diff mbox series

libgloss, aarch64: Fix off-by-one in exception handler

Message ID aSQ7jdEG7jXmsSNh@arm.com
State New
Headers
Series libgloss, aarch64: Fix off-by-one in exception handler |

Commit Message

Alex Coplan Nov. 24, 2025, 11:03 a.m. UTC 
  There is a catch-all trap handler in the EL3 boot code found in
libgloss/aarch64/cpu-init/rdimon-aem-el3.S.  It makes a call to write
which is equivalent to the following C code:

write(STDERR_FILENO, "Terminated by exception.\n", 26);

the problem is that 26 is the length of the string + 1, the correct
length is 25:

$ python3 -c 'print(len("Terminated by exception.\n"))'
25

Therefore, as things stand, the trailing NUL byte is also written to
stderr; this can be seen by inspecting the output of binaries built with
e.g. -specs=aem-ve.specs before and after this patch is applied, as in
the below:

$ cat run_qemu.sh
#!/bin/bash
qemu-system-aarch64 -machine virt,secure=on -cpu neoverse-v1 -m 2g \
  -nographic -semihosting -device loader,file=$1,cpu-num=0
$ ./run_qemu.sh before.exe 2>&1 | xxd
00000000: 5465 726d 696e 6174 6564 2062 7920 6578  Terminated by ex
00000010: 6365 7074 696f 6e2e 0a00                 ception...
$ ./run_qemu.sh after.exe 2>&1 | xxd
00000000: 5465 726d 696e 6174 6564 2062 7920 6578  Terminated by ex
00000010: 6365 7074 696f 6e2e 0a                   ception..

This simple patch fixes the off-by-one error, passing the correct length
to write in the exception handler.
---

OK to commit?  I'll need someone to commit on my behalf as I don't have
write access.

Thanks,
Alex

---
 libgloss/aarch64/cpu-init/rdimon-aem-el3.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Richard Earnshaw Nov. 25, 2025, 1:42 p.m. UTC | #1 
On 24/11/2025 11:03, Alex Coplan wrote:
> There is a catch-all trap handler in the EL3 boot code found in
> libgloss/aarch64/cpu-init/rdimon-aem-el3.S.  It makes a call to write
> which is equivalent to the following C code:
> 
> write(STDERR_FILENO, "Terminated by exception.\n", 26);
> 
> the problem is that 26 is the length of the string + 1, the correct
> length is 25:
> 
> $ python3 -c 'print(len("Terminated by exception.\n"))'
> 25
> 
> Therefore, as things stand, the trailing NUL byte is also written to
> stderr; this can be seen by inspecting the output of binaries built with
> e.g. -specs=aem-ve.specs before and after this patch is applied, as in
> the below:
> 
> $ cat run_qemu.sh
> #!/bin/bash
> qemu-system-aarch64 -machine virt,secure=on -cpu neoverse-v1 -m 2g \
>   -nographic -semihosting -device loader,file=$1,cpu-num=0
> $ ./run_qemu.sh before.exe 2>&1 | xxd
> 00000000: 5465 726d 696e 6174 6564 2062 7920 6578  Terminated by ex
> 00000010: 6365 7074 696f 6e2e 0a00                 ception...
> $ ./run_qemu.sh after.exe 2>&1 | xxd
> 00000000: 5465 726d 696e 6174 6564 2062 7920 6578  Terminated by ex
> 00000010: 6365 7074 696f 6e2e 0a                   ception..
> 
> This simple patch fixes the off-by-one error, passing the correct length
> to write in the exception handler.
> ---
> 
> OK to commit?  I'll need someone to commit on my behalf as I don't have
> write access.
> 

Pushed.

Thanks

R.> Thanks,
> Alex
> 
> ---
>  libgloss/aarch64/cpu-init/rdimon-aem-el3.S | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
diff mbox series

Patch

diff --git a/libgloss/aarch64/cpu-init/rdimon-aem-el3.S b/libgloss/aarch64/cpu-init/rdimon-aem-el3.S
index 0296a8054..19dfee4f3 100644
--- a/libgloss/aarch64/cpu-init/rdimon-aem-el3.S
+++ b/libgloss/aarch64/cpu-init/rdimon-aem-el3.S
@@ -68,7 +68,7 @@  lower_a32_fiq:
 lower_a32_serror:
 	mov	x0, 2
 	adr	x1, .LC3
-	mov	x2, 26
+	mov	x2, 25
 	bl	FUNCTION (write)
 	mov	x0,  126
 	b	FUNCTION (exit)		/* Cannot return.  */