[PATCH 1/2] hw/ide/core.c (cmd_read_native_max): Avoid limited device parameters

[PATCH 1/2] hw/ide/core.c (cmd_read_native_max): Avoid limited device parameters

[Lev Kujawski]

Always use the native CHS device parameters for the ATA commands READ
NATIVE MAX ADDRESS and READ NATIVE MAX ADDRESS EXT, not those limited
by the ATA command INITIALIZE_DEVICE_PARAMETERS (introduced in patch
176e4961, hw/ide/core.c: Implement ATA INITIALIZE_DEVICE_PARAMETERS
command, 2022-07-07.)

As stated by the ATA/ATAPI specification, "[t]he native maximum is the
highest address accepted by the device in the factory default
condition."  Therefore this patch substitutes the native values in
drive_heads and drive_sectors before calling ide_set_sector().

One consequence of the prior behavior was that setting zero sectors
per track could lead to an FPE within ide_set_sector().  Thanks to
Alexander Bulekov for reporting this issue.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1243
Signed-off-by: Lev Kujawski <lkujaw@mailbox.org>
---
 hw/ide/core.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 39afdc0006..ee836401bc 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1608,11 +1608,24 @@ static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
     /* Refuse if no sectors are addressable (e.g. medium not inserted) */
     if (s->nb_sectors == 0) {
         ide_abort_command(s);
-        return true;
-    }
+    } else {
+        /*
+         * Save the active drive parameters, which may have been
+         * limited from their native counterparts by, e.g., INITIALIZE
+         * DEVICE PARAMETERS or SET MAX ADDRESS.
+         */
+        const int aheads = s->heads;
+        const int asectors = s->sectors;
 
-    ide_cmd_lba48_transform(s, lba48);
-    ide_set_sector(s, s->nb_sectors - 1);
+        s->heads = s->drive_heads;
+        s->sectors = s->drive_sectors;
+
+        ide_cmd_lba48_transform(s, lba48);
+        ide_set_sector(s, s->nb_sectors - 1);
+
+        s->heads = aheads;
+        s->sectors = asectors;
+    }
 
     return true;
 }
-- 
2.34.1

[PATCH 2/2] tests/qtest/ide-test: Verify READ NATIVE MAX ADDRESS is not limited

[Lev Kujawski]

Verify that the ATA command READ NATIVE MAX ADDRESS returns the last
valid CHS tuple for the native device rather than any limit
established by INITIALIZE DEVICE PARAMETERS.

Signed-off-by: Lev Kujawski <lkujaw@mailbox.org>
---
 tests/qtest/ide-test.c | 47 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/ide-test.c b/tests/qtest/ide-test.c
index dbe1563b23..c406e6752a 100644
--- a/tests/qtest/ide-test.c
+++ b/tests/qtest/ide-test.c
@@ -37,7 +37,8 @@
 /* TODO actually test the results and get rid of this */
 #define qmp_discard_response(q, ...) qobject_unref(qtest_qmp(q, __VA_ARGS__))
 
-#define TEST_IMAGE_SIZE 64 * 1024 * 1024
+/* Specified by ATA (physical) CHS geometry for ~64 MiB device.  */
+#define TEST_IMAGE_SIZE ((130 * 16 * 63) * 512)
 
 #define IDE_PCI_DEV     1
 #define IDE_PCI_FUNC    1
@@ -91,11 +92,13 @@ enum {
 enum {
     CMD_DSM         = 0x06,
     CMD_DIAGNOSE    = 0x90,
+    CMD_INIT_DP     = 0x91,  /* INITIALIZE DEVICE PARAMETERS */
     CMD_READ_DMA    = 0xc8,
     CMD_WRITE_DMA   = 0xca,
     CMD_FLUSH_CACHE = 0xe7,
     CMD_IDENTIFY    = 0xec,
     CMD_PACKET      = 0xa0,
+    CMD_READ_NATIVE = 0xf8,  /* READ NATIVE MAX ADDRESS */
 
     CMDF_ABORT      = 0x100,
     CMDF_NO_BM      = 0x200,
@@ -562,6 +565,46 @@ static void string_cpu_to_be16(uint16_t *s, size_t bytes)
     }
 }
 
