aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi
AgeCommit message (Collapse)Author
2014-09-10block: Make the block accounting functions operate on BlockAcctStatsBenoît Canet
This is the next step for decoupling block accounting functions from BlockDriverState. In a future commit the BlockAcctStats structure will be moved from BlockDriverState to the device models structures. Note that bdrv_get_stats was introduced so device models can retrieve the BlockAcctStats structure of a BlockDriverState without being aware of it's layout. This function should go away when BlockAcctStats will be embedded in the device models structures. CC: Kevin Wolf <kwolf@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Keith Busch <keith.busch@intel.com> CC: Anthony Liguori <aliguori@amazon.com> CC: "Michael S. Tsirkin" <mst@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> CC: Eric Blake <eblake@redhat.com> CC: Peter Maydell <peter.maydell@linaro.org> CC: Michael Tokarev <mjt@tls.msk.ru> CC: John Snow <jsnow@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Alexander Graf <agraf@suse.de> CC: Max Reitz <mreitz@redhat.com> Signed-off-by: Benoît Canet <benoit.canet@nodalink.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-09-10block: rename BlockAcctType members to start with BLOCK_ instead of BDRV_Benoît Canet
The middle term goal is to move the BlockAcctStats structure in the device models. (Capturing I/O accounting statistics in the device models is good for billing) This patch make a small step in this direction by removing a reference to BDRV. CC: Kevin Wolf <kwolf@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Keith Busch <keith.busch@intel.com> CC: Anthony Liguori <aliguori@amazon.com> CC: "Michael S. Tsirkin" <mst@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> CC: John Snow <jsnow@redhat.com> CC: Richard Henderson <rth@twiddle.net> CC: Markus Armbruster <armbru@redhat.com> CC: Alexander Graf <agraf@suse.de>i Signed-off-by: Benoît Canet <benoit.canet@nodalink.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-09-04Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pci, pc fixes, features A bunch of bugfixes - these will make sense for 2.1.1 Initial Intel IOMMU support. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed 03 Sep 2014 14:41:23 BST using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" * remotes/mst/tags/for_upstream: acpi-build: Set FORCE_APIC_CLUSTER_MODEL bit for FADT flags vhost-scsi: init backend features earlier vhost_net: init acked_features to backend_features vhost_net: start/stop guest notifiers properly Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-03vhost-scsi: init backend features earlierMichael S. Tsirkin
As vhost core can use backend_features during init, clear it earlier to avoid using uninitialized memory. This use would be harmless since vhost scsi ignores the result anyway, but initializing earlier will help prevent valgrind errors, and make scsi and net behave similarly. Cc: qemu-stable@nongnu.org Acked-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-08-26virtio-scsi: Report error if num_queues is 0 or too largeFam Zheng
No cmd vq surprises guest (Linux panics in virtscsi_probe), too many queues abort qemu (in the following virtio_add_queue). Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-26scsi-generic: remove superfluous DPRINTF avoid to break compilingGonglei
variables lun and tag had been eliminated, break compiling when enable debug switch. Meanwhile traces provide the same information with this DPRINTF, so remove it. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-26scsi-bus: Convert DeviceClass init to realizeFam Zheng
Replace "init/destroy" with "realize/unrealize" in SCSIDeviceClass, which has errp as a parameter. So all the implementations now use error_setg instead of error_report for reporting error. Also in scsi_bus_legacy_handle_cmdline, report the error when initializing the if=scsi devices, before returning it, because in the callee, error_report is changed to error_setg. And the callers don't have the right locations (e.g. "-drive if=scsi"). Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-26block: Pass errp in blkconf_geometryFam Zheng
This allows us to pass error information to caller. Reviewed-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-08-18memory: remove memory_region_destroyPaolo Bonzini
The function is empty after the previous patch, so remove it. Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29virtio-scsi: implement parse_cdbPaolo Bonzini
Enable passthrough of vendor-specific commands. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29scsi-block, scsi-generic: implement parse_cdbPaolo Bonzini
The callback lets the bus provide the direction and transfer count for passthrough commands, enabling passthrough of vendor-specific commands. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29scsi-block: extract scsi_block_is_passthroughPaolo Bonzini
