From: Michael Roth <michael.roth@amd.com>
To: <qemu-devel@nongnu.org>
Cc: <qemu-stable@nongnu.org>,
Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>,
Paolo Bonzini <pbonzini@redhat.com>
Subject: [PATCH 20/64] esp: only set ESP_RSEQ at the start of the select sequence
Date: Tue, 19 Oct 2021 09:09:00 -0500 [thread overview]
Message-ID: <20211019140944.152419-21-michael.roth@amd.com> (raw)
In-Reply-To: <20211019140944.152419-1-michael.roth@amd.com>
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
When processing a command to select a target and send a CDB, the ESP device
maintains a sequence step register so that if an error occurs the host can
determine which part of the selection/CDB submission sequence failed.
The old Linux 2.6 driver is really pedantic here: it checks the sequence step
register even if a command succeeds and complains loudly on the console if the
sequence step register doesn't match the expected bus phase and interrupt flags.
This reason this mismatch occurs is because the ESP emulation currently doesn't
update the bus phase until the next TI (Transfer Information) command and so the
cleared sequence step register is considered invalid for the stale bus phase.
Normally this isn't an issue as the host only checks the sequence step register
if an error occurs but the old Linux 2.6 driver does this in several places
causing a large stream of "esp0: STEP_ASEL for tgt 0" messages to appear on the
console during the boot process.
Fix this by not clearing the sequence step register when reading the interrupt
register and clearing the DMA status, so the guest sees a valid sequence step
and bus phase combination at the end of the command phase. No other change is
required since the sequence step register is correctly updated throughout the
selection/CDB submission sequence once one of the select commands is issued.
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: 1b9e48a5bd ("esp: implement non-DMA transfers in PDMA mode")
Message-Id: <20210518212511.21688-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit af947a3d853a235943681a00f07f3081f5143cc3)
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
hw/scsi/esp.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 000e45a624..18d4d56392 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -481,7 +481,6 @@ static void esp_dma_done(ESPState *s)
{
s->rregs[ESP_RSTAT] |= STAT_TC;
s->rregs[ESP_RINTR] |= INTR_BS;
- s->rregs[ESP_RSEQ] = 0;
s->rregs[ESP_RFLAGS] = 0;
esp_set_tc(s, 0);
esp_raise_irq(s);
@@ -917,7 +916,15 @@ uint64_t esp_reg_read(ESPState *s, uint32_t saddr)
val = s->rregs[ESP_RINTR];
s->rregs[ESP_RINTR] = 0;
s->rregs[ESP_RSTAT] &= ~STAT_TC;
- s->rregs[ESP_RSEQ] = SEQ_0;
+ /*
+ * According to the datasheet ESP_RSEQ should be cleared, but as the
+ * emulation currently defers information transfers to the next TI
+ * command leave it for now so that pedantic guests such as the old
+ * Linux 2.6 driver see the correct flags before the next SCSI phase
+ * transition.
