 09:52:17 +02:00
sensor hw/misc: Add Infineon DPS310 sensor model 2021-09-20 08:50:59 +02:00
sh4 hw/intc/sh_intc: Inline and drop sh_intc_source() function 2021-10-30 18:39:37 +02:00
smbios hw/smbios: support for type 41 (onboard devices extended information) 2021-05-14 10:26:18 -04:00
sparc sun4m: fix setting CPU id when more than one CPU is present 2021-09-08 11:09:45 +01:00
sparc64 hw/block/fdc: Extract ISA floppy controllers to fdc-isa.c 2021-06-25 08:53:28 -04:00
ssi aspeed/smc: Use a container for the flash mmio address space 2021-10-22 09:52:17 +02:00
timer hw/timer/sh_timer: Remove use of hw_error 2021-10-30 18:39:37 +02:00
tpm tpm: mark correct memory region range dirty when clearing RAM 2021-10-02 08:43:21 +02:00
tricore hw/tricore: fix inclusion of tricore_testboard 2021-07-20 20:10:21 +02:00
usb qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
vfio vfio/common: Add a trace point when a MMIO RAM section cannot be mapped 2021-11-01 12:17:51 -06:00
virtio vhost-vdpa: multiqueue support 2021-10-20 04:44:05 -04:00
watchdog watchdog: remove select_watchdog_action 2021-11-02 15:57:27 +01:00
xen softmmu/qdev-monitor: add error handling in qdev_set_id 2021-10-15 16:08:46 +02:00
xenpv meson: convert hw/arch* 2020-08-21 06:30:33 -04:00
xtensa Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
Kconfig hw/arm: xlnx-zcu102: Add Xilinx eFUSE device 2021-09-30 13:42:10 +01:00
meson.build sensor: Move hardware sensors from misc to a sensor directory 2021-06-17 07:10:32 -05:00