aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi
AgeCommit message (Collapse)AuthorFilesLines
2016-07-07tap: vhost busy polling supportJason Wang1-1/+1
This patch add the capability of basic vhost net busy polling which is supported by recent kernel. User could configure the maximum number of us that could be spent on busy polling through a new property of tap "poll-us". Cc: Greg Kurz <groug@kaod.org> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-07-05Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into stagingPeter Maydell1-7/+8
Block layer patches # gpg: Signature made Tue 05 Jul 2016 16:46:14 BST # gpg: using RSA key 0x7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: (43 commits) block/qcow2: Don't use cpu_to_*w() block: Convert bdrv_co_preadv/pwritev to BdrvChild block: Convert bdrv_prwv_co() to BdrvChild block: Convert bdrv_pwrite_zeroes() to BdrvChild block: Convert bdrv_pwrite(v/_sync) to BdrvChild block: Convert bdrv_pread(v) to BdrvChild block: Convert bdrv_write() to BdrvChild block: Convert bdrv_read() to BdrvChild block: Use BlockBackend for I/O in bdrv_commit() block: Move bdrv_commit() to block/commit.c block: Convert bdrv_co_do_readv/writev to BdrvChild block: Convert bdrv_aio_writev() to BdrvChild block: Convert bdrv_aio_readv() to BdrvChild block: Convert bdrv_co_writev() to BdrvChild block: Convert bdrv_co_readv() to BdrvChild vhdx: Some more BlockBackend use in vhdx_create() blkreplay: Convert to byte-based I/O vvfat: Use BdrvChild for s->qcow block/qdev: Fix NULL access when using BB twice block: fix return code for partial write for Linux AIO ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-05block: Switch transfer length bounds to byte-basedEric Blake1-6/+6
Sector-based limits are awkward to think about; in our on-going quest to move to byte-based interfaces, convert max_transfer_length and opt_transfer_length. Rename them (dropping the _length suffix) so that the compiler will help us catch the change in semantics across any rebased code, and improve the documentation. Use unsigned values, so that we don't have to worry about negative values and so that bit-twiddling is easier; however, we are still constrained by 2^31 of signed int in most APIs. When a value comes from an external source (iscsi and raw-posix), sanitize the results to ensure that opt_transfer is a power of 2. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-07-05block: Give nonzero result to blk_get_max_transfer_length()Eric Blake1-6/+6
Making all callers special-case 0 as unlimited is awkward, and we DO have a hard maximum of BDRV_REQUEST_MAX_SECTORS given our current block layer API limits. In the case of scsi, this means that we now always advertise a limit to the guest, even in cases where the underlying layers previously use 0 for no inherent limit beyond the block layer. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-07-05scsi: Advertise limits by blocksize, not 512Eric Blake1-1/+2
s->blocksize may be larger than 512, in which case our tweaks to max_xfer_len and opt_xfer_len must be scaled appropriately. CC: qemu-stable@nongnu.org Reported-by: Fam Zheng <famz@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-07-05vmw_pvscsi: remove unnecessary internal msi state flagCao jin1-6/+3
Internal flag msi_used is uncesessary, msi_uninit() could be called directly, msi_enabled() is enough to check device msi state. But for migration compatibility, keep the field in structure. cc: Paolo Bonzini <pbonzini@redhat.com> cc: Dmitry Fleytman <dmitry@daynix.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>
2016-07-05mptsas: remove unnecessary internal msi state flagCao jin2-14/+6
internal flag msi_in_use in unnecessary, msi_uninit() could be called directly, and msi_enabled() is enough to check device msi state. cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-05megasas: remove unnecessary megasas_use_msi()Cao jin1-9/+2
megasas overwrites user configuration when msi_init fail to flag internal msi state, which is unsuitable. megasa_use_msi() is unnecessary, we can call msi_uninit() directly when unrealize, even no need to call msi_enabled() first. cc: Hannes Reinecke <hare@suse.de> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> Acked-by: Hannes Reinecke <hare@suse.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-05pci: Convert msi_init() to Error and fix callers to check itCao jin3-13/+46
msi_init() reports errors with error_report(), which is wrong when it's used in realize(). Fix by converting it to Error. Fix its callers to handle failure instead of ignoring it. For those callers who don't handle the failure, it might happen: when user want msi on, but he doesn't get what he want because of msi_init fails silently. cc: Gerd Hoffmann <kraxel@redhat.com> cc: John Snow <jsnow@redhat.com> cc: Dmitry Fleytman <dmitry@daynix.com> cc: Jason Wang <jasowang@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> cc: Hannes Reinecke <hare@suse.de> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Alex Williamson <alex.williamson@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Hannes Reinecke <hare@suse.com>
