Commit bc72b2996c for qemu.org

commit bc72b2996c0b3f46d422c612b5093500c468fd6c
Author: Davidlohr Bueso <dave@stgolabs.net>
Date:   Thu Mar 19 11:42:55 2026 -0700

    hw/cxl: Respect Media Operation max ops discovery semantics

    The Discovery rejects requests where start_index + num_ops
    exceeds the total number of supported operations. Per CXL 4.0
    Table 8-332, num_ops is the "Maximum number of Media Operation to
    return" - a maximum, not an exact count. The device should return
    up to that many entries, not reject the request.

    Cap num_ops to the available entries from start_index instead of
    erroring the command.

    Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media operations discovery commands cxl r3.2 (8.2.10.9.5.3)")
    Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
    Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
    Message-ID: <20260319184256.3762391-2-dave@stgolabs.net>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index c83b5f90d4..a5b70cd01c 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -2675,6 +2675,7 @@ static CXLRetCode media_operations_discovery(uint8_t *payload_in,
     } QEMU_PACKED *media_op_in_disc_pl = (void *)payload_in;
     struct media_op_discovery_out_pl *media_out_pl =
         (struct media_op_discovery_out_pl *)payload_out;
+    int total = ARRAY_SIZE(media_op_matrix);
     int num_ops, start_index, i;
     int count = 0;

@@ -2691,24 +2692,20 @@ static CXLRetCode media_operations_discovery(uint8_t *payload_in,
      * sub class command.
      */
     if (media_op_in_disc_pl->dpa_range_count ||
-        start_index + num_ops > ARRAY_SIZE(media_op_matrix)) {
+        start_index >= total) {
         return CXL_MBOX_INVALID_INPUT;
     }

     media_out_pl->dpa_range_granularity = CXL_CACHE_LINE_SIZE;
-    media_out_pl->total_supported_operations =
-                                     ARRAY_SIZE(media_op_matrix);
-    if (num_ops > 0) {
-        for (i = start_index; i < start_index + num_ops; i++) {
-            media_out_pl->entry[count].media_op_class =
-                    media_op_matrix[i].media_op_class;
-            media_out_pl->entry[count].media_op_subclass =
-                        media_op_matrix[i].media_op_subclass;
-            count++;
-            if (count == num_ops) {
-                break;
-            }
-        }
+    media_out_pl->total_supported_operations = total;
+
+    num_ops = MIN(num_ops, total - start_index);
+    for (i = 0; i < num_ops; i++) {
+        media_out_pl->entry[count].media_op_class =
+                media_op_matrix[start_index + i].media_op_class;
+        media_out_pl->entry[count].media_op_subclass =
+                media_op_matrix[start_index + i].media_op_subclass;
+        count++;
     }

     media_out_pl->num_of_supported_operations = count;