It is unnecessary to increase dif_errors in dif_verify(), because the
caller will increment it when dif_verify() detects failure.

This bug was introduced by commit beb40ea4 ("[SCSI] scsi_debug:
reduce duplication between prot_verify_read and prot_verify_write")
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

As pseudo_primary is only used in scsi_debug.c, it should be static.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Reviewed-by: NDouglas Gilbert <dgilbert@interlog.com>
Reviewed-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Reading partially unwritten sectors generates a false positive logical
block reference tag check failure when DIF is enabled.

This bug is caused by missing ei_lba increment in loop of dif_verify()
when unwritten sector is skipped.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Instead of repeatedly calling driver_create_file() to create driver
attribute files, This achieves the same thing by constructing an array
of driver_attribute and setting it to bus_type->drv_groups.

This change simplifies both creation and destruction of the attribute
files, and also removes sparse warning caused by driver_attributes which
are unnecessarily declared as global.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Each member in data integrity field tuple is big-endian.  But the
endianness of the values being compared with these members are not
annotated.  So this fixes these sparse warnings.
Reported-by: Nkbuild test robot <fengguang.wu@intel.com>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

In the module initialization, invalid value for guard module parameter
is detected by the following check:

        if (scsi_debug_guard > 1) {
                printk(KERN_ERR "scsi_debug_init: guard must be 0 or 1\n");
                return -EINVAL;
        }

But this check isn't enough, because the type of scsi_debug_guard is
'int' and scsi_debug_guard could be a negative value.

This fixes it by changing the type of scsi_debug_guard to 'unsigned int'
instead of adding extra check for a negative value.
Reported-by: NJoe Perches <joe@perches.com>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If data integrity support is enabled, prot_verify_write() is called in
response to WRITE commands and it verifies protection info from
prot_sglist by comparing against data sglist, and copies protection info
to dif_storep.

When multiple blocks are transfered by a WRITE command, it verifies and
copies these blocks one by one.  So if it fails to verify protection
info in the middle of blocks, the actual data transfer to fake_storep
isn't proceeded at all although protection info for some blocks are
already copied to dif_storep.  Therefore, it breaks the data integrity
between fake_storep and dif_storep.

This fixes it by ensuring that copying protection info to dif_storep is
done after all blocks are successfully verified.  Reusing dif_copy_prot()
with supporting the opposite direction simplifies this fix.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If data integrity support is enabled, prot_verify_read() is called in
response to READ commands and it verifies protection info from dif_storep
by comparing against fake_storep, and copies protection info to
prot_sglist.

This factors out the portion of copying protection info into a separate
function.  It will also be reused in the next change after supporting
the opposite direction (copying prot_sglist to dif_storep).
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If the module parameter virtual_gb is greater than 0, the READ command
may request the blocks which exceed actual ramdisk storage (fake_storep).
prot_verify_read() should treat those blocks as wrap around the end of
fake_storep.  But it actually causes fake_storep and dif_storep buffer
overruns.

This fixes these buffer overruns.  In order to simplify the fix,
this also introduces fake_store() and dif_store() which return
corresponding wrap around addresses.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Commit b90ebc3d ("[SCSI] scsi_debug:
fix logical block provisioning support") fixed several issues with
logical block provisioning support, but it still doesn't properly fix
the cases when unmap_alignment > 0.

For example, load scsi_debug module with the following module parameters
and make all blocks mapped by filling the storage with zero.

        # modprobe scsi_debug lbpu=1 unmap_alignment=1 unmap_granularity=4
        # dd if=/dev/zero of=$DEV

Then, try to unmap the first unmappable blocks at lba=1, but GET LBA STATUS
unexpectedly reports that the last UNMAP has done nothing.

        # sg_unmap --lba=1 --num=4 $DEV
        # sg_get_lba_status --lba=1 $DEV
        descriptor LBA: 0x0000000000000001  blocks: 16383  mapped

The problem is in map_index_to_lba(), which should return the first
LBA which is corresponding to a given index of provisioning map
(map_storep).
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: N"Martin K. Petersen" <martin.petersen@oracle.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

With module parameter num_parts > 0, partition table is built on the
ramdisk storage when loading the driver.  Unfortunately, there is an
endianness bug in sdebug_build_parts().  So the partition table is not
correctly initialized on big-endian systems.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Tested-by: NMartin Peschke <mpeschke@linux.vnet.ibm.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

do_device_access() is a function that abstracts copying SG list from/to
ramdisk storage (fake_storep).

