Re: [Qemu-devel] [PATCH v4 38/47] msix: implement pba write (but read-only)

[Paolo Bonzini]

On 24/09/2015 13:37, address@hidden wrote:
> From: Marc-André Lureau <address@hidden>
> 
> qpci_msix_pending() writes on pba region, causing qemu to SEGV:
> 
>   Program received signal SIGSEGV, Segmentation fault.
>   [Switching to Thread 0x7ffff7fba8c0 (LWP 25882)]
>   0x0000000000000000 in ?? ()
>   (gdb) bt
>   #0  0x0000000000000000 in  ()
>   #1  0x00005555556556c5 in memory_region_oldmmio_write_accessor 
> (mr=0x5555579f3f80, addr=0, value=0x7fffffffbf68, size=4, shift=0, 
> mask=4294967295, attrs=...) at /home/elmarco/src/qemu/memory.c:434
>   #2  0x00005555556558e1 in access_with_adjusted_size (addr=0, 
> value=0x7fffffffbf68, size=4, access_size_min=1, access_size_max=4, 
> access=0x55555565563e <memory_region_oldmmio_write_accessor>, 
> mr=0x5555579f3f80, attrs=...) at /home/elmarco/src/qemu/memory.c:506
>   #3  0x00005555556581eb in memory_region_dispatch_write (mr=0x5555579f3f80, 
> addr=0, data=0, size=4, attrs=...) at /home/elmarco/src/qemu/memory.c:1176
>   #4  0x000055555560b6f9 in address_space_rw (as=0x555555eff4e0 
> <address_space_memory>, addr=3759147008, attrs=..., buf=0x7fffffffc1b0 "", 
> len=4, is_write=true) at /home/elmarco/src/qemu/exec.c:2439
>   #5  0x000055555560baa2 in cpu_physical_memory_rw (addr=3759147008, 
> buf=0x7fffffffc1b0 "", len=4, is_write=1) at 
> /home/elmarco/src/qemu/exec.c:2534
>   #6  0x000055555564c005 in cpu_physical_memory_write (addr=3759147008, 
> buf=0x7fffffffc1b0, len=4) at 
> /home/elmarco/src/qemu/include/exec/cpu-common.h:80
>   #7  0x000055555564cd9c in qtest_process_command (chr=0x55555642b890, 
> words=0x5555578de4b0) at /home/elmarco/src/qemu/qtest.c:378
>   #8  0x000055555564db77 in qtest_process_inbuf (chr=0x55555642b890, 
> inbuf=0x55555641b340) at /home/elmarco/src/qemu/qtest.c:569
>   #9  0x000055555564dc07 in qtest_read (opaque=0x55555642b890, 
> buf=0x7fffffffc2e0 "writel 0xe0100800 0x0\n", size=22) at 
> /home/elmarco/src/qemu/qtest.c:581
>   #10 0x000055555574ce3e in qemu_chr_be_write (s=0x55555642b890, 
> buf=0x7fffffffc2e0 "writel 0xe0100800 0x0\n", len=22) at qemu-char.c:306
>   #11 0x0000555555751263 in tcp_chr_read (chan=0x55555642bcf0, cond=G_IO_IN, 
> opaque=0x55555642b890) at qemu-char.c:2876
>   #12 0x00007ffff64c9a8a in g_main_context_dispatch (context=0x55555641c400) 
> at gmain.c:3122
> 
> (without this patch, this can be reproduced with the ivshmem qtest)
> 
> Implement an empty mmio write to avoid the crash.
> 
> Signed-off-by: Marc-André Lureau <address@hidden>
> ---
>  hw/pci/msix.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/hw/pci/msix.c b/hw/pci/msix.c
> index 2fdada4..64c93d8 100644
> --- a/hw/pci/msix.c
> +++ b/hw/pci/msix.c
> @@ -200,8 +200,14 @@ static uint64_t msix_pba_mmio_read(void *opaque, hwaddr 
> addr,
>      return pci_get_long(dev->msix_pba + addr);
>  }
>  
> +static void msix_pba_mmio_write(void *opaque, hwaddr addr,
> +                                uint64_t val, unsigned size)
> +{
> +}
> +
>  static const MemoryRegionOps msix_pba_mmio_ops = {
>      .read = msix_pba_mmio_read,
> +    .write = msix_pba_mmio_write,
>      .endianness = DEVICE_LITTLE_ENDIAN,
>      .valid = {
>          .min_access_size = 4,
> 

Reviewed-by: Paolo Bonzini <address@hidden>