Skip to content

Instantly share code, notes, and snippets.

View Skryptonyte's full-sized avatar

Rayhan Faizel Skryptonyte

  • Manipal Institute of Technology
  • India
  • 02:13 (UTC +05:30)
View GitHub Profile
@Skryptonyte
Skryptonyte / TSO_inside_VM.md
Last active December 8, 2023 14:52
A poor attempt at trying to change TSO bits inside a Parallels VM

As a quick recap, TSO or Total storing ordering is an M1 exclusive feature that enforces strong memory ordering similar to x86. The advantage of this is that emulators don't have to use fencing on weak memory model systems, notably most ARM systems. This gives a massive performance boost.

I wanted to intentionally turn off TSO inside an Ubuntu parallels VM with x86_64 emulation to test some linux binaries of my own which purposefully exploit weak order models to demonstrate some example race conditions. Ideally, it would have been as simple as writing a kernel driver to write bit 1 of ACTLR_EL1 on each core... but not really.

Before I dive into this, I'd recommend reading a bit about exception levels in ARM. The linux kernel runs at EL1 and the hypervisor operates at EL2. Now back to the topic at hand, it seemed like ACTLR_EL1 was frozen as 0 which seemed very odd due to my previous lack of understanding of how VHE works on ARM.

Marcan recently did a write up of the working of TSO on M1 https://gist.githu