LDTR not properly emulated when MTE tag checks enabled at EL0
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Richard Henderson |
Bug Description
I am trying to boot Android (just the non-GUI parts for now) under QEMU with MTE enabled. This can be done by following the instructions here to build the fvp-eng target with MTE support:
https:/
and launching QEMU with the following command:
qemu-system-aarch64 -kernel $ANDROID_
If I do this then QEMU crashes like so:
**
ERROR:.
Bail out! ERROR:.
The error is caused by an MTE tag check fault from an LDTR instruction in __arch_
I have this patch that gets me past the error but it is unclear whether this is the correct fix since there may be other confusion between TCF and TCF0 elsewhere.
diff --git a/target/
index 153bd1e9df.
--- a/target/
+++ b/target/
@@ -552,10 +552,8 @@ static void mte_check_
case 0:
/*
* Tag check fail does not affect the PE.
- * We eliminate this case by not setting MTE_ACTIVE
- * in tb_flags, so that we never make this runtime call.
*/
- g_assert_
+ break;
case 2:
/* Tag check fail causes asynchronous flag set. */
The workaround patch above is insufficient if I change userspace to set TCF0=1. With that I get a kernel panic:
[ 13.336255][ C0] Bad mode in Synchronous Abort handler detected on CPU0, code 0x92000011 -- DABT (lower EL) rc7-mainline- 00300-gf4328758 abb6 #1 copy_from_ user+0x1e4/ 0x340 user+0xbc/ 0x564 rc7-mainline- 00300-gf4328758 abb6 #1 0x0/0x1e0 0x1c/0x2c 0xd0/0x154 sync+0x0/ 0x5c handler+ 0x64/0x8c copy_from_ user+0x1e4/ 0x340 options+ 0x40/0x1d0 sys_mount+ 0x84/0x13c common+ 0xc0/0x1b4
[ 13.337437][ C0] CPU: 0 PID: 1 Comm: init Not tainted 5.10.0-
[ 13.338086][ C0] Hardware name: linux,dummy-virt (DT)
[ 13.338948][ C0] pstate: 20400005 (nzCv daif +PAN -UAO -TCO BTYPE=--)
[ 13.339951][ C0] pc : __arch_
[ 13.340483][ C0] lr : _copy_from_
[ 13.340930][ C0] sp : ffffffc01000bda0
[ 13.341385][ C0] x29: ffffffc01000bda0
[ 13.342295][ C0] x28: ffffff804011c100
[ 13.342951][ C0]
[ 13.343321][ C0] x27: 0000000000000000
[ 13.343759][ C0] x26: 0000000000000000
[ 13.344178][ C0]
[ 13.344513][ C0] x25: 0000000000000000
[ 13.344954][ C0] x24: 0000000000000000
[ 13.345382][ C0]
[ 13.345713][ C0] x23: 0300007e18aca850
[ 13.346153][ C0] x22: 0300007e18aca860
[ 13.346809][ C0]
[ 13.347144][ C0] x21: ffffff8043d1ef80
[ 13.347596][ C0] x20: 0300007e18aca850
[ 13.348023][ C0]
[ 13.348354][ C0] x19: ffffff8043295000
[ 13.348806][ C0] x18: ffffff8040103c38
[ 13.349232][ C0]
[ 13.349557][ C0] x17: 0000000004000000
[ 13.349998][ C0] x16: 0000007fffffffff
[ 13.350634][ C0]
[ 13.350965][ C0] x15: 0000007f9fed34f8
[ 13.351409][ C0] x14: 006d65747379730c
[ 13.351844][ C0]
[ 13.352167][ C0] x13: 00000000000001ed
[ 13.352610][ C0] x12: 0000000000000000
[ 13.353034][ C0]
[ 13.353358][ C0] x11: 0000000000000000
[ 13.353802][ C0] x10: 0000000000000000
[ 13.354232][ C0]
[ 13.354785][ C0] x9 : 006d65747379730c
[ 13.355236][ C0] x8 : 0000000000000000
[ 13.355673][ C0]
[ 13.355998][ C0] x7 : 0000000000000000
[ 13.356448][ C0] x6 : ffffff8043295040
[ 13.356874][ C0]
[ 13.357200][ C0] x5 : ffffff8043296000
[ 13.357646][ C0] x4 : 0000000000000000
[ 13.358077][ C0]
[ 13.358423][ C0] x3 : 0000000000000001
[ 13.359055][ C0] x2 : 0000000000000f80
[ 13.359497][ C0]
[ 13.359829][ C0] x1 : 0300007e18aca8c0
[ 13.360278][ C0] x0 : ffffff8043295000
[ 13.360705][ C0]
[ 13.362315][ C0] Kernel panic - not syncing: bad mode
[ 13.362377][ C0] CPU: 0 PID: 1 Comm: init Not tainted 5.10.0-
[ 13.362410][ C0] Hardware name: linux,dummy-virt (DT)
[ 13.362442][ C0] Call trace:
[ 13.362474][ C0] dump_backtrace+
[ 13.362507][ C0] show_stack+
[ 13.362539][ C0] dump_stack+
[ 13.362570][ C0] panic+0x158/0x370
[ 13.362602][ C0] bad_el0_
[ 13.362634][ C0] el1_inv+0x3c/0x5c
[ 13.362666][ C0] el1_sync_
[ 13.362698][ C0] el1_sync+0x84/0x140
[ 13.362730][ C0] __arch_
[ 13.362762][ C0] copy_mount_
[ 13.362794][ C0] __arm64_
[ 13.362826][ C0] el0_svc_
[ 13.362858][ C0] do_el0_svc+0x20...