From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
To: peter.maydell@linaro.org, qemu-devel@nongnu.org
Subject: [PULL 12/13] esp: ensure that do_cmd is set to zero before submitting an ESP select command
Date: Mon, 12 Apr 2021 23:20:47 +0100 [thread overview]
Message-ID: <20210412222048.22818-13-mark.cave-ayland@ilande.co.uk> (raw)
In-Reply-To: <20210412222048.22818-1-mark.cave-ayland@ilande.co.uk>
When a CDB has been received and is about to be submitted to the SCSI layer
via one of the ESP select commands, ensure that do_cmd is set to zero before
executing the command.
Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI
.transfer_data callback again before do_cmd is set to zero by the callback
function triggering an assert at the start of esp_transfer_data().
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
---
hw/scsi/esp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 0037197bdb..b668acef82 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -357,6 +357,7 @@ static void handle_satn(ESPState *s)
cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
if (cmdlen > 0) {
s->cmdfifo_cdb_offset = 1;
+ s->do_cmd = 0;
do_cmd(s);
} else if (cmdlen == 0) {
s->do_cmd = 1;
@@ -390,6 +391,7 @@ static void handle_s_without_atn(ESPState *s)
cmdlen = get_cmd(s, ESP_CMDFIFO_SZ);
if (cmdlen > 0) {
s->cmdfifo_cdb_offset = 0;
+ s->do_cmd = 0;
do_busid_cmd(s, 0);
} else if (cmdlen == 0) {
s->do_cmd = 1;
--
2.20.1
next prev parent reply other threads:[~2021-04-12 22:41 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-12 22:20 [PULL 00/13] qemu-sparc queue 20210412 Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 01/13] esp: fix setting of ESPState mig_version_id when launching QEMU with -S option Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 02/13] esp: always check current_req is not NULL before use in DMA callbacks Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 03/13] esp: rework write_response() to avoid using the FIFO for DMA transactions Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 04/13] esp: consolidate esp_cmdfifo_push() into esp_fifo_push() Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 05/13] esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop() Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 06/13] esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf() Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 07/13] esp: ensure cmdfifo is not empty and current_dev is non-NULL Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 08/13] esp: don't underflow cmdfifo in do_cmd() Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 09/13] esp: don't overflow cmdfifo in get_cmd() Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 10/13] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size Mark Cave-Ayland
2021-04-12 22:20 ` [PULL 11/13] esp: don't reset async_len directly in esp_select() if cancelling request Mark Cave-Ayland
2021-04-12 22:20 ` Mark Cave-Ayland [this message]
2021-04-12 22:20 ` [PULL 13/13] tests/qtest: add tests for am53c974 device Mark Cave-Ayland
2021-04-13 12:04 ` [PULL 00/13] qemu-sparc queue 20210412 Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210412222048.22818-13-mark.cave-ayland@ilande.co.uk \
--to=mark.cave-ayland@ilande.co.uk \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.