It must deal with the ranges exceeding actual fake_storep size, because
such ranges are valid if virtual_gb is set greater than zero, and they
should be treated as fake_storep is repeatedly mirrored up to virtual
size.

Unfortunately, it can't deal with the range which wraps around the end of
fake_storep.  A wrap around range is copied by two
sg_copy_{from,to}_buffer() calls, but sg_copy_{from,to}_buffer() can't
copy from/to in the middle of SG list, therefore the second call can't
copy correctly.

This fixes it by using sg_pcopy_{from,to}_buffer() that can copy from/to
the middle of SG list.

This also simplifies the assignment of sdb->resid in
fill_from_dev_buffer().  Because fill_from_dev_buffer() is now only called
once per command execution cycle.  So it is not necessary to take care to
decrease sdb->resid if fill_from_dev_buffer() is called more than once.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: "James E.J. Bottomley" <JBottomley@parallels.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Horia Geanta <horia.geanta@freescale.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

In order to reduce code duplication between prot_verify_read() and
prot_verify_write(), this moves common code into the new functions.

[jejb: fix unitialised variable warning]
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Acked-by: N"Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

dif_storep is declared as pointer to unsigned char type.  But it is
actually used to store vmalloced array of struct sd_dif_tuple.

This changes the type of dif_storep to the pointer to struct sd_dif_tuple.
It simplifies offset calculation for dif_storep and enables to remove
hardcoded size of struct sd_dif_tuple.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Acked-by: N"Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

When UNMAP command is issued with the data integrity support enabled,
the protection info for the unmapped region is remain unchanged.
So READ command for the region later on causes data integrity failure.

This fixes it by invalidating protection info for the unmapped region
by filling with 0xff pattern.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Acked-by: N"Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The protection info dif_storep is allocated only when parameter dif is
not zero.  But it will be accessed when reading or writing to the storage
installed with parameter dix is not zero.

So kernel crashes if scsi_debug module is loaded with parameters dix=1 and
dif=0.

This fixes it by making dif_storep available if parameter dix is not zero
instead of checking if parameter dif is not zero.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Acked-by: N"Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

In the function prot_verify_write(), kmap_atomic()/kunmap_atomic() for
data page and kmap_atomic()/kunmap_atomic() for protection information
page are not nested each other.

It worked perfectly before commit 3e4d3af5
("mm: stack based kmap_atomic()").  Because the kmap_atomic slot KM_IRQ0
was used for data page and the slot KM_IRQ1 was used for protection page.

But KM_types are gone and kmap_atomic() is using stack based implementation.
So two different kmap_atomic() usages must be strictly nested now.

This change ensures kmap_atomic() usage is strictly nested.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Acked-by: N"Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

In the function prot_verify_write(), the kmap address 'daddr' is
incremented in the loop for each data page.  Finally 'daddr' reaches
the next page boundary in the end of the loop, and the invalid address
is passed to kunmap_atomic().

Fix the issue by not incrementing 'daddr' in the loop and offsetting it
by the loop counter on demand.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Acked-by: N"Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

provisioning map (map_storep) is a bitmap accessed by bitops.

So the allocation size should be a multiple of sizeof(unsigned long) and
also the bitmap should be cleared by using bitmap_clear() instead of
memset().

Otherwise it will cause problem on big-endian architecture if the number of
bits is not a multiple of BITS_PER_LONG.

I tried testing the logical block provisioning support in scsi_debug,
but it didn't work as I expected.

For example, load scsi_debug module with UNMAP command supported
and fill the storage with random data.

        # modprobe scsi_debug lbpu=1
        # dd if=/dev/urandom of=/dev/sdb

Then, try to unmap LBA 0, but Get LBA status reports:

        # sg_unmap --lba=0 --num=1 /dev/sdb
        # sg_get_lba_status --lba=0 /dev/sdb
        descriptor LBA: 0x0000000000000000  blocks: 16384  mapped

This is unexpected result.  Because UNMAP command to LBA 0 finished
without any errors, but Get LBA status shows that LBA 0 is still mapped.

This problem is due to the wrong translation between LBA and index of
provisioning map.  Fix it by using correct translation functions.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The function unmap_region() clears memory region specified as the logical
block address and the number of logical blocks in ramdisk storage
(fake_storep) if lbpu and lbprz module parameters are enabled.

In the while loop of unmap_region(), it advances optimal unmap granularity
in logical blocks.  But it only clears one logical block at LBA 'block' per
loop iteration.  And furthermore, the 'block' is not pointing to a logical
block address which should be cleared, it is a index of probisioning map
(map_storep).
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

scsi_debug prohibits setting scsi_debug_unmap_alignment to be greater
than scsi_debug_unmap_granularity.  But setting them to be the same value
is not prohibited.  In this case, the only difference with
scsi_debug_unmap_alignment == 0 is the logical blocks from 0 to
scsi_debug_unmap_alignment - 1 cannot be unmapped.  But the difference is
not properly handled in the current code.

