summaryrefslogtreecommitdiff
path: root/hw/scsi
AgeCommit message (Collapse)AuthorFilesLines
2017-03-16scsi: mptsas: fix the wrong reading size in fetch requestLi Qiang1-3/+3
When fetching request, it should read sizeof(*hdr), not the pointer hdr. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-Id: <1489488980-130668-1-git-send-email-liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit b01a2d07c963e96dbd151f0db1eaa06f273acf34) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-03-16scsi-block: fix direction of BYTCHK test for VERIFY commandsPaolo Bonzini1-1/+1
The direction is wrong; scsi_block_is_passthrough returns false for commands that *can* use sglists. Reported-by: Zhang Qian <zhangqian@sangfor.com.cn> Fixes: 8fdc7839e40f43a426bc7e858cf1dbfe315a3804 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 1f8af0d186abf9ef775a74d41bf2852ed8d59b63) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-11-29Merge remote-tracking branch 'bonzini/tags/for-upstream' into stagingStefan Hajnoczi1-26/+32
Small fixes for rc2. # gpg: Signature made Mon 28 Nov 2016 03:45:20 PM GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * bonzini/tags/for-upstream: rules.mak: Use -r instead of -Wl, -r to fix building when PIE is default migration/pcspk: Turn migration of pcspk off for 2.7 and older migration/pcspk: Add a property to state if pcspk is migrated pci-assign: sync MSI/MSI-X cap and table with PCIDevice megasas: clean up and fix request completion/cancellation megasas: do not call pci_dma_unmap after having freed the frame once Message-id: 1480372837-109736-1-git-send-email-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-11-28megasas: clean up and fix request completion/cancellationPaolo Bonzini1-25/+28
megasas_command_cancel is a callback; it should report the abort in the frame, not try another abort! Compare for instance with mptsas_request_cancelled. So extract the common bits for request completion in a new function megasas_complete_command, call it from both the .complete and .cancel callbacks, and remove duplicate pieces from the DCMD path. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20161110152751.4267-2-pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-28megasas: do not call pci_dma_unmap after having freed the frame oncePaolo Bonzini1-1/+4
Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was wrong because I trusted Coverity too much. It turns out that there _is_ a path through which cmd->frame can become NULL. After megasas_handle_frame's switch (md->frame->header.frame_cmd), megasas_init_firmware can be called. From there, megasas_reset_frames will call megasas_unmap_frame which resets cmd->frame = NULL. However, there is another bug to fix in there, because megasas_unmap_frame is called again after setting the command status. In this case QEMU should not do anything, instead it calls pci_dma_unmap again. Harmless, but better fix it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-22scsi/esp: do not raise an interrupt when reading the FIFO registerHervé Poussineau1-2/+0
This fixes SCSI adapter self-tests done in MIPS Jazz emulation, broken since ff589551c8e8e9e95e211b9d8daafb4ed39f1aec. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1479508397-8443-1-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-18virtio: set ISR on dataplane notificationsPaolo Bonzini2-8/+1
Dataplane has been omitting forever the step of setting ISR when an interrupt is raised. This caused little breakage, because the specification actually says that ISR may not be updated in MSI mode. Some versions of the Windows drivers however didn't clear MSI mode correctly, and proceeded using polling mode (using ISR, not the used ring index!) for crashdump and hibernation. If it were just crashdump and hibernation it would not be a big deal, but recent releases of Windows do not really shut down, but rather log out and hibernate to make the next startup faster. Hence, this manifested as a more serious hang during shutdown with e.g. Windows 8.1 and virtio-win 1.8.0 RPMs. Newer versions fixed this, while older versions do not use MSI at all. The failure has always been there for virtio dataplane, but it became visible after commits 9ffe337 ("virtio-blk: always use dataplane path if ioeventfd is active", 2016-10-30) and ad07cd6 ("virtio-scsi: always use dataplane path if ioeventfd is active", 2016-10-30) made virtio-blk and virtio-scsi always use the dataplane code under KVM. The good news therefore is that it was not a bug in the patches---they were doing exactly what they were meant for, i.e. shake out remaining dataplane bugs. The fix is not hard, so it's worth arranging for the broken drivers. The virtio_should_notify+event_notifier_set pair that is common to virtio-blk and virtio-scsi dataplane is replaced with a new public function virtio_notify_irqfd that also sets ISR. The irqfd emulation code now need not set ISR anymore, so virtio_irq is removed. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Farhan Ali <alifm@linux.vnet.ibm.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-03Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingStefan Hajnoczi2-35/+45
