Re: [PATCH] hw/dma/i8257: Return zeroes for read_memory in verify mode

["Daniel P. Berrangé" <berrange@redhat.com>]

On Mon, Jun 29, 2026 at 03:01:28PM +0100, Peter Maydell wrote:
> The i8257 DMA controller has a "verify" mode, which the datasheet
> describes like this:
> 
> > DMA verify, which does not actually involve the transfer of data.
> > When an 8257 channel is in the DMA verify mode, it will respond the
> > same as described for transfer operations, except that no memory or
> > I/O read/write control signals will be generated.  When an 8257
> > channel is in the DMA verify mode, it will respond the same as
> > described for transfer operations, except that no memory or I/O read
> > /write control signals will be generated, thus preventing the
> > transfer of data.  The 8257, however, will gain control of the system
> > bus and will acknowledge the peripheral's DMA request for each DMA
> > cycle.  The perihperal can use these acknowledge signals to enable an
> > internal access of each byte of a data block in order to execute some
> > verification procedure, such as the accumulation of a CRC check word.
> 
> In practice, for QEMU's purposes the only real user of this is the
> floppy controller, which can be made to perform a "read data from
> floppy disk and check the checksum" by telling the fdc to do a read
> and the DMA controller to do a verify.  This causes the fdc to do all
> the usual read actions including the checksum, but the data is never
> written to memory.  However, it is possible for a guest doing
> something silly to program the DMA controller to do a verify
> operation for a device that wants to read from memory.  Currently we
> simply return early from i8257_dma_read_memory() without writing to
> the buffer.  None of the callers (the GUS, sb16 and cs4231a sound
> cards, plus the fdc) expect this, so they will take the uninitialized
> data as if it were from the guest.  This can cause us to leak host
> data off the stack into the guest.
> 
> Make i8257_dma_read_memory() fill the buffer with zeroes rather
> than leaving it untouched for a verify operation.
> 
> Cc: qemu-stable@nongnu.org
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3487
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  hw/dma/i8257.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|