text:
ARP: Replies are sent to multicast MAC address rather than senders MAC address.

ARP replies are being sent to IPv4mcast MAC addresses rather than the expected source MAC address. I have attached 2 pcap files:

arp-reply-mcast.pcapng
arp-reply-mcast-fixed.pcapng

The first shows the issue:
Ping 172.16.225.92 from 172.16.225.94
1	2021-09-30 11:04:31.281	TexasIns_1a:9b:18	ARP	Broadcast			Who has 172.16.225.92? Tell 172.16.225.94
2	2021-09-30 11:04:31.281	STMicroe_00:87:35	ARP	IPv4mcast_5c:b8:80			172.16.225.92 is at 00:80:e1:00:87:35
Note the Destination is  IPv4mcast_5c:b8:80 I believe it should be TexasIns_1a:9b:18 as seen in the 2nd pcap file.
Ping 172.16.225.92 from 172.16.225.91
5	2021-09-30 11:24:31.816	MitacInt_9a:2e:8b	ARP	Broadcast			Who has 172.16.225.92? Tell 172.16.225.91
6	2021-09-30 11:24:31.816	STMicroe_00:87:35	ARP	MitacInt_9a:2e:8b			172.16.225.92 is at 00:80:e1:00:87:35
To Reproduce
Steps to reproduce the behaviour:

Using Zephyr 2.6
Using Socket Echo Server as example
west build -b nucleo_f429zi ../zephyr/samples/net/sockets/echo_server
Use wireshark to capture packets.
Ping the target from host to trigger an ARP request.

Expected behavior
APR Replies are sent to the senders MAC address, not the mcast address.
Impact
ARP only works when NIC is in promiscuous mode.
Logs and console output
See attached
Possible Fix:
diff --git a/subsys/net/l2/ethernet/ethernet.c b/subsys/net/l2/ethernet/ethernet.c
index 7089d406c9..ca2647e471 100644
--- a/subsys/net/l2/ethernet/ethernet.c
+++ b/subsys/net/l2/ethernet/ethernet.c
@@ -494,8 +494,9 @@ static struct net_buf *ethernet_fill_header(struct ethernet_context *ctx,

hdr_vlan = (struct net_eth_vlan_hdr *)(hdr_frag->data);

-               if (!ethernet_fill_in_dst_on_ipv4_mcast(pkt, &hdr_vlan->dst) &&
-                   !ethernet_fill_in_dst_on_ipv6_mcast(pkt, &hdr_vlan->dst)) {
+               if (ptype == htons(NET_ETH_PTYPE_ARP) ||
+                       (!ethernet_fill_in_dst_on_ipv4_mcast(pkt, &hdr_vlan->dst) &&
+                   !ethernet_fill_in_dst_on_ipv6_mcast(pkt, &hdr_vlan->dst))) {
memcpy(&hdr_vlan->dst, net_pkt_lladdr_dst(pkt)->addr,
sizeof(struct net_eth_addr));
}
@@ -515,8 +516,9 @@ static struct net_buf *ethernet_fill_header(struct ethernet_context *ctx,
} else {
hdr = (struct net_eth_hdr *)(hdr_frag->data);

-               if (!ethernet_fill_in_dst_on_ipv4_mcast(pkt, &hdr->dst) &&
-                   !ethernet_fill_in_dst_on_ipv6_mcast(pkt, &hdr->dst)) {
+               if (ptype == htons(NET_ETH_PTYPE_ARP) ||
+                       (!ethernet_fill_in_dst_on_ipv4_mcast(pkt, &hdr->dst) &&
+                   !ethernet_fill_in_dst_on_ipv6_mcast(pkt, &hdr->dst))) {
memcpy(&hdr->dst, net_pkt_lladdr_dst(pkt)->addr,
sizeof(struct net_eth_addr));
}

Add pcap files.
pcap-files.tar.gz

Please send a PR with your proposal, it is difficult to review code from issue.

Is it valid to look in an IP header for APR packets? It could be that NET_IPV4_HDR(pkt) is not valid/initialised.

Looking at this ARP Frame from wireshark:
2	2021-09-30 11:04:31.281	STMicroe_00:87:35	ARP	IPv4mcast_5c:b8:80	172.16.225.92 is at 00:80:e1:00:87:35
0000   01 00 5e 5c b8 80 00 80 e1 00 87 35 08 06 00 01
0010   08 00 06 04 00 02 00 80 e1 00 87 35 ac 10 e1 5c
                                           ^------- ARP sender IP addr
                                                 ^------- IP4 frame dest add.
0020   b8 80 4f 1a 9b 18 ac 10 e1 5e 00 00 00 00 00 00
0030   00 00 00 00 00 00 00 00 00 00 00 00

The ARP sender address is ac 10 e1 5c (172.16.225.92). If interpreted as an IPV4 frame
the destination address would be e1 5c b8 80 (225.92.184.128) which is why the address
is interpreted as multi cast IPv4mcast_5c:b8:80

authors: jukkar rmelch

repo: zephyrproject-rtos/zephyr


text:
ci: Track build time for Hello World multi-platform

Is your enhancement proposal related to a problem? Please describe.
The newly introduced Hello World Multiplatform build is a great way to track that we have a working out-of-the-box experience for everyone, in particular people checking out Zephyr for the first time.
It would be nice to go one step further and capture the evolution of the "time to Hello world" over time.
Describe the solution you'd like
Capture time to build hello world on each platform. Would be nice to not only track the full "zero to hello world" time, but also "time to install sdk", "time to perform the first west update", etc. so that we can pinpoint potential regressions better (ex. a HAL growing substantially, etc.)
The captured metrics (csv? json? whatever...) should be pushed to our dashboarding infrastructure so that everyone can easily visualize trends and flag any regression.
Describe alternatives you've considered
None
Additional context
If we think this is a good idea, it might be a challenge to make sure captured times remain meaningful over a long period of time, i.e. should the specs of the runners used change, this will of course impact build time.
Also good to note that the reported time will likely be less than the one experience by a real-world user on a similar machine (i.e. with clone with fetch-depth=0), but what matters is the trend over time, not only the absolute numbers.
cc @fabiobaltieri (may I assign this to you? ;-))

I do not see how this can work in practice.
Build time is highly dependent on the host CPU performance.
Even for the same type of instance on AWS, the jobs can be scheduled onto many different types of CPUs (I've seen at least 4 so far) with varying clock frequencies and cache sizes. To make matters worse, AWS vCPUs are "threads" and not "cores," meaning the build time will significantly increase if a CI job ends up running on more than one thread on a host.
And with the upcoming zephyr-runner v2, jobs can even be scheduled onto multiple generations of x86 CPUs (Sandy Bridge, Ivy Bridge, Haswell, Broadwell, Zen 2, Zen 3) and even multiple architectures (x86 and AArch64).
I do not think it makes sense to track build time.

Thanks, @stephanosio! Completely agreed that build time can fluctuate quite a bit and pointed it out in my initial comment. I guess I was less concerned about this due to Hello World using the GH hosted runners, that I would (wrongly?)  wrongly assume to be more "stable" in terms of specs.
Looking at several months of nightly builds of an out-of-tree project of mine using Fabio's action is showing pretty steady numbers (+/- 2%) between each run, so even even if tracking only works for months at times and get an occasional shift should GH change the specs of their runners, I still think it's valuable data to surface.

To add to the above, we know building on windows is just a mistake in general because of the huge overhead that the antivirus adds and that is completely out of the users control, it's possible that the AV might be updated by microsoft in the future and made faster or slower, and it would wrongly skew numbers

build time can fluctuate quite a bit

"quite a bit" is more like by +/-100%.

using the GH hosted runners

GH hosted runners are no different from AWS. They are likely one or more types of VM instances from Azure, which can consist of multiple types or even generations of CPUs with all varying clock frequencies and cache sizes. And, the Azure vCPUs too are "threads" and not "cores."
Moreover, something like this can happen and now the build time is almost half of what it used to be with basically no change on the Zephyr side:
https://github.blog/2024-01-17-github-hosted-runners-double-the-power-for-open-source/
Unless we dedicate a specific physical "reference" machine (that can be made available for the next 10 years or something) for this purpose, I do not think tracking build time will be meaningful.

Yeah same feeling from me, this is very unpractical, too many things out of control. That said, if you feel like writing something to ingest the data from the action and store it long term just go ahead and do it, worst case we look at it two years down the road and say "yep, this is useless". I just would not put too much time on it.

we know building on windows is just a mistake in general

I want that on a t-shirt.

source: gharchive/issue

authors: fabiobaltieri kartben nordicjm stephanosio

license_type: permissive

license_source: github-api


text:
drivers: eth: gmac: fix screening registers limit check

The j iterator is used for priorities, and the i iterator is used for
choosing the actual screening register. Therefore the screening register
availability needs to be checked with i.
Signed-off-by: Tomasz Gorochowik tgorochowik@antmicro.com

cc: @dgloeck
@tgorochowik, I wouldn't call this Trivial, it should be reviewed by someone who actually knows how this driver works ;-)

@pfalcon The i iterator is used a few lines below and it is used as an index to an array - this check is just making sure it is not too large for that array - that's why I labeled it so - but I guess you may be right that it is not that trivial, so I removed the label, thanks! :wink:

Codecov Report

Merging #13988 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master   #13988   +/-   ##
=======================================
  Coverage   52.23%   52.23%
=======================================
  Files         307      307
  Lines       45447    45447
  Branches    10514    10514
=======================================
  Hits        23741    23741
  Misses      16912    16912
  Partials     4794     4794

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5f2099f...81c06d2. Read the comment docs.

source: gharchive/pull-request

authors: codecov-io pfalcon tgorochowik


text:
Add support for RISC-V memory protection

RISC-V architecture have an hardware feature named
PMP (Physical Memory Protection). Integrate PMP in Zephyr
allow to support userspace (with shared memory) and
stack guard features.
Samples have been added to help userspace integration for RISC-V and
other future architecture:

Hello World from userspace is used to check if the minimum needed is
implemented to run an user thread.
Syscall perfomance is used to see how many cycles/instructions are used
for a fonction executed under user and kernel thread.

Userspace and stack guard are tested on hifive1_revb board with samples and
other custom applications. But this board doesn't support the generic
userspace zephyr test due to PMP slot limitation (8 slots).
Userspace test suite pass on QEMU and FPGA board simulating E31 core
with 16 PMP slot. To launch this test on QEMU, you must patch QEMU to fix
some PMP issue and extend SRAM to 32k (on QEMU and Zephyr side):

The 2 QEMU patch can be found here 1 2.
In QEMU source code repository, modify "sifive_e.c" file to modify
SRAM (DTIM) from 0x4000 to 0x8000 (32kB).
In Zephyr source code repository, add in "qemu_riscv32_defconfig"
board file (3).

In attach the 3 QEMU patch I used.
0003-target-riscv-Fix-pmp-implementation.patch.txt
0002-riscv-pmp-granularity-hotfix.patch.txt
0001-sifive-increase-sram-to-32k.patch.txt
(3):
CONFIG_CORE_E31=y
CONFIG_PMP_SLOT=16
CONFIG_TEST_EXTRA_STACKSIZE=1024
CONFIG_SRAM_SIZE=32

Hi @amergnat, it looks like we've been working on the same thing at the same time. I implemented userspace for the HiFive1 Rev B #26755. Are there any limitations to your implementation? I'd be happy to collaborate and see how we can combine our work.

