summaryrefslogtreecommitdiffstats
path: root/results/classifier/118/none/1906516
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-06-16 16:59:00 +0000
committerChristian Krinitsin <mail@krinitsin.com>2025-06-16 16:59:33 +0000
commit9aba81d8eb048db908c94a3c40c25a5fde0caee6 (patch)
treeb765e7fb5e9a3c2143c68b0414e0055adb70e785 /results/classifier/118/none/1906516
parentb89a938452613061c0f1f23e710281cf5c83cb29 (diff)
downloademulator-bug-study-9aba81d8eb048db908c94a3c40c25a5fde0caee6.tar.gz
emulator-bug-study-9aba81d8eb048db908c94a3c40c25a5fde0caee6.zip
add 18th iteration of classifier
Diffstat (limited to 'results/classifier/118/none/1906516')
-rw-r--r--results/classifier/118/none/1906516154
1 files changed, 154 insertions, 0 deletions
diff --git a/results/classifier/118/none/1906516 b/results/classifier/118/none/1906516
new file mode 100644
index 00000000..334bc5b4
--- /dev/null
+++ b/results/classifier/118/none/1906516
@@ -0,0 +1,154 @@
+vnc: 0.799
+VMM: 0.761
+ppc: 0.735
+TCG: 0.724
+architecture: 0.712
+permissions: 0.697
+risc-v: 0.690
+assembly: 0.675
+KVM: 0.667
+peripherals: 0.658
+user-level: 0.648
+virtual: 0.635
+graphic: 0.629
+performance: 0.610
+files: 0.591
+PID: 0.591
+arm: 0.590
+socket: 0.577
+debug: 0.573
+hypervisor: 0.571
+mistranslation: 0.563
+network: 0.530
+device: 0.529
+register: 0.525
+semantic: 0.492
+kernel: 0.465
+boot: 0.455
+x86: 0.435
+i386: 0.312
+
+[RISCV] sfence.vma need to end the translation block
+
+QEMU emulator version 5.0.0
+
+sfence.vma will flush the tlb, so after this instruction, the translation block should be end. The following code will only work in single step mode:
+```
+relocate:
+ li a0, OFFSET
+
+ la t0, 1f
+ add t0, t0, a0
+ csrw stvec, t0
+
+ la t0, early_pgtbl
+ srl t0, t0, PAGE_SHIFT
+ li t1, SATP_SV39
+ or t0, t1, t0
+
+ csrw satp, t0
+1:
+ sfence.vma
+ la t0, trap_s
+ csrw stvec, t0
+ ret
+```
+
+In this code, I want to relocate pc to virtual address with the OFFSET prefix, before writing to satp, pc run at physic address, stvec has been set a label 1 with a virtual prefix and virtual address has been mapping in early_pgtbl, after writing satp, there will throw a page fault, and pc will set to virtual address of label 1.
+
+The problem is that, in this situation, the translation block will not end after sfence.vma, and stvec will be set to trap_s,
+
+```
+----------------
+IN:
+Priv: 1; Virt: 0
+0x00000000800000dc: 00a080b3 add ra,ra,a0
+0x00000000800000e0: 00007297 auipc t0,28672 # 0x800070e0
+0x00000000800000e4: f2028293 addi t0,t0,-224
+0x00000000800000e8: 00c2d293 srli t0,t0,12
+0x00000000800000ec: fff0031b addiw t1,zero,-1
+0x00000000800000f0: 03f31313 slli t1,t1,63
+0x00000000800000f4: 005362b3 or t0,t1,t0
+0x00000000800000f8: 18029073 csrrw zero,satp,t0
+
+----------------
+IN:
+Priv: 1; Virt: 0
+0x00000000800000fc: 12000073 sfence.vma zero,zero
+0x0000000080000100: 00000297 auipc t0,0 # 0x80000100
+0x0000000080000104: 1c828293 addi t0,t0,456
+0x0000000080000108: 10529073 csrrw zero,stvec,t0
+
+riscv_raise_exception: 12
+riscv_raise_exception: 12
+riscv_raise_exception: 12
+riscv_raise_exception: 12
+...
+```
+
+So, the program will crash, and the program will work in single step mode:
+```
+----------------
+IN:
+Priv: 1; Virt: 0
+0x00000000800000f8: 18029073 csrrw zero,satp,t0
+
+----------------
+IN:
+Priv: 1; Virt: 0
+0x00000000800000fc: 12000073 sfence.vma zero,zero
+
+riscv_raise_exception: 12
+----------------
+IN:
+Priv: 1; Virt: 0
+0xffffffff800000fc: 12000073 sfence.vma zero,zero
+
+----------------
+IN:
+Priv: 1; Virt: 0
+0xffffffff80000100: 00000297 auipc t0,0 # 0xffffffff80000100
+
+```
+The pc will set to label 1, instead of trap_s.
+
+I try to patch the code in fence.i in trans_rvi.inc.c to sfence.vma:
+```
+ tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
+ exit_tb(ctx);
+ ctx->base.is_jmp = DISAS_NORETURN;
+```
+This codes can help to end the tranlate block, since I'm not a qemu guy, I'm not sure if this is a corret method.
+
+The QEMU project is currently moving its bug tracking to another system.
+For this we need to know which bugs are still valid and which could be
+closed already. Thus we are setting the bug state to "Incomplete" now.
+
+If the bug has already been fixed in the latest upstream version of QEMU,
+then please close this ticket as "Fix released".
+
+If it is not fixed yet and you think that this bug report here is still
+valid, then you have two options:
+
+1) If you already have an account on gitlab.com, please open a new ticket
+for this problem in our new tracker here:
+
+ https://gitlab.com/qemu-project/qemu/-/issues
+
+and then close this ticket here on Launchpad (or let it expire auto-
+matically after 60 days). Please mention the URL of this bug ticket on
+Launchpad in the new ticket on GitLab.
+
+2) If you don't have an account on gitlab.com and don't intend to get
+one, but still would like to keep this ticket opened, then please switch
+the state back to "New" or "Confirmed" within the next 60 days (other-
+wise it will get closed as "Expired"). We will then eventually migrate
+the ticket automatically to the new system (but you won't be the reporter
+of the bug in the new system and thus you won't get notified on changes
+anymore).
+
+Thank you and sorry for the inconvenience.
+
+
+[Expired for QEMU because there has been no activity for 60 days.]
+