On Mon, Jan 23, 2012 at 12:47:54PM -0500, Paolo Bonzini wrote: > On 01/23/2012 06:15 PM, Thomas Higdon wrote: > > This prevents the emulated SCSI device from trying to DMA more bytes to the > > initiator than are expected. Without this, the SCRIPTS code in the emulated > > LSI > > device eventually raises a DMA interrupt for a data overrun when an INQUIRY > > command whose buflen exceeds req->cmd.xfer is processed. It's the > > responsibility of the client to provide a request buffer and allocation > > length that are large enough for the result of the command. > > > > I'm no expert on SCSI (or qemu), but this appears to be more correct > > behavior > > than before, and makes my SCSI INQUIRY commands more successful. > > Yes, this is correct. SCSI says "The device server shall terminate > transfers to the Data-In Buffer when the number of bytes or blocks > specified by the ALLOCATION LENGTH field have been transferred or when > all available data have been transferred, whichever is less". > > The same is already done for example for MODE SENSE commands. > > Can you please also do the same REPORT LUNS and INQUIRY in hw/scsi-bus.c?
You're talking about the scsi_target_emulate_report_luns() and scsi_target_emulate_inquiry() functions in hw/scsi-bus.c? By my read of the code, these appear safe. In both functions, I see len getting set via calls to MIN with r->req->cmd.xfer as one of the arguments. If you're referring to something else, can you be more specific?