Hi @lindemer, there are no known limitation, but I invite you to review/test/question the code. Userspace implementation is a huge project, I probably missed some stuff so collaboration are welcome ;)

Hi @amergnat, I tried out your samples on the HiFive1 Rev B. hello_world_user works fine, but syscall_perf and the existing shared_mem samples don't compile due to incompatible pointer type errors. Have you experienced this issue?
As you said, this is a huge project, so it's unfortunate we didn't know about each other before we both started :) Since we've both spent several weeks on this (I assume) and there's so much overlap between both of our contributions, I think it would be easiest to close our pull request and collaborate with you on this one. Would that be okay with you if we add our organization's name (RISE Research Institutes of Sweden) to the copyright banner on the top of the files that we've both contributed to?

Hi @lindemer , about compilation fail I think "CONFIG_CORE_E31=y" is missing in your board_deconfig. You can also put individually  "CONFIG_RISCV_PMP" && "ARCH_HAS_USERSPACE". I hesitated  to push another patch in this serie which add this config for concerned boards. Please let me know if it isn't a missing config flag.
About copyright banner, I think that depend of the contribution level. Let me time to ask my organization.

Hi @lindemer , about compilation fail I think "CONFIG_CORE_E31=y" is missing in your board_deconfig. You can also put individually "CONFIG_RISCV_PMP" && "ARCH_HAS_USERSPACE". I hesitated to push another patch in this serie which add this config for concerned boards. Please let me know if it isn't a missing config flag.
About copyright banner, I think that depend of the contribution level. Let me time to ask my organization.

Absolutely. In my opinion our work has significant overlap on these files. And of course, I'd be happy to continue reviewing your code and suggesting improvements.
include/arch/riscv/syscall.h
arch/riscv/core/userspace.S
arch/riscv/core/isr.S
With regards to the samples:

In syscall_perf, will compile hen the instances of k_sleep(X) are changed to k_sleep(K_MSEC(x)), and the last argument of k_thread_create is changed from 0 to K_NO_WAIT. The output shows that the user and supervisor context switch times are the same unless CONFIG_CORE_E31 is enabled.
shared_mem will compile with CONFIG_CORE_E31, but it fails immediately due to a lack of available PMP entries. I believe this sample will work on the HiFive1 Rev B if the partitions are declared as NAPOT. I can look into it next week.

syscall_perf issue: I made a mistake on my master rebase, will fix soon. (I also catch another one today)
shared_mem: you should use napot only if shared memory size is an power of two, else you will apply a PMP restriction on some memory space you shouldn't (then tests/kernel/mem_protect/userspace will failed). If you really want to make this sample working, I suggest you to modify the shared space size or numbers.

About improvement: I think the main purpose here is to catch issues or miss-implemented code. If you want to improve something, we can still talk about it here but you also can push commit later. That allow us to keep focus on what is doing in these patches.

@amergnat Just submitted a pull request to your fork. I aligned .text .rodata and the thread stacks to NAPOT as we have in our implementation. For some reason this reduces user-mode system call latency by 70%.

@amergnat We installed your QEMU patches and were able to run tests/kernel/mem_protect/userspace. We'll look into why our additions are causing RAM to overflow this week. The performance improvement we observed in samples/userspace/syscall_perf on the HiFive Rev B doesn't appear in QEMU, which is odd.

Great.
About performance improvement, I think it's HW specific, for this one NAPOT is faster than TOR.

Hello @lindemer,
I’ve got news from senior upstreamer (@superna9999 , @npitre, ... ). All your modifications shouldn’t be in this pull request because that don't patch an issue or miss-coded stuff, everything have be done by myself and the status of the development is “finish”, an internal review has already be done few weeks ago. The only modification of this PR will be the corrections linked to the comments of the reviewers. But you still can push your “NAPOT RO area” patch directly on zephyr after this PR, and then put your copyright. This is how it works on linux upstream but maybe is different on Zephyr that why I wish to have a confirmation from @andrewboie @nashif @carlescufi or another Zephyr maintainer.
Also, I found something to do for userspace improvement (outside of this PR). I can let you implement it if you wish, that will allow us to collaborate and then put your signoff /copyright (warning: that could be a little bit tricky). I still available to collaborate/help for your future work on riscv userspace anyway. I also started to work with QEMU to improve/fix the riscv PMP, if that interest you...
My apologies for this situation, hope you understand, I wasn’t aware of WIP PR protocole. If this PR is fully functional it’s because this project started in 2019.

@amergnat No worries :) These situations happen, and we'd be happy to collaborate with you on this moving forward. We started on this as a master's thesis project in January so I know you've put in quite a lot of work. As a public research institution, we don't have a commercial interest in this; we just want to use it as a platform for research papers.
We'll close our PR now and help you get this one accepted (if you need it). I'll continue to work on those NAPOT improvements to your branch and submit it as a separate PR later on. Please let me know what you have in mind for other userspace improvements; we're interested in implementing those if we can.

hey, glad to see you all are joining forces on this.
please let me know when you've integrated the work together and would like some more review from me. I sometimes miss GH emails so ping me on Slack if needed.

@lindemer Thanks !

I will contact you by email for the next step of riscv userspace.
About QEMU patch in Zephyr SDK, I'm waiting for QEMU fixes to be upstreamed. I need to report them another bug on MPRV bit which it seems to not work (used to enable stack guard). Then that may take a while but Zephyr need a working QEMU !
qemu_riscv32 shouldn't (in my opinion) simulate core E31 only but the global arch. Upgrade memory size it's only to execute zephyr userspace test suite so qemu still a good choice to simulate E31 even if we upgrade memory size.

My last push fix some spurious #ifdef in isr.S to split properly stack guard and userspace features.
@andrewboie  The PR is ready to be review ;)

Hi there, the stack object refactoring patch landed and you'll need to rebase on it.
The best practice for stack object layouts, and the necessary ARCH_ variables you have to define, are documented here: https://docs.zephyrproject.org/latest/guides/porting/arch.html
It may take a few more hours for the docs to get rebuilt, you can always refer to doc/guides/porting/arch.rst in tree.

In the other PR it was mentioned we could get more memory domain regions available if we restricted regions to a power of two size/alignment. MPUs like this are supported in Zephyr and if you added support, this code would be more usable on real boards.

The other PR use the same number of PMP slot because it use 2 NAPOT for the RO region instead of one NA + one TOR (then 2 slots too). Anyway @lindemer prepare a patch to use NAPOT (rebased from my PR) so a future PR will propose this alternative but I don't think is it mandatory for this PR, isn't it ?

Anyway @lindemer prepares a patch to use NAPOT (rebased from my PR) so a future PR will propose this alternative but I don't think is it mandatory for this PR, isn't it ?

It depends on how much test coverage we can get with the current scheme. Of the tests with tag "userspace", how many of them can we run currently?

Anyway @lindemer prepares a patch to use NAPOT (rebased from my PR) so a future PR will propose this alternative but I don't think is it mandatory for this PR, isn't it ?

It depends on how much test coverage we can get with the current scheme. Of the tests with tag "userspace", how many of them can we run currently?

That have no impact on test coverage because that don't reduce the number of used PMP slot. That just increase speed on HW which are faster to do NAPOT instead of NA + TOR. They are a possible optimization to save 1 slot (probably soc dependant), but I think this is not a priority because that will not increase test coverage.

@pgielda @kgugala is anyone from ANT micro willing to review this patch series?

I feel we need more reviewers with knowledge of the RISC-V arch for this particular PR. @xodus7 @jaronkelleher @npitre @no1wudi any chance you could contribute a review?

Hello @lindemer,
I’ve got news from senior upstreamer (@superna9999 , @npitre, ... ). All your modifications shouldn’t be in this pull request because that don't patch an issue or miss-coded stuff, everything have be done by myself and the status of the development is “finish”, an internal review has already be done few weeks ago. The only modification of this PR will be the corrections linked to the comments of the reviewers. But you still can push your “NAPOT RO area” patch directly on zephyr after this PR, and then put your copyright. This is how it works on linux upstream but maybe is different on Zephyr that why I wish to have a confirmation from @andrewboie @nashif @carlescufi or another Zephyr maintainer.

If you need a common space to collaborate we can create a topic- branch for this purpose if you think that will help. There you would be able to send commits and Pull Requests without them explicitly going into master, which would perhaps help in this particular case.

Hello,
Rebased done.
I'm currently implementing syscall interruption. It's on the right track, I have to fix some regression.
Still some missing fix (reported by @andrewboie ):

https://github.com/zephyrproject-rtos/zephyr/pull/27063#discussion_r463777197
https://github.com/zephyrproject-rtos/zephyr/pull/27063#discussion_r463778162

All should be done for the next push. (I hope ;) )

Hello @carlescufi ,
Let's see if this PR need some other reworks. For now, topic branch isn't needed I think.

Going to do another review pass this week. There were some minor changes to memory domains that landed, you will need to set CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API for this arch if userspace is enabled. See https://github.com/zephyrproject-rtos/zephyr/pull/27786

Hello @lindemer,
I’ve got news from senior upstreamer (@superna9999 , @npitre, ... ). All your modifications shouldn’t be in this pull request because that don't patch an issue or miss-coded stuff, everything have be done by myself and the status of the development is “finish”, an internal review has already be done few weeks ago. The only modification of this PR will be the corrections linked to the comments of the reviewers. But you still can push your “NAPOT RO area” patch directly on zephyr after this PR, and then put your copyright. This is how it works on linux upstream but maybe is different on Zephyr that why I wish to have a confirmation from @andrewboie @nashif @carlescufi or another Zephyr maintainer.

If you need a common space to collaborate we can create a topic- branch for this purpose if you think that will help. There you would be able to send commits and Pull Requests without them explicitly going into master, which would perhaps help in this particular case.

@amergnat This sounds like a good idea to me. The change that @xodus7 just suggested was already in the patch I submitted to your fork a while back.

If you need a common space to collaborate we can create a topic- branch for this purpose if you think that will help. There you would be able to send commits and Pull Requests without them explicitly going into master, which would perhaps help in this particular case.

@carlescufi Sorry, I forgot to answer you.
I don't think branch is needed, this PR add RISCV Userspace, Userspace Test Suite passed for QEMU and CORE_E31, then in my opinion all mandatory feature/stuff are implemented.
All comments report minor issues that can be fixed by myself.
As explained before, improvement (which not fix malfunctions/issues) shouldn't be done in this PR because is it enough voluminous and provide the base/foundation of the RISCV Userspace.

Update:

User syscall return detection improvement
Add stack guard support when power of two alignment is enabled
Linker issue for C++
Rebase to master
Minor bugfix linked to points above

Ah, I see in the PR description some QEMU instructions, will try this

@andrewboie  I observed a strange behavior (referring to the specifications) when I ran some PMP tests on QEMU whereas it worked well on real boards like Hifive_revb or FPGA running a RISCV core-E31. To be short, deeper test prove me the QEMU didn’t support PMP well, even if I built my own QEMU with some quick-fix to get a correct PMP support for user privilege mode.
If you wish I can share success log of test. I think @xodus7 also have a RISCV board with enough PMP slot and RAM to run userspace testsuite.

