nvme: Fix PRP list pointer arithmetic for chained transfers

The PRP setup code advances prp_pool using u64 pointer
arithmetic:

        prp_pool += page_size;

This increments the pointer by page_size * sizeof(u64)
bytes instead of page_size bytes, resulting in invalid
PRP list addresses when multiple PRP list pages are
required.

The issue becomes visible for large transfers, typically
above 2 MiB when MDTS > 9.

Fix it by using byte-wise pointer arithmetic when
advancing to the next PRP list page.

Signed-off-by: Prashant Kamble <prashant.kamble223@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260518022535.17197-1-prashant.kamble223@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>

diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c
index 4f9473367d3ccb63fed78bea19d91898534d73ec..0631b190b9785c16b6c588c25b190ae3e2021d94 100644 (file)
--- a/drivers/nvme/nvme.c
+++ b/drivers/nvme/nvme.c
@@ -94,7 +94,7 @@ static int nvme_setup_prps(struct nvme_dev *dev, u64 *prp2,
                        *(prp_pool + i) = cpu_to_le64((ulong)prp_pool +
                                        page_size);
                        i = 0;
-                       prp_pool += page_size;
+                       prp_pool = (u64 *)((uintptr_t)prp_pool + page_size);
                }
                *(prp_pool + i++) = cpu_to_le64(dma_addr);
                dma_addr += page_size;