Re: [Qemu-devel] [PATCH master/stable-1.0] pci: fix corrupted pci conf index register by unaligned write

[Michael S. Tsirkin]

On Sun, Jan 08, 2012 at 12:02:35PM +0200, Avi Kivity wrote:
> On 01/08/2012 11:17 AM, Michael S. Tsirkin wrote:
> > On Thu, Jan 05, 2012 at 04:14:29PM +0100, Stefan Weil wrote:
> > > Am 04.01.2012 15:47, schrieb Michael S. Tsirkin:
> > > >On Wed, Jan 04, 2012 at 04:28:42PM +0200, Avi Kivity wrote:
> > > >>Commit d0ed8076cbdc261 converted the PCI config access to the memory
> > > >>API, but also inadvertantly changed it to accept unaligned writes,
> > > >>and corrupt the index register in the process. This causes a regression
> > > >>booting NetBSD.
> > > >>
> > > >>Fix by ignoring unaligned or non-dword writes.
> > > >>
> > > >>https://bugs.launchpad.net/qemu/+bug/897771
> > > >>
> > > >>Reported-by: Andreas Gustafsson <address@hidden>
> > > >>Signed-off-by: Avi Kivity <address@hidden>
> > > >
> > > >Acked-by: Michael S. Tsirkin <address@hidden>
> > > >
> > > >>---
> > > >>
> > > >>hw/pci_host.c | 3 +++
> > > >>1 files changed, 3 insertions(+), 0 deletions(-)
> > > >>
> > > >>diff --git a/hw/pci_host.c b/hw/pci_host.c
> > > >>index 44c6c20..8041778 100644
> > > >>--- a/hw/pci_host.c
> > > >>+++ b/hw/pci_host.c
> > > >>@@ -101,6 +101,9 @@ static void pci_host_config_write(void
> > > >>*opaque, target_phys_addr_t addr,
> > > >>
> > > >>PCI_DPRINTF("%s addr " TARGET_FMT_plx " len %d val %"PRIx64"\n",
> > > >>__func__, addr, len, val);
> > > >>+ if (addr != 0 || len != 4) {
> > > >>+ return;
> > > >>+ }
> > > >>s->config_reg = val;
> > > >>}
> > > >>
> > > >>-- 
> > > >>1.7.7.1
> > > 
> > > Non dword writes are quite common. I get them with Linux kernels, too.
> > > Do you really want to ignore them?
> >
> > Are you sure?
> > Note this is an io write at cf8. Not an unaligned config write.
> >
> > > And the check for unaligned writes is, well, unusual :-)
> 
> What's unusual?
> 
> 
> > This seems to be how memory API behaves ... right, Avi?
> > Maybe this should be documented somewhere.
> 
> Document what?

That address passed to callbacks is in fact an offset
from start of the region.

> -- 
> error compiling committee.c: too many arguments to function