If the above requirements do not agree with your timeline or collaboration model we can talk about creating a topic branch.

If the above requirements do not agree with your timeline or collaboration model we can talk about creating a topic branch.

Ok thanks, I will start to investigate and if I haven't enough time topic branch will be a great option.
If some failed can't be fixed on Zephyr side because QEMU doesn't support 100% of PMP features, what happen ?

If some failed can't be fixed on Zephyr side because QEMU doesn't support 100% of PMP features, what happen ?

We'll cross that bridge when we get there, with the discussion informed by what the specific issues in QEMU are. If they are intractable in the short-term, we'll need to identify some real HW platforms to test with instead using sanitycheck --device-testing. We should probably start doing that now anyway, can you recommend a specific off-the-shelf board to test with? I can get some ordered on my side.

Relevant to my previous message, we need a real HW platform to test with, we can't just rely on QEMU especially since the PMP support is bleeding-edge. Please add such a HW testing platform to this series. We will validate with this as well as the emulator.

Just catching up with this PR, a couple comments:

The qemu_riscv32 target is based off Freedom E310 which only supports 8 PMP regions I believe. I don't see this limitation in the QEMU code but I'm also not a QEMU expert.

This patch set fixes a few PMP issues including a better fix for the TLB issue addressed in the hotfix (I think) . The patch has been pulled into the RISC-V dev branch but not sure if it was included into 5.1.

Quick Update:
Some regression have been fixed (but not pushed yet). Still some task to do to solve the following test:

tests/kernel/mem_protect/mem_protect:
Debug/Fix: Only one test fail (test_permission_inheritance)
@andrewboie  The test isn't able to be flash on 16k RAM target, can you fix that like userspace test or I have to log an issue ?
zephyr/app_smem_unaligned_prebuilt.elf section noinit' will not fit in region RAM' /opt/zephyr-sdk-0.12.0-alpha/riscv64-zephyr-elf/bin/../lib/gcc/riscv64-zephyr-elf/10.2.0/../../../../riscv64-zephyr-elf/bin/ld: region RAM' overflowed by 8596 bytes
`

tests/kernel/mem_protect/stackprot:
Implement user mode software-triggered system fatal exceptions support (canarie)
Issue: This isn't running on hifive1_revb (investigation needed)
@andrewboie Build fail if I don't add CONFIG_KOBJECT_TEXT_AREA value. Is it normal ? Should I add this value on board defconfig and commit it wheareas other board haven't it?

tests/kernel/mem_protect/protection:
Mechanism to restrict execution is missing. 2 options, skip exec tests, implement restriction

@galak New QEMU from 0.12 alpha SDK build test done (https://github.com/zephyrproject-rtos/sdk-ng/pull/279).
I also tried a QEMU build from master (QEMU) branch and got the same result (good point).
Result: There are no QEMU limitations on sanity for now. But I need to fix test above before validate it.
Note: Seems to have a regression on Zephyr mainline code with the old & new modified QEMU for tests/crypto/tinycrypt (WARNING).

Hello @andrewboie
What is the next step for merging this PR please ? All sanity pass on hifive_revb board.
Sanity for qemu_riscv32 success localy with 0.12 alpha SDK build. Should I disable userspace feature for qemu_riscv32 until new SDK appear (to pass all sanity) ?

Hi, I'm on vacation until tomorrow but will review this week.

Hi, I'm on vacation until tomorrow but will review this week.

Ok Thanks
I've removed the board QEMU patch which add support for userspace. I will push it later when new QEMU build will be used for sanity.

@lindemer @xodus7 @cwshu any final comments? Would be good to get some approvals from your side so we can get this in-tree with more than just my +1 on it.

I think we are ready to proceed with merging this. Please prioritize efforts to get the QEMU side of this sorted out as soon as possible.

@andrewboie QEMU patch is ready to be merge on next PR as soon as new QEMU build will be online.
As discussed in #29811 I will remove the fixing patch which is include in this PR, agree?

The single-line if and while statements in core_pmp.c, test_user.c and test_supervisor.c should be bracketed according to the style guidelines. Other than that it looks good to me.

The single-line if and while statements in core_pmp.c, test_user.c and test_supervisor.c should be bracketed according to the style guidelines. Other than that it looks good to me.

Fixed.

Thanks all for your support / help. It was a HUGE work.

authors: amergnat andrewboie carlescufi lindemer xodus7


text:
Paxdma driver enable

This PR contains changes to enable PAX DMA driver,

boards: arm: bcm958402m2_m7: Enable PAXDMA driver
boards: arm: bcm958402m2_a72: Enable PAXDMA driver

WIth the iproc change merged, if you rebase this I think it should pass the CI tests.

@galak: With the iproc change merged, if you rebase this I think it should pass the CI tests.

@galak : Yes. let me rebase.

@raveenp looks like you still need to rebase on newer upstream to resolve the merge conflict.  You also still need to remove CONFIG_DMA_0_NAME.  There is now no code in three that uses this symbol.

@raveenp looks like you still need to rebase on newer upstream to resolve the merge conflict. You also still need to remove CONFIG_DMA_0_NAME. There is now no code in tree that uses this symbol.

@galak: yes.  I missed to remove CONFIG_DMA_0_NAME.   Will fix and rebase on newer upstream version. Thanks.

@raveenp looks like we need one more rebase.

@galak : I have rebased once again.  Build may still fail due to dependency on https://github.com/zephyrproject-rtos/zephyr/pull/32690.

@galak: I have fixed current build issue by adding missing changes in a72 specific dts file with adding:
dts: arm: broadcom: viper-a72: paxdma: Add interrupt property
Still the build will fail due to dependency on
https://github.com/zephyrproject-rtos/zephyr/pull/32690: soc: arm: bcm_vk: viper: Increase default NUM_IRQS

@raveenp #32690 is merged now, so should be good to rebase and fixup the last issue :)

authors: galak raveenp


text:
net: buf: keep memory alignment provided by k_heap_alloc and k_malloc

Allocation callback in net_buf_heap_cb and net_buf_var_cb
used for net_bufs with variable size payloads, defined by
NET_BUF_POOL_HEAP_DEFINE or NET_BUF_POOL_VAR_DEFINE,
allocate one more octet for internal variable ref_count,
used in function generic_data_ref(), which in turn is needed
for net_buf_clone()).
The user gets a buffer which is shifted by one octet in memory
block. This breaks alignment provided k_heap_alloc and k_malloc.

I’m not really opposed to this, curious to hear where you benefit from it considering that in almost all cases the buffer payload is some protocol data that’s not assumed to be properly aligned, ie we access it using packed structs or using the various net buf data getter functions that don’t assume any specific alignment for the payload.

I’m not really opposed to this, curious to hear where you benefit from it considering that in almost all cases the buffer payload is some protocol data that’s not assumed to be properly aligned

I use it in USB device controller API, some controllers allow to use data for transfers directly from RAM without storing it in specific area or FIFO, but data block must be aligned. IMHO it is a kind of bug because it does not keep the alignment provided by k_heap what one could assume. As I see fixed size pools can not provide aligned buffers as well. I could possibly solve it differently by definition of own callbacks and NET_BUF_POOL_UDC_DEFINE macro.

@rlubos @jhedberg @tbursztyka could you please review?

Am I right in that this messes up generic_data_ref? That one still uses 1 insead of sizeof(void*):
ref_count = data - 1;

If true, ref and unref would use different memory locations. I'm not sure how that would not be caught by unit and manual tests though since it would cause memory leaks all over the place.

@jfischer-no could you respond to the comment from @M1cha above? Is there some place in the code that you forgot to update?

Am I right in that this messes up generic_data_ref? That one still uses 1 insead of sizeof(void*):
ref_count = data - 1;

If true, ref and unref would use different memory locations. I'm not sure how that would not be caught by unit and manual tests though since it would cause issues all over the place.

It looks like I screwed up on this one, cloned net_buf data would point to a data block that has already been freed:
https://github.com/zephyrproject-rtos/zephyr/blob/fa5b706871f01bb3bba3b2d9f774d27615855e7e/subsys/net/buf.c#L96-L103
There are net_buf reference count (member ref of struct net_buf) and data reference count at the top of allocated data. This PR is about data reference count.
Probably no one caught it because it is only used for NET_BUF_POOL_VAR_DEFINE() and  NET_BUF_POOL_HEAP_DEFINE() to increase the data reference count in net_buf_clone(). NET_BUF_POOL_HEAP_DEFINE is not used in the tree.
test_net_buf_clone() would not catch it, @jhedberg any ideas other than the one-line fix below?
diff --git a/subsys/net/buf.c b/subsys/net/buf.c
index dc6f5dc8e0d..462a21198e2 100644
--- a/subsys/net/buf.c
+++ b/subsys/net/buf.c
@@ -93,7 +93,7 @@ static uint8_t *generic_data_ref(struct net_buf *buf, uint8_t *data)
 {
        uint8_t *ref_count;

-       ref_count = data - 1;
+       ref_count = data - sizeof(void *);
        (*ref_count)++;

        return data;

authors: M1cha carlescufi jfischer-no jhedberg


text:
drivers: dai: ssp: clear RSE bits on ACE

On ACE RSE bits should be cleared unconditionally if ssp is no longer in use
This will allow to successfully disable SSP in dai_ssp_pm_runtime_dis_ssp_power() and enable it correctly in the next run

@nashif @galak this one fixes a release blocker.

authors: abonislawski lgirdwood


text:
cmake: sca: codechecker: Support storing results

Introduce CODECHECKER_STORE parameters to upload results to an active CodeChecker server.
Closes #61633

Small change: Moved the name parameter to inline instead of prepending to the OPTS list.


text:
samples: Add USB Audio to broadcast audio source

Adds support for using a connected host to
broadcast audio via USB Audio.
Offload LC3 encoding to separate thread.

Moved the PR out of draft to get some initial reviews.  There are some glitches on the USB Audio side (periodic  approx 10 secs of clean flow and audio, then 2-3 secs of missing data coming from USB) which may require updates to how the USB data flow is handled.

Moving the PR to draft until I have the encoder in a separate thread and addressed the issues mentioned in comments above

ok - offloaded to a separate thread and everything flows smoothly now (cleaning up the PR).  There are a very few occasional glitches, probably because we don't have sample rate conversion to compensate for clock drifting/mismatch - but rare enough for the sample IMO.  Working on reintroducing multi stream (stereo) and the rest of the change requests.

@Thalley and @tmon-nordic - it seems to be in a stable state now with the tests I made. Would you be able to re-review and possibly accept further improvements (e.g. to USB corner case handling) to come as a follow-up?

(last push was just commit message fix)

@tmon-nordic could you check if you could approve? GH still tells me you have a change requested.  If anything, could it be a followup PR?

@tmon-nordic could you check if you could approve? GH still tells me you have a change requested. If anything, could it be a followup PR?

