From patchwork Sat Mar 15 09:14:14 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873866 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1104400wrq; Sat, 15 Mar 2025 02:15:40 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWkF0TxKkI6bSotQL8qlZTTSRe1uc1/s+AKlV4kqV/+9zMTP1v21U8SToGESwACBwqt3OzyDw==@linaro.org X-Google-Smtp-Source: AGHT+IFwI6Bxk1YBLKeBnFfwQ+EnsO9Kx4dA3EhWRyfJZIxRB2Qp8hq2/t2hLmqbfq++/iaYIHWZ X-Received: by 2002:a05:6214:2a48:b0:6e8:fa33:2962 with SMTP id 6a1803df08f44-6eaea9e44b4mr76601406d6.10.1742030139838; Sat, 15 Mar 2025 02:15:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030139; cv=none; d=google.com; s=arc-20240605; b=XjPcVyGn+g6/1GLNbnWEFvKaiyzJV7QdbIurEs7L3/6YrxP3lNWx3s0Les/PoGVHUS bUKw9f847GFVTrIDdljkIjoiyQabrjwS+D3H3sceBG5mBnQ3EksTayUfof2rxfiuPERf jWlcv1havpV8AAGtZvptm5ksUs7atUKDnv4fD+lum2zoiwTwysYDN90WTkIxoSWvUS/9 S4fKbSqItc7LYKmMoyzWwWzfbltbCgI0aIYzRw9OcHyNB0JL+9MRNR9CPI+BOB3SWehw 6NTQZ//kbHfvBR+0LPilbfYoDkKsxAU0ha297WugXWyRU50vkVJ8OP8/cJ3jDiD9ersQ OYQw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=jfYVvxRSHPpKYFtAWIVzZJDdvJfQqo5qz4AMq7Yi4xo=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=Q87G12+bvzpvnh3/JqHhz7vZqsQHm8uP2Zo0uFF0qqeAz4dWsUXrEXjO8aj5CLeNOF L/VN+6euKA76xqg9IsUs2PjY/I990RjVxf+z79P6h7ghWq9u4NvkYgZhrs8JDPdisXYy JXqzS1rzPDWswDdnsSS8yhPZZwjiwh6NYGbQSeHL5voPpp5/lDR1a98I5qCY2RwHmtau FIs4HmrZ+zb6g802TqK64U7+VIsnTGnKYCfGsenmOlCPUgZkbGO047EgcIWsq7xQkap/ OUcEew2AX6KfhpMe6VVRt65jsB3a1JQPhePEteZ0GB+aIl3p7eAxlTcXjDj8VXLolBEY 01Hg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade33f708si53261416d6.170.2025.03.15.02.15.39 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:15:39 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNbg-0002eP-BZ; Sat, 15 Mar 2025 05:15:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNba-0002cH-3z; Sat, 15 Mar 2025 05:14:56 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbW-0007k1-9j; Sat, 15 Mar 2025 05:14:53 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id AA655FFBB4; Sat, 15 Mar 2025 12:13:45 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id B2DD31CAD4D; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 99E7155A30; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-7.2.17 03/27] hw/net/smc91c111: Ignore attempt to pop from empty RX fifo Date: Sat, 15 Mar 2025 12:14:14 +0300 Message-Id: <20250315091439.657371-3-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The SMC91C111 includes an MMU Command register which permits the guest to remove entries from the RX FIFO. The datasheet does not specify what happens if the guest tries to do this when the FIFO is already empty; there are no status registers containing error bits which might be applicable. Currently we don't guard at all against pop of an empty RX FIFO, with the result that we allow the guest to drive the rx_fifo_len index to negative values, which will cause smc91c111_receive() to write to the rx_fifo[] array out of bounds when we receive the next packet. Instead ignore attempts to pop an empty RX FIFO. Cc: qemu-stable@nongnu.org Fixes: 80337b66a8e7 ("NIC emulation for qemu arm-softmmu") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2780 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250207151157.3151776-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 937df81af6757638a7f1908747560dd342947213) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 4eda971ef3..6ce610cb23 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -183,6 +183,15 @@ static void smc91c111_pop_rx_fifo(smc91c111_state *s) { int i; + if (s->rx_fifo_len == 0) { + /* + * The datasheet doesn't document what the behaviour is if the + * guest tries to pop an empty RX FIFO, and there's no obvious + * error status register to report it. Just ignore the attempt. + */ + return; + } + s->rx_fifo_len--; if (s->rx_fifo_len) { for (i = 0; i < s->rx_fifo_len; i++) From patchwork Sat Mar 15 09:14:16 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873874 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1106563wrq; Sat, 15 Mar 2025 02:24:00 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCV6vsCodw+CwjIML5BfBOZwF22ZuUpAs9S4A0Aqz5CRWGX5zchMUPNeOlcbKOyOD23ILqiQ4Q==@linaro.org X-Google-Smtp-Source: AGHT+IH2H7W6EPbmL3qk9dxmo7iB4N1xFAWxehS5Nv+o4vclo7sqqfS2OFFClA+t9AuGMnvUNEl+ X-Received: by 2002:a05:620a:460d:b0:7c5:3b8d:9f2f with SMTP id af79cd13be357-7c573791ffamr1598592585a.17.1742030640464; Sat, 15 Mar 2025 02:24:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030640; cv=none; d=google.com; s=arc-20240605; b=DiTH+sXyF4vrGMaAS+tO1ClTRhnc8X+x1NbPlJHJUoqjFqRNbD/FbMH10AbjUErnmF ng67L8t+mdw0SKGGXyL9/+Vn0qEECJNExnUQq7kB+FL4dN6F40/Ia7fRftPwvNkFQxKh Byh/Dho95+iiwGkSym8ARgpU94Ad7XWVzyCzTRM1r4UziHiIzt5sCs6nFboireEXX5c6 o8NBsI72bJ0yqofBO9foorh+nQ5FXXA2heoAN5sO7dqvS1XuwqIQxnnLRJhnFOSdae2D 9A4rAH5N6MDIdNTl6AxUF6qPP2zNzVHmsEdQfCIVTUFhjXV5XLHOhuq+XJajxGGP139B zSgw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=mGjOK9eLGYukp71ghfhJJr9G6lJNX13KGLmpIPayoDw=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=I3KnPGe4SQJpSLp7YBSj2iCyfNGECgD8D/ZugeCoIogeaWlcbZxPCuq1/wW4Y7oOW9 M9qJISb0JLrQa+njmxpP4vJIVGYgN28zpR7Hj1Jzb/nqvIxAQd31smCGiCzHCiGho0We XPde0Unwk1kHAa8Z+YesTrve4VsbavUXA7uo1BcsmgVM/PacDAi6WFrQK4DMaFetc0ym wgK4qj66PIJU/igZLOCkdgT+IG8eVToo6U5wWFTE0KX4y047Sb1JV6imP81ra2/F9O76 zUwGkRA8oERpLJ+NqyqTNLVCBkNR0ZWZ0gwKGjIFsPl4jrWwIcvGpfmaRoSM+qnJpPfH ts3Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573caaee7si585871685a.297.2025.03.15.02.24.00 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:24:00 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNbx-0002ro-3N; Sat, 15 Mar 2025 05:15:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbf-0002dv-Ax; Sat, 15 Mar 2025 05:14:59 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbc-0007l3-3U; Sat, 15 Mar 2025 05:14:59 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B2DBFFFBB6; Sat, 15 Mar 2025 12:13:45 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id BB0681CAD4F; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id 9E9D555A34; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.17 05/27] target/arm: Report correct syndrome for UNDEFINED CNTPS_*_EL1 from EL2 and NS EL1 Date: Sat, 15 Mar 2025 12:14:16 +0300 Message-Id: <20250315091439.657371-5-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The access pseudocode for the CNTPS_TVAL_EL1, CNTPS_CTL_EL1 and CNTPS_CVAL_EL1 secure timer registers says that they are UNDEFINED from EL2 or NS EL1. We incorrectly return CP_ACCESS_TRAP from the access function in these cases, which means that we report the wrong syndrome value to the target EL. Use CP_ACCESS_TRAP_UNCATEGORIZED, which reports the correct syndrome value for an UNDEFINED instruction. Cc: qemu-stable@nongnu.org Fixes: b4d3978c2fd ("target-arm: Add the AArch64 view of the Secure physical timer") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-2-peter.maydell@linaro.org (cherry picked from commit b819fd6994243aee6f9613edbbacedce4f511c32) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index 5c22626b80..d1e176e711 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2505,7 +2505,7 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, switch (arm_current_el(env)) { case 1: if (!arm_is_secure(env)) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } if (!(env->cp15.scr_el3 & SCR_ST)) { return CP_ACCESS_TRAP_EL3; @@ -2513,7 +2513,7 @@ static CPAccessResult gt_stimer_access(CPUARMState *env, return CP_ACCESS_OK; case 0: case 2: - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; case 3: return CP_ACCESS_OK; default: From patchwork Sat Mar 15 09:14:17 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873870 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1105292wrq; Sat, 15 Mar 2025 02:19:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCWuJYJjeIsh8WKI/lLUNS1sJR/SSVWqkFhChBWsGt26BIXETQ0mx0JNM7AHXT38vmZrt5g4JQ==@linaro.org X-Google-Smtp-Source: AGHT+IEGpIX1UN916wr6P3G2ifoVn1d5jIBPaLkbofjbevViueNimwAyXAZ1XEGpIvZtqwD1TF+2 X-Received: by 2002:ac8:5fd2:0:b0:476:bb8e:a90e with SMTP id d75a77b69052e-476c813fa34mr85871901cf.20.1742030347565; Sat, 15 Mar 2025 02:19:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030347; cv=none; d=google.com; s=arc-20240605; b=dgetOdMlYP6jjQoWSy4mIiNbLyCfzEoqmM5zp/AlnZ/coMXAzI+ayyM8l/eejpjhZQ 1ro6bCyxQJ8aUUjiMFk/oNkoNz0fcHM7MOmBxapQlFubDsKdn5Guywa2O45vBjTiNLr2 G9CVyoiQRV/rNrWcpA22vgOGQ8PeL0g0WK8REY8Jt+vxh4adWKNzYr4zIXJE38lE3DvU uijoABIwkyZiSC6ibWEX3+L3NcvXk6EkgImJwsb2rrtQFyQCTM9HUJf/yHdkPv1xkMoZ OMeouXgXDhrCAAw/PDWrjgWgYCm36iJ4H80qbgMxlxVr1C3MKzuFsJFsd32UnbDbEua2 XLOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=VSEd97dIe4s2EZ8xU0HHRiiFTYnPTuFgIEbFb2Vaom8=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=UX44RMwmrpf1s/+jX0ZHQndwaYHNVkbhJ56UqNYIIJQeM0RVaAIcpzBuIIO3C57qkq xetGf0jHMCKMS//VydpaSLkj+6nveMuXZitN7CfMMB/7vm5QGu6zEQf/0c6X4TU8L8Y5 rhxyiY7F1j23NHrEuaiNJKM8KkaS3Jv6bwYw2UjkQJGZuE5rS4i8QKqA9Ht9dkWMT6Lp wsg+mn7j92rHyd7ac6h+lB0tpi+6zQyWxEa2FzT+XVM5z4h0bnmLfVb7V4C0cRlPmoej ZcHx9VADJKmVrY5mQ7yHM0X/kIl0VXh47k4Equca9kBoxOHlkdmGISeU6ENP6mTYA0Xa n4sg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb81a576si54820001cf.435.2025.03.15.02.19.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:19:07 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNc0-0002u7-Vw; Sat, 15 Mar 2025 05:15:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbi-0002fu-NB; Sat, 15 Mar 2025 05:15:03 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbg-0007lv-V8; Sat, 15 Mar 2025 05:15:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B68FFFFBB7; Sat, 15 Mar 2025 12:13:45 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id BEF5B1CAD50; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A0ED255A36; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.17 06/27] target/arm: Report correct syndrome for UNDEFINED S1E2 AT ops at EL3 Date: Sat, 15 Mar 2025 12:14:17 +0300 Message-Id: <20250315091439.657371-6-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The pseudocode for AT S1E2R and AT S1E2W says that they should be UNDEFINED if executed at EL3 when EL2 is not enabled. We were incorrectly using CP_ACCESS_TRAP and reporting the wrong exception syndrome as a result. Use CP_ACCESS_TRAP_UNCATEGORIZED. Cc: qemu-stable@nongnu.org Fixes: 2a47df953202e1 ("target-arm: Wire up AArch64 EL2 and EL3 address translation ops") Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-4-peter.maydell@linaro.org (cherry picked from commit ccda792945d650bce4609c8dbce8814a220df1bb) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index d1e176e711..f33fc5c4a6 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -3516,7 +3516,7 @@ static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, { if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) { - return CP_ACCESS_TRAP; + return CP_ACCESS_TRAP_UNCATEGORIZED; } return CP_ACCESS_OK; } From patchwork Sat Mar 15 09:14:18 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873868 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1104896wrq; Sat, 15 Mar 2025 02:17:36 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUj+LhEumDRI2Dno/mXQN1COh/8MquPin+9vFeDFHdgaYgaKEcTkWgCuL0ZVKUnMzbjbSDAvg==@linaro.org X-Google-Smtp-Source: AGHT+IGnSCYQZ98JCmJEzpxq0i2Bs/75FoH6fMosv697NnlBUJmz9qZW/gS6dG5uJoVwTjtoPE+D X-Received: by 2002:a05:622a:10e:b0:476:5fd5:4df8 with SMTP id d75a77b69052e-476c81d92cbmr77537451cf.45.1742030255926; Sat, 15 Mar 2025 02:17:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030255; cv=none; d=google.com; s=arc-20240605; b=AlPS3pFgnSqf10qqnyoB1f/tzJLBlNjedxjXHl6y/0GjV94A2hYdQIN13kfO/KDrw4 DC1sBF5p/9q9Rv3eAIvrxdsrwdxvJANplV69tu1lpq/4w0hlk/SWL1PB1SGOsUVdbZim K6SUJFKSA0iHxEuA6hhRJ/GRIs1Xz4aVKOR4VAeBY37lTrL8XR3Rm7sBIOqcnr4t+h98 m00M5rzW8gnYEzvXaOKA9sfBDxkqiE0ciA3o1UKpj68SUFSrOB3YQ/zzGUszOxyhwJ5w WJp0knaFzwL8ViTNB6d54wQcYry9Ny5uLOsoZKYjOU6hE60eFJdvjg8nhSKzwo0vgF2S thVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=1IzR4071OHmfWfS91TaKToJcj2cmOblh7XtcAwG61VU=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=EmSiihseYbdjIYEKsnS3NZ/dkmCh3kBiLM1wVQIAoYqLdTxaErMM+p7jP2OUSInpi8 N5v64sv9Yl7RIcBJWNJHwUw+ibKbDwp5qVyRiH9sbAgqd/3+/5kqQZLdMMaJNzmcrV5M vlJ7w9/Jn0ASEvG4PPokaE/n1JGF8c9RUcGXLSHt4zYgjG3Ev+mAn8P1o81F9HvxkUih 