2016-07-05megasas: change msi/msix property typeCao jin1-17/+11
>From bit to enum OnOffAuto. cc: Hannes Reinecke <hare@suse.de> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Hannes Reinecke <hare@suse.com>
2016-07-05mptsas: change msi property typeCao jin2-3/+5
>From uint32 to enum OnOffAuto, and give it a shorter name. cc: Paolo Bonzini <pbonzini@redhat.com> cc: Michael S. Tsirkin <mst@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-05change pvscsi_init_msi() type to voidCao jin1-3/+1
Nobody use its return value, so change the type to void. cc: Michael S. Tsirkin <mst@redhat.com> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Markus Armbruster <armbru@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Dmitry Fleytman <dmitry@daynix.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-06-29Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell1-2/+3
* serial port fixes (Paolo) * Q35 modeling improvements (Paolo, Vasily) * chardev cleanup improvements (Marc-André) * iscsi bugfix (Peter L.) * cpu_exec patch from multi-arch patches (Peter C.) * pci-assign tweak (Lin Ma) # gpg: Signature made Wed 29 Jun 2016 15:56:30 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: (35 commits) socket: unlink unix socket on remove socket: add listen feature char: clean up remaining chardevs when leaving vhost-user: disable chardev handlers on close vhost-user-test: fix g_cond_wait_until compat implementation vl: smp_parse: fix regression ich9: implement SCI_IRQ_SEL register ich9: implement ACPI_EN register serial: reinstate watch after migration serial: remove watch on reset char: change qemu_chr_fe_add_watch to return unsigned serial: separate serial_xmit and serial_watch_cb serial: simplify tsr_retry reset serial: make tsr_retry unsigned iscsi: fix assertion in is_sector_request_lun_aligned target-*: Don't redefine cpu_exec() pci-assign: Move "Invalid ROM" error message to pci-assign-load-rom.c vnc: generalize "VNC server running on ..." message scsi: esp: fix migration MC146818 RTC: add GPIO access to output IRQ ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-29scsi: esp: fix migrationPaolo Bonzini1-2/+3
Commit 926cde5 ("scsi: esp: make cmdbuf big enough for maximum CDB size", 2016-06-16) changed the size of a migrated field. Split it in two parts, and only migrate the second part in a new vmstate version. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-28Revert "virtio: sync the dataplane vring state to the virtqueue before ↵Stefan Hajnoczi1-5/+0
virtio_save" This reverts commit 10a06fd65f667a972848ebbbcac11bdba931b544. Dataplane has used the same virtqueue code as non-dataplane since commits e24a47c5b73e04f94030e2daa356c7582aebfca2 ("virtio-scsi: do not use vring in dataplane") and 03de2f527499ae0c6d16a379665d072345254f2c ("virtio-blk: do not use vring in dataplane"). It is no longer necessary to stop dataplane in order to sync state since there is no duplicated virtqueue state. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Pavel Butsykin <pbutsykin@virtuozzo.com> Message-id: 1466503331-9831-1-git-send-email-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-24virtio-bus: remove old set_host_notifier callbackCornelia Huck1-15/+4
All users have been converted to the new ioevent callbacks. Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-06-24virtio-bus: have callers tolerate new host notifier apiCornelia Huck1-5/+15
Have vhost and dataplane use the new api for transports that have been converted. Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-06-20Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' ↵Peter Maydell1-0/+204
into staging # gpg: Signature made Mon 20 Jun 2016 21:29:27 BST # gpg: using RSA key 0x9CA4ABB381AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" # Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8 * remotes/stefanha/tags/tracing-pull-request: (42 commits) trace: split out trace events for linux-user/ directory trace: split out trace events for qom/ directory trace: split out trace events for target-ppc/ directory trace: split out trace events for target-s390x/ directory trace: split out trace events for target-sparc/ directory trace: split out trace events for net/ directory trace: split out trace events for audio/ directory trace: split out trace events for ui/ directory trace: split out trace events for hw/alpha/ directory trace: split out trace events for hw/arm/ directory trace: split out trace events for hw/acpi/ directory trace: split out trace events for hw/vfio/ directory trace: split out trace events for hw/s390x/ directory trace: split out trace events for hw/pci/ directory trace: split out trace events for hw/ppc/ directory trace: split out trace events for hw/9pfs/ directory trace: split out trace events for hw/i386/ directory trace: split out trace events for hw/isa/ directory trace: split out trace events for hw/sd/ directory trace: split out trace events for hw/sparc/ directory ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-20trace: split out trace events for hw/scsi/ directoryDaniel P. Berrange1-0/+204