virtio, pc: fixes and features nvdimm hotplug support virtio migration and ioeventfd rework virtio crypto device ipmi fixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 01 Nov 2016 05:23:40 PM GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (47 commits) acpi: fix assert failure caused by commit 35c5a52d acpi/ipmi: Initialize the fwinfo before fetching it ipmi: Add graceful shutdown handling to the external BMC ipmi: fix build config variable name for ipmi_bmc_extern.o ipmi: Implement shutdown via ACPI overtemp ipmi: chassis poweroff should use qemu_system_shutdown_request() ipmi_bmc_sim: Remove an unnecessary mutex ipmi: Remove hotplug from IPMI BMCs pc: memhp: enable nvdimm device hotplug nvdimm acpi: introduce _FIT nvdimm acpi: introduce fit buffer nvdimm acpi: prebuild nvdimm devices for available slots nvdimm acpi: use common macros instead of magic names acpi nvdimm: rename result_size to dsm_out_buf_siz nvdimm acpi: compile nvdimm acpi code arch-independently acpi nvdimm: fix Arg6 usage acpi nvdimm: fix ARG3 conflict acpi nvdimm: fix device physical address base acpi nvdimm: fix OperationRegion definition acpi nvdimm: fix wrong buffer size returned by DSM method ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-10-31Merge remote-tracking branch 'remotes/famz/tags/for-upstream' into stagingPeter Maydell1-3/+1
# gpg: Signature made Fri 28 Oct 2016 15:47:39 BST # gpg: using RSA key 0xCA35624C6A9171C6 # gpg: Good signature from "Fam Zheng <famz@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 5003 7CB7 9706 0F76 F021 AD56 CA35 624C 6A91 71C6 * remotes/famz/tags/for-upstream: aio: convert from RFifoLock to QemuRecMutex qemu-thread: introduce QemuRecMutex iothread: release AioContext around aio_poll block: only call aio_poll on the current thread's AioContext qemu-img: call aio_context_acquire/release around block job qemu-io: acquire AioContext block: prepare bdrv_reopen_multiple to release AioContext replication: pass BlockDriverState to reopen_backing_file iothread: detach all block devices before stopping them aio: introduce qemu_get_current_aio_context sheepdog: use BDRV_POLL_WHILE nfs: use BDRV_POLL_WHILE nfs: move nfs_set_events out of the while loops block: introduce BDRV_POLL_WHILE qed: Implement .bdrv_drain block: change drain to look only at one child at a time block: add BDS field to count in-flight requests mirror: use bdrv_drained_begin/bdrv_drained_end blockjob: introduce .drain callback for jobs replication: interrupt failover if the main device is closed Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-10-30virtio-scsi: always use dataplane path if ioeventfd is activePaolo Bonzini2-35/+45
Override start_ioeventfd and stop_ioeventfd to start/stop the whole dataplane logic. This has some positive side effects: - no need anymore for virtio_add_queue_aio (i.e. a revert of commit 1c627137c10ee2dcf59e0383ade8a9abfa2d4355) - no need anymore to switch from generic ioeventfd handlers to dataplane It detects some errors better: $ qemu-system-x86_64 -object iothread,id=io \ -device virtio-scsi-pci,ioeventfd=off,iothread=io qemu-system-x86_64: -device virtio-scsi-pci,ioeventfd=off,iothread=io: ioeventfd is required for iothread while previously it would have started just fine. Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-30virtio: move ioeventfd_started flag to VirtioBusStatePaolo Bonzini1-1/+1
This simplifies the code and removes the ioeventfd_started and ioeventfd_set_started callback. The only difference is in how virtio-ccw handles an error---it doesn't disable ioeventfd forever anymore. It was the only backend to do so, and if desired this behavior should be implemented in virtio-bus.c. Instead of ioeventfd_started, the ioeventfd_assign callback now determines whether the virtio bus supports host notifiers. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-28block: only call aio_poll on the current thread's AioContextPaolo Bonzini1-3/+1
