From 158b65945192eb01708fa13718d92053ad583bba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 25 Oct 2019 13:01:13 +0200 Subject: [PATCH 1/3] hw/misc/grlib_ahb_apb_pnp: Avoid crash when writing to PnP registers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Guests can crash QEMU when writting to PnP registers: $ echo 'writeb 0x800ff042 69' | qemu-system-sparc -M leon3_generic -S -bios /etc/magic -qtest stdio [I 1571938309.932255] OPENED [R +0.063474] writeb 0x800ff042 69 Segmentation fault (core dumped) (gdb) bt #0 0x0000000000000000 in () #1 0x0000555f4bcdf0bc in memory_region_write_with_attrs_accessor (mr=0x555f4d7be8c0, addr=66, value=0x7fff07d00f08, size=1, shift=0, mask=255, attrs=...) at memory.c:503 #2 0x0000555f4bcdf185 in access_with_adjusted_size (addr=66, value=0x7fff07d00f08, size=1, access_size_min=1, access_size_max=4, access_fn=0x555f4bcdeff4 , mr=0x555f4d7be8c0, attrs=...) at memory.c:539 #3 0x0000555f4bce2243 in memory_region_dispatch_write (mr=0x555f4d7be8c0, addr=66, data=69, op=MO_8, attrs=...) at memory.c:1489 #4 0x0000555f4bc80b20 in flatview_write_continue (fv=0x555f4d92c400, addr=2148528194, attrs=..., buf=0x7fff07d01120 "E", len=1, addr1=66, l=1, mr=0x555f4d7be8c0) at exec.c:3161 #5 0x0000555f4bc80c65 in flatview_write (fv=0x555f4d92c400, addr=2148528194, attrs=..., buf=0x7fff07d01120 "E", len=1) at exec.c:3201 #6 0x0000555f4bc80fb0 in address_space_write (as=0x555f4d7aa460, addr=2148528194, attrs=..., buf=0x7fff07d01120 "E", len=1) at exec.c:3291 #7 0x0000555f4bc8101d in address_space_rw (as=0x555f4d7aa460, addr=2148528194, attrs=..., buf=0x7fff07d01120 "E", len=1, is_write=true) at exec.c:3301 #8 0x0000555f4bcdb388 in qtest_process_command (chr=0x555f4c2ed7e0 , words=0x555f4db0c5d0) at qtest.c:432 Instead of crashing, log the access as unimplemented. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: KONRAD Frederic Message-Id: <20191025110114.27091-2-philmd@redhat.com> Signed-off-by: Laurent Vivier --- hw/misc/grlib_ahb_apb_pnp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/misc/grlib_ahb_apb_pnp.c b/hw/misc/grlib_ahb_apb_pnp.c index 7338461694..f3c015d2c3 100644 --- a/hw/misc/grlib_ahb_apb_pnp.c +++ b/hw/misc/grlib_ahb_apb_pnp.c @@ -22,6 +22,7 @@ */ #include "qemu/osdep.h" +#include "qemu/log.h" #include "hw/sysbus.h" #include "hw/misc/grlib_ahb_apb_pnp.h" @@ -231,8 +232,15 @@ static uint64_t grlib_apb_pnp_read(void *opaque, hwaddr offset, unsigned size) return apb_pnp->regs[offset >> 2]; } +static void grlib_apb_pnp_write(void *opaque, hwaddr addr, + uint64_t val, unsigned size) +{ + qemu_log_mask(LOG_UNIMP, "%s not implemented\n", __func__); +} + static const MemoryRegionOps grlib_apb_pnp_ops = { .read = grlib_apb_pnp_read, + .write = grlib_apb_pnp_write, .endianness = DEVICE_BIG_ENDIAN, }; From 0fbe394a64ac9ceb13a98f43d078cd48d3006498 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Fri, 25 Oct 2019 13:01:14 +0200 Subject: [PATCH 2/3] hw/misc/grlib_ahb_apb_pnp: Fix 8-bit accesses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Plug & Play region of the AHB/APB bridge can be accessed by various word size, however the implementation is clearly restricted to 32-bit: static uint64_t grlib_apb_pnp_read(void *opaque, hwaddr offset, unsigned size) { APBPnp *apb_pnp = GRLIB_APB_PNP(opaque); return apb_pnp->regs[offset >> 2]; } Set the MemoryRegionOps::impl min/max fields to 32-bit, so memory.c::access_with_adjusted_size() can adjust when the access is not 32-bit. This is required to run RTEMS on leon3, the grlib scanning functions do byte accesses. Reported-by: Jiri Gaisler Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: KONRAD Frederic Message-Id: <20191025110114.27091-3-philmd@redhat.com> Signed-off-by: Laurent Vivier --- hw/misc/grlib_ahb_apb_pnp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/misc/grlib_ahb_apb_pnp.c b/hw/misc/grlib_ahb_apb_pnp.c index f3c015d2c3..e230e25363 100644 --- a/hw/misc/grlib_ahb_apb_pnp.c +++ b/hw/misc/grlib_ahb_apb_pnp.c @@ -242,6 +242,10 @@ static const MemoryRegionOps grlib_apb_pnp_ops = { .read = grlib_apb_pnp_read, .write = grlib_apb_pnp_write, .endianness = DEVICE_BIG_ENDIAN, + .impl = { + .min_access_size = 4, + .max_access_size = 4, + }, }; static void grlib_apb_pnp_realize(DeviceState *dev, Error **errp) From df59feb197cda31a8b807c13bf509259db9e018f Mon Sep 17 00:00:00 2001 From: "Dr. David Alan Gilbert" Date: Mon, 4 Nov 2019 18:52:02 +0000 Subject: [PATCH 3/3] global: Squash 'the the' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 'the' has a tendency to double up; squash them back down. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Alex Bennée Reviewed-by: Laurent Vivier Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20191104185202.102504-1-dgilbert@redhat.com> [lv: removed disas/libvixl/vixl/invalset.h change] Signed-off-by: Laurent Vivier --- docs/interop/pr-helper.rst | 2 +- docs/specs/ppc-spapr-hotplug.txt | 2 +- docs/specs/ppc-xive.rst | 2 +- docs/specs/tpm.txt | 2 +- include/hw/xen/interface/io/blkif.h | 2 +- scripts/dump-guest-memory.py | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/interop/pr-helper.rst b/docs/interop/pr-helper.rst index 9f76d5bcf9..e926f0a6c9 100644 --- a/docs/interop/pr-helper.rst +++ b/docs/interop/pr-helper.rst @@ -10,7 +10,7 @@ can delegate implementation of persistent reservations to an external restricting access to block devices to specific initiators in a shared storage setup. -For a more detailed reference please refer the the SCSI Primary +For a more detailed reference please refer to the SCSI Primary Commands standard, specifically the section on Reservations and the "PERSISTENT RESERVE IN" and "PERSISTENT RESERVE OUT" commands. diff --git a/docs/specs/ppc-spapr-hotplug.txt b/docs/specs/ppc-spapr-hotplug.txt index cc7833108e..859d52cce6 100644 --- a/docs/specs/ppc-spapr-hotplug.txt +++ b/docs/specs/ppc-spapr-hotplug.txt @@ -385,7 +385,7 @@ Each LMB list entry consists of the following elements: is used to retrieve the right associativity list to be used for this LMB. - A 32bit flags word. The bit at bit position 0x00000008 defines whether - the LMB is assigned to the the partition as of boot time. + the LMB is assigned to the partition as of boot time. ibm,dynamic-memory-v2 diff --git a/docs/specs/ppc-xive.rst b/docs/specs/ppc-xive.rst index 148d57eb6a..83d43f658b 100644 --- a/docs/specs/ppc-xive.rst +++ b/docs/specs/ppc-xive.rst @@ -163,7 +163,7 @@ Interrupt Priority Register (PIPR) is also updated using the IPB. This register represent the priority of the most favored pending notification. -The PIPR is then compared to the the Current Processor Priority +The PIPR is then compared to the Current Processor Priority Register (CPPR). If it is more favored (numerically less than), the CPU interrupt line is raised and the EO bit of the Notification Source Register (NSR) is updated to notify the presence of an exception for diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt index 5d8c26b1ad..9c8cca042d 100644 --- a/docs/specs/tpm.txt +++ b/docs/specs/tpm.txt @@ -89,7 +89,7 @@ TPM upon reboot. The PPI specification defines the operation requests and the actions the firmware has to take. The system administrator passes the operation request number to the firmware through an ACPI interface which writes this number to a memory location that the firmware knows. Upon reboot, the firmware -finds the number and sends commands to the the TPM. The firmware writes the TPM +finds the number and sends commands to the TPM. The firmware writes the TPM result code and the operation request number to a memory location that ACPI can read from and pass the result on to the administrator. diff --git a/include/hw/xen/interface/io/blkif.h b/include/hw/xen/interface/io/blkif.h index 8b1be50ce8..d07fa1e078 100644 --- a/include/hw/xen/interface/io/blkif.h +++ b/include/hw/xen/interface/io/blkif.h @@ -341,7 +341,7 @@ * access (even when it should be read-only). If the frontend hits the * maximum number of allowed persistently mapped grants, it can fallback * to non persistent mode. This will cause a performance degradation, - * since the the backend driver will still try to map those grants + * since the backend driver will still try to map those grants * persistently. Since the persistent grants protocol is compatible with * the previous protocol, a frontend driver can choose to work in * persistent mode even when the backend doesn't support it. diff --git a/scripts/dump-guest-memory.py b/scripts/dump-guest-memory.py index 2c587cbefc..9371e45813 100644 --- a/scripts/dump-guest-memory.py +++ b/scripts/dump-guest-memory.py @@ -170,7 +170,7 @@ class ELF(object): self.ehdr.e_phnum += 1 def to_file(self, elf_file): - """Writes all ELF structures to the the passed file. + """Writes all ELF structures to the passed file. Structure: Ehdr