[Qemu-devel] [RFC PATCH 3/9] pvscsi: check validity of DMA addresses in advance

[Paolo Bonzini <pbonzini@redhat.com>]

This also depends on the cpu_physical_memory_map_fast series, so I'm
keeping it separated.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/vmw_pvscsi.c |   35 +++++++++++++++++++++++++++++++++++
 1 files changed, 35 insertions(+), 0 deletions(-)

diff --git a/hw/vmw_pvscsi.c b/hw/vmw_pvscsi.c
index 6f0b0b9..84bcfe6 100644
--- a/hw/vmw_pvscsi.c
+++ b/hw/vmw_pvscsi.c
@@ -383,6 +383,35 @@ static void pvscsi_transfer_data_with_sg_list(PVSCSIRequest *p, bool to_host,
     }
 }
 
+static bool pvscsi_check_sg_list_addresses(PVSCSIRequest *p)
+{
+    uint64_t len = p->req.dataLen;
+    uint64_t n;
+    PVSCSISGState sg = { .elemAddr = p->req.dataAddr };
+    while (len) {
+        while (!sg.resid) {
+            pvscsi_get_next_sg_elem(&sg);
+        }
+        n = MIN(len, sg.resid);
+        if (!cpu_physical_memory_map_check(sg.dataAddr, n)) {
+            return false;
+        }
+
+        len -= n;
+	sg.resid -= n;
+    }
+    return true;
+}
+
+static bool pvscsi_check_addresses(PVSCSIRequest *p)
+{
+    if (p->req.flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
+        return pvscsi_check_sg_list_addresses(p);
+    } else {
+        return cpu_physical_memory_map_check(p->req.dataAddr, p->req.dataLen);
+    }
+}
+
 /* Callback to indicate that the SCSI layer has completed a transfer.  */
 static void pvscsi_transfer_data(SCSIRequest *req, uint32_t len)
 {
@@ -487,6 +516,12 @@ static void pvscsi_process_req(PVSCSIState *s, struct PVSCSIRingReqDesc *r)
         return;
     }
 
+    if (!pvscsi_check_addresses(p)) {
+        p->cmp.hostStatus = BTSTAT_DATARUN;
+        pvscsi_complete_req(s, p);
+        return;
+    }
+
     if (r->flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
         p->sg.elemAddr = r->dataAddr;
     }
-- 
1.7.4.4