5qmVkv5BC0YN4s3Usnhrm5X6Likf+eual3fm+sL6td1VZuQXAPb1feO9KGVTlDbi1ffM 2X6oQ/vt3QsOjory9mO9ycP46qJVXSjuL8LWoH7aKb6aCPxmOrdwY6v0I0TyjS8E9q08 sQog==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb819604si57092621cf.412.2025.03.15.02.17.35 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:17:35 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNbz-0002tg-GD; Sat, 15 Mar 2025 05:15:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbi-0002fw-NJ; Sat, 15 Mar 2025 05:15:03 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbg-0007lx-Uc; Sat, 15 Mar 2025 05:15:02 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BA680FFBB8; Sat, 15 Mar 2025 12:13:45 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C2E1C1CAD51; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A343D55A38; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.17 07/27] target/arm: Report correct syndrome for UNDEFINED LOR sysregs when NS=0 Date: Sat, 15 Mar 2025 12:14:18 +0300 Message-Id: <20250315091439.657371-7-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The pseudocode for the accessors for the LOR sysregs says they are UNDEFINED if SCR_EL3.NS is 0. We were reporting the wrong syndrome value here; use CP_ACCESS_TRAP_UNCATEGORIZED. Cc: qemu-stable@nongnu.org Fixes: 2d7137c10faf ("target/arm: Implement the ARMv8.1-LOR extension") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-5-peter.maydell@linaro.org (cherry picked from commit 707d478ed8f2da6f2327e5af780890c1fd9c371a) Signed-off-by: Michael Tokarev diff --git a/target/arm/helper.c b/target/arm/helper.c index f33fc5c4a6..24585d528b 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6650,8 +6650,8 @@ static CPAccessResult access_lor_other(CPUARMState *env, const ARMCPRegInfo *ri, bool isread) { if (arm_is_secure_below_el3(env)) { - /* Access denied in secure mode. */ - return CP_ACCESS_TRAP; + /* UNDEF if SCR_EL3.NS == 0 */ + return CP_ACCESS_TRAP_UNCATEGORIZED; } return access_lor_ns(env, ri, isread); } From patchwork Sat Mar 15 09:14:19 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873872 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1105362wrq; Sat, 15 Mar 2025 02:19:22 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUvhXOo92O1LroVWPIzfIkXpiHDzWqglhmlhE2UGnB3rmhzWLe5ZrNtiHCfocO3DIexDWtZnA==@linaro.org X-Google-Smtp-Source: AGHT+IFXkrzNkpHYaPujtpjAtm6J9o3OUY8B/2jk6rLhmDwrSKFQjyx36xiORNyjVf3L8aurhxF+ X-Received: by 2002:a05:620a:408a:b0:7c5:4c6d:7fa5 with SMTP id af79cd13be357-7c57c9192e2mr847855985a.48.1742030362077; Sat, 15 Mar 2025 02:19:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030362; cv=none; d=google.com; s=arc-20240605; b=aoz1YBUghq2x4uiynwfFFdppwIA1uApbbFrkv6RL/4/V0FJRtAO04PGO6HBNZtOY2d uB21L2acWYZXxGxyAuw2pdf284ZPKhvlHBjHDEwRGowkAFSUb5Xx0BxL6tSsej+sYHkO xaQ9JCldokomKoSrJhVP8FhILR+62ffV9+k6fHQ4FWfi3LHsF39f0CUEAFMNkijn3Q8z Y9H32YHNABv3os24EaRLylG4eAzcJOmTcmBu/eRBPWs1uKXJv+H2o01m/xPAzymd3PSY oUqSytN5DBUwMZdz+4Xl9EpGqWJZbDsJYENyCVdrgtqIcSDYKH8/BNiP3p3Nk8afDK9h UKyA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=cqIY/ECi5/Z4ptbhU4OyGEFfgUrJ/qPGOULcj3wNQRw=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=dc8ViMP/0JD4oVRZZ6Dlv4+Jn2UM0xXrU//v6TnEn1pHX4vFCIjQXpvQYkFujeMVQp GwaA3g+EDe7vkdWVf/H2BlyQUtK+s5Ns8bvNYzYg9VsPwnq/lpisU4m0gbYCDLNa88ul S3EGyak9uApcJKVeF2KDb9YVjJ6oeg0Lkj6TcCwwEUqxz+UQCSZs434D71U2Pp3Qggp0 oVepIcgPjplD46MA/KvqDEuTtRYcecxSExPCYa9pxysTH/+E7THUmKPgY2DdjP5HfnVk FHxFm4gBG7Hv7OjCk/QJDS8rKJmqZjkEg33BsN+DKdo8HAyuWwcVLhcxDjgEw2MicJ36 yA+Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573b75442si542402285a.126.2025.03.15.02.19.21 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:19:22 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNc8-0002vp-0B; Sat, 15 Mar 2025 05:15:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbn-0002kl-4V; Sat, 15 Mar 2025 05:15:08 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbl-0007ma-5s; Sat, 15 Mar 2025 05:15:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id BE535FFBB9; Sat, 15 Mar 2025 12:13:45 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id C6C631CAD52; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A5A4955A3A; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.17 08/27] target/arm: Make CP_ACCESS_TRAPs to AArch32 EL3 be Monitor traps Date: Sat, 15 Mar 2025 12:14:19 +0300 Message-Id: <20250315091439.657371-8-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In system register access pseudocode the common pattern for AArch32 registers with access traps to EL3 is: at EL1 and EL2: if HaveEL(EL3) && !ELUsingAArch32(EL3) && (SCR_EL3.TERR == 1) then AArch64.AArch32SystemAccessTrap(EL3, 0x03); elsif HaveEL(EL3) && ELUsingAArch32(EL3) && (SCR.TERR == 1) then AArch32.TakeMonitorTrapException(); at EL3: if (PSTATE.M != M32_Monitor) && (SCR.TERR == 1) then AArch32.TakeMonitorTrapException(); (taking as an example the ERRIDR access pseudocode). This implements the behaviour of (in this case) SCR.TERR that "Accesses to the specified registers from modes other than Monitor mode generate a Monitor Trap exception" and of SCR_EL3.TERR that "Accesses of the specified Error Record registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception". In QEMU we don't implement this pattern correctly in two ways: * in access_check_cp_reg() we turn the CP_ACCESS_TRAP_EL3 into an UNDEF, not a trap to Monitor mode * in the access functions, we check trap bits like SCR.TERR only when arm_current_el(env) < 3 -- this is correct for AArch64 EL3, but misses the "trap non-Monitor-mode execution at EL3 into Monitor mode" case for AArch32 EL3 In this commit we fix the first of these two issues, by making access_check_cp_reg() handle CP_ACCESS_TRAP_EL3 as a Monitor trap. This is a kind of exception that we haven't yet implemented(!), so we need a new EXCP_MON_TRAP for it. This diverges from the pseudocode approach, where every access check function explicitly checks for "if EL3 is AArch32" and takes a monitor trap; if we wanted to be closer to the pseudocode we could add a new CP_ACCESS_TRAP_MONITOR and make all the accessfns use it when appropriate. But because there are no non-standard cases in the pseudocode (i.e. where either it raises a Monitor trap that doesn't correspond to an AArch64 SystemAccessTrap or where it raises a SystemAccessTrap that doesn't correspond to a Monitor trap), handling this all in one place seems less likely to result in future bugs where we forgot again about this special case when writing an accessor. (The cc of stable here is because "hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3" which is also cc:stable will implicitly use the new EXCP_MON_TRAP code path.