[PATCH 0/2] spapr_vscsi: fix silent data corruption above 128 KiB

[Bernard Ladenthin <bernard.ladenthin@gmail.com>]

struct vscsi_req::cur_desc_offset is uint16_t. scsi-disk delivers a command
in SCSI_DMA_BUF_SIZE (128 KiB) chunks, so vscsi_srp_direct_data() adds
0x20000 to it on the first chunk and it wraps back to zero. Every following
chunk of the same command is then DMA'd over the start of the guest buffer:
the tail of the transfer overwrites the head, and the rest is never written
at all. The command completes with status 0 and no sense data, so the guest
has no way to notice.

Linux never hits it. Its ibmvscsi initiator uses INDIRECT descriptors for
anything multi-page, and that path resets cur_desc_offset at every
descriptor boundary, so the counter never reaches 65536. A guest that
describes the whole transfer with one DIRECT descriptor and issues 256 KiB
commands hits it on the first command. The field has been uint16_t since it
was introduced in 2013.

Patch 1 widens it. struct srp_direct_buf.len is already uint32_t and
vscsi_fetch_desc() already takes buf_offset as unsigned, so that is the
whole change. The VMSTATE entries for cur_desc_num/cur_desc_offset are
commented out upstream, so the migration format is unaffected.

Patch 2 adds the reproducer. It is a bare-metal PowerPC payload booted with
-kernel on -M pseries that speaks CRQ and SRP directly, with no guest
operating system involved, so a failure is attributable to one function in
QEMU rather than to something a kernel did on the way there. The fix comes
first, so the tree is never left with a failing test, but the test applies
on its own if a reviewer wants to put it first and watch it fail.

Testing. Against unpatched master the test reports 2 passed, 2 failed: the
two controls hold -- the CRQ registers and the 256 KiB READ_10 completes
with SRP status 0 -- and exactly the two assertions about where the data
landed fail. With patch 1 it reports 4 passed, 0 failed. Both runs use the
same payload and the same script; only qemu-system-ppc64 differs. Each
patch was also confirmed to apply and compile on its own against master.

The committed ELF is 920 bytes and its source rebuilds to it byte for byte;
"make check-reproducible" is there so the .S and the .elf cannot drift apart
unnoticed. tests/multiboot is the precedent for committing a built payload
and running it from a standalone script rather than a meson target.

The bug was found while trying to boot AIX 5.3 on -M pseries, where liblvm
reads a volume group descriptor area in one 256 KiB command and gets the
second half of it at offset 0. That is not needed to see the problem and is
not part of this series; the reproducer needs no guest at all.

Bernard Ladenthin (2):
  spapr_vscsi: fix data corruption on transfers above 128 KiB
  tests/spapr: add bare-metal reproducers for pseries machine behaviour

 MAINTAINERS              |   1 +
 hw/scsi/spapr_vscsi.c    |   9 +-
 tests/spapr/Makefile     |  62 ++++++++++
 tests/spapr/link.ld      |   3 +
 tests/spapr/run_test.sh  | 108 ++++++++++++++++
 tests/spapr/vscsibig.S   | 285 +++++++++++++++++++++++++++++++++++++++++++
 tests/spapr/vscsibig.elf | Bin 0 -> 920 bytes
 7 files changed, 467 insertions(+), 1 deletion(-)
 create mode 100644 tests/spapr/Makefile
 create mode 100644 tests/spapr/link.ld
 create mode 100755 tests/spapr/run_test.sh
 create mode 100644 tests/spapr/vscsibig.S
 create mode 100644 tests/spapr/vscsibig.elf

--
2.47.3