From: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
To: Richard Henderson <richard.henderson@linaro.org>
Cc: qemu-devel@nongnu.org, qemu-arm@nongnu.org
Subject: Re: [PATCH v4 00/84] target/arm: Implement FEAT_GCS
Date: Tue, 03 Mar 2026 23:07:15 -0300 [thread overview]
Message-ID: <878qc8e4a4.fsf@linaro.org> (raw)
In-Reply-To: <87tsv1fr54.fsf@linaro.org> (Thiago Jung Bauermann's message of "Sat, 28 Feb 2026 01:06:47 -0300")
Thiago Jung Bauermann <thiago.bauermann@linaro.org> writes:
> I tried using GCS in current QEMU trunk (commit d8a9d97317d0 "Merge tag
> 'pull-target-arm-20260226' of https://gitlab.com/pm215/qemu into
> staging"), but I get this kernel oops with a simple program (attached)
> that just tries to enable GCS using prctl:
>
> [ 226.334899] Unable to handle kernel paging request at virtual address fffff1ffc36c8008
> [ 226.335033] Mem abort info:
> [ 226.335088] ESR = 0x0000000096000004
> [ 226.335117] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 226.335137] SET = 0, FnV = 0
> [ 226.335153] EA = 0, S1PTW = 0
> [ 226.335172] FSC = 0x04: level 0 translation fault
> [ 226.335192] Data abort info:
> [ 226.335208] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> [ 226.335224] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> [ 226.335241] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [ 226.335284] swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000dbe9b000
> [ 226.335306] [fffff1ffc36c8008] pgd=10000000dcfcd003, p4d=0000000000000000
> [ 226.335475] Internal error: Oops: 0000000096000004 [#1] SMP
> [ 226.336917] Modules linked in: tpm_tis tpm_tis_core qrtr sha256 cfg80211 rfkill fuse
> dm_mod drm backlight ipv6 btrfs blake2b libblake2b xor xor_neon raid6_pq zstd_compress
> sm3_ce
> [ 226.337746] CPU: 0 UID: 1000 PID: 950 Comm: simple-gcs Tainted: G M 6.19.0 #2 PREEMPT
> [ 226.337963] Tainted: [M]=MACHINE_CHECK
> [ 226.338035] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-stable202408-prebuilt.qemu.org 08/13/2024
> [ 226.338281] pstate: 21402005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
> [ 226.338411] pc : __get_user_pages+0x4a4/0xc0c
> [ 226.338889] lr : __get_user_pages+0x3fc/0xc0c
> [ 226.338977] sp : ffff800080e236f0
> [ 226.339042] x29: ffff800080e236f0 x28: fff00000c3c21e80 x27: 0000000000000000
> [ 226.339203] x26: 0000000000000000 x25: fff00000c1a988c8 x24: 0000000000000000
> [ 226.339327] x23: 0000ffffa3200000 x22: 000000000000000e x21: 0000000000000000
> [ 226.339453] x20: fff00000c80bc300 x19: 0008000000000000 x18: 0000000000000000
> [ 226.339573] x17: 0000000000000000 x16: ffff95c0712386b8 x15: 0000ffffa363bfff
> [ 226.339699] x14: 0000000000000000 x13: 1ffe000018271e21 x12: fff00000c138f10c
> [ 226.339824] x11: fff00000c138f100 x10: 0000000000000001 x9 : 0000000000000001
> [ 226.339962] x8 : 00c800011b200f41 x7 : fff00000c138f108 x6 : 00000000000008c8
> [ 226.340086] x5 : fffff1ffc36c8000 x4 : ffffc1ffc0000000 x3 : 0000000000000000
> [ 226.340207] x2 : 0000000000104a00 x1 : 0040000000000841 x0 : 0040000000000800
> [ 226.340392] Call trace:
> [ 226.340554] __get_user_pages+0x4a4/0xc0c (P)
> [ 226.340701] get_dump_page+0xe4/0x150
> [ 226.340797] dump_user_range+0x64/0x2e8
> [ 226.340886] elf_core_dump+0xbf8/0xe10
> [ 226.340955] vfs_coredump+0xea0/0x1c80
> [ 226.341026] get_signal+0x644/0x82c
> [ 226.341097] arch_do_signal_or_restart+0x118/0x3c4
> [ 226.341184] exit_to_user_mode_loop+0x104/0x16c
> [ 226.341269] el0_da+0x8c/0x90
> [ 226.341344] el0t_64_sync_handler+0xd0/0xe4
> [ 226.341419] el0t_64_sync+0x198/0x19c
> [ 226.341626] Code: eb00003f 540029a0 924d0113 b6982d88 (f94004a4)
> [ 226.341893] ---[ end trace 0000000000000000 ]---
> [ 226.851631] note: simple-gcs[950] exited with preempt_count 1
>
> This is using Linux kernel v6.19 built with defconfig.
