[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 05/41] ppc/pnv: use a do-while() loop in pnv_phb3_translate_tve()
From: |
Cédric Le Goater |
Subject: |
[PULL 05/41] ppc/pnv: use a do-while() loop in pnv_phb3_translate_tve() |
Date: |
Mon, 31 Jan 2022 12:07:35 +0100 |
From: Daniel Henrique Barboza <danielhb413@gmail.com>
The 'taddr' variable is left unintialized, being set only inside the
"while ((lev--) >= 0)" loop where we get the TCE address. The 'lev' var
is an int32_t that is being initiliazed by the GETFIELD() macro, which
returns an uint64_t.
For a human reader this means that 'lev' will always be positive or zero.
But some compilers may beg to differ. 'lev' being an int32_t can in theory
be set as negative, and the "while ((lev--) >= 0)" loop might never be
reached, and 'taddr' will be left unitialized. This can cause phb3_error()
to use 'taddr' uninitialized down below:
if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
A quick way of fixing it is to use a do/while() loop. This will keep the
same semanting as the existing while() loop does and the compiler will
understand that 'taddr' will be initialized at least once.
Suggested-by: Matheus K. Ferst <matheus.ferst@eldorado.org.br>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/573
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-Id: <20220127122234.842145-2-danielhb413@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
hw/pci-host/pnv_phb3.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
index a757f1a58ec8..aafd46b635e8 100644
--- a/hw/pci-host/pnv_phb3.c
+++ b/hw/pci-host/pnv_phb3.c
@@ -792,7 +792,9 @@ static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds,
hwaddr addr,
sh = tbl_shift * lev + tce_shift;
/* TODO: Multi-level untested */
- while ((lev--) >= 0) {
+ do {
+ lev--;
+
/* Grab the TCE address */
taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
if (dma_memory_read(&address_space_memory, taddr, &tce,
@@ -813,7 +815,7 @@ static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds,
hwaddr addr,
}
sh -= tbl_shift;
base = tce & ~0xfffull;
- }
+ } while (lev >= 0);
/* We exit the loop with TCE being the final TCE */
if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
--
2.34.1
- [PULL 25/41] target/ppc: 405: Instruction storage interrupt cleanup, (continued)
- [PULL 25/41] target/ppc: 405: Instruction storage interrupt cleanup, Cédric Le Goater, 2022/01/31
- [PULL 33/41] target/ppc: Introduce powerpc_excp_74xx, Cédric Le Goater, 2022/01/31
- [PULL 06/41] ppc/pnv: use a do-while() loop in pnv_phb4_translate_tve(), Cédric Le Goater, 2022/01/31
- [PULL 19/41] target/ppc: 405: Machine check exception cleanup, Cédric Le Goater, 2022/01/31
- [PULL 10/41] target/ppc: Fix test on mmu_model in hreg_compute_hflags_value(), Cédric Le Goater, 2022/01/31
- [PULL 27/41] target/ppc: 405: Watchdog timer exception cleanup, Cédric Le Goater, 2022/01/31
- [PULL 35/41] target/ppc: 74xx: Machine Check exception cleanup, Cédric Le Goater, 2022/01/31
- [PULL 32/41] target/ppc: books: Program exception cleanup, Cédric Le Goater, 2022/01/31
- [PULL 01/41] spapr: Force 32bit when resetting a core, Cédric Le Goater, 2022/01/31
- [PULL 30/41] target/ppc: books: Machine Check exception cleanup, Cédric Le Goater, 2022/01/31
- [PULL 05/41] ppc/pnv: use a do-while() loop in pnv_phb3_translate_tve(),
Cédric Le Goater <=
- [PULL 16/41] target/ppc: Introduce powerpc_excp_40x, Cédric Le Goater, 2022/01/31
- [PULL 12/41] hw/ppc/vof: Add missing includes, Cédric Le Goater, 2022/01/31
- [PULL 38/41] target/ppc: 74xx: System Call exception cleanup, Cédric Le Goater, 2022/01/31
- [PULL 29/41] target/ppc: Simplify powerpc_excp_books, Cédric Le Goater, 2022/01/31
- [PULL 41/41] target/ppc: Remove support for the PowerPC 602 CPU, Cédric Le Goater, 2022/01/31
- [PULL 24/41] target/ppc: 405: Data Storage exception cleanup, Cédric Le Goater, 2022/01/31
- [PULL 40/41] target/ppc: 74xx: Set SRRs directly in exception code, Cédric Le Goater, 2022/01/31
- [PULL 07/41] ppc/xive: check return value of ldq_be_dma(), Cédric Le Goater, 2022/01/31
- [PULL 02/41] target/ppc: 603: fix restore of GPRs 0-3 on rfi, Cédric Le Goater, 2022/01/31