[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 19/19] exec: skip MMIO regions correctly in cpu_physi
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 19/19] exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal |
Date: |
Mon, 6 Jul 2015 14:35:08 +0200 |
Loading the BIOS in the mac99 machine is interesting, because there is a
PROM in the middle of the BIOS region (from 16K to 32K). Before memory
region accesses were clamped, when QEMU was asked to load a BIOS from
0xfff00000 to 0xffffffff it would put even those 16K from the BIOS file
into the region. This is weird because those 16K were not actually
visible between 0xfff04000 and 0xfff07fff. However, it worked.
After clamping was added, this also worked. In this case, the
cpu_physical_memory_write_rom_internal function split the write in
three parts: the first 16K were copied, the PROM area (second 16K) were
ignored, then the rest was copied.
Problems then started with commit 965eb2f (exec: do not clamp accesses
to MMIO regions, 2015-06-17). Clamping accesses is not done for MMIO
regions because they can overlap wildly, and MMIO registers can be
expected to perform full-width accesses based only on their address
(with no respect for adjacent registers that could decode to completely
different MemoryRegions). However, this lack of clamping also applied
to the PROM area! cpu_physical_memory_write_rom_internal thus failed
to copy the third range above, i.e. only copied the first 16K of the BIOS.
In effect, address_space_translate is expecting _something else_ to do
the clamping for MMIO regions if the incoming length is large. This
"something else" is memory_access_size in the case of address_space_rw,
so use the same logic in cpu_physical_memory_write_rom_internal.
Reported-by: Alexander Graf <address@hidden>
Reviewed-by: Laurent Vivier <address@hidden>
Tested-by: Laurent Vivier <address@hidden>
Fixes: 965eb2f
Signed-off-by: Paolo Bonzini <address@hidden>
---
exec.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/exec.c b/exec.c
index 3457f7e..251dc79 100644
--- a/exec.c
+++ b/exec.c
@@ -353,6 +353,18 @@ address_space_translate_internal(AddressSpaceDispatch *d,
hwaddr addr, hwaddr *x
*xlat = addr + section->offset_within_region;
mr = section->mr;
+
+ /* MMIO registers can be expected to perform full-width accesses based only
+ * on their address, without considering adjacent registers that could
+ * decode to completely different MemoryRegions. When such registers
+ * exist (e.g. I/O ports 0xcf8 and 0xcf9 on most PC chipsets), MMIO
+ * regions overlap wildly. For this reason we cannot clamp the accesses
+ * here.
+ *
+ * If the length is small (as is the case for address_space_ldl/stl),
+ * everything works fine. If the incoming length is large, however,
+ * the caller really has to do the clamping through memory_access_size.
+ */
if (memory_region_is_ram(mr)) {
diff = int128_sub(section->size, int128_make64(addr));
*plen = int128_get64(int128_min(diff, int128_make64(*plen)));
@@ -2491,7 +2503,7 @@ static inline void
cpu_physical_memory_write_rom_internal(AddressSpace *as,
if (!(memory_region_is_ram(mr) ||
memory_region_is_romd(mr))) {
- /* do nothing */
+ l = memory_access_size(mr, l, addr1);
} else {
addr1 += memory_region_get_ram_addr(mr);
/* ROM/RAM case */
--
2.4.3
- [Qemu-devel] [PULL 06/19] include/exec: Move tb hash functions out, (continued)
- [Qemu-devel] [PULL 06/19] include/exec: Move tb hash functions out, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 08/19] Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 09/19] main-loop: use qemu_mutex_lock_iothread consistently, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 11/19] memory: Add global-locking property to memory regions, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 12/19] exec: pull qemu_flush_coalesced_mmio_buffer() into address_space_rw/ld*/st*, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 13/19] memory: let address_space_rw/ld*/st* run outside the BQL, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 10/19] main-loop: introduce qemu_mutex_iothread_locked, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 15/19] kvm: Switch to unlocked PIO, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 14/19] kvm: First step to push iothread lock out of inner run loop, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 16/19] acpi: mark PMTIMER as unlocked, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 19/19] exec: skip MMIO regions correctly in cpu_physical_memory_write_rom_internal,
Paolo Bonzini <=
- [Qemu-devel] [PULL 18/19] Stop including qemu-common.h in memory.h, Paolo Bonzini, 2015/07/06
- [Qemu-devel] [PULL 17/19] kvm: Switch to unlocked MMIO, Paolo Bonzini, 2015/07/06