Re: [Qemu-devel] [RFC 1/1] ide: bug #1777315: io_buffer_size and sg.size can represent partial sector sizes

[Amol Surati <suratiamol@gmail.com>]

On Mon, Jun 18, 2018 at 12:05:15AM +0530, Amol Surati wrote:
> This patch fixes the assumption that io_buffer_size is always a perfect
> multiple of the sector size. The assumption is the cause of the firing
> of 'assert(n * 512 == s->sg.size);'.
> 
> Signed-off-by: Amol Surati <suratiamol@gmail.com>
> ---

The repository https://github.com/asurati/1777315 contains a module for
QEMU's 8086:7010 ATA controller, which exercises the code path
described in [RFC 0/1] of this series.

Loading the module reproduces the bug. Tested on the latest master
branch.

Steps:
- Install a Linux distribution as a guest, ensuring that the boot disk
  resides on non-IDE controllers (such as virtio)
- Attach another disk as a master device on the primary
  IDE controller (i.e. attach at -hda.)
- Blacklist ata_piix, pata_acpi and ata_generic modules, and reboot.
- Copy the source files into the guest and build the module.
- Load the module. QEMU process should die with the message:
  qemu-system-x86_64: hw/ide/core.c:871: ide_dma_cb:
  Assertion `n * 512 == s->sg.size' failed.


-Amol