From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.43; helo=mga05.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id CA42D2194D3AE for ; Sun, 11 Nov 2018 17:34:33 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Nov 2018 17:34:33 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,493,1534834800"; d="scan'208";a="88524104" Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.9]) by orsmga007.jf.intel.com with ESMTP; 11 Nov 2018 17:34:31 -0800 From: Hao Wu To: edk2-devel@lists.01.org Cc: Hao Wu , Andrew Fish , Laszlo Ersek , Leif Lindholm , Michael D Kinney , Liming Gao , Ruiyu Ni , Jiewen Yao , Star Zeng Date: Mon, 12 Nov 2018 09:34:25 +0800 Message-Id: <20181112013425.28588-2-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20181112013425.28588-1-hao.a.wu@intel.com> References: <20181112013425.28588-1-hao.a.wu@intel.com> Subject: [PATCH v1 1/1] MdeModulePkg/NvmExpressPei: Refine data buffer & len check in PassThru X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Nov 2018 01:34:34 -0000 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1142 The fix is similar to commit ebb6c7633bca47fcd5b460a67e18e4a717ea91cc. We found that a similar fix should be applied to the NVMe PEI driver as well. Hence, this one is for the PEI counterpart driver. According to the the NVM Express spec Revision 1.1, for some commands (like Get/Set Feature Command, Figure 89 & 90 of the spec), the Memory Buffer maybe optional although the command opcode indicates there is a data transfer between host & controller (Get/Set Feature Command, Figure 38 of the spec). Hence, this commit refine the checks for the 'TransferLength' and 'TransferBuffer' field of the EDKII_PEI_NVM_EXPRESS_PASS_THRU_COMMAND_PACKET structure to address this issue. Cc: Andrew Fish Cc: Laszlo Ersek Cc: Leif Lindholm Cc: Michael D Kinney Cc: Liming Gao Cc: Ruiyu Ni Cc: Jiewen Yao Cc: Star Zeng Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu --- MdeModulePkg/Bus/Pci/NvmExpressPei/NvmExpressPeiPassThru.c | 33 +++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/MdeModulePkg/Bus/Pci/NvmExpressPei/NvmExpressPeiPassThru.c b/MdeModulePkg/Bus/Pci/NvmExpressPei/NvmExpressPeiPassThru.c index 81ad01b7ee..ddcfe03998 100644 --- a/MdeModulePkg/Bus/Pci/NvmExpressPei/NvmExpressPeiPassThru.c +++ b/MdeModulePkg/Bus/Pci/NvmExpressPei/NvmExpressPeiPassThru.c @@ -442,7 +442,8 @@ NvmePassThru ( // specific addresses. // if ((Sq->Opc & (BIT0 | BIT1)) != 0) { - if ((Packet->TransferLength == 0) || (Packet->TransferBuffer == NULL)) { + if (((Packet->TransferLength != 0) && (Packet->TransferBuffer == NULL)) || + ((Packet->TransferLength == 0) && (Packet->TransferBuffer != NULL))) { return EFI_INVALID_PARAMETER; } @@ -468,21 +469,23 @@ NvmePassThru ( MapOp = EdkiiIoMmuOperationBusMasterWrite; } - MapLength = Packet->TransferLength; - Status = IoMmuMap ( - MapOp, - Packet->TransferBuffer, - &MapLength, - &PhyAddr, - &MapData - ); - if (EFI_ERROR (Status) || (MapLength != Packet->TransferLength)) { - Status = EFI_OUT_OF_RESOURCES; - DEBUG ((DEBUG_ERROR, "%a: Fail to map data buffer.\n", __FUNCTION__)); - goto Exit; - } + if ((Packet->TransferLength != 0) && (Packet->TransferBuffer != NULL)) { + MapLength = Packet->TransferLength; + Status = IoMmuMap ( + MapOp, + Packet->TransferBuffer, + &MapLength, + &PhyAddr, + &MapData + ); + if (EFI_ERROR (Status) || (MapLength != Packet->TransferLength)) { + Status = EFI_OUT_OF_RESOURCES; + DEBUG ((DEBUG_ERROR, "%a: Fail to map data buffer.\n", __FUNCTION__)); + goto Exit; + } - Sq->Prp[0] = PhyAddr; + Sq->Prp[0] = PhyAddr; + } if((Packet->MetadataLength != 0) && (Packet->MetadataBuffer != NULL)) { MapLength = Packet->MetadataLength; -- 2.12.0.windows.1