From nobody Mon Feb 9 16:18:42 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1593460556; cv=none; d=zohomail.com; s=zohoarc; b=ZARX71+xQ1Xdn7b2vUTOd5ViYcqSOO5jOrgHLz6izlEu68+42bkf0V+cDThvZv+3qqPxXWs0PVey8lV67vsk0hC6CLgpBq+jDjcTFA3blKICVhcOoq3h3haN51ifWtM+BcXEPfNWmc6TDxzSdoIT3LCZ91L53ajWG0HUKKetduk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1593460556; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=ZcViI5oUKDR+zTARpAii+V8T/gl4HAa57pwe9CqWBsE=; b=EowISeOvHh1XwNFrj3W55TRYSrxEYvDehE1xSBZ291v9fKeM2ZQ7xhcaieyTFQLc08iZXgD9RKF7t7/vyglzMGVS0MsaQKQ+8PEpXsMLTg4cB1c0r4yWALjZPHd4qPbkMkVW5wmDnaMSw+uIQMWFi85jmazSoRPWgezKJr4es9s= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1593460555936765.5186581433956; Mon, 29 Jun 2020 12:55:55 -0700 (PDT) Received: from localhost ([::1]:50522 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jpzsg-0007YM-FM for importer@patchew.org; Mon, 29 Jun 2020 15:55:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57504) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jpznV-00078z-Il; Mon, 29 Jun 2020 15:50:33 -0400 Received: from charlie.dont.surf ([128.199.63.193]:46174) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jpznS-0005wy-MC; Mon, 29 Jun 2020 15:50:33 -0400 Received: from apples.local (80-167-98-190-cable.dk.customer.tdc.net [80.167.98.190]) by charlie.dont.surf (Postfix) with ESMTPSA id C9774BF804; Mon, 29 Jun 2020 19:50:26 +0000 (UTC) From: Klaus Jensen To: qemu-block@nongnu.org Subject: [PATCH 08/17] hw/block/nvme: verify validity of prp lists in the cmb Date: Mon, 29 Jun 2020 21:50:08 +0200 Message-Id: <20200629195017.1217056-9-its@irrelevant.dk> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200629195017.1217056-1-its@irrelevant.dk> References: <20200629195017.1217056-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=128.199.63.193; envelope-from=its@irrelevant.dk; helo=charlie.dont.surf X-detected-operating-system: by eggs.gnu.org: First seen = 2020/06/29 14:26:53 X-ACL-Warn: Detected OS = Linux 3.11 and newer [fuzzy] X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Klaus Jensen , qemu-devel@nongnu.org, Max Reitz , Klaus Jensen , Keith Busch , Maxim Levitsky Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" From: Klaus Jensen Before this patch the device already supported PRP lists in the CMB, but it did not check for the validity of it nor announced the support in the Identify Controller data structure LISTS field. If some of the PRPs in a PRP list are in the CMB, then ALL entries must be there. This patch makes sure that requirement is verified as well as properly announcing support for PRP lists in the CMB. Signed-off-by: Klaus Jensen Reviewed-by: Maxim Levitsky --- hw/block/nvme.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index d236a3cdee54..55b305458152 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -237,6 +237,7 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList *q= sg, QEMUIOVector *iov, trans_len =3D MIN(len, trans_len); int num_prps =3D (len >> n->page_bits) + 1; uint16_t status; + bool prp_list_in_cmb =3D false; =20 trace_pci_nvme_map_prp(nvme_cid(req), trans_len, len, prp1, prp2, num_prps); @@ -264,11 +265,16 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList = *qsg, QEMUIOVector *iov, status =3D NVME_INVALID_FIELD | NVME_DNR; goto unmap; } + if (len > n->page_size) { uint64_t prp_list[n->max_prp_ents]; uint32_t nents, prp_trans; int i =3D 0; =20 + if (nvme_addr_is_cmb(n, prp2)) { + prp_list_in_cmb =3D true; + } + nents =3D (len + n->page_size - 1) >> n->page_bits; prp_trans =3D MIN(n->max_prp_ents, nents) * sizeof(uint64_t); nvme_addr_read(n, prp2, (void *)prp_list, prp_trans); @@ -282,6 +288,11 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList *= qsg, QEMUIOVector *iov, goto unmap; } =20 + if (prp_list_in_cmb !=3D nvme_addr_is_cmb(n, prp_ent))= { + status =3D NVME_INVALID_USE_OF_CMB | NVME_DNR; + goto unmap; + } + i =3D 0; nents =3D (len + n->page_size - 1) >> n->page_bits; prp_trans =3D MIN(n->max_prp_ents, nents) * sizeof(uin= t64_t); @@ -301,6 +312,7 @@ static uint16_t nvme_map_prp(NvmeCtrl *n, QEMUSGList *q= sg, QEMUIOVector *iov, if (status) { goto unmap; } + len -=3D trans_len; i++; } @@ -2097,7 +2109,7 @@ static void nvme_init_cmb(NvmeCtrl *n, PCIDevice *pci= _dev) =20 NVME_CMBSZ_SET_SQS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_CQS(n->bar.cmbsz, 0); - NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 0); + NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_RDS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_WDS(n->bar.cmbsz, 1); NVME_CMBSZ_SET_SZU(n->bar.cmbsz, 2); /* MBs */ --=20 2.27.0