hw/cxl: Respect Media Operation max ops discovery semantics
The Discovery rejects requests where start_index + num_ops exceeds the total number of supported operations. Per CXL 4.0 Table 8-332, num_ops is the "Maximum number of Media Operation to return" - a maximum, not an exact count. The device should return up to that many entries, not reject the request. Cap num_ops to the available entries from start_index instead of erroring the command. Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media operations discovery commands cxl r3.2 (8.2.10.9.5.3)") Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Signed-off-by: Davidlohr Bueso <dave@stgolabs.net> Message-ID: <20260319184256.3762391-2-dave@stgolabs.net> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Davidlohr Bueso committed
Mar 19, 2026 at 11:42 UTC
bc72b2996c0b3f46d422c612b5093500c468fd6c
1 file changed
+11
-14
hw/cxl/cxl-mailbox-utils.c
+11
-14
@@ -2675,6 +2675,7 @@ static CXLRetCode media_operations_discovery(uint8_t *payload_in,
2675
} QEMU_PACKED *media_op_in_disc_pl = (void *)payload_in;
2676
struct media_op_discovery_out_pl *media_out_pl =
2677
(struct media_op_discovery_out_pl *)payload_out;
2678
+ int total = ARRAY_SIZE(media_op_matrix);
2679
int num_ops, start_index, i;
2680
int count = 0;
2681
@@ -2691,24 +2692,20 @@ static CXLRetCode media_operations_discovery(uint8_t *payload_in,
2692
* sub class command.
2693
*/
2694
if (media_op_in_disc_pl->dpa_range_count ||
2694
- start_index + num_ops > ARRAY_SIZE(media_op_matrix)) {
2695
+ start_index >= total) {
2696
return CXL_MBOX_INVALID_INPUT;
2697
}
2698
2699
media_out_pl->dpa_range_granularity = CXL_CACHE_LINE_SIZE;
2699
- media_out_pl->total_supported_operations =
2700
- ARRAY_SIZE(media_op_matrix);
2701
- if (num_ops > 0) {
2702
- for (i = start_index; i < start_index + num_ops; i++) {
2703
- media_out_pl->entry[count].media_op_class =
2704
- media_op_matrix[i].media_op_class;
2705
- media_out_pl->entry[count].media_op_subclass =
2706
- media_op_matrix[i].media_op_subclass;
2707
- count++;
2708
- if (count == num_ops) {
2709
- break;
2710
- }
2711
- }
2700
+ media_out_pl->total_supported_operations = total;
2701
+
2702
+ num_ops = MIN(num_ops, total - start_index);
2703
+ for (i = 0; i < num_ops; i++) {
2704
+ media_out_pl->entry[count].media_op_class =
2705
+ media_op_matrix[start_index + i].media_op_class;
2706
+ media_out_pl->entry[count].media_op_subclass =
2707
+ media_op_matrix[start_index + i].media_op_subclass;
2708
+ count++;
2709
}
2710
2711
media_out_pl->num_of_supported_operations = count;