[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 03/13] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH f
From: |
Michael S. Tsirkin |
Subject: |
[PULL 03/13] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field |
Date: |
Wed, 7 Jul 2021 11:03:03 -0400 |
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
libFuzzer triggered the following assertion:
cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
-nographic -monitor none -serial none \
-qtest stdio -d guest_errors -trace pci\*
outl 0xcf8 0xf2000060
outl 0xcfc 0x8400056e
EOF
pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
Aborted (core dumped)
This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD
(reserved value) to the PCIE XBAR register.
There is no indication on the datasheet about what occurs when
this value is written. Simply ignore it on QEMU (and report an
guest error):
pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
Q35: Reserved PCIEXBAR LENGTH
pci_cfg_read mch 00:0 @0x0 -> 0x8086
pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
...
Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
BugLink: https://bugs.launchpad.net/qemu/+bug/1878641
Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210526142438.281477-1-f4bug@amsat.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
hw/pci-host/q35.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 2eb729dff5..0f37cf056a 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -29,6 +29,7 @@
*/
#include "qemu/osdep.h"
+#include "qemu/log.h"
#include "hw/i386/pc.h"
#include "hw/pci-host/q35.h"
#include "hw/qdev-properties.h"
@@ -318,6 +319,8 @@ static void mch_update_pciexbar(MCHPCIState *mch)
addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
break;
case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
+ qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
+ return;
default:
abort();
}
--
MST
- [PULL 00/13] pc,pci,virtio: bugfixes, improvements, Michael S. Tsirkin, 2021/07/07
- [PULL 01/13] virtio: disable ioeventfd for record/replay, Michael S. Tsirkin, 2021/07/07
- [PULL 03/13] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field,
Michael S. Tsirkin <=
- [PULL 05/13] virtio-pci: Added check for virtio device in PCI config cbs., Michael S. Tsirkin, 2021/07/07
- [PULL 04/13] virtio-pci: Added check for virtio device presence in mm callbacks., Michael S. Tsirkin, 2021/07/07
- [PULL 02/13] virtio: Clarify MR transaction optimization, Michael S. Tsirkin, 2021/07/07
- [PULL 06/13] virtio-pci: Changed return values for "notify", "device" and "isr" read., Michael S. Tsirkin, 2021/07/07
- [PULL 07/13] migration: failover: reset partially_hotplugged, Michael S. Tsirkin, 2021/07/07
- [PULL 08/13] tests: acpi: prepare for changing DSDT tables, Michael S. Tsirkin, 2021/07/07
- [PULL 09/13] acpi: pc: revert back to v5.2 PCI slot enumeration, Michael S. Tsirkin, 2021/07/07
- [PULL 10/13] tests: acpi: pc: update expected DSDT blobs, Michael S. Tsirkin, 2021/07/07
- [PULL 11/13] acpi/ged: fix reset cause, Michael S. Tsirkin, 2021/07/07
- [PULL 12/13] docs: add slot when adding new PCIe root port, Michael S. Tsirkin, 2021/07/07