I think to fix the reproducer we can swap the if=sd for if=none:
qemu-system-i386 -M pc-q35-5.0 \
-qtest stdio \
-device sdhci-pci,sd-spec-version=3 -device sd-card,drive=mydrive \
-drive if=none,index=0,file=null-co://,format=raw,id=mydrive \
-nographic -nographic -serial none -monitor none < attachment2
I confirmed that this reproducer triggers the high-cpu usage for the
QEMU 5.2 build I got from Debian.
That said, this no longer times-out in my 6.0 build, so I think this is
fixed.
-Alex
On 210603 1500, Thomas Huth wrote:
> The latest version of QEMU seems to refuse the provided command line:
>
> qemu-system-i386: -drive if=sd,index=0,file=null-
> co://,format=raw,id=mydrive: machine type does not support
> if=sd,bus=0,unit=0
>
> ... is there still a way to reproduce this issue with the latest QEMU
> version?
>
> ** Changed in: qemu
> Status: New => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1878054
>
> Title:
> Hang with high CPU usage in sdhci_data_transfer
>
> Status in QEMU:
> Incomplete
>
> Bug description:
> Hello,
> While fuzzing, I found an input that causes QEMU to hang with 100% CPU usage.
> I have waited several minutes, and QEMU is still unresponsive. Using gdb, It
> appears that it is stuck in an sdhci_data_transfer:
>
> #0 memory_region_access_valid (mr=<optimized out>, addr=0x10284920, size=<optimized out>, is_write=0xff, attrs=...) at /home/alxndr/Development/qemu/memory.c:1378
> #1 memory_region_dispatch_write (mr=<optimized out>, addr=<optimized out>, data=<optimized out>, op=MO_32, attrs=...) at /home/alxndr/Development/qemu/memory.c:1463
> #2 flatview_write_continue (fv=<optimized out>, addr=0x10284920, attrs=..., ptr=<optimized out>, len=0xb7, addr1=0x5555582798e0, l=<optimized out>, mr=0x5555582798e0 <io_mem_unassigned>) at /home/alxndr/Development/qemu/exec.c:3137
> #3 flatview_write (fv=0x606000045da0, addr=<optimized out>, attrs=..., buf=<optimized out>, len=<optimized out>) at /home/alxndr/Development/qemu/exec.c:3177
> #4 address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., buf=0xaaaab04f325, len=0x4) at /home/alxndr/Development/qemu/exec.c:3268
> #5 address_space_rw (as=0x5555572509ac <unassigned_mem_ops+44>, addr=0x5555582798e0, attrs=..., attrs@entry=..., buf=0xaaaab04f325, len=0x4, is_write=0xb8, is_write@entry=0x1) at
> /home/alxndr/Development/qemu/exec.c:3278
> #6 dma_memory_rw_relaxed (as=0x5555572509ac <unassigned_mem_ops+44>, addr=0x5555582798e0, buf=0xaaaab04f325, len=0x4, dir=DMA_DIRECTION_FROM_DEVICE) at /home/alxndr/Development/qemu/include/sysemu/dma.h:87
> #7 dma_memory_rw (as=0x5555572509ac <unassigned_mem_ops+44>, addr=0x5555582798e0, buf=0xaaaab04f325, len=0x4, dir=DMA_DIRECTION_FROM_DEVICE) at /home/alxndr/Development/qemu/include/sysemu/dma.h:110
> #8 dma_memory_write (as=0x5555572509ac <unassigned_mem_ops+44>, addr=0x5555582798e0, buf=0xaaaab04f325, len=0x4) at /home/alxndr/Development/qemu/include/sysemu/dma.h:122
> #9 sdhci_sdma_transfer_multi_blocks (s=<optimized out>) at /home/alxndr/Development/qemu/hw/sd/sdhci.c:618
> #10 sdhci_data_transfer (opaque=0x61e000021080) at /home/alxndr/Development/qemu/hw/sd/sdhci.c:891
> #11 sdhci_send_command (s=0x61e000021080) at /home/alxndr/Development/qemu/hw/sd/sdhci.c:364
> #12 sdhci_write (opaque=<optimized out>, offset=0xc, val=<optimized out>, size=<optimized out>) at /home/alxndr/Development/qemu/hw/sd/sdhci.c:1158
> #13 memory_region_write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) at
> /home/alxndr/Development/qemu/memory.c:483
