| From e4edeb73e3b9b1ba4efbf18ddb687fb210fd57f8 Mon Sep 17 00:00:00 2001 |
| From: John Snow <jsnow@redhat.com> |
| Date: Fri, 26 Jun 2015 21:52:46 +0200 |
| Subject: [PATCH 1/2] ahci.c: mask unused flags when reading size PRDT DBC |
| |
| Message-id: <1435355567-29641-2-git-send-email-jsnow@redhat.com> |
| Patchwork-id: 66535 |
| O-Subject: [RHEL-7.2 qemu-kvm PATCH 1/2] ahci.c: mask unused flags when reading size PRDT DBC |
| Bugzilla: 1205100 |
| RH-Acked-by: Kevin Wolf <kwolf@redhat.com> |
| RH-Acked-by: Juan Quintela <quintela@redhat.com> |
| RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com> |
| |
| From: Reza Jelveh <reza.jelveh@tuhh.de> |
| |
| The data byte count(DBC) read from the description information is defined for |
| bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion |
| (I) flag. |
| |
| Completion interrupts are triggered after every transaction instead of on |
| I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the |
| DBC leads to a negative offset that causes sglist allocation to fail. |
| |
| Signed-off-by: Reza Jelveh <reza.jelveh@tuhh.de> |
| Reviewed-by: Alexander Graf <agraf@suse.de> |
| Reviewed-by: Kevin Wolf <kwolf@redhat.com> |
| Reviewed-by: John Snow <jsnow@redhat.com> |
| Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
| (cherry picked from commit d02f8adc6d2a178bcbf77d0413f9a96fdbed53f0) |
| Signed-off-by: John Snow <jsnow@redhat.com> |
| Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> |
| |
| hw/ide/ahci.c | 11 ++++++++--- |
| hw/ide/ahci.h | 2 ++ |
| 2 files changed, 10 insertions(+), 3 deletions(-) |
| |
| diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c |
| index 011e796..7f3927a 100644 |
| |
| |
| @@ -635,6 +635,11 @@ static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis) |
| } |
| } |
| |
| +static int prdt_tbl_entry_size(const AHCI_SG *tbl) |
| +{ |
| + return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1; |
| +} |
| + |
| static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset) |
| { |
| AHCICmdHdr *cmd = ad->cur_cmd; |
| @@ -675,7 +680,7 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset) |
| sum = 0; |
| for (i = 0; i < sglist_alloc_hint; i++) { |
| /* flags_size is zero-based */ |
| - tbl_entry_size = (le32_to_cpu(tbl[i].flags_size) + 1); |
| + tbl_entry_size = prdt_tbl_entry_size(&tbl[i]); |
| if (offset <= (sum + tbl_entry_size)) { |
| off_idx = i; |
| off_pos = offset - sum; |
| @@ -693,12 +698,12 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset) |
| |
| qemu_sglist_init(sglist, (sglist_alloc_hint - off_idx), ad->hba->dma); |
| qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos), |
| - le32_to_cpu(tbl[off_idx].flags_size) + 1 - off_pos); |
| + prdt_tbl_entry_size(&tbl[off_idx]) - off_pos); |
| |
| for (i = off_idx + 1; i < sglist_alloc_hint; i++) { |
| /* flags_size is zero-based */ |
| qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr), |
| - le32_to_cpu(tbl[i].flags_size) + 1); |
| + prdt_tbl_entry_size(&tbl[i])); |
| } |
| } |
| |
| diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h |
| index 85f37fe..47c0961 100644 |
| |
| |
| @@ -201,6 +201,8 @@ |
| |
| #define AHCI_COMMAND_TABLE_ACMD 0x40 |
| |
| +#define AHCI_PRDT_SIZE_MASK 0x3fffff |
| + |
| #define IDE_FEATURE_DMA 1 |
| |
| #define READ_FPDMA_QUEUED 0x60 |
| -- |
| 1.8.3.1 |
| |