From patchwork Tue May 17 11:01:04 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 95923 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 30132B6EEE for ; Tue, 17 May 2011 21:10:35 +1000 (EST) Received: from localhost ([::1]:43036 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QMIAa-0001CM-8l for incoming@patchwork.ozlabs.org; Tue, 17 May 2011 07:10:32 -0400 Received: from eggs.gnu.org ([140.186.70.92]:44462) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QMI3P-0005xR-S9 for qemu-devel@nongnu.org; Tue, 17 May 2011 07:04:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QMI2Z-00054e-2C for qemu-devel@nongnu.org; Tue, 17 May 2011 07:03:07 -0400 Received: from mail-iy0-f173.google.com ([209.85.210.173]:62390) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QMI2Y-0004zX-Uy for qemu-devel@nongnu.org; Tue, 17 May 2011 07:02:15 -0400 Received: by mail-iy0-f173.google.com with SMTP id 10so365615iym.4 for ; Tue, 17 May 2011 04:02:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:from:to:cc:subject:date:message-id :x-mailer:in-reply-to:references; bh=VZrecIGN8ROEKhu20NG4RVXEC5KQCizwXxQh8nNE2EE=; b=iElhlReGFABPVlDWhseanJofZJsBE6vn/jhoIhjz8bHjlPYsIvrb0KH8RXtykPnMeM 7A/ErxX51Crcrs2SVUhXaUXW5KQ2AkATcKVQwaip7ntxBINosdEIBcHbh6Fbx+zhrDDq WF3Vxl7gxcowPDvhB/6VsCGtIo/gNsf32bokg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:from:to:cc:subject:date:message-id:x-mailer:in-reply-to :references; b=GpbeAKC7/TRutI1lvRmResumA3luZGVAvwUglZVb/RyHBZKHaxvdpAjt/9bcjkcQJA RuPje4elPOFPm7N7zpLJd6wAfFiyRE3kWbk/oxjAig/9ITc1QIOomg/tRhMyCIE/dsQh sRA1qLQI08Tv6qAZMTM/sBt9jFBGMPKTXifes= Received: by 10.42.134.67 with SMTP id k3mr442601ict.478.1305630134684; Tue, 17 May 2011 04:02:14 -0700 (PDT) Received: from localhost.localdomain (93-34-184-88.ip51.fastwebnet.it [93.34.184.88]) by mx.google.com with ESMTPS id c16sm211390ibe.41.2011.05.17.04.02.12 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 17 May 2011 04:02:13 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Tue, 17 May 2011 13:01:04 +0200 Message-Id: <1305630067-2119-19-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.7.4.4 In-Reply-To: <1305630067-2119-1-git-send-email-pbonzini@redhat.com> References: <1305630067-2119-1-git-send-email-pbonzini@redhat.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-Received-From: 209.85.210.173 Cc: Hannes Reinecke Subject: [Qemu-devel] [PATCH v3 18/21] scsi-disk: add data direction checking X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Hannes Reinecke scsi_req_parse() already provides for a data direction setting, so we should be using it to check for correct direction. And we should return the sense code 'INVALID FIELD IN CDB' in these cases. Signed-off-by: Hannes Reinecke Signed-off-by: Paolo Bonzini Reviewed-by: Christoph Hellwig --- hw/scsi-disk.c | 37 +++++++++++++++++++++++++------------ 1 files changed, 25 insertions(+), 12 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index 4241fad..65744c7 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -49,10 +49,8 @@ do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); } while (0) typedef struct SCSIDiskState SCSIDiskState; -typedef struct SCSIDiskReq { + typedef struct SCSIDiskReq { SCSIRequest req; - /* ??? We should probably keep track of whether the data transfer is - a read or a write. Currently we rely on the host getting it right. */ /* Both sector and sector_count are in terms of qemu 512 byte blocks. */ uint64_t sector; uint32_t sector_count; @@ -178,6 +176,12 @@ static void scsi_read_data(SCSIRequest *req) /* No data transfer may already be in progress */ assert(r->req.aiocb == NULL); + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) { + DPRINTF("Data transfer direction invalid\n"); + scsi_read_complete(r, -EINVAL); + return; + } + n = r->sector_count; if (n > SCSI_DMA_BUF_SIZE / 512) n = SCSI_DMA_BUF_SIZE / 512; @@ -214,16 +218,22 @@ static int scsi_handle_rw_error(SCSIDiskReq *r, int error, int type) if (type == SCSI_REQ_STATUS_RETRY_READ) { scsi_req_data(&r->req, 0); } - if (error == ENOMEM) { + switch (error) { + case ENOMEM: scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(TARGET_FAILURE)); - } else { + break; + case EINVAL: + scsi_command_complete(r, CHECK_CONDITION, + SENSE_CODE(INVALID_FIELD)); + break; + default: scsi_command_complete(r, CHECK_CONDITION, SENSE_CODE(IO_ERROR)); + break; } bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read); } - return 1; } @@ -266,6 +276,12 @@ static int scsi_write_data(SCSIRequest *req) /* No data transfer may already be in progress */ assert(r->req.aiocb == NULL); + if (r->req.cmd.mode != SCSI_XFER_TO_DEV) { + DPRINTF("Data transfer direction invalid\n"); + scsi_write_complete(r, -EINVAL); + return 0; + } + n = r->iov.iov_len / 512; if (n) { qemu_iovec_init_external(&r->qiov, &r->iov, 1); @@ -985,14 +1001,12 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf) SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req); SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev); int32_t len; - int is_write; uint8_t command; uint8_t *outbuf; int rc; command = buf[0]; outbuf = (uint8_t *)r->iov.iov_base; - is_write = 0; DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]); if (scsi_req_parse(&r->req, buf) != 0) { @@ -1072,7 +1086,6 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf) goto illegal_lba; r->sector = r->req.cmd.lba * s->cluster_size; r->sector_count = len * s->cluster_size; - is_write = 1; break; case MODE_SELECT: DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer); @@ -1138,13 +1151,13 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf) scsi_command_complete(r, GOOD, SENSE_CODE(NO_SENSE)); } len = r->sector_count * 512 + r->iov.iov_len; - if (is_write) { - len = -len; + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) { + return -len; } else { if (!r->sector_count) r->sector_count = -1; + return len; } - return len; } static void scsi_disk_reset(DeviceState *dev)