From: Klaus Birkelund Jensen <klaus@birkelund.eu>
Date: Sat, 18 May 2019 07:39:05 +0000 (+0200)
Subject: nvme: fix copy direction in DMA reads going to CMB
X-Git-Tag: v4.1.0-rc0~102^2~18
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=25349e8250e67e7d126fbf0ad213811b62e7e529;p=thirdparty%2Fqemu.git

nvme: fix copy direction in DMA reads going to CMB

`nvme_dma_read_prp` erronously used `qemu_iovec_*to*_buf` instead of
`qemu_iovec_*from*_buf` when the request involved the controller memory
buffer.

Signed-off-by: Klaus Birkelund Jensen <klaus.jensen@cnexlabs.com>
Reviewed-by: Kenneth Heitke <kenneth.heitke@intel.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 7caf92532a0..63a5b58849f 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -238,7 +238,7 @@ static uint16_t nvme_dma_read_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
         }
         qemu_sglist_destroy(&qsg);
     } else {
-        if (unlikely(qemu_iovec_to_buf(&iov, 0, ptr, len) != len)) {
+        if (unlikely(qemu_iovec_from_buf(&iov, 0, ptr, len) != len)) {
             trace_nvme_err_invalid_dma();
             status = NVME_INVALID_FIELD | NVME_DNR;
         }