From: Jeuk Kim <jeuk20.kim@samsung.com>
Date: Mon, 2 Feb 2026 05:31:03 +0000 (+0900)
Subject: hw/ufs: Ensure DBC of PRDT uses only lower 18 bits
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=289e6a3edf5041a9f96c3fb792845b94b5b3c666;p=thirdparty%2Fqemu.git

hw/ufs: Ensure DBC of PRDT uses only lower 18 bits

The UFS spec defines the PRDT data byte count as an 18-bit field. This
commit masks the value to the lower 18 bits to prevent incorrect
transfer lengths and ensure compliance.

Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
---

diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
index cab42ae7b6..d3f08f2ba9 100644
--- a/hw/ufs/ufs.c
+++ b/hw/ufs/ufs.c
@@ -224,7 +224,8 @@ static MemTxResult ufs_dma_read_prdt(UfsRequest *req)
 
     for (uint16_t i = 0; i < prdt_len; ++i) {
         hwaddr data_dma_addr = le64_to_cpu(prd_entries[i].addr);
-        uint32_t data_byte_count = le32_to_cpu(prd_entries[i].size) + 1;
+        uint32_t data_byte_count =
+            (le32_to_cpu(prd_entries[i].size) & 0x3ffff) + 1;
         qemu_sglist_add(req->sg, data_dma_addr, data_byte_count);
         req->data_len += data_byte_count;
     }