[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL for-2.1 04/11] ahci.c: mask unused flags when reading
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PULL for-2.1 04/11] ahci.c: mask unused flags when reading size PRDT DBC |
Date: |
Mon, 7 Jul 2014 14:28:31 +0200 |
From: Reza Jelveh <address@hidden>
The data byte count(DBC) read from the description information is defined for
bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion
(I) flag.
Completion interrupts are triggered after every transaction instead of on
I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the
DBC leads to a negative offset that causes sglist allocation to fail.
Signed-off-by: Reza Jelveh <address@hidden>
Reviewed-by: Alexander Graf <address@hidden>
Reviewed-by: Kevin Wolf <address@hidden>
Reviewed-by: John Snow <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
hw/ide/ahci.c | 11 ++++++++---
hw/ide/ahci.h | 2 ++
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 9bae22e..cd140d1 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -639,6 +639,11 @@ static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t
*cmd_fis)
}
}
+static int prdt_tbl_entry_size(const AHCI_SG *tbl)
+{
+ return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1;
+}
+
static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
{
AHCICmdHdr *cmd = ad->cur_cmd;
@@ -681,7 +686,7 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList
*sglist, int offset)
sum = 0;
for (i = 0; i < sglist_alloc_hint; i++) {
/* flags_size is zero-based */
- tbl_entry_size = (le32_to_cpu(tbl[i].flags_size) + 1);
+ tbl_entry_size = prdt_tbl_entry_size(&tbl[i]);
if (offset <= (sum + tbl_entry_size)) {
off_idx = i;
off_pos = offset - sum;
@@ -700,12 +705,12 @@ static int ahci_populate_sglist(AHCIDevice *ad,
QEMUSGList *sglist, int offset)
qemu_sglist_init(sglist, qbus->parent, (sglist_alloc_hint - off_idx),
ad->hba->as);
qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos),
- le32_to_cpu(tbl[off_idx].flags_size) + 1 - off_pos);
+ prdt_tbl_entry_size(&tbl[off_idx]) - off_pos);
for (i = off_idx + 1; i < sglist_alloc_hint; i++) {
/* flags_size is zero-based */
qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
- le32_to_cpu(tbl[i].flags_size) + 1);
+ prdt_tbl_entry_size(&tbl[i]));
}
}
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index 9a4064f..f418b30 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -201,6 +201,8 @@
#define AHCI_COMMAND_TABLE_ACMD 0x40
+#define AHCI_PRDT_SIZE_MASK 0x3fffff
+
#define IDE_FEATURE_DMA 1
#define READ_FPDMA_QUEUED 0x60
--
1.9.3
- [Qemu-devel] [PULL for-2.1 00/11] Block patches, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 01/11] Fix nocow typos in manpage, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 04/11] ahci.c: mask unused flags when reading size PRDT DBC,
Stefan Hajnoczi <=
- [Qemu-devel] [PULL for-2.1 02/11] mirror: Fix qiov size for short requests, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 03/11] MAINTAINERS: add Stefan Hajnoczi to IDE maintainers, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 05/11] qemu-iotests: Disable Quorum testing in 041 when Quorum is not builtin, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 06/11] raw-posix: Fix raw_getlength() to always return -errno on error, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 07/11] ahci: map memory via device's address space instead of address_space_memory, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 08/11] block: block: introduce APIs for submitting IO as a batch, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 09/11] linux-aio: implement io plug, unplug and flush io queue, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 10/11] dataplane: submit I/O as a batch, Stefan Hajnoczi, 2014/07/07
- [Qemu-devel] [PULL for-2.1 11/11] qmp: show QOM properties in device-list-properties, Stefan Hajnoczi, 2014/07/07
- Re: [Qemu-devel] [PULL for-2.1 00/11] Block patches, Peter Maydell, 2014/07/07