Merge tag 'ata-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal: - Fix the max segment size and max number of segments supported by the pata_macio driver to fix issues with BIO splitting leading to an overflow of the adapter DMA table (from Michael) - Related to the previous fix, change BUG_ON() calls for incorrect command buffer segmentation into WARN_ON() and an error return (from Michael) * tag 'ata-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: pata_macio: Use WARN instead of BUG ata: pata_macio: Fix DMA table overflow
This commit is contained in:
+20
-10
@@ -208,6 +208,19 @@ static const char* macio_ata_names[] = {
|
||||
/* Don't let a DMA segment go all the way to 64K */
|
||||
#define MAX_DBDMA_SEG 0xff00
|
||||
|
||||
#ifdef CONFIG_PAGE_SIZE_64KB
|
||||
/*
|
||||
* The SCSI core requires the segment size to cover at least a page, so
|
||||
* for 64K page size kernels it must be at least 64K. However the
|
||||
* hardware can't handle 64K, so pata_macio_qc_prep() will split large
|
||||
* requests. To handle the split requests the tablesize must be halved.
|
||||
*/
|
||||
#define PATA_MACIO_MAX_SEGMENT_SIZE SZ_64K
|
||||
#define PATA_MACIO_SG_TABLESIZE (MAX_DCMDS / 2)
|
||||
#else
|
||||
#define PATA_MACIO_MAX_SEGMENT_SIZE MAX_DBDMA_SEG
|
||||
#define PATA_MACIO_SG_TABLESIZE MAX_DCMDS
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Wait 1s for disk to answer on IDE bus after a hard reset
|
||||
@@ -541,7 +554,8 @@ static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
|
||||
|
||||
while (sg_len) {
|
||||
/* table overflow should never happen */
|
||||
BUG_ON (pi++ >= MAX_DCMDS);
|
||||
if (WARN_ON_ONCE(pi >= MAX_DCMDS))
|
||||
return AC_ERR_SYSTEM;
|
||||
|
||||
len = (sg_len < MAX_DBDMA_SEG) ? sg_len : MAX_DBDMA_SEG;
|
||||
table->command = cpu_to_le16(write ? OUTPUT_MORE: INPUT_MORE);
|
||||
@@ -553,11 +567,13 @@ static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
|
||||
addr += len;
|
||||
sg_len -= len;
|
||||
++table;
|
||||
++pi;
|
||||
}
|
||||
}
|
||||
|
||||
/* Should never happen according to Tejun */
|
||||
BUG_ON(!pi);
|
||||
if (WARN_ON_ONCE(!pi))
|
||||
return AC_ERR_SYSTEM;
|
||||
|
||||
/* Convert the last command to an input/output */
|
||||
table--;
|
||||
@@ -912,16 +928,10 @@ static int pata_macio_do_resume(struct pata_macio_priv *priv)
|
||||
|
||||
static const struct scsi_host_template pata_macio_sht = {
|
||||
__ATA_BASE_SHT(DRV_NAME),
|
||||
.sg_tablesize = MAX_DCMDS,
|
||||
.sg_tablesize = PATA_MACIO_SG_TABLESIZE,
|
||||
/* We may not need that strict one */
|
||||
.dma_boundary = ATA_DMA_BOUNDARY,
|
||||
/*
|
||||
* The SCSI core requires the segment size to cover at least a page, so
|
||||
* for 64K page size kernels this must be at least 64K. However the
|
||||
* hardware can't handle 64K, so pata_macio_qc_prep() will split large
|
||||
* requests.
|
||||
*/
|
||||
.max_segment_size = SZ_64K,
|
||||
.max_segment_size = PATA_MACIO_MAX_SEGMENT_SIZE,
|
||||
.device_configure = pata_macio_device_configure,
|
||||
.sdev_groups = ata_common_sdev_groups,
|
||||
.can_queue = ATA_DEF_QUEUE,
|
||||
|
||||
Reference in New Issue
Block a user