aio_poll is not thread safe; for example bdrv_drain can hang if the last in-flight I/O operation is completed in the I/O thread after the main thread has checked bs->in_flight. The bug remains latent as long as all of it is called within aio_context_acquire/aio_context_release, but this will change soon. To fix this, if bdrv_drain is called from outside the I/O thread, signal the main AioContext through a dummy bottom half. The event loop then only runs in the I/O thread. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <1477565348-5458-18-git-send-email-pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com>
2016-10-27dma-helpers: explicitly pass alignment into DMA helpersMark Cave-Ayland1-0/+2
The hard-coded default alignment is BDRV_SECTOR_SIZE, however this is not necessarily the case for all platforms. Use this as the default alignment for all current callers. Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Reviewed-by: Eric Blake <eblake@redhat.com> Acked-by: John Snow <jsnow@redhat.com> Message-id: 1476445266-27503-2-git-send-email-mark.cave-ayland@ilande.co.uk Signed-off-by: John Snow <jsnow@redhat.com>
2016-10-10virtio: cleanup VMSTATE_VIRTIO_DEVICEHalil Pasic1-2/+0
Now all the usages of the old version of VMSTATE_VIRTIO_DEVICE are gone, so we can get rid of the conditionals, and the old macro. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-scsi: convert VMSTATE_VIRTIO_DEVICEHalil Pasic1-17/+11
Use the new VMSTATE_VIRTIO_DEVICE macro. Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-scsi: handle virtio_scsi_set_config() errorGreg Kurz1-2/+3
This error is caused by a buggy guest: let's switch the device to the broken state instead of terminating QEMU. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-10virtio-scsi: convert virtio_scsi_bad_req() to use virtio_error()Greg Kurz1-14/+32
The virtio_scsi_bad_req() function is called when a guest sends a request with missing or ill-sized headers. This generally happens when the virtio_scsi_parse_req() function returns an error. With this patch, virtio_scsi_bad_req() will mark the device as broken, detach the request from the virtqueue and free it, instead of forcing QEMU to exit. In nearly all locations where virtio_scsi_bad_req() is called, the only thing to do next is to return to the caller. The virtio_scsi_handle_cmd_req_prepare() function is an exception though. It is called in a loop by virtio_scsi_handle_cmd_vq() and passed requests freshly popped from a cmd virtqueue; virtio_scsi_handle_cmd_req_prepare() does some sanity checks on the request and returns a boolean flag to indicate whether the request should be queued or not. In the latter case, virtio_scsi_handle_cmd_req_prepare() has detected a non-fatal error and sent a response back to the guest. We have now a new condition to take into account: the device is broken and should stop all processing. The return value of virtio_scsi_handle_cmd_req_prepare() is hence changed to an int. A return value of zero means that the request should be queued. Other non-fatal error cases where the request shoudn't be queued return a negative errno (values are vaguely inspired by the error condition, but the only goal here is to discriminate the case we're interested in). And finally, if virtio_scsi_bad_req() was called, -EINVAL is returned. In this case, virtio_scsi_handle_cmd_vq() detaches and frees already queued requests, instead of submitting them. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-10-05spapr_vscsi: fix build error introduced by f19661c8Felipe Franciosi2-2/+2
A typo introduced in f19661c8 prevents qemu from building when configured with --enable-trace-backend=dtrace. Signed-off-by: Felipe Franciosi <felipe@nutanix.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-09-23spapr_vscsi: convert to trace framework instead of DPRINTFLaurent Vivier2-52/+63
Signed-off-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2016-09-15Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell4-22/+22
* Support multiple -d trace:PATTERN arguments (Daniel) * SCSI cleanups/fixes for removable meia (Fam) * SCSI security fixes (Li Qiang, PJP) * qemu-char segfault fix (Lin Ma) * "make help" and qemu-socket cleanups (Marc-André) * end of the buffer_is_zero reword (Richard) * Fix target-i386 syscall segfault (Stanislav) * split irqchip fix/robustification (Wanpeng) * misc cleanups (me, Jiangang) * x86 vmstate fixes (Pavel) # gpg: Signature made Thu 15 Sep 2016 14:11:35 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: pcspk: adding vmstate for save/restore kvmvapic: fix state change handler pc: apic: introduce APIC macro target-i386: Fixed syscall posssible segfault log: fix parsing of multiple trace:PATTERN log args qemu-char: avoid segfault if user lacks of permisson of a given logfile build-sys: add make 'help' target linux-user: complete omission of removing uses of strdup target-i386: fix ordering of fields in CPUX86State pc: apic: fix touch LAPIC when irqchip is split scsi: pvscsi: limit process IO loop to ring size memory: remove memory_region_destructor_rom_device Change net/socket.c to use socket_*() functions cutils: Rewrite x86 buffer zero checking scsi: mptsas: use g_new0 to allocate MPTSASRequest object virtio-scsi: Don't abort when media is ejected scsi-disk: Cleaning up around tray open state Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-09-15mptsas: change .realize function nameCao jin1-2/+2