>
> I also tried the QEMU commit corresponding to the last patch in this
> series (af0bd678df72 "tests/tcg/aarch64: Add gcsss") but had the same
> result.
>
> The same binaries work as expected using Arm FVP, so it seems to be
> something in QEMU.
This turned out to be a kernel problem after all.
Using kernel v7.0-rc2 with its defconfig works fine, so I was able to
bisect the problem to this kernel commit from last week:
commit 8a85b3131225 ("arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled")
I did try several kernel versions (as early as v6.13 which was the first
one with GCS enabled) to try to determine whether the problem was in the
kernel or QEMU, but failed.
Sorry for the noise.
--
Thiago
prev parent reply other threads:[~2026-03-04 2:07 UTC|newest]
Thread overview: 102+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-30 5:40 [PATCH v4 00/84] target/arm: Implement FEAT_GCS Richard Henderson
2025-08-30 5:40 ` [PATCH v4 01/84] linux-user/aarch64: Split out signal_for_exception Richard Henderson
2025-08-30 5:40 ` [PATCH v4 02/84] linux-user/aarch64: Check syndrome for EXCP_UDEF Richard Henderson
2025-08-30 5:40 ` [PATCH v4 03/84] linux-user/aarch64: Generate ESR signal records Richard Henderson
2025-08-30 5:40 ` [PATCH v4 04/84] target/arm: Add prot_check parameter to pmsav8_mpu_lookup Richard Henderson
2025-08-30 5:40 ` [PATCH v4 05/84] target/arm: Add in_prot_check to S1Translate Richard Henderson
2025-08-30 5:40 ` [PATCH v4 06/84] target/arm: Skip permission check from arm_cpu_get_phys_page_attrs_debug Richard Henderson
2025-08-30 5:40 ` [PATCH v4 07/84] target/arm: Introduce get_phys_addr_for_at Richard Henderson
2025-08-30 5:40 ` [PATCH v4 08/84] target/arm: Skip AF and DB updates for AccessType_AT Richard Henderson
2026-02-26 17:12 ` Zenghui Yu
2026-02-27 3:01 ` Richard Henderson
2026-03-15 15:14 ` Zenghui Yu
2026-03-20 2:58 ` Richard Henderson
2025-08-30 5:40 ` [PATCH v4 09/84] target/arm: Add prot_check parameter to do_ats_write Richard Henderson
2025-08-30 5:40 ` [PATCH v4 10/84] target/arm: Fill in HFG[RWI]TR_EL2 bits for Arm v9.5 Richard Henderson
2025-08-30 5:40 ` [PATCH v4 11/84] target/arm: Remove outdated comment for ZCR_EL12 Richard Henderson
2025-08-30 5:40 ` [PATCH v4 12/84] target/arm: Implement FEAT_ATS1A Richard Henderson
2025-08-30 5:40 ` [PATCH v4 13/84] target/arm: Add isar feature test for FEAT_S1PIE, FEAT_S2PIE Richard Henderson
2025-08-30 5:40 ` [PATCH v4 14/84] target/arm: Enable TCR2_ELx.PIE Richard Henderson
2025-08-30 5:40 ` [PATCH v4 15/84] target/arm: Implement PIR_ELx, PIRE0_ELx, S2PIR_EL2 registers Richard Henderson
2025-08-30 5:40 ` [PATCH v4 16/84] target/arm: Force HPD for stage2 translations Richard Henderson
2025-08-30 5:40 ` [PATCH v4 17/84] target/arm: Cache NV1 early in get_phys_addr_lpae Richard Henderson
2025-08-30 5:40 ` [PATCH v4 18/84] target/arm: Populate PIE in aa64_va_parameters Richard Henderson
2025-08-30 5:40 ` [PATCH v4 19/84] target/arm: Implement get_S1prot_indirect Richard Henderson
2025-08-30 5:40 ` [PATCH v4 20/84] target/arm: Implement get_S2prot_indirect Richard Henderson
2025-08-30 5:40 ` [PATCH v4 21/84] target/arm: Do not migrate env->exception Richard Henderson
2025-09-08 14:40 ` Peter Maydell
2025-09-15 17:42 ` Richard Henderson
2025-08-30 5:40 ` [PATCH v4 22/84] target/arm: Expand CPUARMState.exception.syndrome to 64 bits Richard Henderson
