Re: [Qemu-devel] [PATCH 04/16] ahci: check for ncq prdtl overflow

From: Stefan Hajnoczi <stefanha@redhat.com>
To: John Snow <jsnow@redhat.com>
Cc: kwolf@redhat.com, pbonzini@redhat.com, qemu-devel@nongnu.org,
	qemu-block@nongnu.org
Subject: Re: [Qemu-devel] [PATCH 04/16] ahci: check for ncq prdtl overflow
Date: Mon, 22 Jun 2015 15:06:19 +0100	[thread overview]
Message-ID: <20150622140619.GB7136@stefanha-thinkpad.redhat.com> (raw)
In-Reply-To: <1434765047-29333-5-git-send-email-jsnow@redhat.com>

[-- Attachment #1: Type: text/plain, Size: 908 bytes --]

On Fri, Jun 19, 2015 at 09:50:35PM -0400, John Snow wrote:
> @@ -999,20 +1000,28 @@ static void process_ncq_command(AHCIState *s, int port, uint8_t *cmd_fis,
>                     ((uint64_t)ncq_fis->lba2 << 16) |
>                     ((uint64_t)ncq_fis->lba1 << 8) |
>                     (uint64_t)ncq_fis->lba0;
> +    ncq_tfs->tag = tag;
>  
> -    /* Note: We calculate the sector count, but don't currently rely on it.
> -     * The total size of the DMA buffer tells us the transfer size instead. */
>      ncq_tfs->sector_count = ((uint16_t)ncq_fis->sector_count_high << 8) |
>                                  ncq_fis->sector_count_low;
> +    ahci_populate_sglist(ad, &ncq_tfs->sglist, 0);
> +    size = ncq_tfs->sector_count * 512;

ncq_tfs->sector_count is used with - 2 and - 1 below.  What is the
semantics of this field and why is it okay to use it without subtracting
here?

[-- Attachment #2: Type: application/pgp-signature, Size: 473 bytes --]