qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* qemu-system-aarch64 crashes with device ich9-usb-ehci1
@ 2021-03-25 16:58 Thomas Huth
  2021-03-25 17:12 ` Richard Henderson
  0 siblings, 1 reply; 2+ messages in thread
From: Thomas Huth @ 2021-03-25 16:58 UTC (permalink / raw)
  To: QEMU Developers, qemu-arm; +Cc: Gerd Hoffmann


In case anybody is interested, ich9-usb-ehci1 can be used to crash QEMU:

$ ./qemu-system-aarch64 -M virt -device ich9-usb-ehci1,help
qemu-system-aarch64: ../../devel/qemu/softmmu/physmem.c:1154: 
phys_section_add: Assertion `map->sections_nb < TARGET_PAGE_SIZE' failed.
Aborted (core dumped)

  Thomas



^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: qemu-system-aarch64 crashes with device ich9-usb-ehci1
  2021-03-25 16:58 qemu-system-aarch64 crashes with device ich9-usb-ehci1 Thomas Huth
@ 2021-03-25 17:12 ` Richard Henderson
  0 siblings, 0 replies; 2+ messages in thread
From: Richard Henderson @ 2021-03-25 17:12 UTC (permalink / raw)
  To: Thomas Huth, QEMU Developers, qemu-arm; +Cc: Gerd Hoffmann

On 3/25/21 10:58 AM, Thomas Huth wrote:
> 
> In case anybody is interested, ich9-usb-ehci1 can be used to crash QEMU:
> 
> $ ./qemu-system-aarch64 -M virt -device ich9-usb-ehci1,help
> qemu-system-aarch64: ../../devel/qemu/softmmu/physmem.c:1154: phys_section_add: 
> Assertion `map->sections_nb < TARGET_PAGE_SIZE' failed.
> Aborted (core dumped)

That's because

#14 0x0000555555afad47 in usb_ehci_init (s=0x555556ee54b0, dev=0x555556ee4bb0)
     at ../qemu/hw/usb/hcd-ehci.c:2585

is doing stuff at init time that should be done at realize.

The virt board has not yet set the system page size, which is currently at 0.


r~


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-03-25 17:16 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-25 16:58 qemu-system-aarch64 crashes with device ich9-usb-ehci1 Thomas Huth
2021-03-25 17:12 ` Richard Henderson

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).