I just dismissed the review because the USB issue is fixed. The problem was simply preventing USBD workqueue from processing events within the deadline (SOF = 1 ms). The PR looks fine to me, but I am not really the correct person to approve it.

authors: larsgk tmon-nordic


text:
twister: Fix google test harness for variant and parameterized

I ran into several issue's when trying to use the provided gtest harness.
This PR fixes the regex for newer googletest releases
tested on google test 1.12.0 and 1.14.0
Also parameterized tests did not match properly when failed.
Additional unit tests has been provided.
Example google test can be found here (needs this PR to run properly):
https://github.com/jbr7rr/zephyr-googletest-example

@yperess could you please have a look? Thanks!


text:
No way to avoid truffle gas price check using the lib in node console

In a node console, I tried to run the following commands:
> var Web3 = require('web3')
> web3 = new Web3(new Web3.providers.HttpProvider("http://localhost:9545"))
> const { Contracts, SimpleProject } = require('zos-lib')
> const MyContract = Contracts.getFromLocal('MyContract')
> myProject = new SimpleProject('MyProject', { from: web3.eth.accounts[0] });
> myProject.createProxy(MyContract)

The last step fails saying:
Error: Cowardly refusing to execute transaction with gas price set to Truffle's default of 100 gwei. Consider explicitly setting a different value in your truffle.js file.
I changed the gas price on my truffle.js before starting truffle develop, but the error is the same.
truffle.js:
module.exports = {
  networks: {
    development: {
      host: 'localhost',
      network_id: '*',
      port: 9545,
      gas: 250000,
      gasPrice: 200000000,
    }
  }
};

Considered fixed on #354 and https://github.com/zeppelinos/zos/pull/359

authors: elopio facuspagnuolo

repo: zeppelinos/zos

license: MIT


text:
gracefulStop  bug

main函数在gracefulStop 执行完毕前退出

Use the following method to make sure it's called before exiting.
	waitForCalled := proc.AddShutdownListener(func() {
		println("shutdown")
	})
	srv.Start()
	waitForCalled()

Also, there is AddWrapUpListener for earlier stage events on getting signals.

proc.SetTimeToForceQuit(time.Second * 60)
not work

proc.SetTimeToForceQuit(time.Second * 60) not work

It's force to quit after specific duration. Not wait this time interval.

repo: zeromicro/go-zero


text:
JWT token is still take effect after the token is removed from redis( by call the method clear token)

JWT token is still take effect after the token is removed from redis( by call the method clear token from redis)
I just configure the app of api with JwtAuth conponent like document.
(1)Geting a jwt token by calling the api of login.I can see the jwt token in redis.
(2)Clearing the token by calling the api of logout.The token in redis has been cleared.
(3)Now I call an API that requires authentication, and the token is still valid.
I guess the built-in authentication middleware only uses "AccessSecret" to verify the token, but does not verify whether there is a corresponding token in redis.
Therefore, in the built-in scheme, the JWT token will only expire due to expiration, and the logout scheme needs to be implemented additionally.

JWT token is stateless. Removing from redis doesn't affect the validation.

在jwt token中增加session_id存储 把session_id再放redis里面存储就好了

JWT token is stateless. Removing from redis doesn't affect the validation.

Is there any other authentication scheme, such as oauth2?

在jwt token中增加session_id存储 把session_id再放redis里面存储就好了
可以，这个方案没啥问题，谢谢啦

没太理解，能具体说说吗

在jwt token中增加session_id存储 把session_id再放redis里面存储就好了
可以，这个方案没啥问题，谢谢啦

Bro, can you tell me more about how it worked out

authors: Oxygenese chenchat kevwan smithyj


text:
fix: BatchError.Add() non thread safe

BatchError.Add()  non thread safe,  append operation need  locked.
help to review it. thank!
@kevwan @kesonan

example:
fx.Parallel(
	func() {
		_, err := l.svcCtx.xxxRpc.SelectXxx(l.ctx, &Req{})
		if err != nil {
			batchErr.Add(err)
		}
	},
	func() {
		_, err := l.svcCtx.xxxRpc.SelectXxx(l.ctx, &Req{})
		if err != nil {
			batchErr.Add(err)
		}
	},
	func() {
		_, err := l.svcCtx.xxxRpc.SelectXxx(l.ctx, &Req{})
		if err != nil {
			batchErr.Add(err)
		}
	},
)

if batchErr.NotNil() {
	return nil, batchErr.Err()
}

batchErr.Err() error message may be incomplete during concurrency


text:
Mypy thinks Context.socket is an untyped function

Consider this minimal example:
import zmq

ctx = zmq.Context.instance()
socket = ctx.socket(zmq.PULL)

When running mypy with the  disallow_untyped_calls option, an error surfaces about this function being untyped:
$ mypy --disallow-untyped-calls example.py
example.py:4: error: Call to untyped function "socket" in typed context  [no-untyped-call]

My workaround is to annotate directly and ignore the error:
from zmq.sugar.socket import Socket
socket: Socket = ctx.socket(zmq.PULL)  # type: ignore

I've looked at https://github.com/zeromq/pyzmq/issues/1206 and it doesn't seem like context.py has either inline annotations or an associated .pyi file. Should this work out of the box?

I don't use mypy much. pyzmq definitely isn't fully covered by types (and I doubt it ever will be), but this much should definitely work!
#1631 fixes this example

authors: bbatliner minrk

repo: zeromq/pyzmq


text:
tool link

一些实用且可以复用的工具link

get tg id


text:
Added domains doesn't load or display

@dj-gaban-zestyio : transferring ticket to website repo for accounts
Describe the bug
After adding a domain, it doesn't load or display upon launching the website
To Reproduce
Steps to reproduce the behavior:

Go to any instance/s

Click on 'Add domain'

Input the "Domain" and "Branch" then submit

Click the recently added domain

See error

@bltarkany
im using the createDomain  from fetchwrapper to add domain , can you also verify it thanks

@darwin808 the createDomain  from the fetchwrapper is correct.
I reviewed the workflow that James used for the bug he reported above. Based on that information the way he formatted the url on creation was incorrect - not the createDomain function.
I tested the creation of both a live and dev vanity domain url with no issue. this looks to be resolved

repo: zesty-io/website

license: Unlicense


text:
Move cli/integrationtests/inbound_voter_test.go and cli/integrationtests/outbound_voter_test.go into keeper package

Describe the Issue
These tests are used to test the voting logic of inbound and outbound ballot as an integration test with a group of voter.
The current structure spins up a local network and use the CLI interface. Which makes debugging hard when the test no longer passes because only the CLI response is available.
Moving the test logic in the keeper package, use the test keeper implementation and use the keeper interface would simplify debugging.
We can still add CLI unit test to test the CLI interface (which is not used by ZetaClient in any case)

@kingpinXD I may think you worked on the these tests? Would you have strong opposition from moving those to keeper? Do we have any benefits of using the CLI interface?

No, I think it's a good idea to move these tests to the keeper .

Completed

authors: kingpinXD lumtis

repo: zeta-chain/node


text:
Add char8_t mode

Overview
This PR adds a new mode to pugixml which uses C++20 char8_t instead of char for the UTF-8 interface. I've dubbed it char8 mode and it can be enabled using the PUGIXML_CHAR8_MODE option/macro.
Motivation
Using pugixml in a mixed ANSI/Unicode Windows codebase is quite errorprone. char is already used for the system codepage and it can easily happen that a UTF-8-as-char string slips through without conversion. I've found char8_t it to be a huge help in migrating stuff to UTF-8.
Implementation
Not much has to be changed. Since pugixml already calls C string functions with UTF-8, we can do the same with char8_t by just casting in a few places.
Stream-based methods received an additional overload, since the char overload may be used to represent arbitrary bytes, and the char8_t overload may be used by string streams.
An additional typedef u8char_t, which represents the type pugixml uses for a UTF-8 code unit, was added for the conversion functions.
Most changes had to be done in the test code. Representing raw bytes as string literals does not work for UTF-8 literals, since hex escape codes are interpreted as a Unicode character (and replaced by multiple bytes). Affected places either received a branch with a u8 literal or use a new RAW() macro which smuggles in UTF-8 code points using chars.
Notes

As implemented, the PUGIXML_CHAR8_MODE modifies the UTF-8 interface, which means PUGIXML_WCHAR_MODE takes precedence if both are defined (no diagnostic).
I haven't updated the CI build descriptions since I don't know the compiler versions. Locally I've tested with Visual Studio 2022 17.3 and clang 15.
Maybe an overload taking char8_t file paths should be added as well?

Just a question on the last note. (The rest sound good to me, thanks)
Are you really using or planning to use char8_t for paths? Especially on Windows where UTF-16 is used? There are no overloads for fopen() or std::fstream::open() AFAIK. Would not std::filesystem::path be the better type?

Is there any chance of this PR ever progressing?

While the changes in the PR itself feel reasonable, I'd like to better understand how widely this will be used. This adds a new compilation mode; for thorough testing it would require increasing number of tested build configurations by 50%. In some sense it's fine, in some other sense it's a notable increase in complexity. It's a C++20 feature so it's not obvious how widely available it would be - I would be more comfortable with some indication from multiple people about this being very valuable in their work.
I think something like this could be merged if there's sufficient demand for a new mode. If there's any way to reduce the differences in tests that would also be nice - this doesn't matter that much for the PR itself, but when adding new tests the wchar_t mode is already a problem because people tend to forget STR macros, so if any of the new macros could be replaced somehow that would be nice. It's not a big deal if they are necessary.

A little related although that one needs a separate fix to also avoid the footgun in regular mode: https://github.com/zeux/pugixml/issues/378

Probably the main thing that would make me comfortable with merging this would be more indication that this is going to be helpful for various users.

For one, it would make pugixml future proof and help adoption of char8_t. Many complaints about char8_t are about how useless it is since nothing supports it; a classic chicken-and-egg problem. User's on Linux have long misused char and treated it as always being UTF-8 but it's not portable (and might not even work on all Linux systems).
On Windows the situation is worse since char is almost never UTF-8 and just compiling with UNICODE does not make all the legacy APIs go away. The options are:

wchar_t-mode: Increased memory usage. Many unnecessary conversions. UTF-16 is not necessarily a good internal encoding even on Windows.
UTF-8 as char: Error-prone and unportable.
Convert to char8_t: Cumbersome since every use of pugixml looks like PugiToU8(node.attribute(U8ToPugi(name)).value()).

authors: brandl-muc gix zeux

repo: zeux/pugixml

license: mit

license_source: bigquery


text:
PHP 7.2 support

Resolves #102

PHP 7.2 lowest build failing - phpspec issue?

The problem is the set of dependencies used in PHPUnit 5.7. It pins to sebastian/comparator at ^1.2.4; however, that version reports incorrect information to prophecy under PHP 7.2. I tried pinning to ^2.0, but PHPUnit 5.7 cannot use that series.
Interestingly, I only see this issue when attempting to mock the ServiceManager. More interestingly: the one test where we do so does not need to, as it can mock the PSR-11 ContainerInterface instead. In fact, when doing so, all testing issues go away.
I'll push the relevant change to your branch in a moment so that Travis can validate this observation.

