From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:53313)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jan.kiszka@siemens.com>) id 1T4bio-0002v9-QK
	for qemu-devel@nongnu.org; Thu, 23 Aug 2012 14:01:35 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jan.kiszka@siemens.com>) id 1T4bii-00043O-NX
	for qemu-devel@nongnu.org; Thu, 23 Aug 2012 14:01:34 -0400
Received: from david.siemens.de ([192.35.17.14]:25965)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jan.kiszka@siemens.com>) id 1T4bii-00042e-Dn
	for qemu-devel@nongnu.org; Thu, 23 Aug 2012 14:01:28 -0400
Message-ID: <50366FEE.70502@siemens.com>
Date: Thu, 23 Aug 2012 20:01:18 +0200
From: Jan Kiszka <jan.kiszka@siemens.com>
MIME-Version: 1.0
References: <cover.1345549695.git.julien.grall@citrix.com>
	<1fa099f2f1c404e8b562a2ad32a39a784c68be1c.1345549695.git.julien.grall@citrix.com>
In-Reply-To: <1fa099f2f1c404e8b562a2ad32a39a784c68be1c.1345549695.git.julien.grall@citrix.com>
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH V5 2/8] hw/acpi_piix4.c: replace
	register_ioport*
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Julien Grall <julien.grall@citrix.com>
Cc: Stefano.Stabellini@eu.citrix.com, qemu-devel@nongnu.org, avi@redhat.com

On 2012-08-22 14:27, Julien Grall wrote:
> This patch replaces all register_ioport* with the new memory API. It permits
> to use the new Memory stuff like listener.
> 
> Signed-off-by: Julien Grall <julien.grall@citrix.com>
> ---
>  hw/acpi_piix4.c |  160 ++++++++++++++++++++++++++++++++++++++++++------------
>  1 files changed, 124 insertions(+), 36 deletions(-)
> 

...

> @@ -198,8 +212,10 @@ static void pm_io_space_update(PIIX4PMState *s)
>  
>          /* XXX: need to improve memory and ioport allocation */
>          PIIX4_DPRINTF("PM: mapping to 0x%x\n", pm_io_base);
> -        iorange_init(&s->ioport, &pm_iorange_ops, pm_io_base, 64);
> -        ioport_register(&s->ioport);
> +
> +        memory_region_init_io(&s->pm_io, &pm_io_ops, s, "piix4-pm", 64);
> +        memory_region_add_subregion(pci_address_space_io(&s->dev),
> +                                    pm_io_base, &s->pm_io);

This was broken before, but now I'm worried a guest can even crash qemu
by updating an existing mapping. So you will have to
 - initialize pm_io only once
 - track the active address
 - remove a registered region before registering a new one

Didn't look at the spec, but I bet that (config[0x80] & 1) == 0 means
disable this mapping. Should be fixed as well if that is true.

Jan

-- 
Siemens AG, Corporate Technology, CT RTC ITP SDP-DE
Corporate Competence Center Embedded Linux