aboutsummaryrefslogtreecommitdiff
path: root/hw/scsi
AgeCommit message (Collapse)Author
2017-07-04virtio-scsi: finalize IOMMU supportJason Wang
After converting to use DMA api for virtio devices, we should use dma_as instead of address_space_memory. Otherwise it won't work if IOMMU is enabled. Fixes: commit 8607f5c3072c ("virtio: convert to use DMA api") Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <1499170866-9068-1-git-send-email-jasowang@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15vhost-user-scsi: Introduce vhost-user-scsi host deviceFelipe Franciosi
This commit introduces a vhost-user device for SCSI. This is based on the existing vhost-scsi implementation, but done over vhost-user instead. It also uses a chardev to connect to the backend. Unlike vhost-scsi (today), VMs using vhost-user-scsi can be live migrated. To use it, start Qemu with a command line equivalent to: qemu-system-x86_64 \ -chardev socket,id=vus0,path=/tmp/vus.sock \ -device vhost-user-scsi-pci,chardev=vus0,bus=pci.0,addr=... A separate commit presents a sample application linked with libiscsi to provide a backend for vhost-user-scsi. Signed-off-by: Felipe Franciosi <felipe@nutanix.com> Message-Id: <1488479153-21203-4-git-send-email-felipe@nutanix.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: always store SCSIRequest* into MegasasCmdPaolo Bonzini
This ensures that the request is unref'ed properly, and avoids a segmentation fault in the new qtest testcase that is added. This is CVE-2017-9503. Reported-by: Zhangyanyu <zyy4013@stu.ouc.edu.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read SCSI req parameters more than once from framePaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read command more than once from framePaolo Bonzini
Avoid TOC-TOU bugs by passing the frame_cmd down, and checking cmd->dcmd_opcode instead of cmd->frame->header.frame_cmd. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read DCMD opcode more than once from framePaolo Bonzini
Avoid TOC-TOU bugs by storing the DCMD opcode in the MegasasCmd Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read iovec count more than once from framePaolo Bonzini
Avoid TOC-TOU bugs depending on how the compiler behaves. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-15megasas: do not read sense length more than once from framePaolo Bonzini
Avoid TOC-TOU bugs depending on how the compiler behaves. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-06virtio-scsi: Unset hotplug handler when unrealizeFam Zheng
This matches the qbus_set_hotplug_handler in realize, and it releases the final reference to the embedded VirtIODevice so that it is properly finalized. A use-after-free is fixed with this patch, indirectly: virtio_device_instance_finalize wasn't called at hot-unplug, and the vdev->listener would be a dangling pointer in the global and the per address space listener list. See also RHBZ 1449031. Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170518102808.30046-1-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-06-04scsi/lsi53c895a: Remove unused lsi_mem_*() return valueMao Zhongyi
lsi_mem_read/write() always return 0 about which their callers actually don't care. Change the function type to void. Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-05-17migration: Create migration/blocker.hJuan Quintela
This allows us to remove lots of includes of migration/migration.h Signed-off-by: Juan Quintela <quintela@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-05-05vhost-scsi: create a vhost-scsi-common abstractionFelipe Franciosi
In order to introduce a new vhost-user-scsi host device type, it makes sense to abstract part of vhost-scsi into a common parent class. This commit does exactly that. Signed-off-by: Felipe Franciosi <felipe@nutanix.com> Message-Id: <1488479153-21203-3-git-send-email-felipe@nutanix.com>
2017-05-05vmw_pvscsi: check message ring page count at initialisationP J P
A guest could set the message ring page count to zero, resulting in infinite loop. Add check to avoid it. Reported-by: YY Z <bigbird475958471@gmail.com> Signed-off-by: P J P <ppandit@redhat.com> Message-Id: <20170425130623.3649-1-ppandit@redhat.com> Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-05-05scsi: avoid an off-by-one error in megasas_mmio_writePrasad J Pandit
While reading magic sequence(MFI_SEQ) in megasas_mmio_write, an off-by-one error could occur as 's->adp_reset' index is not reset after reading the last sequence. Reported-by: YY Z <bigbird475958471@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <20170424120634.12268-1-ppandit@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-04-24scsi: Make errp the last parameter of virtio_scsi_common_realizeFam Zheng
Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170421122710.15373-12-famz@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-03-27Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
* MTTCG fix for win32 * virtio-scsi assertion failure * mem-prealloc coverity fix * x86 migration revert which requires more thought * x86 instruction limit (avoids >2 page translation blocks) * nbd dead code cleanup * small memory.c logic fix # gpg: Signature made Mon 27 Mar 2017 17:03:04 BST # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * remotes/bonzini/tags/for-upstream: scsi-generic: Fill in opt_xfer_len in INQUIRY reply if it is zero Revert "apic: save apic_delivered flag" nbd: drop unused NBDClientSession.is_unix field win32: replace custom mutex and condition variable with native primitives mem-prealloc: fix sysconf(_SC_NPROCESSORS_ONLN) failure case. tcg/i386: Check the size of instruction being translated virtio-scsi: Fix acquire/release in dataplane handlers virtio-scsi: Make virtio_scsi_acquire/release public clear pending status before calling memory commit Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-03-27scsi-generic: Fill in opt_xfer_len in INQUIRY reply if it is zeroFam Zheng
When opt_xfer_len is zero, Linux ignores max_xfer_len erroneously. While that obviously should be fixed, we do older guests a favor to always filling in a value. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170327142625.1249-1-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-24virtio-scsi: Fix acquire/release in dataplane handlersFam Zheng
After the AioContext lock push down, there is a race between virtio_scsi_dataplane_start and those "assert(s->ctx && s->dataplane_started)", because the latter doesn't isn't wrapped in aio_context_acquire. Reproducer is simply booting a Fedora guest with an empty virtio-scsi-dataplane controller: qemu-system-x86_64 \ -drive if=none,id=root,format=raw,file=Fedora-Cloud-Base-25-1.3.x86_64.raw \ -device virtio-scsi \ -device scsi-disk,drive=root,bootindex=1 \ -object iothread,id=io \ -device virtio-scsi-pci,iothread=io \ -net user,hostfwd=tcp::10022-:22 -net nic,model=virtio -m 2048 \ --enable-kvm Fix this by moving acquire/release pairs from virtio_scsi_handle_*_vq to their callers - and wrap the broken assertions in. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170317061447.16243-3-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-24virtio-scsi: Make virtio_scsi_acquire/release publicFam Zheng
They will be used in virtio-scsi-dataplane.c as well, so move them to header. Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <20170317061447.16243-2-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-03-24trace: Fix incorrect megasas trace parametersEric Blake
hw/scsi/trace-events lists cmd as the first parameter for both megasas_iovec_overflow and megasas_iovec_underflow, but the caller was mistakenly passing cmd->iov_size twice instead of the command index. Also, trace_megasas_abort_invalid is called with parameters in the wrong order. Broken since its introduction in commit e8f943c3. Signed-off-by: Eric Blake <eblake@redhat.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-03-14scsi: mptsas: fix the wrong reading size in fetch requestLi Qiang
When fetching request, it should read sizeof(*hdr), not the pointer hdr. Signed-off-by: Li Qiang <liqiang6-s@360.cn> Message-Id: <1489488980-130668-1-git-send-email-liqiang6-s@360.cn> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-02-28hw/block: Request permissionsKevin Wolf
This makes all device emulations with a qdev drive property request permissions on their BlockBackend. The only thing we block at this point is resizing images for some devices that can't support it. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Acked-by: Fam Zheng <famz@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com>
2017-02-28block: Allow error return in BlockDevOps.change_media_cb()Kevin Wolf
Some devices allow a media change between read-only and read-write media. They need to adapt the permissions in their .change_media_cb() implementation, which can fail. So add an Error parameter to the function. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Acked-by: Fam Zheng <famz@redhat.com>
2017-02-28block: Add permissions to blk_new()Kevin Wolf
