[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 04/16] ahci: check for ncq prdtl overflow
From: |
John Snow |
Subject: |
[Qemu-devel] [PATCH v2 04/16] ahci: check for ncq prdtl overflow |
Date: |
Mon, 22 Jun 2015 19:38:16 -0400 |
Don't attempt the NCQ transfer if the PRDT we were given is not big
enough to perform the entire transfer.
Signed-off-by: John Snow <address@hidden>
---
hw/ide/ahci.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 375aa44..24c4832 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -983,6 +983,7 @@ static void process_ncq_command(AHCIState *s, int port,
uint8_t *cmd_fis,
NCQFrame *ncq_fis = (NCQFrame*)cmd_fis;
uint8_t tag = ncq_fis->tag >> 3;
NCQTransferState *ncq_tfs = &ad->ncq_tfs[tag];
+ size_t size;
if (ncq_tfs->used) {
/* error - already in use */
@@ -999,20 +1000,28 @@ static void process_ncq_command(AHCIState *s, int port,
uint8_t *cmd_fis,
((uint64_t)ncq_fis->lba2 << 16) |
((uint64_t)ncq_fis->lba1 << 8) |
(uint64_t)ncq_fis->lba0;
+ ncq_tfs->tag = tag;
- /* Note: We calculate the sector count, but don't currently rely on it.
- * The total size of the DMA buffer tells us the transfer size instead. */
ncq_tfs->sector_count = ((uint16_t)ncq_fis->sector_count_high << 8) |
ncq_fis->sector_count_low;
+ ahci_populate_sglist(ad, &ncq_tfs->sglist, 0);
+ size = ncq_tfs->sector_count * 512;
+
+ if (ncq_tfs->sglist.size < size) {
+ error_report("ahci: PRDT length for NCQ command (0x%zx) "
+ "is smaller than the requested size (0x%zx)",
+ ncq_tfs->sglist.size, size);
+ qemu_sglist_destroy(&ncq_tfs->sglist);
+ ncq_err(ncq_tfs);
+ ahci_trigger_irq(ad->hba, ad, PORT_IRQ_OVERFLOW);
+ return;
+ }
DPRINTF(port, "NCQ transfer LBA from %"PRId64" to %"PRId64", "
"drive max %"PRId64"\n",
ncq_tfs->lba, ncq_tfs->lba + ncq_tfs->sector_count - 2,
ide_state->nb_sectors - 1);
- ahci_populate_sglist(ad, &ncq_tfs->sglist, 0);
- ncq_tfs->tag = tag;
-
switch(ncq_fis->command) {
case READ_FPDMA_QUEUED:
DPRINTF(port, "NCQ reading %d sectors from LBA %"PRId64", "
@@ -1051,6 +1060,7 @@ static void process_ncq_command(AHCIState *s, int port,
uint8_t *cmd_fis,
"error: tried to process non-NCQ command as NCQ\n");
}
qemu_sglist_destroy(&ncq_tfs->sglist);
+ ncq_err(ncq_tfs);
}
}
--
2.1.0
- [Qemu-devel] [PATCH v2 00/16] ahci: ncq cleanup, part 1, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 01/16] ahci: Rename NCQFIS structure fields, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 03/16] ahci: add ncq_err helper, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 04/16] ahci: check for ncq prdtl overflow,
John Snow <=
- [Qemu-devel] [PATCH v2 02/16] ahci: use shorter variables, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 06/16] ahci: add ncq debug checks, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 05/16] ahci: separate prdtl from opts, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 07/16] ahci: ncq sector count correction, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 08/16] ahci/qtest: Execute IDENTIFY prior to data commands, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 09/16] libqos/ahci: fix cmd_sanity for ncq, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 10/16] libqos/ahci: add NCQ frame support, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 11/16] libqos/ahci: edit wait to be ncq aware, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 12/16] libqos/ahci: adjust expected NCQ interrupts, John Snow, 2015/06/22
- [Qemu-devel] [PATCH v2 14/16] libqos/ahci: Force all NCQ commands to be LBA48, John Snow, 2015/06/22