* [PATCH] system/memory: Split address_space_write_rom_internal
@ 2025-09-22 19:29 Richard Henderson
2025-09-26 12:33 ` Thomas Huth
2025-10-03 20:38 ` Philippe Mathieu-Daudé
0 siblings, 2 replies; 3+ messages in thread
From: Richard Henderson @ 2025-09-22 19:29 UTC (permalink / raw)
To: qemu-devel; +Cc: thuth
In 2dbaf58bbe7 we conditionally skipped the increment
of buf because ubsan warns incrementing NULL, and buf
is always NULL for FLUSH_CACHE. However, the existence
of the test for NULL caused Coverity to warn that the
memcpy in the WRITE_DATA case lacked a test for NULL.
Duplicate address_space_write_rom_internal into the two
callers, dropping enum write_rom_type, and simplify.
This eliminates buf in the flush case, and eliminates
the conditional increment of buf in the write case.
Coverity: CID 1621220
Fixes: 2dbaf58bbe7 ("system/physmem: Silence warning from ubsan")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
system/physmem.c | 90 ++++++++++++++++++++----------------------------
1 file changed, 37 insertions(+), 53 deletions(-)
diff --git a/system/physmem.c b/system/physmem.c
index ae8ecd50ea..5f76a5f767 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3187,63 +3187,33 @@ void cpu_physical_memory_rw(hwaddr addr, void *buf,
buf, len, is_write);
}
-enum write_rom_type {
- WRITE_DATA,
- FLUSH_CACHE,
-};
-
-static inline MemTxResult address_space_write_rom_internal(AddressSpace *as,
- hwaddr addr,
- MemTxAttrs attrs,
- const void *ptr,
- hwaddr len,
- enum write_rom_type type)
-{
- hwaddr l;
- uint8_t *ram_ptr;
- hwaddr addr1;
- MemoryRegion *mr;
- const uint8_t *buf = ptr;
-
- RCU_READ_LOCK_GUARD();
- while (len > 0) {
- l = len;
- mr = address_space_translate(as, addr, &addr1, &l, true, attrs);
-
- if (!memory_region_supports_direct_access(mr)) {
- l = memory_access_size(mr, l, addr1);
- } else {
- /* ROM/RAM case */
- ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
- switch (type) {
- case WRITE_DATA:
- memcpy(ram_ptr, buf, l);
- invalidate_and_set_dirty(mr, addr1, l);
- break;
- case FLUSH_CACHE:
- flush_idcache_range((uintptr_t)ram_ptr, (uintptr_t)ram_ptr, l);
- break;
- }
- }
- len -= l;
- addr += l;
- if (buf) {
- buf += l;
- }
- }
- return MEMTX_OK;
-}
-
/* used for ROM loading : can write in RAM and ROM */
MemTxResult address_space_write_rom(AddressSpace *as, hwaddr addr,
MemTxAttrs attrs,
const void *buf, hwaddr len)
{
- return address_space_write_rom_internal(as, addr, attrs,
- buf, len, WRITE_DATA);
+ RCU_READ_LOCK_GUARD();
+ while (len > 0) {
+ hwaddr addr1, l = len;
+ MemoryRegion *mr = address_space_translate(as, addr, &addr1, &l,
+ true, attrs);
+
+ if (!memory_region_supports_direct_access(mr)) {
+ l = memory_access_size(mr, l, addr1);
+ } else {
+ /* ROM/RAM case */
+ void *ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
+ memcpy(ram_ptr, buf, l);
+ invalidate_and_set_dirty(mr, addr1, l);
+ }
+ len -= l;
+ addr += l;
+ buf += l;
+ }
+ return MEMTX_OK;
}
-void cpu_flush_icache_range(hwaddr start, hwaddr len)
+void cpu_flush_icache_range(hwaddr addr, hwaddr len)
{
/*
* This function should do the same thing as an icache flush that was
@@ -3255,9 +3225,23 @@ void cpu_flush_icache_range(hwaddr start, hwaddr len)
return;
}
- address_space_write_rom_internal(&address_space_memory,
- start, MEMTXATTRS_UNSPECIFIED,
- NULL, len, FLUSH_CACHE);
+ RCU_READ_LOCK_GUARD();
+ while (len > 0) {
+ hwaddr addr1, l = len;
+ MemoryRegion *mr = address_space_translate(&address_space_memory,
+ addr, &addr1, &l, true,
+ MEMTXATTRS_UNSPECIFIED);
+
+ if (!memory_region_supports_direct_access(mr)) {
+ l = memory_access_size(mr, l, addr1);
+ } else {
+ /* ROM/RAM case */
+ void *ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
+ flush_idcache_range((uintptr_t)ram_ptr, (uintptr_t)ram_ptr, l);
+ }
+ len -= l;
+ addr += l;
+ }
}
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] system/memory: Split address_space_write_rom_internal
2025-09-22 19:29 [PATCH] system/memory: Split address_space_write_rom_internal Richard Henderson
@ 2025-09-26 12:33 ` Thomas Huth
2025-10-03 20:38 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Huth @ 2025-09-26 12:33 UTC (permalink / raw)
To: Richard Henderson, qemu-devel
On 22/09/2025 21.29, Richard Henderson wrote:
> In 2dbaf58bbe7 we conditionally skipped the increment
> of buf because ubsan warns incrementing NULL, and buf
> is always NULL for FLUSH_CACHE. However, the existence
> of the test for NULL caused Coverity to warn that the
> memcpy in the WRITE_DATA case lacked a test for NULL.
>
> Duplicate address_space_write_rom_internal into the two
> callers, dropping enum write_rom_type, and simplify.
> This eliminates buf in the flush case, and eliminates
> the conditional increment of buf in the write case.
>
> Coverity: CID 1621220
> Fixes: 2dbaf58bbe7 ("system/physmem: Silence warning from ubsan")
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> system/physmem.c | 90 ++++++++++++++++++++----------------------------
> 1 file changed, 37 insertions(+), 53 deletions(-)
>
> diff --git a/system/physmem.c b/system/physmem.c
> index ae8ecd50ea..5f76a5f767 100644
> --- a/system/physmem.c
> +++ b/system/physmem.c
> @@ -3187,63 +3187,33 @@ void cpu_physical_memory_rw(hwaddr addr, void *buf,
> buf, len, is_write);
> }
>
> -enum write_rom_type {
> - WRITE_DATA,
> - FLUSH_CACHE,
> -};
> -
> -static inline MemTxResult address_space_write_rom_internal(AddressSpace *as,
> - hwaddr addr,
> - MemTxAttrs attrs,
> - const void *ptr,
> - hwaddr len,
> - enum write_rom_type type)
> -{
> - hwaddr l;
> - uint8_t *ram_ptr;
> - hwaddr addr1;
> - MemoryRegion *mr;
> - const uint8_t *buf = ptr;
> -
> - RCU_READ_LOCK_GUARD();
> - while (len > 0) {
> - l = len;
> - mr = address_space_translate(as, addr, &addr1, &l, true, attrs);
> -
> - if (!memory_region_supports_direct_access(mr)) {
> - l = memory_access_size(mr, l, addr1);
> - } else {
> - /* ROM/RAM case */
> - ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
> - switch (type) {
> - case WRITE_DATA:
> - memcpy(ram_ptr, buf, l);
> - invalidate_and_set_dirty(mr, addr1, l);
> - break;
> - case FLUSH_CACHE:
> - flush_idcache_range((uintptr_t)ram_ptr, (uintptr_t)ram_ptr, l);
> - break;
> - }
> - }
> - len -= l;
> - addr += l;
> - if (buf) {
> - buf += l;
> - }
> - }
> - return MEMTX_OK;
> -}
> -
> /* used for ROM loading : can write in RAM and ROM */
> MemTxResult address_space_write_rom(AddressSpace *as, hwaddr addr,
> MemTxAttrs attrs,
> const void *buf, hwaddr len)
