[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 5/7] hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buff
From: |
Philippe Mathieu-Daudé |
Subject: |
[PATCH v3 5/7] hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size |
Date: |
Thu, 5 Mar 2020 13:12:51 +0100 |
The 'union srp_iu' is meant as a pointer to any SRP Information
Unit type, it is not related to the size of a VIO DMA buffer.
Use a plain buffer for the VIO DMA read/write calls.
We can remove the reserved buffer from the 'union srp_iu'.
This issue was noticed when replacing the zero-length arrays
from hw/scsi/srp.h with flexible array member,
'clang -fsanitize=undefined' reported:
hw/scsi/spapr_vscsi.c:69:29: error: field 'iu' with variable sized type
'union viosrp_iu' not at the end of a struct or class is a GNU extension
[-Werror,-Wgnu-variable-sized-type-not-at-end]
union viosrp_iu iu;
^
Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
---
v2: Removed unuseful _Static_assert (dgibson)
---
hw/scsi/viosrp.h | 1 -
hw/scsi/spapr_vscsi.c | 10 +++++-----
2 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/hw/scsi/viosrp.h b/hw/scsi/viosrp.h
index 25676c2383..e5f9768e8f 100644
--- a/hw/scsi/viosrp.h
+++ b/hw/scsi/viosrp.h
@@ -49,7 +49,6 @@ union srp_iu {
struct srp_tsk_mgmt tsk_mgmt;
struct srp_cmd cmd;
struct srp_rsp rsp;
- uint8_t reserved[SRP_MAX_IU_LEN];
};
enum viosrp_crq_formats {
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 70547f98ac..acf9bb50bc 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -66,7 +66,7 @@ typedef union vscsi_crq {
typedef struct vscsi_req {
vscsi_crq crq;
- union viosrp_iu iu;
+ uint8_t viosrp_iu_buf[SRP_MAX_IU_LEN];
/* SCSI request tracking */
SCSIRequest *sreq;
@@ -99,7 +99,7 @@ typedef struct {
static union viosrp_iu *req_iu(vscsi_req *req)
{
- return &req->iu;
+ return (union viosrp_iu *)req->viosrp_iu_buf;
}
static struct vscsi_req *vscsi_get_req(VSCSIState *s)
@@ -183,7 +183,7 @@ static int vscsi_send_iu(VSCSIState *s, vscsi_req *req,
/* First copy the SRP */
rc = spapr_vio_dma_write(&s->vdev, req->crq.s.IU_data_ptr,
- &req->iu, length);
+ &req->viosrp_iu_buf, length);
if (rc) {
fprintf(stderr, "vscsi_send_iu: DMA write failure !\n");
}
@@ -602,7 +602,7 @@ static const VMStateDescription vmstate_spapr_vscsi_req = {
.minimum_version_id = 1,
.fields = (VMStateField[]) {
VMSTATE_BUFFER(crq.raw, vscsi_req),
- VMSTATE_BUFFER(iu.srp.reserved, vscsi_req),
+ VMSTATE_BUFFER(viosrp_iu_buf, vscsi_req),
VMSTATE_UINT32(qtag, vscsi_req),
VMSTATE_BOOL(active, vscsi_req),
VMSTATE_UINT32(data_len, vscsi_req),
@@ -1103,7 +1103,7 @@ static void vscsi_got_payload(VSCSIState *s, vscsi_crq
*crq)
}
/* XXX Handle failure differently ? */
- if (spapr_vio_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->iu,
+ if (spapr_vio_dma_read(&s->vdev, crq->s.IU_data_ptr, &req->viosrp_iu_buf,
crq->s.IU_length)) {
fprintf(stderr, "vscsi_got_payload: DMA read failure !\n");
vscsi_put_req(req);
--
2.21.1
- [PATCH v3 0/7] hw/scsi/spapr_vscsi: Fix time bomb buffer overflow, Philippe Mathieu-Daudé, 2020/03/05
- [PATCH v3 1/7] hw/scsi/viosrp: Add missing 'hw/scsi/srp.h' include, Philippe Mathieu-Daudé, 2020/03/05
- [PATCH v3 2/7] hw/scsi/spapr_vscsi: Use SRP_MAX_IU_LEN instead of sizeof flexible array, Philippe Mathieu-Daudé, 2020/03/05
- [PATCH v3 3/7] hw/scsi/spapr_vscsi: Simplify a bit, Philippe Mathieu-Daudé, 2020/03/05
- [PATCH v3 4/7] hw/scsi/spapr_vscsi: Introduce req_iu() helper, Philippe Mathieu-Daudé, 2020/03/05
- [PATCH v3 5/7] hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size,
Philippe Mathieu-Daudé <=
- [PATCH v3 6/7] hw/scsi/spapr_vscsi: Prevent buffer overflow, Philippe Mathieu-Daudé, 2020/03/05
- [PATCH v3 7/7] hw/scsi/spapr_vscsi: Convert debug fprintf() to trace event, Philippe Mathieu-Daudé, 2020/03/05
- Re: [PATCH v3 0/7] hw/scsi/spapr_vscsi: Fix time bomb buffer overflow, no-reply, 2020/03/05
- Re: [PATCH v3 0/7] hw/scsi/spapr_vscsi: Fix time bomb buffer overflow, no-reply, 2020/03/05
- Re: [PATCH v3 0/7] hw/scsi/spapr_vscsi: Fix time bomb buffer overflow, Paolo Bonzini, 2020/03/05
- Re: [PATCH v3 0/7] hw/scsi/spapr_vscsi: Fix time bomb buffer overflow, David Gibson, 2020/03/05