Move all trace-events for files in the hw/scsi/ directory to their own file. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 1466066426-16657-16-git-send-email-berrange@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-20coccinelle: Remove unnecessary variables for function return valueEduardo Habkost2-8/+2
Use Coccinelle script to replace 'ret = E; return ret' with 'return E'. The script will do the substitution only when the function return type and variable type are the same. Manual fixups: * audio/audio.c: coding style of "read (...)" and "write (...)" * block/qcow2-cluster.c: wrap line to make it shorter * block/qcow2-refcount.c: change indentation of wrapped line * target-tricore/op_helper.c: fix coding style of "remainder|quotient" * target-mips/dsp_helper.c: reverted changes because I don't want to argue about checkpatch.pl * ui/qemu-pixman.c: fix line indentation * block/rbd.c: restore blank line between declarations and statements Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <1465855078-19435-4-git-send-email-ehabkost@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> [Unused Coccinelle rule name dropped along with a redundant comment; whitespace touched up in block/qcow2-cluster.c; stale commit message paragraph deleted] Signed-off-by: Markus Armbruster <armbru@redhat.com>
2016-06-16scsi: esp: make cmdbuf big enough for maximum CDB sizePrasad J Pandit1-2/+4
While doing DMA read into ESP command buffer 's->cmdbuf', it could write past the 's->cmdbuf' area, if it was transferring more than 16 bytes. Increase the command buffer size to 32, which is maximum when 's->do_cmd' is set, and add a check on 'len' to avoid OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi: esp: clean up handle_ti/esp_do_dma if s->do_cmdPaolo Bonzini1-7/+4
Avoid duplicated code between esp_do_dma and handle_ti. esp_do_dma has the same code that handle_ti contains after the call to esp_do_dma; but the code in handle_ti is never reached because it is in an "else if". Remove the else and also the pointless return. esp_do_dma also has a partially dead assignment of the to_device variable. Sink it to the point where it's actually used. Finally, assert that the other caller of esp_do_dma (esp_transfer_data) only transfers data and not a command. This is true because get_cmd cancels the old request synchronously before its caller handle_satn_stop sets do_cmd to 1. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi: esp: respect FIFO invariant after message phasePaolo Bonzini1-1/+1
The FIFO contains two bytes; hence the write ptr should be two bytes ahead of the read pointer. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi: esp: check buffer length before reading scsi commandPrasad J Pandit1-0/+3
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() in non-DMA mode, uses 'ti_size' to read scsi command into a buffer. Add check to validate command length against buffer size to avoid any overrun. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464717207-7549-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi-disk: Use (unsigned long) typecasts when using "%lu" format stringThomas Huth1-4/+4
Some source code analyzers like cppcheck spill out a warning if the sign of the argument does not match the format string. Ticket: https://bugs.launchpad.net/qemu/+bug/1589564 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1465805418-15906-1-git-send-email-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-08Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell3-11/+12
* max-ram-below-4g improvement (Gerd) * escc fix (xiaoqiang) * ESP fix (Prasad) * scsi-disk tweaks/fix (me) * Makefile dependency fixes (me) * PKGVERSION improvement (Fam) * -vnc man improvement (Robert) # gpg: Signature made Tue 07 Jun 2016 18:06:22 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" * remotes/bonzini/tags/for-upstream: vnc: list the 'to' parameter of '-vnc' in the qemu man page scsi-disk: add missing break Makefile: Derive "PKGVERSION" from "git describe" by default Makefile: add dependency on scripts/hxtool Makefile: add dependency on scripts/make_device_config.sh Makefile: add dependency on scripts/create_config Makefile: Add a "FORCE" target scsi: megasas: null terminate bios version buffer scsi: mark TYPE_SCSI_DISK_BASE as abstract scsi: esp: check TI buffer index before read/write hw/char: QOM'ify escc.c (fix) pc: allow raising low memory via max-ram-below-4g option tests: Rename tests/Makefile to tests/Makefile.include Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-06-07virtio: drop duplicate virtio_queue_get_id() functionStefan Hajnoczi1-1/+1
