summaryrefslogtreecommitdiffstats
path: root/hw/ide
diff options
context:
space:
mode:
authorReza Jelveh2014-07-01 13:13:27 +0200
committerStefan Hajnoczi2014-07-07 09:15:29 +0200
commitd02f8adc6d2a178bcbf77d0413f9a96fdbed53f0 (patch)
tree002176c41fd505217c0fc7bda156d5dd8c7e9d46 /hw/ide
parentMAINTAINERS: add Stefan Hajnoczi to IDE maintainers (diff)
downloadqemu-d02f8adc6d2a178bcbf77d0413f9a96fdbed53f0.tar.gz
qemu-d02f8adc6d2a178bcbf77d0413f9a96fdbed53f0.tar.xz
qemu-d02f8adc6d2a178bcbf77d0413f9a96fdbed53f0.zip
ahci.c: mask unused flags when reading size PRDT DBC
The data byte count(DBC) read from the description information is defined for bits 21:00. Bits 30:22 are reserved and bit 31 is the Interrupt on Completion (I) flag. Completion interrupts are triggered after every transaction instead of on I-flag in QEMU. tbl_entry_size is a signed integer and improperly reading the DBC leads to a negative offset that causes sglist allocation to fail. Signed-off-by: Reza Jelveh <reza.jelveh@tuhh.de> Reviewed-by: Alexander Graf <agraf@suse.de> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: John Snow <jsnow@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/ide')
-rw-r--r--hw/ide/ahci.c11
-rw-r--r--hw/ide/ahci.h2
2 files changed, 10 insertions, 3 deletions
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 9bae22ecb1..cd140d16b8 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -639,6 +639,11 @@ static void ahci_write_fis_d2h(AHCIDevice *ad, uint8_t *cmd_fis)
}
}
+static int prdt_tbl_entry_size(const AHCI_SG *tbl)
+{
+ return (le32_to_cpu(tbl->flags_size) & AHCI_PRDT_SIZE_MASK) + 1;
+}
+
static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
{
AHCICmdHdr *cmd = ad->cur_cmd;
@@ -681,7 +686,7 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
sum = 0;
for (i = 0; i < sglist_alloc_hint; i++) {
/* flags_size is zero-based */
- tbl_entry_size = (le32_to_cpu(tbl[i].flags_size) + 1);
+ tbl_entry_size = prdt_tbl_entry_size(&tbl[i]);
if (offset <= (sum + tbl_entry_size)) {
off_idx = i;
off_pos = offset - sum;
@@ -700,12 +705,12 @@ static int ahci_populate_sglist(AHCIDevice *ad, QEMUSGList *sglist, int offset)
qemu_sglist_init(sglist, qbus->parent, (sglist_alloc_hint - off_idx),
ad->hba->as);
qemu_sglist_add(sglist, le64_to_cpu(tbl[off_idx].addr + off_pos),
- le32_to_cpu(tbl[off_idx].flags_size) + 1 - off_pos);
+ prdt_tbl_entry_size(&tbl[off_idx]) - off_pos);
for (i = off_idx + 1; i < sglist_alloc_hint; i++) {
/* flags_size is zero-based */
qemu_sglist_add(sglist, le64_to_cpu(tbl[i].addr),
- le32_to_cpu(tbl[i].flags_size) + 1);
+ prdt_tbl_entry_size(&tbl[i]));
}
}
diff --git a/hw/ide/ahci.h b/hw/ide/ahci.h
index 9a4064f892..f418b30ce7 100644
--- a/hw/ide/ahci.h
+++ b/hw/ide/ahci.h
@@ -201,6 +201,8 @@
#define AHCI_COMMAND_TABLE_ACMD 0x40
+#define AHCI_PRDT_SIZE_MASK 0x3fffff
+
#define IDE_FEATURE_DMA 1
#define READ_FPDMA_QUEUED 0x60