From nobody Sat Sep 26 20:01:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1790177779; cv=none; d=zohomail.com; s=zohoarc; b=fQxEgY8GgywpfmFtDWrFK2BbsP0MuXg6zu6WUuhEjW/lhb8Mkb5P4fgr3G8LRgWMaAelRdkojOOXE7/SN0et0FUUNSJa4f0txQ+0OBgQ6eWsK3CzBH4s0Tu4BezRT6G43fLqVq/sAYVV/kgmVFM11Vt7DfcqncJFMupd1u1XEnM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790177779; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3AAsn5hRzFWTJqFhNM6N7BgfNZj9lOJNONVNVc0evOM=; b=SPX7mJHxvm5iSC2iG8a9IIftZsn3I6I+gehgnuqTn2m8kUqPdR+Hzi9qiC9PfPdJu9c7wdgwQFpHi1imGRVHtGGWpcOcWXqNpJNgB2Atd09uPWt5Cx3pS4KcR+Gap1w4+m0gW3P8sLM+IOHcq1ejhkOFw8ieaIzDvreL2R71Yno= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790177779821149.42243586906386; Wed, 23 Sep 2026 08:36:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x9P0T-0003Rr-5E; Wed, 23 Sep 2026 11:35:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0M-0003QR-1w for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:30 -0400 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0G-0007nK-Os for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:28 -0400 Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68NBbbW63772266 for ; Wed, 23 Sep 2026 15:35:23 GMT Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gvdb6169a-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 23 Sep 2026 15:35:22 +0000 (GMT) Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-86a6f4ba619so794139b3a.1 for ; Wed, 23 Sep 2026 08:35:22 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-87d1e601b5dsm1516072b3a.61.2026.09.23.08.35.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Sep 2026 08:35:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 3AAsn5hRzFWTJqFhNM6N7BgfNZj9lOJNONVNVc0evOM=; b=I0g1J9RzkTYa6zFS uZRF/xm0kX65dpGMPjG5lzB8TQNgXRshe6vBwLKoVQKsVZOSFvdtsszlHNGqInUz Z7VV8aE11JiOrCBiyCSlOE/UAEe/VF1vDbl+g8+IexGee2LTpR/Mmna1nWh4Ma79 gIi6HFcx1O+dr/eTj3bI0ez6KJ3J9lMoL4Z9vVm1SVWW10hVSIFJ7A54Cq6snt2M Kkgs2sHo/hJcq8sEYZGPvZvG+QzKCMU74YMZBFfRIsl6CqmNRZ852yOrqcn7ZsWK w5OPhOAnmF1a0D5NXQSKESUqWOqGThVWibErfaL496RVdjE6kgSw2GBiGbDcKP+n apHuXA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1790177722; x=1790782522; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=3AAsn5hRzFWTJqFhNM6N7BgfNZj9lOJNONVNVc0evOM=; b=IEyHZX2RvbhHoxo7SgL8QcJzvUxipxo7P8R8dpv7+GJAxVrYu6yNQU/4VVr3eDjjKV cqhWrRhRwWL8Vn/ezj7GdMYgyOcrMa+wgJRbJDKwWNfcJTvxuvNlw9DXmdUeQzfS4G8U HdV/fyew4dwocXa3kK22vWkq7qc5pRYHVGcpwEfOpJeVf9TL/X1zbvsi1zd1OYgRiGvq wPB47c3a18DkPGTnV+rd4z9qA5kE3hbOXSvQ8PtcEALpD06Qlw53nbf/IbvTNwXn/sI1 16C97Gpgp63C/PeR9/z13d2loKrKcq1OS293UTFv1wNqM0eJeUohYtzBF6ISNO931GIH U8nA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790177722; x=1790782522; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=3AAsn5hRzFWTJqFhNM6N7BgfNZj9lOJNONVNVc0evOM=; b=0W9uBO5z+JxUCSb7ZhFzPSYbAixdWaUw7/iJy+DSYK55dgNW7rRM0EuUyCeSOm18Up OkEmHEolTXvIGt6J5t4WdzNEZdY/tit4oFPgIyo1dM595KiiKEvslu9x1L6U0HpXzqg3 dy+XRIkporkRl4Ggoq4tUDww1pqxvUJ+OgwszJwk8//KCQpzI9/l+TU3ycPCXaJ7JbFx fMaGTgBWlmEsV9OKazcYsxksrzqkk/2C851oOZAuf9KIgn5MIcP8+jjtWh7Y+4XJyM2O 6BdKDkvN4GugCjPsCt6bWxmR+8iPWSC9bBA6BU1TzmhZ27op+gknINiIDKhhTsSCG/Li zPBg== X-Gm-Message-State: AFuF++kORrf7KAkgerTl/z42A5UFXDXeaDNrCdp3jfBzgMWcjRPXMo0C YdAMJNUSw3HrG+yRIFtFr1FVXJO/7+NEqmRrNTq7q5H6Y2QdSxtkT2UWIs4yupuPoTAyNnGzzH7 hWmsTeCKP0SAgNu6UIkMntQLwGXoRfOe64sSmyV5mg1vW6iilFYvLXaD8o5NmJHSBTg== X-Gm-Gg: AYBFou09COloP2sL0S7zHwdnNCDUgDa+SdWzUeF9Jk7+v/Gew3w16H5df7xZt0v04zx OdyDtns3p9XjFQAysvRsIV/segOiAWEIDgfFFoNEFEcOd++/OINGneG2fitwiPUfRskjYk5zcV7 hJSfn0qwq/WPjyuTuKN40Ep9wGwkoK0TpJqA4MiPx+M/ZbJiJlJvRVbwb3YHOpsjgwBHD8P5vfQ wh8GzXE+npxDxRotIIuRMr+diwudweOYwaQYe9Msj9noGhlcKdGA5QISKkNswDdgpJ/qsMm6Jdd o4RRl28NBv4LSd2w1am0EV2v+LyS7HXVvQODNKzayNIJeZWEX8LGeNsv4gv0R9vjLt+PIbkgzfL vNlAmnEYLsbdwRwpkewb9NTVKVnmTYkaeIObcm0MuA/cVIBQ= X-Received: by 2002:a05:6300:6bd6:20b0:3dd:f9ff:f67 with SMTP id adf61e73a8af0-3ddfa0e5de5mr1649206637.15.1790177721612; Wed, 23 Sep 2026 08:35:21 -0700 (PDT) X-Received: by 2002:a05:6300:6bd6:20b0:3dd:f9ff:f67 with SMTP id adf61e73a8af0-3ddfa0e5de5mr1649176637.15.1790177720898; Wed, 23 Sep 2026 08:35:20 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Brian Cain , philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org Subject: [PATCH v3 1/4] target/hexagon: fix semihosting OPEN filename handling Date: Wed, 23 Sep 2026 08:35:13 -0700 Message-Id: <20260923153516.3615007-2-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> References: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: ah6AeYOffYhApGUtD0QFkfJJLoNqLAs3 X-Proofpoint-ORIG-GUID: ah6AeYOffYhApGUtD0QFkfJJLoNqLAs3 X-Authority-Analysis: v=2.4 cv=QeXzLcbv c=1 sm=1 tr=0 ts=6ab3f1bb cx=c_pps a=mDZGXZTwRPZaeRUbqKGCBw==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=hEAv9kTW4kDMYmpk0H0A:9 a=QEXdDO2ut3YA:10 a=zc0IvFSfCIW2DFIPzwfm:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfX8ej+46Xdhixa Dp2VMUsotoQpFx8w2/ByRNFyh+4w4w4DeUg1nSRssAEiHjgKMhyHClFzj+KRKIH68EBQXnt56PX k48vD+YLiWYQN+cf58vZjNaITkuOypI= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfX8TtTlD/nCNTT dRYoMhRB5Pn1MIIRdkYPWzEqUQFg1OxZNTo14JByu0uGrasA0gFzk88bIfqmRLFxzJJlsqpBKrN U466x4LPPdbUjQ+BxegqQPr1iTs7mBgldmuDxbGkfwaXM8SUgvtzZvNSD7PyzkZJLsJigd/JAzV 7p2dElXrkpF1AE0lParEOZOhJJCE9NRV6Z5toTMkbpNaY19/6pf7CUUjlHa9tOqm8ioiJ/zkxHB X7uXm2c4r5R0o8buxgS2uMRMIejmPHV7cbtqN5G/zuvrqD/vu3BE4r4OX0xMPbJSjGxjbKeXtEP iiUQfWW5tf2wJ51s3U60nobkQMwDv03mWXX+OU6qIsK/nPRFl9PKecbVq2X8cbFv6syEiherzdm oSVan8Cxmax+RB6dq/ksIyOMKST3HmQy5l+RM0HPhzH+Rusw73y0CzUZkLatwAklbmmszi1VvGu PGJU01UwoRlkUCnME+w== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-23_04,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 priorityscore=1501 phishscore=0 lowpriorityscore=0 bulkscore=0 impostorscore=0 adultscore=0 clxscore=1015 spamscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609230062 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.180.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0b-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1790177781004158500 HEX_SYS_OPEN copied guest bytes into a fixed-size buffer until it found a NUL. A missing terminator could overrun that buffer. Use lock_user() with the ABI filename length and validate its terminating NUL before opening it. Replace hexagon_read_memory() with get_user_*() for semihosting argument accesses. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/cpu_helper.h | 2 - target/hexagon/cpu_helper.c | 48 ++-------------- target/hexagon/hexswi.c | 107 ++++++++++++++++++++++-------------- 3 files changed, 70 insertions(+), 87 deletions(-) diff --git a/target/hexagon/cpu_helper.h b/target/hexagon/cpu_helper.h index 12512efd74f..d6b2dfa4b03 100644 --- a/target/hexagon/cpu_helper.h +++ b/target/hexagon/cpu_helper.h @@ -7,8 +7,6 @@ #ifndef HEXAGON_CPU_HELPER_H #define HEXAGON_CPU_HELPER_H =20 -void hexagon_read_memory(CPUHexagonState *env, target_ulong vaddr, int siz= e, - void *retptr, uintptr_t retaddr); void hexagon_write_memory(CPUHexagonState *env, target_ulong vaddr, int size, uint64_t data, uintptr_t retaddr); void hexagon_peek_memory_range(CPUHexagonState *env, uint32_t start_addr, diff --git a/target/hexagon/cpu_helper.c b/target/hexagon/cpu_helper.c index eea5f60b46c..a3578da6d2c 100644 --- a/target/hexagon/cpu_helper.c +++ b/target/hexagon/cpu_helper.c @@ -27,48 +27,6 @@ =20 #ifndef CONFIG_USER_ONLY =20 -static bool hexagon_read_memory_small(CPUHexagonState *env, target_ulong a= ddr, - int byte_count, uint64_t *data, - int mmu_idx, uintptr_t retaddr) - { - /* handle small sizes */ - switch (byte_count) { - case 1: - *data =3D cpu_ldub_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 2: - *data =3D cpu_lduw_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 4: - *data =3D cpu_ldl_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 8: - *data =3D cpu_ldq_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - default: - /* larger request, handle elsewhere */ - return false; - } -} - -void hexagon_read_memory(CPUHexagonState *env, target_ulong vaddr, int siz= e, - void *retptr, uintptr_t retaddr) -{ - BQL_LOCK_GUARD(); - CPUState *cs =3D env_cpu(env); - unsigned mmu_idx =3D cpu_mmu_index(cs, false); - uint64_t data; - if (hexagon_read_memory_small(env, vaddr, size, &data, mmu_idx, retadd= r)) { - stn_he_p(retptr, size, data); - } else { - cpu_abort(cs, "%s: ERROR: bad size =3D %d!\n", __func__, size); - } -} - static bool hexagon_write_memory_small(CPUHexagonState *env, target_ulong = addr, int byte_count, uint64_t data, int mmu_idx, uintptr_t retaddr) @@ -116,11 +74,13 @@ static inline uint32_t page_start(uint32_t addr) void hexagon_peek_memory_range(CPUHexagonState *env, uint32_t start_addr, uint32_t length, uintptr_t retaddr) { - unsigned int warm; + CPUState *cs =3D env_cpu(env); + unsigned int mmu_idx =3D cpu_mmu_index(cs, false); uint32_t first =3D page_start(start_addr); uint32_t last =3D page_start(start_addr + length - 1); + for (uint32_t page =3D first; page <=3D last; page +=3D TARGET_PAGE_SI= ZE) { - hexagon_read_memory(env, page, 1, &warm, retaddr); + cpu_ldub_mmuidx_ra(env, page, mmu_idx, retaddr); } } =20 diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index 4705e915aea..6a4c42914e1 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -28,6 +28,7 @@ #include "semihosting/console.h" #include "semihosting/syscalls.h" #include "semihosting/guestfd.h" +#include "semihosting/uaccess.h" #include "system/runstate.h" =20 /* non-arm-compatible semihosting calls */ @@ -168,14 +169,18 @@ static void init_semihosting_guestfds(void) } } =20 -static void do_preload(CPUHexagonState *env, target_ulong swi_info, bool l= oad) +static bool do_preload(CPUHexagonState *env, target_ulong swi_info) { + CPUState *cs =3D env_cpu(env); uint32_t addr, count; uintptr_t retaddr =3D 0; =20 - hexagon_read_memory(env, swi_info + 4, 4, &addr, retaddr); - hexagon_read_memory(env, swi_info + 8, 4, &count, retaddr); + if (get_user_u32(addr, swi_info + 4) || + get_user_u32(count, swi_info + 8)) { + return false; + } hexagon_peek_memory_range(env, addr, count, retaddr); + return true; } =20 /* Hexagon semihosting errno values */ @@ -429,7 +434,10 @@ static void sim_handle_trap0(CPUHexagonState *env) * the input address. The contents of that buffer will be * directed to the SWI interface. */ - do_preload(env, swi_info, (what_swi =3D=3D HEX_SYS_WRITE)); + if (!do_preload(env, swi_info)) { + semi_cb(cs, -1, EFAULT); + return; + } } /* * ARM-compat semihosting SWI numbers are all <=3D 0x31. @@ -461,31 +469,28 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_OPEN: { - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; unsigned int filemode; - int length; + uint32_t filename_len; + size_t filename_size; int real_openmode; int ret, err =3D 0; - int i =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); - hexagon_read_memory(env, swi_info + 4, 4, &filemode, retaddr); - hexagon_read_memory(env, swi_info + 8, 4, &length, retaddr); - - if (length >=3D BUFSIZ) { - qemu_log_mask(LOG_GUEST_ERROR, - "%s: filename too large (%d)\n", - __func__, length); - semi_cb(cs, -1, ENAMETOOLONG); - break; + if (get_user_u32(physical_filename_addr, swi_info) || + get_user_u32(filemode, swi_info + 4) || + get_user_u32(filename_len, swi_info + 8)) { + goto do_fault; } =20 - do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); - i++; - } while (filename[i - 1]); + /* The ABI length excludes the filename's terminating NUL. */ + filename_size =3D (size_t)filename_len + 1; + filename =3D lock_user(VERIFY_READ, physical_filename_addr, + filename_size, true); + if (!filename || filename[filename_len] !=3D '\0') { + unlock_user(filename, physical_filename_addr, 0); + goto do_fault; + } =20 /* convert ARM ANGEL filemode into host filemode */ if (filemode < ARRAY_SIZE(angel_to_host_filemode_table)) { @@ -494,6 +499,7 @@ static void sim_handle_trap0(CPUHexagonState *env) qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid OPEN mode: %u\n", __func__, filemode); + unlock_user(filename, physical_filename_addr, 0); semi_cb(cs, -1, EINVAL); break; } @@ -513,6 +519,7 @@ static void sim_handle_trap0(CPUHexagonState *env) ret =3D guestfd; } } + unlock_user(filename, physical_filename_addr, 0); semi_cb(cs, ret, err); } break; @@ -531,7 +538,9 @@ static void sim_handle_trap0(CPUHexagonState *env) case HEX_SYS_ISTTY: { int fd; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); + if (get_user_u32(fd, swi_info)) { + goto do_fault; + } semi_cb(cs, isatty(fd), 0); } break; @@ -540,8 +549,10 @@ static void sim_handle_trap0(CPUHexagonState *env) { int fd; target_ulong off; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); - hexagon_read_memory(env, swi_info + 4, 4, &off, retaddr); + if (get_user_u32(fd, swi_info) || + get_user_u32(off, swi_info + 4)) { + goto do_fault; + } semihost_sys_lseek(env_cpu(env), common_semi_ftell_cb, fd, off, GDB_SEEK_SET); } @@ -556,13 +567,17 @@ static void sim_handle_trap0(CPUHexagonState *env) char filename[BUFSIZ]; target_ulong physical_filename_addr; target_ulong statBufferAddr; - hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); + if (get_user_u32(physical_filename_addr, swi_info) || + get_user_u32(statBufferAddr, swi_info + 4)) { + goto do_fault; + } =20 if (what_swi =3D=3D HEX_SYS_STAT) { int i =3D 0; do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); + if (get_user_u8(filename[i], physical_filename_addr + i)) { + goto do_fault; + } i++; } while ((i < BUFSIZ) && filename[i - 1]); rc =3D stat(filename, &st_buf); @@ -590,8 +605,6 @@ static void sim_handle_trap0(CPUHexagonState *env) sys_stat.mtime =3D cpu_to_le32(st_buf.st_mtime); sys_stat.ctime =3D cpu_to_le32(st_buf.st_ctime); } - hexagon_read_memory(env, swi_info + 4, 4, &statBufferAddr, retaddr= ); - for (int i =3D 0; i < sizeof(sys_stat); i++) { hexagon_write_memory(env, statBufferAddr + i, 1, st_bufptr[i], retaddr); @@ -604,8 +617,10 @@ static void sim_handle_trap0(CPUHexagonState *env) { int fd; off_t size_limit; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); - hexagon_read_memory(env, swi_info + 4, 8, &size_limit, retaddr); + if (get_user_u32(fd, swi_info) || + get_user_u64(size_limit, swi_info + 4)) { + goto do_fault; + } semihost_sys_ftruncate(cs, semi_cb, fd, size_limit); } break; @@ -619,16 +634,17 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 int i =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &FileNameAddr, retaddr); + if (get_user_u32(FileNameAddr, swi_info) || + get_user_u32(BufferMode, swi_info + 4)) { + goto do_fault; + } do { - hexagon_read_memory(env, FileNameAddr + i, 1, &filename[i], - retaddr); + if (get_user_u8(filename[i], FileNameAddr + i)) { + goto do_fault; + } i++; } while ((i < BUFSIZ) && (filename[i - 1])); filename[i] =3D 0; - - hexagon_read_memory(env, swi_info + 4, 4, &BufferMode, retaddr); - rc =3D access(filename, BufferMode); semi_cb(cs, rc, rc =3D=3D 0 ? 0 : errno); } @@ -641,8 +657,10 @@ static void sim_handle_trap0(CPUHexagonState *env) uint32_t BufferSize; uint32_t rc =3D 0, err =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &BufferAddr, retaddr); - hexagon_read_memory(env, swi_info + 4, 4, &BufferSize, retaddr); + if (get_user_u32(BufferAddr, swi_info) || + get_user_u32(BufferSize, swi_info + 4)) { + goto do_fault; + } =20 if (!getcwd(cwdPtr, PATH_MAX)) { err =3D errno; @@ -676,7 +694,9 @@ static void sim_handle_trap0(CPUHexagonState *env) case HEX_SYS_FTELL: { int fd; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); + if (get_user_u32(fd, swi_info)) { + goto do_fault; + } semihost_sys_lseek(cs, common_semi_ftell_cb, fd, 0, GDB_SEEK_CUR); } break; @@ -714,6 +734,11 @@ static void sim_handle_trap0(CPUHexagonState *env) "unknown swi request: 0x%" PRIx32 "\n", (uint32_t)what_swi); semi_cb(cs, -1, ENOSYS); + break; + + do_fault: + semi_cb(cs, -1, EFAULT); + break; } } =20 --=20 2.34.1 From nobody Sat Sep 26 20:01:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1790177761; cv=none; d=zohomail.com; s=zohoarc; b=gwwFjj8TCiWay5Z9WUi4Knuh1orHnMQvUXrxUYQIVo3WSOT4H+DVttwVmoFsrktLOg1lID8cyDP5ntriYAw1i3itB3K6oxghgbhbBQ5agQUGg1wp1mPNvPDDVd0XiEq/gdjtS+WKU5RZik/+KrpTCxq8QhybdviFhgg4+ZC5qPg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790177761; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Oi4bCaFs3KNwyQBkJ7GPKB+4MbctQ2MgVFUD9DxJ36g=; b=hkRBXGeeY+ED318GSeNZ60MGGFoCVpnbORBPK87R4LsLudTi34oZYAr1wahBdaxfPkBqxFWpkBaGmXIFnIEG8Cr55/+O/IQFczy+FDHL3rkToDZ12Nsld+mnzQliYD4JzjsA0p+ULQ5CMxVQUqx5O+G7B51RAH0iXRE0NcsWwVM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790177761080509.6923440470093; Wed, 23 Sep 2026 08:36:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x9P0U-0003Rs-C7; Wed, 23 Sep 2026 11:35:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0N-0003Qu-Nn for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:31 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0K-0007nf-NQ for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:31 -0400 Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68NDKfp3322172 for ; Wed, 23 Sep 2026 15:35:24 GMT Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gvfjsgmdt-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 23 Sep 2026 15:35:23 +0000 (GMT) Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-86a59faf521so918922b3a.2 for ; Wed, 23 Sep 2026 08:35:23 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-87d1e601b5dsm1516072b3a.61.2026.09.23.08.35.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Sep 2026 08:35:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= Oi4bCaFs3KNwyQBkJ7GPKB+4MbctQ2MgVFUD9DxJ36g=; b=VJwVWJ3OXnFfP/zB IFvH8zo2dwyM8YAg+ltYSswTFL1lqfJ4mzRf2XoH90QvpG/1xCodCK35jvzyEHSB NwKfcI9Uo5Toz3WYxsq+0R/nahemxzq5OOASkmBWd9awJ4k3GDNmPT37ZM6kCQaG nJ5fi22sZM/KtfC/Vr453O5wCD5DzyhFdQxWfxiHNq3c+r4Y2UiwmdDo6NAn5OuC woEkACHeyOntnvOOCJ18vANRFGYu/tRrcYzMp1VjqjnC+4WAbmM/RJXXBgqk7bip j2vILaTbTnP8bPr3XaZHsBCkqigfPXzQTENQdbRPXwfb05GqcS0orviZhWB0QF9t PjFy5Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1790177723; x=1790782523; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Oi4bCaFs3KNwyQBkJ7GPKB+4MbctQ2MgVFUD9DxJ36g=; b=KYnfQusOl4/i2/ugdF/v/1zfzomOrGZnZNi+9hLh+bS4niyEvBi2Ca2YsEi4mJ4ykq cgLIVG2tU/tiZRU8ZasW3qlD+cVHEs6WcrTE70oOQ8zmXisO8m0nDCsPoNTeCm8gKh/K HA0mc7unr5DySDx8B9ijZIoFBjvjzPB6U1RuKpqOcjIPTrEbqh0VBZXv+DVgDrFlSBRW Lw4SxlNExnyofDD2H66aEOELxgx0FuasNpRcvLLCrKoSO0BldVjorEBh362ywhAWU8NB CB4PluzZ+Rf5QBk3QomCVydIcOy5r9aON3SYx1bxFhmbycIlqyUZ0SipCPlAAQIinfuU X1Xw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790177723; x=1790782523; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Oi4bCaFs3KNwyQBkJ7GPKB+4MbctQ2MgVFUD9DxJ36g=; b=fr/CGbfYdxjAYtUW8LpMt9k3U860I4+LSU6EFsu7tlCKx4iE0KLRyi/ah80hKt64gs DubHtETeIxffL+t5/gzfJgTIeqdSFay+0aRYjUFKdzOlYgGcgG0H1pgiVSeoM4bvDtA+ i7XFBHiu9DTaIRx2M4auRAcfIlqoCxoVF4IXzdX3Xd3uC93hDTMOeDXGpZcmdn8T8Q7J d4zAWLunZEOY8hjG8GgVrHryQc34dPCZ9yLRF3/HNdmIRJ/WrGXUakZwmBKqYjk46+x9 cHUb8ZBSy8NJGpNu2nvjA+Nu0nlVY2FFphmQk+c7MNuIZWYT3Ix1xlkiauE/uUliqu1g 26Yg== X-Gm-Message-State: AFuF++k+4tbmhsm7ESPgjCzB2uC0yYCkz+Lf12E4z0VgmwQmbkXJyPXE HubkbHB77AsrKK7/NcMpGBKa84cV/4JUB22Tyb/DM4UDqUBiZd+r33J6K/FeWzFPUwpGm/GSYv8 kOi6EL5pFQ/EdEDSeBiaadWvvg75gV7dY45dO5P3q70omm90mLozF1DxOTbkIvTdYSA== X-Gm-Gg: AYBFou2+pbadPUq6LW9rQ08f5X/zuM8jKgdOR1d0SBDY0Q3zG7T1FxiurlCzqUVkWaw ENI6I5zjQw5+x7l8Oc10Mb4eoL2MdfBeN+qlpBdGnjmuAI47DC2snWZNSVzyb9/PNxsHWRe2byg q1qP0zKor11MkKBBD1P5rylRsYhWSS4pFvGMWHGq0K9tesxf/i6u6rxMPEQc2fmRhQRdDE96SOe Pp6YzLyD1OKcq5YkA4CkianJKisHbVabMmDYAddTf6BXjLEwSTvUplacDmlsG8xsSg3BeKRlWAP UhYeCelDu2vBQrtB5Zuu8Oblqm4pE+umW+rTzzUPx6pOZTqFCWSQPIhfUgjrO9zhbYJXyoxsVR4 29JE2371BMJzGgeo0opS0WlAMV4Xmcl8njNulf0IVEtQ7h1U= X-Received: by 2002:a05:6a00:1911:b0:878:1aee:fa43 with SMTP id d2e1a72fcca58-87d1b2b072fmr2579278b3a.33.1790177722943; Wed, 23 Sep 2026 08:35:22 -0700 (PDT) X-Received: by 2002:a05:6a00:1911:b0:878:1aee:fa43 with SMTP id d2e1a72fcca58-87d1b2b072fmr2579250b3a.33.1790177722339; Wed, 23 Sep 2026 08:35:22 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Brian Cain , philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org Subject: [PATCH v3 2/4] target/hexagon: fix semihosting STAT filename handling Date: Wed, 23 Sep 2026 08:35:14 -0700 Message-Id: <20260923153516.3615007-3-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> References: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfXwFZqssZPC9TS j2X0CVrToVp8R0lD6F4RjlARss6GoCJWxXLaQdOmP6AHkedXC18Gp1yWg1jtypSHuFE5tbpzN3G nfdgtisLe7HDv/x7UGel7Jr26vn2bgrrz5QSzmdgnMRmrB6zqZxY5+F25wh2eA496jRoXVC9hES jVpHIwlbMD64ZNI5M6vncdcjokrgb99iCafDRha+gXuS3Fr19sh1/y+RJ21nbt/HQ4rsZSZkiCs PSlTGopjMdAv8sFTHFGj8f3U4zichKwTqwKao3R/yCqeAUt5KzjSkj874m1wGSJYXSorcvxRyS8 B5uQzdvOuXATjSZkATvBJdGzl68p2v+rnQ4nib1n/uz+s+uNj2rxhu8/NeNT8Cui6f23+t1GC8D a3lvbkJI7LIZwxYj5HIFuSF46KR0ZnkbOD5MrWiXaKvGi+Cvz+QjsierKtrM/Pz9ghy57RQtt2/ kIi3t9yxSHWjqkJqGmA== X-Proofpoint-GUID: EufqhgSDgnko_lbSRe5DNM6apWNcF9Qn X-Proofpoint-ORIG-GUID: EufqhgSDgnko_lbSRe5DNM6apWNcF9Qn X-Authority-Analysis: v=2.4 cv=K4+3jCWI c=1 sm=1 tr=0 ts=6ab3f1bb cx=c_pps a=WW5sKcV1LcKqjgzy2JUPuA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=eoimf2acIAo5FJnRuUoq:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=FZZFJ5KotruyPtQxbZcA:9 a=QEXdDO2ut3YA:10 a=OpyuDcXvxspvyRM73sMx:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfX8MRaCX4X1YCa /6O/+wSga75J27/ba4ael5LZbvaNoex2kt8CZ7/s3xJSH3mYmNRY5FW6FW9Qr8BzRDfr1KrxIV1 9opBKcdBQNTTOeABgHxMTUdZuibUWDs= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-23_04,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 phishscore=0 suspectscore=0 priorityscore=1501 spamscore=0 lowpriorityscore=0 malwarescore=0 adultscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609230062 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1790177762780158500 HEX_SYS_STAT could pass an unterminated local filename buffer to stat() when the guest string filled it. Use lock_user_string() to map the guest string safely. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index 6a4c42914e1..9e885344a73 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -564,7 +564,7 @@ static void sim_handle_trap0(CPUHexagonState *env) struct stat st_buf; uint8_t *st_bufptr =3D (uint8_t *)&sys_stat; int rc, err =3D 0; - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; target_ulong statBufferAddr; if (get_user_u32(physical_filename_addr, swi_info) || @@ -573,15 +573,14 @@ static void sim_handle_trap0(CPUHexagonState *env) } =20 if (what_swi =3D=3D HEX_SYS_STAT) { - int i =3D 0; - do { - if (get_user_u8(filename[i], physical_filename_addr + i)) { - goto do_fault; - } - i++; - } while ((i < BUFSIZ) && filename[i - 1]); + filename =3D lock_user_string(physical_filename_addr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc =3D stat(filename, &st_buf); err =3D errno; + unlock_user(filename, physical_filename_addr, 0); } else { int fd =3D physical_filename_addr; GuestFD *gf =3D get_guestfd(fd); --=20 2.34.1 From nobody Sat Sep 26 20:01:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1790177761; cv=none; d=zohomail.com; s=zohoarc; b=dG21jV55j9IoHEXtx0U17JErnczkBXCSkjNyH6WJ8+DXphTJE84Ab05nEMeDfhToQhSp3+r/+cxCXjnqUuJaa91lhz1dh4obiRXQik6lG7GtwkCpCKFtsCQfeAfoLT0KNxTrujz28lj+iedTH/iChrKlHttJkdOKAfRugelyUHs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790177761; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=XLjb43swtoOWATDZCNbyUc6f4RjjUHm57qX1Y/WEq/w=; b=kxWW3UppiIZPQPqmbSPwDIF6qDlAlMbfLOf8b/OzDPJp1Cb6snhpQStHV2xP4HHio6lE7q2r/z0G/ekgf8KdDSlzQYOPpOKK3jqBCio8lgMOkmI+YaR97q/EwHXrS+PNA6NWfvVU0MY6qyxMvFjVzhPX41imwOAJwi3MChKaA48= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790177761637430.19998980106607; Wed, 23 Sep 2026 08:36:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x9P0U-0003Rw-Bc; Wed, 23 Sep 2026 11:35:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0P-0003RN-NQ for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:34 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0L-0007nq-Or for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:32 -0400 Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68NBbkrX3295824 for ; Wed, 23 Sep 2026 15:35:27 GMT Received: from mail-pf1-f198.google.com (mail-pf1-f198.google.com [209.85.210.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gvbwm9kyx-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 23 Sep 2026 15:35:27 +0000 (GMT) Received: by mail-pf1-f198.google.com with SMTP id d2e1a72fcca58-8632fdf67dfso845432b3a.1 for ; Wed, 23 Sep 2026 08:35:27 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-87d1e601b5dsm1516072b3a.61.2026.09.23.08.35.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Sep 2026 08:35:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= XLjb43swtoOWATDZCNbyUc6f4RjjUHm57qX1Y/WEq/w=; b=hBlu+sG2vDnmkLCx ik3GA6KCokMTe9cxQEg7tHdTpEm1EuCA5QcF4oarT9vwy9r3knLmIz2keZY9zjkb mEGsN72FWZhJvpl4NE8n0xKbjlkgLcSpuLQWGtYpY3XgnzFnh91O2PFNljo7Vp1I iPu3rwl+axlzwn2W6I3dST9bqAgR03lLXIMmI5Jh3Uyu6S8T4tQE1FAJxGftUbEd HB0HLD4cVsyLAqabn0inSNY2phovcW3lUsd51PIgYX91sxgWHMmRlaZQ/ozPpBXm z8yOQSCIfTN6irJOrhHzohSYrUX7HDfFntu1cqqy1+2bpyf6cGxvjMq9SbIy0FGM DHI02g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1790177726; x=1790782526; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=XLjb43swtoOWATDZCNbyUc6f4RjjUHm57qX1Y/WEq/w=; b=Zr3Hsb0NCv1KWQVq8Rgw3U2F/25vcG1ojtk+dp8IuNYygM3QuW6prRmLAPM3Sm6wKs Nii3SAm2X84XwqhvNNCH/e10xdzsKvkBJIodgKlDcAWvtaoWip06gcUI2P6POqESJGcP psIl1tSaRJzZN6NCIBh+z2YPQ2X8Irkes/G4dHn/bjeuygzbZjPfX855C1Tzx9awDVUj 1rAkg/AQHzNdZMokq0OGcyIWlVDYQe7TI/Au3DVdBfZ1yVSGWhZk9kIt9pDHWar4GQoY xsJgIZszXmK9bvIFuZs8BfjvMVrpTBTy+PE8jTqgcjjyhI5gGRTdeYKfQXMSETJHMdcD 4bXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790177726; x=1790782526; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=XLjb43swtoOWATDZCNbyUc6f4RjjUHm57qX1Y/WEq/w=; b=uep/Cy9addVOauG1XeWZD/iOV16Zs4fXXu7zT3XWteL5VpOksI0c0f4ooCpDsDcnYj fvd/VspnlxDN3FOhUxgQJm949f8KQrHpCs0peHXnq0BX7YWHs6axarqkITwGS7Jtngz2 J6lrJqsUpl4dUlsjEJ63A0YH1goO+77fshsGmaHFhq8ikI0AHg8ILTNsIzgH4j8fWxhf F3eiCvezkyU7ZLZbgR55oeA7eFaFjoKh7+NdERUUCTTfDKvM/E9lgB7+7rq4w8vj1Kv5 8OJeU0GrpMikq3/hA0pAFBD3gkso8LmgngFHxYhmosUF1h6SSJHdHUumQSXZrsaYcbj8 zq2Q== X-Gm-Message-State: AFuF++keIt9ounDXx+5HM0ss9vVuIQsF58yuPDoCzFYkXfde+biIZZ8t 3kvWp9WGxRfd2LLVLb7h+y1USX2pDJKmBUUSd0unqEINrlcqpylPr3U0bx5HP81jKndiUSqLSHw sbvc0CTfytNL5tHMFBS3du3F3iUPJNS1ZONOo1CGPR+4txfyNcPazjEnMgKze+wyGPw== X-Gm-Gg: AYBFou0Dg4PXSmY4FaKLdSM+Gjdef2ZFcC4bIp9bSbGMceuBJO/agzCuXXx8SEx7Urm 2MkdzsZuHJtZq9MIT640zfpJuMih+0s+b13Ca940A7P53fq8QPzLvpISL8UArfvFNEPyrOllW63 fV/2y0JnD7in5YiDyPfEkYPNLe3n6atUZRZ3rpGR7caqz1AvE4XeRUHBZtfSGQV7/gXaKuhOwO8 24KPnAUz7t3ivKrZSkt3CjjtfklRr+SD6e250zsaHJC7S5asfO79GEYGbcxUN9T8Jkf9fB356gI KVWw/hrWr0/w2cGjfqLbGcjtcmFwk9dt1nbXbZaJyzIIFFAq8Ruvk8ndv2OUHmaxLk1nwK94Q13 PYpEWGILurgOalib+GpMOzBP2G50cebVzhDXnV4rdbripNzk= X-Received: by 2002:a05:6a00:288b:b0:878:3705:5720 with SMTP id d2e1a72fcca58-87c857f2d1dmr3151558b3a.44.1790177724758; Wed, 23 Sep 2026 08:35:24 -0700 (PDT) X-Received: by 2002:a05:6a00:288b:b0:878:3705:5720 with SMTP id d2e1a72fcca58-87c857f2d1dmr3151546b3a.44.1790177724323; Wed, 23 Sep 2026 08:35:24 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Brian Cain , philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org Subject: [PATCH v3 3/4] target/hexagon: fix semihosting ACCESS filename handling Date: Wed, 23 Sep 2026 08:35:15 -0700 Message-Id: <20260923153516.3615007-4-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> References: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Info: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfX/iSkJMq8xO1l ktd+4vMlho4CjktLO0RBzxZJWSLKsc2FWd5vR/bEapg5Ud92zMK4LDOSyCI6YnN36EDy9TGfc6g A3deHX2uHLjq9tV1uIecXiefzz732so= X-Authority-Analysis: v=2.4 cv=R/6WitRX c=1 sm=1 tr=0 ts=6ab3f1bf cx=c_pps a=m5Vt/hrsBiPMCU0y4gIsQw==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=pS50CBgNNeok3lFgILkA:9 a=QEXdDO2ut3YA:10 a=IoOABgeZipijB_acs4fv:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-GUID: PPoDI1HoFPolapXB6VfYBeebHGDcKGC7 X-Proofpoint-ORIG-GUID: PPoDI1HoFPolapXB6VfYBeebHGDcKGC7 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfXwDBLMsRQilrA 4lYaW+Fy+3Di7nbpbhcD8vsEuI0PHiR6juJvSajRHjvxE9noTmWmzGhWmAVIeThaCqNION71yG7 G9v+bdQFWf5gPIKIZP7QucDvM1xm2GnXys83GrQA6mxtJ8FMKRCo9IfKN5s56PB5+UgCQf4Ue6d QIMBiFHoH4LQ1Z/9RTtfX2joD0VOoUXSFdisEYvsgE+MPCj9clMwfFKIEfL3TjJEKq0a5w+3PBv El2W0n4WMpXItxGJPVCJ0WBb4PjlHluQ82B2q5PJqQgwGB6c8A6LAjkI4mA196p3F911kpsa3S+ ohNM/kf6CnwWpGTBTRr47Xy89I1gh3Lx38Tt5KI7lkUFxvutmQhMvipzYjnFts9fpGAOgkioJc2 B2cJ6VWDkkcxEDVgSlSYfCWpmsmQ9lfyGdcf9Zc8XwatQBkdfrD25ytI6TM/sBfeYxFQIH6znGJ BULwf+V47VOHRpP9ihw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-23_04,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609230062 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1790177762781158500 HEX_SYS_ACCESS wrote a NUL byte past its fixed-size filename buffer when the guest string filled it. Use lock_user_string() to avoid the out-of-boun= ds write. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Resolves: Coverity CID 1685942 Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index 9e885344a73..a18e675aec9 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -626,26 +626,24 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_ACCESS: { - char filename[BUFSIZ]; + char *filename; uint32_t FileNameAddr; uint32_t BufferMode; - int rc; - - int i =3D 0; + int rc, err; =20 if (get_user_u32(FileNameAddr, swi_info) || get_user_u32(BufferMode, swi_info + 4)) { goto do_fault; } - do { - if (get_user_u8(filename[i], FileNameAddr + i)) { - goto do_fault; - } - i++; - } while ((i < BUFSIZ) && (filename[i - 1])); - filename[i] =3D 0; + filename =3D lock_user_string(FileNameAddr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc =3D access(filename, BufferMode); - semi_cb(cs, rc, rc =3D=3D 0 ? 0 : errno); + err =3D errno; + unlock_user(filename, FileNameAddr, 0); + semi_cb(cs, rc, rc =3D=3D 0 ? 0 : err); } break; =20 --=20 2.34.1 From nobody Sat Sep 26 20:01:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1790177775; cv=none; d=zohomail.com; s=zohoarc; b=WQwLrxSKZNxKx51YaD9DxIGjDiN1Gki4ix0+Zvy8+tKMvSKmq7mCmgxVCfSCNpiDDI2HTfVlje6hkYXKqV885OO6iLoWAweCzFPFGmXtvw2pIzQonQG+9B3ScaARwk/7goaJ7G/8Y6vmXT0eDOzJUWpxBMIXXCLOU7LL/xfdQRI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790177775; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=O8FRPjrEmxVSebteoOgV6vdfaFSXe50/ep6t2WyhFfE=; b=ZlZN5Pj663sdgh7ybqkBM4ocG7gE1NL7f/cWO3JvmjoZiohX2NBspT7Jjsu0G9Eiw3Q1ev82n9qyLaukZWqcS1lTUpnQS3tjzmu0josWJNLfNI08qqO+5lcKsOULQJOogyYiDGCDK6R15UllHovFQwlVMfZ5G9JN1BGiZEfC27U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790177775060288.23830001751435; Wed, 23 Sep 2026 08:36:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x9P0Y-0003Sk-7A; Wed, 23 Sep 2026 11:35:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0P-0003RO-Nz for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:34 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x9P0L-0007nr-H9 for qemu-devel@nongnu.org; Wed, 23 Sep 2026 11:35:33 -0400 Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68NDKpFX2056305 for ; Wed, 23 Sep 2026 15:35:27 GMT Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gvfjv0mef-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 23 Sep 2026 15:35:27 +0000 (GMT) Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-cc435388657so1178719a12.3 for ; Wed, 23 Sep 2026 08:35:27 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-87d1e601b5dsm1516072b3a.61.2026.09.23.08.35.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 23 Sep 2026 08:35:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= O8FRPjrEmxVSebteoOgV6vdfaFSXe50/ep6t2WyhFfE=; b=ExYr5cfwBr1tgJgd 6+uK5gA5Dqv6n89o+Y/ZlWlmiSIjeXWe3k1GAFznfmbqLwhAZBGyQln3cF4t1XjX UPDUwE8+a/qwuOA0qXnT5kcWaOq8op9OyyhpIrd8piOoK+6Qq0aTPLe61PBl8T7b Ppnawg/Tejadm2RoR0GJzinXsZCBPDW6IQY+oWzIfY85su3Y3GdM4sj65dAXFHkx NkcYao+b6TKUCPeaU6+4f21bBm6ANVoM2x/K4elucqivWLkV5n+LS9k5D9oY8UUR 1inn/+tT4C6KTmr9k9E33gT5obGyay4Io2DzXAEMLI34/wYEAKniRbhFS/XPR2zD eGzZTw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1790177727; x=1790782527; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=O8FRPjrEmxVSebteoOgV6vdfaFSXe50/ep6t2WyhFfE=; b=PQFew33ZZ29yYPl9hjNAumUG3ICDhkX2EKA6FbXJADBqkgy6myl/CuBd//MMd1IARS D4ydAqVNt8BLIOWWLaYpPIO1vGsZREeNvhD2mJwmsf1qZVV/vcqkL8o6deK/ndxI9uiL 6fhlr5icHgViVGNcZ9Wmwi7v7XhxD8Ij+UzO6lEPdHtljOmU8ggXLjlQiMr6DadNxtaL 9r1YjqvDBkRHPiIUfAYuqfu9Ck/LcalF5sXNdkmcpP29t80If+1uaCb/qU4mumJ/hsNU QO0Qt2GTL6ffzhoemRTodBu18BUqPGmei+lGax2g2ijavS2pWqIN344qTR6eTSsVQhF+ +1zg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790177727; x=1790782527; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=O8FRPjrEmxVSebteoOgV6vdfaFSXe50/ep6t2WyhFfE=; b=dTumGgyMhKx1fehYwtBEGHs+Tm5AKqPOEM4T6M6FMjylhFwitKF5XcvmEN/cVH4DMT +0WJhWjTxmbXGDipCuzuJsYjRlcRgjmaHcVlOl5duLy/3FEIi7eBZs6kOuJ6hHHHo3Fx tdskGAgI2zQXHI1XvgoZNLACUOGwavVyjYN4MaA4HKuRuvlh1MfDbE9VeLx2nOUb2GZe CLCYnjKijIXbWRWuVMkw1es5ph1E8aKmCumZK9YHinrO7MAFfZelBLh1GSLC8qlaxQZi 5Hnqo1MEf4bmHpC8oPPUFiidcvkMCZgFoWYA/TCwEZQp9LaqXgRaDsEKHe/XIdaczcaE WzjA== X-Gm-Message-State: AFuF++k4OeWwi0rzk2KJFOVw/svG8HgI07fcT91GsRYcV0le9/nOh0QN yXsTsuxjlKt3JAAYwI6TegRAkTQ7RssS3+6kakYrAI6nv/NeCpKz7KVvSjfT8Q+BSN6XKH8PHW1 2qsZg+EB3LC/jdh5OuJ/X6QYOWjpGOv1WcnfHVxDfuB8jOKfoZzP+pMuMIVC+KyGGRg== X-Gm-Gg: AYBFou16Od4vQlaiXo6+NTkaFH9K2U49EU0Il60sK+eu66taemZJ7RXj4jukpMV5n/1 URijrOuISM2Jie6yPR5OlLkN23oN+ByAX2hoOge01UJ2Cg64jD/KeZnuS1QGtJdfxKMLV4bkVwT 28QGT48j74qj9Wb23AchtQ4PHKTdnpbEklGCkF+PYuqMhnfdNqb/16OqznJfAuKZb+eE1QWF1y8 65jriKGZWP2eYGin2sTfdNpFUpC40ymVxy6tqBnAsQp3B8MXCyvLriVltW4t6xKVrvyh6wET7m3 4Gfx2Z1mP4WykBEh5sjDep5AZTSiTZZotnDmqVNMCeplax4MCVq/525tHQdI0q2lAYTKDQEvYtS vi44+hDYsPmtvIDyDYEDJi5jXqBvsJ3iQSjQfKREhYLozChk= X-Received: by 2002:a05:6a21:7d06:b0:3c3:875d:c52f with SMTP id adf61e73a8af0-3ddf7cf9bd7mr3117249637.10.1790177726395; Wed, 23 Sep 2026 08:35:26 -0700 (PDT) X-Received: by 2002:a05:6a21:7d06:b0:3c3:875d:c52f with SMTP id adf61e73a8af0-3ddf7cf9bd7mr3117198637.10.1790177725811; Wed, 23 Sep 2026 08:35:25 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Brian Cain , philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org, Matheus Tavares Bernardino Subject: [PATCH v3 4/4] target/hexagon: add directory semihosting operations Date: Wed, 23 Sep 2026 08:35:16 -0700 Message-Id: <20260923153516.3615007-5-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> References: <20260923153516.3615007-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfXyGedOP2ZMf6C /freWFXsWDF/mcPLjwc+eKcRdTByNKA/Z6RE1q9uh4x1/j/quqtWrWWY63l7IoT07J9peHlj3Vd So0EmcObFJqnE8OiVh8JdIk6jtQvMtcMm9+MRAZuYbJYZwMciECt1McIVYoF1Gc5Iyh/p3gDJfq scsx8o4b1RnuaiwGo21pGTtvDfsX3vm8tKQduN0L301HDeeLukuHgdiS7fRAmS4KOArUG6qw2+M axSg3PQ8OPuL+KwGo5M79NxBAs0TJt0Au7d8L3BbxGBp9CklcgmE3btKyvMddccoA1oFBNHmz/Z Hkxb0FCm9My52AoLbDD0YM9ZM9QoywU501XtUoSYeYgLX2fDKag8UrcFbaq5rDfEqN2sGRZM2h+ +OEtx+uIn+rgZreJAFeHfA20w07PZxYiCB/726yAwiZk1aVbxUiLf2OOtIqAuZp5LYMEts6Umo5 eYNzwNj6W57ab1gApEQ== X-Authority-Analysis: v=2.4 cv=aIxlOr9m c=1 sm=1 tr=0 ts=6ab3f1bf cx=c_pps a=Oh5Dbbf/trHjhBongsHeRQ==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=EUspDBNiAAAA:8 a=JARE-9YbG5QTd34tVfMA:9 a=QEXdDO2ut3YA:10 a=_Vgx9l1VpLgwpw_dHYaR:22 X-Proofpoint-GUID: vXpbM6nnIiovohUYgT2bz-l2tUAcFBsy X-Proofpoint-Spam-Info: AW1haW4tMjYwOTIzMDA2MiBTYWx0ZWRfX+ZB1BmN/QDoD uooFu9arWGkmy3aGK5LBT+tMbIwiw7VSzlJlzmIuWvdd9VhFf6L6hgvZ84W4yoxHrWNP4HtOvNb 2k09p8BsWVEw9Lmt8KbmN1Jk214jkEg= X-Proofpoint-ORIG-GUID: vXpbM6nnIiovohUYgT2bz-l2tUAcFBsy X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-23_04,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 lowpriorityscore=0 adultscore=0 bulkscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609230062 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1790177777066158500 From: Matheus Tavares Bernardino Bare-metal Hexagon programs use OPENDIR, READDIR, and CLOSEDIR semihosting calls to enumerate host directories. Directory handles are shar= ed by CPUs in a cluster, allowing guest indices to resolve across calls. Use lock_user_string()/unlock_user() to read the OPENDIR path from guest memory instead of copying it into a fixed-size buffer. CLOSEDIR clears its slot in the directory list, so a stale index reports EBADF instead of dereferencing a freed pointer. Also add a functional test for the new semihosting operations. Signed-off-by: Matheus Tavares Bernardino Signed-off-by: Brian Cain --- include/hw/hexagon/hexagon.h | 14 ++- hw/hexagon/hex-subsys.c | 32 ++++--- target/hexagon/hexswi.c | 108 ++++++++++++++++++++++ tests/functional/hexagon/test_systests.py | 11 +++ 4 files changed, 153 insertions(+), 12 deletions(-) diff --git a/include/hw/hexagon/hexagon.h b/include/hw/hexagon/hexagon.h index 62398eeb359..58bdcabe87e 100644 --- a/include/hw/hexagon/hexagon.h +++ b/include/hw/hexagon/hexagon.h @@ -11,6 +11,7 @@ =20 #include "system/memory.h" #include "hw/core/boards.h" +#include "hw/cpu/cluster.h" =20 struct hexagon_board_boot_info { uint64_t ram_size; @@ -159,6 +160,17 @@ struct hexagon_machine_config { union hexagon_config_table cfgtable; }; =20 +#define TYPE_HEXAGON_CLUSTER_STATE "hexagon-cluster-state" +OBJECT_DECLARE_SIMPLE_TYPE(HexagonClusterState, HEXAGON_CLUSTER_STATE) + +struct HexagonClusterState { + CPUClusterState parent_obj; + + struct { + GList *dir_list; + } semihosting; +}; + #define TYPE_HEXAGON_COMMON_MACHINE "hexagon-common-machine" OBJECT_DECLARE_SIMPLE_TYPE(HexagonCommonMachineState, HEXAGON_COMMON_MACHI= NE) =20 @@ -168,7 +180,7 @@ struct HexagonCommonMachineState { MemoryRegion ram; MemoryRegion cfgtable_rom; MemoryRegion vtcm; - DeviceState *cluster; + HexagonClusterState cluster; DeviceState *l2vic; DeviceState *qtimer; DeviceState *glob_regs; diff --git a/hw/hexagon/hex-subsys.c b/hw/hexagon/hex-subsys.c index 4e3a418340e..f76f803dfb0 100644 --- a/hw/hexagon/hex-subsys.c +++ b/hw/hexagon/hex-subsys.c @@ -98,14 +98,11 @@ static DeviceState *tlb_create(HexagonCommonMachineStat= e *hms, return tlb; } =20 -static DeviceState *cluster_create(HexagonCommonMachineState *hms) +static void cluster_create(HexagonCommonMachineState *hms) { - DeviceState *cluster =3D qdev_new(TYPE_CPU_CLUSTER); - - object_property_add_child(OBJECT(hms), "cluster", OBJECT(cluster)); - qdev_prop_set_uint32(cluster, "cluster-id", 0); - - return cluster; + object_initialize_child(OBJECT(hms), "cluster", &hms->cluster, + TYPE_HEXAGON_CLUSTER_STATE); + qdev_prop_set_uint32(DEVICE(&hms->cluster), "cluster-id", 0); } =20 void hex_subsys_create(HexagonCommonMachineState *hms, @@ -135,7 +132,7 @@ void hex_subsys_create(HexagonCommonMachineState *hms, &hms->vtcm); } =20 - hms->cluster =3D cluster_create(hms); + cluster_create(hms); hms->l2vic =3D l2vic_create(hms, m_cfg); hms->qtimer =3D qtimer_create(hms, m_cfg); hms->glob_regs =3D globalreg_create(hms, m_cfg, rev); @@ -144,7 +141,7 @@ void hex_subsys_create(HexagonCommonMachineState *hms, =20 void hex_subsys_add_cpu(HexagonCommonMachineState *hms, DeviceState *cpu) { - object_property_add_child(OBJECT(hms->cluster), "cpu[*]", OBJECT(cpu)); + object_property_add_child(OBJECT(&hms->cluster), "cpu[*]", OBJECT(cpu)= ); object_property_set_link(OBJECT(cpu), "global-regs", OBJECT(hms->glob_regs), &error_fatal); object_property_set_link(OBJECT(cpu), "tlb", OBJECT(hms->tlb), @@ -158,10 +155,10 @@ void hex_subsys_realize_cluster(HexagonCommonMachineS= tate *hms) /* * The cluster must be realized after its CPUs have been parented into= it * (see hex_subsys_add_cpu()) but before any CPU is itself realized, s= ince - * qdev_realize_and_unref() on a CPU latches cluster_index into the TCG + * qdev_realize() on a CPU latches cluster_index into the TCG * cflags at that point. */ - qdev_realize_and_unref(hms->cluster, NULL, &error_fatal); + qdev_realize(DEVICE(&hms->cluster), NULL, &error_fatal); } =20 void hex_subsys_realize_cpu(HexagonCommonMachineState *hms, DeviceState *c= pu, @@ -173,3 +170,16 @@ void hex_subsys_realize_cpu(HexagonCommonMachineState = *hms, DeviceState *cpu, l2vic_connect_cpu(hms->l2vic, cpu); } } + +static const TypeInfo hexagon_cluster_type_info =3D { + .name =3D TYPE_HEXAGON_CLUSTER_STATE, + .parent =3D TYPE_CPU_CLUSTER, + .instance_size =3D sizeof(HexagonClusterState), +}; + +static void hexagon_cluster_register_types(void) +{ + type_register_static(&hexagon_cluster_type_info); +} + +type_init(hexagon_cluster_register_types) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index a18e675aec9..6c11ffc19a6 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -19,6 +19,7 @@ #include "hex_mmu.h" #include "hexswi.h" #include "hw/hexagon/hexagon_globalreg.h" +#include "hw/hexagon/hexagon.h" =20 #ifdef CONFIG_USER_ONLY #error "This file is only used in system emulation" @@ -31,6 +32,18 @@ #include "semihosting/uaccess.h" #include "system/runstate.h" =20 +/* We start from 1 as 0 is used to signal an error from g_dir_open(). */ +static const int DIR_INDEX_OFFSET =3D 1; + +/* + * GDir does not surface "." and ".." itself, so we track how many of + * those synthetic entries have been served for this handle so far. + */ +typedef struct { + GDir *dir; + unsigned int dot_entries; +} SemihostingDir; + /* non-arm-compatible semihosting calls */ #define HEXAGON_SPECIFIC_SWI_FLAGS \ DEF_SWI_FLAG(OPEN, 0x01) \ @@ -405,6 +418,13 @@ static void coredump(CPUHexagonState *env) qemu_log_unlock(f); } =20 +static GList **hex_semihosting_dir_list(CPUHexagonState *env) +{ + HexagonCPU *cpu =3D env_archcpu(env); + HexagonClusterState *cluster =3D HEXAGON_CLUSTER_STATE(OBJECT(cpu)->pa= rent); + return &cluster->semihosting.dir_list; +} + static void sim_handle_trap0(CPUHexagonState *env) { target_ulong what_swi, swi_info; @@ -684,6 +704,94 @@ static void sim_handle_trap0(CPUHexagonState *env) } break; =20 + case HEX_SYS_OPENDIR: + { + GDir *dir; + SemihostingDir *semidir; + char *buf; + int rc =3D 0, err =3D 0; + + buf =3D lock_user_string(swi_info); + if (!buf) { + common_semi_cb(cs, -1, EFAULT); + break; + } + + GList **dir_list =3D hex_semihosting_dir_list(env); + dir =3D g_dir_open(buf, 0, NULL); + if (dir !=3D NULL) { + semidir =3D g_new(SemihostingDir, 1); + semidir->dir =3D dir; + semidir->dot_entries =3D 0; + *dir_list =3D g_list_append(*dir_list, semidir); + rc =3D g_list_index(*dir_list, semidir) + DIR_INDEX_OFFSET; + } else { + err =3D errno; + } + unlock_user(buf, swi_info, 0); + common_semi_cb(cs, rc, rc !=3D 0 ? 0 : err); + break; + } + + case HEX_SYS_READDIR: + { + const char *host_dir_entry =3D NULL; + int dir_index =3D swi_info - DIR_INDEX_OFFSET; + GList **dir_list =3D hex_semihosting_dir_list(env); + SemihostingDir *dir =3D g_list_nth_data(*dir_list, dir_index); + uint32_t rc =3D 0, err =3D 0; + size_t i, name_len; + + if (dir) { + if (dir->dot_entries < 2) { + host_dir_entry =3D dir->dot_entries++ ? ".." : "."; + } else { + errno =3D 0; + host_dir_entry =3D g_dir_read_name(dir->dir); + if (host_dir_entry =3D=3D NULL) { + err =3D errno; + } + } + } else { + err =3D EBADF; + } + + if (host_dir_entry) { + uint32_t guest_dir_entry =3D env->gpr[HEX_REG_R02]; + /* GDir does not provide a portable inode number. */ + hexagon_write_memory(env, guest_dir_entry, 4, 0, retaddr); + name_len =3D MIN(strlen(host_dir_entry), 254); + for (i =3D 0; i <=3D name_len; i++) { + hexagon_write_memory(env, guest_dir_entry + 4 + i, 1, + host_dir_entry[i], retaddr); + } + rc =3D guest_dir_entry; + } + common_semi_cb(cs, rc, err); + break; + } + + case HEX_SYS_CLOSEDIR: + { + SemihostingDir *dir; + int ret =3D -1, err =3D 0; + int dir_index =3D swi_info - DIR_INDEX_OFFSET; + GList **dir_list =3D hex_semihosting_dir_list(env); + GList *node =3D g_list_nth(*dir_list, dir_index); + + dir =3D node ? node->data : NULL; + if (dir !=3D NULL) { + g_dir_close(dir->dir); + g_free(dir); + ret =3D 0; + node->data =3D NULL; + } else { + err =3D EBADF; + } + common_semi_cb(cs, ret, ret =3D=3D 0 ? 0 : err); + break; + } + case HEX_SYS_COREDUMP: coredump(env); break; diff --git a/tests/functional/hexagon/test_systests.py b/tests/functional/h= exagon/test_systests.py index 2779efa9172..a1080f7b974 100755 --- a/tests/functional/hexagon/test_systests.py +++ b/tests/functional/hexagon/test_systests.py @@ -7,6 +7,7 @@ import re import time import unittest +from pathlib import Path =20 from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern =20 @@ -99,5 +100,15 @@ def test_mmu_multi_tlb(self): def test_timer_reg(self): self.run_exit_zero("timer_reg") =20 + def test_dirent(self): + testdir =3D Path(self.scratch_file("_testdir_dirent")) + testdir.mkdir() + files =3D ["file1", "file2"] + for f in files: + testdir.joinpath(f).touch() + expected =3D ". .. " + " ".join(files) + self.run_console_pattern("dirent", expected, "-append", + str(testdir)) + if __name__ =3D=3D "__main__": QemuSystemTest.main() --=20 2.34.1