forked from qemu/qemu
-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixed problem where QEMU symbol info is wrong when executable segments don't start at 0x0. #5
Merged
guillon
merged 1 commit into
atos-tools:stable-3.1.plugins
from
fadeopolis:stable-3.1.plugins
Mar 18, 2019
Merged
Fixed problem where QEMU symbol info is wrong when executable segments don't start at 0x0. #5
guillon
merged 1 commit into
atos-tools:stable-3.1.plugins
from
fadeopolis:stable-3.1.plugins
Mar 18, 2019
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…s don't start at 0x0. Problem: With newer versions of GCC/binutils (for example on Fedora 29) the executable segment of executables and shared libraries no longer starts at offset 0x0. When QEMU loads a file the following happens: 1. QEMU loads the binary via `load_elf_image`, which in turn maps in all segments via `target_mmap`. 2. `target_mmap` calls `load_symbols_from_fd` if a segment is mapped in as executable code (the load bias used is the start address of the segment, i.e. any original load bias + the offset at which the segment is loaded). `load_symbols_from_fd` then calls `load_symbols` with the passed load bias. 3. At the end `load_elf_image` calls `load_symbols` yet again to make sure symbols are loaded. Here the When querying for symbol information QEMU will use the symbol info with the wrong load bias! There are two problems here: 1. The load bias for symbol information loaded in step 2 is incorrect, it is actually `real_load_bias+offset`. 2. Symbol information is loaded & stored in memory at least twice for every normal executable & shared libary. (once with the correct load bias, once with the wrong one). This patch only solves problem 1. Problem 2 is not hard to solve, but requires more invasive changes to `load_symbols` from upstream.
NicolasDerumigny
pushed a commit
to NicolasDerumigny/qemu
that referenced
this pull request
Jun 1, 2022
In commit 00f05c0 we gave the TYPE_XLNX_CSU_DMA object its own class struct, but forgot to update the TypeInfo::class_size accordingly. This meant that not enough memory was allocated for the class struct, and the initialization of xcdc->read in the class init function wrote off the end of the memory. Add the missing line. Found by running 'check-qtest-aarch64' with a clang address-sanitizer build, which complains: ==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8 WRITE of size 8 at 0x61000000ab00 thread T0 #0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16 atos-tools#1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9 atos-tools#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5 atos-tools#3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7) atos-tools#4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5 atos-tools#5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5 atos-tools#6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24 atos-tools#7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35 atos-tools#8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5 atos-tools#9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5 atos-tools#10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16 atos-tools#11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d) 0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00) allocated by thread T0 here: #0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2) atos-tools#1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0) atos-tools#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5 Fixes: 00f05c0 ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method") Signed-off-by: Peter Maydell <[email protected]> Reviewed-by: Francisco Iglesias <[email protected]> Reviewed-by: Edgar E. Iglesias <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Alistair Francis <[email protected]> Message-id: [email protected]
NicolasDerumigny
pushed a commit
to NicolasDerumigny/qemu
that referenced
this pull request
Jun 1, 2022
