Re: [coreboot] qemu-armv7: code execution out of RAM or ROM using latest QEMU

[Piotr Król]

On Mon, Aug 11, 2014 at 07:36:42AM -0700, ron minnich wrote:
> So, if you comment that one line out, do things work for you? Just
> double checking.

Comment is not enough to make it work. VE_NORFLASHALIAS has to be -1, then it
works for me. So patch for QEMU is:

diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index a88732c..67f266a 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -84,7 +84,7 @@ enum {
 };

static hwaddr motherboard_legacy_map[] = {
-    [VE_NORFLASHALIAS] = 0,
+    [VE_NORFLASHALIAS] = -1,
     /* CS7: 0x10000000 .. 0x10020000 */
     [VE_SYSREGS] = 0x10000000,
     [VE_SP810] = 0x10001000,

Unfortunately this won't fix '-bios' option only '-kernel'. So it looks like
the difference is that with VE_NORFLASHALIAS=0 we have vexpress.flash0 as alias
to 0x0-0x3ffffff, but without it this range is mapped to vexpress.highmem.
'-kernel' parameter put coreboot.rom into highmem. Does anyone know what is the
correct memory map for qemu-armv7 and where coreboot.rom should be placed ?

I will try to debug '-bios' option as Peter points that address in lowmem looks
better for him. I will see if this option worked in the past.

Thanks,
Piotr
> ron
>
> On Mon, Aug 11, 2014 at 2:09 AM, Piotr Król  wrote:
> > On Mon, Aug 11, 2014 at 12:15:32AM +0200, Peter Stuge wrote:
> > > > There is no coreboot gdb support
> > >
> > > There is some gdb support in coreboot, but maybe not for ARM?
> >
> > What I tried to say is that it happens to early to connect to coreboot
> > using gdb support, but maybe I'm wrong.
> > > > so I used qemu '-s -S'. Whole qemu command:
> > > >
> > > > qemu-system-arm -M vexpress-a9 -m 1024M -nographic -kernel build/coreboot.rom
> > >
> > > Is -kernel really correct for coreboot.rom ?
> >
> > This is option from commit message when qemu-armv7 was introduced
> > (7635a60). I also tried '-bios' but it gives same result but with
> > different address (not 0x6001024f but 0x0000024f).
> >
> > What I see now is that I made mistake during bisect and it was not the
> > correct commit that I point to. The correct change causing problem is
> > exactly one before:
> >
> > http://git.qemu.org/?p=qemu.git;a=commit;h=6ec1588e09770ac7e9c60194faff61011...
> >
> > Sorry for confusion - first time bisect user. This commit is directly
> > related to vexpress-a9 board.
> >
> > Piotr

qemu-armv7: code execution out of RAM or ROM using latest QEMU

[ron minnich]

I can't recall for ARM, it's been more than a year since I used qemu
on that platform. That said, ... on the platforms we use ROM is in low
memory. What's your coreboot system.map say?

ron

On Mon, Aug 11, 2014 at 1:11 PM, Piotr Król  wrote:
> On Mon, Aug 11, 2014 at 07:36:42AM -0700, ron minnich wrote:
> > So, if you comment that one line out, do things work for you? Just
> > double checking.
>
> Comment is not enough to make it work. VE_NORFLASHALIAS has to be -1, then it
> works for me. So patch for QEMU is:
>
> diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
> index a88732c..67f266a 100644
> --- a/hw/arm/vexpress.c
> +++ b/hw/arm/vexpress.c
> @@ -84,7 +84,7 @@ enum {
>  };
>
> static hwaddr motherboard_legacy_map[] = {
> [VE_NORFLASHALIAS] = 0,
> [VE_NORFLASHALIAS] = -1,
> /* CS7: 0x10000000 .. 0x10020000 */
> [VE_SYSREGS] = 0x10000000,
> [VE_SP810] = 0x10001000,
>
> Unfortunately this won't fix '-bios' option only '-kernel'. So it looks like
> the difference is that with VE_NORFLASHALIAS=0 we have vexpress.flash0 as alias
> to 0x0-0x3ffffff, but without it this range is mapped to vexpress.highmem.
> '-kernel' parameter put coreboot.rom into highmem. Does anyone know what is the
> correct memory map for qemu-armv7 and where coreboot.rom should be placed ?
>
> I will try to debug '-bios' option as Peter points that address in lowmem looks
> better for him. I will see if this option worked in the past.
>
> Thanks,
> Piotr
> > ron
> >
> > On Mon, Aug 11, 2014 at 2:09 AM, Piotr Król  wrote:
> > > On Mon, Aug 11, 2014 at 12:15:32AM +0200, Peter Stuge wrote:
> > > > > There is no coreboot gdb support
> > > >
> > > > There is some gdb support in coreboot, but maybe not for ARM?
> > >
> > > What I tried to say is that it happens to early to connect to coreboot
> > > using gdb support, but maybe I'm wrong.
> > > > > so I used qemu '-s -S'. Whole qemu command:
> > > > >
> > > > > qemu-system-arm -M vexpress-a9 -m 1024M -nographic -kernel build/coreboot.rom
> > > >
> > > > Is -kernel really correct for coreboot.rom ?
> > >
> > > This is option from commit message when qemu-armv7 was introduced
> > > (7635a60). I also tried '-bios' but it gives same result but with
> > > different address (not 0x6001024f but 0x0000024f).
> > >
> > > What I see now is that I made mistake during bisect and it was not the
> > > correct commit that I point to. The correct change causing problem is
> > > exactly one before:
> > >
> > > http://git.qemu.org/?p=qemu.git;a=commit;h=6ec1588e09770ac7e9c60194faff61011...
> > >
> > > Sorry for confusion - first time bisect user. This commit is directly
> > > related to vexpress-a9 board.
> > >
> > > Piotr