[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 26/64] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH
From: |
Michael Roth |
Subject: |
[PATCH 26/64] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field |
Date: |
Tue, 19 Oct 2021 09:09:06 -0500 |
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
libFuzzer triggered the following assertion:
cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
-nographic -monitor none -serial none \
-qtest stdio -d guest_errors -trace pci\*
outl 0xcf8 0xf2000060
outl 0xcfc 0x8400056e
EOF
pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
Aborted (core dumped)
This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD
(reserved value) to the PCIE XBAR register.
There is no indication on the datasheet about what occurs when
this value is written. Simply ignore it on QEMU (and report an
guest error):
pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
Q35: Reserved PCIEXBAR LENGTH
pci_cfg_read mch 00:0 @0x0 -> 0x8086
pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
...
Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
BugLink: https://bugs.launchpad.net/qemu/+bug/1878641
Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210526142438.281477-1-f4bug@amsat.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 9b0ca75e0196a72523232063db1e07ae36a5077a)
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
hw/pci-host/q35.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 2eb729dff5..0f37cf056a 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -29,6 +29,7 @@
*/
#include "qemu/osdep.h"
+#include "qemu/log.h"
#include "hw/i386/pc.h"
#include "hw/pci-host/q35.h"
#include "hw/qdev-properties.h"
@@ -318,6 +319,8 @@ static void mch_update_pciexbar(MCHPCIState *mch)
addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
break;
case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
+ qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
+ return;
default:
abort();
}
--
2.25.1
- [PATCH 17/64] configure: fix detection of gdbus-codegen, (continued)
- [PATCH 17/64] configure: fix detection of gdbus-codegen, Michael Roth, 2021/10/19
- [PATCH 18/64] vhost-vdpa: don't initialize backend_features, Michael Roth, 2021/10/19
- [PATCH 19/64] esp: only assert INTR_DC interrupt flag if selection fails, Michael Roth, 2021/10/19
- [PATCH 20/64] esp: only set ESP_RSEQ at the start of the select sequence, Michael Roth, 2021/10/19
- [PATCH 01/64] multi-process: Initialize variables declared with g_auto*, Michael Roth, 2021/10/19
- [PATCH 21/64] runstate: Initialize Error * to NULL, Michael Roth, 2021/10/19
- [PATCH 22/64] vfio: Fix unregister SaveVMHandler in vfio_migration_finalize, Michael Roth, 2021/10/19
- [PATCH 23/64] vl: Fix an assert failure in error path, Michael Roth, 2021/10/19
- [PATCH 24/64] tcg/sparc: Fix temp_allocate_frame vs sparc stack bias, Michael Roth, 2021/10/19
- [PATCH 25/64] tcg: Allocate sufficient storage in temp_allocate_frame, Michael Roth, 2021/10/19
- [PATCH 26/64] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field,
Michael Roth <=
- [PATCH 27/64] block/nvme: Fix VFIO_MAP_DMA failed: No space left on device, Michael Roth, 2021/10/19
- [PATCH 28/64] crypto/tlscreds: Introduce qcrypto_tls_creds_check_endpoint() helper, Michael Roth, 2021/10/19
- [PATCH 29/64] block/nbd: Use qcrypto_tls_creds_check_endpoint(), Michael Roth, 2021/10/19
- [PATCH 30/64] qemu-nbd: Use qcrypto_tls_creds_check_endpoint(), Michael Roth, 2021/10/19
- [PATCH 02/64] linux-user/aarch64: Enable hwcap for RND, BTI, and MTE, Michael Roth, 2021/10/19
- [PATCH 31/64] chardev/socket: Use qcrypto_tls_creds_check_endpoint(), Michael Roth, 2021/10/19
- [PATCH 32/64] migration/tls: Use qcrypto_tls_creds_check_endpoint(), Michael Roth, 2021/10/19
- [PATCH 33/64] ui/vnc: Use qcrypto_tls_creds_check_endpoint(), Michael Roth, 2021/10/19
- [PATCH 34/64] crypto: Make QCryptoTLSCreds* structures private, Michael Roth, 2021/10/19
- [PATCH 35/64] yank: Unregister function when using TLS migration, Michael Roth, 2021/10/19