The virtio_queue_get_id() function is the lesser used duplicate of virtio_get_queue_index(). Use the latter instead. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1463767461-17922-1-git-send-email-stefanha@redhat.com
2016-06-07virtio-scsi: Remove op blocker for dataplaneFam Zheng1-62/+0
The previous patch dropped all op blockers from virtio-blk data plane. The situation of virtio-scsi is exactly the same it can drop them too. Signed-off-by: Fam Zheng <famz@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 1463969978-24970-5-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-06-07scsi-disk: add missing breakPaolo Bonzini1-0/+1
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-07scsi: megasas: null terminate bios version bufferPrasad J Pandit1-0/+1
While reading information via 'megasas_ctrl_get_info' routine, a local bios version buffer isn't null terminated. Add the terminating null byte to avoid any OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-06scsi: mark TYPE_SCSI_DISK_BASE as abstractPaolo Bonzini1-0/+1
Suggested-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-06scsi: esp: check TI buffer index before read/writePrasad J Pandit1-11/+9
The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte FIFO buffers. One is used to handle commands and other is for information transfer. Three control variables 'ti_rptr', 'ti_wptr' and 'ti_size' are used to control r/w access to the information transfer buffer ti_buf[TI_BUFSZ=16]. In that, 'ti_rptr' is used as read index, where read occurs. 'ti_wptr' is a write index, where write would occur. 'ti_size' indicates total bytes to be read from the buffer. While reading/writing to this buffer, index could exceed its size. Add check to avoid OOB r/w access. Reported-by: Huawei PSIRT <psirt@huawei.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1465230883-22303-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-06scsi-disk: fix reads from scsi-disk devicesMark Cave-Ayland1-1/+1
Commit fcaafb1001b9c42817714dd3b2aadcfdb997b53d accidentally broke reads from scsi-disk devices when being updated from its original form to use the new byte-based block functions. Add the extra missing sector to offset conversion in order to restore read functionality. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: xiaoqiang zhao <zxq_yx_007@163.com> Message-id: 1464931021-25117-1-git-send-email-mark.cave-ayland@ilande.co.uk Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-29scsi-generic: Merge block max xfer len in INQUIRY responseFam Zheng1-0/+12
The rationale is similar to the above mode sense response interception: this is practically the only channel to communicate restraints from elsewhere such as host and block driver. The scsi bus we attach onto can have a larger max xfer len than what is accepted by the host file system (guarding between the host scsi LUN and QEMU), in which case the SG_IO we generate would get -EINVAL. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1464243305-10661-3-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi-block: always use SG_IOPaolo Bonzini1-18/+196
Using pread/pwrite or io_submit has the advantage of eliminating the bounce buffer, but drops the SCSI status. This keeps the guest from seeing unit attention codes, as well as statuses such as RESERVATION CONFLICT. Because we know scsi-block operates on an SBC device we can still use the DMA helpers with SG_IO; just remember to patch the CDBs if the transfer is split into multiple segments. This means that scsi-block will always use the thread-pool unfortunately, instead of respecting aio=native. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi-disk: introduce scsi_disk_req_check_errorPaolo Bonzini1-67/+22
Commonize all the checks for canceled requests and errors. The next patch will add another case to check for, in order to handle passthrough commands. There is no semantic change here; the only nontrivial modification is in scsi_write_do_fua, where cancellation has been checked earlier by both callers. Thus, the check is replaced with an assertion. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi-disk: add need_fua_emulation to SCSIDiskClassPaolo Bonzini1-2/+7
scsi-block will be able to do FUA just by passing the request through to the LUN (which is also more efficient); there is no need to emulate it like we do for scsi-disk. Add a new method to distinguish this. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi-disk: introduce dma_readv and dma_writevPaolo Bonzini1-15/+52
