From nobody Sat May 30 19:23:37 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1777493046; cv=none; d=zohomail.com; s=zohoarc; b=BShX/EJLlNvMs2gtIc4e4Yk/vvqiIvnuTXLljk64vL1ZkHiAfb527ltKkAB4ZzfPGvK2ROa/S6TxyfupJf62DBxuJpAw8LIHleixRl21J4Z2/2/W+raGyuU7meunXpDN+2ms7n0xm2uD1HtVlk75NipmCd8NIqmHJBIDVyvawAM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1777493046; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=hTTlPltB87Jiy4ggwrXJ/CgZ7x1nyauhJv2LXZKrUW0=; b=ZE/bViSWcCfMItaNpY/UOMI40aU43whErk9b2dGRlw5Fyn66+XnATCz9T/1ifIkYrCc2WMgM7sHBa+6luodYntBCIv19fDvNFHBevJmz5S1ruRRNBWF6lWwJpqeupT7v/p9yPRiY6csMHqW5dnmBUrpdc+Hr5EwTs6XAskH8b9M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177749304647349.0400380257563; Wed, 29 Apr 2026 13:04:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wIB89-0003dj-Ts; Wed, 29 Apr 2026 16:03:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wI8M7-0005I5-Nd for qemu-devel@nongnu.org; Wed, 29 Apr 2026 13:05:47 -0400 Received: from a-painless.mh.aa.net.uk ([2001:8b0:0:30::51]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wI8M5-00057n-UD for qemu-devel@nongnu.org; Wed, 29 Apr 2026 13:05:47 -0400 Received: from thunderhill.nvidia.com ([216.228.112.22] helo=jholdsworth-sail.nvidia.com) by painless-a.thn.aa.net.uk with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wI8M3-00000003iOT-0qNL; Wed, 29 Apr 2026 18:05:43 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=airwebreathe.org.uk; s=aaisp1; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To: Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=hTTlPltB87Jiy4ggwrXJ/CgZ7x1nyauhJv2LXZKrUW0=; b=k2RnfBXCo9otN1fWJiJvc4EIQ8 wLqMiI6hNhRMcs8HmFLgmLtzrWd1AIaQekvIei1imdRtjj45ho1QmpFNzmjWyhz4UMrFThpHm3zAP cCCyCWavW8XJ5hJNnDPqkkeSqwGnKuaJe7yXatw9cYg4xQTctRhwlDtRHy0wna7atBRrQuGZMgOeN xfXonDsv5yMSFLmM977hc4gnjKxGX3dm+pOaFJTJI9Ng42WUbUfLK88NfP34R+Npv171z2WlzCGbM 9Y397MQf/TE/PmY0KHn42UOIinWQTQYDdteKKoTFu6ZaYMI9VrtK3qYE5dl3b9epO2qJOlCIBvYF4 ZAoaWMbw==; To: qemu-devel@nongnu.org Cc: Stafford Horne , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Joel Holdsworth Subject: [PATCH 1/2] target/or1k: fix gen_mulu using signed multiply for unsigned operation Date: Wed, 29 Apr 2026 10:03:58 -0700 Message-ID: <20260429170519.2137725-2-joel@airwebreathe.org.uk> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20260429170519.2137725-1-joel@airwebreathe.org.uk> References: <20260429170519.2137725-1-joel@airwebreathe.org.uk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2001:8b0:0:30::51; envelope-from=joel@airwebreathe.org.uk; helo=a-painless.mh.aa.net.uk X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Wed, 29 Apr 2026 16:03:01 -0400 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: joel@airwebreathe.org.uk From: joel--- via qemu development Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1777493049353154100 Content-Type: text/plain; charset="utf-8" From: Joel Holdsworth gen_mulu() uses tcg_gen_muls2_i32 (signed widening multiply) but it implements the l.mulu instruction which is an unsigned multiply. The low 32-bit result is the same either way, but the high word written to cpu_sr_cy (used for carry/overflow detection) will be incorrect when the sign bits of the operands differ. Switch to tcg_gen_mulu2_i32 so the carry flag is computed correctly. Signed-off-by: Joel Holdsworth Reviewed-by: Richard Henderson --- target/or1k/translate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/or1k/translate.c b/target/or1k/translate.c index eb4485312f..1602e204fe 100644 --- a/target/or1k/translate.c +++ b/target/or1k/translate.c @@ -269,7 +269,7 @@ static void gen_mul(DisasContext *dc, TCGv_i32 dest, static void gen_mulu(DisasContext *dc, TCGv_i32 dest, TCGv_i32 srca, TCGv_i32 srcb) { - tcg_gen_muls2_i32(dest, cpu_sr_cy, srca, srcb); + tcg_gen_mulu2_i32(dest, cpu_sr_cy, srca, srcb); tcg_gen_setcondi_i32(TCG_COND_NE, cpu_sr_cy, cpu_sr_cy, 0); =20 gen_ove_cy(dc); --=20 2.51.2 From nobody Sat May 30 19:23:37 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1777493097; cv=none; d=zohomail.com; s=zohoarc; b=b+iKX50Z59LDcL9cGFAyd4PlMdKXUA+4SPaw1QgeZBtMTo24SRDWW8WeAC6nVUaOwXMQtUuJ6KU2RhtFp1DqD/RdpBLR68wFsDNgHjajaZ8QuyT7+THKeOTTVMnWu21XTT7gLMmcoSsHeECWuRgsYisj3bWO/Yg68wECd3u4hlQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1777493097; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=4HlHIUCCfVNq7SnCRPG2LedBEmtBcE0/hKTviMJSuM0=; b=kS2N4B2qHDyK7zLXsgFtKHWMIkKQeJVAlItTKG2ybdFx1N2LY5hr3vlxzUXkUobkRQTwnG2ZqdX0GA/WdpyZBXbzRQvStNhw2i3p9q0rZvpRXJMV4HJMG5oqU6jtdrkBtvwIoPpcYkrVh1akLo1x4itLaMv8V6f/e+OjQh5uMfI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1777493097423850.5388782250016; Wed, 