2025-08-30 5:40 ` [PATCH v4 23/84] target/arm: Expand syndrome parameter to raise_exception* Richard Henderson
2025-08-30 5:40 ` [PATCH v4 24/84] target/arm: Implement dirtybit check for PIE Richard Henderson
2025-08-30 5:40 ` [PATCH v4 25/84] target/arm: Enable FEAT_S1PIE and FEAT_S2PIE on -cpu max Richard Henderson
2025-08-30 5:40 ` [PATCH v4 26/84] include/hw/core/cpu: Introduce MMUIdxMap Richard Henderson
2025-09-08 14:42 ` Peter Maydell
2025-08-30 5:40 ` [PATCH v4 27/84] include/hw/core/cpu: Introduce cpu_tlb_fast Richard Henderson
2025-08-30 5:40 ` [PATCH v4 28/84] include/hw/core/cpu: Invert the indexing into CPUTLBDescFast Richard Henderson
2025-08-30 5:40 ` [PATCH v4 29/84] target/hppa: Adjust mmu indexes to begin with 0 Richard Henderson
2025-08-30 5:40 ` [PATCH v4 30/84] include/exec/memopidx: Adjust for 32 mmu indexes Richard Henderson
2025-08-30 5:40 ` [PATCH v4 31/84] include/hw/core/cpu: Widen MMUIdxMap Richard Henderson
2025-08-30 5:40 ` [PATCH v4 32/84] target/arm: Split out mmuidx.h from cpu.h Richard Henderson
2025-08-30 5:40 ` [PATCH v4 33/84] target/arm: Convert arm_mmu_idx_to_el from switch to table Richard Henderson
2025-08-30 5:40 ` [PATCH v4 34/84] target/arm: Remove unused env argument from regime_el Richard Henderson
2025-08-30 5:40 ` [PATCH v4 35/84] target/arm: Convert regime_el from switch to table Richard Henderson
2025-08-30 5:40 ` [PATCH v4 36/84] target/arm: Convert regime_has_2_ranges " Richard Henderson
2025-08-30 5:40 ` [PATCH v4 37/84] target/arm: Remove unused env argument from regime_is_pan Richard Henderson
2025-08-30 5:40 ` [PATCH v4 38/84] target/arm: Convert regime_is_pan from switch to table Richard Henderson
2025-08-30 5:40 ` [PATCH v4 39/84] target/arm: Remove unused env argument from regime_is_user Richard Henderson
2025-08-30 5:40 ` [PATCH v4 40/84] target/arm: Convert regime_is_user from switch to table Richard Henderson
2025-08-30 5:40 ` [PATCH v4 41/84] target/arm: Convert arm_mmu_idx_is_stage1_of_2 " Richard Henderson
2025-08-30 5:40 ` [PATCH v4 42/84] target/arm: Convert regime_is_stage2 " Richard Henderson
2025-08-30 5:40 ` [PATCH v4 43/84] target/arm: Introduce mmu indexes for GCS Richard Henderson
2025-08-30 5:40 ` [PATCH v4 44/84] target/arm: Introduce regime_to_gcs Richard Henderson
2025-08-30 5:40 ` [PATCH v4 45/84] target/arm: Support page protections for GCS mmu indexes Richard Henderson
2025-08-30 5:40 ` [PATCH v4 46/84] target/arm: Implement gcs bit for data abort Richard Henderson
2025-08-30 5:40 ` [PATCH v4 47/84] target/arm: Add GCS cpregs Richard Henderson
2025-08-30 5:40 ` [PATCH v4 48/84] target/arm: Add GCS enable and trap levels to DisasContext Richard Henderson
2025-08-30 5:40 ` [PATCH v4 49/84] target/arm: Implement FEAT_CHK Richard Henderson
2025-08-30 5:40 ` [PATCH v4 50/84] target/arm: Expand pstate to 64 bits Richard Henderson
2025-09-08 15:57 ` Peter Maydell
2025-09-15 19:45 ` Richard Henderson
2025-08-30 5:40 ` [PATCH v4 51/84] target/arm: Add syndrome data for EC_GCS Richard Henderson
2025-08-30 5:40 ` [PATCH v4 52/84] target/arm: Implement EXLOCKException for ELR_ELx and SPSR_ELx Richard Henderson
2025-09-09 13:14 ` Peter Maydell
2025-08-30 5:40 ` [PATCH v4 53/84] target/arm: Split {arm,core}_user_mem_index Richard Henderson
2025-09-09 13:21 ` Peter Maydell
