[PATCH 0/7] scsi: Fix transfer length 0 for 6-byte r/w commands

[PATCH 0/7] scsi: Fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

But some drivers consider transfer length 0 as 0 block.
Fortunately, the scsi disk driver sets up 10-byte r/w commands for
256 blocks of data instead of 6-byte r/w commands.  So this could be
an issue when SCSI commands are issued by SG_IO ioctl.

Akinobu Mita (7):
  hpsa: fix transfer length 0 for 6-byte r/w commands
  3w-xxxx: fix transfer length 0 for 6-byte r/w commands
  3w-9xxx: fix transfer length 0 for 6-byte r/w commands
  scsi: trace: fix transfer length 0 for 6-byte r/w commands
  staging: rts5208: fix transfer length 0 for 6-byte r/w commands
  megaraid_mbox: fix transfer length 0 for 6-byte r/w commands
  megaraid: fix transfer length 0 for 6-byte r/w commands

 drivers/scsi/3w-9xxx.c                | 5 ++++-
 drivers/scsi/3w-xxxx.c                | 2 ++
 drivers/scsi/hpsa.c                   | 2 ++
 drivers/scsi/megaraid.c               | 2 ++
 drivers/scsi/megaraid/megaraid_mbox.c | 2 ++
 drivers/scsi/scsi_trace.c             | 2 ++
 drivers/staging/rts5208/rtsx_scsi.c   | 8 ++++++--
 7 files changed, 20 insertions(+), 3 deletions(-)

Cc: Don Brace <don.brace@pmcs.com>
Cc: iss_storagedev@hp.com
Cc: storagedev@pmcs.com
Cc: Adam Radford <linuxraid@lsi.com>
Cc: Kashyap Desai <kashyap.desai@avagotech.com>
Cc: Sumit Saxena <sumit.saxena@avagotech.com>
Cc: Uday Lingala <uday.lingala@avagotech.com>
Cc: megaraidlinux.pdl@avagotech.com
Cc: "James E.J. Bottomley" <JBottomley@odin.com>
Cc: linux-scsi@vger.kernel.org
-- 
1.9.1

[PATCH 1/7] hpsa: fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Don Brace <don.brace@pmcs.com>
Cc: iss_storagedev@hp.com
Cc: storagedev@pmcs.com
Cc: linux-scsi@vger.kernel.org
---
 drivers/scsi/hpsa.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 8895bc9..f1d667c 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -3326,6 +3326,8 @@ static int fixup_ioaccel_cdb(u8 *cdb, int *cdb_len)
 		if (*cdb_len == 6) {
 			block = (((u32) cdb[2]) << 8) | cdb[3];
 			block_cnt = cdb[4];
+			if (block_cnt == 0)
+				block_cnt = 256;
 		} else {
 			BUG_ON(*cdb_len != 12);
 			block = (((u32) cdb[2]) << 24) |
-- 
1.9.1

[PATCH 2/7] 3w-xxxx: fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Adam Radford <linuxraid@lsi.com>
Cc: linux-scsi@vger.kernel.org
---
 drivers/scsi/3w-xxxx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index 2940bd7..e836aee 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -1727,6 +1727,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
 	if (srb->cmnd[0] == READ_6 || srb->cmnd[0] == WRITE_6) {
 		lba = ((u32)srb->cmnd[1] << 16) | ((u32)srb->cmnd[2] << 8) | (u32)srb->cmnd[3];
 		num_sectors = (u32)srb->cmnd[4];
+		if (num_sectors == 0)
+			num_sectors = 256;
 	} else {
 		lba = ((u32)srb->cmnd[2] << 24) | ((u32)srb->cmnd[3] << 16) | ((u32)srb->cmnd[4] << 8) | (u32)srb->cmnd[5];
 		num_sectors = (u32)srb->cmnd[8] | ((u32)srb->cmnd[7] << 8);
-- 
1.9.1

[PATCH 3/7] 3w-9xxx: fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Adam Radford <linuxraid@lsi.com>
Cc: linux-scsi@vger.kernel.org
---
 drivers/scsi/3w-9xxx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index add419d..71ddb7f 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1870,8 +1870,11 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
 	}
 
 	if (srb) {
-		if (srb->cmnd[0] == READ_6 || srb->cmnd[0] == WRITE_6)
+		if (srb->cmnd[0] == READ_6 || srb->cmnd[0] == WRITE_6) {
 			num_sectors = (u32)srb->cmnd[4];
+			if (num_sectors == 0)
+				num_sectors = 256;
+		}
 
 		if (srb->cmnd[0] == READ_10 || srb->cmnd[0] == WRITE_10)
 			num_sectors = (u32)srb->cmnd[8] | ((u32)srb->cmnd[7] << 8);
-- 
1.9.1

[PATCH 4/7] scsi: trace: fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: linux-scsi@vger.kernel.org
---
 drivers/scsi/scsi_trace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c
index 08bb47b..104e817 100644
--- a/drivers/scsi/scsi_trace.c
+++ b/drivers/scsi/scsi_trace.c
@@ -35,6 +35,8 @@ scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len)
 	lba |=  (cdb[2] << 8);
 	lba |=   cdb[3];
 	txlen = cdb[4];
+	if (txlen == 0)
+		txlen = 256;
 
 	trace_seq_printf(p, "lba=%llu txlen=%llu",
 			 (unsigned long long)lba, (unsigned long long)txlen);
-- 
1.9.1

