summary refs log tree commit diff stats
path: root/hw/scsi/virtio-scsi.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* virtio-scsi: prepare sense data handling for any_layoutPaolo Bonzini2014-06-181-10/+12
| | | | | | | | | | Retrieve sense and copy it to guest memory, to prepare for when we will use qemu_iovec_from_buf. Swap response and request, since we'll use the tail of VirtIOSCSIReq for the CDB. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: add extra argument and return type to qemu_sgl_concatPaolo Bonzini2014-06-181-7/+20
| | | | | | Will be used for anylayout support. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: add target swap for VirtIOSCSICtrlTMFReq fieldsPaolo Bonzini2014-06-181-1/+5
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: start preparing for any_layoutPaolo Bonzini2014-06-181-49/+72
| | | | | | | | | | | - Introduce virtio_scsi_init_req and virtio_scsi_free_req - rename qemu_sgl_init_external to qemu_sgl_concat - move virtio_scsi_parse_req from virtio_scsi_pop_req to callers and add header length checks to virtio_scsi_parse_req. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw: use ld_p/st_p instead of ld_raw/st_rawPaolo Bonzini2014-06-051-14/+14
| | | | | | | | | | The ld_raw and st_raw definitions are only needed in code that must compile for both user-mode and softmmu emulation. Device models can use the equivalent ld_p/st_p which are simple pointer accessors. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Merge remote-tracking branch 'remotes/bonzini/scsi-next' into stagingPeter Maydell2014-05-221-1/+2
|\ | | | | | | | | | | | | | | | | | | * remotes/bonzini/scsi-next: megasas: remove buildtime strings block: iscsi build fix if LIBISCSI_FEATURE_IOVECTOR is not defined virtio-scsi: Plug memory leak on virtio_scsi_push_event() error path scsi: Document intentional fall through in scsi_req_length() Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * virtio-scsi: Plug memory leak on virtio_scsi_push_event() error pathMarkus Armbruster2014-05-161-1/+2
| | | | | | | | | | | | | | | | Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* | virtio-scsi: fix buffer overrun on invalid state loadMichael S. Tsirkin2014-05-051-0/+9
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2013-4542 hw/scsi/scsi-bus.c invokes load_request. virtio_scsi_load_request does: qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem)); this probably can make elem invalid, for example, make in_num or out_num huge, then: virtio_scsi_parse_req(s, vs->cmd_vqs[n], req); will do: if (req->elem.out_num > 1) { qemu_sgl_init_external(req, &req->elem.out_sg[1], &req->elem.out_addr[1], req->elem.out_num - 1); } else { qemu_sgl_init_external(req, &req->elem.in_sg[1], &req->elem.in_addr[1], req->elem.in_num - 1); } and this will access out of array bounds. Note: this adds security checks within assert calls since SCSIBusInfo's load_request cannot fail. For now simply disable builds with NDEBUG - there seems to be little value in supporting these. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
* virtio-scsi: actually honor sense_size from configuration spacePaolo Bonzini2014-03-141-1/+3
| | | | | | | We were always truncating the sense size to 96 bytes. Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: Prevent assertion on missed eventsEric Farman2014-01-151-1/+1
| | | | | | | | | | In some cases, an unplug can cause events to be dropped, which leads to an assertion failure when preparing to notify the guest kernel. Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: Cleanup of I/Os that never startedEric Farman2014-01-151-0/+4
| | | | | | | | | | | | | | | | | There is still a small window that occurs when a cancel I/O affects an asynchronous I/O operation that hasn't started. In other words, when the residual data length equals the expected data length. Today, the routine virtio_scsi_command_complete fails because the VirtIOSCSIReq pointer (from the hba_private field in SCSIRequest) was cleared earlier when virtio_scsi_complete_req was called by the virtio_scsi_request_cancelled routine. As a result, the virtio_scsi_command_complete routine needs to simply return when it is processing a SCSIRequest block that was marked canceled. Signed-off-by: Eric Farman <farman@linux.vnet.ibm.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio: Convert exit to unrealizeAndreas Färber2013-12-091-8/+9
| | | | | Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio: Complete converting VirtioDevice to QOM realizeAndreas Färber2013-12-091-2/+1
