The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce:

Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321

for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255:

target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000)

* contrib/elf2dmp: Support Windows Server 2022

* hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

* target/arm: Add Neoverse-N1 IMPDEF registers

* hw/usb/imx: Fix out of bounds access in imx_usbphy_read()

* docs/system/arm/cpu-features.rst: Fix formatting

* target/arm: Don't advertise aarch64-pauth.xml to gdb

Chen Baozi (1):

target/arm: Add Neoverse-N1 registers

Guenter Roeck (1):

hw/usb/imx: Fix out of bounds access in imx_usbphy_read()

Peter Maydell (3):

hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings

docs/system/arm/cpu-features.rst: Fix formatting

target/arm: Don't advertise aarch64-pauth.xml to gdb

Viktor Prutyanov (3):

contrib/elf2dmp: fix code style

contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry

contrib/elf2dmp: add PE name check and Windows Server 2022 support

The cadence UART attempts to avoid allowing the guest to set invalid

baud rate register values in the uart_write() function. However it

does the "mask to the size of the register field" and "check for

invalid values" in the wrong order, which means that a malicious

guest can get a bogus value into the register by setting also some

high bits in the value, and cause QEMU to crash by division-by-zero.

Do the mask before the bounds check instead of afterwards.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Thomas Huth <thuth@redhat.com>

Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>

Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Tested-by: Qiang Liu <cyruscyliu@gmail.com>

Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org

hw/char/cadence_uart.c | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c

--- a/hw/char/cadence_uart.c

+++ b/hw/char/cadence_uart.c

@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,

}

break;

case R_BRGR: /* Baud rate generator */

+ value &= 0xffff;

if (value >= 0x01) {

- s->r[offset] = value & 0xFFFF;

+ s->r[offset] = value;

}

break;

case R_BDIV: /* Baud rate divider */

+ value &= 0xff;

if (value >= 0x04) {

- s->r[offset] = value & 0xFF;

+ s->r[offset] = value;

}

break;

default:

2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Move out PE directory search functionality to be reused not only

for Debug Directory processing but for arbitrary PE directory.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>

Reviewed-by: Annie Li <annie.li@oracle.com>

Message-id: 20230222211246.883679-3-viktor@daynix.com

contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++-----------------

1 file changed, 42 insertions(+), 29 deletions(-)

diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c

--- a/contrib/elf2dmp/main.c

+++ b/contrib/elf2dmp/main.c

@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,

return 0;

}

+static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,

+ void *entry, size_t size, struct va_space *vs)

+ const char e_magic[2] = "MZ";

+ const char Signature[4] = "PE\0\0";

+ IMAGE_DOS_HEADER *dos_hdr = start_addr;

+ IMAGE_NT_HEADERS64 nt_hdrs;

+ IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;

+ IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;

+ IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;

+

+ QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);

+

+ if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {

+ return 1;

+ if (va_space_rw(vs, base + dos_hdr->e_lfanew,

+ &nt_hdrs, sizeof(nt_hdrs), 0)) {

+ return 1;

+ }

+

+ if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||

+ file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {

+ return 1;

+ }

+

+ if (va_space_rw(vs,

+ base + data_dir[idx].VirtualAddress,

+ entry, size, 0)) {

+ return 1;

+ }

+

+ printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,

+ (uint32_t)data_dir[idx].VirtualAddress);

+

+ return 0;

static int write_dump(struct pa_space *ps,

WinDumpHeader64 *hdr, const char *name)

@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,

static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,

char *hash, struct va_space *vs)

{

- const char e_magic[2] = "MZ";

- const char Signature[4] = "PE\0\0";

const char sign_rsds[4] = "RSDS";

- IMAGE_DOS_HEADER *dos_hdr = start_addr;

- IMAGE_NT_HEADERS64 nt_hdrs;

- IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;

- IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;

- IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;

IMAGE_DEBUG_DIRECTORY debug_dir;

OMFSignatureRSDS rsds;

char *pdb_name;

size_t pdb_name_sz;

size_t i;

- QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);

-

- if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {

- return 1;

- }

-

- if (va_space_rw(vs, base + dos_hdr->e_lfanew,

- &nt_hdrs, sizeof(nt_hdrs), 0)) {

- return 1;

- }

-

- if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||

- file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {

- return 1;

- }

-

- printf("Debug Directory RVA = 0x%08"PRIx32"\n",

- (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);

-

- if (va_space_rw(vs,

- base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,

- &debug_dir, sizeof(debug_dir), 0)) {

+ if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,

+ &debug_dir, sizeof(debug_dir), vs)) {

+ eprintf("Failed to get Debug Directory\n");

return 1;

}

2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Since its inception elf2dmp has checked MZ signatures within an

address space above IDT[0] interrupt vector and took first PE image

found as Windows Kernel.

But in Windows Server 2022 memory dump this address space range is

full of invalid PE fragments and the tool must check that PE image

is 'ntoskrnl.exe' actually.