[PATCH 5/7] staging: rts5208: fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Micky Ching <micky_ching@realsil.com.cn>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-scsi@vger.kernel.org
---
 drivers/staging/rts5208/rtsx_scsi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
index 8a5d6a8..60871f3 100644
--- a/drivers/staging/rts5208/rtsx_scsi.c
+++ b/drivers/staging/rts5208/rtsx_scsi.c
@@ -915,6 +915,8 @@ static int read_write(struct scsi_cmnd *srb, struct rtsx_chip *chip)
 		start_sec = ((u32)(srb->cmnd[1] & 0x1F) << 16) |
 			((u32)srb->cmnd[2] << 8) | ((u32)srb->cmnd[3]);
 		sec_cnt = srb->cmnd[4];
+		if (sec_cnt == 0)
+			sec_cnt = 256;
 	} else if ((srb->cmnd[0] == VENDOR_CMND) &&
 		(srb->cmnd[1] == SCSI_APP_CMD) &&
 		((srb->cmnd[2] == PP_READ10) || (srb->cmnd[2] == PP_WRITE10))) {
@@ -2904,9 +2906,11 @@ void led_shine(struct scsi_cmnd *srb, struct rtsx_chip *chip)
 
 	if ((srb->cmnd[0] == READ_10) || (srb->cmnd[0] == WRITE_10))
 		sec_cnt = ((u16)(srb->cmnd[7]) << 8) | srb->cmnd[8];
-	else if ((srb->cmnd[0] == READ_6) || (srb->cmnd[0] == WRITE_6))
+	else if ((srb->cmnd[0] == READ_6) || (srb->cmnd[0] == WRITE_6)) {
 		sec_cnt = srb->cmnd[4];
-	else
+		if (sec_cnt == 0)
+			sec_cnt = 256;
+	} else
 		return;
 
 	if (chip->rw_cap[lun] >= GPIO_TOGGLE_THRESHOLD) {
-- 
1.9.1

[PATCH 6/7] megaraid_mbox: fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Kashyap Desai <kashyap.desai@avagotech.com>
Cc: Sumit Saxena <sumit.saxena@avagotech.com>
Cc: Uday Lingala <uday.lingala@avagotech.com>
Cc: megaraidlinux.pdl@avagotech.com
Cc: linux-scsi@vger.kernel.org
---
 drivers/scsi/megaraid/megaraid_mbox.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index f0987f2..bed00d4 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -1691,6 +1691,8 @@ megaraid_mbox_build_cmd(adapter_t *adapter, struct scsi_cmnd *scp, int *busy)
 			 */
 			if (scp->cmd_len == 6) {
 				mbox->numsectors = (uint32_t)scp->cmnd[4];
+				if (mbox->numsectors == 0)
+					mbox->numsectors = 256;
 				mbox->lba =
 					((uint32_t)scp->cmnd[1] << 16)	|
 					((uint32_t)scp->cmnd[2] << 8)	|
-- 
1.9.1

[PATCH 7/7] megaraid: fix transfer length 0 for 6-byte r/w commands

[Akinobu Mita]

For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
not 0 block.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Kashyap Desai <kashyap.desai@avagotech.com>
Cc: Sumit Saxena <sumit.saxena@avagotech.com>
Cc: Uday Lingala <uday.lingala@avagotech.com>
Cc: megaraidlinux.pdl@avagotech.com
Cc: linux-scsi@vger.kernel.org
---
 drivers/scsi/megaraid.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index bc7b34c..509aead 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -759,6 +759,8 @@ mega_build_cmd(adapter_t *adapter, Scsi_Cmnd *cmd, int *busy)
 			 */
 			if( cmd->cmd_len == 6 ) {
 				mbox->m_out.numsectors = (u32) cmd->cmnd[4];
+				if (mbox->m_out.numsectors == 0)
+					mbox->m_out.numsectors = 256;
 				mbox->m_out.lba =
 					((u32)cmd->cmnd[1] << 16) |
 					((u32)cmd->cmnd[2] << 8) |
-- 
1.9.1

Re: [PATCH 0/7] scsi: Fix transfer length 0 for 6-byte r/w commands

[James Bottomley]

On Sat, 2015-05-16 at 16:17 +0900, Akinobu Mita wrote:
> For 6-byte r/w commands, transfer length 0 means 256 blocks of data,
> not 0 block.
> 
> But some drivers consider transfer length 0 as 0 block.
> Fortunately, the scsi disk driver sets up 10-byte r/w commands for
> 256 blocks of data instead of 6-byte r/w commands.  So this could be
> an issue when SCSI commands are issued by SG_IO ioctl.

6-byte commands are obsolete, so there's not a lot of point in doing
this; however, in the early days of SCSI, there was considerable
confusion about what 0 transfer length meant (I think it wasn't until
SCSI-2 that it was clarified).  Even today, USB drive manufacturers have
considerable difficulty with it, that's why the sd driver avoids it, as
would any sensible program doing sg_io.

James