2025-08-30 5:40 ` [PATCH v4 54/84] target/arm: Introduce delay_exception{_el} Richard Henderson
2025-08-30 5:40 ` [PATCH v4 55/84] target/arm: Emit HSTR trap exception out of line Richard Henderson
2025-09-09 13:33 ` Peter Maydell
2025-09-16 1:00 ` Richard Henderson
2025-08-30 5:41 ` [PATCH v4 56/84] target/arm: Emit v7m LTPSIZE " Richard Henderson
2025-08-30 5:41 ` [PATCH v4 57/84] target/arm: Implement GCSSTR, GCSSTTR Richard Henderson
2025-08-30 5:41 ` [PATCH v4 58/84] target/arm: Implement GCSB Richard Henderson
2025-08-30 5:41 ` [PATCH v4 59/84] target/arm: Implement GCSPUSHM Richard Henderson
2025-08-30 5:41 ` [PATCH v4 60/84] target/arm: Implement GCSPOPM Richard Henderson
2025-08-30 5:41 ` [PATCH v4 61/84] target/arm: Implement GCSPUSHX Richard Henderson
2025-08-30 5:41 ` [PATCH v4 62/84] target/arm: Implement GCSPOPX Richard Henderson
2025-08-30 5:41 ` [PATCH v4 63/84] target/arm: Implement GCSPOPCX Richard Henderson
2025-08-30 5:41 ` [PATCH v4 64/84] target/arm: Implement GCSSS1 Richard Henderson
2025-08-30 5:41 ` [PATCH v4 65/84] target/arm: Implement GCSSS2 Richard Henderson
2025-08-30 5:41 ` [PATCH v4 66/84] target/arm: Add gcs record for BL Richard Henderson
2025-08-30 5:41 ` [PATCH v4 67/84] target/arm: Add gcs record for BLR Richard Henderson
2025-08-30 5:41 ` [PATCH v4 68/84] target/arm: Add gcs record for BLR with PAuth Richard Henderson
2025-09-09 17:17 ` Peter Maydell
2025-08-30 5:41 ` [PATCH v4 69/84] target/arm: Load gcs record for RET Richard Henderson
2025-08-30 5:41 ` [PATCH v4 70/84] target/arm: Load gcs record for RET with PAuth Richard Henderson
2025-08-30 5:41 ` [PATCH v4 71/84] target/arm: Copy EXLOCKEn to EXLOCK on exception to the same EL Richard Henderson
2025-08-30 5:41 ` [PATCH v4 72/84] target/arm: Implement EXLOCK check during exception return Richard Henderson
2025-08-30 5:41 ` [PATCH v4 73/84] target/arm: Enable FEAT_GCS with -cpu max Richard Henderson
2025-08-30 5:41 ` [PATCH v4 74/84] linux-user/aarch64: Implement prctls for GCS Richard Henderson
2025-08-30 5:41 ` [PATCH v4 75/84] linux-user/aarch64: Allocate new gcs stack on clone Richard Henderson
2025-08-30 5:41 ` [PATCH v4 76/84] linux-user/aarch64: Release gcs stack on thread exit Richard Henderson
2025-08-30 5:41 ` [PATCH v4 77/84] linux-user/aarch64: Implement map_shadow_stack syscall Richard Henderson
2025-08-30 5:41 ` [PATCH v4 78/84] target/arm: Enable GCSPR_EL0 for read in user-mode Richard Henderson
2025-08-30 5:41 ` [PATCH v4 79/84] linux-user/aarch64: Inject SIGSEGV for GCS faults Richard Henderson
2025-08-30 5:41 ` [PATCH v4 80/84] linux-user/aarch64: Generate GCS signal records Richard Henderson
2025-08-30 5:41 ` [PATCH v4 81/84] linux-user/aarch64: Enable GCS in HWCAP Richard Henderson
2025-08-30 5:41 ` [PATCH v4 82/84] tests/tcg/aarch64: Add gcsstr Richard Henderson
2025-08-30 5:41 ` [PATCH v4 83/84] tests/tcg/aarch64: Add gcspushm Richard Henderson
2025-08-30 5:41 ` [PATCH v4 84/84] tests/tcg/aarch64: Add gcsss Richard Henderson
2025-09-11 12:18 ` [PATCH v4 00/84] target/arm: Implement FEAT_GCS Peter Maydell
2026-02-28 4:06 ` Thiago Jung Bauermann
2026-03-04 2:07 ` Thiago Jung Bauermann [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878qc8e4a4.fsf@linaro.org \
--to=thiago.bauermann@linaro.org \
--cc=qemu-arm@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=richard.henderson@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox