From nobody Fri May 17 07:47:11 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of _spf.google.com designates 209.85.128.53 as permitted sender) client-ip=209.85.128.53; envelope-from=philippe.mathieu.daude@gmail.com; helo=mail-wm1-f53.google.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of _spf.google.com designates 209.85.128.53 as permitted sender) smtp.mailfrom=philippe.mathieu.daude@gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1622039082; cv=none; d=zohomail.com; s=zohoarc; b=nkvT7GfAB+5aJ8Cfzmkral26rAeiIp1bS+dJEcJoT7nApjOx4j8nF98vaXqcfnYDoh6tb69xRyjEbGPBMYeQIVa245sZvZ4vy0bgOuhkmNbhRjKkocQlbOB6eQ5GgvX9GnOpfgxB3oAQBfOKAj/hhzhL0jM7fL6050wCWMPbmZk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1622039082; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:MIME-Version:Message-ID:Sender:Subject:To; bh=ORCeOe/azUUD6/5loOQJVMd3UNGL2eaY5a9u5h5/+WY=; b=KB5E2NNvLex6DzTKrjo73R6AH2GPdNNLeW+aDTJZ7Wq1dTTNYGaIY2YC35+oipSvpTkiqCuw9QFapmNYijEByTftDRNDC3LXoMdJcvUTnQZOKpX/o4KWl3rKRBJhE4aTP+q1WFQ2GthuOlrKfs9YyMBHoSK2z2oKD7bIOos+Svk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of _spf.google.com designates 209.85.128.53 as permitted sender) smtp.mailfrom=philippe.mathieu.daude@gmail.com Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.zohomail.com with SMTPS id 1622039082746460.82738313239474; Wed, 26 May 2021 07:24:42 -0700 (PDT) Received: by mail-wm1-f53.google.com with SMTP id z130so841234wmg.2 for ; Wed, 26 May 2021 07:24:42 -0700 (PDT) Return-Path: Return-Path: Received: from localhost.localdomain (64.red-88-10-103.dynamicip.rima-tde.net. [88.10.103.64]) by smtp.gmail.com with ESMTPSA id p5sm22002220wrd.25.2021.05.26.07.24.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 May 2021 07:24:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ORCeOe/azUUD6/5loOQJVMd3UNGL2eaY5a9u5h5/+WY=; b=WEml9EGxhbzp8s9P8UkP9wfbs+CtOgQZQrf8LCx//os/KhXgaxva66W9y3AEH5h6Mn 8tv77hS5Ugtpaz6UV4LYLpAuciLzG+ZokkCeI1fbwOGs2GbiHRj7kn8NRZBUV0nAMPPW XDnjsGlPO0VU1TA0Ppz8hs9sUpJNJURnKCjzEXlQA2iT6VndcVKMLx73ffwWv1yRWr+2 gspC8gSmBbNZ2EEDzcQ2esI5aNSY1a+dPQnV/txADBhOyx2A8YziTyxk+jfMFkX+EGYV hMxOrP8SC4ZW/mBTUbLFroQXz7WIVb91TJz//cmYzIpor3FbqLtGhV7gIGr3z+Djb0EW 72pQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :mime-version:content-transfer-encoding; bh=ORCeOe/azUUD6/5loOQJVMd3UNGL2eaY5a9u5h5/+WY=; b=qBMteOvJcrUQiYckYae29C7I+s7h1UfmMe8JFpbTzly7KSUR8rBq9f9Z+cu7rKxpcS tuMGufzqKAhY/aFdzKWspsPhRSXtXCyMqX1iRQ92fqsRwZ7OsDJUtIphobR04K+77Cyy 8d5HaxM0X8j+8QFH30+LlBS3udkQOgkZ6lCAvtMiFzJjU+ZKnnlFG48+mEoEiRkMyJRR 33EZ111p2c4ZGxxn9wLfIgjm6Y9+xMZrEdQpfay24+e3EIs4twhHuVReRF0H6VCME6Pe 0Y9wlBVGKhcoK446bfNC/MN5J+TtTUmDLEtdzbPXM9cx1jp/y2/kjjQIHYi6i5HdZ98s nkIQ== X-Gm-Message-State: AOAM5312TCR8p5IDJJdIIq20PzUx+ks9NDGC+al8ZcB53PEOfH/1JvlI 5SRwfDgHRP0N1YEo/GRtWM8= X-Google-Smtp-Source: ABdhPJzstc/Gy04+9cH2zR5Ff9PIb23FSM7UwaXkFJhoCHyVStgpXqnVr+3Fbuuu2AueMZbFG0e4vg== X-Received: by 2002:a1c:4006:: with SMTP id n6mr1493627wma.58.1622039080910; Wed, 26 May 2021 07:24:40 -0700 (PDT) Sender: =?UTF-8?Q?Philippe_Mathieu=2DDaud=C3=A9?= From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: Thomas Huth , "Michael S. Tsirkin" , Marcel Apfelbaum , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , qemu-stable@nongnu.org, Alexander Bulekov , Richard Henderson Subject: [PATCH v2] hw/pci-host/q35: Ignore write of reserved PCIEXBAR LENGTH field Date: Wed, 26 May 2021 16:24:38 +0200 Message-Id: <20210526142438.281477-1-f4bug@amsat.org> X-Mailer: git-send-email 2.26.3 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @gmail.com) libFuzzer triggered the following assertion: cat << EOF | qemu-system-i386 -M pc-q35-5.0 \ -nographic -monitor none -serial none \ -qtest stdio -d guest_errors -trace pci\* outl 0xcf8 0xf2000060 outl 0xcfc 0x8400056e EOF pci_cfg_write mch 00:0 @0x60 <- 0x8400056e Aborted (core dumped) This is because guest wrote MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD (reserved value) to the PCIE XBAR register. There is no indication on the datasheet about what occurs when this value is written. Simply ignore it on QEMU (and report an guest error): pci_cfg_write mch 00:0 @0x60 <- 0x8400056e Q35: Reserved PCIEXBAR LENGTH pci_cfg_read mch 00:0 @0x0 -> 0x8086 pci_cfg_read mch 00:0 @0x0 -> 0x29c08086 ... Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov BugLink: https://bugs.launchpad.net/qemu/+bug/1878641 Fixes: df2d8b3ed4 ("q35: Introduce q35 pc based chipset emulator") Reviewed-by: Richard Henderson Signed-off-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Alexander Bulekov --- v2: Do not remove default case (rth) --- hw/pci-host/q35.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c index 2eb729dff58..0f37cf056a9 100644 --- a/hw/pci-host/q35.c +++ b/hw/pci-host/q35.c @@ -29,6 +29,7 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/log.h" #include "hw/i386/pc.h" #include "hw/pci-host/q35.h" #include "hw/qdev-properties.h" @@ -318,6 +319,8 @@ static void mch_update_pciexbar(MCHPCIState *mch) addr_mask |=3D MCH_HOST_BRIDGE_PCIEXBAR_64ADMSK; break; case MCH_HOST_BRIDGE_PCIEXBAR_LENGTH_RVD: + qemu_log_mask(LOG_GUEST_ERROR, "Q35: Reserved PCIEXBAR LENGTH\n"); + return; default: abort(); } --=20 2.26.3