From: Magnus Lindholm <linmag7@gmail.com>
To: richard.henderson@linaro.org, mattst88@gmail.com,
linux-kernel@vger.kernel.org, linux-alpha@vger.kernel.org
Cc: linmag7@gmail.com
Subject: [PATCH v6 3/6] alpha: bound EV6 logout decoding by the processor area
Date: Sun, 11 Oct 2026 21:12:50 +0200 [thread overview]
Message-ID: <20261011191344.981000-4-linmag7@gmail.com> (raw)
In-Reply-To: <20261011191344.981000-1-linmag7@gmail.com>
The ES40 Service Guide, Table D-19, documents a correctable frame with
its system area at 0x58 and total size 0x80. The existing EV6 decoder
interprets system words as extended CPU registers and reads past its end.
This establishes the layout for ES40; whether Titan and Nautilus PALcode
also emits this short frame has not been verified.
Validate the processor area before decoding it and only print extended
registers when present. Preserve rejected frames with a raw dump rather
than trusting their invalid offsets. Cap the dump at 1 KiB and round down
to complete quadwords. This still relies on firmware supplying an
accessible frame of its advertised size; the cap is not pointer validation.
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
---
arch/alpha/kernel/err_common.c | 13 ++++++++++++
arch/alpha/kernel/err_ev6.c | 38 +++++++++++++++++++++++++---------
arch/alpha/kernel/err_impl.h | 1 +
3 files changed, 42 insertions(+), 10 deletions(-)
diff --git a/arch/alpha/kernel/err_common.c b/arch/alpha/kernel/err_common.c
index 94e1b3dcf6d4..9271ea425a7b 100644
--- a/arch/alpha/kernel/err_common.c
+++ b/arch/alpha/kernel/err_common.c
@@ -44,6 +44,19 @@ mchk_dump_mem(void *data, size_t length, char **annotation)
}
}
+/* Preserve rejected frames without trusting their internal offsets. */
+void
+mchk_dump_logout_frame_raw(struct el_common *header)
+{
+ size_t length = header->size;
+
+ /* Bound diagnostic output and never read a partial final quadword. */
+ if (length > 1024)
+ length = 1024;
+ length &= ~7UL;
+ mchk_dump_mem(header, length, NULL);
+}
+
void
mchk_dump_logout_frame(struct el_common *mchk_header)
{
diff --git a/arch/alpha/kernel/err_ev6.c b/arch/alpha/kernel/err_ev6.c
index 8144f2045b5b..f12299ae1f24 100644
--- a/arch/alpha/kernel/err_ev6.c
+++ b/arch/alpha/kernel/err_ev6.c
@@ -190,6 +190,25 @@ ev6_process_logout_frame(struct el_common *mchk_header, int print)
(struct el_common_EV6_mcheck *)mchk_header;
int status = MCHK_DISPOSITION_UNKNOWN_ERROR;
+ /*
+ * ES40 correctable frames end the CPU area before EXC_ADDR (Table
+ * D-19). Validate both regions before decoding or dumping any data.
+ */
+ if (mchk_header->proc_offset != offsetof(struct el_common_EV6_mcheck,
+ I_STAT) ||
+ mchk_header->sys_offset < offsetof(struct el_common_EV6_mcheck,
+ EXC_ADDR) ||
+ mchk_header->sys_offset > mchk_header->size ||
+ ((mchk_header->sys_offset | mchk_header->size) & 7)) {
+ if (print) {
+ printk("%s Invalid EV6 logout frame: size %x, CPU %x, system %x\n",
+ err_print_prefix, mchk_header->size,
+ mchk_header->proc_offset, mchk_header->sys_offset);
+ mchk_dump_logout_frame_raw(mchk_header);
+ }
+ return MCHK_DISPOSITION_UNKNOWN_ERROR;
+ }
+
status |= ev6_parse_ibox(ev6mchk->I_STAT, print);
status |= ev6_parse_mbox(ev6mchk->MM_STAT, ev6mchk->DC_STAT,
ev6mchk->C_STAT, print);
@@ -203,16 +222,15 @@ ev6_process_logout_frame(struct el_common *mchk_header, int print)
if (status != MCHK_DISPOSITION_DISMISS) {
char *saved_err_prefix = err_print_prefix;
- /*
- * Dump some additional information from the frame
- */
- printk("%s EXC_ADDR: 0x%016lx IER_CM: 0x%016lx"
- " ISUM: 0x%016lx\n"
- " PAL_BASE: 0x%016lx I_CTL: 0x%016lx"
- " PCTX: 0x%016lx\n",
- err_print_prefix,
- ev6mchk->EXC_ADDR, ev6mchk->IER_CM, ev6mchk->ISUM,
- ev6mchk->PAL_BASE, ev6mchk->I_CTL, ev6mchk->PCTX);
+ /* These registers are absent from short correctable frames. */
+ if (mchk_header->sys_offset >= sizeof(*ev6mchk))
+ printk("%s EXC_ADDR: 0x%016lx IER_CM: 0x%016lx"
+ " ISUM: 0x%016lx\n"
+ " PAL_BASE: 0x%016lx I_CTL: 0x%016lx"
+ " PCTX: 0x%016lx\n",
+ err_print_prefix,
+ ev6mchk->EXC_ADDR, ev6mchk->IER_CM, ev6mchk->ISUM,
+ ev6mchk->PAL_BASE, ev6mchk->I_CTL, ev6mchk->PCTX);
if (status == MCHK_DISPOSITION_UNKNOWN_ERROR) {
printk("%s UNKNOWN error, frame follows:\n",
diff --git a/arch/alpha/kernel/err_impl.h b/arch/alpha/kernel/err_impl.h
index 737b958a586d..5bef23a00942 100644
--- a/arch/alpha/kernel/err_impl.h
+++ b/arch/alpha/kernel/err_impl.h
@@ -47,6 +47,7 @@ struct el_subpacket_handler {
extern char *err_print_prefix;
extern void mchk_dump_mem(void *, size_t, char **);
+extern void mchk_dump_logout_frame_raw(struct el_common *header);
extern void mchk_dump_logout_frame(struct el_common *);
extern void el_print_timestamp(union el_timestamp *);
extern void el_process_subpackets(struct el_subpacket *, int);
--
2.43.0
next prev parent reply other threads:[~2026-10-11 19:14 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-11 19:12 [PATCH v6 0/6] alpha: improve Tsunami machine check reporting Magnus Lindholm
2026-10-11 19:12 ` [PATCH v6 1/6] alpha: move Tsunami machine check handling to err_tsunami.c Magnus Lindholm
2026-10-11 19:12 ` [PATCH v6 2/6] alpha: describe the Tsunami system machine check frame Magnus Lindholm
2026-10-11 19:12 ` Magnus Lindholm [this message]
2026-10-11 19:59 ` [PATCH v6 3/6] alpha: bound EV6 logout decoding by the processor area Matt Turner
2026-10-11 19:12 ` [PATCH v6 4/6] alpha: decode and acknowledge Tsunami system machine checks Magnus Lindholm
2026-10-11 20:00 ` Matt Turner
2026-10-11 19:12 ` [PATCH v6 5/6] alpha: decode Clipper environmental events and retain console logs Magnus Lindholm
2026-10-11 20:00 ` Matt Turner
2026-10-11 19:12 ` [PATCH v6 6/6] alpha: stop on fatal Tsunami system ECC and write parity errors Magnus Lindholm
2026-10-11 20:01 ` Matt Turner
2026-10-12 4:57 ` Magnus Lindholm
2026-10-13 3:19 ` Matt Turner
2026-10-13 5:37 ` Magnus Lindholm
2026-10-11 19:59 ` [PATCH v6 0/6] alpha: improve Tsunami machine check reporting Matt Turner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261011191344.981000-4-linmag7@gmail.com \
--to=linmag7@gmail.com \
--cc=linux-alpha@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mattst88@gmail.com \
--cc=richard.henderson@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®