linux-toradex.git/drivers/target/target_core_cdb.c, branch v3.2.33

target: Check number of unmap descriptors against our limit

2012-08-02T13:37:50+00:00

commit 7409a6657aebf8be74c21d0eded80709b27275cb upstream.

Fail UNMAP commands that have more than our reported limit on unmap
descriptors.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

target: Fix possible integer underflow in UNMAP emulation

2012-08-02T13:37:50+00:00

commit b7fc7f3777582dea85156a821d78a522a0c083aa upstream.

It's possible for an initiator to send us an UNMAP command with a
descriptor that is less than 8 bytes; in that case it's really bad for
us to set an unsigned int to that value, subtract 8 from it, and then
use that as a limit for our loop (since the value will wrap around to
a huge positive value).

Fix this by making size be signed and only looping if size >= 16 (ie
if we have at least a full descriptor available).

Also remove offset as an obfuscated name for the constant 8.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

target: Fix reading of data length fields for UNMAP commands

2012-08-02T13:37:49+00:00

commit 1a5fa4576ec8a462313c7516b31d7453481ddbe8 upstream.

The UNMAP DATA LENGTH and UNMAP BLOCK DESCRIPTOR DATA LENGTH fields
are in the unmap descriptor (the payload transferred to our data out
buffer), not in the CDB itself.  Read them from the correct place in
target_emulated_unmap.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

target: Add range checking to UNMAP emulation

2012-08-02T13:37:49+00:00

commit 2594e29865c291db162313187612cd9f14538f33 upstream.

When processing an UNMAP command, we need to make sure that the number
of blocks we're asked to UNMAP does not exceed our reported maximum
number of blocks per UNMAP, and that the range of blocks we're
unmapping doesn't go past the end of the device.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

target: Fix range calculation in WRITE SAME emulation when num blocks == 0

2012-07-25T03:11:25+00:00

commit 1765fe5edcb83f53fc67edeb559fcf4bc82c6460 upstream.

When NUMBER OF LOGICAL BLOCKS is 0, WRITE SAME is supposed to write
all the blocks from the specified LBA through the end of the device.
However, dev->transport->get_blocks(dev) (perhaps confusingly) returns
the last valid LBA rather than the number of blocks, so the correct
number of blocks to write starting with lba is

dev->transport->get_blocks(dev) - lba + 1

(nab: Backport roland's for-3.6 patch to for-3.5)

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Ben Hutchings

target: Don't set WBUS16 or SYNC bits in INQUIRY response

2012-04-02T16:52:47+00:00

commit effc6cc8828257c32c37635e737f14fd6e19ecd7 upstream.

SPC-4 says about the WBUS16 and SYNC bits:

    The meanings of these fields are specific to SPI-5 (see 6.4.3).
    For SCSI transport protocols other than the SCSI Parallel
    Interface, these fields are reserved.

We don't have a SPI fabric module, so we should never set these bits.
(The comment was misleading, since it only mentioned Sync but the
actual code set WBUS16 too).

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Allow control CDBs with data > 1 page

2012-03-01T00:31:09+00:00

commit 4949314c7283ea4f9ade182ca599583b89f7edd6 upstream.

We need to handle >1 page control cdbs, so extend the code to do a vmap
if bigger than 1 page. It seems like kmap() is still preferable if just
a page, fewer TLB shootdowns(?), so keep using that when possible.

Rename function pair for their new scope.

Signed-off-by: Andy Grover 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Fail INQUIRY commands with EVPD==0 but PAGE CODE!=0

2012-02-13T19:17:02+00:00

commit bf0053550aebe56f3bb5dd793e9de69238b5b945 upstream.

My draft of SPC-4 says:

    If the PAGE CODE field is not set to zero when the EVPD bit is set
    to zero, the command shall be terminated with CHECK CONDITION
    status, with the sense key set to ILLEGAL REQUEST, and the
    additional sense code set to INVALID FIELD IN CDB.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Return correct ASC for unimplemented VPD pages

2012-02-13T19:17:02+00:00

commit bb1acb2ee038a6c13ee99e0b9fb44dacb4a9de84 upstream.

My draft of SPC-4 says:

    If the device server does not implement the requested vital product
    data page, then the command shall be terminated with CHECK CONDITION
    status, with the sense key set to ILLEGAL REQUEST, and the
    additional sense code set to INVALID FIELD IN CDB.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

target: Set response format in INQUIRY response

2012-01-26T00:13:49+00:00

commit ce136176fea522fc8f4c16dcae7e8ed1d890ca39 upstream.

Current SCSI specs say that the "response format" field in the standard
INQUIRY response should be set to 2, and all the real SCSI devices I
have do put 2 here.  So let's do that too.

Signed-off-by: Roland Dreier 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman