qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field
@ 2021-05-26 14:24 Philippe Mathieu-Daudé
  2021-06-14 11:14 ` Philippe Mathieu-Daudé
  2021-06-21 14:09 ` Alexander Bulekov
  0 siblings, 2 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-05-26 14:24 UTC (permalink / raw)
  To: qemu-devel
  Cc: Thomas Huth, Michael S. Tsirkin, Richard Henderson, qemu-stable,
	Philippe Mathieu-Daudé,
	Alexander Bulekov

libFuzzer triggered the following assertion:

  cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
    -nographic -monitor none -serial none \
    -qtest stdio -d guest_errors -trace pci\*
  outl 0xcf8 0xf2000060
  outl 0xcfc 0x8400056e
  EOF
  pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
  Aborted (core dumped)

This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD
(reserved value) to the PCIE XBAR register.

There is no indication on the datasheet about what occurs when
this value is written. Simply ignore it on QEMU (and report an
guest error):

  pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
  Q35: Reserved PCIEXBAR LENGTH
  pci_cfg_read mch 00:0 @0x0 -> 0x8086
  pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
  ...

Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
BugLink: https://bugs.launchpad.net/qemu/+bug/1878641
Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
v2: Do not remove default case (rth)
---
 hw/pci-host/q35.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 2eb729dff58..0f37cf056a9 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -29,6 +29,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/log.h"
 #include "hw/i386/pc.h"
 #include "hw/pci-host/q35.h"
 #include "hw/qdev-properties.h"
@@ -318,6 +319,8 @@ static void mch_update_pciexbar(MCHPCIState *mch)
         addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
         break;
     case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
+        qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
+        return;
     default:
         abort();
     }
-- 
2.26.3



^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field
  2021-05-26 14:24 [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field Philippe Mathieu-Daudé
@ 2021-06-14 11:14 ` Philippe Mathieu-Daudé
  2021-06-21 10:05   ` Philippe Mathieu-Daudé
  2021-06-21 14:09 ` Alexander Bulekov
  1 sibling, 1 reply; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-06-14 11:14 UTC (permalink / raw)
  To: qemu-devel
  Cc: Alexander Bulekov, Thomas Huth, Richard Henderson, qemu-stable,
	Michael S. Tsirkin

ping?

On 5/26/21 4:24 PM, Philippe Mathieu-Daudé wrote:
> libFuzzer triggered the following assertion:
> 
>   cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
>     -nographic -monitor none -serial none \
>     -qtest stdio -d guest_errors -trace pci\*
>   outl 0xcf8 0xf2000060
>   outl 0xcfc 0x8400056e
>   EOF
>   pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
>   Aborted (core dumped)
> 
> This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD
> (reserved value) to the PCIE XBAR register.
> 
> There is no indication on the datasheet about what occurs when
> this value is written. Simply ignore it on QEMU (and report an
> guest error):
> 
>   pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
>   Q35: Reserved PCIEXBAR LENGTH
>   pci_cfg_read mch 00:0 @0x0 -> 0x8086
>   pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
>   ...
> 
> Cc: qemu-stable@nongnu.org
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> BugLink: https://bugs.launchpad.net/qemu/+bug/1878641
> Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator")
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
> v2: Do not remove default case (rth)
> ---
>  hw/pci-host/q35.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index 2eb729dff58..0f37cf056a9 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -29,6 +29,7 @@
>   */
>  
>  #include "qemu/osdep.h"
> +#include "qemu/log.h"
>  #include "hw/i386/pc.h"
>  #include "hw/pci-host/q35.h"
>  #include "hw/qdev-properties.h"
> @@ -318,6 +319,8 @@ static void mch_update_pciexbar(MCHPCIState *mch)
>          addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
>          break;
>      case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
> +        qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
> +        return;
>      default:
>          abort();
>      }
> 


^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field
  2021-06-14 11:14 ` Philippe Mathieu-Daudé
@ 2021-06-21 10:05   ` Philippe Mathieu-Daudé
  0 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-06-21 10:05 UTC (permalink / raw)
  To: qemu-devel
  Cc: Alexander Bulekov, Thomas Huth, Richard Henderson, qemu-stable,
	Michael S. Tsirkin

ping?