+ *
+ * s->rregs[ESP_RSEQ] = SEQ_0;
+ */
esp_lower_irq(s);
break;
case ESP_TCHI:
--
2.25.1
next prev parent reply other threads:[~2021-10-19 14:55 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-19 14:08 [PATCH 00/64] Patch Round-up for stable 6.0.1, freeze on 2021-10-26 Michael Roth
2021-10-19 14:08 ` [PATCH 01/64] multi-process: Initialize variables declared with g_auto* Michael Roth
2021-10-19 14:08 ` [PATCH 02/64] linux-user/aarch64: Enable hwcap for RND, BTI, and MTE Michael Roth
2021-10-19 14:08 ` [PATCH 03/64] docs/system: Document the removal of "compat" property for POWER CPUs Michael Roth
2021-10-19 14:08 ` [PATCH 04/64] monitor/qmp: fix race on CHR_EVENT_CLOSED without OOB Michael Roth
2021-10-19 14:08 ` [PATCH 05/64] migration/rdma: Fix cm_event used before being initialized Michael Roth
2021-10-19 14:08 ` [PATCH 06/64] target/i386: Exit tb after wrmsr Michael Roth
2021-10-19 14:08 ` [PATCH 07/64] target/ppc: Fix load endianness for lxvwsx/lxvdsx Michael Roth
2021-10-19 14:08 ` [PATCH 08/64] vl: allow not specifying size in -m when using -M memory-backend Michael Roth
2021-10-19 14:08 ` [PATCH 09/64] target/xtensa: fix access ring in l32ex Michael Roth
2021-10-19 14:08 ` [PATCH 10/64] qemu-option: support accept-any QemuOptsList in qemu_opts_absorb_qdict Michael Roth
2021-10-19 14:08 ` [PATCH 11/64] qemu-config: load modules when instantiating option groups Michael Roth
2021-10-19 14:08 ` [PATCH 12/64] qemu-config: parse configuration files to a QDict Michael Roth
2021-10-19 14:08 ` [PATCH 13/64] vl: plumb keyval-based options into -readconfig Michael Roth
2021-10-19 14:08 ` [PATCH 14/64] vl: plug -object back " Michael Roth
2021-10-19 14:08 ` [PATCH 15/64] sockets: update SOCKET_ADDRESS_TYPE_FD listen(2) backlog Michael Roth
2021-10-19 14:08 ` [PATCH 16/64] hmp: Fix loadvm to resume the VM on success instead of failure Michael Roth
2021-10-19 14:08 ` [PATCH 17/64] configure: fix detection of gdbus-codegen Michael Roth
2021-10-19 14:08 ` [PATCH 18/64] vhost-vdpa: don't initialize backend_features Michael Roth
2021-10-19 14:08 ` [PATCH 19/64] esp: only assert INTR_DC interrupt flag if selection fails Michael Roth
2021-10-19 14:09 ` Michael Roth [this message]
2021-10-19 14:09 ` [PATCH 21/64] runstate: Initialize Error * to NULL Michael Roth
2021-10-19 14:09 ` [PATCH 22/64] vfio: Fix unregister SaveVMHandler in vfio_migration_finalize Michael Roth
2021-10-19 14:09 ` [PATCH 23/64] vl: Fix an assert failure in error path Michael Roth
2021-10-19 14:09 ` [PATCH 24/64] tcg/sparc: Fix temp_allocate_frame vs sparc stack bias Michael Roth
2021-10-19 14:09 ` [PATCH 25/64] tcg: Allocate sufficient storage in temp_allocate_frame Michael Roth
2021-10-19 14:09 ` [PATCH 26/64] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field Michael Roth
2021-10-19 14:09 ` [PATCH 27/64] block/nvme: Fix VFIO_MAP_DMA failed: No space left on device Michael Roth
2021-10-19 14:09 ` [PATCH 28/64] crypto/tlscreds: Introduce qcrypto_tls_creds_check_endpoint() helper Michael Roth
2021-10-19 14:09 ` [PATCH 29/64] block/nbd: Use qcrypto_tls_creds_check_endpoint() Michael Roth
2021-10-19 14:09 ` [PATCH 30/64] qemu-nbd: " Michael Roth
2021-10-19 14:09 ` [PATCH 31/64] chardev/socket: " Michael Roth
2021-10-19 14:09 ` [PATCH 32/64] migration/tls: " Michael Roth
2021-10-19 14:09 ` [PATCH 33/64] ui/vnc: " Michael Roth
2021-10-19 14:09 ` [PATCH 34/64] crypto: Make QCryptoTLSCreds* structures private Michael Roth
