Bug 392146 - aarch64: unhandled instruction 0xD5380001 (MRS rT, mdir_el1)
Summary: aarch64: unhandled instruction 0xD5380001 (MRS rT, mdir_el1)
Status: REPORTED
Alias: None
Product: valgrind
Classification: Developer tools
Component: vex (show other bugs)
Version: 3.14 SVN
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Paul Floyd
URL:
Keywords:
: 450203 466732 482013 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-03-21 19:27 UTC by Matthias Brugger
Modified: 2024-04-27 16:41 UTC (History)
8 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
Iplements "mrs <reg>, mdir_el1" for VEX aarch64 (1.13 KB, patch)
2018-03-21 19:42 UTC, Matthias Brugger
Details
implementation of system register emulation (13.48 KB, patch)
2018-05-30 18:13 UTC, Matthias Brugger
Details
Implement emulated system registers. Fixes #392146. (13.51 KB, patch)
2018-06-06 13:26 UTC, Matthias Brugger
Details
Attachment from 466732 (262 bytes, text/x-csrc)
2024-04-27 16:40 UTC, Paul Floyd
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Brugger 2018-03-21 19:27:46 UTC
Tested with kernel v4.12, valgrind crashes when trying to check for memory leaks:

# valgrind --leak-check=yes ../test 
==23307== Memcheck, a memory error detector
==23307== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==23307== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==23307== Command: ../test
==23307== 
ARM64 front end: branch_etc
disInstr(arm64): unhandled instruction 0xD5380001
disInstr(arm64): 1101'0101 0011'1000 0000'0000 0000'0001
==23307== valgrind: Unrecognised instruction at address 0x4015734.

Root cause is missing support for reads of MDIR_EL1
Comment 1 Matthias Brugger 2018-03-21 19:28:18 UTC
I will provide a patch
Comment 2 Matthias Brugger 2018-03-21 19:42:05 UTC
Created attachment 111541 [details]
Iplements "mrs <reg>, mdir_el1" for VEX aarch64
Comment 3 Peter Maydell 2018-03-22 11:26:17 UTC
Hi; your patch consistently typos the register name -- it is MIDR_EL1 (for Main ID Register).

This register is only accessible at EL1 in hardware, though -- I guess your host kernel is emulating accesses to it? Are there other ID register accesses that also now need to be emulated in valgrind because the kernel passes them through to userspace?
Comment 4 Matthias Brugger 2018-03-22 14:00:20 UTC
(In reply to Peter Maydell from comment #3)
> Hi; your patch consistently typos the register name -- it is MIDR_EL1 (for
> Main ID Register).
> 

Uups, thanks for noting. 

> This register is only accessible at EL1 in hardware, though -- I guess your
> host kernel is emulating accesses to it? Are there other ID register
> accesses that also now need to be emulated in valgrind because the kernel
> passes them through to userspace?

I'll have to investigate further on this.

I'll update the after I can confirm that we only need MIDR access, or I'll add the necessary parts as well.
Comment 5 Matthias Brugger 2018-03-29 15:57:39 UTC
the following system registers are emulated by the kernel:
MIDR_EL1
MPIDR_EL1
REVIDR_EL1
ID_AA64PFR0_EL1
ID_AA64PFR1_EL1
ID_AA64ZFR0_EL1
ID_AA64DFR0_EL1
ID_AA64DFR1_EL1
ID_AA64AFR0_EL1
ID_AA64AFR1_EL1
ID_AA64ISAR0_EL1
ID_AA64ISAR1_EL1
ID_AA64MMFR0_EL1
ID_AA64MMFR1_EL1
ID_AA64MMFR2_EL1

I have a patch which just puts faked values into the registers in guest_arm64_toIR.c

But I wonder if we would need to actually provide the real values, as this may have influence on the program flow of the code under inspection.

The registers give information about the underlying HW, like manufacturer, but also about which HW enhancements are present.

Is my assumption correct, that we will need to provide the host values of this registers? Can anyone give guidance in which file/data structure this should be done.
Comment 6 Tom Hughes 2018-03-29 16:23:15 UTC
I think you were already told on IRC when you asked that it should provide results which reflect the capabilities of the emulated environment, which in at least some cases is likely to mean not passing on host values.
Comment 7 Matthias Brugger 2018-05-30 18:13:22 UTC
Created attachment 112966 [details]
implementation of system register emulation

Emulate all system register accesses. Return only the bits that are supported by the emulation environment.
Comment 8 Matthias Brugger 2018-06-06 13:26:02 UTC
Created attachment 113113 [details]
Implement emulated system registers. Fixes #392146.

Updated version of the patch. I flip the registers of the bits which are not supported in the emulation environment in the dirty helper. Following the example of amd's cpuid.
Comment 9 Matthias Brugger 2018-06-06 13:28:26 UTC
Please provide some feedback about the patch.
Comment 10 Matthias Brugger 2018-07-16 12:41:37 UTC
any comments on that?
Comment 11 Matthias Brugger 2018-11-07 12:17:00 UTC
Julian, Peter, any comments on this patch?
Comment 12 Paul Floyd 2024-03-17 10:41:08 UTC
*** Bug 482013 has been marked as a duplicate of this bug. ***
Comment 13 Paul Floyd 2024-03-17 10:50:12 UTC
Do you have any tests for this?
Comment 14 Matthias Brugger 2024-03-18 10:02:03 UTC
I used to have a test for this, but I lost that over the last 6 years.

But under "Implementation" https://bugs.kde.org/show_bug.cgi?id=482013 gives a code snipped that can be easily used to create a test.
Comment 15 Paul Floyd 2024-04-01 06:41:27 UTC
Well it's time for me to look at this again. I just tried to run Firefox on FreeBSD under Valgrind and I got

ARM64 front end: branch_etc
disInstr(arm64): unhandled instruction 0xD5380609
disInstr(arm64): 1101'0101 0011'1000 0000'0110 0000'1001
==2219== valgrind: Unrecognised instruction at address 0xdfa7880.
==2219==    at 0xDFA7880: SkCpu::CacheRuntimeFeatures() (in /usr/local/lib/firefox/libxul.so)
Comment 16 Paul Floyd 2024-04-01 06:50:05 UTC
And the patch seems to work, with the patch FF proceeds until it hits a SIGBUS (which is what I was looking for).

I'll look at it in more detail.
Comment 17 Peter Maydell 2024-04-01 12:17:58 UTC
The Linux kernel documents which ID registers and which fields in those registers it exposes here: https://www.kernel.org/doc/Documentation/arm64/cpu-feature-registers.txt . Does FreeBSD expose the same set, or a different set?
Comment 18 Paul Floyd 2024-04-01 15:17:27 UTC
(In reply to Peter Maydell from comment #17)
> The Linux kernel documents which ID registers and which fields in those
> registers it exposes here:
> https://www.kernel.org/doc/Documentation/arm64/cpu-feature-registers.txt .
> Does FreeBSD expose the same set, or a different set?

I don't know of any such document. I expect that they are similar since FreeBSD has a linux compatibility layer and it sets possibly different HWCAPs for FreeBSD apps and for Linux apps running under the compat layer.
Comment 19 Paul Floyd 2024-04-02 10:33:28 UTC
*** Bug 450203 has been marked as a duplicate of this bug. ***
Comment 20 Paul Floyd 2024-04-27 16:40:48 UTC
Created attachment 168951 [details]
Attachment from 466732
Comment 21 Paul Floyd 2024-04-27 16:41:17 UTC
*** Bug 466732 has been marked as a duplicate of this bug. ***