Skip to content
Snippets Groups Projects
Select Git revision
  • feature/libtcg-rebase default protected
1 result
Search by author
  • Any Author
  • Anton Anton anjo
1 author
  1. Mar 24, 2021
    • Alex Bennée's avatar
      semihosting: move semihosting tests to multiarch · 3539d84d
      Alex Bennée authored 
      
It may be arm-compat-semihosting but more than one architecture uses
it so lets move the tests into the multiarch area. We gate it on the
feature and split the semicall.h header between the arches.

Also clean-up a bit of the Makefile messing about to one common set of
runners.

Signed-off-by: default avatarAlex Bennée <alex.bennee@linaro.org>
Reviewed-by: default avatarRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20210323165308.15244-6-alex.bennee@linaro.org>
      3539d84d
    • Richard Henderson's avatar
      exec: Build page-vary-common.c with -fno-lto · 44b99a6d
      Richard Henderson authored 
      
In bbc17caf, we used an alias attribute to allow target_page
to be declared const, and yet be initialized late.

This fails when using LTO with several versions of gcc.
The compiler looks through the alias and decides that the const
variable is statically initialized to zero, then propagates that
zero to many uses of the variable.

This can be avoided by compiling one object file with -fno-lto.
In this way, any initializer cannot be seen, and the constant
propagation does not occur.

Since we are certain to have this separate compilation unit, we
can drop the alias attribute as well.  We simply have differing
declarations for target_page in different compilation units.
Drop the use of init_target_page, and drop the configure detection
for CONFIG_ATTRIBUTE_ALIAS.

In order to change the compilation flags for a file with meson,
we must use a static_library.  This runs into specific_ss, where
we would need to create many static_library instances.

Fix this by splitting page-vary.c: the page-vary-common.c part is
compiled once as a static_library, while the page-vary.c part is
left in specific_ss in order to handle the target-specific value
of TARGET_PAGE_BITS_MIN.

Reported-by: default avatarGavin Shan <gshan@redhat.com>
Signed-off-by: default avatarRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20210321211534.2101231-1-richard.henderson@linaro.org>
[PMD: Fix typo in subject, split original patch in 3]
Signed-off-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: default avatarGavin Shan <gshan@redhat.com>
Message-Id: <20210322112427.4045204-4-f4bug@amsat.org>
[rth: Update MAINTAINERS]
Signed-off-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      44b99a6d
    • Richard Henderson's avatar
      exec: Rename exec-vary.c as page-vary.c · 6670d4d0
      Richard Henderson authored 
      
exec-vary.c is about variable page size handling,
rename it page-vary.c. Currently this file is target
specific (built once for each target), comment this.

Signed-off-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210322112427.4045204-2-f4bug@amsat.org>
[rth: Update MAINTAINERS]
Signed-off-by: default avatarRichard Henderson <richard.henderson@linaro.org>
      6670d4d0
  3. Mar 22, 2021
    • Philippe Mathieu-Daudé's avatar
      net/eth: Read ip6_ext_hdr_routing buffer before accessing it · 7d6a4f12
      Philippe Mathieu-Daudé authored 
      We can't know the caller read enough data in the memory pointed
by ext_hdr to cast it as a ip6_ext_hdr_routing.
Declare rt_hdr on the stack and fill it again from the iovec.

Since we already checked there is enough data in the iovec buffer,
simply add an assert() call to consume the bytes_read variable.

