Commit b78b25f6 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'ata-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux 

Pull ata fixes from Damien Le Moal:

 - Fix the max segment size and max number of segments supported by the
   pata_macio driver to fix issues with BIO splitting leading to an
   overflow of the adapter DMA table (from Michael)

 - Related to the previous fix, change BUG_ON() calls for incorrect
   command buffer segmentation into WARN_ON() and an error return (from
   Michael)

* tag 'ata-6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: pata_macio: Use WARN instead of BUG
  ata: pata_macio: Fix DMA table overflow
parents aa0743a2 d4bc0a26

drivers/ata/pata_macio.c

+20 −10
Original line number Diff line number Diff line
@@ -208,6 +208,19 @@ static const char* macio_ata_names[] = { 
/* Don't let a DMA segment go all the way to 64K */

#define MAX_DBDMA_SEG		0xff00



#ifdef CONFIG_PAGE_SIZE_64KB

/*

 * The SCSI core requires the segment size to cover at least a page, so

 * for 64K page size kernels it must be at least 64K. However the

 * hardware can't handle 64K, so pata_macio_qc_prep() will split large

 * requests. To handle the split requests the tablesize must be halved.

 */

#define PATA_MACIO_MAX_SEGMENT_SIZE	SZ_64K

#define PATA_MACIO_SG_TABLESIZE		(MAX_DCMDS / 2)

#else

#define PATA_MACIO_MAX_SEGMENT_SIZE	MAX_DBDMA_SEG

#define PATA_MACIO_SG_TABLESIZE		MAX_DCMDS

#endif



/*

 * Wait 1s for disk to answer on IDE bus after a hard reset
@@ -541,7 +554,8 @@ static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc) 


		while (sg_len) {

			/* table overflow should never happen */

			BUG_ON (pi++ >= MAX_DCMDS);

			if (WARN_ON_ONCE(pi >= MAX_DCMDS))

				return AC_ERR_SYSTEM;



			len = (sg_len < MAX_DBDMA_SEG) ? sg_len : MAX_DBDMA_SEG;

			table->command = cpu_to_le16(write ? OUTPUT_MORE: INPUT_MORE);
@@ -553,11 +567,13 @@ static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc) 
			addr += len;

			sg_len -= len;

			++table;

			++pi;

		}

	}



	/* Should never happen according to Tejun */

	BUG_ON(!pi);

	if (WARN_ON_ONCE(!pi))

		return AC_ERR_SYSTEM;



	/* Convert the last command to an input/output */

	table--;
@@ -912,16 +928,10 @@ static int pata_macio_do_resume(struct pata_macio_priv *priv) 


static const struct scsi_host_template pata_macio_sht = {

	__ATA_BASE_SHT(DRV_NAME),

	.sg_tablesize		= MAX_DCMDS,

	.sg_tablesize		= PATA_MACIO_SG_TABLESIZE,

	/* We may not need that strict one */

	.dma_boundary		= ATA_DMA_BOUNDARY,

	/*

	 * The SCSI core requires the segment size to cover at least a page, so

	 * for 64K page size kernels this must be at least 64K. However the

	 * hardware can't handle 64K, so pata_macio_qc_prep() will split large

	 * requests.

	 */

	.max_segment_size	= SZ_64K,

	.max_segment_size	= PATA_MACIO_MAX_SEGMENT_SIZE,

	.device_configure	= pata_macio_device_configure,

	.sdev_groups		= ata_common_sdev_groups,

	.can_queue		= ATA_DEF_QUEUE,