ARM bootloader does not set r0 to 0

[Sylvain]

The link register is not properly set up in the ARM bootloader code, leading to the instruction which sets r0 to 0x00000000 to be skipped.

As a consequence, r0 may hold the value leaked from the board setup code.

For instance, if using arm_write_secure_board_setup_dummy_smc, r0 holds 0x00000031.

Attached is a patch to fix the issue.

Please include Sylvain Garrigues <email address hidden> in the commit log.

[Peter Maydell (pmaydell)]

On 19 April 2016 at 23:34, Sylvain <email address hidden> wrote:
> # arm-softmmu/qemu-system-arm -M raspi2 -m 1024 -smp 4 -kernel
> kernel.bin -serial stdio -dtb rpi2.dtb
>
> My code shows r0 = 0x31 while it should be 0.

Hi. Thanks for this bug report and the patch. In order
for us to be able to use your patch, we'll need you to
provide a signed-off-by line, which tells us you have
the legal right to submit it and are happy for us to
include it in QEMU under QEMU's licensing terms.
(You can look at
http://wiki.qemu.org/Contribute/SubmitAPatch#Patch_emails_must_include_a_Signed-off-by:_line
if you want more details.)

You can provide a signoff just by replying to this email
with a line which reads
"Signed-off-by: Your Name <your.email@here>".

A couple of notes: this bug only affects boards which
have a write_board_setup function, which means only
highbank/midway, raspi2, and xilinx_zynq; that's probably
why we didn't spot it earlier.

thanks
-- PMM

[Sylvain (sylvain-m)]

Signed-off-by: Sylvain Garrigues <email address hidden>

Fix link register patch follows:

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 5975fbf..5876945 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -68,7 +68,7 @@ static const ARMInsnFixup bootloader_aarch64[] = {
  */

 static const ARMInsnFixup bootloader[] = {
- { 0xe28fe008 }, /* add lr, pc, #8 */
+ { 0xe28fe004 }, /* add lr, pc, #4 */
     { 0xe51ff004 }, /* ldr pc, [pc, #-4] */
     { 0, FIXUP_BOARD_SETUP },
 #define BOOTLOADER_NO_BOARD_SETUP_OFFSET 3

> Le 20 avr. 2016 à 16:21, Peter Maydell <email address hidden> a écrit :
>
> On 19 April 2016 at 23:34, Sylvain <email address hidden> wrote:
>> # arm-softmmu/qemu-system-arm -M raspi2 -m 1024 -smp 4 -kernel
>> kernel.bin -serial stdio -dtb rpi2.dtb
>>
>> My code shows r0 = 0x31 while it should be 0.
>
> Hi. Thanks for this bug report and the patch. In order
> for us to be able to use your patch, we'll need you to
> provide a signed-off-by line, which tells us you have
> the legal right to submit it and are happy for us to
> include it in QEMU under QEMU's licensing terms.
> (You can look at
> http://wiki.qemu.org/Contribute/SubmitAPatch#Patch_emails_must_include_a_Signed-off-by:_line
> if you want more details.)
>
> You can provide a signoff just by replying to this email
> with a line which reads
> "Signed-off-by: Your Name <your.email@here>".
>
> A couple of notes: this bug only affects boards which
> have a write_board_setup function, which means only
> highbank/midway, raspi2, and xilinx_zynq; that's probably
> why we didn't spot it earlier.
>
> thanks
> -- PMM

[Peter Maydell (pmaydell)]

Fix committed: b4850e5ae9607f9f31932

[Thomas Huth (th-huth)]

Should be part of QEMU 2.6 ==> Fix released