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-6-peter.maydell@linaro.org (cherry picked from commit 4cf4948651615181c5bc3d0e4a9f5c46be576bb2) (Mjt: context fix due to missing v9.0.0-151-gb36a32ead159 "target/arm: Add support for Non-maskable Interrupt", v8.0.0-2011-g11b76fda0adc "target/arm: Implement GPC exceptions") Signed-off-by: Michael Tokarev diff --git a/target/arm/cpu.h b/target/arm/cpu.h index a9cd7178f8..32b0bf8e2d 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -57,6 +57,7 @@ #define EXCP_UNALIGNED 22 /* v7M UNALIGNED UsageFault */ #define EXCP_DIVBYZERO 23 /* v7M DIVBYZERO UsageFault */ #define EXCP_VSERR 24 +#define EXCP_MON_TRAP 29 /* AArch32 trap to Monitor mode */ /* NB: add new EXCP_ defines to the array in arm_log_exception() too */ #define ARMV7M_EXCP_RESET 1 diff --git a/target/arm/helper.c b/target/arm/helper.c index 24585d528b..6cffbcb276 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -9475,6 +9475,7 @@ void arm_log_exception(CPUState *cs) [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault", [EXCP_VSERR] = "Virtual SERR", + [EXCP_MON_TRAP] = "Monitor Trap", }; if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { @@ -10036,6 +10037,16 @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs) mask = CPSR_A | CPSR_I | CPSR_F; offset = 0; break; + case EXCP_MON_TRAP: + new_mode = ARM_CPU_MODE_MON; + addr = 0x04; + mask = CPSR_A | CPSR_I | CPSR_F; + if (env->thumb) { + offset = 2; + } else { + offset = 4; + } + break; default: cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); return; /* Never happens. Keep compiler happy. */ diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index 70672bcd9f..9b07c79392 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -631,6 +631,7 @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, const ARMCPRegInfo *ri = rip; CPAccessResult res = CP_ACCESS_OK; int target_el; + uint32_t excp; if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) { @@ -667,8 +668,18 @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, } fail: + excp = EXCP_UDEF; switch (res & ~CP_ACCESS_EL_MASK) { case CP_ACCESS_TRAP: + /* + * If EL3 is AArch32 then there's no syndrome register; the cases + * where we would raise a SystemAccessTrap to AArch64 EL3 all become + * raising a Monitor trap exception. (Because there's no visible + * syndrome it doesn't matter what we pass to raise_exception().) + */ + if ((res & CP_ACCESS_EL_MASK) == 3 && !arm_el_is_aa64(env, 3)) { + excp = EXCP_MON_TRAP; + } break; case CP_ACCESS_TRAP_UNCATEGORIZED: if (cpu_isar_feature(aa64_ids, cpu) && isread && @@ -702,7 +713,7 @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, g_assert_not_reached(); } - raise_exception(env, EXCP_UDEF, syndrome, target_el); + raise_exception(env, excp, syndrome, target_el); } void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value) From patchwork Sat Mar 15 09:14:20 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873867 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1104456wrq; Sat, 15 Mar 2025 02:15:55 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXS5+Aef8NnxgGHS3NkQHpN3IlsGfsA1mMI3AmnONeDmk1iPG9yvGJcpHtK90lh55lMKojNOw==@linaro.org X-Google-Smtp-Source: AGHT+IGwX5iVRNg22JkIdvvnSFAk4pOI3vKHB8JVUqEmvLNzhDJSqww1uDe1llrEzs+RHdpyeQhs X-Received: by 2002:a05:620a:24cb:b0:7c5:5d4b:e621 with SMTP id af79cd13be357-7c57c8fc874mr714616085a.37.1742030155300; Sat, 15 Mar 2025 02:15:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030155; cv=none; d=google.com; s=arc-20240605; b=Y508KNfzLn8C+II0Si/hIjiPrTIUMsywNI+aVg58EIbUe3ifOGcRZPBdak0ovUOeyY RWm9VeYD4e2tCkLvGI90KtAToz2K0LyJeiuj3E3bs3GhNgga9criAv52Xvmy23OMngUA 0OGU1imanMr+6uEL8X+j0v4kI4bHaVLNtXDyDQSa4DQO9oVQ/GsyEddzePAIz3yxkyTx iZOGcGHCERR7HnSlzIJgAAZXzZWdW4ir83HKxA8elgUgCtMXYbJy1DWPLFbLXodAh7cV ILUcE3b0k/RU7KirBGrM5MoIicF3RIcBWtiiabm33x8bEF5r4iA0avfw2NeyIgGanIOz tMtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=qgJVzmqE/7owaMTmrbnY/58KYFKJBGAyPnRihiXBSf8=; fh=upfN+4mcRAuX+bX9oPqMwq1TP+fTfKlWZBqspF+lG6I=; b=TR9CthEnzllN99lcDM4pqFmFBPxJ4S/XagJWNsfkNyCQZMfsN0phQtq1N2hv9McfWg y/ANhPZVOdfFg08k3jjWQzZkokhu6vWydZ83CZpNglkJ2Q9ItIEQnea2Qh1t9/ed6Omt R4cTNpE/VvC6Hh66Ur66N+clgJdXD1WrISFX3jNHPwwt5oXwe7Y82yuTT0qiYKnctJ45 niPLLDMDq56I2Hk1/E7hEI9atwTd8t3UaEbtVvyT0jZ/7TRzbjF0o/gTK7YKPsFSzT60 xR6DQ2oKAvo5WFTc1wPPO7KWyhP05cHsqqWsiVDuc7ovJmyAGpzj4T/pKae/t+fYzceN SCRA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7c573cb237csi549156485a.232.2025.03.15.02.15.55 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:15:55 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNc3-0002uh-6q; Sat, 15 Mar 2025 05:15:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbm-0002kH-T2; Sat, 15 Mar 2025 05:15:08 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNbl-0007mY-5D; Sat, 15 Mar 2025 05:15:06 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id C24B5FFBBA; Sat, 15 Mar 2025 12:13:45 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id CAC481CAD53; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id A83BA55A3C; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Alex_Benn=C3=A9e?