+static void test_specify(void)
+{
+    QTestState *qts;
+    QPCIDevice *dev;
+    QPCIBar bmdma_bar, ide_bar;
+    uint16_t cyls;
+    uint8_t heads, spt;
+
+    qts = ide_test_start(
+        "-blockdev driver=file,node-name=hda,filename=%s "
+        "-device ide-hd,drive=hda,bus=ide.0,unit=0 ",
+        tmp_path[0]);
+
+    dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
+
+    /* Initialize drive with zero sectors per track and one head.  */
+    qpci_io_writeb(dev, ide_bar, reg_nsectors, 0);
+    qpci_io_writeb(dev, ide_bar, reg_device, 0);
+    qpci_io_writeb(dev, ide_bar, reg_command, CMD_INIT_DP);
+
+    /* READ NATIVE MAX ADDRESS (CHS mode).  */
+    qpci_io_writeb(dev, ide_bar, reg_device, 0xa0);
+    qpci_io_writeb(dev, ide_bar, reg_command, CMD_READ_NATIVE);
+
+    heads = qpci_io_readb(dev, ide_bar, reg_device) & 0xf;
+    ++heads;
+    g_assert_cmpint(heads, ==, 16);
+
+    cyls = qpci_io_readb(dev, ide_bar, reg_lba_high) << 8;
+    cyls |= qpci_io_readb(dev, ide_bar, reg_lba_middle);
+    ++cyls;
+    g_assert_cmpint(cyls, ==, 130);
+
+    spt = qpci_io_readb(dev, ide_bar, reg_lba_low);
+    g_assert_cmpint(spt, ==, 63);
+
+    ide_test_quit(qts);
+    free_pci_device(dev);
+}
+
 static void test_identify(void)
 {
     QTestState *qts;
@@ -1079,6 +1122,8 @@ int main(int argc, char **argv)
     /* Run the tests */
     g_test_init(&argc, &argv, NULL);
 
+    qtest_add_func("/ide/read_native", test_specify);
+
     qtest_add_func("/ide/identify", test_identify);
 
     qtest_add_func("/ide/diagnostic", test_diagnostic);
-- 
2.34.1

Re: [PATCH 2/2] tests/qtest/ide-test: Verify READ NATIVE MAX ADDRESS is not limited

[Thomas Huth]

On 10/10/2022 10.52, Lev Kujawski wrote:
> Verify that the ATA command READ NATIVE MAX ADDRESS returns the last
> valid CHS tuple for the native device rather than any limit
> established by INITIALIZE DEVICE PARAMETERS.
> 
> Signed-off-by: Lev Kujawski <lkujaw@mailbox.org>
> ---
>   tests/qtest/ide-test.c | 47 +++++++++++++++++++++++++++++++++++++++++-
>   1 file changed, 46 insertions(+), 1 deletion(-)
> 
> diff --git a/tests/qtest/ide-test.c b/tests/qtest/ide-test.c
> index dbe1563b23..c406e6752a 100644
> --- a/tests/qtest/ide-test.c
> +++ b/tests/qtest/ide-test.c
> @@ -37,7 +37,8 @@
>   /* TODO actually test the results and get rid of this */
>   #define qmp_discard_response(q, ...) qobject_unref(qtest_qmp(q, __VA_ARGS__))
>   
> -#define TEST_IMAGE_SIZE 64 * 1024 * 1024
> +/* Specified by ATA (physical) CHS geometry for ~64 MiB device.  */
> +#define TEST_IMAGE_SIZE ((130 * 16 * 63) * 512)
>   
>   #define IDE_PCI_DEV     1
>   #define IDE_PCI_FUNC    1
> @@ -91,11 +92,13 @@ enum {
>   enum {
>       CMD_DSM         = 0x06,
>       CMD_DIAGNOSE    = 0x90,
> +    CMD_INIT_DP     = 0x91,  /* INITIALIZE DEVICE PARAMETERS */
>       CMD_READ_DMA    = 0xc8,
>       CMD_WRITE_DMA   = 0xca,
>       CMD_FLUSH_CACHE = 0xe7,
>       CMD_IDENTIFY    = 0xec,
>       CMD_PACKET      = 0xa0,
> +    CMD_READ_NATIVE = 0xf8,  /* READ NATIVE MAX ADDRESS */
>   
>       CMDF_ABORT      = 0x100,
>       CMDF_NO_BM      = 0x200,
> @@ -562,6 +565,46 @@ static void string_cpu_to_be16(uint16_t *s, size_t bytes)
>       }
>   }
>   
> +static void test_specify(void)
> +{
> +    QTestState *qts;
> +    QPCIDevice *dev;
> +    QPCIBar bmdma_bar, ide_bar;
> +    uint16_t cyls;
> +    uint8_t heads, spt;
> +
> +    qts = ide_test_start(
> +        "-blockdev driver=file,node-name=hda,filename=%s "
> +        "-device ide-hd,drive=hda,bus=ide.0,unit=0 ",
> +        tmp_path[0]);
> +
> +    dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
> +
> +    /* Initialize drive with zero sectors per track and one head.  */
> +    qpci_io_writeb(dev, ide_bar, reg_nsectors, 0);
> +    qpci_io_writeb(dev, ide_bar, reg_device, 0);
> +    qpci_io_writeb(dev, ide_bar, reg_command, CMD_INIT_DP);
> +
> +    /* READ NATIVE MAX ADDRESS (CHS mode).  */
> +    qpci_io_writeb(dev, ide_bar, reg_device, 0xa0);
> +    qpci_io_writeb(dev, ide_bar, reg_command, CMD_READ_NATIVE);
> +
> +    heads = qpci_io_readb(dev, ide_bar, reg_device) & 0xf;
> +    ++heads;
> +    g_assert_cmpint(heads, ==, 16);
> +
> +    cyls = qpci_io_readb(dev, ide_bar, reg_lba_high) << 8;
> +    cyls |= qpci_io_readb(dev, ide_bar, reg_lba_middle);
> +    ++cyls;
> +    g_assert_cmpint(cyls, ==, 130);
> +
> +    spt = qpci_io_readb(dev, ide_bar, reg_lba_low);
> +    g_assert_cmpint(spt, ==, 63);
> +
> +    ide_test_quit(qts);
> +    free_pci_device(dev);
> +}
> +
>   static void test_identify(void)
>   {
>       QTestState *qts;
> @@ -1079,6 +1122,8 @@ int main(int argc, char **argv)
>       /* Run the tests */
>       g_test_init(&argc, &argv, NULL);
>   
> +    qtest_add_func("/ide/read_native", test_specify);
> +
>       qtest_add_func("/ide/identify", test_identify);
>   
>       qtest_add_func("/ide/diagnostic", test_diagnostic);

Acked-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH 2/2] tests/qtest/ide-test: Verify READ NATIVE MAX ADDRESS is not limited

[John Snow]

On Mon, Oct 10, 2022 at 4:52 AM Lev Kujawski <lkujaw@mailbox.org> wrote:
>
> Verify that the ATA command READ NATIVE MAX ADDRESS returns the last
> valid CHS tuple for the native device rather than any limit
> established by INITIALIZE DEVICE PARAMETERS.
>
> Signed-off-by: Lev Kujawski <lkujaw@mailbox.org>

Does this still need to be staged or merged?