On 6/14/21 1:14 PM, Philippe Mathieu-Daudé wrote:
> ping?
> 
> On 5/26/21 4:24 PM, Philippe Mathieu-Daudé wrote:
>> libFuzzer triggered the following assertion:
>>
>>   cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
>>     -nographic -monitor none -serial none \
>>     -qtest stdio -d guest_errors -trace pci\*
>>   outl 0xcf8 0xf2000060
>>   outl 0xcfc 0x8400056e
>>   EOF
>>   pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
>>   Aborted (core dumped)
>>
>> This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD
>> (reserved value) to the PCIE XBAR register.
>>
>> There is no indication on the datasheet about what occurs when
>> this value is written. Simply ignore it on QEMU (and report an
>> guest error):
>>
>>   pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
>>   Q35: Reserved PCIEXBAR LENGTH
>>   pci_cfg_read mch 00:0 @0x0 -> 0x8086
>>   pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
>>   ...
>>
>> Cc: qemu-stable@nongnu.org
>> Reported-by: Alexander Bulekov <alxndr@bu.edu>
>> BugLink: https://bugs.launchpad.net/qemu/+bug/1878641
>> Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator")
>> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
>> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
>> ---
>> v2: Do not remove default case (rth)
>> ---
>>  hw/pci-host/q35.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>> index 2eb729dff58..0f37cf056a9 100644
>> --- a/hw/pci-host/q35.c
>> +++ b/hw/pci-host/q35.c
>> @@ -29,6 +29,7 @@
>>   */
>>  
>>  #include "qemu/osdep.h"
>> +#include "qemu/log.h"
>>  #include "hw/i386/pc.h"
>>  #include "hw/pci-host/q35.h"
>>  #include "hw/qdev-properties.h"
>> @@ -318,6 +319,8 @@ static void mch_update_pciexbar(MCHPCIState *mch)
>>          addr_mask |= MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK;
>>          break;
>>      case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD:
>> +        qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n");
>> +        return;
>>      default:
>>          abort();
>>      }
>>
> 


^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field
  2021-05-26 14:24 [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field Philippe Mathieu-Daudé
  2021-06-14 11:14 ` Philippe Mathieu-Daudé
@ 2021-06-21 14:09 ` Alexander Bulekov
  1 sibling, 0 replies; 4+ messages in thread
From: Alexander Bulekov @ 2021-06-21 14:09 UTC (permalink / raw)
  To: Philippe Mathieu-Daudé
  Cc: Thomas Huth, Michael S. Tsirkin, Richard Henderson, qemu-stable,
	qemu-devel

On 210526 1624, Philippe Mathieu-Daudé wrote:
> libFuzzer triggered the following assertion:
> 
>   cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
>     -nographic -monitor none -serial none \
>     -qtest stdio -d guest_errors -trace pci\*
>   outl 0xcf8 0xf2000060
>   outl 0xcfc 0x8400056e
>   EOF
>   pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
>   Aborted (core dumped)
> 
> This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD
> (reserved value) to the PCIE XBAR register.
> 
> There is no indication on the datasheet about what occurs when
> this value is written. Simply ignore it on QEMU (and report an
> guest error):
> 
>   pci_cfg_write mch 00:0 @0x60 <- 0x8400056e
>   Q35: Reserved PCIEXBAR LENGTH
>   pci_cfg_read mch 00:0 @0x0 -> 0x8086
>   pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
>   ...
> 
> Cc: qemu-stable@nongnu.org
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> BugLink: https://bugs.launchpad.net/qemu/+bug/1878641
> Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator")
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---

Reviewed-by: Alexander Bulekov <alxndr@bu.edu>


^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-06-21 14:12 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-26 14:24 [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field Philippe Mathieu-Daudé
2021-06-14 11:14 ` Philippe Mathieu-Daudé
2021-06-21 10:05   ` Philippe Mathieu-Daudé
2021-06-21 14:09 ` Alexander Bulekov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).