This will be used for both scsi_block_new_request and the scsi-block implementation of parse_cdb. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29scsi-bus: introduce parse_cdb in SCSIDeviceClass and SCSIBusInfoPaolo Bonzini
These callbacks will let devices do their own request parsing, or defer it to the bus. If the bus does not provide an implementation, in turn, fall back to the default parsing routine. Swap the first two arguments to scsi_req_parse, and rename it to scsi_req_parse_cdb, for consistency. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-29scsi-bus: prepare scsi_req_new for introduction of parse_cdbPaolo Bonzini
The per-SCSIDevice parse_cdb callback must not be called if the request will go through special SCSIReqOps, so detect the special cases early enough. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-14scsi: Report error when lun number is in useFam Zheng
In the case that the lun number is taken by another scsi device, don't release the existing device siliently, but report an error to user. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-01virtio-scsi: scsi events must be converted to target endiannessCédric Le Goater
Virtio SCSI Events need to be byteswapped before being pushed when host and guest have a different endianness. Not doing so breaks hotplug of virtio scsi disks, with the following error message being printed in the guest console: virtio_scsi: Unsupport virtio scsi event 1000000 This issue got uncovered while testing disk hotplug with a PowerKVM ppc64le guest. I have checked that this issue also affects a x86_64 guest run on a ppc64 host. Signed-off-by: Cédric Le Goater <clg@fr.ibm.com> [ Ported from PowerKVM, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-07-01virtio-scsi: virtio_scsi_push_event() lacks VirtIOSCSIReq parsingGreg Kurz
Hotplug of a virtio scsi disk is currently broken: no disk appears in the guest (verified with a fedora 20 host running a fedora 20 guest with KVM). Bisect leeds to Paolo's patches to support any_layout, especially this commit: commit 36b15c79aa1bef5fe7543f9f2629b6413720bbfb Author: Paolo Bonzini <pbonzini@redhat.com> Date: Tue Jun 10 16:21:18 2014 +0200 virtio-scsi: start preparing for any_layout It modifies virtio_scsi_pop_req() so that it is up to the callers to parse the virtio scsi request. It seems that virtio_scsi_push_event() was not modified accordingly... This patch adds a call to virtio_scsi_parse_req(). It also drops some sanity checks that are already performed by virtio_scsi_parse_req(). Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-29virtio-scsi: use virtio wrappers to access headersRusty Russell
Note that st*_raw and ld*_raw are effectively replaced by st*_p and ld*_p. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Reviewed-by: Anthony Liguori <aliguori@us.ibm.com> [ pass VirtIODevice * to memory accessors, converted new tswap locations to virtio_tswap, Greg Kurz <gkurz@linux.vnet.ibm.com> ] Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-29virtio: introduce device specific migration callsGreg Kurz
In order to migrate virtio subsections, they should be streamed after the device itself. We need the device specific code to be called from the common migration code to achieve this. This patch introduces load and save methods for this purpose. Suggested-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-23qapi: adjust existing definesWenchao Xia
In order to let event defines use existing types later, instead of redefine new ones, some old type defines for spice and vnc are changed, and BlockErrorAction is moved from block.h to qapi schema. Note that BlockErrorAction is not merged with BlockdevOnError. At this point, VncInfo is not made a child of VncBasicInfo, because VncBasicInfo has mandatory fields where VncInfo makes them optional. Signed-off-by: Wenchao Xia <wenchaoqemu@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
2014-06-20Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell
pc,pci,virtio,hotplug fixes, enhancements numa work by Hu Tao and others memory hotplug by Igor vhost-user by Nikolay, Antonios and others guest virtio announcements by Jason qtest fixes by Sergey qdev hotplug fixes by Paolo misc other fixes mostly by myself Signed-off-by: Michael S. Tsirkin <mst@redhat.com> * remotes/mst/tags/for_upstream: (109 commits) numa: use RAM_ADDR_FMT with ram_addr_t qapi/string-output-visitor: fix bugs tests: simplify code qapi: fix input visitor bugs acpi: rephrase comment qmp: add ACPI_DEVICE_OST event handling qmp: add query-acpi-ospm-status command acpi: implement ospm_status() method for PIIX4/ICH9_LPC devices acpi: introduce TYPE_ACPI_DEVICE_IF interface qmp: add query-memory-devices command numa: handle mmaped memory allocation failure correctly pc: acpi: do not hardcode preprocessor qmp: clean out whitespace qdev: recursively unrealize devices when unrealizing bus qdev: reorganize error reporting in bus_set_realized qapi: fix build on glib < 2.28 qapi: make string output visitor parse int list qapi: make string input visitor parse int list tests: fix memory leak in test of string input visitor hmp: add info memdev ... Conflicts: include/hw/i386/pc.h [PMM: fixed minor conflict in pc.h] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-06-19Add vhost-backend and VhostBackendTypeNikolay Nikolaev
Use vhost_set_backend_type to initialise a proper vhost_ops structure. In vhost_net_init and vhost_net_start_one call conditionally TAP related initialisation depending on the vhost backend type. Signed-off-by: Antonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-19Add vhost_ops to vhost_dev struct and replace all relevant ioctlsNikolay Nikolaev
Decouple vhost from the Linux kernel by introducing vhost_ops. The intention is to provide different backends - a 'kernel' backend based on the ioctl interface, and an 'user' backend based on a UNIX domain socket and shared memory interface. Signed-off-by: Antonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-19vhost_net_init will use VhostNetOptions to get all its argumentsNikolay Nikolaev
vhost_dev_init will replace devfd and devpath with a single opaque argument. This is initialised with a file descriptor. When TAP is used (through vhost_net), open /dev/vhost-net and pass the fd as an opaque parameter in VhostNetOptions. The same applies to vhost-scsi - open /dev/vhost-scsi and pass the fd. Signed-off-by: Antonios Motakis <a.motakis@virtualopensystems.com> Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-19vhost: add vhost_get_features and vhost_ack_featuresNikolay Nikolaev
Generalize the features get/ack to be used for both vhost-net and vhost-scsi. In vhost-net add vhost_net_get_feature_bits to select the feature bit set depending on the NetClient kind. Signed-off-by: Nikolay Nikolaev <n.nikolaev@virtualopensystems.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-19virtio-scsi: define dummy handle_output for vhost-scsi vqsMing Lei
vhost userspace needn't to handle vq's notification from guest, so define dummy handle_output callback for all vqs of vhost-scsi. In some corner cases(such as when handling vq's reset from VM), virtio-pci still trys to handle pending virtio-scsi events, then object check failure inside virtio_scsi_handle_event() for vhost-scsi can be triggered. The issue can be reproduced by 'rmmod virtio-scsi', 'system sleep' or reboot inside VM. Cc: qemu-stable@nongnu.org Cc: Anthony Liguori <aliguori@amazon.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18virtio-scsi: add support for the any_layout featurePaolo Bonzini
Store the request and response headers by value, and let virtio_scsi_parse_req check that there is only one of datain and dataout. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18virtio-scsi: introduce virtio_scsi_complete_cmd_reqPaolo Bonzini
This is also related to sense handling, and will be used by anylayout. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18virtio-scsi: prepare sense data handling for any_layoutPaolo Bonzini
Retrieve sense and copy it to guest memory, to prepare for when we will use qemu_iovec_from_buf. Swap response and request, since we'll use the tail of VirtIOSCSIReq for the CDB. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18virtio-scsi: add extra argument and return type to qemu_sgl_concatPaolo Bonzini
Will be used for anylayout support. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18virtio-scsi: add target swap for VirtIOSCSICtrlTMFReq fieldsPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18virtio-scsi: start preparing for any_layoutPaolo Bonzini
- Introduce virtio_scsi_init_req and virtio_scsi_free_req - rename qemu_sgl_init_external to qemu_sgl_concat - move virtio_scsi_parse_req from virtio_scsi_pop_req to callers and add header length checks to virtio_scsi_parse_req. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18megasas: use PCI DMA APIPaolo Bonzini
MegaSAS emulation is not IOMMU-friendly. Fix this by switching to pci_dma_* functions. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18scsi: Print command name in debugAlexey Kardashevskiy
This makes scsi_command_name() public. This makes use of scsi_command_name() in debug output for scsi-disk and spapr-vscsi host bus adapter. Before this, SCSI used to print hex numbers instead of human-friendly strings. This adds GET_EVENT_STATUS_NOTIFICATION and READ_DISC_INFORMATION to the list of SCSI commands supported by scsi_command_name(). Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18scsi-disk: fix bug in scsi_block_new_request() introduced by commit 137745cUlrich Obergfell
This patch fixes a bug in scsi_block_new_request() that was introduced by commit 137745c5c60f083ec982fe9e861e8c16ebca1ba8. If the host cache is used - i.e. if BDRV_O_NOCACHE is _not_ set - the 'break' statement needs to be executed to 'fall back' to SG_IO. Cc: qemu-stable@nongnu.org Signed-off-by: Ulrich Obergfell <uobergfe@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-18scsi-disk.c: Fix compilation with -DDEBUG_SCSIPaul Janzen
