aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi/esp.c
AgeCommit message (Collapse)Author
2017-02-21hw/scsi: Concentrate -drive if=scsi auto-create in one placeMarkus Armbruster
The logic to create frontends for -drive if=scsi is in SCSI HBAs. For all other interface types, it's in machine initialization code. A few machine types create the SCSI HBAs necessary for that. That's also not done for other interface types. I'm going to deprecate these SCSI eccentricities. In preparation for that, create the frontends in main() instead of the SCSI HBAs, by calling new function scsi_legacy_handle_cmdline() there. Note that not all SCSI HBAs create frontends. Take care not to change that. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1487161136-9018-2-git-send-email-armbru@redhat.com> Acked-By: Paolo Bonzini <pbonzini@redhat.com>
2016-11-22scsi/esp: do not raise an interrupt when reading the FIFO registerHervé Poussineau
This fixes SCSI adapter self-tests done in MIPS Jazz emulation, broken since ff589551c8e8e9e95e211b9d8daafb4ed39f1aec. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1479508397-8443-1-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-29scsi: esp: fix migrationPaolo Bonzini
Commit 926cde5 ("scsi: esp: make cmdbuf big enough for maximum CDB size", 2016-06-16) changed the size of a migrated field. Split it in two parts, and only migrate the second part in a new vmstate version. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi: esp: make cmdbuf big enough for maximum CDB sizePrasad J Pandit
While doing DMA read into ESP command buffer 's->cmdbuf', it could write past the 's->cmdbuf' area, if it was transferring more than 16 bytes. Increase the command buffer size to 32, which is maximum when 's->do_cmd' is set, and add a check on 'len' to avoid OOB access. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi: esp: clean up handle_ti/esp_do_dma if s->do_cmdPaolo Bonzini
Avoid duplicated code between esp_do_dma and handle_ti. esp_do_dma has the same code that handle_ti contains after the call to esp_do_dma; but the code in handle_ti is never reached because it is in an "else if". Remove the else and also the pointless return. esp_do_dma also has a partially dead assignment of the to_device variable. Sink it to the point where it's actually used. Finally, assert that the other caller of esp_do_dma (esp_transfer_data) only transfers data and not a command. This is true because get_cmd cancels the old request synchronously before its caller handle_satn_stop sets do_cmd to 1. Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi: esp: respect FIFO invariant after message phasePaolo Bonzini
The FIFO contains two bytes; hence the write ptr should be two bytes ahead of the read pointer. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-16scsi: esp: check buffer length before reading scsi commandPrasad J Pandit
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() in non-DMA mode, uses 'ti_size' to read scsi command into a buffer. Add check to validate command length against buffer size to avoid any overrun. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1464717207-7549-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-06-06scsi: esp: check TI buffer index before read/writePrasad J Pandit
The 53C9X Fast SCSI Controller(FSC) comes with internal 16-byte FIFO buffers. One is used to handle commands and other is for information transfer. Three control variables 'ti_rptr', 'ti_wptr' and 'ti_size' are used to control r/w access to the information transfer buffer ti_buf[TI_BUFSZ=16]. In that, 'ti_rptr' is used as read index, where read occurs. 'ti_wptr' is a write index, where write would occur. 'ti_size' indicates total bytes to be read from the buffer. While reading/writing to this buffer, index could exceed its size. Add check to avoid OOB r/w access. Reported-by: Huawei PSIRT <psirt@huawei.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1465230883-22303-1-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23esp: check dma length before reading scsi command(CVE-2016-4441)Prasad J Pandit
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. Routine get_cmd() uses DMA to read scsi commands into this buffer. Add check to validate DMA length against buffer size to avoid any overrun. Fixes CVE-2016-4441. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-3-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-23esp: check command buffer length before write(CVE-2016-4439)Prasad J Pandit
The 53C9X Fast SCSI Controller(FSC) comes with an internal 16-byte FIFO buffer. It is used to handle command and data transfer. While writing to this command buffer 's->cmdbuf[TI_BUFSZ=16]', a check was missing to validate input length. Add check to avoid OOB write access. Fixes CVE-2016-4439. Reported-by: Li Qiang <liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1463654371-11169-2-git-send-email-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-22include/qemu/osdep.h: Don't include qapi/error.hMarkus Armbruster
Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: Markus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-01-29hw/scsi: Clean up includesPeter Maydell
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-24-git-send-email-peter.maydell@linaro.org
2014-11-12esp: Do not overwrite ESP_TCHI after resetHannes Reinecke
After a reset ESP_TCHI should contain the unique ID of the chip. This value will be overwritten with the current tranfer count if the transfer count has previously been set. So we should always return the chip id if ESP_TCHI has never been written to. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-14savevm: Remove all the unneeded version_minimum_id_old (rest)Juan Quintela
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2013-08-30scsi: Pass size to scsi_bus_new()Andreas Färber
To be passed to qbus_create_inplace(). Use DEVICE() casts instead of direct parent field access. Reviewed-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-29devices: Associate devices to their logical categoryMarcel Apfelbaum
The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-07-23scsi: Improve error propagation for scsi_bus_legacy_handle_cmdline()Andreas Färber
Let scsi_bus_legacy_add_drive() and scsi_bus_legacy_handle_cmdline() return an Error**. Prepare qdev initfns for QOM realize error model. Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-23scsi/esp: Use QOM realize for scsi espHu Tao
Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> [AF: Drop sysbus_esp_init()] Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-23scsi/esp: QOM'ify some moreHu Tao
Introduce type constant and avoid DO_UPCAST(). Signed-off-by: Hu Tao <hutao@cn.fujitsu.com> [AF: Renamed parent field] Signed-off-by: Andreas Färber <afaerber@suse.de>
2013-07-04hw/s*: pass owner to memory_region_init* functionsPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-07-04memory: add owner argument to initialization functionsPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-05-03scsi: add bus_name parameter to scsi_bus_new.KONRAD Frederic
This adds the possibility to create a scsi-bus with a specified name. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com> Message-id: 1367330931-12994-4-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2013-04-08hw: move target-independent files to subdirectoriesPaolo Bonzini
This patch tackles all files that are compiled once, moving them to subdirectories of hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-03 16:32:41 +0000