= , Richard Henderson , Michael Tokarev Subject: [Stable-7.2.17 09/27] hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3 Date: Sat, 15 Mar 2025 12:14:20 +0300 Message-Id: <20250315091439.657371-9-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In the gicv3_{irq,fiq,irqfiq}_access() functions, there is a check which downgrades a CP_ACCESS_TRAP_EL3 to CP_ACCESS_TRAP if EL3 is not AArch64. This has been there since the GIC was first implemented, but it isn't right: if we are trapping because of SCR.IRQ or SCR.FIQ then we definitely want to be going to EL3 (doing AArch32.TakeMonitorTrapException() in pseudocode terms). We might want to not take a trap at all, but we don't ever want to go to the default target EL, because that would mean, for instance, taking a trap to Hyp mode if the trapped access was made from Hyp mode. (This might have been an attempt to work around our failure to properly implement Monitor Traps.) Remove the bogus check. Cc: qemu-stable@nongnu.org Fixes: 359fbe65e01e ("hw/intc/arm_gicv3: Implement GICv3 CPU interface registers") Signed-off-by: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Richard Henderson Message-id: 20250130182309.717346-7-peter.maydell@linaro.org (cherry picked from commit d04c6c3c000ab3e588a2b91641310aeea89408f7) Signed-off-by: Michael Tokarev diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c index 9811fb3fb4..8d36f57f3d 100644 --- a/hw/intc/arm_gicv3_cpuif.c +++ b/hw/intc/arm_gicv3_cpuif.c @@ -2097,9 +2097,6 @@ static CPAccessResult gicv3_irqfiq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } @@ -2162,9 +2159,6 @@ static CPAccessResult gicv3_fiq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } @@ -2201,9 +2195,6 @@ static CPAccessResult gicv3_irq_access(CPUARMState *env, } } - if (r == CP_ACCESS_TRAP_EL3 && !arm_el_is_aa64(env, 3)) { - r = CP_ACCESS_TRAP; - } return r; } From patchwork Sat Mar 15 09:14:23 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873871 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1105293wrq; Sat, 15 Mar 2025 02:19:07 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXgbchd5m17KJ2eju9UrwuBQFWHTSK5N4jc/ec1fYD0/bqFf7vPmffSRvTyhH4N3AqHOpMCbQ==@linaro.org X-Google-Smtp-Source: AGHT+IEwAI6mUphteKKCTq2pQ5fD4C1SU3deNpRuJbhF2kvvAxB03Ipfl72r/j/ldSokA6FDuyyM X-Received: by 2002:ac8:5891:0:b0:472:1225:bd98 with SMTP id d75a77b69052e-476c81e04a5mr101192661cf.50.1742030347603; Sat, 15 Mar 2025 02:19:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030347; cv=none; d=google.com; s=arc-20240605; b=DlZvgFEXN1m4kFAcq5YiLEtANGoytPk3iJn23m28DvMPClAxjQNjlRYbFbKhE/HnBU WAueVnRxXo748r8lPkGWzz+qdTyFHdsdIq1ZQv79SQSs6XM+IE8e7f1gaYFAKldrhVXn cVJalMx0S0jsEhaCnXFdB+dE723pQ2sLvcgxV1unvfO2bZTFIbqMAP7iPzGppGgjg2ke 6f60RUJU4/4ReXnB73jHyYlKZ4plrGZlKHmhQZUqQSKuAf8upXl52V38G/v9oeCS9uKE 5xEiJqfbzA/yW75nxCxiGu6STgF51G6Ab/K7T/9f+Ykqb/ppMHj5FSEdpE9so1S+8a2u gEvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=wTVpB6jwsO1yf6q8ZPXxBbLHQJqaI8zdvAlU/724+bk=; fh=RkVaduC9mSS2s8S4opwaBgxzh946Y+Bi0zKymkK8x08=; b=IEZe8V2GnJEnjJgjLSPEJm7and4/7+joczVDMfsDmabHBi+LKjBbxVvGnMFnT/uBpo cEIIPK1PDiGzjIcrtOIMukmOOxS3MR2AfAQdGnck+VH5OvfN9yVS/NchOP02UVgHIi/Q oD8Gzjyqz2OZtpo+Elbvg+I8noLmhVLlUoQH/c5eI5J8H7UqdHTKEYEJuTJFisk5HZ+G uCQ8I9P4klniLbSrhegEmJUMwNIkJvC7yjKKeK6WZJFG4ADNFhxaw8GnK874c4tGCSBR 1R1SPlVx9Msah4IgZtHV+/J97vg9USSMXt7KrTIEK1r1IetZ9VYSK0BrsOiM8Jykn11j 81mg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb7da18csi52867681cf.206.2025.03.15.02.19.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:19:07 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNcK-00031Z-Bx; Sat, 15 Mar 2025 05:15:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNcG-0002wb-5W; Sat, 15 Mar 2025 05:15:38 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNcD-0007yQ-UE; Sat, 15 Mar 2025 05:15:35 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id CE557FFBBD; Sat, 15 Mar 2025 12:13:45 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id D6D4A1CAD56; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id AF7B355A42; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , "Michael S . Tsirkin" , Michael Tokarev Subject: [Stable-7.2.17 12/27] hw/i386/amd_iommu: Explicit use of AMDVI_BASE_ADDR in amdvi_init Date: Sat, 15 Mar 2025 12:14:23 +0300 Message-Id: <20250315091439.657371-12-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Philippe Mathieu-Daudé By accessing MemoryRegion internals, amdvi_init() gives the false idea that the PCI BAR can be modified. However this isn't true (at least the model isn't ready for that): the device is explicitly maps at the BAR at the fixed AMDVI_BASE_ADDR address in amdvi_sysbus_realize(). Since the SysBus API isn't designed to remap regions, directly use the fixed address in amdvi_init(). Signed-off-by: Philippe Mathieu-Daudé Message-Id: <20230313153031.86107-3-philmd@linaro.org> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 6291a28645a0656477bc5962a81b181e6a99487c) Signed-off-by: Michael Tokarev diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c index d94c0f9bfb..e6da60fc15 100644 --- a/hw/i386/amd_iommu.c +++ b/hw/i386/amd_iommu.c @@ -1514,9 +1514,9 @@ static void amdvi_init(AMDVIState *s) /* reset AMDVI specific capabilities, all r/o */ pci_set_long(s->pci.dev.config + s->capab_offset, AMDVI_CAPAB_FEATURES); pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_BAR_LOW, - s->mmio.addr & ~(0xffff0000)); + AMDVI_BASE_ADDR & ~(0xffff0000)); pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_BAR_HIGH, - (s->mmio.addr & ~(0xffff)) >> 16); + (AMDVI_BASE_ADDR & ~(0xffff)) >> 16); pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_RANGE, 0xff000000); pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_MISC, 0); From patchwork Sat Mar 15 09:14:34 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873875 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1106711wrq; Sat, 15 Mar 2025 02:24:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXvf4+IDUudkQOmTVdg/EEbzS/8NqRBDRo8M9/xFXx9LtJTTGoVbCkOulyS5W6ftOubYx2wug==@linaro.org X-Google-Smtp-Source: AGHT+IEd1rRuMgqqSrjBLp48KeKsA2iMbjwYwtZfOZ+TuiiEyCvTuYdd6t3/+vzaR5MFUfef+xZ6 X-Received: by 2002:ac8:5ac3:0:b0:476:ae25:2f02 with SMTP id d75a77b69052e-476c81593a7mr86494251cf.31.1742030673749; Sat, 15 Mar 2025 02:24:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030673; cv=none; d=google.com; s=arc-20240605; b=Cyvuhn7ZcHaAm3RkRjsIlkwKNeTnggcxViIehMvNq9E1rZiNOayXYVOObebGCVt7BW +fonHhy2vRFsTM4j2+arOnGwUA5vhu+0BjqMI8tshuLd4Ghw8qRsMhpzLcVjpJkPAbOy FtoIPhbWVrLku1yFpxj1xR1LiHiYprGZ2Zddxd71CeaSN5DO0GW4FwptVQQ160aN1u4E