We want every user to be specific about the permissions it needs, so we'll pass the initial permissions as parameters to blk_new(). A user only needs to call blk_set_perm() if it wants to change the permissions after the fact. The permissions are stored in the BlockBackend and applied whenever a BlockDriverState should be attached in blk_insert_bs(). This does not include actually choosing the right set of permissions everywhere yet. Instead, the usual FIXME comment is added to each place and will be addressed in individual patches. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Acked-by: Fam Zheng <famz@redhat.com>
2017-02-21Merge remote-tracking branch 'remotes/armbru/tags/pull-block-2017-02-21' ↵Peter Maydell
into staging Changes to -drive without if= and with if=scsi # gpg: Signature made Tue 21 Feb 2017 12:22:35 GMT # gpg: using RSA key 0x3870B400EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * remotes/armbru/tags/pull-block-2017-02-21: hw/i386: Deprecate -drive if=scsi with PC machine types hw: Deprecate -drive if=scsi with non-onboard HBAs hw/scsi: Concentrate -drive if=scsi auto-create in one place hw: Drop superfluous special checks for orphaned -drive blockdev: Make orphaned -drive fatal blockdev: Improve message for orphaned -drive hw/arm/highbank: Default -drive to if=ide instead of if=scsi hw: Default -drive to if=none instead of scsi when scsi cannot work hw: Default -drive to if=none instead of ide when ide cannot work hw/arm/cubieboard hw/arm/xlnx-ep108: Fix units_per_default_bus hw: Default -drive to if=ide explicitly where it works Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-02-21hw: Deprecate -drive if=scsi with non-onboard HBAsMarkus Armbruster
Block backends defined with "-drive if=T" with T other than "none" are meant to be picked up by machine initialization code: a suitable frontend gets created and wired up automatically. Drives defined with if=scsi are also picked up by SCSI HBAs added with -device, unlike other interface types. Deprecate this usage, as follows. Create the frontends for onboard HBAs in machine initialization code, exactly like we do for if=ide and other interface types. Change scsi_legacy_handle_cmdline() to create a frontend only when it's still missing, and warn that this usage is deprecated. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1487161136-9018-3-git-send-email-armbru@redhat.com>
2017-02-21hw/scsi: Concentrate -drive if=scsi auto-create in one placeMarkus Armbruster
The logic to create frontends for -drive if=scsi is in SCSI HBAs. For all other interface types, it's in machine initialization code. A few machine types create the SCSI HBAs necessary for that. That's also not done for other interface types. I'm going to deprecate these SCSI eccentricities. In preparation for that, create the frontends in main() instead of the SCSI HBAs, by calling new function scsi_legacy_handle_cmdline() there. Note that not all SCSI HBAs create frontends. Take care not to change that. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1487161136-9018-2-git-send-email-armbru@redhat.com> Acked-By: Paolo Bonzini <pbonzini@redhat.com>
2017-02-21block: explicitly acquire aiocontext in aio callbacks that need itPaolo Bonzini
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170213135235.12274-16-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-21block: explicitly acquire aiocontext in bottom halves that need itPaolo Bonzini
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170213135235.12274-15-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-21block: explicitly acquire aiocontext in callbacks that need itPaolo Bonzini
This covers both file descriptor callbacks and polling callbacks, since they execute related code. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20170213135235.12274-14-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2017-02-17virtio: Report real progress in VQ aio poll handlerFam Zheng
In virtio_queue_host_notifier_aio_poll, not all "!virtio_queue_empty()" cases are making true progress. Currently the offending one is virtio-scsi event queue, whose handler does nothing if no event is pending. As a result aio_poll() will spin on the "non-empty" VQ and take 100% host CPU. Fix this by reporting actual progress from virtio queue aio handlers. Reported-by: Ed Swierk <eswierk@skyportsystems.com> Signed-off-by: Fam Zheng <famz@redhat.com> Tested-by: Ed Swierk <eswierk@skyportsystems.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-02-01pci: Convert msix_init() to Error and fix callersCao jin