So this prohibits such unusual setting.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

If the logical block provisioning is not enabled, map_region() and
unmap_region() have no effect and they don't need to be called.

So this makes map_region() and unmap_region() to be called only
when scsi_debug_lbp() returns true, i.e. logical block provisioning is
enabled.

While I'm at it, this also removes meaningless non-zero check for
scsi_debug_unmap_granularity.

Because scsi_debug_unmap_granularity cannot be zero with usual setting:
scsi_debug_unmap_granularity is 1 by default, and it can be changed to
zero with explicit module parameter setting only when the logical block
provisioning is disabled.  But it is only meaningful module parameter
when the logical block provisioning is enabled.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Acked-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Currently it is possible to unmap one more block than user requested to
due to the off-by-one error in unmap_region(). This is probably due to
the fact that the end variable despite its name actually points to the
last block to unmap + 1. However in the condition it is handled as the
last block of the region to unmap.

The bug was not previously spotted probably due to the fact that the
region was not zeroed, which has changed with commit
be1dd78d. With that commit we were able
to corrupt the ext4 file system on 256M scsi_debug device with LBPRZ
enabled using fstrim.

Since the 'end' semantic is the same in several functions there this
commit just fixes the condition to use the 'end' variable correctly in
that context.
Reported-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NLukas Czerner <lczerner@redhat.com>
Reviewed-by: NMartin K. Petersen <martin.petersen@oracle.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Add "removable" module parameter to set the "removable" attribute of any
subsequently created debug block device. It is a writable driver option, so
that you can switch between removable and "fixed" media block devices in
between the add_host calls.

This is useful for being able to test the different behaviour/required
privileges in e. g. the udisks test suite.
Signed-off-by: NMartin Pitt <martin.pitt@ubuntu.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The page length for the 0xb2 VPD page is defined to be 4 bytes when no
provisioning descriptors are provided (DP=0).
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Add LBPRZ support to scsi_debug; i.e. read zeros for
unmapped blocks.

Rather than checking for unmapped blocks at
read time, this just zeroes them on the backing store
at unmap time so it behaves the same way.

This also adds a module parameter to disable it.

lbprz, "unmapped blocks return 0 on read (def=1)"

[jejb: fix whitespace errors]
Signed-off-by: NEric Sandeen <sandeen@redhat.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Signed-off-by: NCong Wang <amwang@redhat.com>

We have experienced several devices which fail in a fashion we do not
currently handle gracefully in SCSI. After a failure these devices will
respond to the SCSI primary command set (INQUIRY, TEST UNIT READY, etc.)
but any command accessing the storage medium will time out.

The following patch adds an callback that can be used by upper level
drivers to inspect the results of an error handling command. This in
turn has been used to implement additional checking in the SCSI disk
driver.

If a medium access command fails twice but TEST UNIT READY succeeds both
times in the subsequent error handling we will offline the device. The
maximum number of failed commands required to take a device offline can
be tweaked in sysfs.

Also add a new error flag to scsi_debug which allows this scenario to be
easily reproduced.

[jejb: fix up integer parsing to use kstrtouint]
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

The SCSI GET LBA STATUS command was introduced in SBC-3 revision
20 in September 2009. At that time the Parameter Data Length
field in the response had an associated byte offset of 8.

Then in SBC-3 revision 25 (October 2010) that byte offset was
changed to 4. The sg_get_lba_status utility in sg3_utils version
1.33 (released earlier today) has been changed to calculate
the newer response length. However the implementation of
GET LBA STATUS command in the scsi_debug driver still uses the
original byte offset.

modify the Parameter Data Length field value in the GET LBA STATUS command
response to comply with the change in SBC-3 revision 25
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Fixes generated by 'codespell' and manually reviewed.
Signed-off-by: NLucas De Marchi <lucas.demarchi@profusion.mobi>

A useful test case for error recovery is multiple,
consecutive medium errors. When scsi_debug is started
with "opts=2" a MEDIUM ERROR is generated when block
0x1234 (4660) is read. The patch extends that to
10 consecutive blocks from 0x1234 (i.e. blocks 4660 to
4669 inclusive).

