From 7721c7f7c272fd2ed9d58500b7e99c33ab8a1af1 Mon Sep 17 00:00:00 2001 From: Pavel Hrdina Date: Mon, 20 May 2013 13:06:47 +0200 Subject: scsi: reset cdrom tray statuses on scsi_disk_reset Tray statuses should be also reset. Some guests may lock the tray and right after resetting the guest it should be unlocked and closed. This is done on power-on, reset and resume from suspend/hibernate on bare-metal. This fix is already committed for IDE CD. Check the commit a7f3d65b65b8c86a5ff0c0abcfefb45e2ec6fe4c. Test results on bare-metal: - on reset/power-on the CD-ROM tray is closed even before the monitor is turned on - on resume from suspend/hibernate the tray is also closed before the monitor is turned on From test results it seems that this behavior is OS and probably BIOS independent. Cc: qemu-stable@nongnu.org Signed-off-by: Pavel Hrdina Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-disk.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'hw') diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index c8d2a99593..02733dc507 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -1984,6 +1984,9 @@ static void scsi_disk_reset(DeviceState *dev) nb_sectors--; } s->qdev.max_lba = nb_sectors; + /* reset tray statuses */ + s->tray_locked = 0; + s->tray_open = 0; } static void scsi_destroy(SCSIDevice *dev) -- cgit v1.2.1 From 53254e569f8e07501f3e0098bd57d2b780e52faa Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Tue, 21 May 2013 14:08:53 +0200 Subject: scsi-generic: fix sign extension of READ CAPACITY(10) data Issuing the READ CAPACITY(10) command in the guest will cause QEMU to update its knowledge of the maximum accessible LBA in the disk. The recorded maximum LBA will be wrong if the disk is bigger than 1TB, because ldl_be_p returns a signed int. When this is fixed, a latent bug will be unmasked. If the READ CAPACITY(10) command reported an overflow (0xFFFFFFFF), we must not overwrite the previously-known maximum accessible LBA, or the guest will fail to access the disk above the first 2TB. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-generic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'hw') diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c index 2a9a561127..19bd36cd54 100644 --- a/hw/scsi/scsi-generic.c +++ b/hw/scsi/scsi-generic.c @@ -198,9 +198,10 @@ static void scsi_read_complete(void * opaque, int ret) scsi_command_complete(r, 0); } else { /* Snoop READ CAPACITY output to set the blocksize. */ - if (r->req.cmd.buf[0] == READ_CAPACITY_10) { + if (r->req.cmd.buf[0] == READ_CAPACITY_10 && + (ldl_be_p(&r->buf[0]) != 0xffffffffU || s->max_lba == 0)) { s->blocksize = ldl_be_p(&r->buf[4]); - s->max_lba = ldl_be_p(&r->buf[0]); + s->max_lba = ldl_be_p(&r->buf[0]) & 0xffffffffULL; } else if (r->req.cmd.buf[0] == SERVICE_ACTION_IN_16 && (r->req.cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) { s->blocksize = ldl_be_p(&r->buf[8]); -- cgit v1.2.1 From d836f8d35dc418e24c3b11e2ea67d361b867b650 Mon Sep 17 00:00:00 2001 From: Pavel Hrdina Date: Wed, 29 May 2013 14:12:10 +0200 Subject: scsi-generic: check the return value of bdrv_aio_ioctl in execute_command This fixes the bug introduced by this commit ad54ae80c73f. The bdrv_aio_ioctl() still could return null and we should return an error in that case. Cc: qemu-stable@nongnu.org Signed-off-by: Pavel Hrdina Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-generic.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'hw') diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c index 19bd36cd54..8f195bec00 100644 --- a/hw/scsi/scsi-generic.c +++ b/hw/scsi/scsi-generic.c @@ -174,6 +174,9 @@ static int execute_command(BlockDriverState *bdrv, r->io_header.flags |= SG_FLAG_DIRECT_IO; r->req.aiocb = bdrv_aio_ioctl(bdrv, SG_IO, &r->io_header, complete, r); + if (r->req.aiocb == NULL) { + return -EIO; + } return 0; } -- cgit v1.2.1 From 18e673b8f350e1d789b8a50d209eb4a4252ebbda Mon Sep 17 00:00:00 2001 From: Pavel Hrdina Date: Wed, 29 May 2013 15:47:23 +0200 Subject: scsi-disk: scsi-block device for scsi pass-through should not be removable This patch adds a new SCSI_DISK_F_NO_REMOVABLE_DEVOPS feature. By this feature we can set that the scsi-block (scsi pass-through) device will still be removable from the guest side, but from monitor it cannot be removed. Cc: qemu-stable@nongnu.org Signed-off-by: Pavel Hrdina Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-disk.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'hw') diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index 02733dc507..74e6a14c29 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -61,8 +61,9 @@ typedef struct SCSIDiskReq { BlockAcctCookie acct; } SCSIDiskReq; -#define SCSI_DISK_F_REMOVABLE 0 -#define SCSI_DISK_F_DPOFUA 1 +#define SCSI_DISK_F_REMOVABLE 0 +#define SCSI_DISK_F_DPOFUA 1 +#define SCSI_DISK_F_NO_REMOVABLE_DEVOPS 2 struct SCSIDiskState { @@ -2110,7 +2111,8 @@ static int scsi_initfn(SCSIDevice *dev) return -1; } - if (s->features & (1 << SCSI_DISK_F_REMOVABLE)) { + if ((s->features & (1 << SCSI_DISK_F_REMOVABLE)) && + !(s->features & (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS))) { bdrv_set_dev_ops(s->qdev.conf.bs, &scsi_disk_removable_block_ops, s); } else { bdrv_set_dev_ops(s->qdev.conf.bs, &scsi_disk_block_ops, s); @@ -2322,6 +2324,12 @@ static int scsi_block_initfn(SCSIDevice *dev) } else { s->qdev.blocksize = 512; } + + /* Makes the scsi-block device not removable by using HMP and QMP eject + * command. + */ + s->features |= (1 << SCSI_DISK_F_NO_REMOVABLE_DEVOPS); + return scsi_initfn(&s->qdev); } -- cgit v1.2.1 From 0e22a2d18998fd183c8181663981eb681ca977e9 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Thu, 30 May 2013 16:14:44 +0200 Subject: vhost-scsi: fix k->set_guest_notifiers() NULL dereference Coverity picked up a copy-paste bug. In vhost_scsi_start() we check for !k->set_guest_notifiers and error out. The check probably got copied but instead of erroring we actually use the function pointer! Cc: Nicholas Bellinger Cc: Asias He Cc: qemu-stable@nongnu.org Signed-off-by: Stefan Hajnoczi Signed-off-by: Paolo Bonzini --- hw/scsi/vhost-scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'hw') diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c index d7a1c33183..785e93f545 100644 --- a/hw/scsi/vhost-scsi.c +++ b/hw/scsi/vhost-scsi.c @@ -123,7 +123,7 @@ static void vhost_scsi_stop(VHostSCSI *s) VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus); int ret = 0; - if (!k->set_guest_notifiers) { + if (k->set_guest_notifiers) { ret = k->set_guest_notifiers(qbus->parent, s->dev.nvqs, false); if (ret < 0) { error_report("vhost guest notifier cleanup failed: %d\n", ret); -- cgit v1.2.1