Xtensa configuration overlays for recent releases may have special
registers for which [rwx]sr opcodes are defined, but they are not listed
as SR in xtensa_sysreg_name and associated functions. As a result
generic translate_[rwx]sr* functions generate access to uninitialized
cpu_SR causing segfault at runtime.
Don't try to access cpu_SR for such registers, ignore writes and return
0 for reads.
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
---
target/xtensa/translate.c | 48 +++++++++++++++++++++++++++------------
1 file changed, 34 insertions(+), 14 deletions(-)
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index e0beaf7abbbd..546d2fa2facf 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -2191,7 +2191,11 @@ static void translate_rsil(DisasContext *dc, const OpcodeArg arg[],
static void translate_rsr(DisasContext *dc, const OpcodeArg arg[],
const uint32_t par[])
{
- tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
+ if (sr_name[par[0]]) {
+ tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
+ } else {
+ tcg_gen_movi_i32(arg[0].out, 0);
+ }
}
static void translate_rsr_ccount(DisasContext *dc, const OpcodeArg arg[],
@@ -2563,13 +2567,17 @@ static void translate_wrmsk_expstate(DisasContext *dc, const OpcodeArg arg[],
static void translate_wsr(DisasContext *dc, const OpcodeArg arg[],
const uint32_t par[])
{
- tcg_gen_mov_i32(cpu_SR[par[0]], arg[0].in);
+ if (sr_name[par[0]]) {
+ tcg_gen_mov_i32(cpu_SR[par[0]], arg[0].in);
+ }
}
static void translate_wsr_mask(DisasContext *dc, const OpcodeArg arg[],
const uint32_t par[])
{
- tcg_gen_andi_i32(cpu_SR[par[0]], arg[0].in, par[2]);
+ if (sr_name[par[0]]) {
+ tcg_gen_andi_i32(cpu_SR[par[0]], arg[0].in, par[2]);
+ }
}
static void translate_wsr_acchi(DisasContext *dc, const OpcodeArg arg[],
@@ -2775,23 +2783,31 @@ static void translate_xor(DisasContext *dc, const OpcodeArg arg[],
static void translate_xsr(DisasContext *dc, const OpcodeArg arg[],
const uint32_t par[])
{
- TCGv_i32 tmp = tcg_temp_new_i32();
+ if (sr_name[par[0]]) {
+ TCGv_i32 tmp = tcg_temp_new_i32();
- tcg_gen_mov_i32(tmp, arg[0].in);
- tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
- tcg_gen_mov_i32(cpu_SR[par[0]], tmp);
- tcg_temp_free(tmp);
+ tcg_gen_mov_i32(tmp, arg[0].in);
+ tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
+ tcg_gen_mov_i32(cpu_SR[par[0]], tmp);
+ tcg_temp_free(tmp);
+ } else {
+ tcg_gen_movi_i32(arg[0].out, 0);
+ }
}
static void translate_xsr_mask(DisasContext *dc, const OpcodeArg arg[],
const uint32_t par[])
{
- TCGv_i32 tmp = tcg_temp_new_i32();
+ if (sr_name[par[0]]) {
+ TCGv_i32 tmp = tcg_temp_new_i32();
- tcg_gen_mov_i32(tmp, arg[0].in);
- tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
- tcg_gen_andi_i32(cpu_SR[par[0]], tmp, par[2]);
- tcg_temp_free(tmp);
+ tcg_gen_mov_i32(tmp, arg[0].in);
+ tcg_gen_mov_i32(arg[0].out, cpu_SR[par[0]]);
+ tcg_gen_andi_i32(cpu_SR[par[0]], tmp, par[2]);
+ tcg_temp_free(tmp);
+ } else {
+ tcg_gen_movi_i32(arg[0].out, 0);
+ }
}
static void translate_xsr_ccount(DisasContext *dc, const OpcodeArg arg[],
@@ -2819,7 +2835,11 @@ static void translate_xsr_ccount(DisasContext *dc, const OpcodeArg arg[],
{ \
TCGv_i32 tmp = tcg_temp_new_i32(); \
\
- tcg_gen_mov_i32(tmp, cpu_SR[par[0]]); \
+ if (sr_name[par[0]]) { \
+ tcg_gen_mov_i32(tmp, cpu_SR[par[0]]); \
+ } else { \
+ tcg_gen_movi_i32(tmp, 0); \
+ } \
translate_wsr_##name(dc, arg, par); \
tcg_gen_mov_i32(arg[0].out, tmp); \
tcg_temp_free(tmp); \
--
2.20.1
Patchew URL: https://patchew.org/QEMU/20200430113915.19550-1-jcmvbkbc@gmail.com/
Hi,
This series failed the docker-quick@centos7 build test. Please find the testing commands and
their output below. If you have Docker installed, you can probably reproduce it
locally.
=== TEST SCRIPT BEGIN ===
#!/bin/bash
make docker-image-centos7 V=1 NETWORK=1
time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
=== TEST SCRIPT END ===
TEST check-unit: tests/test-qht-par
socket_accept failed: Resource temporarily unavailable
**
ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake: assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
/tmp/qemu-test/src/tests/qtest/libqtest.c:166: kill_qemu() tried to terminate QEMU process but encountered exit status 1 (expected 0)
ERROR - Bail out! ERROR:/tmp/qemu-test/src/tests/qtest/libqtest.c:301:qtest_init_without_qmp_handshake: assertion failed: (s->fd >= 0 && s->qmp_fd >= 0)
make: *** [check-qtest-aarch64] Error 1
make: *** Waiting for unfinished jobs....
TEST check-unit: tests/test-bitops
TEST iotest-qcow2: 025
---
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['sudo', '-n', 'docker', 'run', '--label', 'com.qemu.instance.uuid=5f17dd67f5d942edac1d0616183b3262', '-u', '1003', '--security-opt', 'seccomp=unconfined', '--rm', '-e', 'TARGET_LIST=', '-e', 'EXTRA_CONFIGURE_OPTS=', '-e', 'V=', '-e', 'J=14', '-e', 'DEBUG=', '-e', 'SHOW_ENV=1', '-e', 'CCACHE_DIR=/var/tmp/ccache', '-v', '/home/patchew2/.cache/qemu-docker-ccache:/var/tmp/ccache:z', '-v', '/var/tmp/patchew-tester-tmp-04y0os7n/src/docker-src.2020-04-30-17.50.22.19896:/var/tmp/qemu:z,ro', 'qemu:centos7', '/var/tmp/qemu/run', 'test-quick']' returned non-zero exit status 2.
filter=--filter=label=com.qemu.instance.uuid=5f17dd67f5d942edac1d0616183b3262
make[1]: *** [docker-run] Error 1
make[1]: Leaving directory `/var/tmp/patchew-tester-tmp-04y0os7n/src'
make: *** [docker-run-test-quick@centos7] Error 2
real 16m41.463s
user 0m9.522s
The full log is available at
http://patchew.org/logs/20200430113915.19550-1-jcmvbkbc@gmail.com/testing.docker-quick@centos7/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com
© 2016 - 2025 Red Hat, Inc.