From: Prashant Kamble Date: Mon, 18 May 2026 02:25:35 +0000 (+0530) Subject: nvme: Fix PRP list pointer arithmetic for chained transfers X-Git-Tag: v2026.07-rc3~9^2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=4f510505988928e129e109811587c4a00d28ec56;p=thirdparty%2Fu-boot.git nvme: Fix PRP list pointer arithmetic for chained transfers The PRP setup code advances prp_pool using u64 pointer arithmetic: prp_pool += page_size; This increments the pointer by page_size * sizeof(u64) bytes instead of page_size bytes, resulting in invalid PRP list addresses when multiple PRP list pages are required. The issue becomes visible for large transfers, typically above 2 MiB when MDTS > 9. Fix it by using byte-wise pointer arithmetic when advancing to the next PRP list page. Signed-off-by: Prashant Kamble Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260518022535.17197-1-prashant.kamble223@gmail.com Signed-off-by: Neil Armstrong --- diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c index 4f9473367d3..0631b190b97 100644 --- a/drivers/nvme/nvme.c +++ b/drivers/nvme/nvme.c @@ -94,7 +94,7 @@ static int nvme_setup_prps(struct nvme_dev *dev, u64 *prp2, *(prp_pool + i) = cpu_to_le64((ulong)prp_pool + page_size); i = 0; - prp_pool += page_size; + prp_pool = (u64 *)((uintptr_t)prp_pool + page_size); } *(prp_pool + i++) = cpu_to_le64(dma_addr); dma_addr += page_size;