Re: [PATCH v3 4/8] s390/vfio_ccw: ensure first IDAW remains constant

[Matthew Rosato]

On 7/23/26 1:47 PM, Eric Farman wrote:
> The first IDAW in a list does not need to be on a 2K/4K boundary
> like all others, and so is read separately to accurately calculate
> the size of the buffer needed to read the full IDAL.
> 
> Verify that the address found in the first IDAW is unchanged between
> reads, to ensure a consistent set of IDAWs being worked with.
> 
> Fixes: 01aa26c672c0 ("s390/cio: Combine direct and indirect CCW paths")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Eric Farman <farman@xxxxxxxxxxxxx>
> ---
>  drivers/s390/cio/vfio_ccw_cp.c | 15 +++++++++++++++
>  drivers/s390/cio/vfio_ccw_cp.h |  1 +
>  2 files changed, 16 insertions(+)
> 
> diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
> index 258a99930c6a..06b6bc6142a0 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.c
> +++ b/drivers/s390/cio/vfio_ccw_cp.c
> @@ -533,6 +533,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
>  		&container_of(cp, struct vfio_ccw_private, cp)->vdev;
>  	dma64_t *idaws;
>  	dma32_t *idaws_f1;
> +	u64 first_idaw;
>  	int idal_len = idaw_nr * sizeof(*idaws);
>  	int idaw_size = idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE;
>  	int idaw_mask = ~(idaw_size - 1);
> @@ -549,6 +550,17 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
>  			kfree(idaws);
>  			return ERR_PTR(ret);
>  		}
> +
> +		if (cp->orb.cmd.c64)
> +			first_idaw = dma64_to_u64(idaws[0]);
> +		else
> +			first_idaw = dma32_to_u32(idaws[0] >> 32);

Sashiko mentions this one, since first_idaw is a u64 would
first_idaw = dma64_to_u64(idaws[0]) >> 32;
work?

Then you are doing the >> 32 against a u64 just like what
is done in ccw_count_idaws() where we set guest_iova for
comparison below.

Other than this line, this patch LGTM.

> +
> +		/* Unexpected mismatch from earlier read */
> +		if (first_idaw != cp->guest_iova) {
> +			kfree(idaws);
> +			return ERR_PTR(-EINVAL);
> +		}
>  	} else {
>  		/* Fabricate an IDAL based off CCW data address */
>  		if (cp->orb.cmd.c64) {
> @@ -614,6 +626,9 @@ static int ccw_count_idaws(struct ccw1 *ccw,
>  		iova = dma32_to_u32(ccw->cda);
>  	}
>  
> +	/* Save the read address for later */
> +	cp->guest_iova = iova;
> +
>  	/* Format-1 IDAWs operate on 2K each */
>  	if (!cp->orb.cmd.c64)
>  		return idal_2k_nr_words((void *)iova, bytes);
> diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h
> index dc91a317ef19..d547dbc969cc 100644
> --- a/drivers/s390/cio/vfio_ccw_cp.h
> +++ b/drivers/s390/cio/vfio_ccw_cp.h
> @@ -43,6 +43,7 @@ struct channel_program {
>  	union orb orb;
>  	bool initialized;
>  	struct ccw1 *guest_cp;
> +	u64 guest_iova;
>  	int ccwchain_count;
>  };
>