Include the qtest reproducer provided by Alexander Bulekov in https://gitlab.com/qemu-project/qemu/-/issues/542. Without the previous commit, we get: $ make check-qtest-i386 ... Running test tests/qtest/intel-hda-test AddressSanitizer:DEADLYSIGNAL ================================================================= ==1580408==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc3d566fe0 #0 0x63d297cf in address_space_translate_internal softmmu/physmem.c:356 atos-tools#1 0x63d27260 in flatview_do_translate softmmu/physmem.c:499:15 atos-tools#2 0x63d27af5 in flatview_translate softmmu/physmem.c:565:15 atos-tools#3 0x63d4ce84 in flatview_write softmmu/physmem.c:2850:10 atos-tools#4 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18 atos-tools#5 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16 atos-tools#6 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 atos-tools#7 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12 atos-tools#8 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12 atos-tools#9 0x62ae5ec0 in stl_le_dma include/sysemu/dma.h:275:1 atos-tools#10 0x62ae5ba2 in stl_le_pci_dma include/hw/pci/pci.h:871:1 atos-tools#11 0x62ad59a6 in intel_hda_response hw/audio/intel-hda.c:372:12 atos-tools#12 0x62ad2afb in hda_codec_response hw/audio/intel-hda.c:107:5 atos-tools#13 0x62aec4e1 in hda_audio_command hw/audio/hda-codec.c:655:5 atos-tools#14 0x62ae05d9 in intel_hda_send_command hw/audio/intel-hda.c:307:5 atos-tools#15 0x62adff54 in intel_hda_corb_run hw/audio/intel-hda.c:342:9 atos-tools#16 0x62adc13b in intel_hda_set_corb_wp hw/audio/intel-hda.c:548:5 atos-tools#17 0x62ae5942 in intel_hda_reg_write hw/audio/intel-hda.c:977:9 atos-tools#18 0x62ada10a in intel_hda_mmio_write hw/audio/intel-hda.c:1054:5 atos-tools#19 0x63d8f383 in memory_region_write_accessor softmmu/memory.c:492:5 atos-tools#20 0x63d8ecc1 in access_with_adjusted_size softmmu/memory.c:554:18 atos-tools#21 0x63d8d5d6 in memory_region_dispatch_write softmmu/memory.c:1504:16 atos-tools#22 0x63d5e85e in flatview_write_continue softmmu/physmem.c:2812:23 qemu#23 0x63d4d05b in flatview_write softmmu/physmem.c:2854:12 qemu#24 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18 qemu#25 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16 qemu#26 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 qemu#27 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12 qemu#28 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12 qemu#29 0x62ae5ec0 in stl_le_dma include/sysemu/dma.h:275:1 qemu#30 0x62ae5ba2 in stl_le_pci_dma include/hw/pci/pci.h:871:1 qemu#31 0x62ad59a6 in intel_hda_response hw/audio/intel-hda.c:372:12 qemu#32 0x62ad2afb in hda_codec_response hw/audio/intel-hda.c:107:5 qemu#33 0x62aec4e1 in hda_audio_command hw/audio/hda-codec.c:655:5 qemu#34 0x62ae05d9 in intel_hda_send_command hw/audio/intel-hda.c:307:5 qemu#35 0x62adff54 in intel_hda_corb_run hw/audio/intel-hda.c:342:9 qemu#36 0x62adc13b in intel_hda_set_corb_wp hw/audio/intel-hda.c:548:5 qemu#37 0x62ae5942 in intel_hda_reg_write hw/audio/intel-hda.c:977:9 qemu#38 0x62ada10a in intel_hda_mmio_write hw/audio/intel-hda.c:1054:5 qemu#39 0x63d8f383 in memory_region_write_accessor softmmu/memory.c:492:5 qemu#40 0x63d8ecc1 in access_with_adjusted_size softmmu/memory.c:554:18 qemu#41 0x63d8d5d6 in memory_region_dispatch_write softmmu/memory.c:1504:16 qemu#42 0x63d5e85e in flatview_write_continue softmmu/physmem.c:2812:23 qemu#43 0x63d4d05b in flatview_write softmmu/physmem.c:2854:12 qemu#44 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18 qemu#45 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16 qemu#46 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 qemu#47 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12 qemu#48 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12 ... SUMMARY: AddressSanitizer: stack-overflow softmmu/physmem.c:356 in address_space_translate_internal ==1580408==ABORTING Broken pipe Aborted (core dumped) Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Acked-by: Thomas Huth <[email protected]> Message-Id: <[email protected]> Signed-off-by: Thomas Huth <[email protected]>
