* [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases
@ 2017-08-25 13:50 Andrew
2017-08-25 15:41 ` Peter Maydell
` (6 more replies)
0 siblings, 7 replies; 8+ messages in thread
From: Andrew @ 2017-08-25 13:50 UTC (permalink / raw)
To: qemu-devel
Public bug reported:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this will
raise an exception. When this happens x0 has already been updated so
after the exception handler has run the operating system will try to
rerun the instruction. QEMU will now try to perform an invalid load and
raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings implementation
of memcpy. This uses a similar instruction when copying between 64 and
96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
** Affects: qemu
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1713066
Title:
Incorrect handling of aarch64 ldp in some cases
Status in QEMU:
New
Bug description:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this
will raise an exception. When this happens x0 has already been updated
so after the exception handler has run the operating system will try
to rerun the instruction. QEMU will now try to perform an invalid load
and raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings
implementation of memcpy. This uses a similar instruction when copying
between 64 and 96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1713066/+subscriptions
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
@ 2017-08-25 15:41 ` Peter Maydell
2017-08-25 20:42 ` [Qemu-devel] [Bug 1713066] " Gergely Czuczy
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2017-08-25 15:41 UTC (permalink / raw)
To: Bug 1713066; +Cc: QEMU Developers
On 25 August 2017 at 14:50, Andrew <andrew@fubar.geek.nz> wrote:
> Given the following instruction:
> ldp x0, x1, [x0]
>
> This will load two 64 bit values from memory, however if each location
> to load is on a different page and the second page is unmapped this will
> raise an exception. When this happens x0 has already been updated
Yes, this is a QEMU bug. disas_ldst_pair() should not let the
first load go directly to the target integer register but instead
postpone updating the register until after the second load.
We can safely do this only for the integer load case because
float/vector registers can't be used in address generation so
they're OK to become UNKNOWN.
(D1.14.5 is about interrupts and exceptions that happen during
a multiple-register load or store; for straightforward synchronous
data aborts D1.13.4 is what you want, but the requirements are the
same in any case.)
We got this right for the load/store exclusive pair, so it's only
the plain load pair that needs fixing I think.
thanks
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Qemu-devel] [Bug 1713066] Re: Incorrect handling of aarch64 ldp in some cases
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
2017-08-25 15:41 ` Peter Maydell
@ 2017-08-25 20:42 ` Gergely Czuczy
2017-08-29 11:15 ` Andrew
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Gergely Czuczy @ 2017-08-25 20:42 UTC (permalink / raw)
To: qemu-devel
This might be the cause for my bugreport:
https://bugs.launchpad.net/qemu/+bug/1711316
Marked mine as a duplicate of this, please correct me if I'm wrong.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1713066
Title:
Incorrect handling of aarch64 ldp in some cases
Status in QEMU:
New
Bug description:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this
will raise an exception. When this happens x0 has already been updated
so after the exception handler has run the operating system will try
to rerun the instruction. QEMU will now try to perform an invalid load
and raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings
implementation of memcpy. This uses a similar instruction when copying
between 64 and 96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1713066/+subscriptions
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Qemu-devel] [Bug 1713066] Re: Incorrect handling of aarch64 ldp in some cases
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
2017-08-25 15:41 ` Peter Maydell
2017-08-25 20:42 ` [Qemu-devel] [Bug 1713066] " Gergely Czuczy
@ 2017-08-29 11:15 ` Andrew
2017-08-29 11:47 ` Peter Maydell
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Andrew @ 2017-08-29 11:15 UTC (permalink / raw)
To: qemu-devel
Yes, D1.13.4 is what I want, I'm not completely familiar with this part
of the document.
Based on my reading of gen_load_exclusive I agree that it looks correct,
and loading to a float/vector won't affect the address generation.
I have worked around this in FreeBSD my switching the order of the
registers in the affected load & store, but still have an image I can
test a fix with.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1713066
Title:
Incorrect handling of aarch64 ldp in some cases
Status in QEMU:
New
Bug description:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this
will raise an exception. When this happens x0 has already been updated
so after the exception handler has run the operating system will try
to rerun the instruction. QEMU will now try to perform an invalid load
and raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings
implementation of memcpy. This uses a similar instruction when copying
between 64 and 96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1713066/+subscriptions
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Qemu-devel] [Bug 1713066] Re: Incorrect handling of aarch64 ldp in some cases
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
` (2 preceding siblings ...)