So, introduce additional validation by checking image name from

Export Directory against 'ntoskrnl.exe'.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>

Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>

Reviewed-by: Annie Li <annie.li@oracle.com>

Message-id: 20230222211246.883679-4-viktor@daynix.com

contrib/elf2dmp/pe.h | 15 +++++++++++++++

contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++--

2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h

--- a/contrib/elf2dmp/pe.h

+++ b/contrib/elf2dmp/pe.h

@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 {

IMAGE_OPTIONAL_HEADER64 OptionalHeader;

} __attribute__ ((packed)) IMAGE_NT_HEADERS64;

+typedef struct IMAGE_EXPORT_DIRECTORY {

+ uint32_t Characteristics;

+ uint32_t TimeDateStamp;

+ uint16_t MajorVersion;

+ uint16_t MinorVersion;

+ uint32_t Name;

+ uint32_t Base;

+ uint32_t NumberOfFunctions;

+ uint32_t NumberOfNames;

+ uint32_t AddressOfFunctions;

+ uint32_t AddressOfNames;

+ uint32_t AddressOfNameOrdinals;

+} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;

+

typedef struct IMAGE_DEBUG_DIRECTORY {

uint32_t Characteristics;

uint32_t TimeDateStamp;

@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY {

#define IMAGE_DEBUG_TYPE_CODEVIEW 2

#endif

+#define IMAGE_FILE_EXPORT_DIRECTORY 0

#define IMAGE_FILE_DEBUG_DIRECTORY 6

typedef struct guid_t {

diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c

index XXXXXXX..XXXXXXX 100644

--- a/contrib/elf2dmp/main.c

+++ b/contrib/elf2dmp/main.c

@@ -XXX,XX +XXX,XX @@

#define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/"

#define PDB_NAME "ntkrnlmp.pdb"

+#define PE_NAME "ntoskrnl.exe"

#define INITIAL_MXCSR 0x1f80

@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,

return fclose(dmp_file);

}

+static bool pe_check_export_name(uint64_t base, void *start_addr,

+ struct va_space *vs)

+{

+ IMAGE_EXPORT_DIRECTORY export_dir;

+ const char *pe_name;

+

+ if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY,

+ &export_dir, sizeof(export_dir), vs)) {

+ return false;

+ }

+

+ pe_name = va_space_resolve(vs, base + export_dir.Name);

+ if (!pe_name) {

+ return false;

+ }

+

+ return !strcmp(pe_name, PE_NAME);

+}

+

static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,

char *hash, struct va_space *vs)

{

@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])

uint64_t KdDebuggerDataBlock;

KDDEBUGGER_DATA64 *kdbg;

uint64_t KdVersionBlock;

+ bool kernel_found = false;

if (argc != 3) {

eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);

@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])

if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */

- break;

+ if (pe_check_export_name(KernBase, nt_start_addr, &vs)) {

+ kernel_found = true;

+ break;

+ }

- if (!nt_start_addr) {

+ if (!kernel_found) {

eprintf("Failed to find NT kernel image\n");

err = 1;

goto out_ps;

2.34.1

From: Guenter Roeck <linux@roeck-us.net>

The i.MX USB Phy driver does not check register ranges, resulting in out of

bounds accesses if an attempt is made to access non-existing PHY registers.

Add range check and conditionally report bad accesses to fix the problem.

While at it, also conditionally log attempted writes to non-existing or

read-only registers.

Reported-by: Qiang Liu <cyruscyliu@gmail.com>

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Tested-by: Qiang Liu <cyruscyliu@gmail.com>

Message-id: 20230316234926.208874-1-linux@roeck-us.net

Link: https://gitlab.com/qemu-project/qemu/-/issues/1408

Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

hw/usb/imx-usb-phy.c | 19 +++++++++++++++++--

1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c

--- a/hw/usb/imx-usb-phy.c

+++ b/hw/usb/imx-usb-phy.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

#include "hw/usb/imx-usb-phy.h"

#include "migration/vmstate.h"

+#include "qemu/log.h"

#include "qemu/module.h"

static const VMStateDescription vmstate_imx_usbphy = {

@@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)

value = s->usbphy[index - 3];

break;

default:

- value = s->usbphy[index];

+ if (index < USBPHY_MAX) {

+ value = s->usbphy[index];

+ } else {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: Read from non-existing USB PHY register 0x%"

+ HWADDR_PRIx "\n",

+ __func__, offset);

+ value = 0;

+ }

break;

return (uint64_t)value;

@@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,

s->usbphy[index - 3] ^= value;

break;

default:

- /* Other registers are read-only */

+ /* Other registers are read-only or do not exist */

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: Write to %s USB PHY register 0x%"

+ HWADDR_PRIx "\n",

+ __func__,

+ index >= USBPHY_MAX ? "non-existing" : "read-only",

+ offset);

break;

2.34.1