guest exploitation of the XIVE interrupt controller (POWER9)

[Qemu-devel] [RFC PATCH 10/26] ppc/xive: record interrupt source MMIO address for hcalls

Posted by Cédric Le Goater 8 years, 4 months ago

The address of the MMIO page through which the Event State Buffer is
controlled is returned to the guest by the H_INT_GET_SOURCE_INFO hcall.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/intc/xive.c        | 3 +++
 include/hw/ppc/xive.h | 1 +
 2 files changed, 4 insertions(+)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index a1cb87a07b76..0db97fd33981 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -344,6 +344,9 @@ static void xive_ics_realize(ICSState *ics, Error **errp)
                                 ICS_BASE(xs)->offset * (1 << xs->esb_shift),
                                 &xs->esb_iomem);
 
+    /* Record base address which is needed by the hcalls */
+    xs->esb_base = x->vc_base + ICS_BASE(xs)->offset * (1 << xs->esb_shift);
+
     qemu_register_reset(xive_ics_reset, xs);
 }
 
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 1178300c9df3..b06bc861b845 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -43,6 +43,7 @@ struct XiveICSState {
 
     uint64_t     flags;
     uint32_t     esb_shift;
+    hwaddr       esb_base;
     MemoryRegion esb_iomem;
 
     XIVE         *xive;
-- 
2.7.5

Re: [Qemu-devel] [RFC PATCH 10/26] ppc/xive: record interrupt source MMIO address for hcalls

Posted by David Gibson 8 years, 3 months ago

On Wed, Jul 05, 2017 at 07:13:23PM +0200, Cédric Le Goater wrote:
> The address of the MMIO page through which the Event State Buffer is
> controlled is returned to the guest by the H_INT_GET_SOURCE_INFO hcall.
> 
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> ---
>  hw/intc/xive.c        | 3 +++
>  include/hw/ppc/xive.h | 1 +
>  2 files changed, 4 insertions(+)
> 
> diff --git a/hw/intc/xive.c b/hw/intc/xive.c
> index a1cb87a07b76..0db97fd33981 100644
> --- a/hw/intc/xive.c
> +++ b/hw/intc/xive.c
> @@ -344,6 +344,9 @@ static void xive_ics_realize(ICSState *ics, Error **errp)
>                                  ICS_BASE(xs)->offset * (1 << xs->esb_shift),
>                                  &xs->esb_iomem);
>  
> +    /* Record base address which is needed by the hcalls */
> +    xs->esb_base = x->vc_base + ICS_BASE(xs)->offset * (1 << xs->esb_shift);

This doesn't seem like it needs to be stored in the persistent object
- it can be calculated when the hcall is made.  Plus if it's for the
hcll it only makes sense for spapr.

>      qemu_register_reset(xive_ics_reset, xs);
>  }
>  
> diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
> index 1178300c9df3..b06bc861b845 100644
> --- a/include/hw/ppc/xive.h
> +++ b/include/hw/ppc/xive.h
> @@ -43,6 +43,7 @@ struct XiveICSState {
>  
>      uint64_t     flags;
>      uint32_t     esb_shift;
> +    hwaddr       esb_base;
>      MemoryRegion esb_iomem;
>  
>      XIVE         *xive;

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

Re: [Qemu-devel] [RFC PATCH 10/26] ppc/xive: record interrupt source MMIO address for hcalls

Posted by Cédric Le Goater 8 years, 3 months ago

On 07/24/2017 07:11 AM, David Gibson wrote:
> On Wed, Jul 05, 2017 at 07:13:23PM +0200, Cédric Le Goater wrote:
>> The address of the MMIO page through which the Event State Buffer is
>> controlled is returned to the guest by the H_INT_GET_SOURCE_INFO hcall.
>>
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> ---
>>  hw/intc/xive.c        | 3 +++
>>  include/hw/ppc/xive.h | 1 +
>>  2 files changed, 4 insertions(+)
>>
>> diff --git a/hw/intc/xive.c b/hw/intc/xive.c
>> index a1cb87a07b76..0db97fd33981 100644
>> --- a/hw/intc/xive.c
>> +++ b/hw/intc/xive.c
>> @@ -344,6 +344,9 @@ static void xive_ics_realize(ICSState *ics, Error **errp)
>>                                  ICS_BASE(xs)->offset * (1 << xs->esb_shift),
>>                                  &xs->esb_iomem);
>>  
>> +    /* Record base address which is needed by the hcalls */
>> +    xs->esb_base = x->vc_base + ICS_BASE(xs)->offset * (1 << xs->esb_shift);
> 
> This doesn't seem like it needs to be stored in the persistent object
> - it can be calculated when the hcall is made.  Plus if it's for the
> hcll it only makes sense for spapr.

yes. you are right. I will get rid of it.

Thanks,

C. 

>>      qemu_register_reset(xive_ics_reset, xs);
>>  }
>>  
>> diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
>> index 1178300c9df3..b06bc861b845 100644
>> --- a/include/hw/ppc/xive.h
>> +++ b/include/hw/ppc/xive.h
>> @@ -43,6 +43,7 @@ struct XiveICSState {
>>  
>>      uint64_t     flags;
>>      uint32_t     esb_shift;
>> +    hwaddr       esb_base;
>>      MemoryRegion esb_iomem;
>>  
>>      XIVE         *xive;
>