All the other devices` .realize function name are xxx_realize, except this one. cc: Michael S. Tsirkin <mst@redhat.com> cc: Marcel Apfelbaum <marcel@redhat.com> cc: Paolo Bonzini <pbonzini@redhat.com> cc: Markus Armbruster <armbru@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2016-09-14scsi: pvscsi: limit process IO loop to ring sizePrasad J Pandit1-1/+4
Vmware Paravirtual SCSI emulator while processing IO requests could run into an infinite loop if 'pvscsi_ring_pop_req_descr' always returned positive value. Limit IO loop to the ring size. Cc: qemu-stable@nongnu.org Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473845952-30785-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi: mptsas: use g_new0 to allocate MPTSASRequest objectLi Qiang1-1/+1
When processing IO request in mptsas, it uses g_new to allocate a 'req' object. If an error occurs before 'req->sreq' is allocated, It could lead to an OOB write in mptsas_free_request function. Use g_new0 to avoid it. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473684251-17476-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14virtio-scsi: Don't abort when media is ejectedFam Zheng1-6/+9
With an ejected block backend, blk_get_aio_context() would return qemu_aio_context. In this case don't assert. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-3-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-14scsi-disk: Cleaning up around tray open stateFam Zheng1-14/+8
Even if tray is not open, it can be empty (blk_is_inserted() == false). Handle both cases correctly by replacing the s->tray_open checks with blk_is_available(), which is an AND of the two. Also simplify successive checks of them into blk_is_available(), in a couple cases. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1473848224-24809-2-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13Revert "megasas: remove useless check for cmd->frame"Paolo Bonzini1-1/+5
This reverts commit 8cc46787b5b58f01a11c919c7ff939ed009e27fc. It turns out that cmd->frame can be NULL and thus the commit can cause a SIGSEGV Reported-by: Holger Schranz <holger@fam-schranz.de> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: pvscsi: limit loop to fetch SG listPrasad J Pandit1-5/+6
In PVSCSI paravirtual SCSI bus, pvscsi_convert_sglist can take a very long time or go into an infinite loop due to two different bugs: 1) the request descriptor data length is defined to be 64 bit. While building SG list from a request descriptor, it gets truncated to 32bit in routine 'pvscsi_convert_sglist'. This could lead to an infinite loop situation large 'dataLen' values when data_length is cast to uint32_t and chunk_size becomes always zero. Fix this by removing the incorrect cast. 2) pvscsi_get_next_sg_elem can be called arbitrarily many times if the element has a zero length. Get out of the loop early when this happens, by introducing an upper limit on the number of SG list elements. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1473108643-12983-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACKPaolo Bonzini1-2/+2
These issues cause respectively a QEMU crash and a leak of 2 bytes of stack. They were discovered by VictorV of 360 Marvel Team. Reported-by: Tom Victor <i-tangtianwen@360.cm> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi: mptconfig: fix an assert expressionPrasad J Pandit1-1/+1
When LSI SAS1068 Host Bus emulator builds configuration page headers, mptsas_config_pack() should assert that the size fits in a byte. However, the size is expressed in 32-bit units, so up to 1020 bytes fit. The assertion was only allowing replies up to 252 bytes, so fix it. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472645167-30765-2-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13vmw_pvscsi: check page count while initialising descriptor ringsPrasad J Pandit1-10/+9
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the page count for these rings to an arbitrary value, leading to infinite loop or OOB access. Add check to avoid it. Reported-by: Tom Victor <vv474172261@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13scsi-disk: change disk serial length from 20 to 36Rony Weng1-2/+2
