[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 18/21] scsi-disk: add data direction checking
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PATCH v2 18/21] scsi-disk: add data direction checking |
Date: |
Mon, 16 May 2011 14:16:34 +0200 |
From: Hannes Reinecke <address@hidden>
scsi_req_parse() already provides for a data direction setting,
so we should be using it to check for correct direction.
And we should return the sense code 'INVALID FIELD IN CDB'
in these cases.
Signed-off-by: Hannes Reinecke <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/scsi-disk.c | 37 +++++++++++++++++++++++++------------
1 files changed, 25 insertions(+), 12 deletions(-)
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 4241fad..65744c7 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -49,10 +49,8 @@ do { fprintf(stderr, "scsi-disk: " fmt , ## __VA_ARGS__); }
while (0)
typedef struct SCSIDiskState SCSIDiskState;
-typedef struct SCSIDiskReq {
+ typedef struct SCSIDiskReq {
SCSIRequest req;
- /* ??? We should probably keep track of whether the data transfer is
- a read or a write. Currently we rely on the host getting it right. */
/* Both sector and sector_count are in terms of qemu 512 byte blocks. */
uint64_t sector;
uint32_t sector_count;
@@ -178,6 +176,12 @@ static void scsi_read_data(SCSIRequest *req)
/* No data transfer may already be in progress */
assert(r->req.aiocb == NULL);
+ if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
+ DPRINTF("Data transfer direction invalid\n");
+ scsi_read_complete(r, -EINVAL);
+ return;
+ }
+
n = r->sector_count;
if (n > SCSI_DMA_BUF_SIZE / 512)
n = SCSI_DMA_BUF_SIZE / 512;
@@ -214,16 +218,22 @@ static int scsi_handle_rw_error(SCSIDiskReq *r, int
error, int type)
if (type == SCSI_REQ_STATUS_RETRY_READ) {
scsi_req_data(&r->req, 0);
}
- if (error == ENOMEM) {
+ switch (error) {
+ case ENOMEM:
scsi_command_complete(r, CHECK_CONDITION,
SENSE_CODE(TARGET_FAILURE));
- } else {
+ break;
+ case EINVAL:
+ scsi_command_complete(r, CHECK_CONDITION,
+ SENSE_CODE(INVALID_FIELD));
+ break;
+ default:
scsi_command_complete(r, CHECK_CONDITION,
SENSE_CODE(IO_ERROR));
+ break;
}
bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read);
}
-
return 1;
}
@@ -266,6 +276,12 @@ static int scsi_write_data(SCSIRequest *req)
/* No data transfer may already be in progress */
assert(r->req.aiocb == NULL);
+ if (r->req.cmd.mode != SCSI_XFER_TO_DEV) {
+ DPRINTF("Data transfer direction invalid\n");
+ scsi_write_complete(r, -EINVAL);
+ return 0;
+ }
+
n = r->iov.iov_len / 512;
if (n) {
qemu_iovec_init_external(&r->qiov, &r->iov, 1);
@@ -985,14 +1001,12 @@ static int32_t scsi_send_command(SCSIRequest *req,
uint8_t *buf)
SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);
SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
int32_t len;
- int is_write;
uint8_t command;
uint8_t *outbuf;
int rc;
command = buf[0];
outbuf = (uint8_t *)r->iov.iov_base;
- is_write = 0;
DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
if (scsi_req_parse(&r->req, buf) != 0) {
@@ -1072,7 +1086,6 @@ static int32_t scsi_send_command(SCSIRequest *req,
uint8_t *buf)
goto illegal_lba;
r->sector = r->req.cmd.lba * s->cluster_size;
r->sector_count = len * s->cluster_size;
- is_write = 1;
break;
case MODE_SELECT:
DPRINTF("Mode Select(6) (len %lu)\n", (long)r->req.cmd.xfer);
@@ -1138,13 +1151,13 @@ static int32_t scsi_send_command(SCSIRequest *req,
uint8_t *buf)
scsi_command_complete(r, GOOD, SENSE_CODE(NO_SENSE));
}
len = r->sector_count * 512 + r->iov.iov_len;
- if (is_write) {
- len = -len;
+ if (r->req.cmd.mode == SCSI_XFER_TO_DEV) {
+ return -len;
} else {
if (!r->sector_count)
r->sector_count = -1;
+ return len;
}
- return len;
}
static void scsi_disk_reset(DeviceState *dev)
--
1.7.4.4
- [Qemu-devel] [PATCH v2 09/21] scsi: introduce scsi_req_abort, (continued)
- [Qemu-devel] [PATCH v2 09/21] scsi: introduce scsi_req_abort, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 08/21] scsi: commonize purging requests, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 10/21] scsi: introduce scsi_req_cancel, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 11/21] scsi: use scsi_req_complete, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 12/21] scsi: Update sense code handling, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 13/21] scsi: do not call send_command directly, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 14/21] scsi: introduce scsi_req_new, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 16/21] scsi: introduce scsi_req_get_buf, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 15/21] scsi: introduce scsi_req_kick, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 17/21] scsi: Implement 'get_sense' callback, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 18/21] scsi-disk: add data direction checking,
Paolo Bonzini <=
- [Qemu-devel] [PATCH v2 19/21] scsi: make write_data return void, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 20/21] scsi-generic: Handle queue full, Paolo Bonzini, 2011/05/16
- [Qemu-devel] [PATCH v2 21/21] scsi: split command_complete callback in two, Paolo Bonzini, 2011/05/16