In scsi-disk.c, if you #define DEBUG_SCSI=1, you get: hw/scsi/scsi-disk.c: In function 'scsi_disk_emulate_command': hw/scsi/scsi-disk.c:2018: error: 'SCSIRequest' has no member named 'buf' Change the debugging statement to match the actual value tested. Signed-off-by: Paul Janzen <pcj@pauljanzen.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-06-16savevm: Remove all the unneeded version_minimum_id_old (x86)Juan Quintela
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
2014-06-16savevm: Remove all the unneeded version_minimum_id_old (ppc)Juan Quintela
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Acked-by: Alexey Kardashevskiy <aik@ozlabs.ru>
2014-06-05hw: use ld_p/st_p instead of ld_raw/st_rawPaolo Bonzini
The ld_raw and st_raw definitions are only needed in code that must compile for both user-mode and softmmu emulation. Device models can use the equivalent ld_p/st_p which are simple pointer accessors. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-22Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell
* remotes/bonzini/scsi-next: megasas: remove buildtime strings block: iscsi build fix if LIBISCSI_FEATURE_IOVECTOR is not defined virtio-scsi: Plug memory leak on virtio_scsi_push_event() error path scsi: Document intentional fall through in scsi_req_length() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-20megasas: remove buildtime stringsOlaf Hering
Using __DATE__ or __TIME__ in binary pkgs changes the checksum of compiled binaries if they get rebuilt, even if there are no other source changes. Replace the dynamic strings with some equally informative static strings. Signed-off-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-19Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell
* remotes/bonzini/scsi-next: [PATCH] block/iscsi: bump year in copyright notice block/iscsi: allow cluster_size of 4K and greater block/iscsi: clarify the meaning of ISCSI_CHECKALLOC_THRES block/iscsi: speed up read for unallocated sectors block/iscsi: allow fall back to WRITE SAME without UNMAP MAINTAINERS: mark megasas as maintained megasas: Add MSI support megasas: Enable MSI-X support megasas: Implement LD_LIST_QUERY scsi: Improve error messages more scsi-disk: Improve error messager if can't get version number Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-16virtio-scsi: Plug memory leak on virtio_scsi_push_event() error pathMarkus Armbruster
Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-16scsi: Document intentional fall through in scsi_req_length()Markus Armbruster
For clarity, and to hush up Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-05-14savevm: Remove all the unneeded version_minimum_id_old (rest)Juan Quintela
After previous Peter patch, they are redundant. This way we don't assign them except when needed. Once there, there were lots of case where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (appart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
2014-05-07hw: Add missing 'static' attributesStefan Weil
This fixes warnings from the static code analysis (smatch). Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-05-05virtio-scsi: fix buffer overrun on invalid state loadMichael S. Tsirkin
CVE-2013-4542 hw/scsi/scsi-bus.c invokes load_request. virtio_scsi_load_request does: qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); this probably can make elem invalid, for example, make in_num or out_num huge, then: virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); will do: if (req->elem.out_num > 1) { qemu_sgl_init_external(req, &req->elem.out_sg[1], &req->elem.out_addr[1], req->elem.out_num - 1); } else { qemu_sgl_init_external(req, &req->elem.in_sg[1], &req->elem.in_addr[1], req->elem.in_num - 1); } and this will access out of array bounds. Note: this adds security checks within assert calls since SCSIBusInfo's load_request cannot fail. For now simply disable builds with NDEBUG - there seems to be little value in supporting these. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-04-28megasas: Add MSI supportHannes Reinecke
Some hardware instances do support MSI, so we should do likewise. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-28megasas: Enable MSI-X supportHannes Reinecke
MSI-X support has been fixed in qemu, so we can enable it again. Signed-off-by: Hannes Reinecke <hare@suse.de> [Do not change VMSTATE_PCI_DEVICE to PCIE. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-04-28megasas: Implement LD_LIST_QUERYHannes Reinecke
Newer firmware implement a LD_LIST_QUERY command, and due to a driver issue no drives might be detected if this command isn't supported. So add emulation for this command, too. Cc: qemu-stable@nongnu.org Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-15 17:50:24 +0000