diff options
| author | Daniel Henrique Barboza | 2022-01-28 13:15:02 +0100 |
|---|---|---|
| committer | Cédric Le Goater | 2022-01-28 13:15:02 +0100 |
| commit | 799c179ed844b01542e729405c0bf5ef4cd294dc (patch) | |
| tree | 159e58ca1cca6eef2f384d7c65e835e58860c142 /hw/pci-host | |
| parent | ppc/pnv: use a do-while() loop in pnv_phb3_translate_tve() (diff) | |
| download | qemu-799c179ed844b01542e729405c0bf5ef4cd294dc.tar.gz qemu-799c179ed844b01542e729405c0bf5ef4cd294dc.tar.xz qemu-799c179ed844b01542e729405c0bf5ef4cd294dc.zip | |
ppc/pnv: use a do-while() loop in pnv_phb4_translate_tve()
pnv_phb4_translate_tve() is quite similar to pnv_phb3_translate_tve(),
and that includes the fact that 'taddr' can be considered uninitialized
when throwing the "TCE access fault" error because, in theory, the loop
that sets 'taddr' can be skippable due to 'lev' being an signed int.
No one complained about this specific case yet, but since we took the
time to handle the same situtation in pnv_phb3_translate_tve(), let's
replicate it here as well.
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Matheus Ferst <matheus.ferst@eldorado.org.br>
Message-Id: <20220127122234.842145-3-danielhb413@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Diffstat (limited to 'hw/pci-host')
| -rw-r--r-- | hw/pci-host/pnv_phb4.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c index ee56377c02..e91249ef64 100644 --- a/hw/pci-host/pnv_phb4.c +++ b/hw/pci-host/pnv_phb4.c @@ -1267,7 +1267,9 @@ static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr, /* TODO: Limit to support IO page sizes */ /* TODO: Multi-level untested */ - while ((lev--) >= 0) { + do { + lev--; + /* Grab the TCE address */ taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3); if (dma_memory_read(&address_space_memory, taddr, &tce, @@ -1288,7 +1290,7 @@ static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr, } sh -= tbl_shift; base = tce & ~0xfffull; - } + } while (lev >= 0); /* We exit the loop with TCE being the final TCE */ if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) { |