From patchwork Mon Aug 26 10:58:34 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikunj A Dadhania X-Patchwork-Id: 269858 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 096AE2C00A1 for ; Mon, 26 Aug 2013 20:59:42 +1000 (EST) Received: from localhost ([::1]:50594 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VDuWK-0004Tz-0h for incoming@patchwork.ozlabs.org; Mon, 26 Aug 2013 06:59:40 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37224) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VDuVr-0004Sn-8j for qemu-devel@nongnu.org; Mon, 26 Aug 2013 06:59:18 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VDuVk-0000mx-Aa for qemu-devel@nongnu.org; Mon, 26 Aug 2013 06:59:11 -0400 Received: from e28smtp01.in.ibm.com ([122.248.162.1]:34877) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VDuVj-0000me-MK for qemu-devel@nongnu.org; Mon, 26 Aug 2013 06:59:04 -0400 Received: from /spool/local by e28smtp01.in.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 26 Aug 2013 16:19:57 +0530 Received: from d28dlp02.in.ibm.com (9.184.220.127) by e28smtp01.in.ibm.com (192.168.1.131) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 26 Aug 2013 16:19:55 +0530 Received: from d28relay01.in.ibm.com (d28relay01.in.ibm.com [9.184.220.58]) by d28dlp02.in.ibm.com (Postfix) with ESMTP id 43C15394004D; Mon, 26 Aug 2013 16:28:47 +0530 (IST) Received: from d28av04.in.ibm.com (d28av04.in.ibm.com [9.184.220.66]) by d28relay01.in.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r7QB0WtD32768096; Mon, 26 Aug 2013 16:30:33 +0530 Received: from d28av04.in.ibm.com (localhost [127.0.0.1]) by d28av04.in.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id r7QAwtI8030677; Mon, 26 Aug 2013 16:28:55 +0530 Received: from abhimanyu.vnet.linux.ibm.com ([9.77.124.130]) by d28av04.in.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id r7QAwnCW030439 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Mon, 26 Aug 2013 16:28:52 +0530 From: Nikunj A Dadhania To: Alexander Graf In-Reply-To: References: <1377249737-12570-1-git-send-email-aik@ozlabs.ru> <24C2B209-2082-4AF8-A8FB-1FF8A8B7751B@suse.de> <1377468637.3819.27.camel@pasglop> <87vc2tysur.fsf@linux.vnet.ibm.com> User-Agent: Notmuch/0.14+104~g0a21fb9 (http://notmuchmail.org) Emacs/24.3.50.1 (x86_64-unknown-linux-gnu) Date: Mon, 26 Aug 2013 16:28:34 +0530 Message-ID: <874naczpk5.fsf@linux.vnet.ibm.com> MIME-Version: 1.0 X-TM-AS-MML: No X-Content-Scanned: Fidelis XPS MAILER x-cbid: 13082610-4790-0000-0000-000009FA1035 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] X-Received-From: 122.248.162.1 Cc: Alexey Kardashevskiy , Paolo Bonzini , "qemu-ppc@nongnu.org" , "qemu-devel@nongnu.org" Subject: Re: [Qemu-devel] [PATCH] spapr-vscsi: Adding VSCSI capabilities X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Alexander Graf writes: > Am 26.08.2013 um 05:32 schrieb Nikunj A Dadhania : > >> Benjamin Herrenschmidt writes: >> >>> On Sun, 2013-08-25 at 17:41 +0100, Alexander Graf wrote: >>>>> + vcap = &req->iu.mad.capabilities; >>>>> + rc = spapr_vio_dma_read(&s->vdev, be64_to_cpu(vcap->buffer), >>>>> + &cap, >>>> be16_to_cpu(vcap->common.length)); >>>> >>>> While I don't think any harm could happen from it, this could lead to >>>> a potential timing attack where we read and write from different >>>> locations in memory if the guest swizzles the request while we're >>>> processing it. >>> >>> BTW. While I disagree with your initial comment ... is there any bound >>> checking here ? That looks like potential stack corruption unless I >>> miss something if the guest passes a too big length... >>> >>> So at least the length should be read once, bound-checked, then the read >>> done with the result (don't bound check and read again, that would be >>> indeed racy). >> From: Nikunj A Dadhania This implements capabilities exchange between host and client. As at the moment no capability is supported, put zero flags everywhere and return. Signed-off-by: Nikunj A Dadhania --- hw/scsi/spapr_vscsi.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c index e9090e5..0758263 100644 --- a/hw/scsi/spapr_vscsi.c +++ b/hw/scsi/spapr_vscsi.c @@ -858,6 +858,47 @@ static int vscsi_send_adapter_info(VSCSIState *s, vscsi_req *req) return vscsi_send_iu(s, req, sizeof(*sinfo), VIOSRP_MAD_FORMAT); } +static int vscsi_send_capabilities(VSCSIState *s, vscsi_req *req) +{ + struct viosrp_capabilities *vcap; + struct capabilities cap; + uint16_t len; + uint64_t buffer; + int rc; + + vcap = &req->iu.mad.capabilities; + len = be16_to_cpu(vcap->common.length); + buffer = be64_to_cpu(vcap->buffer); + if (len > sizeof(cap)) { + fprintf(stderr, "vscsi_send_capabilities: size out of bound !\n"); + rc = H_PARAMETER; + goto error_out; + } + rc = spapr_vio_dma_read(&s->vdev, buffer, &cap, len); + if (rc) { + fprintf(stderr, "vscsi_send_capabilities: DMA read failure !\n"); + } + + /* + * Current implementation does not suppport any migration or + * reservation capabilities. Construct the response telling the + * guest not to use them. + */ + cap.flags = 0; + cap.migration.ecl = 0; + cap.reserve.type = 0; + cap.migration.common.server_support = 0; + cap.reserve.common.server_support = 0; + + rc = spapr_vio_dma_write(&s->vdev, buffer, &cap, len); + if (rc) { + fprintf(stderr, "vscsi_send_capabilities: DMA write failure !\n"); + } +error_out: + vcap->common.status = rc ? cpu_to_be32(1) : 0; + return vscsi_send_iu(s, req, sizeof(*vcap), VIOSRP_MAD_FORMAT); +} + static int vscsi_handle_mad_req(VSCSIState *s, vscsi_req *req) { union mad_iu *mad = &req->iu.mad; @@ -878,6 +919,9 @@ static int vscsi_handle_mad_req(VSCSIState *s, vscsi_req *req) mad->host_config.common.status = cpu_to_be16(1); vscsi_send_iu(s, req, sizeof(mad->host_config), VIOSRP_MAD_FORMAT); break; + case VIOSRP_CAPABILITIES_TYPE: + vscsi_send_capabilities(s, req); + break; default: fprintf(stderr, "VSCSI: Unknown MAD type %02x\n", be32_to_cpu(mad->empty_iu.common.type));