* hw/nvme: fix verification of select field in namespace attachment
[not found] <CGME20210823114601epcas5p17b488aeeae3dd41d32ab3df4fd235256@epcas5p1.samsung.com>
@ 2021-08-23 11:03 ` Naveen
2021-08-24 6:31 ` Klaus Jensen
2021-09-06 6:04 ` Klaus Jensen
0 siblings, 2 replies; 3+ messages in thread
From: Naveen @ 2021-08-23 11:03 UTC (permalink / raw)
To: qemu-devel
Cc: fam, kwolf, anuj.singh, jg123.choi, qemu-block, k.jensen, Naveen,
d.palani, mreitz, its, Minwoo Im, stefanha, kbusch, prakash.v,
raphel.david
Fix is added to check for reserved value in select field for
namespace attachment
Signed-off-by: Naveen Nagar <naveen.n1@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
cc: Minwoo Im <minwoo.im.dev@gmail.com>
---
hw/nvme/ctrl.c | 13 +++++++++----
include/block/nvme.h | 5 +++++
2 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 6baf9e0..2c59c74 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -5191,7 +5191,7 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {};
uint32_t nsid = le32_to_cpu(req->cmd.nsid);
uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
- bool attach = !(dw10 & 0xf);
+ uint8_t sel = dw10 & 0xf;
uint16_t *nr_ids = &list[0];
uint16_t *ids = &list[1];
uint16_t ret;
@@ -5224,7 +5224,8 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
return NVME_NS_CTRL_LIST_INVALID | NVME_DNR;
}
- if (attach) {
+ switch (sel) {
+ case NVME_NS_ATTACHMENT_ATTACH:
if (nvme_ns(ctrl, nsid)) {
return NVME_NS_ALREADY_ATTACHED | NVME_DNR;
}
@@ -5235,7 +5236,8 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
nvme_attach_ns(ctrl, ns);
nvme_select_iocs_ns(ctrl, ns);
- } else {
+ break;
+ case NVME_NS_ATTACHMENT_DETACH:
if (!nvme_ns(ctrl, nsid)) {
return NVME_NS_NOT_ATTACHED | NVME_DNR;
}
@@ -5244,8 +5246,11 @@ static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
ns->attached--;
nvme_update_dmrsl(ctrl);
+ break;
+ default:
+ return NVME_INVALID_FIELD | NVME_DNR;
}
-
+
/*
* Add namespace id to the changed namespace id list for event clearing
* via Get Log Page command.
diff --git a/include/block/nvme.h b/include/block/nvme.h
index 77aae01..e3bd47b 100644
--- a/include/block/nvme.h
+++ b/include/block/nvme.h
@@ -1154,6 +1154,11 @@ enum NvmeIdCtrlCmic {
NVME_CMIC_MULTI_CTRL = 1 << 1,
};
+enum NvmeNsAttachmentOperation {
+ NVME_NS_ATTACHMENT_ATTACH = 0x0,
+ NVME_NS_ATTACHMENT_DETACH = 0x1,
+};
+
#define NVME_CTRL_SQES_MIN(sqes) ((sqes) & 0xf)
#define NVME_CTRL_SQES_MAX(sqes) (((sqes) >> 4) & 0xf)
#define NVME_CTRL_CQES_MIN(cqes) ((cqes) & 0xf)
--
1.8.3.1
^ permalink raw reply related [flat|nested] 3+ messages in thread