This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported
by QEMU fuzzer:

  $ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
    -accel qtest -monitor none \
    -serial none -nographic -qtest stdio
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  write 0x25 0x1 0x86
  write 0x26 0x1 0xdd
  write 0x4f 0x1 0x2b
  write 0xe1020030 0x4 0x190002e1
  write 0xe102003a 0x2 0x0807
  write 0xe1020048 0x4 0x12077cdd
  write 0xe1020400 0x4 0xba077cdd
  write 0xe1020420 0x4 0x190002e1
  write 0xe1020428 0x4 0x3509d807
  write 0xe1020438 0x1 0xe2
  EOF
  =================================================================
  ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
  READ of size 1 at 0x7ffdef904902 thread T0
      #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
      #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
      #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
      #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
      #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
      #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
      #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
      #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
      #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5

  Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
      #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486

    This frame has 1 object(s):
      [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
  HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
        (longjmp and C++ exceptions *are* supported)
  SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
  Shadow bytes around the buggy address:
    0x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Stack left redzone:      f1
    Stack right redzone:     f3
  ==2859770==ABORTING

Add the corresponding qtest case with the fuzzer reproducer.

FWIW GCC 11 similarly reported:

  net/eth.c: In function 'eth_parse_ipv6_hdr':
  net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |          ~~~~~^~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~
  net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |                                 ~~~~~^~~~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~

Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1879531


Reported-by: default avatarAlexander Bulekov <alxndr@bu.edu>
Reported-by: default avatarMiroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Reviewed-by: default avatarMiroslav Rezanina <mrezanin@redhat.com>
Fixes: eb700029 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Signed-off-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
      7d6a4f12
  5. Mar 16, 2021
  7. Mar 15, 2021
  9. Mar 12, 2021
  11. Mar 10, 2021
  13. Mar 09, 2021
  15. Mar 08, 2021
  17. Mar 06, 2021
  19. Mar 04, 2021
  21. Feb 21, 2021
    • Jiaxun Yang's avatar
      tests/acceptance: Test PMON with Loongson-3A1000 CPU · c0928e6d
      Jiaxun Yang authored 
      
Test booting of PMON bootloader on loongson3-virt platform.