chxHEjXiXNQ0Z/Imad0pxqsI+Vv1UJyaVwu5GR4dkP9MsKT/b1xLCtoDjoStcKmoGC0Z MQMKW/hkKGh64BY5klO/mQ8Ik6owwM6ckuggPS9nVvt1CADhK/RTSasKRUPihoK0q+fP CKXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=CR6JKyUNckJ52x8qSEnOUb9T+OQ9URPdtuLRc9ZRO4E=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=cgbp99fOdjZrMRFTsCZdCISwMlHsCWXQ59SGFxyhqJFcRlQzPgNDcLxy3PfYUSjrAi iEHXm2ZZSiivYfQ+fNQt5okO8t+7K/niM2hhqMA8dKKyhEsfa6Tr0DrFLB6avYxVxSqV gHzaJ21M0txak00OxhzVrHnlOq0hiV/PipMB+gZ9pOACxWl2g9ph9BkQutJ3G9wgOReV Xt1MPvmWtq4JskRLnc5thBjXsk9mVuR9RZDjnRwcRD6hKMNKHvl/8ICmJOlxsCEnE54q 7086i+HCM7H3/eb6fm3dLxdFmVa/Z0NDh6fyrqMQ0eCv3PwhI6GxcF3hbiN3O0rGnFdu NqRA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id d75a77b69052e-476bb617f13si53413941cf.60.2025.03.15.02.24.33 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:24:33 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNfR-0007T2-8D; Sat, 15 Mar 2025 05:18:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNdB-000461-Fb; Sat, 15 Mar 2025 05:16:34 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNd9-000877-FW; Sat, 15 Mar 2025 05:16:32 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 06114FFBC8; Sat, 15 Mar 2025 12:13:46 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 0EAE61CAD61; Sat, 15 Mar 2025 12:14:40 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id CA65755A58; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-7.2.17 23/27] hw/net/smc91c111: Sanitize packet numbers Date: Sat, 15 Mar 2025 12:14:34 +0300 Message-Id: <20250315091439.657371-23-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell The smc91c111 uses packet numbers as an index into its internal s->data[][] array. Valid packet numbers are between 0 and 3, but the code does not generally check this, and there are various places where the guest can hand us an arbitrary packet number and cause an out-of-bounds access to the data array. Add validation of packet numbers. The datasheet is not very helpful about how guest errors like this should be handled: it says nothing on the subject, and none of the documented error conditions are relevant. We choose to log the situation with LOG_GUEST_ERROR and silently ignore the attempted operation. In the places where we are about to access the data[][] array using a packet number and we know the number is valid because we got it from somewhere that has already validated, we add an assert() to document that belief. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228174802.1945417-2-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 2fa3a5b9469615d06091cf473d172794148e1248) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 6ce610cb23..efb15d5fe2 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -119,6 +119,11 @@ static const VMStateDescription vmstate_smc91c111 = { #define RS_TOOSHORT 0x0400 #define RS_MULTICAST 0x0001 +static inline bool packetnum_valid(int packet_num) +{ + return packet_num >= 0 && packet_num < NUM_PACKETS; +} + /* Update interrupt status. */ static void smc91c111_update(smc91c111_state *s) { @@ -219,6 +224,17 @@ static void smc91c111_pop_tx_fifo_done(smc91c111_state *s) /* Release the memory allocated to a packet. */ static void smc91c111_release_packet(smc91c111_state *s, int packet) { + if (!packetnum_valid(packet)) { + /* + * Data sheet doesn't document behaviour in this guest error + * case, and there is no error status register to report it. + * Log and ignore the attempt. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to release invalid packet %d\n", + packet); + return; + } s->allocated &= ~(1 << packet); if (s->tx_alloc == 0x80) smc91c111_tx_alloc(s); @@ -240,6 +256,8 @@ static void smc91c111_do_tx(smc91c111_state *s) return; for (i = 0; i < s->tx_fifo_len; i++) { packetnum = s->tx_fifo[i]; + /* queue_tx checked the packet number was valid */ + assert(packetnum_valid(packetnum)); p = &s->data[packetnum][0]; /* Set status word. */ *(p++) = 0x01; @@ -288,6 +306,17 @@ static void smc91c111_do_tx(smc91c111_state *s) /* Add a packet to the TX FIFO. */ static void smc91c111_queue_tx(smc91c111_state *s, int packet) { + if (!packetnum_valid(packet)) { + /* + * Datasheet doesn't document behaviour in this error case, and + * there's no error status register we could report it in. + * Log and ignore. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to queue invalid packet %d\n", + packet); + return; + } if (s->tx_fifo_len == NUM_PACKETS) return; s->tx_fifo[s->tx_fifo_len++] = packet; @@ -458,6 +487,13 @@ static void smc91c111_writeb(void *opaque, hwaddr offset, n = s->rx_fifo[0]; else n = s->packet_num; + if (!packetnum_valid(n)) { + /* Datasheet doesn't document what to do here */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to write data to invalid packet %d\n", + n); + return; + } p = s->ptr & 0x07ff; if (s->ptr & 0x4000) { s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff); @@ -606,6 +642,13 @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset) n = s->rx_fifo[0]; else n = s->packet_num; + if (!packetnum_valid(n)) { + /* Datasheet doesn't document what to do here */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: attempt to read data from invalid packet %d\n", + n); + return 0; + } p = s->ptr & 0x07ff; if (s->ptr & 0x4000) { s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff); @@ -714,6 +757,8 @@ static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t return -1; s->rx_fifo[s->rx_fifo_len++] = packetnum; + /* allocate_packet() will not hand us back an invalid packet number */ + assert(packetnum_valid(packetnum)); p = &s->data[packetnum][0]; /* ??? Multicast packets? */ status = 0; From patchwork Sat Mar 15 09:14:35 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873873 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1105805wrq; Sat, 15 Mar 2025 02:21:01 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCUV6RCsh4+jAE6GhtVX1OCnAyqM63EK8NQjrKi8cMOsSOpYtgmd9Bpsx0xPWdhiEfYPzvKtCA==@linaro.org X-Google-Smtp-Source: AGHT+IHeHJh/GLlPqhO9XMi0YwjilqepKp5UOVmiFLdynEkxZ38COYZeG6NeKb8SzhK/+pA9CMFi X-Received: by 2002:a05:6214:e8c:b0:6e8:9fcb:5f7d