scsi: Fix transfer length for READ POSITION commands.

The transfer length depends on the specific service action
code, as defined in the SCSI stream commands spec section 7.7.
Up to now only the extended form was supported.

Signed-off-by: Christian Hoff <christian.hoff@de.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c
index 9c64e3027916bcac3a7c41bbdbd3dc1822f42b10..5ad1013be1e25cc15bf63ce13534a943feef70aa 100644 (file)
--- a/hw/scsi-bus.c
+++ b/hw/scsi-bus.c
@@ -901,7 +901,21 @@ static int scsi_req_stream_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *bu
         cmd->xfer = buf[13] | (buf[12] << 8);
         break;
     case READ_POSITION:
-        cmd->xfer = buf[8] | (buf[7] << 8);
+        switch (buf[1] & 0x1f) /* operation code */ {
+        case SHORT_FORM_BLOCK_ID:
+        case SHORT_FORM_VENDOR_SPECIFIC:
+            cmd->xfer = 20;
+            break;
+        case LONG_FORM:
+            cmd->xfer = 32;
+            break;
+        case EXTENDED_FORM:
+            cmd->xfer = buf[8] | (buf[7] << 8);
+            break;
+        default:
+            return -1;
+        }
+
         break;
     case FORMAT_UNIT:
         cmd->xfer = buf[4] | (buf[3] << 8);

diff --git a/hw/scsi-defs.h b/hw/scsi-defs.h
index ade82a488f181d14daf23b54295c94a37ffec22f..8a73f745ba5fd7f517d681261ede31397eef331a 100644 (file)
--- a/hw/scsi-defs.h
+++ b/hw/scsi-defs.h
@@ -146,6 +146,14 @@
  */
 #define SAI_READ_CAPACITY_16  0x10
 
+/*
+ * READ POSITION service action codes
+ */
+#define SHORT_FORM_BLOCK_ID  0x00
+#define SHORT_FORM_VENDOR_SPECIFIC 0x01
+#define LONG_FORM            0x06
+#define EXTENDED_FORM        0x08
+
 /*
  *  SAM Status codes
  */