msix_init() reports errors with error_report(), which is wrong when it's used in realize(). The same issue was fixed for msi_init() in commit 1108b2f. In order to make the API change as small as possible, leave the return value check to later patch. For some devices(like e1000e, vmxnet3, nvme) who won't fail because of msix_init's failure, suppress the error report by passing NULL error object. Bonus: add comment for msix_init. CC: Jiri Pirko <jiri@resnulli.us> CC: Gerd Hoffmann <kraxel@redhat.com> CC: Dmitry Fleytman <dmitry@daynix.com> CC: Jason Wang <jasowang@redhat.com> CC: Michael S. Tsirkin <mst@redhat.com> CC: Hannes Reinecke <hare@suse.de> CC: Paolo Bonzini <pbonzini@redhat.com> CC: Alex Williamson <alex.williamson@redhat.com> CC: Markus Armbruster <armbru@redhat.com> CC: Marcel Apfelbaum <marcel@redhat.com> Signed-off-by: Cao jin <caoj.fnst@cn.fujitsu.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-27hw/scsi: Fix debug message of cdb structure in scsi-genericEric Farman
When running with debug enabled, the scsi-generic cdb that is dumped skips byte 0 of the command, which is the opcode. This makes identifying which command is being issued/completed a little difficult. Example: 0x00 0x00 0x01 0x00 0x00 scsi-generic: scsi_read_data 0x0 scsi-generic: Data ready tag=0x0 len=164 scsi-generic: scsi_read_data 0x0 scsi-generic: Command complete 0x0x10a42c60 tag=0x0 status=0 Improve this by adding a message prior to the loop, similar to what exists for scsi-disk. Clean up a few other messages to be more explicit of what is being represented. Example: scsi-generic: Command: data=0x12 0x00 0x00 0x01 0x00 0x00 scsi-generic: scsi_read_data tag=0x0 scsi-generic: Data ready tag=0x0 len=164 scsi-generic: scsi_read_data tag=0x0 scsi-generic: Command complete 0x0x10a452d0 tag=0x0 status=0 Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Message-Id: <20170120162527.66075-2-farman@linux.vnet.ibm.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-25Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into ↵Peter Maydell
staging trivial patches for 2017-01-24 # gpg: Signature made Tue 24 Jan 2017 20:27:08 GMT # gpg: using RSA key 0x701B4F6B1A693E59 # gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" # gpg: aka "Michael Tokarev <mjt@corpit.ru>" # gpg: aka "Michael Tokarev <mjt@debian.org>" # Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D 4324 457C E0A0 8044 65C5 # Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931 4B22 701B 4F6B 1A69 3E59 * remotes/mjt/tags/trivial-patches-fetch: (31 commits) hw/isa/isa-bus: Set category of the "isabus-bridge" device usb: Set category and description of the MTP device gdbstub.c: update old error report statements gdbstub.c: fix GDB connection segfault caused by empty machines scsi-disk: add 'fall through' comment to switch VERIFY cases Drop duplicate display option documentation hw/display/framebuffer.c: Avoid overflow for framebuffers > 4GB win32: use glib gpoll if glib >= 2.50 util/mmap-alloc: refactor a little bit for readability util/mmap-alloc: check parameter before using vfio: remove a duplicated word in comments docs: sync pci-ids.txt disas/cris.c: Fix Coverity warning about unchecked NULL lm32: milkymist-tmu2: fix another integer overflow hw/i386/kvmvapic: Remove dead code in patch_hypercalls() doc/usb2: fix typo qga: fix erroneous argument to strerror block: remove dead check pci-assign: avoid pointless stat qemu-img: remove dead check ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2017-01-24scsi-disk: add 'fall through' comment to switch VERIFY casesPeter Maydell
Commit 166dbda7e131 added some extra cases to a switch() such that the existing code is intended to fall through the new case statements. It's clear from the commit that this is intentional, but less clear to subsequent readers of the code, and not clear at all to static analysis tools like Coverity. Add a /* fall through */ comment to indicate the intent. (Fixes CID 1368287.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2017-01-24PCI/migration merge vmstate_pci_device and vmstate_pcie_deviceDr. David Alan Gilbert
The vmstate_pci_device and vmstate_pcie_devices differ just in the size of one buffer; combine the two using a _TEST macro. I think this is safe as long as everywhere which currently uses either of these two uses the right type. One thing that concerns me is that some places use pci_device_load/save which does some irq mangling, but others just use the VMSTATE_PCI_DEVICE macro - how are they getting the same irq mangling? This passes a smoke test migrate of: ./x86_64-softmmu/qemu-system-x86_64 -M pc,accel=kvm -m 1024 ./littlefed20.img -device e1000e -device virtio-net -device e1000 -device virtio-rng -device megasas -device megasas-gen2 -device ioh3420 -device nec-usb-xhci to an unmodified qemu. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20161214195829.18241-1-dgilbert@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-01-24migration: disallow migrate_add_blocker during migrationAshijeet Acharya