$ (venv) AVOCADO_ALLOW_UNTRUSTED_CODE=1 \
    avocado --show=app,console \
      run -t machine:loongson3-virt tests/acceptance
Fetching asset from tests/acceptance/machine_mips_loongson3v.py:MipsLoongson3v.test_pmon_serial_console
JOB ID     : 8e202b3727847c9104d0d3d6546ed225d35f6706
JOB LOG    : /home/flygoat/avocado/job-results/job-2021-01-12T10.02-8e202b3/job.log
 (1/1) tests/acceptance/machine_mips_loongson3v.py:MipsLoongson3v.test_pmon_serial_console:
console: PMON2000 MIPS Initializing. Standby...
console: 00000000Jump to 9fc
console: Init Memory done.
console: The uncache data is:
console: 00000000:  5555555555555555
console: 00000008:  aaaaaaaaaaaaaaaa
console: 00000010:  3333333333333333
console: 00000018:  cccccccccccccccc
console: 00000020:  7777777777777777
console: 00000028:  8888888888888888
console: 00000030:  1111111111111111
console: 00000038:  eeeeeeeeeeeeeeee
console: The cached  data is:
console: 00000000:  5555555555555555
console: 00000008:  aaaaaaaaaaaaaaaa
console: 00000010:  3333333333333333
console: 00000018:  cccccccccccccccc
console: 00000020:  7777777777777777
console: 00000028:  8888888888888888
console: 00000030:  1111111111111111
console: 00000038:  eeeeeeeeeeeeeeee
console: Copy PMON to execute location...
console: start = 0x8f900000
console: s0 = 0x30300000
console: _edata = 0x8f989010
console: _end = 0x8f98a028copy text section done.
console: Copy PMON to execute location done.
console: sp=8f8fc000
console: Uncompressing Bios............................................................................OK,Booting Bios
console: FREQ
console: DONE
console: DEVI
console: ENVI
console: MAPV
console: NVRAM@8f7ff898
console: STDV
console: 80100000:  memory between 8f7ff400-8f800000  is already been allocated,heap is already above this point
console: SBDD
console: P12PCIH
console: PCIH
console: PCID
console: setting up 1 bus
console: PCI bus 0 slot 1: probe...completed
console: PCI bus 0 slot 1/0: vendor/product: 0x106b/0x003f (serialbus, USB, interface: 0x10, revision: 0x00)
console: PCI bus 0 slot 1/0: reg 0x10 = 0xffffff00
console: PCI bus 0 slot 2: probe...completed
console: PCI bus 0 slot 2/0: vendor/product: 0x1af4/0x1000 (network, ethernet, interface: 0x00, revision: 0x00)
console: PCI bus 0 slot 2/0: reg 0x10 = 0xffffffe1
console: PCI bus 0 slot 2/0: reg 0x14 = 0xfffff000
console: PCI bus 0 slot 2/0: reg 0x20 = 0xffffc00c
console: PCI bus 0 slot 2/0: reg 0x30 = 0xfffc0000
console: PCI bus 0 slot 3: probe...completed
console: PCI bus 0 slot 4: probe...completed
console: PCI bus 0 slot 5: probe...completed
console: PCI bus 0 slot 6: probe...completed
console: PCI bus 0 slot 7: probe...completed
console: PCI bus 0 slot 8: probe...completed
console: PCI bus 0 slot 9: probe...completed
console: PCI bus 0 slot 10: probe...completed
console: PCI bus 0 slot 11: probe...completed
console: PCI bus 0 slot 12: probe...completed
console: PCI bus 0 slot 13: probe...completed
console: PCI bus 0 slot 14: probe...completed
console: PCI bus 0 slot 15: probe...completed
console: PCI bus 0 slot 16: probe...completed
console: PCI bus 0 slot 17: probe...completed
console: PCI bus 0 slot 18: probe...completed
console: PCI bus 0 slot 19: probe...completed
console: PCI bus 0 slot 20: probe...completed
console: PCI bus 0 slot 21: probe...completed
console: PCI bus 0 slot 22: probe...completed
console: PCI bus 0 slot 23: probe...completed
console: PCI bus 0 slot 24: probe...completed
console: PCI bus 0 slot 25: probe...completed
console: PCI bus 0 slot 26: probe...completed
console: PCI bus 0 slot 27: probe...completed
console: PCI bus 0 slot 28: probe...completed
console: PCI bus 0 slot 29: probe...completed
console: PCI bus 0 slot 30: probe...completed
console: PCI bus 0 slot 31: probe...completed
console: PCIS
console: PCIR
console: PCIW
