From nobody Tue Feb 10 21:19:17 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1528481623492232.65331821394136; Fri, 8 Jun 2018 11:13:43 -0700 (PDT) Received: from localhost ([::1]:37476 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fRLtH-0005y9-Sq for importer@patchew.org; Fri, 08 Jun 2018 14:13:35 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48030) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fRLUK-0002WS-O4 for qemu-devel@nongnu.org; Fri, 08 Jun 2018 13:47:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fRLUI-0001fA-Ns for qemu-devel@nongnu.org; Fri, 08 Jun 2018 13:47:48 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:50452 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fRLUI-0001ei-F6 for qemu-devel@nongnu.org; Fri, 08 Jun 2018 13:47:46 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id DCA76406F619; Fri, 8 Jun 2018 17:47:45 +0000 (UTC) Received: from probe.redhat.com (ovpn-123-151.rdu2.redhat.com [10.10.123.151]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9E94A1CBBF; Fri, 8 Jun 2018 17:47:45 +0000 (UTC) From: John Snow To: qemu-devel@nongnu.org Date: Fri, 8 Jun 2018 13:47:33 -0400 Message-Id: <20180608174733.4936-31-jsnow@redhat.com> In-Reply-To: <20180608174733.4936-1-jsnow@redhat.com> References: <20180608174733.4936-1-jsnow@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Fri, 08 Jun 2018 17:47:45 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Fri, 08 Jun 2018 17:47:45 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'jsnow@redhat.com' RCPT:'' Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PULL 30/30] ide: introduce ide_transfer_start_norecurse X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, jsnow@redhat.com, Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" From: Paolo Bonzini For the case where the end_transfer_func is also the caller of ide_transfer_start, the mutual recursion can lead to unlimited stack usage. Introduce a new version that can be used to change tail recursion into a loop, and use it in trace_ide_atapi_cmd_reply_end. Signed-off-by: Paolo Bonzini Signed-off-by: John Snow Reviewed-by: John Snow Reviewed-by: Philippe Mathieu-Daud=C3=A9 Message-id: 20180606190955.20845-8-jsnow@redhat.com Signed-off-by: John Snow --- hw/ide/atapi.c | 42 +++++++++++++++++++++++------------------- hw/ide/core.c | 16 ++++++++++++---- include/hw/ide/internal.h | 2 ++ 3 files changed, 37 insertions(+), 23 deletions(-) diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c index 7168ff55a7..39e473f9c2 100644 --- a/hw/ide/atapi.c +++ b/hw/ide/atapi.c @@ -245,15 +245,11 @@ static uint16_t atapi_byte_count_limit(IDEState *s) void ide_atapi_cmd_reply_end(IDEState *s) { int byte_count_limit, size, ret; - trace_ide_atapi_cmd_reply_end(s, s->packet_transfer_size, - s->elementary_transfer_size, - s->io_buffer_index); - if (s->packet_transfer_size <=3D 0) { - /* end of transfer */ - ide_atapi_cmd_ok(s); - ide_set_irq(s->bus); - trace_ide_atapi_cmd_reply_end_eot(s, s->status); - } else { + while (s->packet_transfer_size > 0) { + trace_ide_atapi_cmd_reply_end(s, s->packet_transfer_size, + s->elementary_transfer_size, + s->io_buffer_index); + /* see if a new sector must be read */ if (s->lba !=3D -1 && s->io_buffer_index >=3D s->cd_sector_size) { if (!s->elementary_transfer_size) { @@ -279,11 +275,6 @@ void ide_atapi_cmd_reply_end(IDEState *s) size =3D s->cd_sector_size - s->io_buffer_index; if (size > s->elementary_transfer_size) size =3D s->elementary_transfer_size; - s->packet_transfer_size -=3D size; - s->elementary_transfer_size -=3D size; - s->io_buffer_index +=3D size; - ide_transfer_start(s, s->io_buffer + s->io_buffer_index - size, - size, ide_atapi_cmd_reply_end); } else { /* a new transfer is needed */ s->nsector =3D (s->nsector & ~7) | ATAPI_INT_REASON_IO; @@ -306,13 +297,26 @@ void ide_atapi_cmd_reply_end(IDEState *s) size =3D (s->cd_sector_size - s->io_buffer_index); } trace_ide_atapi_cmd_reply_end_new(s, s->status); - s->packet_transfer_size -=3D size; - s->elementary_transfer_size -=3D size; - s->io_buffer_index +=3D size; - ide_transfer_start(s, s->io_buffer + s->io_buffer_index - size, - size, ide_atapi_cmd_reply_end); + } + s->packet_transfer_size -=3D size; + s->elementary_transfer_size -=3D size; + s->io_buffer_index +=3D size; + + /* Some adapters process PIO data right away. In that case, we ne= ed + * to avoid mutual recursion between ide_transfer_start + * and ide_atapi_cmd_reply_end. + */ + if (!ide_transfer_start_norecurse(s, + s->io_buffer + s->io_buffer_inde= x - size, + size, ide_atapi_cmd_reply_end)) { + return; } } + + /* end of transfer */ + trace_ide_atapi_cmd_reply_end_eot(s, s->status); + ide_atapi_cmd_ok(s); + ide_set_irq(s->bus); } =20 /* send a reply of 'size' bytes in s->io_buffer to an ATAPI command */ diff --git a/hw/ide/core.c b/hw/ide/core.c index 9c4864ae54..2c62efc536 100644 --- a/hw/ide/core.c +++ b/hw/ide/core.c @@ -523,8 +523,8 @@ static void ide_clear_retry(IDEState *s) } =20 /* prepare data transfer and tell what to do after */ -void ide_transfer_start(IDEState *s, uint8_t *buf, int size, - EndTransferFunc *end_transfer_func) +bool ide_transfer_start_norecurse(IDEState *s, uint8_t *buf, int size, + EndTransferFunc *end_transfer_func) { s->data_ptr =3D buf; s->data_end =3D buf + size; @@ -534,10 +534,18 @@ void ide_transfer_start(IDEState *s, uint8_t *buf, in= t size, } if (!s->bus->dma->ops->pio_transfer) { s->end_transfer_func =3D end_transfer_func; - return; + return false; } s->bus->dma->ops->pio_transfer(s->bus->dma); - end_transfer_func(s); + return true; +} + +void ide_transfer_start(IDEState *s, uint8_t *buf, int size, + EndTransferFunc *end_transfer_func) +{ + if (ide_transfer_start_norecurse(s, buf, size, end_transfer_func)) { + end_transfer_func(s); + } } =20 static void ide_cmd_done(IDEState *s) diff --git a/include/hw/ide/internal.h b/include/hw/ide/internal.h index f3de6f9b73..594081e57f 100644 --- a/include/hw/ide/internal.h +++ b/include/hw/ide/internal.h @@ -623,6 +623,8 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val); =20 void ide_transfer_start(IDEState *s, uint8_t *buf, int size, EndTransferFunc *end_transfer_func); +bool ide_transfer_start_norecurse(IDEState *s, uint8_t *buf, int size, + EndTransferFunc *end_transfer_func); void ide_transfer_stop(IDEState *s); void ide_set_inactive(IDEState *s, bool more); BlockAIOCB *ide_issue_trim( --=20 2.14.3