Openstack Cinder assigns volume a 36 characters uuid as serial. QEMU will shrinks the uuid to 20 characters, which does not match the original uuid. Note that there is no limit to the length of the serial number in the SCSI spec. 20 was copy-pasted from virtio-blk which in turn was copy-pasted from ATA; 36 is even more arbitrary. However, bumping it up too much might cause issues (e.g. 252 seems to make sense because then the maximum amount of returned data is 256; but who knows there's no off-by-one somewhere for such a nicely rounded number). Signed-off-by: Rony Weng <ronyweng@synology.com> Message-Id: <1472457138-23386-1-git-send-email-ronyweng@synology.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13lsi: never set DMA FIFO Empty (DFE) bit in DSTAT registerHervé Poussineau1-1/+1
53C895A datasheet says: "This bit (DFE) is a pure status bit and will not cause an interrupt" This bit is already auto-generated in lsi_read_reg when reading the DSTAT register. This fixes IBM RS/6000 7020 firmware, which is: - resetting the adapter - enabling all interrupt sources (including DIP, ie interrupts from DSTAT) - waiting for ISTAT0 to become 0 (including DIP=0, ie no interrupt coming from DSTAT) Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-5-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: implement I/O memory space for Memory Move instructionsHervé Poussineau1-10/+39
Memory Move instructions can read/write data either from PCI memory or from PCI I/O. Implement second case. Windows 98 now works with LSI 53C810A adapter. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-4-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: do not exit QEMU if reading invalid registerHervé Poussineau1-5/+13
When guest accesses invalid register, return 0xff instead of exiting. Also add a log when reading or writing invalid registers. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-3-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-13lsi: print register names in debug printsHervé Poussineau1-73/+146
Modify lsi_reg_readb function to have a single exit point. Debug print can now contain the returned value. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1471505489-1221-2-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Hervé Poussineau <hpoussin@reactos.org>
2016-09-05scsi: scsi-cd without drive property for empty driveKevin Wolf1-0/+5
This allows the creation of an empty scsi-cd device without manually creating a BlockBackend. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
2016-08-12trace-events: fix first line comment in trace-eventsLaurent Vivier1-1/+1
Documentation is docs/tracing.txt instead of docs/trace-events.txt. find . -name trace-events -exec \ sed -i "s?See docs/trace-events.txt for syntax documentation.?See docs/tracing.txt for syntax documentation.?" \ {} \; Signed-off-by: Laurent Vivier <lvivier@redhat.com> Message-id: 1470669081-17860-1-git-send-email-lvivier@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-08-03mptsas: really fix migration compatibilityPaolo Bonzini2-1/+5
Commit 2e2aa316 removed internal flag msi_in_use, but it existed in vmstate. Restore it for migration to older QEMU versions. Reported-by: Amit Shah <amit.shah@redhat.com> Suggested-by: Amit Shah <amit.shah@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Marcel Apfelbaum <marcel@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Cc: Cao jin <caoj.fnst@cn.fujitsu.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-07-29mptsas: Fix a migration compatible issueCao jin1-1/+1
My previous commit 2e2aa316 removed internal flag msi_in_use, which exists in vmstate, use VMSTATE_UNUSED for migration compatibility. Reported-by: Amit Shah <amit.shah@redhat.com> Suggested-by: Amit Shah <amit.shah@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Marcel Apfelbaum <marcel@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Amit Shah <amit.shah@redhat.com>
2016-07-21Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell1-23/+12
