From: Li Qiang <liq3ea@gmail.com>

This patch set try to add the missed read callback for memory region.
Without this patchset, when the guest reads the IO port/memory, it will
cause an NULL-dereference issue. For example, add 
"-device isa-debug-exit" to command, then read the 0x501 port, it causes a 
SIGSEGV.

The only exception is 'readonly_mem_ops' as its read is directly 
access the underlying host ram as the comments says.

These missed read callback is mostly pointed by Laszlo Ersek.



Li Qiang (8):
  fw_cfg_mem: add read memory region callback
  hw: debugexit: add read callback
  hw: hyperv_testdev: add read callback
  hw: pc-testdev: add read memory region callback
  hw: designware: add read memory region callback
  hw: pvrdma: add read memory region callback
  hw: sun4c: add read memory region callback
  exec: add read callback for notdirty memory region

 exec.c                    |  7 +++++++
 hw/misc/debugexit.c       |  6 ++++++
 hw/misc/hyperv_testdev.c  | 10 ++++++++--
 hw/misc/pc-testdev.c      | 20 ++++++++++++++++----
 hw/nvram/fw_cfg.c         |  6 ++++++
 hw/pci-host/designware.c  |  7 +++++++
 hw/rdma/vmw/pvrdma_main.c |  6 ++++++
 hw/sparc64/sun4u.c        |  6 ++++++
 8 files changed, 62 insertions(+), 6 deletions(-)

-- 
2.17.1

Hi Li,

On 9/12/18 6:01 PM, Li Qiang wrote:
> From: Li Qiang <liq3ea@gmail.com>
> 
> This patch set try to add the missed read callback for memory region.
> Without this patchset, when the guest reads the IO port/memory, it will
> cause an NULL-dereference issue. For example, add 
> "-device isa-debug-exit" to command, then read the 0x501 port, it causes a 
> SIGSEGV.
> 
> The only exception is 'readonly_mem_ops' as its read is directly 
> access the underlying host ram as the comments says.
> 
> These missed read callback is mostly pointed by Laszlo Ersek.
> 
> 
> 
> Li Qiang (8):
>   fw_cfg_mem: add read memory region callback
>   hw: debugexit: add read callback
>   hw: hyperv_testdev: add read callback
>   hw: pc-testdev: add read memory region callback
>   hw: designware: add read memory region callback
>   hw: pvrdma: add read memory region callback
>   hw: sun4c: add read memory region callback
>   exec: add read callback for notdirty memory region

Why not rather simply add a check in
memory_region_oldmmio_read_accessor() instead?

Eventually:

{
    uint64_t tmp;
    int idx = ctz32(size);

    if (unlikely(mr->ops->old_mmio.write[idx]
                 && !mr->ops->old_mmio.read[idx])) {
        tmp = 0; /* XXX is 0 the expected value??? */
    } else {
        tmp = mr->ops->old_mmio.read[idx](mr->opaque, addr);
    }
    ...

Philippe Mathieu-Daudé <f4bug@amsat.org> 于2018年9月13日周四 上午1:12写道：

> Hi Li,
>
> On 9/12/18 6:01 PM, Li Qiang wrote:
> > From: Li Qiang <liq3ea@gmail.com>
> >
> > This patch set try to add the missed read callback for memory region.
> > Without this patchset, when the guest reads the IO port/memory, it will
> > cause an NULL-dereference issue. For example, add
> > "-device isa-debug-exit" to command, then read the 0x501 port, it causes
> a
> > SIGSEGV.
> >
> > The only exception is 'readonly_mem_ops' as its read is directly
> > access the underlying host ram as the comments says.
> >
> > These missed read callback is mostly pointed by Laszlo Ersek.
> >
> >
> >
> > Li Qiang (8):
> >   fw_cfg_mem: add read memory region callback
> >   hw: debugexit: add read callback
> >   hw: hyperv_testdev: add read callback
> >   hw: pc-testdev: add read memory region callback
> >   hw: designware: add read memory region callback
> >   hw: pvrdma: add read memory region callback
> >   hw: sun4c: add read memory region callback
> >   exec: add read callback for notdirty memory region
>
> Why not rather simply add a check in
> memory_region_oldmmio_read_accessor() instead?
>
> Eventually:
>
> {
>     uint64_t tmp;
>     int idx = ctz32(size);
>
>     if (unlikely(mr->ops->old_mmio.write[idx]
>                  && !mr->ops->old_mmio.read[idx])) {
>         tmp = 0; /* XXX is 0 the expected value??? */
>     } else {
>         tmp = mr->ops->old_mmio.read[idx](mr->opaque, addr);
>     }
>     ...
>

Hi, I have sent this patch. But...


We have discussed in another thread:
-->https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg01391.html

Thanks,
Li Qiang