femu/ocssd: refuse a geometry the timing model cannot index

The model stamps and locks fixed-size per-chip arrays in the controller,
indexed by channel * lnum_lun + lun, so it is the product that has to
fit; lnum_ch=64,lnum_lun=8 indexes 511 entries into an array of 128 and
writes into the rest of the controller. Both versions asserted on this
during realize, which aborts QEMU over a property the user chose. Refuse
the device with a message naming the limits instead.

Zero is refused for the same reason: the counts divide the namespace
size while the geometry is built, so lnum_ch=0 is a division fault at
realize. Version 2.0 also stops building the controller once a namespace
has failed.

Author: huaicheng

hw/femu/ocssd/oc12.c

@@ -1133,15 +1133,6 @@ static int oc12_init_more(FemuCtrl *n)
         c->num_lun = lps->num_lun;
         c->num_pln = lps->num_pln;
 
-        /*
-         * The timing model indexes its chip array by the flat LUN id,
-         * ch * num_lun + lun, so it is the product that has to fit. Bounding
-         * each axis on its own lets a legal-looking geometry index past the
-         * end of the array.
-         */
-        assert(c->num_ch <= FEMU_MAX_NUM_CHNLS &&
-               c->num_ch * c->num_lun <= FEMU_MAX_NUM_CHIPS);
-
         c->num_blk = cpu_to_le16(chnl_blks) / (c->num_lun * c->num_pln);
         c->num_pg = cpu_to_le16(lps->pgs_per_blk);
         c->csecs = cpu_to_le16(lps->sec_size);
@@ -1293,6 +1284,10 @@ static void oc12_init(FemuCtrl *n, NvmeNamespace *ns, Error **errp)
 
     int i;
 
+    if (!oc_timing_geometry_ok(n, errp)) {
+        return;
+    }
+
     NVME_CAP_SET_OC(n->bar.cap, 1);
     oc12_set_ctrl_str(n);
 

hw/femu/ocssd/oc20.c

@@ -1155,13 +1155,6 @@ static void femu_oc20_init_id_ctrl(FemuCtrl *n, NvmeNamespace *ns,
     uint8_t num_lun = n->oc_params.num_lun;
     uint8_t num_pln = n->oc_params.num_pln;
 
-    /*
-     * The timing model indexes its chip array by the flat LUN id,
-     * group * num_lun + punit, so the product is what has to fit.
-     */
-    assert(num_ch <= FEMU_MAX_NUM_CHNLS &&
-           num_ch * num_lun <= FEMU_MAX_NUM_CHIPS);
-
     /* 
      * Byte 0: Major Version Number (MJR)
      * - Value 1: OCSSD Revision 1.2
@@ -1486,9 +1479,15 @@ static void oc20_init(FemuCtrl *n, NvmeNamespace *ns, Error **errp)
 {
     (void)ns;
 
+    if (!oc_timing_geometry_ok(n, errp)) {
+        return;
+    }
+
     NVME_CAP_SET_OC(n->bar.cap, 1);
     oc20_set_ctrl_str(n);
-    oc20_init_namespaces(n, errp);
+    if (oc20_init_namespaces(n, errp)) {
+        return;
+    }
 
     oc20_init_misc(n);
 }

hw/femu/timing-model/timing.c

@@ -1,5 +1,36 @@
 #include "../nvme.h"
 
+/*
+ * The per-chip arrays this model locks and stamps are fixed-size members of the
+ * controller, indexed by the flat LUN id -- channel * num_lun + lun -- so it is
+ * the product that has to fit. Bounding each axis on its own lets a geometry
+ * that looks legal stamp past the end of the array and into the rest of the
+ * controller. The counts also divide the namespace size when the geometry is
+ * built, so a zero is a division fault at realize rather than a wrong answer.
+ */
+bool oc_timing_geometry_ok(FemuCtrl *n, Error **errp)
+{
+    unsigned ch = n->oc_params.num_ch;
+    unsigned lun = n->oc_params.num_lun;
+
+    if (!ch || !lun || !n->oc_params.num_pln || !n->oc_params.secs_per_pg ||
+        !n->oc_params.pgs_per_blk || !n->oc_params.sec_size) {
+        error_setg(errp, "FEMU ocssd: lnum_ch, lnum_lun, lnum_pln, "
+                   "lsecs_per_pg, lpgs_per_blk and lsec_size must all be "
+                   "greater than zero");
+        return false;
+    }
+
+    if (ch > FEMU_MAX_NUM_CHNLS || ch * lun > FEMU_MAX_NUM_CHIPS) {
+        error_setg(errp, "FEMU ocssd: lnum_ch must not exceed %d and "
+                   "lnum_ch * lnum_lun must not exceed %d, got %u and %u",
+                   FEMU_MAX_NUM_CHNLS, FEMU_MAX_NUM_CHIPS, ch, lun);
+        return false;
+    }
+
+    return true;
+}
+
 void set_latency(FemuCtrl *n)
 {
     if (n->flash_type == TLC) {

hw/femu/timing-model/timing.h

@@ -7,4 +7,5 @@ int64_t advance_channel_timestamp(FemuCtrl *n, int ch, uint64_t now, int opcode)
 int64_t advance_chip_timestamp(FemuCtrl *n, int lunid, uint64_t now, int opcode,
                                uint8_t page_type);
 void set_latency(FemuCtrl *n);
+bool oc_timing_geometry_ok(FemuCtrl *n, Error **errp);
 #endif