Thanks, @webimpress!

authors: webimpress weierophinney

repo: zfcampus/zf-content-negotiation


text:
feat: 查询性能似乎不是很好

为了帮助我们更好的解决您的问题，请填写以下选项（不填写完整可能会被直接关闭 issue）：

是否已搜索其他 issue，没有人提过这个功能？：是
是否已尝试使用最新版本，且仍然没有此功能？：是
功能概述：1）我在演示站的搜索场景下，查询速度似乎有点慢，在数据量上升之后，当前的这个架构性能可以达到什么样的级别？
2）网盘一般会有分享功能，有些文件可以可以分享给其他用户，并对这个分享文件做一定的权限控制
功能动机：
详细解释（可选）：

zfile 和其他类型的网盘不一样，zfile 不存储文件和文件夹的索引到数据库。而是直接通过存储引擎对应的 API 去获取文件列表，文件信息。
如果是本地存储，就使用操作系统的 API。
如果是云存储，如阿里云 OSS，就调用他的 HTTP API。
本地存储的话，获取的速度还是很快的，单文件夹查询的时间可以低到毫秒甚至更低。
但云存储等的话，发起一条 HTTP 请求，这个损耗就难以预估了，可能 0.1 秒，如果是国外的云存储，你服务器又是国内的，那1 秒都有可能，这是无法避免也是无法改变的。
继续回到搜索的话题上，既然上面描述了 ZFile 不存储所有文件和文件夹信息，那根据关键字搜索内容时，只能去调用 API。先调用根目录获取所有文件和文件夹，然后再依次获取这些文件夹下的子文件和子文件夹，以此类推，直到遍历完成所有文件夹。那你可以计算下，如果一个云存储，里面有 1000 个文件夹，以较快的网络请求，每个 0.1 秒来计算，理想状态，不考虑任何损耗下，查询速度需要 100 秒。
你可能会想，能不能查询一次后缓存起来，这样下次查询就不用调用 API 了，但这样你在存储源直接操作文件的话，ZFile 中的缓存并没有刷新，数据不一致也会很麻烦。
或者严格意义上，ZFile 不能算网盘，只能算文件目录展示。你可以去阿里、腾讯、七牛、亚马逊的对象存储看看，看看有没有全盘搜索功能。
你想你希望要的可能是 cloudreve，他会将你上传的每个文件，创建的每个文件夹都存储到数据库，这样查询不需要去访问存储源 API ，速度是飞快的，但是，这样的话，如果你的存储源本身有数据的话，无法在 cloudreve 中看到，你直接修改存储源中的数据，也无法在 cloudreve 中看到。
关于你说的分享，ZFile 正在做多用户，到时候会在权限上做一些补充，但这个过程会比较长。

repo: zfile-dev/zfile


text:
提示说找不到路径，详细的报错信息如下所示

未处理System.IO.DirectoryNotFoundException
  HResult=-2147024893
  Message=未能找到路径“E:\ChromeDownloads\EasyPR-DLL-CSharp-master\EasyPR-DLL-CSharp-master\test_interface\bin\x64\Debug\EasyPR-DLL-CSharp-master\resources\image\interface\show_detect”的一部分。

上面是出错的位置，但是检查了路径没问题啊。
  Source=mscorlib
  StackTrace:
       在 System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
       在 System.IO.Directory.Delete(String fullPath, String userPath, Boolean recursive, Boolean checkHost)
       在 test_interface.SinglePic.打开ToolStripMenuItem_Click(Object sender, EventArgs e) 位置 e:\ChromeDownloads\EasyPR-DLL-CSharp-master\EasyPR-DLL-CSharp-master\test_interface\SinglePic.cs:行号 67
       在 System.Windows.Forms.ToolStripItem.RaiseEvent(Object key, EventArgs e)
       在 System.Windows.Forms.ToolStripMenuItem.OnClick(EventArgs e)
       在 System.Windows.Forms.ToolStripItem.HandleClick(EventArgs e)
       在 System.Windows.Forms.ToolStripItem.HandleMouseUp(MouseEventArgs e)
       在 System.Windows.Forms.ToolStrip.OnMouseUp(MouseEventArgs mea)
       在 System.Windows.Forms.ToolStripDropDown.OnMouseUp(MouseEventArgs mea)
       在 System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
       在 System.Windows.Forms.Control.WndProc(Message& m)
       在 System.Windows.Forms.ToolStrip.WndProc(Message& m)
       在 System.Windows.Forms.ToolStripDropDown.WndProc(Message& m)
       在 System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
       在 System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG& msg)
       在 System.Windows.Forms.Application.ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr dwComponentID, Int32 reason, Int32 pvLoopData)
       在 System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(Int32 reason, ApplicationContext context)
       在 System.Windows.Forms.Application.ThreadContext.RunMessageLoop(Int32 reason, ApplicationContext context)
       在 test_interface.Program.Main() 位置 e:\ChromeDownloads\EasyPR-DLL-CSharp-master\EasyPR-DLL-CSharp-master\test_interface\Program.cs:行号 19
       在 System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
       在 System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
       在 Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
       在 System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
       在 System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
       在 System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
       在 System.Threading.ThreadHelper.ThreadStart()
  InnerException:

上面是栈异常的所有详细代码

Directory.Delete(@"EasyPR-DLL-CSharp-master/resources/image/interface/show_detect", false);

问题就在这句代码上，@之后的路径不对。我在当前目录下没有找到这个问题所在，希望作者指导下，这个目录结构@zhang-can @zhang-can

repo: zhang-can/EasyPR-DLL-CSharp


text:
请问如何推理，谢谢

请问如何推理，谢谢

The training code adaptation.py contains a validation script; I will update a separate validation script later

authors: sunzhcas zhang-haojie

repo: zhang-haojie/wesam


text:
角色授权有数据权限时没有显示提示标签

版本号：
2.2.0
问题描述：
bilibili视频讲解时有提示标签，本地跑时没有:
角色管理 -> 授权 ，有数据权限时，没有显示提示标签。
截图&代码：

友情提示： 未按格式要求发帖，会直接删掉。

我们本地代码未发现没有标签的情况

@lvdandan16 那奇怪了，你也是 2.2.0 吗

是的，我们这也是2.2.0版本

经查， 代码没有问题， 是数据问题。
我数据库中 sys_permission 中的 rule_flag字段值全部为 0,  故页面没有显示。
查询发现脚本2jeecgboot_mysql5.7.sql中单表模型示例这条的rule_flag确实是0,
应该是 @zhangdaiscott 导出的数据有脏数据。
INSERT INTO `sys_permission` VALUES ('4148ec82b6acd69f470bea75fe41c357', '2a470fc0c3954d9dbb61de6d80846549', '单表模型示例', '/jeecg/jeecgDemoList', 'jeecg/JeecgDemoList', 'DemoList', NULL, 1, NULL, NULL, 1.00, 0, NULL, 1, 1, NULL, 0, NULL, NULL, '2018-12-28 15:57:30', 'admin', '2019-02-15 16:24:37', 0, 0, NULL, NULL);

删除已有数据股则后自己创建， 可以看到指示图标了。

repo: zhangdaiscott/jeecg-boot


text:
iOS 10.3.1 证书安装成功后，依然提示无法连接到

如题。
但是在iOS9.3和iOS8上就是正常的。请问是什么原因？

之前是好的吗？我也是10.3.1，正常使用

ipapk-server 的代码我没动过啊。iOS10.3之前是正常的，前几天手机系统做了升级，升级后不行了。真机，模拟器都是一样的情况。

我的10.3.1也是一样的. 证书安装成功了, 但是点击下载还是一样的说无法连接到xxxx

找到一个变通的方法：

On iOS 10.3:

Settings > General > About (logically...) > Certificate Trust Settings > Enable Full Trust for Root Certificates

参考：
https://forums.developer.apple.com/message/212408#212408
https://forums.developer.apple.com/thread/71789

@pandaApe 很nice. 确实能用了.

@zhao0 能否增加移除历史APP和编辑APP提交描述的接口?

自己写吧。在大神的接口上修改。 @SimleCp

@SimleCp 有计划，如果你有余力开发，欢迎提MR

@zhao0 @pandaApe 我能说我不会node.js么....而且最近很忙 没空学这个...

@SimleCp 我在大神的基础上增加了测试和线上环境的区分。公司产品比较多，又增加了一个查询所有产品的接口。优化起来还挺好用的。

@pandaApe 期待你的 Pull requests ^-^ 让我们也能用上

哈哈，好的啊。

authors: SimleCp pandaApe zhao0


text:
🛑 ZY is down

In 810171f, ZY (https://ziyuan.baidu.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: ZY is back up in e223424.

repo: zhaodylan/uptime-ziyuan


text:
🛑 ZY is down

In 9a321ca, ZY (https://ziyuan.baidu.com) was down:

HTTP code: 0
Response time: 0 ms

Resolved: ZY is back up in e219843 after 18 minutes.


text:
拍一拍和拉新人入群无响应，debug模式显示[WX]group message 2885427936572881918 skipped: Unsupported note message

前置确认

[X] 我确认我运行的是最新版本的代码，并且安装了所需的依赖，在FAQS中也未找到类似问题。

⚠ 搜索issues中是否已存在类似问题

[X] 我已经搜索过issues和disscussions，没有跟我遇到的问题相关的issue

操作系统类型?
Linux
运行的python版本是?
python 3.8
使用的chatgpt-on-wechat版本是?
Latest Release
运行的channel类型是?
wx(个人微信, itchat)
复现步骤 🕹
在拍一拍/拉新人入群的时候不会有反应。
Hello似乎是正常启动了，因为我回复Hello或者End的时候都会回复插件中对应的消息和图片。
我确定我hello的config的配置正确
问题描述 😯
在拍一拍/拉新人入群的时候不会有反应。
可用插件中有

tool:这是一个能让chatgpt联网，搜索，数字运算的插件，将赋予强大且丰富的扩展能力。
角色扮演:让机器人扮演不同的角色。
文字冒险:可以和机器人一起玩文字冒险游戏。

且的确只能用这几个；然而在启动的时候都能成功init。
终端日志 📒
[INFO][2024-07-23 03:00:03][keyword.py:40] - [keyword] {}
[INFO][2024-07-23 03:00:03][keyword.py:42] - [keyword] inited.
[WARNING][2024-07-23 03:00:04][tool.py:234] - [tool] filter invalid tool: 'browser'
[WARNING][2024-07-23 03:00:04][tool.py:234] - [tool] filter invalid tool: 'news'
[WARNING][2024-07-23 03:00:04][tool.py:234] - [tool] filter invalid tool: 'visual'
[INFO][2024-07-23 03:00:04][tool.py:28] - [tool] inited
[INFO][2024-07-23 03:00:04][hello.py:38] - [Hello] inited
[INFO][2024-07-23 03:00:04][role.py:69] - [Role] inited
[INFO][2024-07-23 03:00:04][dungeon.py:56] - [Dungeon] inited
[INFO][2024-07-23 03:00:05][bdunit.py:40] - [BDunit] inited
[INFO][2024-07-23 03:00:05][finish.py:23] - [Finish] inited

[DEBUG][2024-07-23 03:08:53][wechat_channel.py:45] - [WX]group message 2885427936572881918 skipped: Unsupported note message: You invited <用户> to the group chat.

