[Bug 1878641] Re: Abort() in mch_update_pciexbar

[Thomas Huth]

Confirmed, this is not fixed yet. Philippe, what happened to your patch?

** Changed in: qemu
       Status: New => Confirmed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1878641

Title:
  Abort() in mch_update_pciexbar

Status in QEMU:
  Confirmed

Bug description:
  Hello,
  I found an input which triggers an abort() in mch_update_pciexbar:

  #0  0x00007ffff686d761 in __GI_raise (sig=sig@entry=0x6) at 
../sysdeps/unix/sysv/linux/raise.c:50
  #1  0x00007ffff685755b in __GI_abort () at abort.c:79
  #2  0x000055555705c7ae in mch_update_pciexbar (mch=0x629000005920) at 
/home/alxndr/Development/qemu/hw/pci-host/q35.c:324
  #3  0x000055555705bb6a in mch_write_config (d=0x629000005920, address=0x60, 
val=0x8400056e, len=0x4) at /home/alxndr/Development/qemu/hw/pci-host/q35.c:480
  #4  0x00005555570954fb in pci_host_config_write_common 
(pci_dev=0x629000005920, addr=0x60, limit=0x100, val=0x8400056e, len=0x4) at 
/home/alxndr/Development/qemu/hw/pci/pci_host.c:81
  #5  0x000055555709606e in pci_data_write (s=0x61d000096080, addr=0xf2000060, 
val=0x8400056e, len=0x4) at /home/alxndr/Development/qemu/hw/pci/pci_host.c:118
  #6  0x00005555570967d0 in pci_host_data_write (opaque=0x629000005200, 
addr=0x0, val=0x8400056e, len=0x4) at 
/home/alxndr/Development/qemu/hw/pci/pci_host.c:165
  #7  0x00005555564938b5 in memory_region_write_accessor (mr=0x629000005610, 
addr=0x0, value=0x7fffffff9c70, size=0x4, shift=0x0, mask=0xffffffff, 
attrs=...) at /home/alxndr/Development/qemu/memory.c:483
  #8  0x000055555649328a in access_with_adjusted_size (addr=0x0, 
value=0x7fffffff9c70, size=0x4, access_size_min=0x1, access_size_max=0x4, 
access_fn=0x555556493360 <memory_region_write_accessor>, mr=0x629000005610, 
attrs=...) at /home/alxndr/Development/qemu/memory.c:544
  #9  0x0000555556491df6 in memory_region_dispatch_write (mr=0x629000005610, 
addr=0x0, data=0x8400056e, op=MO_32, attrs=...) at 
/home/alxndr/Development/qemu/memory.c:1476
  #10 0x00005555562cbbf4 in flatview_write_continue (fv=0x606000033b00, 
addr=0xcfc, attrs=..., ptr=0x7fffffffa4e0, len=0x4, addr1=0x0, l=0x4, 
mr=0x629000005610) at /home/alxndr/Development/qemu/exec.c:3137
  #11 0x00005555562bbad9 in flatview_write (fv=0x606000033b00, addr=0xcfc, 
attrs=..., buf=0x7fffffffa4e0, len=0x4) at 
/home/alxndr/Development/qemu/exec.c:3177
  #12 0x00005555562bb609 in address_space_write (as=0x55555968f940 
<address_space_io>, addr=0xcfc, attrs=..., buf=0x7fffffffa4e0, len=0x4) at 
/home/alxndr/Development/qemu/exec.c:3268
  #13 0x0000555556478c0a in cpu_outl (addr=0xcfc, val=0x8400056e) at 
/home/alxndr/Development/qemu/ioport.c:80
  #14 0x000055555648166f in qtest_process_command (chr=0x555559691d00 
<qtest_chr>, words=0x60300009ebf0) at /home/alxndr/Development/qemu/qtest.c:396
  #15 0x000055555647f187 in qtest_process_inbuf (chr=0x555559691d00 
<qtest_chr>, inbuf=0x61900000f680) at /home/alxndr/Development/qemu/qtest.c:710
  #16 0x000055555647e8b4 in qtest_read (opaque=0x555559691d00 <qtest_chr>, 
buf=0x7fffffffca40 "outl 0xcf8 0xf2000060\noutl 0xcfc 0x8400056e\n-M pc-q35-5.0 
-device intel-hda,id=hda0 -device hda-output,bus=hda0.0 -device 
hda-micro,bus=hda0.0 -device hda-duplex,bus=hda0.0 -display none -nodefaults 
-nographic\n\377\377\377\177", size=0xd2) at 
/home/alxndr/Development/qemu/qtest.c:722
  #17 0x00005555579c260c in qemu_chr_be_write_impl (s=0x60f000001f30, 
buf=0x7fffffffca40 "outl 0xcf8 0xf2000060\noutl 0xcfc 0x8400056e\n-M pc-q35-5.0 
-device intel-hda,id=hda0 -device hda-output,bus=hda0.0 -device 
hda-micro,bus=hda0.0 -device hda-duplex,bus=hda0.0 -display none -nodefaults 
-nographic\n\377\377\377\177", len=0xd2) at 
/home/alxndr/Development/qemu/chardev/char.c:183
  #18 0x00005555579c275b in qemu_chr_be_write (s=0x60f000001f30, 
buf=0x7fffffffca40 "outl 0xcf8 0xf2000060\noutl 0xcfc 0x8400056e\n-M pc-q35-5.0 
-device intel-hda,id=hda0 -device hda-output,bus=hda0.0 -device 
hda-micro,bus=hda0.0 -device hda-duplex,bus=hda0.0 -display none -nodefaults 
-nographic\n\377\377\377\177", len=0xd2) at 
/home/alxndr/Development/qemu/chardev/char.c:195
  #19 0x00005555579cb97a in fd_chr_read (chan=0x6080000026a0, cond=G_IO_IN, 
opaque=0x60f000001f30) at /home/alxndr/Development/qemu/chardev/char-fd.c:68
  #20 0x0000555557a530ea in qio_channel_fd_source_dispatch 
(source=0x60c00002ef00, callback=0x5555579cb540 <fd_chr_read>, 
user_data=0x60f000001f30) at /home/alxndr/Development/qemu/io/channel-watch.c:84
  #21 0x00007ffff7ca8898 in g_main_context_dispatch () at 
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
  #22 0x0000555557c10b85 in glib_pollfds_poll () at 
/home/alxndr/Development/qemu/util/main-loop.c:219
  #23 0x0000555557c0f57e in os_host_main_loop_wait (timeout=0x0) at 
/home/alxndr/Development/qemu/util/main-loop.c:242
  #24 0x0000555557c0f177 in main_loop_wait (nonblocking=0x0) at 
/home/alxndr/Development/qemu/util/main-loop.c:518
  #25 0x000055555689fd1e in qemu_main_loop () at 
/home/alxndr/Development/qemu/softmmu/vl.c:1664
  #26 0x0000555557a6a29d in main (argc=0x17, argv=0x7fffffffe148, 
envp=0x7fffffffe208) at /home/alxndr/Development/qemu/softmmu/main.c:49

  
  I can reproduce this in qemu 5.0 built using these qtest commands:

  cat << EOF | ./qemu-system-i386 \
  -qtest stdio -nographic -monitor none -serial none \
  -M pc-q35-5.0
  outl 0xcf8 0xf2000060
  outl 0xcfc 0x8400056e
  EOF

  Please let me know if I can provide any further info.
  -Alex

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1878641/+subscriptions