summary refs log tree commit diff stats
path: root/results/classifier/semantic-bugs/instruction/1204
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-06-12 09:56:59 +0200
committerChristian Krinitsin <mail@krinitsin.com>2025-06-12 09:56:59 +0200
commitb89a938452613061c0f1f23e710281cf5c83cb29 (patch)
treed5faecfd167e088848cad894f8dc9cfef3352e3b /results/classifier/semantic-bugs/instruction/1204
parent7b681b9f9eedaad2f081ae11a32f459f5a1312ff (diff)
downloademulator-bug-study-b89a938452613061c0f1f23e710281cf5c83cb29.tar.gz
emulator-bug-study-b89a938452613061c0f1f23e710281cf5c83cb29.zip
add manually reviewed semantic bugs
Diffstat (limited to 'results/classifier/semantic-bugs/instruction/1204')
-rw-r--r--results/classifier/semantic-bugs/instruction/120442
1 files changed, 42 insertions, 0 deletions
diff --git a/results/classifier/semantic-bugs/instruction/1204 b/results/classifier/semantic-bugs/instruction/1204
new file mode 100644
index 00000000..e47ce874
--- /dev/null
+++ b/results/classifier/semantic-bugs/instruction/1204
@@ -0,0 +1,42 @@
+instruction: 0.457
+device: 0.406
+graphic: 0.397
+semantic: 0.357
+network: 0.356
+socket: 0.345
+assembly: 0.330
+vnc: 0.306
+mistranslation: 0.284
+other: 0.165
+boot: 0.147
+KVM: 0.125
+
+AArch64 unaligned accesses are allowed by QEMU when SCTLR_EL3.A is 0, but SCTLR_EL3.M is also 0
+Description of problem:
+As per the ARM ARM, when address translation is disabled and the access is not done from EL1/0 with HCR_EL2.DC set to 1, data accesses receive the 'Device-nGnRnE' memory attribute (D.8.2.10 The effects of disabling an address translation stage - DDi0487I.a, Page D8-5119).
+Memory regions marked as Device do not support unaligned access.
+Steps to reproduce:
+Run the following snippet under EL3, and notice the last load instruction completes successfully (doesn't raise an alignment fault)
+```
+.balign 8
+.global first_variable
+first_variable:
+      .word 0x1
+.balign 4
+.global second_variable
+second_variable:
+      .word 0x2
+
+no_mmu_sctlr: .dword 0x0000000030C51834
+
+.globl reproducer
+reproducer:
+      ldr  x1, no_mmu_sctlr // A=0,M=0
+      msr  sctlr_el3, x1
+      dsb  sy
+      isb
+
+      ldr  x0, =first_variable
+      ldr  x1, [x0, #0] // Aligned - Success
+      ldr  x1, [x0, #4] // Unaligned - Success??? (Should be failure)
+```