在排一排的时候也会有**[WX]group message 2885427936572881918 skipped: Unsupported note message**之类的，我怀疑是这个的问题。

问题解决了！发现是微信语言的问题。我使用的是英文端，拍一拍会显示为"tickled"而不是"拍了拍"，因此不会触发wechat_message.py中的以下行：
elif "拍了拍我" in itchat_msg["Content"]:
拉入群聊等同理。。希望能支持更多语言！

上传了一个pr支持英文端，望通过，感谢~

#2207

已合并

repo: zhayujie/chatgpt-on-wechat


text:
边界不匹配：类型 VM 的通用方法 getObject（long）不适用于参数（long）。推断类型 Array&DvmObject 并不是有界参数 <T 到 DvmObject<?>> 的有效替代项。

配置的时候getObject方法一直报错 不知道是jdk版本问题 还是什么  我是1.8版本

使用idea

使用 idea 就报这种找不到 dll  复制过去有时候也不行  Exception in thread "main" java.lang.UnsatisfiedLinkError: Unable to load library 'capstone': Native library (win32-x86-64/capstone.dll)

是最新的代码吧

应该是最新的 昨天从GitHub 下下来的

请问一下这个运行之后 能用ida附加吗

对ida支持不好

是可以的吗 attach armlinux吗 我一附加 ida就读不到数据 请问下流程 是附加上然后再让程序跑吗 还是说用gdb之类的呢

gdb的方式会稳定点
On Tue, Jun 30, 2020 at 17:29 shijin1999 notifications@github.com wrote:

是可以的吗 attach armlinux吗 我一附加 ida就读不到数据 请问下流程 是附加上然后再让程序跑吗 还是说用gdb之类的呢
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/zhkl0228/unidbg/issues/155#issuecomment-651677570,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAKSR7YR4X23N3ASY6DLKLTRZGV7JANCNFSM4OLLAZTQ
.

好的 谢谢

Hi,
Did you solve the problem?
I've been faced with the same error but with int instead of long.
It seems to come from the following bit of code:
DvmObject ret = JNICLibrary.callStaticJniMethodObject(emulator, "doCommandNative(I[Ljava/lang/Object;)Ljava/lang/Object;", 10401, new ArrayObject(vm.resolveClass("java/util/HashMap").newObject(map), DvmInteger.valueOf(vm, 12), new StringObject(vm, "21646297"), new StringObject(vm, "")));

Have a good day,
Kevin.


text:
英文整句情况下，换行前的标点符号也要求为全角符号

遇到英文整句且标点符号是当前行的最后一个字符时，当前规则下也要求使用全角符号。比如：
Blabla.
Haha.

check时 会要求.使用全角符号，这个和 https://github.com/sparanoid/chinese-copywriting-guidelines/blob/master/README.zh-Hans.md 以及其他的一些lint  检测规则冲突，这个是否需要优化下 ^_^

我也遇到了这个问题，处理英文单句的时候 . 被要求更改为全角句号，期待后续更新

在计划中 #58 暂时可以给全英文的文本加 <!-- zhlint disabled --> 之类的 flag 跳过检查。🙏

authors: Jinjiang yinan-c zhangsw

repo: zhlint-project/zhlint


text:
Fixed tomli dependency for Python 3.6

No review needed.

Coverage: 31.475%. Remained the same when pulling 1fdbf94fc01910c9860ade7bd414e77cf5203a28 on andy/fix-tomli into e85d21d11e61b7145c190aa5aa67aef33dc39d8e on master.

authors: andy-maier coveralls

repo: zhmcclient/zhmccli


text:
Crash

It keeps crashing

They are updating,  close issue

Plz, close this report cause, were spending pore time dealing with reports than porting BL!
Thx!

I can offer that if you have updated Minecraft to 0.15, that is why.  BlockLauncher does not support 0.15 yet.  Please close this so we do not have to sort this later.  The issue is being worked on.
Check twitter and you'll see that he is having issues with OpenGL and closing the app as well as a few more things.  What should have been a week has gotten much longer.  Please close this issue so the author does not have to sort this out later.

repo: zhuowei/MCPELauncher


text:
Level.setSignText have a problem

After I changed the text on a sign,I must wait for nearly one minute to save the text,or it will be disappeared when I open this world again.
Please fix it！

This has been open for a long time.  The work around is to place another sign NEAR the one you modified with code, then exit the world and re-enter it.
https://github.com/zhuowei/MCPELauncher/issues/224
Super Door Operator 2000 discusses this often on the minecraftforums.net site.


text:
Can't connect to aria2c with HTTPS

Connection works without SSL enabled, when enabled connection cannot be made and nothing is listed in the server logs. This is with OpenSSL enabled and AppleTLS, GnuTLS and WinTLS disabled. No issues/warnings when server is started with the correct certificate and private key.

Those parameters work for me only if I manually allow mixed content and only on Chromium.
On Firefox allowing mixed content (there referred to as "insecure content") still results in the generic "Could not connect to the aria2 RPC server" error.
Also, neither browser will read the configuration.js (which would set SSL/TLS encryption to true and contain the secret token), but dunno if that might be a consequence of the connection failing before said manual override.
Using the most recent Linux nightly/git of Firefox, Chromium and webui. aria2 is 1.18.10, running on openwrt with self-signed cert.

aria2c --enable-rpc --rpc-certificate=/path/to/server.pem --rpc-private-key=/path/to/server.key --rpc-secure
above doesn't work for me (Debian 8 Jessie , aria2c 1.18.8), I got Web sockets not working due to The operation is insecure.

The best solution I came up with is an Apache configuration.
Add the following lines at the end of your vhost section:
ProxyRequests Off
ProxyPreserveHost Off

<Proxy *>
  Order allow,deny
  Allow from all
</Proxy>

<Location /jsonrpc>
  <IfVersion >= 2.4>
    ProxyPass ws://127.0.0.1:6800/jsonrpc
    ProxyPassReverse ws://127.0.0.1:6800/jsonrpc
  </IfVersion>
  <IfVersion < 2.4>
    ProxyPass http://127.0.0.1:6800/jsonrpc
    ProxyPassReverse http://127.0.0.1:6800/jsonrpc
  </IfVersion>
</Location>

Then just configure webui-aria2 to connect to the same host, on port 443 secured.
Obviously, you need to activate proxy module for apache.
You should not add certificate options when launching aria2c (--rpc-certificate=/path/to/server.pem --rpc-private-key=/path/to/server.key).
The advantage is you don't need to accept the certificate even it's self-signed because you have already accepted it when getting the webui page. Browers don't complain about insecure connection neither.
I hope this could help.

@csdt How did you manage to connection to wss://?
SSLEngine on
ProxyPass /aria/ http://localhost:80/aria/
ProxyPassReverse /aria/ http://localhost:80/aria/

ProxyPass /jsonrpc ws://localhost:6800/jsonrpc
ProxyPassReverse /jsonrpc ws://localhost:6800/jsonrpc

is not enough
webui-aria2 try to connect to ws://, here comes the notice from browser, that you are trying to connect to mixed content...
Thanks

@muhahacz You need to configure webui-aria2 to connect using SSL.
Here is a screenshot of my connection configuration:

With this configuration, the browser should try to connect using wss://
Tell me if you have any trouble configure it.

Do you know, where exactly is this configuration stored?

Normally, the configuration file is on the file configuration.js.
But webui-aria2 seems to be buggy about connecting with these parameters.
To fix the bug, I needed to edit the file js/services/rpc/rpc.js like this:
angular
.module('webui.services.rpc', [
  'webui.services.rpc.syscall', 'webui.services.configuration', 'webui.services.alerts',
  'webui.services.utils'
])
.factory('$rpc', [
  '$syscall', '$globalTimeout', '$alerts', '$utils',
  '$rootScope', '$location', '$authconf',
function(syscall, time, alerts, utils, rootScope, uri, authconf) {

  var subscriptions = []
    , configurations = [authconf]
    , currentConf = {}
    , currentToken
    , timeout = null
    , forceNextUpdate = false;

  var cookieConf = utils.getCookie('aria2conf');

  // try at the start, so that it is presistant even when default authconf works
  if (cookieConf) configurations.push(cookieConf);

  if (['http', 'https'].indexOf(uri.protocol()) != -1 && uri.host() != 'localhost') {
    console.log(uri.host());
    configurations.push({
      host: uri.host(), // <===================== Modifications // default: "localhost"
      port: uri.port(), // <===================== are           // default: 6800
      encrypt: uri.protocol() == 'https', // <=== here          // default: false
    });
    console.log(configurations);
  }

Otherwise, it is stored in cookies and you can modify it directly from the web page:

Well i can connect from non SSL site to proxied wss://, but from SSL site i can not connect to wss://, seems configuration does not work on SSL, i do not get any cookie...
Can you send me pls your whole virtualhost file? Maybe i have something with apache configuration. Thanks

<VirtualHost *:80>
  ServerName webui-aria2.example.com

  DocumentRoot /var/www/webui-aria2/

  CustomLog /var/logs/apache/webui-aria2-access.log combined
  ErrorLog /var/logs/apache/webui-aria2-errors.log combined

  # Force HTTPS
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

<VirtualHost *:443>
  ServerName webui-aria2.example.com

  DocumentRoot /var/www/webui-aria2/

  CustomLog /var/logs/apache/webui-aria2-access.log combined
  ErrorLog /var/logs/apache/webui-aria2-errors.log combined

  # Authentificate users
  <Location />
    AuthType Basic
    AuthName "webui-aria2"
    AuthUserFile  users.auth
    AuthGroupFile groups.auth

    # allow only users from the webui-aria2 group
    Require group webui-aria2
  </Location>

  # certificates
  SSLEngine on
  SSLCertificateFile    /etc/ssl/apache2/certs/public.crt
  SSLCertificateKeyFile /etc/ssl/apache2/private/private.key

  # The magic happens with all the following lines

  # Not sure if these lines are important
  ProxyRequests Off
  ProxyPreserveHost Off

  # Accept Proxying user
  <Proxy *>
    Order allow,deny
    Allow from all
  </Proxy>

  # Proxying the rpc requets
  <Location /jsonrpc>
    ProxyPass ws://127.0.0.1:6800/jsonrpc
    ProxyPassReverse ws://127.0.0.1:6800/jsonrpc
  </Location>

</VirtualHost>

I start aria2 with the following command line: /usr/bin/aria2c --enable-rpc (using systemd for curious people)

Seems webui-aria2 does not load ssl cookie with connection settings properly, so it's using default configuration every time i reload browser. If i setup correct settings, after while it connects to tunneled rpc, but after reload i lost these settings again....
Also i think that nonSSL and SSL cookie are basically same, so they are every reload overridden by themselves .
Your fix is working! But after CTRL+R blank page appear, dont know why... but after some time it starts working again.... weird....

I have the same problem, but full refresh (clearing cache) avoids this problem.
On firefox, you can do it CTRL+F5.
I don't know for other browsers, maybe the same.

Chrome doesnt work at all, but firefox is ok (except CTRL+R)

Fixed with these settings
ProxyPass /jsonrpc ws://127.0.0.1:6800/jsonrpc retry=0
ProxyPassReverse /jsonrpc ws://127.0.0.1:6800/jsonrpc
SetEnv force-proxy-request-1.0 1
SetEnv proxy-nokeepalive 1

and this commit
https://github.com/buffovich/webui-aria2/commit/b5624e279c224eaf099839d7637503eec8163bae
Still, it takes some time to connect to wss from ssl (aprox 10secs) dont know why.