console: PCI bus 0 slot 2/0: mem @0x40000000, reg 0x30 262144 bytes
console: PCI bus 0 slot 2/0: mem @0x40040000, reg 0x20 16384 bytes
console: PCI bus 0 slot 2/0: mem @0x40044000, reg 0x14 4096 bytes
console: PCI bus 0 slot 1/0: mem @0x40045000, reg 0x10 256 bytes
console: PCI bus 0 slot 2/0: exp @0x40000000, 262144 bytes
console: PCI bus 0 slot 2/0: i/o @0x00004000, reg 0x10 32 bytes
console: NETI
console: RTCL
console: PCID
console: VGAI
console: memorysize=c000000,base=8f6ff508,sysMem=8f6ef500
console: in setup_int_vect!done!VESA
console: vga bios init failed, rc=-1
console: in configure
console: mainbus0 (root)
console: localbus0 at mainbus0
console: loopdev0 at mainbus0pcibr0 at mainbus0
console: pci0 at pcibr0 bus 0
console: ohci0 at pci0 dev 1 function 0 vendor/product: 0x106b/0x003f (serialbus, USB, interface: 0x10, revision: 0x00)usb base addr : 0xc0045000, bus_base is : 0xc0000000
console: OHCI revision: 0x00000010
console: RH: a: 0x00000203 b: 0x00000000
console: early period(0x0)
console: OHCI 8c01ec00 initialized ok
console: New Device 0
console: usb_get_descriptor
console: bLength = 12
console: bDescriptorType =1
console: bcdUSB =  110
console: bDeviceClass =9
console: bDeviceSubClass =0
console: bDeviceProtocol =0
console: bMaxPacketSize0 =8
console: set address 1
console: usb_get_descriptor
console: bLength = 12
console: bDescriptorType =1
console: bcdUSB =  110
console: bDeviceClass =9
console: bDeviceSubClass =0
console: bDeviceProtocol =0
console: bMaxPacketSize0 =8
console: idVendor =0
console: idProduct =0
console: bcdDevice =0
console: iManufacturer=0
console: iProduct =1
console: iSerialNumber=0
console: bNumConfigurations=1
console: usb_get_descriptor
console: usb_get_descriptor
console: get_conf_no 0 Result 25, wLength 25
console: if 0, ep 0
console: bLength=9
console: bDescriptorType=2
console: wTotalLength=19
console: bNumInterfaces=1
console: bConfigurationValue=1
console: iConfiguration=0
console: bmAttributes=40
console: MaxPower=0
console: 09 04 00 00 01 09 00 00 00 07 05 81 03 02 00 ff
console: ##EP epmaxpacketin[1] = 2
console: set configuration 1
console: new device strings: Mfr=0, Product=1, SerialNumber=0
console: USB device number 1 default language ID 0x409
console: Manufacturer
console: Product      OHCI Root Hub
console: SerialNumber
console: New Device 1
console: usb_get_descriptor
console: bLength = 12
console: bDescriptorType =1
console: bcdUSB =  200
console: bDeviceClass =0
console: bDeviceSubClass =0
console: bDeviceProtocol =0
console: bMaxPacketSize0 =8
console: set address 2
console: usb_get_descriptor
console: bLength = 12
console: bDescriptorType =1
console: bcdUSB =  200
console: bDeviceClass =0
console: bDeviceSubClass =0
console: bDeviceProtocol =0
console: bMaxPacketSize0 =8
console: idVendor =627
console: idProduct =1
console: bcdDevice =0
console: iManufacturer=1
console: iProduct =4
console: iSerialNumber=b
console: bNumConfigurations=1
console: usb_get_descriptor
console: usb_get_descriptor
console: get_conf_no 0 Result 34, wLength 34
console: unknown Description Type : 21
console: 09 21 11 01 00 01 22 3F 00
console: if 0, ep 0
console: bLength=9
console: bDescriptorType=2
console: wTotalLength=22
console: bNumInterfaces=1
console: bConfigurationValue=1
console: iConfiguration=8
console: bmAttributes=a0
console: MaxPower=32
console: 09 04 00 00 01 03 01 01 00 09 21 11 01 00 01 22 3f 00 07 05 81 03 08 00 0a
console: ##EP epmaxpacketin[1] = 8
console: set configuration 1
console: new device strings: Mfr=1, Product=4, SerialNumber=11
console: USB device number 2 default language ID 0x409
console: Manufacturer QEMU
console: Product      QEMU USB Keyboard
console: SerialNumber 68284-0000:00:01.0-1
console: drive at ohci0 devnum 2, Product QEMU USB Keyboard
console: not configured
console: New Device 2
