d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bhyve: Fix NVMe iovec construction for large IOs

Browse Source 
The UEFI driver included with Rocky Linux 8.4 uncovered an existing bug
in the NVMe emulation's construction of iovec's.

By default, NVMe data transfer operations use a scatter-gather list in
which all entries point to a fixed size memory region. For example, if
the Memory Page Size is 4KiB, a 2MiB IO requires 512 entries. Lists
themselves are also fixed size (default is 512 entries).

Because the list size is fixed, the last entry is special. If the IO
requires more than 512 entries, the last entry in the list contains the
address of the next list of entries. But if the IO requires exactly 512
entries, the last entry points to data.

The NVMe emulation missed this logic and unconditionally treated the
last entry as a pointer to the next list. Fix is to check if the
remaining data is greater than the page size before using the last entry
as a pointer to the next list.

PR:		256422
Reported by:	dave@syix.com
Tested by:	jason@tubnor.net
MFC after:	5 days
Relnotes:	yes
Reviewed by:	imp, grehan
Differential Revision:	https://reviews.freebsd.org/D30897
This commit is contained in:
Chuck Tuffli 2021-06-27 15:14:52 -07:00
parent c7f048ab35
commit 91064841d7
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
usr.sbin/bhyve/pci_nvme.c
View File

@ -1976,7 +1976,7 @@ nvme_write_read_blockif(struct pci_nvme_softc *sc,
/* PRP2 is pointer to a physical region page list */
while (bytes) {
/* Last entry in list points to the next list */
if (prp_list == last) {
if ((prp_list == last) && (bytes > PAGE_SIZE)) {
uint64_t prp = *prp_list;
prp_list = paddr_guest2host(vmctx, prp,