hrev46331 adds 6 changesets to branch 'master' old head: b7f865a04dfc112aaf84a5da9bd609576fc42291 new head: a0f124211a035461631ac52b9dd0b3e274f1156c overview: http://cgit.haiku-os.org/haiku/log/?qt=range&q=a0f1242+%5Eb7f865a ---------------------------------------------------------------------------- 1149fa6: CID 1108447 Uninitialized scalar field 426c95e: CID 1108333, 1108192, 1108443 * 1108333 Out-of-bounds access * 1108192 Operands don't affect result * 1108443 Uninitialized pointer field ecadc4c: CID 1108428 Uninitialized scalar field 21f7dc3: scsi: checks for B_OK instead of SCSI_REQ_CMP in scsi_scan_bus() * scsi_scan_lun() actually returns a status_t 1ab3841: CID 1108455 Structurally dead code a0f1242: scsi: define SCSI_DEVICE_MAX_LUN_COUNT to set a custom max lun count. * virtio_scsi can have 16384 luns, though we cap at 256 as our scsi_ccb only uses uchar as a type for target_lun and target_id members. * minor code cleanup in scsi_scan_bus(). [ Jérôme Duval <jerome.duval@xxxxxxxxx> ] ---------------------------------------------------------------------------- 9 files changed, 30 insertions(+), 20 deletions(-) headers/os/drivers/bus/SCSI.h | 2 ++ .../kernel/bus_managers/random/driver.cpp | 2 -- src/add-ons/kernel/bus_managers/scsi/busses.cpp | 9 +++++++++ .../kernel/bus_managers/scsi/device_scan.cpp | 20 +++++++------------- .../kernel/bus_managers/scsi/scsi_internal.h | 1 + .../kernel/bus_managers/virtio/VirtioQueue.cpp | 1 + .../kernel/busses/random/VirtioRNGDevice.cpp | 3 ++- .../busses/scsi/virtio/VirtioSCSIRequest.cpp | 9 +++++---- .../kernel/busses/scsi/virtio/virtio_scsi.cpp | 3 +++ ############################################################################ Commit: 1149fa6ece3567c466008a04ae8a830a63bafdaa URL: http://cgit.haiku-os.org/haiku/commit/?id=1149fa6 Author: Jérôme Duval <jerome.duval@xxxxxxxxx> Date: Sat Nov 9 09:13:47 2013 UTC CID 1108447 Uninitialized scalar field ---------------------------------------------------------------------------- diff --git a/src/add-ons/kernel/busses/random/VirtioRNGDevice.cpp b/src/add-ons/kernel/busses/random/VirtioRNGDevice.cpp index 7aa9ae0..2e569c8 100644 --- a/src/add-ons/kernel/busses/random/VirtioRNGDevice.cpp +++ b/src/add-ons/kernel/busses/random/VirtioRNGDevice.cpp @@ -28,7 +28,8 @@ VirtioRNGDevice::VirtioRNGDevice(device_node *node) fVirtio(NULL), fVirtioDevice(NULL), fStatus(B_NO_INIT), - fOffset(BUFFER_SIZE) + fOffset(BUFFER_SIZE), + fExpectsInterrupt(false) { CALLED(); ############################################################################ Commit: 426c95e5b0b5555ed31e220df2e8d24354915b5b URL: http://cgit.haiku-os.org/haiku/commit/?id=426c95e Author: Jérôme Duval <jerome.duval@xxxxxxxxx> Date: Sat Nov 9 09:24:08 2013 UTC CID 1108333, 1108192, 1108443 * 1108333 Out-of-bounds access * 1108192 Operands don't affect result * 1108443 Uninitialized pointer field ---------------------------------------------------------------------------- diff --git a/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp b/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp index fef0ff8..6e489af 100644 --- a/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp +++ b/src/add-ons/kernel/busses/scsi/virtio/VirtioSCSIRequest.cpp @@ -13,6 +13,7 @@ VirtioSCSIRequest::VirtioSCSIRequest(bool hasLock) : fHasLock(hasLock), + fStatus(SCSI_REQ_CMP), fTimeout(0), fBytesLeft(0), fIsWrite(false), @@ -164,11 +165,12 @@ VirtioSCSIRequest::FillRequest(uint32 inCount, uint32 outCount, fRequest->tag = (addr_t)fCCB; fRequest->lun[0] = 1; fRequest->lun[1] = fCCB->target_id; - fRequest->lun[2] = 0x40 | ((fCCB->target_lun >> 8) & 0x3f); - fRequest->lun[3] = (fCCB->target_lun >> 8) & 0xff; + // we don't support lun >= 256 + fRequest->lun[2] = 0x40; + fRequest->lun[3] = fCCB->target_lun & 0xff; memcpy(fRequest->cdb, fCCB->cdb, min_c(fCCB->cdb_length, - sizeof(fRequest->cdb))); + min_c(sizeof(fRequest->cdb), sizeof(fCCB->cdb)))); get_memory_map(fBuffer, sizeof(struct virtio_scsi_cmd_req) + sizeof(struct virtio_scsi_cmd_resp), &entries[0], 1); @@ -225,4 +227,3 @@ VirtioSCSIRequest::_ResponseStatus() return status; } - ############################################################################ Commit: ecadc4c69603b5a4234fe08095ec98a7241b5d17 URL: http://cgit.haiku-os.org/haiku/commit/?id=ecadc4c Author: Jérôme Duval <jerome.duval@xxxxxxxxx> Date: Sat Nov 9 09:29:49 2013 UTC CID 1108428 Uninitialized scalar field ---------------------------------------------------------------------------- diff --git a/src/add-ons/kernel/bus_managers/virtio/VirtioQueue.cpp b/src/add-ons/kernel/bus_managers/virtio/VirtioQueue.cpp index 5977785..77aec1d 100644 --- a/src/add-ons/kernel/bus_managers/virtio/VirtioQueue.cpp +++ b/src/add-ons/kernel/bus_managers/virtio/VirtioQueue.cpp @@ -85,6 +85,7 @@ TransferDescriptor::TransferDescriptor(VirtioQueue* queue, uint16 indirectMaxSiz fIndirect(NULL), fAreaSize(0), fArea(-1), + fPhysAddr(0), fDescriptorCount(0) { fStatus = B_OK; ############################################################################ Commit: 21f7dc3d40f6b1cb187df97ba240bb18112da275 URL: http://cgit.haiku-os.org/haiku/commit/?id=21f7dc3 Author: Jérôme Duval <jerome.duval@xxxxxxxxx> Date: Sat Nov 9 11:15:50 2013 UTC scsi: checks for B_OK instead of SCSI_REQ_CMP in scsi_scan_bus() * scsi_scan_lun() actually returns a status_t ---------------------------------------------------------------------------- diff --git a/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp b/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp index 97d77d7..99c39ce 100644 --- a/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp +++ b/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp @@ -225,7 +225,7 @@ scsi_scan_lun(scsi_bus_info *bus, uchar target_id, uchar target_lun) // the bus_manager should really take care of res = scsi_register_device(bus, target_id, target_lun, &new_inquiry_data); if (res == B_NAME_IN_USE) { - SHOW_FLOW0(3, "name in use"); + SHOW_FLOW0(3, "name in use"); if (scsi_force_get_device(bus, target_id, target_lun, &device) != B_OK) return B_OK; // the device was already registered, let's tell our child to rescan it @@ -282,14 +282,14 @@ scsi_scan_bus(scsi_bus_info *bus) // anything but LUN 0, so we should probably add a black-list // or something for (lun = 0; lun <= MAX_LUN_ID; ++lun) { - status_t res; + status_t status; SHOW_FLOW(3, "lun: %d", lun); - res = scsi_scan_lun(bus, target_id, lun); + status = scsi_scan_lun(bus, target_id, lun); // if there is no device at lun 0, there's probably no device at all - if (lun == 0 && res != SCSI_REQ_CMP) + if (lun == 0 && status != B_OK) break; } } ############################################################################ Commit: 1ab38414b16d4ee91e46e7fa25fe9e44cee1354c URL: http://cgit.haiku-os.org/haiku/commit/?id=1ab3841 Author: Jérôme Duval <jerome.duval@xxxxxxxxx> Date: Sat Nov 9 11:22:53 2013 UTC CID 1108455 Structurally dead code ---------------------------------------------------------------------------- diff --git a/src/add-ons/kernel/bus_managers/random/driver.cpp b/src/add-ons/kernel/bus_managers/random/driver.cpp index d1164bc..592666f 100644 --- a/src/add-ons/kernel/bus_managers/random/driver.cpp +++ b/src/add-ons/kernel/bus_managers/random/driver.cpp @@ -228,8 +228,6 @@ random_register_child_devices(void* _cookie) device_node* node; return gDeviceManager->register_node(info->node, YARROW_RNG_SIM_MODULE_NAME, attrs, NULL, &node); - - return status; } ############################################################################ Revision: hrev46331 Commit: a0f124211a035461631ac52b9dd0b3e274f1156c URL: http://cgit.haiku-os.org/haiku/commit/?id=a0f1242 Author: Jérôme Duval <jerome.duval@xxxxxxxxx> Date: Sat Nov 9 11:55:50 2013 UTC scsi: define SCSI_DEVICE_MAX_LUN_COUNT to set a custom max lun count. * virtio_scsi can have 16384 luns, though we cap at 256 as our scsi_ccb only uses uchar as a type for target_lun and target_id members. * minor code cleanup in scsi_scan_bus(). ---------------------------------------------------------------------------- diff --git a/headers/os/drivers/bus/SCSI.h b/headers/os/drivers/bus/SCSI.h index ed4b616..af91138 100644 --- a/headers/os/drivers/bus/SCSI.h +++ b/headers/os/drivers/bus/SCSI.h @@ -288,6 +288,8 @@ typedef struct { // maximum targets on scsi bus #define SCSI_DEVICE_MAX_TARGET_COUNT "scsi/max_target_count" +// maximum luns on