[Bug libc/31492] New: ARM ldp instruction trigger bus error when kernel open option CONFIG_IO_STRICT_DEVMEM

[Bug libc/31492] New: ARM ldp instruction trigger bus error when kernel open option CONFIG_IO_STRICT_DEVMEM

[luofengwc at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31492

            Bug ID: 31492
           Summary: ARM ldp instruction trigger bus error when kernel open
                    option CONFIG_IO_STRICT_DEVMEM
           Product: glibc
           Version: 2.34
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: luofengwc at qq dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Hi, everyone, I encountered a runtime problem with bus errror caused by the ldp
instruction(ARM instruction).
On an aarch architecture Linux machine, when I turned on the option kernel
option CONFIG_IO_STRICT_DEVMEM, mapped the memory of /dev/mem using mmap, and
used the ldp instruction to read the data, a bus error occurred, but ldr and
ldrp ran normally.

Why do i think this problem is related to glibc because the ldp command is also
used in memcpy. when use memcpy to copy /dev/mem data, alos has bus error;

check kernel CONFIG_IO_STRICT_DEVMEM optoins
```
zcat /proc/config.gz | grep CONFIG_IO_STRICT_DEVMEM
CONFIG_IO_STRICT_DEVMEM=y
```
code example: demo.c

```
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <string.h>
#include <stdlib.h>

typedef char u8;

int main() {
        off_t base = 9654697984;
        void *p;
        int fd;
        int len = 724;

        struct stat statbuf;
        off_t mmoffset;
        void *mmp;

        if ((fd = open("/dev/mem", O_RDONLY)) == -1)
        {
                printf("%d\n",__LINE__);
                return NULL;
        }

        if ((p = malloc(len)) == NULL)
        {
                printf("%d\n",__LINE__);
                return NULL;
        }

        if (fstat(fd, &statbuf) == -1)
        {
                printf("%d\n",__LINE__);
                return NULL;
        }


        mmoffset = base % sysconf(_SC_PAGESIZE);

        printf("0");
        mmp = mmap(NULL, mmoffset + len, PROT_READ, MAP_SHARED, fd, base -
mmoffset);
        if (mmp == MAP_FAILED)
                return 0;

        long output;

        __asm__(
                "ldrb w0, [x0]"
                : "=r" (output)
                : "r" (mmp+mmoffset)
        );

        __asm__(
                "ldr x0, [x0]"
                : "=r" (output)
                : "r" (mmp+mmoffset)
        );
        // ldp trigger bus error
        __asm__(
                "ldp x0, x1, [x0]"
                : "=r" (output)         
                : "r" (mmp+mmoffset)
        );


        if (munmap(mmp, mmoffset + len) == -1)
        {
                return NULL;
        }

        printf("\noutput = %ld\n",output);

  return 0;
}
```
compile command with none optimization

```
gcc -O0 demo.c  -g
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31492] ARM ldp instruction trigger bus error when kernel open option CONFIG_IO_STRICT_DEVMEM

[luofengwc at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31492

--- Comment #1 from luofeng14 <luofengwc at qq dot com> ---
and please use root to execute demo

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31492] ARM ldp instruction trigger bus error when kernel open option CONFIG_IO_STRICT_DEVMEM

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31492

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
You use the x0 and x1 registers, but you don't tell the compiler about it.
Anything may happen as a result.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31492] ARM ldp instruction trigger bus error when kernel open option CONFIG_IO_STRICT_DEVMEM

[luofengwc at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31492

--- Comment #3 from luofeng14 <luofengwc at qq dot com> ---
(In reply to Florian Weimer from comment #2)
> You use the x0 and x1 registers, but you don't tell the compiler about it.
> Anything may happen as a result.

there may be some misunderstandings about the problem, actually, i encountered
this problem