with SMTP id 6a1803df08f44-6eaeaaaa503mr105102536d6.36.1742030461449; Sat, 15 Mar 2025 02:21:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030461; cv=none; d=google.com; s=arc-20240605; b=cfWcbj654qSYAgk2aJj4yVRs5I4V7/TroEWFQSxgxzhlTcnNshpluLMa2Uw3qvjv30 TU6m4UqEgfUlWh2ep+tzb2QAtamH65s+8uVvvpQjhuZf4a7mxgrr5MIZBe/9ZT68wphs Be8W4pYej1TPDXyxeo0F9SqcPjcI50dLBGuoIQjwoxcOuVaPcOiGAxxgylaXQKTtwhFo MMXr/P5EQNh1DoPg8ejNNUf+ty17X4c8+tUSnnbWqpCFG7jiWFSPqkvhc64w5OxeV2q9 wFnNvcOSigxnPNMv2ZpXnH5ptsoy2sA7mTBsOk3RKdMUmQ1EhSDUjg9+uIWvjDGTUkvZ jGmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=UadpuHgVS25nbFVTePcGf7gTb9NxkP8pTLaC5W7kWl4=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=fPX8ZmVU6odt9kAZhNOKHS1ruhwKoh7fDEGbm4uZh0WDkyVPpMy0PVsTITm+qAAOPM 373QOXGNqOVsn7J862FeTtPnmcpVyFqie9kjdModeKCB7rtosN4XLdch2P7pnFnxEHPr G9kWBgSG61cbhEc7hxEL8D9Ive0kLZ7Mp/rvObIcglAuAhzpRB9qtLhz78H8tvid7D8P EEmk2mXOufqgEumcaltsr7fHPOy+RhEBbuT++rDfn8pSM1UPWuOX8k2Ow7nyiAcPITSK wSspWQJme9wDN4nHwANrYWbLPGPKwfrRHonejErnZR1izn3uDiiOyP03/00TTLzXGrcU +QuQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade33f708si53324926d6.170.2025.03.15.02.21.01 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:21:01 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNfd-0008Uj-PH; Sat, 15 Mar 2025 05:19:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNdG-0004BF-9J; Sat, 15 Mar 2025 05:16:43 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNdE-00087l-C2; Sat, 15 Mar 2025 05:16:37 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0A894FFBC9; Sat, 15 Mar 2025 12:13:46 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 12AD51CAD62; Sat, 15 Mar 2025 12:14:40 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id CD9CA55A5A; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-7.2.17 24/27] hw/net/smc91c111: Sanitize packet length on tx Date: Sat, 15 Mar 2025 12:14:35 +0300 Message-Id: <20250315091439.657371-24-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell When the smc91c111 transmits a packet, it must read a control byte which is at the end of the data area and CRC. However, we don't sanitize the length field in the packet buffer, so if the guest sets the length field to something large we will try to read past the end of the packet data buffer when we access the control byte. As usual, the datasheet says nothing about the behaviour of the hardware if the guest misprograms it in this way. It says only that the maximum valid length is 2048 bytes. We choose to log the guest error and silently drop the packet. This requires us to factor out the "mark the tx packet as complete" logic, so we can call it for this "drop packet" case as well as at the end of the loop when we send a valid packet. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2742 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228174802.1945417-3-peter.maydell@linaro.org> [PMD: Update smc91c111_do_tx() as len > MAX_PACKET_SIZE] Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit aad6f264add3f2be72acb660816588fe09110069) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index efb15d5fe2..67e11bdedd 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -23,6 +23,13 @@ /* Number of 2k memory pages available. */ #define NUM_PACKETS 4 +/* + * Maximum size of a data frame, including the leading status word + * and byte count fields and the trailing CRC, last data byte + * and control byte (per figure 8-1 in the Microchip Technology + * LAN91C111 datasheet). + */ +#define MAX_PACKET_SIZE 2048 #define TYPE_SMC91C111 "smc91c111" OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111) @@ -241,6 +248,16 @@ static void smc91c111_release_packet(smc91c111_state *s, int packet) smc91c111_flush_queued_packets(s); } +static void smc91c111_complete_tx_packet(smc91c111_state *s, int packetnum) +{ + if (s->ctr & CTR_AUTO_RELEASE) { + /* Race? */ + smc91c111_release_packet(s, packetnum); + } else if (s->tx_fifo_done_len < NUM_PACKETS) { + s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; + } +} + /* Flush the TX FIFO. */ static void smc91c111_do_tx(smc91c111_state *s) { @@ -264,6 +281,17 @@ static void smc91c111_do_tx(smc91c111_state *s) *(p++) = 0x40; len = *(p++); len |= ((int)*(p++)) << 8; + if (len > MAX_PACKET_SIZE) { + /* + * Datasheet doesn't say what to do here, and there is no + * relevant tx error condition listed. Log, and drop the packet. + */ + qemu_log_mask(LOG_GUEST_ERROR, + "smc91c111: tx packet with bad length %d, dropping\n", + len); + smc91c111_complete_tx_packet(s, packetnum); + continue; + } len -= 6; control = p[len + 1]; if (control & 0x20) @@ -292,11 +320,7 @@ static void smc91c111_do_tx(smc91c111_state *s) } } #endif - if (s->ctr & CTR_AUTO_RELEASE) - /* Race? */ - smc91c111_release_packet(s, packetnum); - else if (s->tx_fifo_done_len < NUM_PACKETS) - s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; + smc91c111_complete_tx_packet(s, packetnum); qemu_send_packet(qemu_get_queue(s->nic), p, len); } s->tx_fifo_len = 0; From patchwork Sat Mar 15 09:14:36 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 873869 Delivered-To: patch@linaro.org Received: by 2002:a5d:4308:0:b0:38f:210b:807b with SMTP id h8csp1105170wrq; Sat, 15 Mar 2025 02:18:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCX6LZK8haAgIUKH5SP9MyDMybIozxIGtXoDZTeqcaR0aiJz6qvcEZlxx9Eb9+QidgNo7sAQHg==@linaro.org X-Google-Smtp-Source: AGHT+IGt+sy8jiuv0wOlQzAlmIC2f/+PSD7NNyjEkA+3/YEZ9XstwzvWu8F3G2IvVkXD1zeOXnrS X-Received: by 2002:ad4:5cad:0:b0:6e6:6b99:cd1e with SMTP id 6a1803df08f44-6eaeaa62615mr57939566d6.26.1742030313156; Sat, 15 Mar 2025 02:18:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1742030313; cv=none; d=google.com; s=arc-20240605; b=WqhsbkfjJzHhWdkNA1KcvGERi0KkzHP95+HRsJg+dwW/7+cNjw03PeyXto1mgoKpP7 6qmBt6UOPNgIcDrF7DwXpDOSIOdwhvPT4l7C5WiQKFpYS/aCYkSeno5rznb+XxiCDqbv OoNU5SMOUu5NZRi8kbuVUd8LCts28nutzwQ+o5khJnpifPKWMbVbwWIyRZat5hHH9Zhs cIbN3X/0i1bqJLbkoo7JcyclC20i/G7OHqhZnTjBW5cdht8GplNfiJcTKdTjHu3Q+hG4 yXl/LA5oWmv6Rxnkiloq/i86W050FYRAEiqzEUtFxQYnffdWFanwQJgoNAzD9kku6bnW