diff options
-rw-r--r-- | hw/char/pl011.c | 9 | ||||
-rw-r--r-- | hw/core/loader.c | 75 | ||||
-rw-r--r-- | hw/core/machine.c | 1 | ||||
-rw-r--r-- | include/exec/memory.h | 32 | ||||
-rw-r--r-- | include/hw/char/pl011.h | 1 | ||||
-rw-r--r-- | include/hw/loader.h | 31 | ||||
-rw-r--r-- | softmmu/memory.c | 4 | ||||
-rw-r--r-- | target/arm/cpu.c | 2 | ||||
-rw-r--r-- | target/arm/tlb_helper.c | 1 | ||||
-rw-r--r-- | tests/qtest/fuzz/generic_fuzz.c | 11 |
10 files changed, 157 insertions, 10 deletions
diff --git a/hw/char/pl011.c b/hw/char/pl011.c index c5621a1..dc85527 100644 --- a/hw/char/pl011.c +++ b/hw/char/pl011.c @@ -322,10 +322,18 @@ static const MemoryRegionOps pl011_ops = { .endianness = DEVICE_NATIVE_ENDIAN, }; +static bool pl011_clock_needed(void *opaque) +{ + PL011State *s = PL011(opaque); + + return s->migrate_clk; +} + static const VMStateDescription vmstate_pl011_clock = { .name = "pl011/clock", .version_id = 1, .minimum_version_id = 1, + .needed = pl011_clock_needed, .fields = (VMStateField[]) { VMSTATE_CLOCK(clk, PL011State), VMSTATE_END_OF_LIST() @@ -363,6 +371,7 @@ static const VMStateDescription vmstate_pl011 = { static Property pl011_properties[] = { DEFINE_PROP_CHR("chardev", PL011State, chr), + DEFINE_PROP_BOOL("migrate-clk", PL011State, migrate_clk, true), DEFINE_PROP_END_OF_LIST(), }; diff --git a/hw/core/loader.c b/hw/core/loader.c index 9feca32..d3e5f3b 100644 --- a/hw/core/loader.c +++ b/hw/core/loader.c @@ -1383,6 +1383,81 @@ void *rom_ptr(hwaddr addr, size_t size) return rom->data + (addr - rom->addr); } +typedef struct FindRomCBData { + size_t size; /* Amount of data we want from ROM, in bytes */ + MemoryRegion *mr; /* MR at the unaliased guest addr */ + hwaddr xlat; /* Offset of addr within mr */ + void *rom; /* Output: rom data pointer, if found */ +} FindRomCBData; + +static bool find_rom_cb(Int128 start, Int128 len, const MemoryRegion *mr, + hwaddr offset_in_region, void *opaque) +{ + FindRomCBData *cbdata = opaque; + hwaddr alias_addr; + + if (mr != cbdata->mr) { + return false; + } + + alias_addr = int128_get64(start) + cbdata->xlat - offset_in_region; + cbdata->rom = rom_ptr(alias_addr, cbdata->size); + if (!cbdata->rom) { + return false; + } + /* Found a match, stop iterating */ + return true; +} + +void *rom_ptr_for_as(AddressSpace *as, hwaddr addr, size_t size) +{ + /* + * Find any ROM data for the given guest address range. If there + * is a ROM blob then return a pointer to the host memory + * corresponding to 'addr'; otherwise return NULL. + * + * We look not only for ROM blobs that were loaded directly to + * addr, but also for ROM blobs that were loaded to aliases of + * that memory at other addresses within the AddressSpace. + * + * Note that we do not check @as against the 'as' member in the + * 'struct Rom' returned by rom_ptr(). The Rom::as is the + * AddressSpace which the rom blob should be written to, whereas + * our @as argument is the AddressSpace which we are (effectively) + * reading from, and the same underlying RAM will often be visible + * in multiple AddressSpaces. (A common example is a ROM blob + * written to the 'system' address space but then read back via a + * CPU's cpu->as pointer.) This does mean we might potentially + * return a false-positive match if a ROM blob was loaded into an + * AS which is entirely separate and distinct from the one we're + * querying, but this issue exists also for rom_ptr() and hasn't + * caused any problems in practice. + */ + FlatView *fv; + void *rom; + hwaddr len_unused; + FindRomCBData cbdata = {}; + + /* Easy case: there's data at the actual address */ + rom = rom_ptr(addr, size); + if (rom) { + return rom; + } + + RCU_READ_LOCK_GUARD(); + + fv = address_space_to_flatview(as); + cbdata.mr = flatview_translate(fv, addr, &cbdata.xlat, &len_unused, + false, MEMTXATTRS_UNSPECIFIED); + if (!cbdata.mr) { + /* Nothing at this address, so there can't be any aliasing */ + return NULL; + } + cbdata.size = size; + flatview_for_each_range(fv, find_rom_cb, &cbdata); + return cbdata.rom; +} + void hmp_info_roms(Monitor *mon, const QDict *qdict) { Rom *rom; diff --git a/hw/core/machine.c b/hw/core/machine.c index 257a664..9935c6d 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -52,6 +52,7 @@ GlobalProperty hw_compat_5_1[] = { { "virtio-scsi-device", "num_queues", "1"}, { "nvme", "use-intel-id", "on"}, { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */ + { "pl011", "migrate-clk", "off" }, }; const size_t hw_compat_5_1_len = G_N_ELEMENTS(hw_compat_5_1); diff --git a/include/exec/memory.h b/include/exec/memory.h index 260ddd8..5728a68 100644 --- a/include/exec/memory.h +++ b/include/exec/memory.h @@ -776,11 +776,35 @@ static inline FlatView *address_space_to_flatview(AddressSpace *as) return qatomic_rcu_read(&as->current_map); } -typedef int (*flatview_cb)(Int128 start, - Int128 len, - const MemoryRegion*, void*); +/** + * typedef flatview_cb: callback for flatview_for_each_range() + * + * @start: start address of the range within the FlatView + * @len: length of the range in bytes + * @mr: MemoryRegion covering this range + * @offset_in_region: offset of