Re: [coreboot] qemu-armv7: code execution out of RAM or ROM using latest QEMU

[Piotr Król]

On Sun, Aug 10, 2014 at 02:35:46PM -0700, ron minnich wrote:
> You can't assume much of anything. That commit seems not that harmful.
> What would help is if you tell us more about when the problem happens.
> There's just not enough info in your note, but I'd love to try to
> help.

I will try to do my best.

Problem occurs at very early phase. There is no coreboot gdb support so
I used qemu '-s -S'. Whole qemu command:

qemu-system-arm -M vexpress-a9 -m 1024M -nographic -kernel build/coreboot.rom -s -S

Exactly at address 0x6001024f qemu tries to execute:

0x60010249:  adds    r3, #1
   0x6001024b:  cmp     r3, #7
   0x6001024d:  bne.n   0x6001019c
=> 0x6001024f:  ldmia.w sp!, {r2, r3, r4, r5, r6, r7, r9, r10, r11, pc}
   0x60010253:  movs    r3, #0
   0x60010255:  mcr     15, 0, r3, cr8, cr7, {0}
   0x60010259:  mcr     15, 0, r3, cr8, cr6, {0}
   0x6001025d:  mcr     15, 0, r3, cr8, cr5, {0}

I can't find this instruction in coreboot code.

Registers before executing ldmia:
  R0:  0x00000002  R1: 0x00000000  R2:  0xFFFFFFFE  R3:  0x00000007
  R4:  0x00000000  R5: 0x00000000  R6:  0x09000003  R7:  0x00000004
  R8:  0x00000000  R9: 0x00000000  R10: 0x00000000  R11: 0x00000000
  R12: 0x00000000  SP: 0x0007FEA8  LR:  0x6001032F  PC:  0x6001024E

And after:
  R0:  0x00000002  R1: 0x00000000  R2:  0x00000000  R3:  0x00000000
  R4:  0x00000000  R5: 0x00000000  R6:  0x00000000  R7:  0x00000000
  R8:  0x00000000  R9: 0x00000000  R10: 0x00000000  R11: 0x00000000
  R12: 0x00000000  SP: 0x0007FED0  LR:  0x6001032F  PC:  0x00000000

PC goes to 0 and we jumping to code where is 'andeq   r0, r0, r0'. Qemu execute
the same instruction till PC reach 0x4000000, then ends execution with:
> > qemu: fatal: Trying to execute code outside RAM or ROM at 0x04000000

Hope this is enough information.

Thanks,
Piotr

qemu-armv7: code execution out of RAM or ROM using latest QEMU

[Peter Stuge]

Piotr Król wrote:
> Problem occurs at very early phase.

Hm.
> There is no coreboot gdb support

There is some gdb support in coreboot, but maybe not for ARM?
> so I used qemu '-s -S'. Whole qemu command:
>
> qemu-system-arm -M vexpress-a9 -m 1024M -nographic -kernel build/coreboot.rom

Is -kernel really correct for coreboot.rom ?

//Peter

qemu-armv7: code execution out of RAM or ROM using latest QEMU

[Piotr Król]

On Mon, Aug 11, 2014 at 12:15:32AM +0200, Peter Stuge wrote:
> > There is no coreboot gdb support
>
> There is some gdb support in coreboot, but maybe not for ARM?

What I tried to say is that it happens to early to connect to coreboot
using gdb support, but maybe I'm wrong.
> > so I used qemu '-s -S'. Whole qemu command:
> >
> > qemu-system-arm -M vexpress-a9 -m 1024M -nographic -kernel build/coreboot.rom
>
> Is -kernel really correct for coreboot.rom ?

This is option from commit message when qemu-armv7 was introduced
(7635a60). I also tried '-bios' but it gives same result but with
different address (not 0x6001024f but 0x0000024f).

What I see now is that I made mistake during bisect and it was not the
correct commit that I point to. The correct change causing problem is
exactly one before:

http://git.qemu.org/?p=qemu.git;a=commit;h=6ec1588e09770ac7e9c60194faff61011...

Sorry for confusion - first time bisect user. This commit is directly
related to vexpress-a9 board.

Piotr

qemu-armv7: code execution out of RAM or ROM using latest QEMU

[ron minnich]

So, if you comment that one line out, do things work for you? Just
double checking.

ron

On Mon, Aug 11, 2014 at 2:09 AM, Piotr Król  wrote:
> On Mon, Aug 11, 2014 at 12:15:32AM +0200, Peter Stuge wrote:
> > > There is no coreboot gdb support
> >
> > There is some gdb support in coreboot, but maybe not for ARM?
>
> What I tried to say is that it happens to early to connect to coreboot
> using gdb support, but maybe I'm wrong.
> > > so I used qemu '-s -S'. Whole qemu command:
> > >
> > > qemu-system-arm -M vexpress-a9 -m 1024M -nographic -kernel build/coreboot.rom
> >
> > Is -kernel really correct for coreboot.rom ?
>
> This is option from commit message when qemu-armv7 was introduced
> (7635a60). I also tried '-bios' but it gives same result but with
> different address (not 0x6001024f but 0x0000024f).
>
> What I see now is that I made mistake during bisect and it was not the
> correct commit that I point to. The correct change causing problem is
> exactly one before:
>
> http://git.qemu.org/?p=qemu.git;a=commit;h=6ec1588e09770ac7e9c60194faff61011...
>
> Sorry for confusion - first time bisect user. This commit is directly
> related to vexpress-a9 board.
>
> Piotr