Thanks for the tip

I know this issue is a bit old but it has a good Pagerank on Google and I kept landing here. It took me a while to solve, so I'm going to share my experience and understanding of the matter.
Most probably, there's something wrong with your certificate setup. If you press F12 on the index page and keep seeing net::ERR_INSECURE_RESPONSE on the console, then there's definitely something wrong with your certificates.
First, some analogies:

Root certificate => Signature
Certificate signing request => Paper
Certificate => Signed paper

When you want to prove a 3rd party that a piece of paper is valid, you need to get it signed by an authority.
In this setup, the 3rd party is the OS.  When the OS gets handed a piece of signed paper, it checks if the said paper is signed by someone it deems an authority.
The list of signatures that the OS recognizes is called the root certificate storage. OSs come pre-installed with well established root certificates. Take GoDaddy, for example. Their root certificates are present on pretty much all OSs.
When you pay for an SSL certificate from GoDaddy, you're basically handing them a piece of paper for them to sign it, so that you can show it to other OSs and get recognized.
Since we don't care about the rest of the world, what we can also do is to introduce our OS our own signature, and it will gladly accept any piece of paper signed with it.
Start by creating a new directory and moving into it.
Create your own root certificate
openssl genrsa -out ca.key
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
Introduce the resulting ca.crt to your OS as a trusted root certificate.
Note: openssl will ask you some information for certificate details. They are not really important, fill them as you wish them to appear in the root certificate storage. I only see Organization Name within the storage, so I just change that to my liking and leave the rest as default.
Create a certificate signing request
For this step, create a copy of the openssl config file:
cp /etc/ssl/openssl.cnf req.cnf
Within req.cnf:

Uncomment req_extensions = v3_req
Add subjectAltName = @alt_names to the bottom of [v3_req] section
Create a new section called [alt_names] and specify hosts where your aria2 will be running as such:

DNS.1 = example.duckdns.org
IP.1 = 192.168.2.143

Now create a signing request with the configuration we just prepared:
openssl genrsa -out ia.key
openssl req -new -key ia.key -out ia.csr -config req.cnf
Again, fill the additional information requested by openssl as you wish, but leave Common Name and Challenge Password as is.
Sign the request with your root certificate
openssl x509 -req -days 3650 -in ia.csr -CA ca.crt -CAkey ca.key -out ia.crt -CAcreateserial -extensions v3_req -extfile req.cnf
You can now use ia.crt with an external service, and your OS, and your OS only, will recognize it as legit.
Since it's more convenient and more widely supported by aria2's supported TLS libraries (see here), I like packing the certificate and its key into a PKCS12 file with the following:
openssl pkcs12 -export -out ia.p12 -inkey ia.key -in ia.crt
Leave Export Password as is.
You can now fire up aria2 with:
aria2c --enable-rpc --rpc-listen-all --rpc-certificate=/path/to/your/ia.p12 --rpc-secure --rpc-secret=yoursecret
Whew! You should now be able to fire up index.html from your computer at any time and have a fully encrypted and secret protected connection, assuming your ports are forwarded on the network of the machine that's running aria2. Shall we put this in the README section?

You did really got job at explaining c3mb0!! We can make another file
called setup_https.md and link it (maybe called setup https) from the
readme.md ... Adding directly to readme.md would be fine to e for now.
Send over a pull request and I would love to merge it in :)
On Sat, Jan 30, 2016, 5:30 AM c3mb0 notifications@github.com wrote:

I know this issue is a bit old but it has a good Pagerank on Google and I
kept landing here. It took me a while to solve, so I'm going to share my
experience and understanding of the matter.
Most probably, there's something wrong with your certificate setup. If you
press F12 on the index page and keep seeing net::ERR_INSECURE_RESPONSE on
the console, then there's definitely something wrong with your certificates.
First, some analogies:

Root certificate => Signature
Certificate signing request => Paper
Certificate => Signed paper

When you want to prove a 3rd party that a piece of paper is valid, you
need to get it signed by an authority.
In this setup, the 3rd party is the OS. When the OS gets handed a piece of
signed paper, it checks if the said paper is signed by someone it deems an
authority.
The list of signatures that the OS recognizes is called the root
certificate storage. OSs come pre-installed with well established root
certificates. Take GoDaddy, for example. Their root certificates are
present on pretty much all OSs.
When you pay for an SSL certificate from GoDaddy, you're basically handing
them a piece of paper for them to sign it, so that you can show it to other
OSs and get recognized.
Since we don't care about the rest of the world, what we can also do is to
introduce our OS our own signature, and it will gladly accept any piece of
paper signed with it.
Start by creating a new directory and moving into it.
Create your own root certificate
openssl genrsa -out ca.key
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
Introduce the resulting ca.crt to your OS as a trusted root certificate.
Note: openssl will ask you some information for certificate details. They
are not really important, fill them as you wish them to appear in the root
certificate storage. I only see Organization Name within the storage, so I
just change that to my liking and leave the rest as default.
Create a certificate signing request
For this step, create a copy of the openssl config file:
cp /etc/ssl/openssl.cnf req.cnf
Within req.cnf:

Uncomment req_extensions = v3_req
Add subjectAltName = @alt_names to the bottom of [v3_req] section
Create a new section called [alt_names] and specify hosts where your
aria2 will be running as such:

DNS.1 = example.duckdns.org
IP.1 = 192.168.2.143
Now create a signing request with the configuration we just prepared:
openssl genrsa -out ia.key
openssl req -new -key ia.key -out ia.csr -config req.cnf
Again, fill the additional information requested by openssl as you wish,
but leave Common Name and Challenge Password as is.
Sign the request with your root certificate
openssl x509 -req -days 3650 -in ia.csr -CA ca.crt -CAkey ca.key -out
ia.crt -CAcreateserial -extensions v3_req -extfile req.cnf
You can now use ia.crt with an external service, and your OS, and your OS
only, will recognize it as legit.
Since it's more convenient and more widely supported by aria2's supported
TLS libraries (see here
https://aria2.github.io/manual/en/html/aria2c.html#cmdoption--rpc-certificate),
I like packing the certificate and its key into a PKCS12 file with the
following:
openssl pkcs12 -export -out ia.p12 -inkey ia.key -in ia.crt
Leave Export Password as is.
You can now fire up aria2 with:
aria2c --enable-rpc --rpc-listen-all
--rpc-certificate=/path/to/your/ia.p12 --rpc-secure --rpc-secret=yoursecret
Whew! You should now be able to fire up index.html from your computer at
any time and have a fully encrypted and secret protected connection,
assuming your ports are forwarded on the network of the machine that's
running aria2. Shall we put this in the README section?
—
Reply to this email directly or view it on GitHub
https://github.com/ziahamza/webui-aria2/issues/108#issuecomment-176977431
.

Hello, my dear friends. Could you help me? I faced with an issue concerning trusted connection.
I have 2 PC in my LAN, first one is an HTPC (192.168.0.5), second one is my working machine (192.168.0.3). OS on both of them is Windows 8.1 Home.
On the HTPC I installed Aria2c to which I'm trying to connect from my working PC through Aria2cWebUI.
Every time when I'm trying to connect to Aria2c I'm getting following log:
On the HTPC:
C:\Program Files\Aria2c>aria2c.exe --conf-path=aria2c.conf

10/23 19:43:46 [WARN] Unknown option: ;quiet=true

10/23 19:43:46 [WARN] --rpc-user option will be deprecated in the future release
. Migrate to --rpc-secret option as soon as possible.

10/23 19:43:46 [WARN] --rpc-passwd option will be deprecated in the future relea
se.

10/23 19:43:46 [NOTICE] RPC transport will be encrypted.

10/23 19:43:46 [NOTICE] IPv4 RPC: listening on TCP port 6800

10/23 19:44:55 [ERROR] WinTLS: Failed to decrypt a message! Error: The certifica
te chain was issued by an authority that is not trusted.
(80090325)

10/23 19:44:56 [ERROR] WinTLS: Failed to decrypt a message! Error: The certifica
te chain was issued by an authority that is not trusted.
(80090325)

On my working PC in Aria2cWebUI:
Oh Snap! Could not connect to the aria2 RPC server. Will retry in 10 secs. You might want to check the connection settings by going to Settings > Connection Settings
Here is the config file of Aria2c (192.168.0.5):
daemon=true
;quiet=true
file-allocation=falloc
continue
summary-interval=120
allow-overwrite=false
check-certificate=false
auto-file-renaming=false
dir=D:\
dht-file-path=dht.dat
dht-file-path6=dht6.dat
enable-rpc=true
rpc-listen-port=6800
rpc-listen-all=true
rpc-secure=true
rpc-certificate=ia.p12
rpc-user=XXXXXXXX
rpc-passwd=********
file-allocation=none
enable-dht=true
disable-ipv6=true
timeout=600
retry-wait=30
max-tries=50
seed-ratio=2.0
max-download-limit=0
max-overall-download-limit=0
max-concurrent-downloads=5
max-connection-per-server=10
min-split-size=5M
no-file-allocation-limit=10M
piece-length=1M
disk-cache=25M
log=aria2.log
log-level=warn
auto-save-interval=30
save-session=aria2.sav
user-agent=Mozilla/5.0 (Windows NT 6.3; rv:47.0) Gecko/20100101 Firefox/47.0
http-accept-gzip=true

Connection settings in Aria2cWebUI (192.168.0.3):

ia.p12 certificate file I've got with the help of c3mb0's instructions (many thanks to him).
openssl_cert.cnf:
[ req ]
# comment out the next line to protect the private key with a passphrase
encrypt_key                     = no
# the default key length is secure and quite fast - do not change it
default_bits                    = 2048
default_md                      = sha1
distinguished_name              = req_distinguished_name
x509_extensions                 = v3_ca
#req_extensions			= v3_req

[ v3_ca ]
# The extentions to add to a self-signed cert
subjectKeyIdentifier		= hash
nsCertType                      = server
basicConstraints                = CA:TRUE,pathlen:0
keyUsage			= digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
extendedKeyUsage                = serverAuth
nsComment                       = "iG0R self-signed certificate"

#[ v3_req ]
# Extensions to add to a certificate request
#basicConstraints		= CA:FALSE
#keyUsage			= digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
#nsCertType			= emailCA,sslCA,objCA,objsign
#subjectAltName			= @alt_names
#
#[ alt_names ]
#DNS.1 = example.duckdns.org
#IP.1 = 192.168.0.5
#IP.2 = xxx.xxx.xxx.xxx

[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default             = UA
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = xxx

localityName                    = Locality Name (eg, city)
localityName_default            = xxx

organizationName                = Organization Name (eg, company)
organizationName_default        = iG0R home

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = iG0R CA

0.commonName                    = Common Name (FQDN of your server)
0.commonName_default            = xxx.xxx.xxx.xxx (my external IP)

# To create a certificate for more than one name uncomment:
# 1.commonName                  = DNS alias of your server
# 2.commonName                  = DNS alias of your server
# ...
# See http://home.netscape.com/eng/security/ssl_2.0_certificate.html
# to see how Netscape understands commonName.