--js

> ---
>  tests/qtest/ide-test.c | 47 +++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 46 insertions(+), 1 deletion(-)
>
> diff --git a/tests/qtest/ide-test.c b/tests/qtest/ide-test.c
> index dbe1563b23..c406e6752a 100644
> --- a/tests/qtest/ide-test.c
> +++ b/tests/qtest/ide-test.c
> @@ -37,7 +37,8 @@
>  /* TODO actually test the results and get rid of this */
>  #define qmp_discard_response(q, ...) qobject_unref(qtest_qmp(q, __VA_ARGS__))
>
> -#define TEST_IMAGE_SIZE 64 * 1024 * 1024
> +/* Specified by ATA (physical) CHS geometry for ~64 MiB device.  */
> +#define TEST_IMAGE_SIZE ((130 * 16 * 63) * 512)
>
>  #define IDE_PCI_DEV     1
>  #define IDE_PCI_FUNC    1
> @@ -91,11 +92,13 @@ enum {
>  enum {
>      CMD_DSM         = 0x06,
>      CMD_DIAGNOSE    = 0x90,
> +    CMD_INIT_DP     = 0x91,  /* INITIALIZE DEVICE PARAMETERS */
>      CMD_READ_DMA    = 0xc8,
>      CMD_WRITE_DMA   = 0xca,
>      CMD_FLUSH_CACHE = 0xe7,
>      CMD_IDENTIFY    = 0xec,
>      CMD_PACKET      = 0xa0,
> +    CMD_READ_NATIVE = 0xf8,  /* READ NATIVE MAX ADDRESS */
>
>      CMDF_ABORT      = 0x100,
>      CMDF_NO_BM      = 0x200,
> @@ -562,6 +565,46 @@ static void string_cpu_to_be16(uint16_t *s, size_t bytes)
>      }
>  }
>
> +static void test_specify(void)
> +{
> +    QTestState *qts;
> +    QPCIDevice *dev;
> +    QPCIBar bmdma_bar, ide_bar;
> +    uint16_t cyls;
> +    uint8_t heads, spt;
> +
> +    qts = ide_test_start(
> +        "-blockdev driver=file,node-name=hda,filename=%s "
> +        "-device ide-hd,drive=hda,bus=ide.0,unit=0 ",
> +        tmp_path[0]);
> +
> +    dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
> +
> +    /* Initialize drive with zero sectors per track and one head.  */
> +    qpci_io_writeb(dev, ide_bar, reg_nsectors, 0);
> +    qpci_io_writeb(dev, ide_bar, reg_device, 0);
> +    qpci_io_writeb(dev, ide_bar, reg_command, CMD_INIT_DP);
> +
> +    /* READ NATIVE MAX ADDRESS (CHS mode).  */
> +    qpci_io_writeb(dev, ide_bar, reg_device, 0xa0);
> +    qpci_io_writeb(dev, ide_bar, reg_command, CMD_READ_NATIVE);
> +
> +    heads = qpci_io_readb(dev, ide_bar, reg_device) & 0xf;
> +    ++heads;
> +    g_assert_cmpint(heads, ==, 16);
> +
> +    cyls = qpci_io_readb(dev, ide_bar, reg_lba_high) << 8;
> +    cyls |= qpci_io_readb(dev, ide_bar, reg_lba_middle);
> +    ++cyls;
> +    g_assert_cmpint(cyls, ==, 130);
> +
> +    spt = qpci_io_readb(dev, ide_bar, reg_lba_low);
> +    g_assert_cmpint(spt, ==, 63);
> +
> +    ide_test_quit(qts);
> +    free_pci_device(dev);
> +}
> +
>  static void test_identify(void)
>  {
>      QTestState *qts;
> @@ -1079,6 +1122,8 @@ int main(int argc, char **argv)
>      /* Run the tests */
>      g_test_init(&argc, &argv, NULL);
>
> +    qtest_add_func("/ide/read_native", test_specify);
> +
>      qtest_add_func("/ide/identify", test_identify);
>
>      qtest_add_func("/ide/diagnostic", test_diagnostic);
> --
> 2.34.1
>

Re: [PATCH 1/2] hw/ide/core.c (cmd_read_native_max): Avoid limited device parameters

[John Snow]

On Mon, Oct 10, 2022 at 4:52 AM Lev Kujawski <lkujaw@mailbox.org> wrote:
>
> Always use the native CHS device parameters for the ATA commands READ
> NATIVE MAX ADDRESS and READ NATIVE MAX ADDRESS EXT, not those limited
> by the ATA command INITIALIZE_DEVICE_PARAMETERS (introduced in patch
> 176e4961, hw/ide/core.c: Implement ATA INITIALIZE_DEVICE_PARAMETERS
> command, 2022-07-07.)
>
> As stated by the ATA/ATAPI specification, "[t]he native maximum is the
> highest address accepted by the device in the factory default
> condition."  Therefore this patch substitutes the native values in
> drive_heads and drive_sectors before calling ide_set_sector().
>
> One consequence of the prior behavior was that setting zero sectors
> per track could lead to an FPE within ide_set_sector().  Thanks to
> Alexander Bulekov for reporting this issue.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1243
> Signed-off-by: Lev Kujawski <lkujaw@mailbox.org>

Does this need attention?

