qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Bug 1901359] [NEW] ignore bit 0 in pci CONFIG_ADDRESS register write for Type 1 access
@ 2020-10-24 23:25 cinap_lenrek
  2021-01-07  0:26 ` [Bug 1901359] " cinap_lenrek
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: cinap_lenrek @ 2020-10-24 23:25 UTC (permalink / raw)
  To: qemu-devel

Public bug reported:

I'v recently stumbled upon a bug in the Plan9 PCI config space access
routines for config mode #1.

The code used to set bit 0 in the CONFIG_ADDRESS register for a Type 1
access.

This was most likely a misreading of the PCI local bus specification on
our side.

However, in the PCI local bus specification 3.0, it states the
following:

> 3.2.2.3.2 Software Generation of Configuration Transactions
> ...
> For Type 1 translations, the host bridge directly copies the contents of the
> CONFIG_ADDRESS register (excluding bits 31 and 0) onto the PCI AD lines during the
> address phase of a configuration transaction making sure that AD[1::0] is "01".

note the: "excluding bits 31 and 0"

What happens in qemu instead is that it uses bit 0 of the CONFIG_ADDRESS
register as part of the register offset (when it probably should ignore it)
when translating from Type 1 to Type 0 address. So once it reaches the device
behind the bridge the register address is off by one.

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1901359

Title:
  ignore bit 0 in pci CONFIG_ADDRESS register write for Type 1 access

Status in QEMU:
  New

Bug description:
  I'v recently stumbled upon a bug in the Plan9 PCI config space access
  routines for config mode #1.

  The code used to set bit 0 in the CONFIG_ADDRESS register for a Type 1
  access.

  This was most likely a misreading of the PCI local bus specification
  on our side.

  However, in the PCI local bus specification 3.0, it states the
  following:

  > 3.2.2.3.2 Software Generation of Configuration Transactions
  > ...
  > For Type 1 translations, the host bridge directly copies the contents of the
  > CONFIG_ADDRESS register (excluding bits 31 and 0) onto the PCI AD lines during the
  > address phase of a configuration transaction making sure that AD[1::0] is "01".

  note the: "excluding bits 31 and 0"

  What happens in qemu instead is that it uses bit 0 of the CONFIG_ADDRESS
  register as part of the register offset (when it probably should ignore it)
  when translating from Type 1 to Type 0 address. So once it reaches the device
  behind the bridge the register address is off by one.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1901359/+subscriptions


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-07-09  4:29 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-24 23:25 [Bug 1901359] [NEW] ignore bit 0 in pci CONFIG_ADDRESS register write for Type 1 access cinap_lenrek
2021-01-07  0:26 ` [Bug 1901359] " cinap_lenrek
2021-05-09 14:37 ` Thomas Huth
2021-07-09  4:17 ` Launchpad Bug Tracker

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).