the first byte of the range within @mr + * @opaque: data pointer passed to flatview_for_each_range() + * + * Returns: true to stop the iteration, false to keep going. + */ +typedef bool (*flatview_cb)(Int128 start, + Int128 len, + const MemoryRegion *mr, + hwaddr offset_in_region, + void *opaque); -void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque); +/** + * flatview_for_each_range: Iterate through a FlatView + * @fv: the FlatView to iterate through + * @cb: function to call for each range + * @opaque: opaque data pointer to pass to @cb + * + * A FlatView is made up of a list of non-overlapping ranges, each of + * which is a slice of a MemoryRegion. This function iterates through + * each range in @fv, calling @cb. The callback function can terminate + * iteration early by returning 'true'. + */ +void flatview_for_each_range(FlatView *fv, flatview_cb cb, void *opaque); /** * struct MemoryRegionSection: describes a fragment of a #MemoryRegion diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h index 33e5e53..dc2c90e 100644 --- a/include/hw/char/pl011.h +++ b/include/hw/char/pl011.h @@ -50,6 +50,7 @@ struct PL011State { CharBackend chr; qemu_irq irq[6]; Clock *clk; + bool migrate_clk; const unsigned char *id; }; diff --git a/include/hw/loader.h b/include/hw/loader.h index a9eeea3..cbfc184 100644 --- a/include/hw/loader.h +++ b/include/hw/loader.h @@ -290,6 +290,37 @@ void rom_transaction_end(bool commit); int rom_copy(uint8_t *dest, hwaddr addr, size_t size); void *rom_ptr(hwaddr addr, size_t size); +/** + * rom_ptr_for_as: Return a pointer to ROM blob data for the address + * @as: AddressSpace to look for the ROM blob in + * @addr: Address within @as + * @size: size of data required in bytes + * + * Returns: pointer into the data which backs the matching ROM blob, + * or NULL if no blob covers the address range. + * + * This function looks for a ROM blob which covers the specified range + * of bytes of length @size starting at @addr within the address space + * @as. This is useful for code which runs as part of board + * initialization or CPU reset which wants to read data that is part + * of a user-supplied guest image or other guest memory contents, but + * which runs before the ROM loader's reset function has copied the + * blobs into guest memory. + * + * rom_ptr_for_as() will look not just for blobs loaded directly to + * the specified address, but also for blobs which were loaded to an + * alias of the region at a different location in the AddressSpace. + * In other words, if a machine model has RAM at address 0x0000_0000 + * which is aliased to also appear at 0x1000_0000, rom_ptr_for_as() + * will return the correct data whether the guest image was linked and + * loaded at 0x0000_0000 or 0x1000_0000. Contrast rom_ptr(), which + * will only return data if the image load address is an exact match + * with the queried address. + * + * New code should prefer to use rom_ptr_for_as() instead of + * rom_ptr(). + */ +void *rom_ptr_for_as(AddressSpace *as, hwaddr addr, size_t size); void hmp_info_roms(Monitor *mon, const QDict *qdict); #define rom_add_file_fixed(_f, _a, _i) \ diff --git a/softmmu/memory.c b/softmmu/memory.c index c4730ec..d4493ef 100644 --- a/softmmu/memory.c +++ b/softmmu/memory.c @@ -671,8 +671,10 @@ void flatview_for_each_range(FlatView *fv, flatview_cb cb , void *opaque) assert(cb); FOR_EACH_FLAT_RANGE(fr, fv) { - if (cb(fr->addr.start, fr->addr.size, fr->mr, opaque)) + if (cb(fr->addr.start, fr->addr.size, fr->mr, + fr->offset_in_region, opaque)) { break; + } } } diff --git a/target/arm/cpu.c b/target/arm/cpu.c index ae04884..0dd623e 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -331,7 +331,7 @@ static void arm_cpu_reset(DeviceState *dev) /* Load the initial SP and PC from offset 0 and 4 in the vector table */ vecbase = env->v7m.vecbase[env->v7m.secure]; - rom = rom_ptr(vecbase, 8); + rom = rom_ptr_for_as(s->as, vecbase, 8); if (rom) { /* Address zero is covered by ROM which hasn't yet been * copied into physical memory. diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c index 9609333..3107f98 100644 --- a/target/arm/tlb_helper.c +++ b/target/arm/tlb_helper.c @@ -163,6 +163,7 @@ bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size, } else { fi.type = ARMFault_Translation; } + fi.level = 3; /* now we have a real cpu fault */ cpu_restore_state(cs, retaddr, true); diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c index b5fe27a..ae21954 100644 --- a/tests/qtest/fuzz/generic_fuzz.c +++ b/tests/qtest/fuzz/generic_fuzz.c @@ -98,19 +98,22 @@ struct get_io_cb_info { address_range result; }; -static int get_io_address_cb(Int128 start, Int128 size, - const MemoryRegion *mr, void *opaque) { +static bool get_io_address_cb(Int128 start, Int128 size, + const MemoryRegion *mr, + hwaddr offset_in_region, + void *opaque) +{ struct get_io_cb_info *info = opaque; if (g_hash_table_lookup(fuzzable_memoryregions, mr)) { if (info->index == 0) { info->result.addr = (ram_addr_t)start; info->result.size = (ram_addr_t)size; info->found = 1; - return 1; + return true; } info->index--; } - return 0; + return false; } /* |