2021-10-19 14:09 ` [PATCH 35/64] yank: Unregister function when using TLS migration Michael Roth
2021-10-19 14:09 ` [PATCH 36/64] tests: acpi: prepare for changing DSDT tables Michael Roth
2021-10-19 14:09 ` [PATCH 37/64] acpi: pc: revert back to v5.2 PCI slot enumeration Michael Roth
2021-10-19 14:09 ` [PATCH 38/64] tests: acpi: pc: update expected DSDT blobs Michael Roth
2021-10-19 14:09 ` [PATCH 39/64] hw/block/nvme: align with existing style Michael Roth
2021-10-19 14:09 ` [PATCH 40/64] hw/nvme: fix missing check for PMR capability Michael Roth
2021-10-19 14:09 ` [PATCH 41/64] hw/nvme: fix pin-based interrupt behavior (again) Michael Roth
2021-10-19 14:09 ` [PATCH 42/64] virtio-balloon: don't start free page hinting if postcopy is possible Michael Roth
2021-10-19 14:09 ` [PATCH 43/64] hw/net/can: sja1000 fix buff2frame_bas and buff2frame_pel when dlc is out of std CAN 8 bytes Michael Roth
2021-10-19 14:09 ` [PATCH 44/64] hw/sd/sdcard: Document out-of-range addresses for SEND_WRITE_PROT Michael Roth
2021-10-19 14:09 ` [PATCH 45/64] hw/sd/sdcard: Fix assertion accessing out-of-range addresses with CMD30 Michael Roth
2021-10-19 14:09 ` [PATCH 46/64] audio: Never send migration section Michael Roth
2021-10-19 14:09 ` [PATCH 47/64] target/arm: Don't skip M-profile reset entirely in user mode Michael Roth
2021-10-19 14:09 ` [PATCH 48/64] virtio-net: fix use after unmap/free for sg Michael Roth
2021-10-19 14:09 ` [PATCH 49/64] qemu-nbd: Change default cache mode to writeback Michael Roth
2021-10-19 14:09 ` [PATCH 50/64] hmp: Unbreak "change vnc" Michael Roth
2021-10-19 14:09 ` [PATCH 51/64] virtio-mem-pci: Fix memory leak when creating MEMORY_DEVICE_SIZE_CHANGE event Michael Roth
2021-10-19 14:09 ` [PATCH 52/64] uas: add stream number sanity checks Michael Roth
2021-10-19 14:09 ` [PATCH 53/64] usb/redir: avoid dynamic stack allocation (CVE-2021-3527) Michael Roth
2021-10-19 14:09 ` [PATCH 54/64] usb: limit combined packets to 1 MiB (CVE-2021-3527) Michael Roth
2021-10-19 14:09 ` [PATCH 55/64] vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545) Michael Roth
2021-10-19 14:09 ` [PATCH 56/64] vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544) Michael Roth
2021-10-19 14:09 ` [PATCH 57/64] vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544) Michael Roth
2021-10-19 14:09 ` [PATCH 58/64] vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) Michael Roth
2021-10-19 14:09 ` [PATCH 59/64] vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544) Michael Roth
2021-10-19 14:09 ` [PATCH 60/64] vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) Michael Roth
2021-10-19 14:09 ` [PATCH 61/64] vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) Michael Roth
2021-10-19 14:09 ` [PATCH 62/64] hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) Michael Roth
2021-10-19 14:09 ` [PATCH 63/64] pvrdma: Ensure correct input on ring init (CVE-2021-3607) Michael Roth
2021-10-19 14:09 ` [PATCH 64/64] pvrdma: Fix the ring init error flow (CVE-2021-3608) Michael Roth
2021-10-19 14:43 ` [PATCH 00/64] Patch Round-up for stable 6.0.1, freeze on 2021-10-26 Ani Sinha
2021-10-19 14:45 ` Michael S. Tsirkin
2021-10-19 18:22 ` Michael Roth
2021-10-19 23:05 ` Ani Sinha
2021-10-19 14:52 ` Christian Schoenebeck
2021-10-19 15:26 ` Greg Kurz
2021-10-19 15:37 ` Christian Schoenebeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211019140944.152419-21-michael.roth@amd.com \
--to=michael.roth@amd.com \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).