iDRA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=DG7XeS8zDA1s04Ifh5IoP50QBBFCn+5Uiu0/vfeLgGA=; fh=He0A/96iGS/hdBTIvTFKPoE7yByjlEm52ubAJxr7bqo=; b=JuPt8Too955SVZIpSUuIk/Q1blz2iBHLhqmPpV6BvE9POts31qUKegrByC22YbxN9i g7C79/L2IhYw9Fn9/fFz968B3IjzsAjKk7Dtd8j+xiXGIqq49mJvSuLqtwjhlW60GKQj 3fEbkB9Fz2M7ZddTxDFTfxEJbPSJqN7LKsJEwqwtxTgIAd6y+fWQ9mo/WrC5iQWIFSQx JSldIEpddZ/CIkK6prC2Y+SB487nZhwPunyt4qag356NNXonPpIIBFT1fE4JQIv4Rua+ KSYsc6qlsQQc5YkNiW/7t/fmN4ZSXwlyhqshBQu3hpSn1RVDRbItSLELOIgvN8Y/Tbfc YXZw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id 6a1803df08f44-6eade3684e3si53703146d6.377.2025.03.15.02.18.32 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Sat, 15 Mar 2025 02:18:33 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ttNeY-0005jL-JK; Sat, 15 Mar 2025 05:17:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNdK-0004Jt-Ck; Sat, 15 Mar 2025 05:16:47 -0400 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ttNdH-00088U-WF; Sat, 15 Mar 2025 05:16:41 -0400 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id 0E522FFBCA; Sat, 15 Mar 2025 12:13:46 +0300 (MSK) Received: from gandalf.tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with ESMTP id 16C571CAD63; Sat, 15 Mar 2025 12:14:40 +0300 (MSK) Received: by gandalf.tls.msk.ru (Postfix, from userid 1000) id CF40B55A5C; Sat, 15 Mar 2025 12:14:39 +0300 (MSK) From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Michael Tokarev Subject: [Stable-7.2.17 25/27] hw/net/smc91c111: Don't allow data register access to overrun buffer Date: Sat, 15 Mar 2025 12:14:36 +0300 Message-Id: <20250315091439.657371-25-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell For accesses to the 91c111 data register, the address within the packet's data frame is determined by a combination of the pointer register and the offset used to access the data register, so that you can access data at effectively wider than byte width. The pointer register's pointer field is 11 bits wide, which is exactly the size to index a 2048-byte data frame. We weren't quite getting the logic right for ensuring that we end up with a pointer value to use in the s->data[][] array that isn't out of bounds: * we correctly mask when getting the initial pointer value * for the "autoincrement the pointer register" case, we correctly mask after adding 1 so that the pointer register wraps back around at the 2048 byte mark * but for the non-autoincrement case where we have to add the low 2 bits of the data register offset, we don't account for the possibility that the pointer register is 0x7ff and the addition should wrap Fix this bug by factoring out the "get the p value to use as an array index" into a function, making it use FIELD macro names rather than hard-coded constants, and having a utility function that does "add a value and wrap it" that we can use both for the "autoincrement" and "add the offset bits" codepaths. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2758 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-ID: <20250228191652.1957208-1-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé (cherry picked from commit 700d3d6dd41de3bd3f1153e3cfe00b93f99b1441) Signed-off-by: Michael Tokarev diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c index 67e11bdedd..81e5c823d1 100644 --- a/hw/net/smc91c111.c +++ b/hw/net/smc91c111.c @@ -13,6 +13,7 @@ #include "net/net.h" #include "hw/irq.h" #include "hw/net/smc91c111.h" +#include "hw/registerfields.h" #include "hw/qdev-properties.h" #include "qapi/error.h" #include "qemu/log.h" @@ -126,6 +127,13 @@ static const VMStateDescription vmstate_smc91c111 = { #define RS_TOOSHORT 0x0400 #define RS_MULTICAST 0x0001 +FIELD(PTR, PTR, 0, 11) +FIELD(PTR, NOT_EMPTY, 11, 1) +FIELD(PTR, RESERVED, 12, 1) +FIELD(PTR, READ, 13, 1) +FIELD(PTR, AUTOINCR, 14, 1) +FIELD(PTR, RCV, 15, 1) + static inline bool packetnum_valid(int packet_num) { return packet_num >= 0 && packet_num < NUM_PACKETS; @@ -372,6 +380,49 @@ static void smc91c111_reset(DeviceState *dev) #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8) +/* + * The pointer register's pointer is an 11 bit value (so it exactly + * indexes a 2048-byte data frame). Add the specified offset to it, + * wrapping around at the 2048 byte mark, and return the resulting + * wrapped value. There are flag bits in the top part of the register, + * but we can ignore them here as the mask will mask them out. + */ +static int ptr_reg_add(smc91c111_state *s, int offset) +{ + return (s->ptr + offset) & R_PTR_PTR_MASK; +} + +/* + * For an access to the Data Register at @offset, return the + * required offset into the packet's data frame. This will + * perform the pointer register autoincrement if required, and + * guarantees to return an in-bounds offset. + */ +static int data_reg_ptr(smc91c111_state *s, int offset) +{ + int p; + + if (s->ptr & R_PTR_AUTOINCR_MASK) { + /* + * Autoincrement: use the current pointer value, and + * increment the pointer register's pointer field. + */ + p = FIELD_EX32(s->ptr, PTR, PTR); + s->ptr = FIELD_DP32(s->ptr, PTR, PTR, ptr_reg_add(s, 1)); + } else { + /* + * No autoincrement: register offset determines which + * byte we're addressing. Setting the pointer to the top + * of the data buffer and then using the pointer wrapping + * to read the bottom byte of the buffer is not something + * sensible guest software will do, but the datasheet + * doesn't say what the behaviour is, so we don't forbid it. + */ + p = ptr_reg_add(s, offset & 3); + } + return p; +} + static void smc91c111_writeb(void *opaque, hwaddr offset, uint32_t value) { @@ -518,12 +569,7 @@ static void smc91c111_writeb(void *opaque, hwaddr offset, n); return; } - p = s->ptr & 0x07ff; - if (s->ptr & 0x4000) { - s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff); - } else { - p += (offset & 3); - } + p = data_reg_ptr(s, offset); s->data[n][p] = value; } return; @@ -673,12 +719,7 @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset) n); return 0; } - p = s->ptr & 0x07ff; - if (s->ptr & 0x4000) { - s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff); - } else { - p += (offset & 3); - } + p = data_reg_ptr(s, offset); return s->data[n][p]; } case 12: /* Interrupt status. */