From nobody Mon Feb 9 08:57:13 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1584377842; cv=none; d=zohomail.com; s=zohoarc; b=PrgOP81UeNzpsrI5sts8HrR4LLTmUuc4AwiR+6FTviOHA+dLQsx0cT6hfcobfZgqd+/n7rMZxyYEGZw/Y4JmYfA6L7wfvehb+zuAC7zqjizcwNUAWP2XM+VcYFFGqv8GRIlVVmiZMo+3+QiZec2LpZFizCVBtxDJWGDd5AlzbHw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1584377842; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=Fb36ne+gCAdDvVP/dhaN8ZeFbtcgy6lIY8TFWLENtlU=; b=c4V54sqKLrJg1PXqKhDvsUqIKPQGM2vDgb1qZSfL92nQtH4Vuajho558wohihP+E5gYVA5JBPnhQgaj3pQW7Uh/G0nENYuxS20swe++Dsukm80jt6KH+vcHErZNswnpz8jDFMDgnzhIdRKqmE2tQz7O7tnmCeMlggWgn3z1QngQ= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1584377842438365.63664713568426; Mon, 16 Mar 2020 09:57:22 -0700 (PDT) Received: from localhost ([::1]:42914 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jDt31-0005pn-Nm for importer@patchew.org; Mon, 16 Mar 2020 12:57:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54312) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jDqlL-0000Uf-MG for qemu-devel@nongnu.org; Mon, 16 Mar 2020 10:30:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jDqlI-0005Fq-6E for qemu-devel@nongnu.org; Mon, 16 Mar 2020 10:30:39 -0400 Received: from charlie.dont.surf ([128.199.63.193]:48820) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1jDql8-00023u-PB; Mon, 16 Mar 2020 10:30:27 -0400 Received: from apples.local (80-62-117-52-mobile.dk.customer.tdc.net [80.62.117.52]) by charlie.dont.surf (Postfix) with ESMTPSA id BA3CEBF9AA; Mon, 16 Mar 2020 14:29:49 +0000 (UTC) From: Klaus Jensen To: qemu-block@nongnu.org Subject: [PATCH v6 28/42] nvme: verify validity of prp lists in the cmb Date: Mon, 16 Mar 2020 07:29:14 -0700 Message-Id: <20200316142928.153431-29-its@irrelevant.dk> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200316142928.153431-1-its@irrelevant.dk> References: <20200316142928.153431-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 128.199.63.193 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Beata Michalska , qemu-devel@nongnu.org, Max Reitz , Klaus Jensen , Keith Busch , Javier Gonzalez , Maxim Levitsky Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" From: Klaus Jensen Before this patch the device already supported this, but it did not check for the validity of it nor announced the support in the LISTS field. If some of the PRPs in a PRP list are in the CMB, then ALL entries must be there. This patch makes sure that is verified as well as properly announcing support for PRP lists in the CMB. Signed-off-by: Klaus Jensen Reviewed-by: Maxim Levitsky --- hw/block/nvme.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index 850087aac967..eecfad694bf8 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -210,6 +210,7 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList *q= sg, QEMUIOVector *iov, trans_len =3D MIN(len, trans_len); int num_prps =3D (len >> n->page_bits) + 1; uint16_t status; + bool prp_list_in_cmb =3D false; =20 trace_nvme_dev_map_prp(nvme_cid(req), trans_len, len, prp1, prp2, num_prps); @@ -237,11 +238,16 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList = *qsg, QEMUIOVector *iov, status =3D NVME_INVALID_FIELD | NVME_DNR; goto unmap; } + if (len > n->page_size) { uint64_t prp_list[n->max_prp_ents]; uint32_t nents, prp_trans; int i =3D 0; =20 + if (nvme_addr_is_cmb(n, prp2)) { + prp_list_in_cmb =3D true; + } + nents =3D (len + n->page_size - 1) >> n->page_bits; prp_trans =3D MIN(n->max_prp_ents, nents) * sizeof(uint64_t); nvme_addr_read(n, prp2, (void *)prp_list, prp_trans); @@ -255,6 +261,11 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList *= qsg, QEMUIOVector *iov, goto unmap; } =20 + if (prp_list_in_cmb !=3D nvme_addr_is_cmb(n, prp_ent))= { + status =3D NVME_INVALID_USE_OF_CMB | NVME_DNR; + goto unmap; + } + i =3D 0; nents =3D (len + n->page_size - 1) >> n->page_bits; prp_trans =3D MIN(n->max_prp_ents, nents) * sizeof(uin= t64_t); @@ -274,6 +285,7 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList *q= sg, QEMUIOVector *iov, if (status) { goto unmap; } + len -=3D trans_len; i++; } @@ -1931,7 +1943,7 @@ static void nvme_init_cmb(NvmeCtrl *n, PCIDevice *pci= _dev) =20 NVME_CMBSZ_SET_SQS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_CQS(n->bar.cmbsz, 0); - NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 0); + NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_RDS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_WDS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_SZU(n->bar.cmbsz, 2); --=20 2.25.1