openssl_req.cnf:
[ req ]
# comment out the next line to protect the private key with a passphrase
encrypt_key                     = no
# the default key length is secure and quite fast - do not change it
default_bits                    = 2048
default_md                      = sha1
distinguished_name              = req_distinguished_name
#x509_extensions                 = v3_ca
req_extensions			= v3_req

#[ v3_ca ]
# The extentions to add to a self-signed cert
#subjectKeyIdentifier		= hash
#nsCertType                      = server
#basicConstraints                = CA:TRUE,pathlen:0
#keyUsage			= digitalSignature, nonRepudiation, keyEncipherment, #dataEncipherment, keyAgreement, keyCertSign
#extendedKeyUsage                = serverAuth
#nsComment                       = "iG0R self-signed certificate"

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints		= CA:FALSE
keyUsage			= digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
nsCertType			= emailCA,sslCA,objCA,objsign
subjectAltName			= @alt_names

[ alt_names ]
#DNS.1 = example.duckdns.org
IP.1 = 192.168.0.5
IP.2 = xxx.xxx.xxx.xxx

[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default             = UA
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = xxx

localityName                    = Locality Name (eg, city)
localityName_default            = xxx

organizationName                = Organization Name (eg, company)
organizationName_default        = iG0R home

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = iG0R CA

0.commonName                    = Common Name (FQDN of your server)
0.commonName_default            = xxx.xxx.xxx.xxx (my external IP)

# To create a certificate for more than one name uncomment:
# 1.commonName                  = DNS alias of your server
# 2.commonName                  = DNS alias of your server
# ...
# See http://home.netscape.com/eng/security/ssl_2.0_certificate.html
# to see how Netscape understands commonName.

create_certificates.bat:
rem #Create your own root certificate
rem #Introduce the resulting cert.crt to your OS as a trusted root certificate.

rem #Note: openssl will ask you some information for certificate details. They are not really important, fill them as you wish them to appear in the root certificate storage. I only see Organization Name within the storage, so I just change that to my liking and leave the rest as default.

set OPENSSL_CONF=openssl_cert.cnf
openssl.exe genrsa -out ca.key
openssl.exe req -new -x509 -days 3650 -key ca.key -out ca.crt

rem #Create a certificate signing request

rem #Again, fill the additional information requested by openssl as you wish, but leave Common Name and Challenge Password as is.

set OPENSSL_CONF=openssl_req.cnf
openssl.exe genrsa -out ia.key
openssl.exe req -new -key ia.key -out ia.csr

rem #Sign the request with your root certificate

openssl.exe x509 -req -days 3650 -in ia.csr -CA ca.crt -CAkey ca.key -out ia.crt -CAcreateserial -extensions v3_req -extfile openssl_req.cnf

rem #You can now use ia.crt with an external service, and your OS, and your OS only, will recognize it as legit.
rem #Since it's more convenient and more widely supported by aria2's supported TLS libraries (see here), I like packing the certificate and its key into a PKCS12 file with the following:

set OPENSSL_CONF=openssl_cert.cnf
openssl.exe pkcs12 -export -out ia.p12 -inkey ia.key -in ia.crt

Also I've introduced the resulting ca.crt to Windows in 192.168.0.5 (where Aria2c is installed) as a trusted root certificate.

OK, I resolved the issue only with Firefox (on my working PC - 192.168.0.3) access to Aria2 (on the HTPC - 192.168.0.5). I needed to introduce my ca.crt to Firefox through
Settings-> Advanced-> Certificates-> View Certificates (Certificates Manager)-> Authorities-> Import...-> Browse ca.crt
But this approach is not suitable for Google Chrome. Whatever I did - added ca.rt to Windows certificates storage
certmgr-> Certificates-> Current user-> Trusted Root Certification Authorities-> Certificates
also added ca.crt to GoogleChrome
Settings-> Show advanced settings...-> HTTPS/SSL Manage certificates...-> Trusted Root Certification Authorities-> Import...
but GoogleChrome can't connect to Aria2 via SSL,
Also I tried Opera at the same result as with GoogleChrome.
Could somebody answer me what am I doing wrong?
Also I'd like to know why any browser don't warning me about self-signed certificate and don't offer me to trust it on my own risk.

You can also use a webpage, for the redirection.
The advantage is the possible to do something, with the request to aria2 before to get it !
Bypass the proxy and you don't have to change the apache2 setting.
For example, i want to parse automatically the download link to an external service to "debrid" link ! (1fichier, uptobox, etc)
(necessary to aadapt in rpc.php )
Start aria2 :
aria2c --enable-rpc --rpc-listen-all --listen-port=6800 --rpc-allow-origin-all=true
The PHP code for redirection webpage "rpc.php" to the root directory "www" (waiting POST method),
Using localhost because aria2 is on the same machine.

Check the link in your browser :
http://domain_addr:80/rpc.php
You're getting an error, because not request is sent (it's normal)
{"id":null,"jsonrpc":"2.0","error":{"code":-32700,"message":"Parse error."}}
Configure the webui (ariaNg for me, but can do it on another), and change the RPC address from http://domain_addr:6800/jsonrpc to http://domain_addr:80/rpc.php
So my apache setting is light !
<Directory /home/www>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted

<VirtualHost *:80>
DocumentRoot "/home/www"
ServerName ADD_DOMAIN_HERE

        Options FollowSymLinks
        AllowOverride All

        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all

Web sockets not working due to Failed to construct 'WebSocket': An insecure WebSocket connection may not be initiated from a page loaded over HTTPS.
Eh... I fixed this by just changing encrypt: false to true  in configuration.js. I guess the problem is that I have https set up before configuring webui.

same issue

--rpc-secure=true
pem cert configured
pem key configured
port correct
no reverse proxy

curl http://host:port return the http content normally (why http still works?)
curl https://host:port shows unknown protocol error
log
2018-06-08 02:26:24.720191 [INFO] [HttpServerCommand.cc:267] CUID#115 - Error occurred while reading HTTP request Exception: [HttpHeaderProcessor.cc:196] errorCode=1 Bad Request-Line: missing HTTP-version
2018-06-08 02:26:26.926508 [INFO] [HttpListenCommand.cc:81] RPC: Accepted the connection from 153.121.42.113:49308.
2018-06-08 02:26:26.926911 [INFO] [HttpServerCommand.cc:267] CUID#116 - Error occurred while reading HTTP requestException: [HttpHeaderProcessor.cc:168] errorCode=1 Bad Request-Line: missing request-target
2018-06-08 02:26:27.647460 [INFO] [HttpListenCommand.cc:81] RPC: Accepted the connection from 153.121.42.113:49316.
2018-06-08 02:26:27.648439 [INFO] [HttpServerCommand.cc:267] CUID#117 - Error occurred while reading HTTP requestException: [HttpHeaderProcessor.cc:196] errorCode=1 Bad Request-Line: missing HTTP-version

I fixed the problem by changing encrypt: true in configuration.js file, also providing server ssl keys when running aria2c! --rpc-certificate,  --rpc-private-key and  --rpc-secure

Here is my way of doing it
I'm using nginx as a web server on this to serve aria2-webui
on the config you just need to add
location /jsonrpc {
proxy_set_header        Host $host;
proxy_set_header        X-Real-IP $remote_addr;
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header        X-Forwarded-Proto $scheme;
proxy_pass          http://127.0.0.1:6800/jsonrpc;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}

on the configuration.js
change
host: location.protocol.startsWith('http') to host: location.protocol.startsWith('https')
port: 6800, to   port: 443,
encrypt: false, to     encrypt: true,
it will look like this
host: location.protocol.startsWith('https') ? location.hostname : 'localhost',
path: '/jsonrpc',
port: 443,
encrypt: true,

Here is my way of doing it
I'm using nginx as a web server on this to serve webui-aria2
on the config you just need to add
location /jsonrpc
{
proxy_set_header	Host $host;
proxy_set_header	X-Real-IP $remote_addr;
proxy_set_header	X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header	X-Forwarded-Proto $scheme;
proxy_pass	http://127.0.0.1:6800/jsonrpc;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}
on the configuration.js
change
host: location.protocol.startsWith('http') to host: location.protocol.startsWith('https')
port: 6800, to port: 443,
encrypt: false, to encrypt: true,
it will look like this
host: location.protocol.startsWith('https') ? location.hostname : 'localhost',
path: '/jsonrpc',
port: 443,
encrypt: true,
create a config file for aria2 on /etc/aria2.conf (for exemple) and add
continue=true
dir=/path/to/your/download/directory
file-allocation=trunc
max-connection-per-server=4
max-concurrent-downloads=2
max-overall-download-limit=0
min-split-size=25M
rpc-secret=your-rpc-secret (you can generate one by running: openssl rand -base64 32
rpc-allow-origin-all=true
console-log-level=warn
enable-rpc=true
rpc-listen-all=true
daemon=true
bt-enable-lpd=true
save-session=/tmp/aria2.log
then start aria2 with
aria2c --conf-path=/etc/aria2.conf
you can add it to /etc/rc.local so it start it self on system boot

Here is my way of doing it I'm using nginx as a web server on this to serve webui-aria2 on the config you just need to add location /jsonrpc { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://127.0.0.1:6800/jsonrpc; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 86400; }
on the configuration.js change host: location.protocol.startsWith('http') to host: location.protocol.startsWith('https') port: 6800, to port: 443, encrypt: false, to encrypt: true, it will look like this host: location.protocol.startsWith('https') ? location.hostname : 'localhost', path: '/jsonrpc', port: 443, encrypt: true,
create a config file for aria2 on /etc/aria2.conf (for exemple) and add continue=true dir=/path/to/your/download/directory file-allocation=trunc max-connection-per-server=4 max-concurrent-downloads=2 max-overall-download-limit=0 min-split-size=25M rpc-secret=your-rpc-secret (you can generate one by running: openssl rand -base64 32 rpc-allow-origin-all=true console-log-level=warn enable-rpc=true rpc-listen-all=true daemon=true bt-enable-lpd=true save-session=/path/to/your/download/.aria2.session
then start aria2 with aria2c --conf-path=/etc/aria2.conf you can add it to /etc/rc.local so it start it self on system boot

Hi , I am also having similar issue.
I am running Aria2-ui with aria - ng User interface.
I am using NGinx proxy manager, how to secure the access to http://port/jsonrpc;
so that from outside it can't be accessed publically but through proxy manager only.
Thanks

Here's what I did (I'm using Traefik, but that's not really relevant).
first entry - for the webapp:
https://aria2.mydomain/ => http://aria2.lan:6880/
second entry - for server:
https://aria2s.mydomain/ => http://aria2.lan:6800/
Then in aria2 settings => RPC I put:
https://aria2s.mydomain and port 443.

Here's what I did (I'm using Traefik, but that's not really relevant).
first entry - for the webapp:
https://aria2.mydomain/ => http://aria2.lan:6880/
second entry - for server:
https://aria2s.mydomain/ => http://aria2.lan:6800/
Then in aria2 web app settings => RPC I put:
https://aria2s.mydomain and port 443.

This worked for me. Thanks!

authors: Aqualie NAVrasZ bogorad c3mb0 chamchenko csdt iG8R imirzadeh lilarcor muhahacz nicholaswilde rathsky raynoxfr rsvcoder violarulan ziahamza