Patchwork [4/5] virtio-scsi: Fix some endian bugs with virtio-scsi

mail settings
Submitter Paolo Bonzini
Date Nov. 28, 2012, 3:21 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/202478/
State New
Headers show


Paolo Bonzini - Nov. 28, 2012, 3:21 p.m.
From: David Gibson <>

The virtio-scsi specification does not specify the correct endianness for
fields in the request structure.  It's therefore best to assume that it is
"guest native" endian since that's the (stupid and poorly defined) norm in

However, the qemu device for virtio-scsi has no byteswaps at all, and so
will break if the guest has different endianness from the host.  This patch
fixes it by adding tswap() calls for the sense_len and resid fields in
the request structure.  In theory status_qualifier needs swaps as well,
but that field is never actually touched.  The tag field is a uint64_t, but
since its value is completely arbitrary, it might as well be uint8_t[8]
and so it does not need swapping.

Cc: Paolo Bonzini <>
Cc: Paul 'Rusty' Russell <>
Signed-off-by: David Gibson <>
Signed-off-by: Paolo Bonzini <>
 hw/virtio-scsi.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)


diff --git a/hw/virtio-scsi.c b/hw/virtio-scsi.c
index 7d546f6..924fc69 100644
--- a/hw/virtio-scsi.c
+++ b/hw/virtio-scsi.c
@@ -424,15 +424,17 @@  static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,
                                          size_t resid)
     VirtIOSCSIReq *req = r->hba_private;
+    uint32_t sense_len;
     req->resp.cmd->response = VIRTIO_SCSI_S_OK;
     req->resp.cmd->status = status;
     if (req->resp.cmd->status == GOOD) {
-        req->resp.cmd->resid = resid;
+        req->resp.cmd->resid = tswap32(resid);
     } else {
         req->resp.cmd->resid = 0;
-        req->resp.cmd->sense_len =
-            scsi_req_get_sense(r, req->resp.cmd->sense, VIRTIO_SCSI_SENSE_SIZE);
+        sense_len = scsi_req_get_sense(r, req->resp.cmd->sense,
+                                       VIRTIO_SCSI_SENSE_SIZE);
+        req->resp.cmd->sense_len = tswap32(sense_len);