From: Denis V. Lunev <[email protected]> ahci_dma_prepare_buf() returns -1 when it cannot build a scatter-gather list, the PRDTL of zero case among them. ahci_pio_transfer() tests the result for truth, so a failure sets has_sglist and the transfer goes ahead against whatever s->sg holds. AHCI 1.3.1 is explicit about the zero case: "If this field is '0', then no data transfer shall occur with the command."
Test for a positive byte count instead. A successful walk that yields nothing to transfer is already handled by the size check below. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4043 Cc: John Snow <[email protected]> Cc: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Denis V. Lunev <[email protected]> --- hw/ide/ahci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c index 4c138b0c51..436a0eaab6 100644 --- a/hw/ide/ahci.c +++ b/hw/ide/ahci.c @@ -1428,7 +1428,7 @@ static bool ahci_pio_transfer(const IDEDMA *dma) goto out; } - if (ahci_dma_prepare_buf(dma, size)) { + if (ahci_dma_prepare_buf(dma, size) > 0) { has_sglist = 1; } -- 2.53.0