NicolasDerumigny
pushed a commit
to NicolasDerumigny/qemu
that referenced
this pull request
Jun 1, 2022
The issue reported by OSS-Fuzz produces the following backtrace: ==447470==ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61500002a080 thread T0 #0 0x71766d47 in sdhci_read_dataport hw/sd/sdhci.c:474:18 atos-tools#1 0x7175f139 in sdhci_read hw/sd/sdhci.c:1022:19 atos-tools#2 0x721b937b in memory_region_read_accessor softmmu/memory.c:440:11 atos-tools#3 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 atos-tools#4 0x7216f47c in memory_region_dispatch_read1 softmmu/memory.c:1424:16 atos-tools#5 0x7216ebb9 in memory_region_dispatch_read softmmu/memory.c:1452:9 atos-tools#6 0x7212db5d in flatview_read_continue softmmu/physmem.c:2879:23 atos-tools#7 0x7212f958 in flatview_read softmmu/physmem.c:2921:12 atos-tools#8 0x7212f418 in address_space_read_full softmmu/physmem.c:2934:18 atos-tools#9 0x721305a9 in address_space_rw softmmu/physmem.c:2962:16 atos-tools#10 0x7175a392 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 atos-tools#11 0x7175a0ea in dma_memory_rw include/sysemu/dma.h:132:12 atos-tools#12 0x71759684 in dma_memory_read include/sysemu/dma.h:152:12 atos-tools#13 0x7175518c in sdhci_do_adma hw/sd/sdhci.c:823:27 atos-tools#14 0x7174bf69 in sdhci_data_transfer hw/sd/sdhci.c:935:13 atos-tools#15 0x7176aaa7 in sdhci_send_command hw/sd/sdhci.c:376:9 atos-tools#16 0x717629ee in sdhci_write hw/sd/sdhci.c:1212:9 atos-tools#17 0x72172513 in memory_region_write_accessor softmmu/memory.c:492:5 atos-tools#18 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 atos-tools#19 0x72170766 in memory_region_dispatch_write softmmu/memory.c:1504:16 atos-tools#20 0x721419ee in flatview_write_continue softmmu/physmem.c:2812:23 atos-tools#21 0x721301eb in flatview_write softmmu/physmem.c:2854:12 atos-tools#22 0x7212fca8 in address_space_write softmmu/physmem.c:2950:18 qemu#23 0x721d9a53 in qtest_process_command softmmu/qtest.c:727:9 A DMA descriptor is previously filled in RAM. An I/O access to the device (frames atos-tools#22 to atos-tools#16) start the DMA engine (frame atos-tools#13). The engine fetch the descriptor and execute the request, which itself accesses the SDHCI I/O registers (frame atos-tools#1 and #0), triggering a re-entrancy issue. Fix by prohibit transactions from the DMA to devices. The DMA engine is thus restricted to memories. Reported-by: OSS-Fuzz (Issue 36391) Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Thomas Huth <[email protected]> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/451 Message-Id: <[email protected]> Signed-off-by: Thomas Huth <[email protected]>
NicolasDerumigny
pushed a commit
to NicolasDerumigny/qemu
that referenced
this pull request
Jun 1, 2022
Include the qtest reproducer provided by Alexander Bulekov in https://gitlab.com/qemu-project/qemu/-/issues/451. Without the previous commit, we get: $ make check-qtest-i386 ... Running test qtest-i386/fuzz-sdcard-test ==447470==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61500002a080 at pc 0x564c71766d48 bp 0x7ffc126c62b0 sp 0x7ffc126c62a8 READ of size 1 at 0x61500002a080 thread T0 #0 0x564c71766d47 in sdhci_read_dataport hw/sd/sdhci.c:474:18 atos-tools#1 0x564c7175f139 in sdhci_read hw/sd/sdhci.c:1022:19 atos-tools#2 0x564c721b937b in memory_region_read_accessor softmmu/memory.c:440:11 atos-tools#3 0x564c72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 atos-tools#4 0x564c7216f47c in memory_region_dispatch_read1 softmmu/memory.c:1424:16 atos-tools#5 0x564c7216ebb9 in memory_region_dispatch_read softmmu/memory.c:1452:9 atos-tools#6 0x564c7212db5d in flatview_read_continue softmmu/physmem.c:2879:23 atos-tools#7 0x564c7212f958 in flatview_read softmmu/physmem.c:2921:12 atos-tools#8 0x564c7212f418 in address_space_read_full softmmu/physmem.c:2934:18 atos-tools#9 0x564c721305a9 in address_space_rw softmmu/physmem.c:2962:16 atos-tools#10 0x564c7175a392 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12 