This also depends on the cpu_physical_memory_map_fast series, so I'm keeping it separated.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- hw/vmw_pvscsi.c | 35 +++++++++++++++++++++++++++++++++++ 1 files changed, 35 insertions(+), 0 deletions(-) diff --git a/hw/vmw_pvscsi.c b/hw/vmw_pvscsi.c index 6f0b0b9..84bcfe6 100644 --- a/hw/vmw_pvscsi.c +++ b/hw/vmw_pvscsi.c @@ -383,6 +383,35 @@ static void pvscsi_transfer_data_with_sg_list(PVSCSIRequest *p, bool to_host, } } +static bool pvscsi_check_sg_list_addresses(PVSCSIRequest *p) +{ + uint64_t len = p->req.dataLen; + uint64_t n; + PVSCSISGState sg = { .elemAddr = p->req.dataAddr }; + while (len) { + while (!sg.resid) { + pvscsi_get_next_sg_elem(&sg); + } + n = MIN(len, sg.resid); + if (!cpu_physical_memory_map_check(sg.dataAddr, n)) { + return false; + } + + len -= n; + sg.resid -= n; + } + return true; +} + +static bool pvscsi_check_addresses(PVSCSIRequest *p) +{ + if (p->req.flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) { + return pvscsi_check_sg_list_addresses(p); + } else { + return cpu_physical_memory_map_check(p->req.dataAddr, p->req.dataLen); + } +} + /* Callback to indicate that the SCSI layer has completed a transfer. */ static void pvscsi_transfer_data(SCSIRequest *req, uint32_t len) { @@ -487,6 +516,12 @@ static void pvscsi_process_req(PVSCSIState *s, struct PVSCSIRingReqDesc *r) return; } + if (!pvscsi_check_addresses(p)) { + p->cmp.hostStatus = BTSTAT_DATARUN; + pvscsi_complete_req(s, p); + return; + } + if (r->flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) { p->sg.elemAddr = r->dataAddr; } -- 1.7.4.4