Commit 2713717148 for qemu.org

commit 2713717148f538577e5f2a5d4d9dc272f7a8dc4b
Author: Denis V. Lunev <den@openvz.org>
Date:   Mon Aug 17 23:44:59 2026 +0200

    hw/ide/ahci: treat a failed PRDT walk as a PIO transfer failure

    ahci_dma_prepare_buf() returns -1 when it cannot build a scatter-gather
    list, the PRDTL of zero case among them. ahci_pio_transfer() tests the
    result for truth, so a failure sets has_sglist and the transfer goes
    ahead against whatever s->sg holds. AHCI 1.3.1 is explicit about the
    zero case: "If this field is '0', then no data transfer shall occur
    with the command."

    Test for a positive byte count instead. A successful walk that yields
    nothing to transfer is already handled by the size check below.

    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4043
    Cc: John Snow <jsnow@redhat.com>
    Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Signed-off-by: Denis V. Lunev <den@openvz.org>

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 4c138b0c51..436a0eaab6 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1428,7 +1428,7 @@ static bool ahci_pio_transfer(const IDEDMA *dma)
         goto out;
     }

-    if (ahci_dma_prepare_buf(dma, size)) {
+    if (ahci_dma_prepare_buf(dma, size) > 0) {
         has_sglist = 1;
     }