```
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <string.h>
#include <stdlib.h>

typedef char u8;

void * func(void)
{
        off_t base = 9654697984;
        void *p;
        int fd;
        int len = 724;
        // scanf ("%d",&len);

        struct stat statbuf;
        off_t mmoffset;
        void *mmp;

        if ((fd = open("/dev/mem", O_RDONLY)) == -1)
        {
                printf("%d\n",__LINE__);
                return NULL;
        }

        if ((p = malloc(len)) == NULL)
        {
                printf("%d\n",__LINE__);
                return NULL;
        }

        if (fstat(fd, &statbuf) == -1)
        {
                printf("%d\n",__LINE__);
                return NULL;
        }


    mmoffset = base % sysconf(_SC_PAGESIZE);
        mmp = mmap(NULL, mmoffset + len, PROT_READ, MAP_SHARED, fd, base -
mmoffset);
        if (mmp == MAP_FAILED)
                return 0;
        memcpy(p, (char *)mmp + mmoffset, len);

        if (munmap(mmp, mmoffset + len) == -1)
        {
                return NULL;
        }

  return p;
}
int main() {
  if(!func())
    return -1;
  return 0;
}

```
in above code, the ldp command is also used in memcpy. when use memcpy to copy
/dev/mem data, alos has bus error;

using inline assembly is to simplify the problem

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31492] ARM ldp instruction trigger bus error when kernel open option CONFIG_IO_STRICT_DEVMEM

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31492

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg

--- Comment #4 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
This is most likely unaligned access to a device region (due to the
CONFIG_IO_STRICT_DEVMEM), which is not supported by the ISA [1]. Although the
input is aligned, aarch64 memcpy assumes unaligned access;the size of '724'
will trigger the 'copy_long' branch, which copies a multiple of 128 bytes, with
the remaining 84 bytes that it is not aligned to 8 bytes (thus potentially
triggering an unaligned load of the 'copy64_from_end' code path.

We had a similar issue on POWER, which prevented us from adding an unaligned
memcpy optimization as default because memcpy was used in some video drivers on
non-cacheable memory and unaligned VSX operations triggered some bad
performance issues (it is essentially emulated by the kernel). We had to gate
this optimization through a tunable instead [2].

You can raise this to ARM maintainers, but I think it is unlikely that they
will change the default implementation to avoid unaligned access since this is
really a performance improvement for all cases.

[1]
https://developer.arm.com/documentation/102376/0200/Alignment-and-endianness/Alignment
[2] https://sourceware.org/pipermail/libc-alpha/2017-December/089357.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31492] ARM ldp instruction trigger bus error when kernel open option CONFIG_IO_STRICT_DEVMEM

[luofengwc at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31492

--- Comment #5 from luofeng14 <luofengwc at qq dot com> ---
(In reply to Adhemerval Zanella from comment #4)
> This is most likely unaligned access to a device region (due to the
> CONFIG_IO_STRICT_DEVMEM), which is not supported by the ISA [1]. Although
> the input is aligned, aarch64 memcpy assumes unaligned access;the size of
> '724' will trigger the 'copy_long' branch, which copies a multiple of 128
> bytes, with the remaining 84 bytes that it is not aligned to 8 bytes (thus
> potentially triggering an unaligned load of the 'copy64_from_end' code path.
> 
> We had a similar issue on POWER, which prevented us from adding an unaligned
> memcpy optimization as default because memcpy was used in some video drivers
> on non-cacheable memory and unaligned VSX operations triggered some bad
> performance issues (it is essentially emulated by the kernel). We had to
> gate this optimization through a tunable instead [2].
> 
> You can raise this to ARM maintainers, but I think it is unlikely that they
> will change the default implementation to avoid unaligned access since this
> is really a performance improvement for all cases.
> 
> [1]
> https://developer.arm.com/documentation/102376/0200/Alignment-and-endianness/
> Alignment
> [2] https://sourceware.org/pipermail/libc-alpha/2017-December/089357.html

Zanella thanks your reply

-- 
You are receiving this mail because:
You are on the CC list for the bug.