[0:0:0:0]  disk  ATA    INTEL SSD  2CV1 /dev/sda /dev/sg0 80.0GB
[10:0:0:0] disk  Linux  scsi_debug 0004 /dev/sdb /dev/sg1 1.09TB

Output file not specified so no copy, just reading input
 >> unrecovered read error at blk=4660, substitute zeros
...
 >> unrecovered read error at blk=4669, substitute zeros
4670+10 records in
0+0 records out
10 unrecovered read errors
lowest unrecovered read lba=4660, highest unrecovered lba=4669
time to read data: 0.047943 secs at 49.87 MB/sec

BTW Change /dev/sg1 (bsg device works just as well) to
/dev/sdb to see why, with faulty media, you do not want
to use the block layer interface. Reason: time block
layer takes to do useless retries and collateral damage
to data in its 4 KB blocks (O_DIRECT mitigates the
latter).

ChangeLog:
    - extend opts=2 medium error generation at block
      0x1234 to 10 consecutive blocks (i.e. blocks
      0x1234 to 0x123d).
Signed-off-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Update scsi_debug to support the Logical Block Provisioning commands and
bits as defined in SBC3r26. The old tp* parameters have been
transitioned to the new lbp* scheme found in the draft standard.

The old tpu option to enable UNMAP is now called lbpu. tpws to signal
support for WRITE SAME(16) with the UNMAP bit set is now lbpws. Support
for WRITE SAME(10) with the UNMAP bit set is also available using the
lpuws10 parameter.

Limiting the maximum number of blocks per WRITE SAME command has been
implemented and is available via the write_same_length module parameter.

As part of the renaming process the parameter lists have been sorted
alphabetically (request from Doug).
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

If I create a scsi_debug device that is larger than 4GB, the multiplication of
(block * scsi_debug_sector_size) can produce a 64-bit value.  Unfortunately,
the compiler sees two 32-bit quantities and performs a 32-bit multiplication,
thus truncating the bits above 2^32.  This causes the wrong memory location to
be read or written.  Change block and rest to be unsigned long long.
Signed-off-by: NDarrick J. Wong <djwong@us.ibm.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

set resid to the requested data-in length when a MEDIUM ERROR is
simulated. This implies no valid data is returned in the data-in
buffer
Signed-off-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

Move the mid-layer's ->queuecommand() invocation from being locked
with the host lock to being unlocked to facilitate speeding up the
critical path for drivers who don't need this lock taken anyway.

The patch below presents a simple SCSI host lock push-down as an
equivalent transformation.  No locking or other behavior should change
with this patch.  All existing bugs and locking orders are preserved.

Additionally, add one parameter to queuecommand,
	struct Scsi_Host *
and remove one parameter from queuecommand,
	void (*done)(struct scsi_cmnd *)

Scsi_Host* is a convenient pointer that most host drivers need anyway,
and 'done' is redundant to struct scsi_cmnd->scsi_done.

Minimal code disturbance was attempted with this change.  Most drivers
needed only two one-line modifications for their host lock push-down.
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>
Acked-by: NJames Bottomley <James.Bottomley@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch updates the scsi_debug virtual LLD to use
root_device_register() and root_device_unregister() from
include/linux/device.h instead of device_register() and
device_unregister() respectively within scsi_debug_init() and
scsi_debug_exit() This simply involved converting the static struct
device pseudo_primary into a pointer that is setup by the call to
root_device_register().

This patch also contains the correct IS_ERR() conditional check of
root_device_register() from within scsi_debug_init().

Thanks to Richard Sharpe and Dmitry Torokhov for their help with this
item.
Signed-off-by: NNicholas A. Bellinger <nab@linux-iscsi.org>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

The previous thin provisioning support was not very user friendly
because it depended on all the relevant options being set on the command
line.

Implement support for the Thin Provisioning VPD page from SBC3 r24 and
add module options for TPU (UNMAP) and TPWS (WRITE SAME (16) with UNMAP
bit).  This allows us to have sane default and to enable thin
provisioning with a simple tpu=1 or tpws=1 on the command line depending
on whether we want UNMAP or WRITE SAME behavior.
Signed-off-by: NMartin K. Petersen <martin.petersen@oracle.com>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

map_region and unmap_region could access to invalid memory area since
they don't check the size boundary.
Signed-off-by: NFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: NDouglas Gilbert <dgilbert@interlog.com>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>

In the scsi_debug driver, the virtual_gb option ignores the
sector_size, implicitly assuming that is 512 bytes.  So if
'virtual_gb=1 sector_size=4096' the result is an 8 GB (virtual) disk.
Signed-off-by: NDouglas Gilbert <dgilbert@interlog.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: NJames Bottomley <James.Bottomley@suse.de>