| | | | | | | Drop VirtioDeviceClass::init. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: Convert to QOM realizeAndreas Färber2013-12-091-17/+15
| | | | | Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: QOM realize preparationsAndreas Färber2013-12-091-7/+7
| | | | | | | | | | Rename qdev -> dev since that's what realize's argument is called by convention. No need to keep more "qdev" around than necessary. Avoid duplicate VIRTIO_DEVICE() cast. Signed-off-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: switch exit callback to VirtioDeviceClassPaolo Bonzini2013-12-091-8/+7
| | | | | | | | | This ensures hot-unplug is handled properly by the proxy, and avoids leaking bus_name which is freed by virtio_device_exit. Cc: qemu-stable@nongnu.org Acked-by: Andreas Faerber <afaerber@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: Make type virtio-scsi-common abstractMarkus Armbruster2013-09-121-0/+1
| | | | | | | It's the abstract base of virtio-scsi-device and vhost-scsi. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* scsi: Pass size to scsi_bus_new()Andreas Färber2013-08-301-1/+2
| | | | | | | | | | To be passed to qbus_create_inplace(). Use DEVICE() casts instead of direct parent field access. Reviewed-by: Wenchao Xia <xiawenc@linux.vnet.ibm.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de>
* devices: Associate devices to their logical categoryMarcel Apfelbaum2013-07-291-0/+3
| | | | | | | | | The category will be used to sort the devices displayed in the command line help. Signed-off-by: Marcel Apfelbaum <marcel.a@redhat.com> Message-id: 1375107465-25767-4-git-send-email-marcel.a@redhat.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* scsi: Improve error propagation for scsi_bus_legacy_handle_cmdline()Andreas Färber2013-07-231-1/+6
| | | | | | | Let scsi_bus_legacy_add_drive() and scsi_bus_legacy_handle_cmdline() return an Error**. Prepare qdev initfns for QOM realize error model. Signed-off-by: Andreas Färber <afaerber@suse.de>
* dma: keep a device alive while it has SGListsPaolo Bonzini2013-07-041-4/+6
| | | | | Reviewed-by: Anthony Liguori <aliguori@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* dma: eliminate DMAContextPaolo Bonzini2013-06-201-1/+1
| | | | | | | | | The DMAContext is a simple pointer to an AddressSpace that is now always already available. Make everyone hold the address space directly, and clean up the DMA API to use the AddressSpace directly. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* virtio-scsi: fix the command line compatibility.KONRAD Frederic2013-05-031-1/+2
| | | | | | | | | | | The bus name is wrong since the refactoring. This keeps the behaviour of the command line. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com> Message-id: 1367330931-12994-6-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* scsi: add bus_name parameter to scsi_bus_new.KONRAD Frederic2013-05-031-1/+1
| | | | | | | | | | This adds the possibility to create a scsi-bus with a specified name. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Tested-by: Cornelia Huck <cornelia.huck@de.ibm.com> Message-id: 1367330931-12994-4-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* virtio: cleanup: init and exit function.KONRAD Frederic2013-04-241-1/+1
| | | | | | | | | This clean the init and the exit functions and rename virtio_common_cleanup to virtio_cleanup. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Message-id: 1366791683-5350-7-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* virtio: remove the function pointer.KONRAD Frederic2013-04-241-6/+0
| | | | | | | | | This remove the function pointer in VirtIODevice, and use only VirtioDeviceClass function pointer. Signed-off-by: KONRAD Frederic <fred.konrad@greensocs.com> Message-id: 1366791683-5350-5-git-send-email-fred.konrad@greensocs.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
* virtio-scsi: create VirtIOSCSICommonPaolo Bonzini2013-04-191-140/+72
| | | | | | | | | | This patch refactors existing virtio-scsi code into VirtIOSCSICommon in order to allow virtio_scsi_init_common() to be used by both internal virtio_scsi_init() and external vhost-scsi-pci code. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Asias He <asias@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw: move virtio devices to hw/ subdirectoriesPaolo Bonzini2013-04-081-0/+774
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>