These are replacements for blk_aio_readv and blk_aio_writev that allow customization of the data path. They reuse the DMA helpers' DMAIOFunc callback type, so that the same function can be used in either the QEMUSGList or the bounce-buffered case. This customization will be needed in the next patch to do zero-copy SG_IO on scsi-block. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi-disk: introduce a common base classPaolo Bonzini1-14/+22
This will be the place to add DMAIOFuncs in the next patch. There are also a couple DeviceClass members that can be moved to the abstract class's initialization function. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi: megasas: check 'read_queue_head' index valuePrasad J Pandit1-0/+2
While doing MegaRAID SAS controller command frame lookup, routine 'megasas_lookup_frame' uses 'read_queue_head' value as an index into 'frames[MEGASAS_MAX_FRAMES=2048]' array. Limit its value within array bounds to avoid any OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464179110-18593-1-git-send-email-ppandit@redhat.com> Reviewed-by: Alexander Graf <agraf@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi: megasas: initialise local configuration data bufferPrasad J Pandit1-1/+1
When reading MegaRAID SAS controller configuration via MegaRAID Firmware Interface(MFI) commands, routine megasas_dcmd_cfg_read uses an uninitialised local data buffer. Initialise this buffer to avoid stack information leakage. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464178304-12831-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi: megasas: use appropriate property buffer sizePrasad J Pandit1-1/+1
When setting MegaRAID SAS controller properties via MegaRAID Firmware Interface(MFI) commands, a user supplied size parameter is used to set property value. Use appropriate size value to avoid OOB access issues. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464172291-2856-2-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi: mptsas: infinite loop while fetching requestsPrasad J Pandit1-5/+4
The LSI SAS1068 Host Bus Adapter emulator in Qemu, periodically looks for requests and fetches them. A loop doing that in mptsas_fetch_requests() could run infinitely if 's->state' was not operational. Move check to avoid such a loop. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Message-Id: <1464077264-25473-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-29scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)Prasad J Pandit1-4/+20
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the ring buffer size to an arbitrary value leading to OOB access issue. Add check to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Cc: qemu-stable@nongnu.org Message-Id: <1464000485-27041-1-git-send-email-ppandit@redhat.com> Reviewed-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-25block: Rename blk_write_zeroes()Eric Blake1-1/+1
Commit 983a1600 changed the semantics of blk_write_zeroes() to be byte-based rather than sector-based, but did not change the name, which is an open invitation for other code to misuse the function. Renaming to pwrite_zeroes() makes it more in line with other byte-based interfaces, and will help make it easier to track which remaining write_zeroes interfaces still need conversion. Reported-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2016-05-25dma-helpers: change interface to byte-basedPaolo Bonzini1-2/+4
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2016-05-23esp: check dma length before reading scsi command(CVE-2016-4441)Prasad J Pandit1-4/+7
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() uses DMA to read scsi commands into this buffer. Add check to validate DMA length against buffer size to avoid any overrun. Fixes CVE-2016-4441. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-3-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23esp: check command buffer length before write(CVE-2016-4439)Prasad J Pandit1-1/+5
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. While writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check was missing to validate input length. Add check to avoid OOB write access. Fixes CVE-2016-4439. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-18Fix some typos found by codespellStefan Weil2-2/+2
Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-05-12scsi-disk: Switch to byte-based aio block accessEric Blake1-21/+20
Sector-based blk_aio_readv() and blk_aio_writev() should die; switch to byte-based blk_aio_preadv() and blk_aio_pwritev() instead. As part of the cleanup, scsi_init_iovec() no longer needs to return a value, and reword a comment. [ kwolf: Fix read accounting change ] Signed-off-by: Eric Blake <eblake@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
generated by cgit v1.1 at 2025-01-21 11:58:19 +0000