From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55087) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X1vzN-0007Lp-Ku for qemu-devel@nongnu.org; Tue, 01 Jul 2014 07:12:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X1vzH-0005Vy-UU for qemu-devel@nongnu.org; Tue, 01 Jul 2014 07:12:41 -0400 Received: from smtp3.rz.tu-harburg.de ([134.28.202.138]:52384) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X1vzH-0005Mr-Hl for qemu-devel@nongnu.org; Tue, 01 Jul 2014 07:12:35 -0400 From: reza.jelveh@tuhh.de Date: Tue, 1 Jul 2014 13:13:27 +0200 Message-Id: <1404213207-89115-1-git-send-email-reza.jelveh@tuhh.de> Subject: [Qemu-devel] [PATCH_v2] ahci.c: mask unused flags when reading size PRDT DBC List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, jsnow@redhat.com, agraf@suse.de, Reza Jelveh From: Reza Jelveh The data byte count(DBC) read from the description information is defined for bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion (I) flag. Completion interrupts are triggered after every transaction instead of on I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the DBC leads to a negative offset that causes sglist allocation to fail. Signed-off-by: Reza Jelveh --- This requires a custom ovmf image with sata controller for testing: http://reza.jelveh.me/assets/OVMF.fd.bz2 Signed-off-by: Reza Jelveh --- hw/ide/ahci.c | 11 ++++++++--- hw/ide/ahci.h | 2 ++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c index 9bae22e..cd140d1 100644 --- a/hw/ide/ahci.c +++ b/hw/ide/ahci.c @@ -639,6 +639,11 @@ static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis) } } +static int prdt_tbl_entry_size(const AHCI_SG *tbl) +{ + return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1; +} + static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset) { AHCICmdHdr *cmd = ad->cur_cmd; @@ -681,7 +686,7 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset) sum = 0; for (i = 0; i < sglist_alloc_hint; i++) { /* flags_size is zero-based */ - tbl_entry_size = (le32_to_cpu(tbl[i].flags_size) + 1); + tbl_entry_size = prdt_tbl_entry_size(&tbl[i]); if (offset <= (sum + tbl_entry_size)) { off_idx = i; off_pos = offset - sum; @@ -700,12 +705,12 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset) qemu_sglist_init(sglist, qbus->parent, (sglist_alloc_hint - off_idx), ad->hba->as); qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos), - le32_to_cpu(tbl[off_idx].flags_size) + 1 - off_pos); + prdt_tbl_entry_size(&tbl[off_idx]) - off_pos); for (i = off_idx + 1; i < sglist_alloc_hint; i++) { /* flags_size is zero-based */ qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr), - le32_to_cpu(tbl[i].flags_size) + 1); + prdt_tbl_entry_size(&tbl[i])); } } diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h index 9a4064f..f418b30 100644 --- a/hw/ide/ahci.h +++ b/hw/ide/ahci.h @@ -201,6 +201,8 @@ #define AHCI_COMMAND_TABLE_ACMD 0x40 +#define AHCI_PRDT_SIZE_MASK 0x3fffff + #define IDE_FEATURE_DMA 1 #define READ_FPDMA_QUEUED 0x60 -- 1.9.2