From: Peter Maydell <peter.maydell@linaro.org>
To: Adam Lackorzynski <adam@l4re.org>
Cc: QEMU Developers <qemu-devel@nongnu.org>
Subject: Re: arm: Launching EFI-enabled arm32 Linux
Date: Sun, 5 Sep 2021 15:44:14 +0100 [thread overview]
Message-ID: <CAFEAcA_UVbxP59XF4XRYNRrtcYmAH2u066xZOcTnnwx0Ote=bw@mail.gmail.com> (raw)
In-Reply-To: <YTPIdbUCmwagL5/D@os.inf.tu-dresden.de>
On Sat, 4 Sept 2021 at 20:26, Adam Lackorzynski <adam@l4re.org> wrote:
> while trying to launch an EFI-enabled arm32 Linux binary (zImage) I
> noticed I get an undefined instruction exception on the first
> instruction. Now this is a bit special because Linux uses a nop
> instruction there that also is a PE file signature ('MZ') such that the
> CPU runs over it and the file is still recognized as a PE binary. Linux
> uses 0x13105a4d (tstne r0, #0x4d000) as the instruction (see also
> arch/arm/boot/compressed/head.S and efi-header.S in Linux).
> However, QEMU's instruction decoder will only recognize TST with bits
> 12-15 being 0, which this instruction is not fullfilling, and thus the
> undef exception. I guess other CPU implementations will allow this
> encoding. So while investigating I was doing the following to make Linux
> proceed. I also believe this was working in a previous version of QEMU.
>
> diff --git a/target/arm/a32.decode b/target/arm/a32.decode
> index fcd8cd4f7d..222553750e 100644
> --- a/target/arm/a32.decode
> +++ b/target/arm/a32.decode
> @@ -127,7 +127,7 @@ ADD_rri .... 001 0100 . .... .... ............ @s_rri_rot
> ADC_rri .... 001 0101 . .... .... ............ @s_rri_rot
> SBC_rri .... 001 0110 . .... .... ............ @s_rri_rot
> RSC_rri .... 001 0111 . .... .... ............ @s_rri_rot
> -TST_xri .... 001 1000 1 .... 0000 ............ @S_xri_rot
> +TST_xri .... 001 1000 1 .... ---- ............ @S_xri_rot
> TEQ_xri .... 001 1001 1 .... 0000 ............ @S_xri_rot
> CMP_xri .... 001 1010 1 .... 0000 ............ @S_xri_rot
> CMN_xri .... 001 1011 1 .... 0000 ............ @S_xri_rot
>
>
> Any thoughts on this?
If your guest code is relying on bits [15:12] in the TST (immediate)
Arm encoding being non-zero then it is broken. In the v8A Arm ARM
DDI 0487G.b, section F5.1.262, these bits are noted as "(0)", which
means RES0, should-be-zero. In F1.7.2 this is described as meaning
that if the bit is 1 then the behaviour is CONSTRAINED UNPREDICTABLE,
and can be result in any of:
* UNDEF (this is what QEMU chooses)
* NOP
* executes as if the bit were 0
* any destination registers become UNKNOWN
This was true also for v7A. Even back as far as ARMv5 these bits
are marked as "SBZ" (should-be-zero).
Since this is all in the UNPREDICTABLE zone, there are presumably
some CPUs that do execute this insn as either a NOP or ignoring
the incorrectly set bits; but I would not be surprised if there
are also some CPUs that behave like QEMU and UNDEF them.
Looking at the code where this is used, I think it probably
needs to abandon the goal of having the insn be a true
or nearly-true NOP. Since this is the first insn the kernel
executes, it doesn't really have to be a NOP, as long as it
doesn't trash the registers where the bootloader passed it
information (r0, r1, r2).
Unless there are other undocumented constraints on this
instruction pattern, you might try
0xe2255a4d ; eor r5, r5, 0x4d000
That's not a NOP on its own, but if you use it twice
in a row then it is, and you can make sure the use in
head.S arranges to put two of those and then revert to
more normal-looking NOPs for the rest of its run of NOPs.
(This doesn't work for CONFIG_THUMB2_KERNEL, but neither does
the current insn pattern I think.)
thanks
-- PMM
next prev parent reply other threads:[~2021-09-05 14:47 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-04 19:26 arm: Launching EFI-enabled arm32 Linux Adam Lackorzynski
2021-09-05 14:44 ` Peter Maydell [this message]
2021-09-06 15:34 ` Andre Przywara
2021-09-07 23:25 ` Adam Lackorzynski
2021-09-07 23:47 ` Andre Przywara
2021-09-08 11:04 ` Adam Lackorzynski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAFEAcA_UVbxP59XF4XRYNRrtcYmAH2u066xZOcTnnwx0Ote=bw@mail.gmail.com' \
--to=peter.maydell@linaro.org \
--cc=adam@l4re.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).