diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-07-08 13:28:15 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-07-08 13:28:28 +0200 |
| commit | 5aa276efcbd67f4300ca1a7f809c6e00aadb03da (patch) | |
| tree | 9b8f0e074014cda8d42f5a97a95bc25082d8b764 /results/classifier/zero-shot-user-mode/output/instruction/514 | |
| parent | 1a3c4faf4e0a25ed0b86e8739d5319a634cb9112 (diff) | |
| download | emulator-bug-study-5aa276efcbd67f4300ca1a7f809c6e00aadb03da.tar.gz emulator-bug-study-5aa276efcbd67f4300ca1a7f809c6e00aadb03da.zip | |
restructure results
Diffstat (limited to 'results/classifier/zero-shot-user-mode/output/instruction/514')
| -rw-r--r-- | results/classifier/zero-shot-user-mode/output/instruction/514 | 31 |
1 files changed, 0 insertions, 31 deletions
diff --git a/results/classifier/zero-shot-user-mode/output/instruction/514 b/results/classifier/zero-shot-user-mode/output/instruction/514 deleted file mode 100644 index b9dbd2db..00000000 --- a/results/classifier/zero-shot-user-mode/output/instruction/514 +++ /dev/null @@ -1,31 +0,0 @@ -instruction: 0.720 -runtime: 0.146 -syscall: 0.134 - - - -MTE reports false positive for "str" instruction with the SP as the base register. -Description of problem: -When PE executes "sp"-based store instruction with offset I got tag check fault exception. But according to arm spec. load or store that uses "sp" register should generate Tag Unchecked access. -Steps to reproduce: -Clang version: clang version 12.0.1. -I compiled my code using "-target aarch64-linux -march=armv8+memtag -fsanitize=memtag" for Clang. Clang generates following code: -``` -0000000000000c14 <test_func>: - c14: a9bc7bfd stp x29, x30, [sp, #-64]! - c18: f9000bf7 str x23, [sp, #16] - ... -``` -Whole stack was mapped in translation tables as Tagged memory."SCTLR" register was configured to trigger synchronous exception on tag mismatch. -When cpu executes firs instruction "stp x29, x30, [sp, #-64]!" I got tag check fault exception: "0b010001 When FEAT_MTE is implemented Synchronous Tag Check Fault": -ESR_EL1=0x96000051. - -According to ARM specification load or store that uses "sp" register should generate Tag Unchecked access: -``` -A Tag Unchecked access will be generated for a load or store that uses either of the following: -• A base register only, with the SP as the base register. -• A base register plus immediate offset addressing form, with the SP as the base register. -``` -Looks like qemu erroneously generates tag mismatch exceptions for SP-based loads and stores with immediate offset. -Additional information: - |
