[PATCH v2] target/loongarch: Fix the vinsgr2vr/vpickve2gr instructions cause system coredump

Song Gao posted 1 patch 11 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20230525120005.2223413-1-gaosong@loongson.cn
Maintainers: Song Gao <gaosong@loongson.cn>, Xiaojuan Yang <yangxiaojuan@loongson.cn>
target/loongarch/insn_trans/trans_lsx.c.inc | 39 ++++++++++++++-------
1 file changed, 26 insertions(+), 13 deletions(-)
[PATCH v2] target/loongarch: Fix the vinsgr2vr/vpickve2gr instructions cause system coredump
Posted by Song Gao 11 months ago
The vinsgr2vr/vpickve2gr instructions need use get_src/get_dst to get
gpr registers value, not cpu_gpr[]. The $zero register does not
have cpu_gpr[0] allocated.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1662

Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/insn_trans/trans_lsx.c.inc | 39 ++++++++++++++-------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_lsx.c.inc b/target/loongarch/insn_trans/trans_lsx.c.inc
index 0be2b5a3a8..68779daff6 100644
--- a/target/loongarch/insn_trans/trans_lsx.c.inc
+++ b/target/loongarch/insn_trans/trans_lsx.c.inc
@@ -3963,106 +3963,119 @@ TRANS(vsetallnez_d, gen_cv, gen_helper_vsetallnez_d)
 
 static bool trans_vinsgr2vr_b(DisasContext *ctx, arg_vr_i *a)
 {
+    TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_st8_i64(cpu_gpr[a->rj], cpu_env,
+    tcg_gen_st8_i64(src, cpu_env,
                     offsetof(CPULoongArchState, fpr[a->vd].vreg.B(a->imm)));
     return true;
 }
 
 static bool trans_vinsgr2vr_h(DisasContext *ctx, arg_vr_i *a)
 {
+    TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_st16_i64(cpu_gpr[a->rj], cpu_env,
+    tcg_gen_st16_i64(src, cpu_env,
                     offsetof(CPULoongArchState, fpr[a->vd].vreg.H(a->imm)));
     return true;
 }
 
 static bool trans_vinsgr2vr_w(DisasContext *ctx, arg_vr_i *a)
 {
+    TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_st32_i64(cpu_gpr[a->rj], cpu_env,
+    tcg_gen_st32_i64(src, cpu_env,
                      offsetof(CPULoongArchState, fpr[a->vd].vreg.W(a->imm)));
     return true;
 }
 
 static bool trans_vinsgr2vr_d(DisasContext *ctx, arg_vr_i *a)
 {
+    TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_st_i64(cpu_gpr[a->rj], cpu_env,
+    tcg_gen_st_i64(src, cpu_env,
                    offsetof(CPULoongArchState, fpr[a->vd].vreg.D(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_b(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld8s_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld8s_i64(dst, cpu_env,
                      offsetof(CPULoongArchState, fpr[a->vj].vreg.B(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_h(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld16s_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld16s_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.H(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_w(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld32s_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld32s_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.W(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_d(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld_i64(dst, cpu_env,
                    offsetof(CPULoongArchState, fpr[a->vj].vreg.D(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_bu(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld8u_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld8u_i64(dst, cpu_env,
                      offsetof(CPULoongArchState, fpr[a->vj].vreg.B(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_hu(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld16u_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld16u_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.H(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_wu(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld32u_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld32u_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.W(a->imm)));
     return true;
 }
 
 static bool trans_vpickve2gr_du(DisasContext *ctx, arg_rv_i *a)
 {
+    TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
     CHECK_SXE;
-    tcg_gen_ld_i64(cpu_gpr[a->rd], cpu_env,
+    tcg_gen_ld_i64(dst, cpu_env,
                    offsetof(CPULoongArchState, fpr[a->vj].vreg.D(a->imm)));
     return true;
 }
 
 static bool gvec_dup(DisasContext *ctx, arg_vr *a, MemOp mop)
 {
+    TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
     CHECK_SXE;
 
     tcg_gen_gvec_dup_i64(mop, vec_full_offset(a->vd),
-                         16, ctx->vl/8, cpu_gpr[a->rj]);
+                         16, ctx->vl/8, src);
     return true;
 }
 
-- 
2.39.1
Re: [PATCH v2] target/loongarch: Fix the vinsgr2vr/vpickve2gr instructions cause system coredump
Posted by Richard Henderson 11 months ago
On 5/25/23 05:00, Song Gao wrote:
> The vinsgr2vr/vpickve2gr instructions need use get_src/get_dst to get
> gpr registers value, not cpu_gpr[]. The $zero register does not
> have cpu_gpr[0] allocated.
> 
> Resolves:https://gitlab.com/qemu-project/qemu/-/issues/1662
> 
> Signed-off-by: Song Gao<gaosong@loongson.cn>
> ---
>   target/loongarch/insn_trans/trans_lsx.c.inc | 39 ++++++++++++++-------
>   1 file changed, 26 insertions(+), 13 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~