If a migration is already in progress and somebody attempts to add a migration blocker, this should rightly fail. Add an errp parameter and a retcode return value to migrate_add_blocker. Signed-off-by: John Snow <jsnow@redhat.com> Signed-off-by: Ashijeet Acharya <ashijeetacharya@gmail.com> Message-Id: <1484566314-3987-5-git-send-email-ashijeetacharya@gmail.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Acked-by: Greg Kurz <groug@kaod.org> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Merged with recent 'Allow invtsc migration' change
2017-01-24migration: extend VMStateInfoJianjun Duan
Current migration code cannot handle some data structures such as QTAILQ in qemu/queue.h. Here we extend the signatures of put/get in VMStateInfo so that customized handling is supported. put now will return int type. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Jianjun Duan <duanj@linux.vnet.ibm.com> Message-Id: <1484852453-12728-2-git-send-email-duanj@linux.vnet.ibm.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2017-01-16scsi-block: fix direction of BYTCHK test for VERIFY commandsPaolo Bonzini
The direction is wrong; scsi_block_is_passthrough returns false for commands that *can* use sglists. Reported-by: Zhang Qian <zhangqian@sangfor.com.cn> Fixes: 8fdc7839e40f43a426bc7e858cf1dbfe315a3804 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-16megasas: fix guest-triggered memory leakPaolo Bonzini
If the guest sets the sglist size to a value >=2GB, megasas_handle_dcmd will return MFI_STAT_MEMORY_NOT_AVAILABLE without freeing the memory. Avoid this by returning only the status from map_dcmd, and loading cmd->iov_size in the caller. Reported-by: Li Qiang <liqiang6-s@360.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2017-01-10virtio: convert to use DMA apiJason Wang
Currently, all virtio devices bypass IOMMU completely. This is because address_space_memory is assumed and used during DMA emulation. This patch converts the virtio core API to use DMA API. This idea is - introducing a new transport specific helper to query the dma address space. (only pci version is implemented). - query and use this address space during virtio device guest memory accessing when iommu platform (VIRTIO_F_IOMMU_PLATFORM) was enabled for this device. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-block@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2017-01-03virtio-scsi: suppress virtqueue kick during processingStefan Hajnoczi
The guest does not need to kick the virtqueue while we are processing it. This reduces the number of vmexits during periods of heavy I/O. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20161201192652.9509-9-stefanha@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-12-22scsi-disk: fix VERIFY for scsi-blockPaolo Bonzini
When a scsi-disk object receives VERIFY command with BYTCHK bit being zero, scsi_block_is_passthrough returns false and finally makes req being proceeded by scsi_block_dma_command. Because scsi_block_dma_command has removed process of VERIFY, QEMU will abort in this function. Reported-by: Junlian Bell <zhongjun@sangfor.com.cn> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-12-22virtio-scsi: introduce virtio_scsi_acquire/releasePaolo Bonzini
These will be used more as soon as the acquire/release is pushed down to the ioeventfd handlers. Reviewed-by: Fam Zheng <famz@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-29Merge remote-tracking branch 'bonzini/tags/for-upstream' into stagingStefan Hajnoczi
Small fixes for rc2. # gpg: Signature made Mon 28 Nov 2016 03:45:20 PM GMT # gpg: using RSA key 0xBFFBD25F78C7AE83 # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * bonzini/tags/for-upstream: rules.mak: Use -r instead of -Wl, -r to fix building when PIE is default migration/pcspk: Turn migration of pcspk off for 2.7 and older migration/pcspk: Add a property to state if pcspk is migrated pci-assign: sync MSI/MSI-X cap and table with PCIDevice megasas: clean up and fix request completion/cancellation megasas: do not call pci_dma_unmap after having freed the frame once Message-id: 1480372837-109736-1-git-send-email-pbonzini@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-11-28megasas: clean up and fix request completion/cancellationPaolo Bonzini
