gwj / at91sam9263 · Commits

Commit 575750581c6ea70e89a7889cb6028f234f9d2ee9

Authored by balrog
1 parent 02b373ad

SCSI: Handle inquiry commands of varying length (Justin Chevrier). 

Openserver 5.0.5 sends an Inquiry command to the emulated SCSI disk
expecting a response length of 40 bytes. Currently the response to an
Inquiry command is hardcoded to 36 bytes. When receiving a response of
length 36 instead of 40 Openserver panics.

Modifications to original patch based on feedback from Ryan Harper and Paul
Brook. Thanks guys.

Signed-off-by: Justin Chevrier <address@hidden>
Signed-off-by: Andrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5903 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 8 additions and 3 deletions
hw/scsi-disk.c
  View file @5757505
... ... @@ -38,6 +38,7 @@ do { fprintf(stderr, &quot;scsi-disk: &quot; fmt , ##args); } while (0)
38 38 #define STATUS_CHECK_CONDITION 2
39 39  
40 40 #define SCSI_DMA_BUF_SIZE 131072
  41 +#define SCSI_MAX_INQUIRY_LEN 256
41 42  
42 43 typedef struct SCSIRequest {
43 44 SCSIDeviceState *dev;
... ... @@ -492,7 +493,11 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
492 493 "is less than 36 (TODO: only 5 required)\n", len);
493 494 }
494 495 }
495   - memset(outbuf, 0, 36);
  496 +
  497 + if(len > SCSI_MAX_INQUIRY_LEN)
  498 + len = SCSI_MAX_INQUIRY_LEN;
  499 +
  500 + memset(outbuf, 0, len);
496 501  
497 502 if (lun || buf[1] >> 5) {
498 503 outbuf[0] = 0x7f; /* LUN not supported */
... ... @@ -510,10 +515,10 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
510 515 Some later commands are also implemented. */
511 516 outbuf[2] = 3;
512 517 outbuf[3] = 2; /* Format 2 */
513   - outbuf[4] = 31;
  518 + outbuf[4] = len - 5; /* Additional Length = (Len - 1) - 4 */
514 519 /* Sync data transfer and TCQ. */
515 520 outbuf[7] = 0x10 | (s->tcq ? 0x02 : 0);
516   - r->buf_len = 36;
  521 + r->buf_len = len;
517 522 break;
518 523 case 0x16:
519 524 DPRINTF("Reserve(6)\n");
... ...