From patchwork Thu Nov 18 14:47:32 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hannes Reinecke X-Patchwork-Id: 72107 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 98110B71A7 for ; Fri, 19 Nov 2010 01:57:52 +1100 (EST) Received: from localhost ([127.0.0.1]:33913 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PJ5ug-0006nl-JL for incoming@patchwork.ozlabs.org; Thu, 18 Nov 2010 09:56:38 -0500 Received: from [140.186.70.92] (port=35775 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PJ5ja-0001lx-Ti for qemu-devel@nongnu.org; Thu, 18 Nov 2010 09:45:12 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PJ5jZ-0001kQ-It for qemu-devel@nongnu.org; Thu, 18 Nov 2010 09:45:10 -0500 Received: from cantor2.suse.de ([195.135.220.15]:47123 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PJ5jZ-0001kH-AW for qemu-devel@nongnu.org; Thu, 18 Nov 2010 09:45:09 -0500 Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.221.2]) by mx2.suse.de (Postfix) with ESMTP id C753889994; Thu, 18 Nov 2010 15:45:08 +0100 (CET) Date: Thu, 18 Nov 2010 15:47:32 +0100 To: qemu-devel@nongnu.org User-Agent: Heirloom mailx 12.2 01/07/07 MIME-Version: 1.0 Message-Id: <20101118144732.99F4CF90AB@ochil.suse.de> From: hare@suse.de (Hannes Reinecke) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4-2.6 Cc: stefanha@gmail.com, nab@linux-iscsi.org, kraxel@redhat.com Subject: [Qemu-devel] [PATCH 11/16] scsi-disk: add data direction checking X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org scsi_req_parse() already provides for a data direction setting, so we should be using it to check for correct direction. Signed-off-by: Hannes Reinecke --- hw/scsi-disk.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index fa7b29f..1541524 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -51,8 +51,6 @@ typedef struct SCSIDiskState SCSIDiskState; typedef struct SCSIDiskReq { SCSIRequest req; - /* ??? We should probably keep track of whether the data transfer is - a read or a write. Currently we rely on the host getting it right. */ /* Both sector and sector_count are in terms of qemu 512 byte blocks. */ uint64_t sector; uint32_t sector_count; @@ -182,6 +180,9 @@ static void scsi_read_data(SCSIRequest *req) /* No data transfer may already be in progress */ assert(r->req.aiocb == NULL); + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) + BADF("Data transfer direction invalid\n"); + if (r->sector_count == (uint32_t)-1) { DPRINTF("Read buf_len=%zd\n", r->iov[0].iov_len); r->sector_count = 0; @@ -294,6 +295,9 @@ static int scsi_write_data(SCSIRequest *req) /* No data transfer may already be in progress */ assert(r->req.aiocb == NULL); + if (r->req.cmd.mode != SCSI_XFER_TO_DEV) + BADF("Data transfer direction invalid\n"); + n = scsi_req_iov_len(r) / 512; if (n) { qemu_iovec_init_external(&r->qiov, r->iov, r->iov_num); @@ -980,11 +984,9 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf) SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req); SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev); ssize_t len = 0; - int is_write; uint8_t command; command = buf[0]; - is_write = 0; DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]); if (scsi_req_parse(&r->req, buf) != 0) { @@ -1067,7 +1069,6 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf) goto illegal_lba; } r->sector = r->req.cmd.lba * s->cluster_size; - is_write = 1; break; case MODE_SELECT: DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer); @@ -1108,7 +1109,7 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf) scsi_command_complete(r, GOOD, SENSE_CODE(NO_SENSE)); } len += r->sector_count * 512; - if (is_write) { + if (r->req.cmd.mode == SCSI_XFER_TO_DEV) { return -len; } else { if (!r->sector_count)