megasas_command_cancel is a callback; it should report the abort in the frame, not try another abort! Compare for instance with mptsas_request_cancelled. So extract the common bits for request completion in a new function megasas_complete_command, call it from both the .complete and .cancel callbacks, and remove duplicate pieces from the DCMD path. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20161110152751.4267-2-pbonzini@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-28megasas: do not call pci_dma_unmap after having freed the frame oncePaolo Bonzini
Commit 8cc4678 ("megasas: remove useless check for cmd->frame", 2016-07-17) was wrong because I trusted Coverity too much. It turns out that there _is_ a path through which cmd->frame can become NULL. After megasas_handle_frame's switch (md->frame->header.frame_cmd), megasas_init_firmware can be called. From there, megasas_reset_frames will call megasas_unmap_frame which resets cmd->frame = NULL. However, there is another bug to fix in there, because megasas_unmap_frame is called again after setting the command status. In this case QEMU should not do anything, instead it calls pci_dma_unmap again. Harmless, but better fix it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-22scsi/esp: do not raise an interrupt when reading the FIFO registerHervé Poussineau
This fixes SCSI adapter self-tests done in MIPS Jazz emulation, broken since ff589551c8e8e9e95e211b9d8daafb4ed39f1aec. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Message-Id: <1479508397-8443-1-git-send-email-hpoussin@reactos.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-11-18virtio: set ISR on dataplane notificationsPaolo Bonzini
Dataplane has been omitting forever the step of setting ISR when an interrupt is raised. This caused little breakage, because the specification actually says that ISR may not be updated in MSI mode. Some versions of the Windows drivers however didn't clear MSI mode correctly, and proceeded using polling mode (using ISR, not the used ring index!) for crashdump and hibernation. If it were just crashdump and hibernation it would not be a big deal, but recent releases of Windows do not really shut down, but rather log out and hibernate to make the next startup faster. Hence, this manifested as a more serious hang during shutdown with e.g. Windows 8.1 and virtio-win 1.8.0 RPMs. Newer versions fixed this, while older versions do not use MSI at all. The failure has always been there for virtio dataplane, but it became visible after commits 9ffe337 ("virtio-blk: always use dataplane path if ioeventfd is active", 2016-10-30) and ad07cd6 ("virtio-scsi: always use dataplane path if ioeventfd is active", 2016-10-30) made virtio-blk and virtio-scsi always use the dataplane code under KVM. The good news therefore is that it was not a bug in the patches---they were doing exactly what they were meant for, i.e. shake out remaining dataplane bugs. The fix is not hard, so it's worth arranging for the broken drivers. The virtio_should_notify+event_notifier_set pair that is common to virtio-blk and virtio-scsi dataplane is replaced with a new public function virtio_notify_irqfd that also sets ISR. The irqfd emulation code now need not set ISR anymore, so virtio_irq is removed. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Tested-by: Farhan Ali <alifm@linux.vnet.ibm.com> Tested-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2016-11-03Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingStefan Hajnoczi
virtio, pc: fixes and features nvdimm hotplug support virtio migration and ioeventfd rework virtio crypto device ipmi fixes Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Tue 01 Nov 2016 05:23:40 PM GMT # gpg: using RSA key 0x281F0DB8D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (47 commits) acpi: fix assert failure caused by commit 35c5a52d acpi/ipmi: Initialize the fwinfo before fetching it ipmi: Add graceful shutdown handling to the external BMC ipmi: fix build config variable name for ipmi_bmc_extern.o ipmi: Implement shutdown via ACPI overtemp ipmi: chassis poweroff should use qemu_system_shutdown_request() ipmi_bmc_sim: Remove an unnecessary mutex ipmi: Remove hotplug from IPMI BMCs pc: memhp: enable nvdimm device hotplug nvdimm acpi: introduce _FIT nvdimm acpi: introduce fit buffer nvdimm acpi: prebuild nvdimm devices for available slots nvdimm acpi: use common macros instead of magic names acpi nvdimm: rename result_size to dsm_out_buf_siz nvdimm acpi: compile nvdimm acpi code arch-independently acpi nvdimm: fix Arg6 usage acpi nvdimm: fix ARG3 conflict acpi nvdimm: fix device physical address base acpi nvdimm: fix OperationRegion definition acpi nvdimm: fix wrong buffer size returned by DSM method ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-01-07 02:11:24 +0000