Re: [PATCH] hw/pci-host/pnv_phb4: fix guest-triggerable abort on 8-byte config access

Philippe Mathieu-Daudé <[email protected]> Wed, 5 Aug 2026 17:53:59 +0200
Newsgroups gmane.comp.emulators.qemu.stable,gmane.comp.emulators.qemu
Message-ID <[email protected]>
On 5/8/26 15:53, Nikhil Kumar Singh wrote:
> Hi Philippe,
> 
> Thanks for the review.
> 
> 1. Regarding MIN(size, 4): I avoided this because silently truncating an 
> 8-byte guest read to 4 bytes leaves the upper 32 bits unpredictable, 
> which might mask guest OS bugs. Returning ~0ull explicitly matches 
> standard PCI behaviour for invalid reads and is safer.

OK.

> 2. Regarding pci_host_data_le_ops: I agree this is the right way to 
> handle it. However, PHB_CONFIG_DATA is currently interleaved inside the 
> larger big-endian PHB4 MMIO region. Moving it to generic little-endian 
> ops requires a memory region refactor using overlays.

Yeah, "if it ain't broke, don’t fix it", so let's keep maintaining
something old and different.

> Since this patch addresses an immediate DoS crash, I kept the scope 
> minimal.

OK, no objection to your patch, just my 2 cents ;)

> Memory region refactoring can be picked up as a separate 
> follow-up patch.
> 
> Regards,
> ~ Nikhil
>