atos-tools#11 0x564c7175a0ea in dma_memory_rw include/sysemu/dma.h:132:12 atos-tools#12 0x564c71759684 in dma_memory_read include/sysemu/dma.h:152:12 atos-tools#13 0x564c7175518c in sdhci_do_adma hw/sd/sdhci.c:823:27 atos-tools#14 0x564c7174bf69 in sdhci_data_transfer hw/sd/sdhci.c:935:13 atos-tools#15 0x564c7176aaa7 in sdhci_send_command hw/sd/sdhci.c:376:9 atos-tools#16 0x564c717629ee in sdhci_write hw/sd/sdhci.c:1212:9 atos-tools#17 0x564c72172513 in memory_region_write_accessor softmmu/memory.c:492:5 atos-tools#18 0x564c72171e51 in access_with_adjusted_size softmmu/memory.c:554:18 atos-tools#19 0x564c72170766 in memory_region_dispatch_write softmmu/memory.c:1504:16 atos-tools#20 0x564c721419ee in flatview_write_continue softmmu/physmem.c:2812:23 atos-tools#21 0x564c721301eb in flatview_write softmmu/physmem.c:2854:12 atos-tools#22 0x564c7212fca8 in address_space_write softmmu/physmem.c:2950:18 qemu#23 0x564c721d9a53 in qtest_process_command softmmu/qtest.c:727:9 0x61500002a080 is located 0 bytes to the right of 512-byte region [0x615000029e80,0x61500002a080) allocated by thread T0 here: #0 0x564c708e1737 in __interceptor_calloc (qemu-system-i386+0x1e6a737) atos-tools#1 0x7ff05567b5e0 in g_malloc0 (/lib64/libglib-2.0.so.0+0x5a5e0) atos-tools#2 0x564c71774adb in sdhci_pci_realize hw/sd/sdhci-pci.c:36:5 SUMMARY: AddressSanitizer: heap-buffer-overflow hw/sd/sdhci.c:474:18 in sdhci_read_dataport Shadow bytes around the buggy address: 0x0c2a7fffd3c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a7fffd3d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a7fffd3e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a7fffd3f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a7fffd400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c2a7fffd410:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a7fffd420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffd430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffd440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffd450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffd460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Heap left redzone: fa Freed heap region: fd ==447470==ABORTING Broken pipe ERROR qtest-i386/fuzz-sdcard-test - too few tests run (expected 3, got 2) Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Acked-by: Thomas Huth <[email protected]> Message-Id: <[email protected]> [thuth: Replaced "-m 4G" with "-m 512M"] Signed-off-by: Thomas Huth <[email protected]>
NicolasDerumigny
pushed a commit
to NicolasDerumigny/qemu
that referenced
this pull request
Jun 1, 2022
Since commit 0439c5a ("block/block-backend.c: assertions for block-backend") QEMU crashes when using Cocoa on Darwin hosts. Example on macOS: $ qemu-system-i386 Assertion failed: (qemu_in_main_thread()), function blk_all_next, file block-backend.c, line 552. Abort trap: 6 Looking with lldb: Assertion failed: (qemu_in_main_thread()), function blk_all_next, file block-backend.c, line 552. Process 76914 stopped * thread atos-tools#1, queue = 'com.apple.main-thread', stop reason = hit program assert frame atos-tools#4: 0x000000010057c2d4 qemu-system-i386`blk_all_next.cold.1 at block-backend.c:552:5 [opt] 549 */ 550 BlockBackend *blk_all_next(BlockBackend *blk) 551 { --> 552 GLOBAL_STATE_CODE(); 553 return blk ? QTAILQ_NEXT(blk, link) 554 : QTAILQ_FIRST(&block_backends); 555 } Target 1: (qemu-system-i386) stopped. (lldb) bt * thread atos-tools#1, queue = 'com.apple.main-thread', stop reason = hit program assert frame #0: 0x00000001908c99b8 libsystem_kernel.dylib`__pthread_kill + 8 frame atos-tools#1: 0x00000001908fceb0 libsystem_pthread.dylib`pthread_kill + 288 frame atos-tools#2: 0x000000019083a314 libsystem_c.dylib`abort + 164 frame atos-tools#3: 0x000000019083972c libsystem_c.dylib`__assert_rtn + 300 * frame atos-tools#4: 0x000000010057c2d4 qemu-system-i386`blk_all_next.cold.1 at block-backend.c:552:5 [opt] frame atos-tools#5: 0x00000001003c00b4 qemu-system-i386`blk_all_next(blk=<unavailable>) at block-backend.c:552:5 [opt] frame atos-tools#6: 0x00000001003d8f04 qemu-system-i386`qmp_query_block(errp=0x0000000000000000) at qapi.c:591:16 [opt] frame atos-tools#7: 0x000000010003ab0c qemu-system-i386`main [inlined] addRemovableDevicesMenuItems at cocoa.m:1756:21 [opt] frame atos-tools#8: 0x000000010003ab04 qemu-system-i386`main(argc=<unavailable>, argv=<unavailable>) at cocoa.m:1980:5 [opt] frame atos-tools#9: 0x00000001012690f4 dyld`start + 520 As we are in passed release 7.0 hard freeze, disable the block backend assertion which, while being valuable during development, is not helpful to users. We'll restore this assertion immediately once 7.0 is released and work on a fix. Suggested-by: Akihiko Odaki <[email protected]> Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Reviewed-by: Akihiko Odaki <[email protected]> Reviewed-by: Peter Maydell <[email protected]> Message-Id: <[email protected]>
guillon
pushed a commit
that referenced
this pull request
Apr 5, 2023
Fix warnings such: disas/nanomips.c:3251:64: warning: format specifies type 'char *' but the argument has type 'int64' (aka 'long long') [-Wformat] return img_format("CACHE 0x%" PRIx64 ", %s(%s)", op_value, s_value, rs); ~~ ^~~~~~~ %lld To avoid crashes such (kernel from commit f375ad6): $ qemu-system-mipsel -cpu I7200 -d in_asm -kernel generic_nano32r6el_page4k ... ---------------- IN: __bzero 0x805c6084: 20c4 6950 ADDU r13, a0, a2 0x805c6088: 9089 ADDIU a0, 1 Process 70261 stopped * thread #6, stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0) frame #0: 0x00000001bfe38864 libsystem_platform.dylib`_platform_strlen + 4 libsystem_platform.dylib`: -> 0x1bfe38864 <+4>: ldr q0, [x1] 0x1bfe38868 <+8>: adr x3, #-0xc8 ; ___lldb_unnamed_symbol314 0x1bfe3886c <+12>: ldr q2, [x3], #0x10 0x1bfe38870 <+16>: and x2, x0, #0xf Target 0: (qemu-system-mipsel) stopped. (lldb) bt * thread #6, stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0) * frame #0: 0x00000001bfe38864 libsystem_platform.dylib`_platform_strlen + 4 frame #1: 0x00000001bfce76a0 libsystem_c.dylib`__vfprintf + 4544 frame #2: 0x00000001bfd158b4 libsystem_c.dylib`_vasprintf + 280 frame #3: 0x0000000101c22fb0 libglib-2.0.0.dylib`g_vasprintf + 28 frame #4: 0x0000000101bfb7d8 libglib-2.0.0.dylib`g_strdup_vprintf + 32 frame #5: 0x000000010000fb70 qemu-system-mipsel`img_format(format=<unavailable>) at nanomips.c:103:14 [opt] frame #6: 0x0000000100018868 qemu-system-mipsel`SB_S9_(instruction=<unavailable>, info=<unavailable>) at nanomips.c:12616:12 [opt] frame #7: 0x000000010000f90c qemu-system-mipsel`print_insn_nanomips at nanomips.c:589:28 [opt] Fixes: 4066c15 ("disas/nanomips: Remove IMMEDIATE functions") Reported-by: Stefan Weil <[email protected]> Reviewed-by: Stefan Weil <[email protected]> Signed-off-by: Philippe Mathieu-Daudé <[email protected]> Message-Id: <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem:
With newer versions of GCC/binutils (for example on Fedora 29) the executable segment of executables and shared libraries no longer starts at offset 0x0.
When QEMU loads a file the following happens:
1. QEMU loads the binary via
load_elf_image
, which in turn maps in all segments viatarget_mmap
.2.
target_mmap
callsload_symbols_from_fd
if a segment is mapped in as executable code (the load bias used is the start address of the segment, i.e. any original load bias + the offset at which the segment is loaded).load_symbols_from_fd
then callsload_symbols
with the passed load bias.3. At the end
load_elf_image
callsload_symbols
yet again to make sure symbols are loaded. Here theThere are two problems here:
1. The load bias for symbol information loaded in step 2 is incorrect, it is actually
real_load_bias+offset
.2. Symbol information is loaded & stored in memory at least twice for every normal executable & shared libary. (once with the correct load bias, once with the wrong one).
This patch only solves problem 1.
Problem 2 is not hard to solve, but requires more invasive changes to
load_symbols
from upstream.