Patchwork spapr-vscsi: fix SOLNT bit in SRP_RSP

login
register
mail settings
Submitter Alexey Kardashevskiy
Date July 29, 2013, 4:48 a.m.
Message ID <1375073319-17488-1-git-send-email-aik@ozlabs.ru>
Download mbox | patch
Permalink /patch/262667/
State New
Headers show

Comments

Alexey Kardashevskiy - July 29, 2013, 4:48 a.m.
The driver calculates SOLNT bit from UCSOLNT and  SCSOLNT bits from
the request. The iu pointer has a type of srp_iu* which points to a union,
so cmd and rsp overlap. As the vscsi_send_rsp function calls
memset(iu, 0, sizeof(rsp)), it clears first 36 bytes of both cmd and rsp
so cmd.sol_not is always zero at the moment of calculating rsp.sol_not.

This fixes the bug.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---

Is that really trivial? I am not so sure but put qemu-trivial@ to copy :)

---

 hw/scsi/spapr_vscsi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
Anthony Liguori - July 29, 2013, 8:23 p.m.
Applied.  Thanks.

Regards,

Anthony Liguori

Patch

diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 55b44b9..541ffcc 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -217,6 +217,7 @@  static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     union viosrp_iu *iu = &req->iu;
     uint64_t tag = iu->srp.rsp.tag;
     int total_len = sizeof(iu->srp.rsp);
+    uint8_t sol_not = iu->srp.cmd.sol_not;
 
     dprintf("VSCSI: Sending resp status: 0x%x, "
             "res_in: %d, res_out: %d\n", status, res_in, res_out);
@@ -249,7 +250,7 @@  static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
     /* Handle success vs. failure */
     iu->srp.rsp.status = status;
     if (status) {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x04) >> 2;
+        iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2;
         if (req->senselen) {
             req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID;
             req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen);
@@ -257,7 +258,7 @@  static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req,
             total_len += req->senselen;
         }
     } else {
-        iu->srp.rsp.sol_not = (iu->srp.cmd.sol_not & 0x02) >> 1;
+        iu->srp.rsp.sol_not = (sol_not & 0x02) >> 1;
     }
 
     vscsi_send_iu(s, req, total_len, VIOSRP_SRP_FORMAT);