|
 |
05bba0 |
From e4edeb73e3b9b1ba4efbf18ddb687fb210fd57f8 Mon Sep 17 00:00:00 2001
|
|
|
05bba0 |
From: John Snow <jsnow@redhat.com>
|
|
|
05bba0 |
Date: Fri, 26 Jun 2015 21:52:46 +0200
|
|
|
05bba0 |
Subject: [PATCH 1/2] ahci.c: mask unused flags when reading size PRDT DBC
|
|
|
05bba0 |
|
|
|
05bba0 |
Message-id: <1435355567-29641-2-git-send-email-jsnow@redhat.com>
|
|
|
05bba0 |
Patchwork-id: 66535
|
|
|
05bba0 |
O-Subject: [RHEL-7.2 qemu-kvm PATCH 1/2] ahci.c: mask unused flags when reading size PRDT DBC
|
|
|
05bba0 |
Bugzilla: 1205100
|
|
|
05bba0 |
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Juan Quintela <quintela@redhat.com>
|
|
|
05bba0 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
05bba0 |
|
|
|
05bba0 |
From: Reza Jelveh <reza.jelveh@tuhh.de>
|
|
|
05bba0 |
|
|
|
05bba0 |
The data byte count(DBC) read from the description information is defined for
|
|
|
05bba0 |
bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion
|
|
|
05bba0 |
(I) flag.
|
|
|
05bba0 |
|
|
|
05bba0 |
Completion interrupts are triggered after every transaction instead of on
|
|
|
05bba0 |
I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the
|
|
|
05bba0 |
DBC leads to a negative offset that causes sglist allocation to fail.
|
|
|
05bba0 |
|
|
|
05bba0 |
Signed-off-by: Reza Jelveh <reza.jelveh@tuhh.de>
|
|
|
05bba0 |
Reviewed-by: Alexander Graf <agraf@suse.de>
|
|
|
05bba0 |
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
05bba0 |
Reviewed-by: John Snow <jsnow@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
05bba0 |
(cherry picked from commit d02f8adc6d2a178bcbf77d0413f9a96fdbed53f0)
|
|
|
05bba0 |
Signed-off-by: John Snow <jsnow@redhat.com>
|
|
|
05bba0 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
05bba0 |
---
|
|
|
05bba0 |
hw/ide/ahci.c | 11 ++++++++---
|
|
|
05bba0 |
hw/ide/ahci.h | 2 ++
|
|
|
05bba0 |
2 files changed, 10 insertions(+), 3 deletions(-)
|
|
|
05bba0 |
|
|
|
05bba0 |
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
|
|
|
05bba0 |
index 011e796..7f3927a 100644
|
|
|
05bba0 |
--- a/hw/ide/ahci.c
|
|
|
05bba0 |
+++ b/hw/ide/ahci.c
|
|
|
05bba0 |
@@ -635,6 +635,11 @@ static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis)
|
|
|
05bba0 |
}
|
|
|
05bba0 |
}
|
|
|
05bba0 |
|
|
|
05bba0 |
+static int prdt_tbl_entry_size(const AHCI_SG *tbl)
|
|
|
05bba0 |
+{
|
|
|
05bba0 |
+ return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1;
|
|
|
05bba0 |
+}
|
|
|
05bba0 |
+
|
|
|
05bba0 |
static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
|
|
|
05bba0 |
{
|
|
|
05bba0 |
AHCICmdHdr *cmd = ad->cur_cmd;
|
|
|
05bba0 |
@@ -675,7 +680,7 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
|
|
|
05bba0 |
sum = 0;
|
|
|
05bba0 |
for (i = 0; i < sglist_alloc_hint; i++) {
|
|
|
05bba0 |
/* flags_size is zero-based */
|
|
|
05bba0 |
- tbl_entry_size = (le32_to_cpu(tbl[i].flags_size) + 1);
|
|
|
05bba0 |
+ tbl_entry_size = prdt_tbl_entry_size(&tbl[i]);
|
|
|
05bba0 |
if (offset <= (sum + tbl_entry_size)) {
|
|
|
05bba0 |
off_idx = i;
|
|
|
05bba0 |
off_pos = offset - sum;
|
|
|
05bba0 |
@@ -693,12 +698,12 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
|
|
|
05bba0 |
|
|
|
05bba0 |
qemu_sglist_init(sglist, (sglist_alloc_hint - off_idx), ad->hba->dma);
|
|
|
05bba0 |
qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos),
|
|
|
05bba0 |
- le32_to_cpu(tbl[off_idx].flags_size) + 1 - off_pos);
|
|
|
05bba0 |
+ prdt_tbl_entry_size(&tbl[off_idx]) - off_pos);
|
|
|
05bba0 |
|
|
|
05bba0 |
for (i = off_idx + 1; i < sglist_alloc_hint; i++) {
|
|
|
05bba0 |
/* flags_size is zero-based */
|
|
|
05bba0 |
qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
|
|
|
05bba0 |
- le32_to_cpu(tbl[i].flags_size) + 1);
|
|
|
05bba0 |
+ prdt_tbl_entry_size(&tbl[i]));
|
|
|
05bba0 |
}
|
|
|
05bba0 |
}
|
|
|
05bba0 |
|
|
|
05bba0 |
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
|
|
|
05bba0 |
index 85f37fe..47c0961 100644
|
|
|
05bba0 |
--- a/hw/ide/ahci.h
|
|
|
05bba0 |
+++ b/hw/ide/ahci.h
|
|
|
05bba0 |
@@ -201,6 +201,8 @@
|
|
|
05bba0 |
|
|
|
05bba0 |
#define AHCI_COMMAND_TABLE_ACMD 0x40
|
|
|
05bba0 |
|
|
|
05bba0 |
+#define AHCI_PRDT_SIZE_MASK 0x3fffff
|
|
|
05bba0 |
+
|
|
|
05bba0 |
#define IDE_FEATURE_DMA 1
|
|
|
05bba0 |
|
|
|
05bba0 |
#define READ_FPDMA_QUEUED 0x60
|
|
|
05bba0 |
--
|
|
|
05bba0 |
1.8.3.1
|
|
|
05bba0 |
|