From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:55449) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UelxI-0004py-5r for qemu-devel@nongnu.org; Tue, 21 May 2013 08:46:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UelxD-00044o-8M for qemu-devel@nongnu.org; Tue, 21 May 2013 08:46:16 -0400 Received: from mail-ea0-x22d.google.com ([2a00:1450:4013:c01::22d]:55684) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UelxD-00044g-2Y for qemu-devel@nongnu.org; Tue, 21 May 2013 08:46:11 -0400 Received: by mail-ea0-f173.google.com with SMTP id n15so363910ead.18 for ; Tue, 21 May 2013 05:46:10 -0700 (PDT) Received: from playground.lan (net-37-116-223-193.cust.dsl.vodafone.it. [37.116.223.193]) by mx.google.com with ESMTPSA id m48sm3304809eeh.16.2013.05.21.05.46.08 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Tue, 21 May 2013 05:46:09 -0700 (PDT) Sender: Paolo Bonzini From: Paolo Bonzini Date: Tue, 21 May 2013 14:45:25 +0200 Message-Id: <1369140325-17924-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH scsi] scsi-generic: fix sign extension of READ CAPACITY(10) data List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Issuing the READ CAPACITY(10) command in the guest will cause QEMU to update its knowledge of the maximum accessible LBA in the disk. The recorded maximum LBA will be wrong if the disk is bigger than 1TB, because ldl_be_p returns a signed int. When this is fixed, a latent bug will be unmasked. If the READ CAPACITY(10) command reported an overflow (0xFFFFFFFF), we must not overwrite the previously-known maximum accessible LBA, or the guest will fail to access the disk above the first 2TB. Signed-off-by: Paolo Bonzini --- hw/scsi/scsi-generic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c index 2a9a561..19bd36c 100644 --- a/hw/scsi/scsi-generic.c +++ b/hw/scsi/scsi-generic.c @@ -198,9 +198,10 @@ static void scsi_read_complete(void * opaque, int ret) scsi_command_complete(r, 0); } else { /* Snoop READ CAPACITY output to set the blocksize. */ - if (r->req.cmd.buf[0] == READ_CAPACITY_10) { + if (r->req.cmd.buf[0] == READ_CAPACITY_10 && + (ldl_be_p(&r->buf[0]) != 0xffffffffU || s->max_lba == 0)) { s->blocksize = ldl_be_p(&r->buf[4]); - s->max_lba = ldl_be_p(&r->buf[0]); + s->max_lba = ldl_be_p(&r->buf[0]) & 0xffffffffULL; } else if (r->req.cmd.buf[0] == SERVICE_ACTION_IN_16 && (r->req.cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) { s->blocksize = ldl_be_p(&r->buf[8]); -- 1.8.1.4