scsi bus +#define SCSI_DEVICE_MAX_LUN_COUNT "scsi/max_lun_count" // directory containing links to peripheral drivers #define SCSI_PERIPHERAL_DRIVERS_DIR "scsi" diff --git a/src/add-ons/kernel/bus_managers/scsi/busses.cpp b/src/add-ons/kernel/bus_managers/scsi/busses.cpp index d5a17d4..934cf32 100644 --- a/src/add-ons/kernel/bus_managers/scsi/busses.cpp +++ b/src/add-ons/kernel/bus_managers/scsi/busses.cpp @@ -101,6 +101,15 @@ scsi_create_bus(device_node *node, uint8 path_id) if (pnp->get_attr_uint32(node, SCSI_DEVICE_MAX_TARGET_COUNT, &bus->max_target_count, true) != B_OK) bus->max_target_count = MAX_TARGET_ID + 1; + if (pnp->get_attr_uint32(node, SCSI_DEVICE_MAX_LUN_COUNT, &bus->max_lun_count, true) != B_OK) + bus->max_lun_count = MAX_LUN_ID + 1; + + // our scsi_ccb only has a uchar for target_id + if (bus->max_target_count > 256) + bus->max_target_count = 256; + // our scsi_ccb only has a uchar for target_lun + if (bus->max_lun_count > 256) + bus->max_lun_count = 256; bus->node = node; bus->lock_count = bus->blocked[0] = bus->blocked[1] = 0; diff --git a/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp b/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp index 99c39ce..bb0ffe8 100644 --- a/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp +++ b/src/add-ons/kernel/bus_managers/scsi/device_scan.cpp @@ -251,18 +251,16 @@ err: status_t scsi_scan_bus(scsi_bus_info *bus) { - int initiator_id, target_id; scsi_path_inquiry inquiry; - uchar res; SHOW_FLOW0( 3, "" ); // get ID of initiator (i.e. controller) - res = scsi_inquiry_path(bus, &inquiry); + uchar res = scsi_inquiry_path(bus, &inquiry); if (res != SCSI_REQ_CMP) return B_ERROR; - initiator_id = inquiry.initiator_id; + uint initiator_id = inquiry.initiator_id; SHOW_FLOW(3, "initiator_id=%d", initiator_id); @@ -270,9 +268,7 @@ scsi_scan_bus(scsi_bus_info *bus) // as this function is optional for SIM, we ignore its result bus->interface->scan_bus(bus->sim_cookie); - for (target_id = 0; target_id < (int)bus->max_target_count; ++target_id) { - int lun; - + for (uint target_id = 0; target_id < bus->max_target_count; ++target_id) { SHOW_FLOW(3, "target: %d", target_id); if (target_id == initiator_id) @@ -281,12 +277,10 @@ scsi_scan_bus(scsi_bus_info *bus) // TODO: there are a lot of devices out there that go mad if you probe // anything but LUN 0, so we should probably add a black-list // or something - for (lun = 0; lun <= MAX_LUN_ID; ++lun) { - status_t status; - + for (uint lun = 0; lun < bus->max_lun_count; ++lun) { SHOW_FLOW(3, "lun: %d", lun); - status = scsi_scan_lun(bus, target_id, lun); + status_t status = scsi_scan_lun(bus, target_id, lun); // if there is no device at lun 0, there's probably no device at all if (lun == 0 && status != B_OK) diff --git a/src/add-ons/kernel/bus_managers/scsi/scsi_internal.h b/src/add-ons/kernel/bus_managers/scsi/scsi_internal.h index 1c4fd70..d12d7db 100644 --- a/src/add-ons/kernel/bus_managers/scsi/scsi_internal.h +++ b/src/add-ons/kernel/bus_managers/scsi/scsi_internal.h @@ -90,6 +90,7 @@ typedef struct scsi_bus_info { uchar path_id; // SCSI path id uint32 max_target_count; // maximum count of target_ids on the bus + uint32 max_lun_count; // maximum count of lun_ids on the bus thread_id service_thread; // service thread sem_id start_service; // released whenever service thread has work to do diff --git a/src/add-ons/kernel/busses/scsi/virtio/virtio_scsi.cpp b/src/add-ons/kernel/busses/scsi/virtio/virtio_scsi.cpp index 5bf798d..cd092a9 100644 --- a/src/add-ons/kernel/busses/scsi/virtio/virtio_scsi.cpp +++ b/src/add-ons/kernel/busses/scsi/virtio/virtio_scsi.cpp @@ -205,6 +205,7 @@ virtio_scsi_register_device(device_node *parent) return status; uint32 max_targets = config.max_target + 1; + uint32 max_luns = config.max_lun + 1; uint32 max_blocks = 0x10000; if (config.max_sectors != 0) max_blocks = config.max_sectors; @@ -212,6 +213,8 @@ virtio_scsi_register_device(device_node *parent) device_attr attrs[] = { { SCSI_DEVICE_MAX_TARGET_COUNT, B_UINT32_TYPE, { ui32: max_targets }}, + { SCSI_DEVICE_MAX_LUN_COUNT, B_UINT32_TYPE, + { ui32: max_luns }}, { B_DEVICE_PRETTY_NAME, B_STRING_TYPE, { string: VIRTIO_SCSI_BRIDGE_PRETTY_NAME }},