Title integratorcp: reading CM_LMBUSCNT reaches hw_error() Version commit: 2339d0a1 tag: v10.2.0-690-g2339d0a1cf Device and source file hw/arm/integratorcp.c (Integrator core module) After starting the board, `info mtree -f` shows the accessed register in `0x10000000-0x107fffff` (`integratorcm`), so the access at `0x10000018` is in-range. Description of problem Reading `CM_LMBUSCNT` on this board lands in a hard-coded fatal path: `hw_error("integratorcm_read: CM_LMBUSCNT");` This is just a read from a mapped device register, so it should not be able to terminate the emulator. Key code: ```c /* hw/arm/integratorcp.c */ case 6: /* CM_LMBUSCNT */ /* ??? High frequency timer. */ hw_error("integratorcm_read: CM_LMBUSCNT"); ``` Root cause analysis Input source: guest MMIO read of `CM_LMBUSCNT`. Missing validation: the unimplemented register is handled with `hw_error()`. Bug class: guest-triggerable fatal error / host DoS. Impact: a single register read kills QEMU. Steps to Reproduce Configuration ```bash ./configure --target-list=arm-softmmu --enable-debug --disable-strip make -j"$(nproc)" ``` Reproducer (qtest) With the runtime layout confirmed first, this is the qtest sequence I used: ```bash cat <<'EOF' | ./qemu-system-arm -M integratorcp,accel=qtest,audiodev=snd0 -audiodev none,id=snd0 -display none -nodefaults -m 256M -monitor none -serial none -qtest stdio readl 0x10000018 EOF ``` Observed output (excerpt) ```text [I 0.000000] OPENED [R +0.002119] readl 0x10000018 qemu: hardware error: integratorcm_read: CM_LMBUSCNT CPU #0: R00=00000000 R01=00000000 R02=00000000 R03=00000000 R04=00000000 R05=00000000 R06=00000000 R07=00000000 R08=00000000 R09=00000000 R10=00000000 R11=00000000 R12=00000000 R13=00000000 R14=00000000 R15=00000000 PSR=400001d3 -Z-- A svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 [local] exit code: -6 ```