> {
> - return address_space_write_rom_internal(as, addr, attrs,
> - buf, len, WRITE_DATA);
> + RCU_READ_LOCK_GUARD();
> + while (len > 0) {
> + hwaddr addr1, l = len;
> + MemoryRegion *mr = address_space_translate(as, addr, &addr1, &l,
> + true, attrs);
> +
> + if (!memory_region_supports_direct_access(mr)) {
> + l = memory_access_size(mr, l, addr1);
> + } else {
> + /* ROM/RAM case */
> + void *ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
> + memcpy(ram_ptr, buf, l);
> + invalidate_and_set_dirty(mr, addr1, l);
> + }
> + len -= l;
> + addr += l;
> + buf += l;
> + }
> + return MEMTX_OK;
> }
>
> -void cpu_flush_icache_range(hwaddr start, hwaddr len)
> +void cpu_flush_icache_range(hwaddr addr, hwaddr len)
> {
> /*
> * This function should do the same thing as an icache flush that was
> @@ -3255,9 +3225,23 @@ void cpu_flush_icache_range(hwaddr start, hwaddr len)
> return;
> }
>
> - address_space_write_rom_internal(&address_space_memory,
> - start, MEMTXATTRS_UNSPECIFIED,
> - NULL, len, FLUSH_CACHE);
> + RCU_READ_LOCK_GUARD();
> + while (len > 0) {
> + hwaddr addr1, l = len;
> + MemoryRegion *mr = address_space_translate(&address_space_memory,
> + addr, &addr1, &l, true,
> + MEMTXATTRS_UNSPECIFIED);
> +
> + if (!memory_region_supports_direct_access(mr)) {
> + l = memory_access_size(mr, l, addr1);
> + } else {
> + /* ROM/RAM case */
> + void *ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
> + flush_idcache_range((uintptr_t)ram_ptr, (uintptr_t)ram_ptr, l);
> + }
> + len -= l;
> + addr += l;
> + }
> }
Thanks for untangling the mess!
Reviewed-by: Thomas Huth <thuth@redhat.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] system/memory: Split address_space_write_rom_internal
2025-09-22 19:29 [PATCH] system/memory: Split address_space_write_rom_internal Richard Henderson
2025-09-26 12:33 ` Thomas Huth
@ 2025-10-03 20:38 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 3+ messages in thread
From: Philippe Mathieu-Daudé @ 2025-10-03 20:38 UTC (permalink / raw)
To: Richard Henderson, qemu-devel; +Cc: thuth
On 22/9/25 21:29, Richard Henderson wrote:
> In 2dbaf58bbe7 we conditionally skipped the increment
> of buf because ubsan warns incrementing NULL, and buf
> is always NULL for FLUSH_CACHE. However, the existence
> of the test for NULL caused Coverity to warn that the
> memcpy in the WRITE_DATA case lacked a test for NULL.
>
> Duplicate address_space_write_rom_internal into the two
> callers, dropping enum write_rom_type, and simplify.
> This eliminates buf in the flush case, and eliminates
> the conditional increment of buf in the write case.
>
> Coverity: CID 1621220
> Fixes: 2dbaf58bbe7 ("system/physmem: Silence warning from ubsan")
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> system/physmem.c | 90 ++++++++++++++++++++----------------------------
> 1 file changed, 37 insertions(+), 53 deletions(-)
Patch queued, thanks!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-10-03 20:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-22 19:29 [PATCH] system/memory: Split address_space_write_rom_internal Richard Henderson
2025-09-26 12:33 ` Thomas Huth
2025-10-03 20:38 ` Philippe Mathieu-Daudé
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).