pc, pci, virtio: new features, cleanups, fixes - interrupt remapping for intel iommus - a bunch of virtio cleanups - fixes all over the place Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Thu 21 Jul 2016 18:49:30 BST # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (57 commits) intel_iommu: avoid unnamed fields virtio: Update migration docs virtio-gpu: Wrap in vmstate virtio-gpu: Use migrate_add_blocker for virgl migration blocking virtio-input: Wrap in vmstate 9pfs: Wrap in vmstate virtio-serial: Wrap in vmstate virtio-net: Wrap in vmstate virtio-balloon: Wrap in vmstate virtio-rng: Wrap in vmstate virtio-blk: Wrap in vmstate virtio-scsi: Wrap in vmstate virtio: Migration helper function and macro virtio-serial: Remove old migration version support virtio-net: Remove old migration version support virtio-scsi: Replace HandleOutput typedef Revert "mirror: Workaround for unexpected iohandler events during completion" virtio-scsi: Call virtio_add_queue_aio virtio-blk: Call virtio_add_queue_aio virtio: Introduce virtio_add_queue_aio ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-21virtio-scsi: Wrap in vmstateDr. David Alan Gilbert1-15/+6
Forcibly convert it to a vmstate wrapper; proper conversion comes later. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-07-21virtio-scsi: Replace HandleOutput typedefFam Zheng1-2/+3
There is a new common one in virtio.h, use it. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
2016-07-21virtio-scsi: Call virtio_add_queue_aioFam Zheng1-6/+3
AIO based handler is more appropriate here because it will then cooperate with bdrv_drained_begin/end. It is needed by the coming revert patch. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
2016-07-20block: Convert BB interface to byte-based discardsEric Blake1-4/+4
Change sector-based blk_discard(), blk_co_discard(), and blk_aio_discard() to instead be byte-based blk_pdiscard(), blk_co_pdiscard(), and blk_aio_pdiscard(). NBD gets a lot simpler now that ignoring the unaligned portion of a byte-based discard request is handled under the hood by the block layer. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-id: 1468624988-423-6-git-send-email-eblake@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-07-17megasas: remove useless check for cmd->framePaolo Bonzini1-5/+1
megasas_enqueue_frame always returns with non-NULL cmd->frame. Remove the "else" part as it is dead code. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-07-14Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell1-1/+40
* SCSI scanner support * fixes to qemu-char and net exit * FreeBSD fixes * Other small bugfixes # gpg: Signature made Wed 13 Jul 2016 12:30:11 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: hostmem: detect host backend memory is being used properly hostmem: fix QEMU crash by 'info memdev' char: do not use atexit cleanup handler net: do not use atexit for cleanup slirp: use exit notifier for slirp_smb_cleanup tap: use an exit notifier to call down_script util: Fix MIN_NON_ZERO qemu-sockets: use qapi_free_SocketAddress in cleanup disas: avoid including everything in headers compiled from C++ json-streamer: fix double-free on exiting during a parse main-loop: check return value before using pointer Use "-s" instead of "--quiet" to resolve non-fatal build error on FreeBSD. scsi-bus: Use longer sense buffer with scanners scsi-bus: Add SCSI scanner support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-07-13block/qdev: Allow configuring rerror/werror with qdev propertiesKevin Wolf1-0/+1
The rerror/werror policies are implemented in the devices, so that's where they should be configured. In comparison to the old options in -drive, the qdev properties are only added to those devices that actually support them. If the option isn't given (or "auto" is specified), the setting of the BlockBackend is used for compatibility with the old options. For block jobs, "auto" is the same as "enospc". Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2016-07-13block/qdev: Allow configuring WCE with qdev propertiesKevin Wolf1-0/+1
As cache.writeback is a BlockBackend property and as such more related to the guest device than the BlockDriverState, we already removed it from the blockdev-add interface. This patch adds the new way to set it, as a qdev property of the corresponding guest device. For example: -drive if=none,file=test.img,node-name=img -device ide-hd,drive=img,write-cache=off Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2016-07-12scsi-bus: Use longer sense buffer with scannersJarkko Lavinen1-1/+9
Scanners can provide additional sense bytes beyond 18 bytes. VueScan uses 32 bytes alloc length with Request Sense command. Signed-off-by: Jarkko Lavinen <jarkko.lavinen@iki.fi> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-07-12scsi-bus: Add SCSI scanner supportJarkko Lavinen1-0/+31
Add support for missing scanner specific SCSI commands and their xfer lenghts as per ANSI spec section 15. Signed-off-by: Jarkko Lavinen <jarkko.lavinen@iki.fi> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.1 (git 2.18.0) at 2024-06-13 20:56:51 +0000