> #14 access_with_adjusted_size (addr=<optimized out>, value=<optimized out>, size=<optimized out>, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=<optimized out>, mr=0x61e0000219f0, attrs=...) at /home/alxndr/Development/qemu/memory.c:544
> #15 memory_region_dispatch_write (mr=<optimized out>, addr=<optimized out>, data=0x1ffe0ff, op=<optimized out>, attrs=...) at /home/alxndr/Development/qemu/memory.c:1476
> #16 flatview_write_continue (fv=<optimized out>, addr=0xe106800c, attrs=..., ptr=<optimized out>, len=0xff3, addr1=0x5555582798e0, l=<optimized out>, mr=0x61e0000219f0) at /home/alxndr/Development/qemu/exec.c:3137
> #17 flatview_write (fv=0x606000045da0, addr=<optimized out>, attrs=..., buf=<optimized out>, len=<optimized out>) at /home/alxndr/Development/qemu/exec.c:3177
> #18 address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., attrs@entry=..., buf=0xaaaab04f325, buf@entry=0x62100008ad00, len=0x4) at /home/alxndr/Development/qemu/exec.c:3268
> #19 qtest_process_command (chr=<optimized out>, chr@entry=0x55555827c040 <qtest_chr>, words=<optimized out>) at /home/alxndr/Development/qemu/qtest.c:567
> #20 qtest_process_inbuf (chr=0x55555827c040 <qtest_chr>, inbuf=0x61900000f640) at /home/alxndr/Development/qemu/qtest.c:710
>
>
> I am attaching the qtest commands for reproducing it.
> I can reproduce it in a qemu 5.0 build using:
>
> qemu-system-i386 -M pc-q35-5.0 -qtest stdio -device sdhci-pci,sd-spec-
> version=3 -device sd-card,drive=mydrive -drive if=sd,index=0,file
> =null-co://,format=raw,id=mydrive -nographic -nographic -serial none
> -monitor none < attachment
>
> Please let me know if I can provide any further info.
> -Alex
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/qemu/+bug/1878054/+subscriptions
I think to fix the reproducer we can swap the if=sd for if=none: sd-spec- version= 3 -device sd-card, drive=mydrive \ index=0, file=null- co://,format= raw,id= mydrive \
qemu-system-i386 -M pc-q35-5.0 \
-qtest stdio \
-device sdhci-pci,
-drive if=none,
-nographic -nographic -serial none -monitor none < attachment2
I confirmed that this reproducer triggers the high-cpu usage for the
QEMU 5.2 build I got from Debian.
That said, this no longer times-out in my 6.0 build, so I think this is
fixed.
-Alex
On 210603 1500, Thomas Huth wrote: 0,file= null- raw,id= mydrive: machine type does not support /bugs.launchpad .net/bugs/ 1878054 transfer: region_ access_ valid (mr=<optimized out>, addr=0x10284920, size=<optimized out>, is_write=0xff, attrs=...) at /home/alxndr/ Development/ qemu/memory. c:1378 region_ dispatch_ write (mr=<optimized out>, addr=<optimized out>, data=<optimized out>, op=MO_32, attrs=...) at /home/alxndr/ Development/ qemu/memory. c:1463 write_continue (fv=<optimized out>, addr=0x10284920, attrs=..., ptr=<optimized out>, len=0xb7, addr1=0x5555582 798e0, l=<optimized out>, mr=0x5555582798e0 <io_mem_ unassigned> ) at /home/alxndr/ Development/ qemu/exec. c:3137 Development/ qemu/exec. c:3177 Development/ qemu/exec. c:3268 mem_ops+ 44>, addr=0x55555827 98e0, attrs=..., attrs@entry=..., buf=0xaaaab04f325, len=0x4, is_write=0xb8, is_write@entry=0x1) at Development/ qemu/exec. c:3278 rw_relaxed (as=0x5555572509ac <unassigned_ mem_ops+ 44>, addr=0x55555827 98e0, buf=0xaaaab04f325, len=0x4, dir=DMA_ DIRECTION_ FROM_DEVICE) at /home/alxndr/ Development/ qemu/include/ sysemu/ dma.h:87 mem_ops+ 44>, addr=0x55555827 98e0, buf=0xaaaab04f325, len=0x4, dir=DMA_ DIRECTION_ FROM_DEVICE) at /home/alxndr/ Development/ qemu/include/ sysemu/ dma.h:110 mem_ops+ 44>, addr=0x55555827 98e0, buf=0xaaaab04f325, len=0x4) at /home/alxndr/ Development/ qemu/include/ sysemu/ dma.h:122 transfer_ multi_blocks (s=<optimized out>) at /home/alxndr/ Development/ qemu/hw/ sd/sdhci. c:618 0x61e000021080) at /home/alxndr/ Development/ qemu/hw/ sd/sdhci. c:891 Development/ qemu/hw/ sd/sdhci. c:364 Development/ qemu/hw/ sd/sdhci. c:1158 region_ write_accessor (mr=<optimized out>, addr=<optimized out>, value=<optimized out>, size=<optimized out>, shift=<optimized out>, mask=<optimized out>, attrs=...) at Development/ qemu/memory. c:483 with_adjusted_ size (addr=<optimized out>, value=<optimized out>, size=<optimized out>, access_ size_min= <optimized out>, access_ size_max= <optimized out>, access_ fn=<optimized out>, mr=0x61e0000219f0, attrs=...) at /home/alxndr/ Development/ qemu/memory. c:544 region_ dispatch_ write (mr=<optimized out>, addr=<optimized out>, data=0x1ffe0ff, op=<optimized out>, attrs=...) at /home/alxndr/ Development/ qemu/memory. c:1476 write_continue (fv=<optimized out>, addr=0xe106800c, attrs=..., ptr=<optimized out>, len=0xff3, addr1=0x5555582 798e0, l=<optimized out>, mr=0x61e0000219f0) at /home/alxndr/ Development/ qemu/exec. c:3137 Development/ qemu/exec. c:3177 0x62100008ad00, len=0x4) at /home/alxndr/ Development/ qemu/exec. c:3268 command (chr=<optimized out>, chr@entry= 0x55555827c040 <qtest_chr>, words=<optimized out>) at /home/alxndr/ Development/ qemu/qtest. c:567 0f640) at /home/alxndr/ Development/ qemu/qtest. c:710 drive=mydrive -drive if=sd,index=0,file //,format= raw,id= mydrive -nographic -nographic -serial none /bugs.launchpad .net/qemu/ +bug/1878054/ +subscriptions
> The latest version of QEMU seems to refuse the provided command line:
>
> qemu-system-i386: -drive if=sd,index=
> co://,format=
> if=sd,bus=0,unit=0
>
> ... is there still a way to reproduce this issue with the latest QEMU
> version?
>
> ** Changed in: qemu
> Status: New => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https:/
>
> Title:
> Hang with high CPU usage in sdhci_data_transfer
>
> Status in QEMU:
> Incomplete
>
> Bug description:
> Hello,
> While fuzzing, I found an input that causes QEMU to hang with 100% CPU usage.
> I have waited several minutes, and QEMU is still unresponsive. Using gdb, It
> appears that it is stuck in an sdhci_data_
>
> #0 memory_
> #1 memory_
> #2 flatview_
> #3 flatview_write (fv=0x606000045da0, addr=<optimized out>, attrs=..., buf=<optimized out>, len=<optimized out>) at /home/alxndr/
> #4 address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., buf=0xaaaab04f325, len=0x4) at /home/alxndr/
> #5 address_space_rw (as=0x5555572509ac <unassigned_
> /home/alxndr/
> #6 dma_memory_
> #7 dma_memory_rw (as=0x5555572509ac <unassigned_
> #8 dma_memory_write (as=0x5555572509ac <unassigned_
> #9 sdhci_sdma_
> #10 sdhci_data_transfer (opaque=
> #11 sdhci_send_command (s=0x61e000021080) at /home/alxndr/
> #12 sdhci_write (opaque=<optimized out>, offset=0xc, val=<optimized out>, size=<optimized out>) at /home/alxndr/
> #13 memory_
> /home/alxndr/
> #14 access_
> #15 memory_
> #16 flatview_
> #17 flatview_write (fv=0x606000045da0, addr=<optimized out>, attrs=..., buf=<optimized out>, len=<optimized out>) at /home/alxndr/
> #18 address_space_write (as=<optimized out>, addr=<optimized out>, attrs=..., attrs@entry=..., buf=0xaaaab04f325, buf@entry=
> #19 qtest_process_
> #20 qtest_process_inbuf (chr=0x55555827c040 <qtest_chr>, inbuf=0x6190000
>
>
> I am attaching the qtest commands for reproducing it.
> I can reproduce it in a qemu 5.0 build using:
>
> qemu-system-i386 -M pc-q35-5.0 -qtest stdio -device sdhci-pci,sd-spec-
> version=3 -device sd-card,
> =null-co:
> -monitor none < attachment
>
> Please let me know if I can provide any further info.
> -Alex
>
> To manage notifications about this bug go to:
> https:/