console: usb_get_descriptor
console: bLength = 12
console: bDescriptorType =1
console: bcdUSB =  200
console: bDeviceClass =0
console: bDeviceSubClass =0
console: bDeviceProtocol =0
console: bMaxPacketSize0 =8
console: set address 3
console: usb_get_descriptor
console: bLength = 12
console: bDescriptorType =1
console: bcdUSB =  200
console: bDeviceClass =0
console: bDeviceSubClass =0
console: bDeviceProtocol =0
console: bMaxPacketSize0 =8
console: idVendor =627
console: idProduct =1
console: bcdDevice =0
console: iManufacturer=1
console: iProduct =3
console: iSerialNumber=a
console: bNumConfigurations=1
console: usb_get_descriptor
console: usb_get_descriptor
console: get_conf_no 0 Result 34, wLength 34
console: unknown Description Type : 21
console: 09 21 01 00 00 01 22 4A 00
console: if 0, ep 0
console: bLength=9
console: bDescriptorType=2
console: wTotalLength=22
console: bNumInterfaces=1
console: bConfigurationValue=1
console: iConfiguration=7
console: bmAttributes=a0
console: MaxPower=32
console: 09 04 00 00 01 03 00 00 00 09 21 01 00 00 01 22 4a 00 07 05 81 03 08 00 0a
console: ##EP epmaxpacketin[1] = 8
console: set configuration 1
console: new device strings: Mfr=1, Product=3, SerialNumber=10
console: USB device number 3 default language ID 0x409
console: Manufacturer QEMU
console: Product      QEMU USB Tablet
console: SerialNumber 28754-0000:00:01.0-2
console: drive at ohci0 devnum 3, Product QEMU USB Tablet
console: not configured
console: drive at ohci0 devnum 1, Product OHCI Root Hub
console: not configured
console: vendor/product: 0x1af4/0x1000 (network, ethernet, interface: 0x00, revision: 0x00) at pci0 dev 2 function 0 not configured
console: out configure
console: Press <Del> to set BIOS,waiting for 3 seconds here.....
console: devconfig done.
console: ifinit done.
console: domaininit done.
console: init_proc....
console: HSTI
console: SYMI
console: SBDE
console: [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[
console: [[  [[[[[[[[[       [[[[[       [[[[   [[[[[  [[[[[      [[[[[       [[[[[       [[[[   [[[[[  [[
console: [[  [[[[[[[[   [[[[  [[[   [[[[  [[[    [[[[  [[[[  [[[[  [[[   [[[[  [[[   [[[[  [[[    [[[[  [[
console: [[  [[[[[[[[  [[[[[[ [[[  [[[[[[ [[[  [  [[[  [[[  [[[[[[[[[[[[   [[[[[[[  [[[[[[ [[[  [  [[[  [[
console: [[  [[[[[[[[  [[[[[[ [[[  [[[[[[ [[[  [[  [[  [[[  [[[    [[[[[[[    [[[[  [[[[[[ [[[  [[  [[  [[
console: [[  [[[[[[[[  [[[[[[ [[[  [[[[[[ [[[  [[[  [  [[[  [[[[[  [[[[[[[[[[  [[[  [[[[[[ [[[  [[[  [  [[
console: [[  [[[[[[[[   [[[[  [[[   [[[[  [[[  [[[[    [[[   [[[[  [[[   [[[  [[[[   [[[[  [[[  [[[[    [[
console: [[       [[[[       [[[[[       [[[[  [[[[[   [[[[       [[[[[      [[[[[[       [[[[  [[[[[   [[
console: [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[2011 Loongson][[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[
console: Configuration [Bonito,EL,NET,SCSI,IDE]
console: Version: PMON2000 3.3 (Bonito) #0: Tue Dec 22 01:58:09 UTC 2020 commit b3ece66234adbf7d4e453f0ba4f326c099ac2a76 Author: Jiaxun Yang <jiaxun.yang@flygoat.com> Date:   Tue Dec 22 09:51:10 2020 +0800 .
console: Supported loaders [txt, srec, elf, bin]
console: Supported filesystems [net, fat, fs, disk, iso9660, socket, tty, ram]
console: This software may be redistributed under the BSD copyright.
console: Copyright 2000-2002, Opsycon AB, Sweden.
console: Copyright 2005, ICT CAS.
console: CPU GODSON3 BogoMIPS: 1327
PASS (3.89 s)
RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
JOB TIME   : 4.38 s

Signed-off-by: default avatarJiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210112020708.62922-1-jiaxun.yang@flygoat.com>
[PMD: Set timeout to 60sec, simply test for ''CPU GODSON3 BogoMIPS']
Signed-off-by: default avatarPhilippe Mathieu-Daudé <f4bug@amsat.org>
      c0928e6d
  23. Feb 20, 2021
  25. Feb 18, 2021