Bug 843282
| Summary: | libvirt reads PCI_BRIDGE_CONTROL from wrong device | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Alex Williamson <alex.williamson> |
| Component: | libvirt | Assignee: | Osier Yang <jyang> |
| Status: | CLOSED DUPLICATE | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.3 | CC: | acathrow, ajia, dallan, dyasny, dyuan, mzhan, rwu, weizhan |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-09-05 06:54:03 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
(In reply to comment #0) > Description of problem: > src/util/pci.c:pciTrySecondaryBusReset: > > /* Read the control register, set the reset flag, wait 200ms, > * unset the reset flag and wait 200ms. > */ > ctl = pciRead16(dev, PCI_BRIDGE_CONTROL); > ^^^ > > pciWrite16(parent, PCI_BRIDGE_CONTROL, ctl | PCI_BRIDGE_CTL_RESET); > > usleep(200 * 1000); /* sleep 200ms */ > > pciWrite16(parent, PCI_BRIDGE_CONTROL, ctl); > > usleep(200 * 1000); /* sleep 200ms */ > > Why are we reading the PCI_BRIDGE_CONTROL from dev (the device we want > reset) and writing and restoring to parent? The initial read should also be > from the parent bridge. I think this is caused by old codes assumes any device with devices/functions behind the same bus is refused at the very beginning of secondary bus resetting, so it should be fixed with 842017 together. And on the other hand, it's hard for QE to very this bug. So close this as DUPLICATE. *** This bug has been marked as a duplicate of bug 842017 *** |
Description of problem: src/util/pci.c:pciTrySecondaryBusReset: /* Read the control register, set the reset flag, wait 200ms, * unset the reset flag and wait 200ms. */ ctl = pciRead16(dev, PCI_BRIDGE_CONTROL); ^^^ pciWrite16(parent, PCI_BRIDGE_CONTROL, ctl | PCI_BRIDGE_CTL_RESET); usleep(200 * 1000); /* sleep 200ms */ pciWrite16(parent, PCI_BRIDGE_CONTROL, ctl); usleep(200 * 1000); /* sleep 200ms */ Why are we reading the PCI_BRIDGE_CONTROL from dev (the device we want reset) and writing and restoring to parent? The initial read should also be from the parent bridge. Version-Release number of selected component (if applicable): libvirt-0.9.13-2.el6 How reproducible: Unknown, found in code read Steps to Reproduce: 1. 2. 3. Actual results: Hard to predict, the bridge control register is offset 0x3e which is standard PCI config space for a device (min_gnt/max_lat) which may contain data. So we're potentially blasting arbitrary bits into the bridge control register. Expected results: Additional info: