Re: Re: PCI BAR register space written with garbage in HVM guest.

[Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>]

> open("/sys/bus/pci/devices/0000:08:00.0/config", O_RDWR) = 6
> 5904  21:35:47 [    7f05d53fa3c8] pwrite(6, "\6\1", 2, 4) = 2
> 5904  21:35:47 [    7f05d3b6eb77] ioctl(16, EVIOCGKEYCODE, 0x7fffdde98890) = 0
> 5904  21:35:47 [    7f05d53f987b] read(4, 0x7fffdde98870, 16) = -1
> EAGAIN (Resource temporarily unavailable)
> 5904  21:35:47 [    7fffddf437dc] clock_gettime(CLOCK_MONOTONIC,
> {1724, 868201462}) = 0
> 5904  21:35:47 [    7fffddf437dc] clock_gettime(CLOCK_MONOTONIC,
> {1724, 868259075}) = 0

There is a snippet of QEMU that has that (hw/pass-through.c),
function pt_pci_write_config:

.. snip ..
      ret = pci_write_block(pci_dev, address, (uint8_t *)&val, len);

        if (!ret)
            PT_LOG("Error: pci_write_block failed. return value[%d].\n",
ret);
    }    

    if (pm_state != NULL && pm_state->flags & PT_FLAG_TRANSITING)
        /* set QEMUTimer */
        qemu_mod_timer(pm_state->pm_timer,
            (qemu_get_clock(rt_clock) + pm_state->pm_delay));

> 
> <snip>
> 
> 5904  21:35:48 [    7f05d53f987b] read(16, "o\0\0\0", 4) = 4
> 5904  21:35:48 [    7f05d53f97fb] write(16, "o\0\0\0", 4) = 4
> 5904  21:35:48 [    7f05d53f97fb] write(6,
> "\377\377\377\377\377\377\0\26>2\325d\10\0E\0\2@\0\354\0\0@\21w\302\0\0\0\0\377\377"...,
> 590) = 256

I would turn on all of those debug options and see if anything is
happening.

Actually I would instrument all of the 'pci_write_block' calls.

> 
> Notice the length of 590 bytes!  The EIP also matches what the kernel
> thinks was the syscall which caused the write.
> 
> Anyone have any idea where this could be happening in qemu?  I'm

Can you attach debug to it? Or maybe run 'objdump' on the qemu-dm and
see if the address correspond to some code in it?