blob: 405951b7225902cf6a244ff1519f44ff42c1d65a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
id = 2332
title = "Riscv semihosting arguments parsing issue"
state = "opened"
created_at = "2024-05-07T21:55:05.097Z"
closed_at = "n/a"
labels = ["Semihosting", "TestCase", "target: riscv"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2332"
host-os = "Linux Debian 12"
host-arch = "x86_64"
qemu-version = "8.2.3"
guest-os = "Bare metal"
guest-arch = "riscv64 or riscv32"
description = """When executing a bare metal kernel in semihosting mode with "argv" arguments provided through "-append" or "-semihostgin-config", recovering the arguments will read out-of-bound memory in the guest and often make the emulation crash through a hard fault."""
reproduce = """1. Compile the simplest "kernel" in semihosting mode, e.g. test.c containing:
`#include <stdio.h>`
`#include <stdlib.h>`
`int main(int argc, char *argv[])`
`{ unsigned int i; printf("[+] Test OK!\\n"); for(i = 0; i < argc; i++){ printf("Arg %d is '%s'\\n", i, argv[i]); } return 0; }`
2. One can compile the previous example under Debian with
`riscv64-unknown-elf-gcc -static -fPIC -march=rv64imac -mabi=lp64 -specs=picolibc.specs --crt0=semihost --oslib=semihost -Triscv_layout.ld test.c -o test`
This supposes the bare metal cross-toolchain `binutils-riscv64-unknown-elf` to be installed, as well as the standard library picolibc `picolibc-riscv64-unknown-elf` that supports semihosting.
The `riscv_layout`.ld file contains:
`__flash = 0x80000000; __flash_size = 0x00080000; __ram = 0x80080000; __ram_size = 0x40000; __stack_size = 1k; INCLUDE picolibc.ld`
3. Execute the command line:
- `qemu-system-riscv64 -semihosting-config enable=on -monitor none -serial none -nographic -machine sifive_u,accel=tcg -no-reboot -bios none -kernel /tmp/test -append "10 20"`
4. Observe the following as an example of the bug:
`[+] Test OK! Arg rg A is '/tmp/test0' Arg Arg 2 is 'RISCV fault x0 -2146959259z' ero 0x0000000000000000 x1 ra 0x0000000080000e94 x2 sp 0x00000000800bfea0 x3 gp 0x0000000080080820 x4 tp 0x0000000080080028 x5 t0 0x00000000800019a2 x6 t1 0x000000000000002a x7`"""
additional = """The same bug seems to affect risv32 and riscv64 system emulators. The semihosting part seems to work well when there is no access to the "argv" arguments."""
|