--js

> ---
>  hw/ide/core.c | 21 +++++++++++++++++----
>  1 file changed, 17 insertions(+), 4 deletions(-)
>
> diff --git a/hw/ide/core.c b/hw/ide/core.c
> index 39afdc0006..ee836401bc 100644
> --- a/hw/ide/core.c
> +++ b/hw/ide/core.c
> @@ -1608,11 +1608,24 @@ static bool cmd_read_native_max(IDEState *s, uint8_t cmd)
>      /* Refuse if no sectors are addressable (e.g. medium not inserted) */
>      if (s->nb_sectors == 0) {
>          ide_abort_command(s);
> -        return true;
> -    }
> +    } else {
> +        /*
> +         * Save the active drive parameters, which may have been
> +         * limited from their native counterparts by, e.g., INITIALIZE
> +         * DEVICE PARAMETERS or SET MAX ADDRESS.
> +         */
> +        const int aheads = s->heads;
> +        const int asectors = s->sectors;
>
> -    ide_cmd_lba48_transform(s, lba48);
> -    ide_set_sector(s, s->nb_sectors - 1);
> +        s->heads = s->drive_heads;
> +        s->sectors = s->drive_sectors;
> +
> +        ide_cmd_lba48_transform(s, lba48);
> +        ide_set_sector(s, s->nb_sectors - 1);
> +
> +        s->heads = aheads;
> +        s->sectors = asectors;
> +    }
>
>      return true;
>  }
> --
> 2.34.1
>

Re: [PATCH 1/2] hw/ide/core.c (cmd_read_native_max): Avoid limited device parameters

[Lev Kujawski]

John Snow writes:

> On Mon, Oct 10, 2022 at 4:52 AM Lev Kujawski <lkujaw@mailbox.org> wrote:
>>
>> Always use the native CHS device parameters for the ATA commands READ
>> NATIVE MAX ADDRESS and READ NATIVE MAX ADDRESS EXT, not those limited
>> by the ATA command INITIALIZE_DEVICE_PARAMETERS (introduced in patch
>> 176e4961, hw/ide/core.c: Implement ATA INITIALIZE_DEVICE_PARAMETERS
>> command, 2022-07-07.)
>>
>> As stated by the ATA/ATAPI specification, "[t]he native maximum is the
>> highest address accepted by the device in the factory default
>> condition."  Therefore this patch substitutes the native values in
>> drive_heads and drive_sectors before calling ide_set_sector().
>>
>> One consequence of the prior behavior was that setting zero sectors
>> per track could lead to an FPE within ide_set_sector().  Thanks to
>> Alexander Bulekov for reporting this issue.
>>
>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1243
>> Signed-off-by: Lev Kujawski <lkujaw@mailbox.org>
>
> Does this need attention?
>
> --js
>

Hi John,

This patch needs to be merged to mitigate issue 1243, which is still
present within QEMU master as of aa96ab7c9d.

Thanks, Lev

Re: [PATCH 1/2] hw/ide/core.c (cmd_read_native_max): Avoid limited device parameters

[Alexander Bulekov]

On 230112 0412, Lev Kujawski wrote:
> 
> John Snow writes:
> 
> > On Mon, Oct 10, 2022 at 4:52 AM Lev Kujawski <lkujaw@mailbox.org> wrote:
> >>
> >> Always use the native CHS device parameters for the ATA commands READ
> >> NATIVE MAX ADDRESS and READ NATIVE MAX ADDRESS EXT, not those limited
> >> by the ATA command INITIALIZE_DEVICE_PARAMETERS (introduced in patch
> >> 176e4961, hw/ide/core.c: Implement ATA INITIALIZE_DEVICE_PARAMETERS
> >> command, 2022-07-07.)
> >>
> >> As stated by the ATA/ATAPI specification, "[t]he native maximum is the
> >> highest address accepted by the device in the factory default
> >> condition."  Therefore this patch substitutes the native values in
> >> drive_heads and drive_sectors before calling ide_set_sector().
> >>
> >> One consequence of the prior behavior was that setting zero sectors
> >> per track could lead to an FPE within ide_set_sector().  Thanks to
> >> Alexander Bulekov for reporting this issue.
> >>
> >> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1243
> >> Signed-off-by: Lev Kujawski <lkujaw@mailbox.org>
> >
> > Does this need attention?
> >
> > --js
> >
> 
> Hi John,
> 
> This patch needs to be merged to mitigate issue 1243, which is still
> present within QEMU master as of aa96ab7c9d.
> 
> Thanks, Lev
> 

Ping. oss-fuzz re-discovered this bug.