On 13/09/18 01:31, Peter Maydell wrote: > On 12 September 2018 at 18:43, Laszlo Ersek <ler...@redhat.com> wrote: >> On 09/12/18 14:54, Peter Maydell wrote: >>> There's patches on-list which drop the old_mmio field from the MemoryRegion >>> struct entirely, so I think this patch as it stands is obsolete. >>> >>> Currently our semantics are "you must provide both read and write, even >>> if one of them just always returns 0 / does nothing / returns an error". >> >> That's new to me. Has this always been the case? > > Pretty sure it has, yes, because the code assumes that if you can > get a guest read then your MemoryRegion provides an accessor for it. > If your guest never actually tries to do a read then of course we'll > never notice... > >> There are several >> static MemoryRegionOps structures that don't conform. (See the end of my >> other email: >> <84da6f02-1f60-4bc7-92da-6a7f74deded3@redhat.com">http://mid.mail-archive.com/84da6f02-1f60-4bc7-92da-6a7f74deded3@redhat.com>.) >> Beyond the one that Li Qiang reported directly ("fw_cfg_ctl_mem_read"). >> >> Are all of those ops guest-triggerable QEMU crashers? > > Some of them are special cases like the notdirty-memory one where > reads always go to host RAM rather than taking the slow path via > the io accessor. But others are probably guest crashers. > >>> We could probably reasonably assert this at the point when the >>> MemoryRegionOps is registered. >> >> Apparently, we should have... > > Yeah. Or we could define a default for if there's no read function, > which I guess should be the same as what we do if > memory_region_access_valid() fails. If we want that then the > simplest thing is for memory_region_access_valid() itself to > check that at least one of the accessor functions exists and > return false if none do. (But as I mention above we should get > all the "old_mmio is going away" patches in first and base the > change on that, or there'll be a conflict.)
This sounds familiar to me. I remember whilst working on the Mac uninorth patches I couldn't quite figure out why a simple change to the PCI bridge IO address space started to cause some accesses to fail: it was because the guest was issuing a periodic read to an address without a MemoryRegion which was now failing with MEMTX_ERROR rather than the returning 0 which was the previous behaviour. The fix was ultimately to add an unassigned_io_ops to the parent MemoryRegion which I found out was being sneakily added by the old code, although it certainly had me scratching my head for a while... ATB, Mark.
