[PATCH v4 3/3] target/i386: emulate: LOG_GUEST_ERROR for read/write from unmapped MMIO

Mohamed Mediouni posted 3 patches 6 days, 23 hours ago
Maintainers: Pierrick Bouvier <pierrick.bouvier@linaro.org>, Pedro Barbuda <pbarbuda@microsoft.com>, Mohamed Mediouni <mohamed@unpredictable.fr>, Paolo Bonzini <pbonzini@redhat.com>, "Marc-André Lureau" <marcandre.lureau@redhat.com>, "Daniel P. Berrangé" <berrange@redhat.com>, "Philippe Mathieu-Daudé" <philmd@linaro.org>, Roman Bolshakov <rbolshakov@ddn.com>, Phil Dennis-Jordan <phil@philjordan.eu>, Wei Liu <wei.liu@kernel.org>
[PATCH v4 3/3] target/i386: emulate: LOG_GUEST_ERROR for read/write from unmapped MMIO
Posted by Mohamed Mediouni 6 days, 23 hours ago
ReactOS's install ISO does a bunch of 4-byte accesses
to 0xffdff124. This doesn't happen for the boot ISO.

It looks to be an access relative to the Windows KPCR
which is at 0xffdff000 but mistakenly done prior to
paging being on...

https://geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/i386_x/kpcr.htm

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
 target/i386/emulate/x86_mmu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/i386/emulate/x86_mmu.c b/target/i386/emulate/x86_mmu.c
index c69ae96acb..815d01d97f 100644
--- a/target/i386/emulate/x86_mmu.c
+++ b/target/i386/emulate/x86_mmu.c
@@ -21,7 +21,7 @@
 #include "cpu.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
-#include "qemu/error-report.h"
+#include "qemu/log.h"
 #include "emulate/x86.h"
 #include "emulate/x86_emu.h"
 #include "emulate/x86_mmu.h"
@@ -287,7 +287,7 @@ static MMUTranslateResult x86_write_mem_ex(CPUState *cpu, void *data, target_ulo
                             MEMTXATTRS_UNSPECIFIED, data, copy);
 
         if (mem_tx_res == MEMTX_DECODE_ERROR) {
-            warn_report("write to unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
+            qemu_log_mask(LOG_GUEST_ERROR, "write to unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
             return MMU_TRANSLATE_GPA_UNMAPPED;
         } else if (mem_tx_res == MEMTX_ACCESS_ERROR) {
             return MMU_TRANSLATE_GPA_NO_WRITE_ACCESS;
@@ -339,7 +339,7 @@ static MMUTranslateResult x86_read_mem_ex(CPUState *cpu, void *data, target_ulon
                            data, copy);
 
         if (mem_tx_res == MEMTX_DECODE_ERROR) {
-            warn_report("read from unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
+            qemu_log_mask(LOG_GUEST_ERROR, "read from unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
             return MMU_TRANSLATE_GPA_UNMAPPED;
         } else if (mem_tx_res == MEMTX_ACCESS_ERROR) {
             return MMU_TRANSLATE_GPA_NO_READ_ACCESS;
-- 
2.50.1 (Apple Git-155)
Re: [PATCH v4 3/3] target/i386: emulate: LOG_GUEST_ERROR for read/write from unmapped MMIO
Posted by Pierrick Bouvier 6 days, 23 hours ago
On 3/26/26 12:33 PM, Mohamed Mediouni wrote:
> ReactOS's install ISO does a bunch of 4-byte accesses
> to 0xffdff124. This doesn't happen for the boot ISO.
> 
> It looks to be an access relative to the Windows KPCR
> which is at 0xffdff000 but mistakenly done prior to
> paging being on...
> 
> https://geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/i386_x/kpcr.htm
> 
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
> ---
>   target/i386/emulate/x86_mmu.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Re: [PATCH v4 3/3] target/i386: emulate: LOG_GUEST_ERROR for read/write from unmapped MMIO
Posted by Mohamed Mediouni 6 days, 23 hours ago

> On 26. Mar 2026, at 20:33, Mohamed Mediouni <mohamed@unpredictable.fr> wrote:
> 
> ReactOS's install ISO does a bunch of 4-byte accesses
> to 0xffdff124. This doesn't happen for the boot ISO.
> 
> It looks to be an access relative to the Windows KPCR
> which is at 0xffdff000 but mistakenly done prior to
> paging being on...
> 
> https://geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/i386_x/kpcr.htm
> 
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>

Thinking about it more, this is not necessary.

Because -d invalid_mem logs this already… 

Sending a new revision… (and got it confirmed that ReactOS does
the same thing under TCG…) 

> ---
> target/i386/emulate/x86_mmu.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/target/i386/emulate/x86_mmu.c b/target/i386/emulate/x86_mmu.c
> index c69ae96acb..815d01d97f 100644
> --- a/target/i386/emulate/x86_mmu.c
> +++ b/target/i386/emulate/x86_mmu.c
> @@ -21,7 +21,7 @@
> #include "cpu.h"
> #include "system/address-spaces.h"
> #include "system/memory.h"
> -#include "qemu/error-report.h"
> +#include "qemu/log.h"
> #include "emulate/x86.h"
> #include "emulate/x86_emu.h"
> #include "emulate/x86_mmu.h"
> @@ -287,7 +287,7 @@ static MMUTranslateResult x86_write_mem_ex(CPUState *cpu, void *data, target_ulo
>                             MEMTXATTRS_UNSPECIFIED, data, copy);
> 
>         if (mem_tx_res == MEMTX_DECODE_ERROR) {
> -            warn_report("write to unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
> +            qemu_log_mask(LOG_GUEST_ERROR, "write to unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
>             return MMU_TRANSLATE_GPA_UNMAPPED;
>         } else if (mem_tx_res == MEMTX_ACCESS_ERROR) {
>             return MMU_TRANSLATE_GPA_NO_WRITE_ACCESS;
> @@ -339,7 +339,7 @@ static MMUTranslateResult x86_read_mem_ex(CPUState *cpu, void *data, target_ulon
>                            data, copy);
> 
>         if (mem_tx_res == MEMTX_DECODE_ERROR) {
> -            warn_report("read from unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
> +            qemu_log_mask(LOG_GUEST_ERROR, "read from unmapped mmio region gpa=0x%" PRIx64 " size=%i", gpa, bytes);
>             return MMU_TRANSLATE_GPA_UNMAPPED;
>         } else if (mem_tx_res == MEMTX_ACCESS_ERROR) {
>             return MMU_TRANSLATE_GPA_NO_READ_ACCESS;
> -- 
> 2.50.1 (Apple Git-155)
>