d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix AHCI ATAPI emulation when backed with /dev/cd0

Browse Source 
- remove assumption that the backing file/device had
  512-byte sectors
- fix incorrect iovec size variable that would result
  in a buffer overrun when an o/s issued an i/o request
  with more s/g elements than the blockif api

Reviewed by:	Zhixiang Yu (zxyu.core@gmail.com)
MFC after:	3 days
This commit is contained in:
Peter Grehan 2013-10-22 19:55:04 +00:00
parent 23bbf7fa70
commit 10016ed51c
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
usr.sbin/bhyve/pci_ahci.c
View File

@ -663,8 +663,7 @@ atapi_read_capacity(struct ahci_port *p, int slot, uint8_t *cfis)
uint8_t buf[8];
uint64_t sectors;
sectors = blockif_size(p->bctx) / blockif_sectsz(p->bctx);
sectors >>= 2;
sectors = blockif_size(p->bctx) / 2048;
be32enc(buf, sectors - 1);
be32enc(buf + 4, 2048);
cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
@ -908,9 +907,9 @@ atapi_read(struct ahci_port *p, int slot, uint8_t *cfis,
/*
* Build up the iovec based on the prdt
*/
for (i = 0; i < hdr->prdtl; i++) {
for (i = 0; i < iovcnt; i++) {
breq->br_iov[i].iov_base = paddr_guest2host(ahci_ctx(sc),
prdt->dba, prdt->dbc + 1);
prdt->dba, prdt->dbc + 1);
breq->br_iov[i].iov_len = prdt->dbc + 1;
aior->done += (prdt->dbc + 1);
prdt++;