summary refs log tree commit diff stats
path: root/results/classifier/gemma3:12b/peripherals/925
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-07-03 07:27:52 +0000
committerChristian Krinitsin <mail@krinitsin.com>2025-07-03 07:27:52 +0000
commitd0c85e36e4de67af628d54e9ab577cc3fad7796a (patch)
treef8f784b0f04343b90516a338d6df81df3a85dfa2 /results/classifier/gemma3:12b/peripherals/925
parent7f4364274750eb8cb39a3e7493132fca1c01232e (diff)
downloadqemu-analysis-d0c85e36e4de67af628d54e9ab577cc3fad7796a.tar.gz
qemu-analysis-d0c85e36e4de67af628d54e9ab577cc3fad7796a.zip
add deepseek and gemma results
Diffstat (limited to 'results/classifier/gemma3:12b/peripherals/925')
-rw-r--r--results/classifier/gemma3:12b/peripherals/92519
1 files changed, 19 insertions, 0 deletions
diff --git a/results/classifier/gemma3:12b/peripherals/925 b/results/classifier/gemma3:12b/peripherals/925
new file mode 100644
index 000000000..e242effc4
--- /dev/null
+++ b/results/classifier/gemma3:12b/peripherals/925
@@ -0,0 +1,19 @@
+
+AArch64 SVE2 LD/ST instructions segfault on MMIO addresses
+Description of problem:
+During execution of the following SVE2 instruction: `ld1b {z9.s}, p2/z, [x17, z26.s, sxtw]` with the following register state:
+```
+(gdb) p $x17
+$1 = 0xffffffe2
+(gdb) p $z26.s.u
+$2 = {0x0 <repeats 16 times>}
+(gdb) p $p2
+$3 = {0xc4, 0x0, 0x9d, 0x0, 0xe5, 0x0, 0x83, 0x0, 0x80, 0xce, 0x3f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, 0x1a, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0, 0xd8, 0x96, 0xee, 0xfc, 0x7f, 0x0, 0x0, 0x50, 0xce, 0x94, 0x1, 0x0, 0x0, 0x0, 0x0, 0xf0, 0xd8, 0x96, 0xee, 0xfc, 0x7f, 0x0, 0x0, 0x10, 0x38, 0x40, 0x3, 0x0, 0x0, 0x0, 0x0}
+```
+QEMU segfaults due to a null pointer access. Note that after translation this address is an MMIO address that points to a UART device.
+Additional information:
+A quick look at the implementation of the SVE2 load/store host memory access functions I've noticed that the `TLB_MMIO` flag is ignored in `sve_probe_page`, which means that users use the (null) host address as if it was pointing to real memory. This function (or the ones above it) should (probably) throw the appropriate external data abort, otherwise this needs to be instrumented to support reading from MMIO mapped devices.
+
+<details><summary>Reproducer seed for my future self</summary>
+S6008340160849309262|Q|cd4t|pq|w5|lK124
+</details>