2017-08-29 11:15 ` Andrew
@ 2017-08-29 11:47 ` Peter Maydell
2017-08-30 12:38 ` Andrew
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2017-08-29 11:47 UTC (permalink / raw)
To: qemu-devel
Richard Henderson has posted a patch which should fix this:
http://patchwork.ozlabs.org/patch/806051/
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1713066
Title:
Incorrect handling of aarch64 ldp in some cases
Status in QEMU:
New
Bug description:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this
will raise an exception. When this happens x0 has already been updated
so after the exception handler has run the operating system will try
to rerun the instruction. QEMU will now try to perform an invalid load
and raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings
implementation of memcpy. This uses a similar instruction when copying
between 64 and 96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1713066/+subscriptions
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Qemu-devel] [Bug 1713066] Re: Incorrect handling of aarch64 ldp in some cases
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
` (3 preceding siblings ...)
2017-08-29 11:47 ` Peter Maydell
@ 2017-08-30 12:38 ` Andrew
2017-09-04 17:39 ` Peter Maydell
2017-12-15 15:59 ` Thomas Huth
6 siblings, 0 replies; 8+ messages in thread
From: Andrew @ 2017-08-30 12:38 UTC (permalink / raw)
To: qemu-devel
That patch seems to have fixed the issue. I don't get the segfault I was
previously getting without the patch.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1713066
Title:
Incorrect handling of aarch64 ldp in some cases
Status in QEMU:
New
Bug description:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this
will raise an exception. When this happens x0 has already been updated
so after the exception handler has run the operating system will try
to rerun the instruction. QEMU will now try to perform an invalid load
and raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings
implementation of memcpy. This uses a similar instruction when copying
between 64 and 96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1713066/+subscriptions
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Qemu-devel] [Bug 1713066] Re: Incorrect handling of aarch64 ldp in some cases
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
` (4 preceding siblings ...)
2017-08-30 12:38 ` Andrew
@ 2017-09-04 17:39 ` Peter Maydell
2017-12-15 15:59 ` Thomas Huth
6 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2017-09-04 17:39 UTC (permalink / raw)
To: qemu-devel
This fix has now been committed to master as commit
3e4d91b94ce400326fae0 and will be in QEMU 2.11 (and possibly in some
stable releases before that).
** Changed in: qemu
Status: New => Fix Committed
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1713066
Title:
Incorrect handling of aarch64 ldp in some cases
Status in QEMU:
Fix Committed
Bug description:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this
will raise an exception. When this happens x0 has already been updated
so after the exception handler has run the operating system will try
to rerun the instruction. QEMU will now try to perform an invalid load
and raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings
implementation of memcpy. This uses a similar instruction when copying
between 64 and 96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1713066/+subscriptions
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Qemu-devel] [Bug 1713066] Re: Incorrect handling of aarch64 ldp in some cases
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
` (5 preceding siblings ...)
2017-09-04 17:39 ` Peter Maydell
@ 2017-12-15 15:59 ` Thomas Huth
6 siblings, 0 replies; 8+ messages in thread
From: Thomas Huth @ 2017-12-15 15:59 UTC (permalink / raw)
To: qemu-devel
** Changed in: qemu
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1713066
Title:
Incorrect handling of aarch64 ldp in some cases
Status in QEMU:
Fix Released
Bug description:
In some cases the ldp instruction (and presumably other multi-register
loads and stores) can behave incorrectly.
Given the following instruction:
ldp x0, x1, [x0]
This will load two 64 bit values from memory, however if each location
to load is on a different page and the second page is unmapped this
will raise an exception. When this happens x0 has already been updated
so after the exception handler has run the operating system will try
to rerun the instruction. QEMU will now try to perform an invalid load
and raise a new exception.
I believe this is incorrect as section D.1.14.5 of the ARMv8 reference
manual B.a states that, on taking an exception, registers used in the
generation of addresses are restored to their initial value, so x0
shouldn't be changed, where x1 can be un an unknown state.
I found the issue running FreeBSD with the cortex-strings
implementation of memcpy. This uses a similar instruction when copying
between 64 and 96 bytes.
I've observed this on:
QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.14), Copyright (c) 2003-2008 Fabrice Bellard
And checked I still get the same behaviour on:
QEMU emulator version 2.9.94 (v2.10.0-rc4-dirty)
Git revision: 248b23735645f7cbb503d9be6f5bf825f2a603ab
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1713066/+subscriptions
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2017-12-15 16:11 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-08-25 13:50 [Qemu-devel] [Bug 1713066] [NEW] Incorrect handling of aarch64 ldp in some cases Andrew
2017-08-25 15:41 ` Peter Maydell
2017-08-25 20:42 ` [Qemu-devel] [Bug 1713066] " Gergely Czuczy
2017-08-29 11:15 ` Andrew
2017-08-29 11:47 ` Peter Maydell
2017-08-30 12:38 ` Andrew
2017-09-04 17:39 ` Peter Maydell
2017-12-15 15:59 ` Thomas Huth
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.