diff options
| author | Philippe Mathieu-Daudé <philmd@redhat.com> | 2020-03-05 13:12:51 +0100 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2020-03-17 15:08:50 +1100 |
| commit | ff78b728f6c9d2c274dab20114bfe052322365a1 (patch) | |
| tree | 4cb1c74428cc0ea33c80b1b5a8812c16b701b97e | |
| parent | 81e705494f2915b7b6174bc5695d19ee4a083a85 (diff) | |
| download | qemu-ff78b728f6c9d2c274dab20114bfe052322365a1.zip qemu-ff78b728f6c9d2c274dab20114bfe052322365a1.tar.gz qemu-ff78b728f6c9d2c274dab20114bfe052322365a1.tar.bz2 | |
hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size
The 'union srp_iu' is meant as a pointer to any SRP Information
Unit type, it is not related to the size of a VIO DMA buffer.
Use a plain buffer for the VIO DMA read/write calls.
We can remove the reserved buffer from the 'union srp_iu'.
This issue was noticed when replacing the zero-length arrays
from hw/scsi/srp.h with flexible array member,
'clang -fsanitize=undefined' reported:
hw/scsi/spapr_vscsi.c:69:29: error: field 'iu' with variable sized type 'union viosrp_iu' not at the end of a struct or class is a GNU extension [-Werror,-Wgnu-variable-sized-type-not-at-end]
union viosrp_iu iu;
^
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20200305121253.19078-6-philmd@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| -rw-r--r-- | hw/scsi/spapr_vscsi.c | 10 | ||||
| -rw-r--r-- | hw/scsi/viosrp.h | 1 |
2 files changed, 5 insertions, 6 deletions
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c index 70547f9..acf9bb5 100644 --- a/hw/scsi/spapr_vscsi.c +++ b/hw/scsi/spapr_vscsi.c @@ -66,7 +66,7 @@ typedef union vscsi_crq { typedef struct vscsi_req { vscsi_crq crq; - union viosrp_iu iu; + uint8_t viosrp_iu_buf[SRP_MAX_IU_LEN]; /* SCSI request tracking */ SCSIRequest *sreq; @@ -99,7 +99,7 @@ typedef struct { static union viosrp_iu *req_iu(vscsi_req *req) { - return &req->iu; + return (union viosrp_iu *)req->viosrp_iu_buf; } static struct vscsi_req *vscsi_get_req(VSCSIState *s) @@ -183,7 +183,7 @@ static int vscsi_send_iu(VSCSIState *s, vscsi_req *req, /* First copy the SRP */ rc = spapr_vio_dma_write(&s->vdev, req->crq.s.IU_data_ptr, - &req->iu, length); + &req->viosrp_iu_buf, length); if (rc) { fprintf(stderr, "vscsi_send_iu: DMA write failure !\n"); } @@ -602,7 +602,7 @@ static const VMStateDescription vmstate_spapr_vscsi_req = { .minimum_version_id = 1, .fields = (VMStateField[]) { VMSTATE_BUFFER(crq.raw, vscsi_req), - VMSTATE_BUFFER(iu.srp.reserved, vscsi_req), + VMSTATE_BUFFER(viosrp_iu_buf, vscsi_req), VMSTATE_UINT32(qtag, vscsi_req), VMSTATE_BOOL(active, vscsi_req), VMSTATE_UINT32(data_len, vscsi_req), @@ -1103,7 +1103,7 @@ static void vscsi_got_payload(VSCSIState *s, vscsi_crq *crq) } /* XXX Handle failure differently ? */ - if (spapr_vio_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->iu, + if (spapr_vio_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->viosrp_iu_buf, crq->s.IU_length)) { fprintf(stderr, "vscsi_got_payload: DMA read failure !\n"); vscsi_put_req(req); diff --git a/hw/scsi/viosrp.h b/hw/scsi/viosrp.h index 25676c2..e5f9768 100644 --- a/hw/scsi/viosrp.h +++ b/hw/scsi/viosrp.h @@ -49,7 +49,6 @@ union srp_iu { struct srp_tsk_mgmt tsk_mgmt; struct srp_cmd cmd; struct srp_rsp rsp; - uint8_t reserved[SRP_MAX_IU_LEN]; }; enum viosrp_crq_formats { |