summaryrefslogtreecommitdiff
path: root/hw/scsi/scsi-bus.c
AgeCommit message (Collapse)AuthorFilesLines
2014-03-14scsi: Fix migration of scsi sense dataFam Zheng1-1/+29
c5f52875 changed the size of sense array in vmstate_scsi_device by mistake. This patch restores the old size, and add a subsection for the remaining part of the buffer size. So that migration is not broken. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-02-22scsi-bus: Fix transfer length for VERIFY with BYTCHK=11bMarkus Armbruster1-1/+1
The transfer length depends on field BYTCHK, which is encoded in byte 1, bits 1..2. However, the guard for for case BYTCHK=11b doesn't work, and we get case 01b instead. Fix it. Note that since emulated scsi-hd fails the command outright, it takes SCSI passthrough of a device that actually implements VERIFY with BYTCHK=11b to make the bug bite. Screwed up in commit d12ad44. Spotted by Coverity. Cc: qemu-stable@nongnu.org Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-02-22scsi: report thin provisioning errors with werror=reportPaolo Bonzini1-0/+5
SCSI defines a status code for when a thin-provisioned LUNs would exceed the allocated space, map ENOSPC to it. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-01-16scsi: Support TEST UNIT READY in the dummy LUN0Paolo Bonzini1-0/+2
SeaBIOS waits for LUN0 to respond to the TEST UNIT READY command in order to decide whether it should part of the boot sequence. If LUN0 does not respond to the command, boot is delayed by up to 5 seconds. This currently happens when there is no LUN0 on a target. Fix that by adding a trivial implementation of the command. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-12-13Merge remote-tracking branch 'bonzini/scsi-next' into stagingAnthony Liguori1-1/+13
# By Paolo Bonzini (4) and Peter Lieven (1) # Via Paolo Bonzini * bonzini/scsi-next: help: add id suboption to -iscsi scsi-disk: fix WRITE SAME with large non-zero payload block/iscsi: introduce bdrv_co_{readv, writev, flush_to_disk} scsi-disk: fix VERIFY emulation scsi-bus: fix transfer length and direction for VERIFY command Message-id: 1386594157-17535-1-git-send-email-pbonzini@redhat.com Signed-off-by: Anthony Liguori <aliguori@amazon.com>
2013-12-09scsi-bus: fix transfer length and direction for VERIFY commandPaolo Bonzini1-1/+13
The amount of bytes to transfer depends on the BYTCHK field. If any data is transferred, it is sent to the device. Cc: qemu-stable@nongnu.org Tested-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-11-26scsi: Add 2 new sense codes needed by uasHans de Goede1-0/+10
Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2013-11-05qdev: Drop misleading qdev_free() functionStefan Hajnoczi1-3/+3
The qdev_free() function name is misleading since all the function does is unlink the device from its parent. The device is not necessarily freed. The device will be freed when its QObject refcount reaches zero. It is usual for the parent (bus) to hold the final reference but there are cases where something else holds a reference so "free" is a misleading name. Call object_unparent(obj) directly instead of having a qdev wrapper function. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-10-09scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344]Asias He1-11/+34
r->buf is hardcoded to 2056 which is (256 + 1) * 8, allowing 256 luns at most. If more than 256 luns are specified by user, we have buffer overflow in scsi_target_emulate_report_luns. To fix, we allocate the buffer dynamically. Signed-off-by: Asias He <asias@redhat.com> Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-09-12scsi: Fix scsi_bus_legacy_add_drive() scsi-generic with serialMarkus Armbruster1-1/+1
scsi_bus_legacy_add_drive() creates either a scsi-disk or a scsi-generic device. It sets property "serial" to argument serial unless null. Crashes with scsi-generic, because it doesn't have such the property. Only usb_msd_initfn_storage() passes non-null serial. Reproducer: $ qemu-system-x86_64 -nodefaults -display none -S -usb \ -drive if=none,file=/dev/sg1,id=usb-drv0 \ -device usb-storage,id=usb-msd0,drive=usb-drv0,serial=123 qemu-system-x86_64: -device usb-storage,id=usb-msd0,drive=usb-drv0,serial=123: Property '.serial' not found Aborted (core dumped) Fix by handling exactly like "removable": set the property only when it exists. Cc: qemu-stable@nongnu.org Reviewed-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-08-30qdev: Pass size to qbus_create_inplace()Andreas Färber1-1/+1
To be passed to object_initialize(). Since commit 39355c3826f5d9a2eb1ce3dc9b4cdd68893769d6 the argument is void*, so drop some superfluous (BusState *) casts or direct parent field usages. Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-08-30scsi: Pass size to scsi_bus_new()Andreas Färber1-2/+2
To be passed to qbus_create_inplace(). Use DEVICE() casts instead of direct parent field access. Reviewed-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-29devices: Associate devices to their logical categoryMarcel Apfelbaum1-0/+1
The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-23scsi: Improve error propagation for scsi_bus_legacy_handle_cmdline()Andreas Färber1-7/+15
Let scsi_bus_legacy_add_drive() and scsi_bus_legacy_handle_cmdline() return an Error**. Prepare qdev initfns for QOM realize error model. Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-04scsi: keep device alive while it has requestsPaolo Bonzini1-2/+10
Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-05-03scsi: add bus_name parameter to scsi_bus_new.KONRAD Frederic1-2/+3
This adds the possibility to create a scsi-bus with a specified name. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com> Message-id: 1367330931-12994-4-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-04-08hw: move target-independent files to subdirectoriesPaolo Bonzini1-0/+1889
This patch tackles all files that are compiled once, moving them to subdirectories of hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>