| Message ID | 20230705081400.218408-1-fbarrat@linux.ibm.com |
|---|---|
| State | New |
| Headers | show |
| Series | pnv/xive2: Always pass a presenter object when accessing the TIMA | expand |
On 7/5/23 10:14, Frederic Barrat wrote: > The low-level functions to access the TIMA take a presenter object as > a first argument. When accessing the TIMA from the IC BAR, > i.e. indirect calls, we currently pass a NULL pointer for the > presenter argument. While it appears ok with the current usage, it's > dangerous. And it's pretty easy to figure out the presenter in that > context, so this patch fixes it. > > Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Thanks, C. > --- > hw/intc/pnv_xive2.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c > index 82fcd3ea22..bbb44a533c 100644 > --- a/hw/intc/pnv_xive2.c > +++ b/hw/intc/pnv_xive2.c > @@ -1624,6 +1624,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset, > unsigned size) > { > PnvXive2 *xive = PNV_XIVE2(opaque); > + XivePresenter *xptr = XIVE_PRESENTER(xive); > hwaddr hw_page_offset; > uint32_t pir; > XiveTCTX *tctx; > @@ -1633,7 +1634,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset, > hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset); > tctx = pnv_xive2_get_indirect_tctx(xive, pir); > if (tctx) { > - val = xive_tctx_tm_read(NULL, tctx, hw_page_offset, size); > + val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size); > } > > return val; > @@ -1643,6 +1644,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset, > uint64_t val, unsigned size) > { > PnvXive2 *xive = PNV_XIVE2(opaque); > + XivePresenter *xptr = XIVE_PRESENTER(xive); > hwaddr hw_page_offset; > uint32_t pir; > XiveTCTX *tctx; > @@ -1651,7 +1653,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset, > hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset); > tctx = pnv_xive2_get_indirect_tctx(xive, pir); > if (tctx) { > - xive_tctx_tm_write(NULL, tctx, hw_page_offset, val, size); > + xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size); > } > } >
Queued in gitlab.com/danielhb/qemu/tree/ppc-next. Thanks, Daniel On 7/5/23 05:14, Frederic Barrat wrote: > The low-level functions to access the TIMA take a presenter object as > a first argument. When accessing the TIMA from the IC BAR, > i.e. indirect calls, we currently pass a NULL pointer for the > presenter argument. While it appears ok with the current usage, it's > dangerous. And it's pretty easy to figure out the presenter in that > context, so this patch fixes it. > > Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> > --- > hw/intc/pnv_xive2.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c > index 82fcd3ea22..bbb44a533c 100644 > --- a/hw/intc/pnv_xive2.c > +++ b/hw/intc/pnv_xive2.c > @@ -1624,6 +1624,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset, > unsigned size) > { > PnvXive2 *xive = PNV_XIVE2(opaque); > + XivePresenter *xptr = XIVE_PRESENTER(xive); > hwaddr hw_page_offset; > uint32_t pir; > XiveTCTX *tctx; > @@ -1633,7 +1634,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset, > hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset); > tctx = pnv_xive2_get_indirect_tctx(xive, pir); > if (tctx) { > - val = xive_tctx_tm_read(NULL, tctx, hw_page_offset, size); > + val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size); > } > > return val; > @@ -1643,6 +1644,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset, > uint64_t val, unsigned size) > { > PnvXive2 *xive = PNV_XIVE2(opaque); > + XivePresenter *xptr = XIVE_PRESENTER(xive); > hwaddr hw_page_offset; > uint32_t pir; > XiveTCTX *tctx; > @@ -1651,7 +1653,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset, > hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset); > tctx = pnv_xive2_get_indirect_tctx(xive, pir); > if (tctx) { > - xive_tctx_tm_write(NULL, tctx, hw_page_offset, val, size); > + xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size); > } > } >
diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c index 82fcd3ea22..bbb44a533c 100644 --- a/hw/intc/pnv_xive2.c +++ b/hw/intc/pnv_xive2.c @@ -1624,6 +1624,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset, unsigned size) { PnvXive2 *xive = PNV_XIVE2(opaque); + XivePresenter *xptr = XIVE_PRESENTER(xive); hwaddr hw_page_offset; uint32_t pir; XiveTCTX *tctx; @@ -1633,7 +1634,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset, hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset); tctx = pnv_xive2_get_indirect_tctx(xive, pir); if (tctx) { - val = xive_tctx_tm_read(NULL, tctx, hw_page_offset, size); + val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size); } return val; @@ -1643,6 +1644,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) { PnvXive2 *xive = PNV_XIVE2(opaque); + XivePresenter *xptr = XIVE_PRESENTER(xive); hwaddr hw_page_offset; uint32_t pir; XiveTCTX *tctx; @@ -1651,7 +1653,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset, hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset); tctx = pnv_xive2_get_indirect_tctx(xive, pir); if (tctx) { - xive_tctx_tm_write(NULL, tctx, hw_page_offset, val, size); + xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size); } }
The low-level functions to access the TIMA take a presenter object as a first argument. When accessing the TIMA from the IC BAR, i.e. indirect calls, we currently pass a NULL pointer for the presenter argument. While it appears ok with the current usage, it's dangerous. And it's pretty easy to figure out the presenter in that context, so this patch fixes it. Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com> --- hw/intc/pnv_xive2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)