29 Apr 2026 13:04:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wIB7z-0003ZY-Ns; Wed, 29 Apr 2026 16:03:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wI8M7-0005I6-Nt for qemu-devel@nongnu.org; Wed, 29 Apr 2026 13:05:47 -0400 Received: from a-painless.mh.aa.net.uk ([2001:8b0:0:30::51]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wI8M5-00057y-RV for qemu-devel@nongnu.org; Wed, 29 Apr 2026 13:05:47 -0400 Received: from thunderhill.nvidia.com ([216.228.112.22] helo=jholdsworth-sail.nvidia.com) by painless-a.thn.aa.net.uk with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wI8M4-00000003iOT-1VND; Wed, 29 Apr 2026 18:05:44 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=airwebreathe.org.uk; s=aaisp1; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To: Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=4HlHIUCCfVNq7SnCRPG2LedBEmtBcE0/hKTviMJSuM0=; b=l5fFFXZ5TkSjTn546RCYxThIZn TxN/9TtZXu0Rt5j5SkciMY32IatNtwNbyuUIonZz9RiaNTySTshfYZUyDsuII3XxGr1hQGn1pIWaN Z9FOEismvGbLAovnxcySem0nn5WlCP36vnmMmk9mrPu0RQc9zAzH3Z+oZPU33j6y1qB9DeNDmMbh1 kFfz0QelestFDjrD+FPhEZZM4DjNMGjV12zKvowu/FBblnvW+e7/XL97lLaFuygOY9TRhabe3yE0d rl4trVMOdE7Gd2adsPy+baYuoiaHMNiA0450MIDpWJ9M+gw5fj+WiGQ1iQ82yX2Iu2qOZsSwl3hll nPmm4k8g==; To: qemu-devel@nongnu.org Cc: Stafford Horne , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Joel Holdsworth Subject: [PATCH 2/2] target/or1k: fix gen_div INT_MIN / -1 undefined behavior Date: Wed, 29 Apr 2026 10:03:59 -0700 Message-ID: <20260429170519.2137725-3-joel@airwebreathe.org.uk> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20260429170519.2137725-1-joel@airwebreathe.org.uk> References: <20260429170519.2137725-1-joel@airwebreathe.org.uk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2001:8b0:0:30::51; envelope-from=joel@airwebreathe.org.uk; helo=a-painless.mh.aa.net.uk X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Wed, 29 Apr 2026 16:03:09 -0400 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-to: joel@airwebreathe.org.uk From: joel--- via qemu development Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1777493099836154100 Content-Type: text/plain; charset="utf-8" From: Joel Holdsworth Signed division of INT_MIN (0x80000000) by -1 produces a result that overflows a 32-bit signed integer. On many host architectures (x86, ARM) this triggers a hardware exception. The existing code only guards against divide-by-zero but not this case. Add an explicit check for the INT_MIN / -1 pattern and suppress the host-side exception by substituting a divisor of 1, setting the overflow flag instead. Signed-off-by: Joel Holdsworth --- target/or1k/translate.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/target/or1k/translate.c b/target/or1k/translate.c index 1602e204fe..68d40111f0 100644 --- a/target/or1k/translate.c +++ b/target/or1k/translate.c @@ -279,13 +279,27 @@ static void gen_div(DisasContext *dc, TCGv_i32 dest, TCGv_i32 srca, TCGv_i32 srcb) { TCGv_i32 t0 =3D tcg_temp_new_i32(); + TCGv_i32 ov =3D tcg_temp_new_i32(); =20 - tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_ov, srcb, 0); - /* The result of divide-by-zero is undefined. - Suppress the host-side exception by dividing by 1. */ - tcg_gen_or_i32(t0, srcb, cpu_sr_ov); + /* Check for divide-by-zero. */ + tcg_gen_setcondi_i32(TCG_COND_EQ, ov, srcb, 0); + + /* Check for INT_MIN / -1 overflow (0x80000000 / -1). */ + TCGv_i32 t_is_min =3D tcg_temp_new_i32(); + TCGv_i32 t_is_neg1 =3D tcg_temp_new_i32(); + TCGv_i32 t_intmin_ov =3D tcg_temp_new_i32(); + + tcg_gen_setcondi_i32(TCG_COND_EQ, t_is_min, srca, (int32_t)0x80000000); + tcg_gen_setcondi_i32(TCG_COND_EQ, t_is_neg1, srcb, -1); + tcg_gen_and_i32(t_intmin_ov, t_is_min, t_is_neg1); + tcg_gen_or_i32(ov, ov, t_intmin_ov); + + /* Suppress the host-side exception by dividing by 1 on overflow. */ + tcg_gen_movcond_i32(TCG_COND_NE, t0, ov, tcg_constant_i32(0), + tcg_constant_i32(1), srcb); tcg_gen_div_i32(dest, srca, t0); =20 + tcg_gen_mov_i32(cpu_sr_ov, ov); tcg_gen_neg_i32(cpu_sr_ov, cpu_sr_ov); gen_ove_ov(dc); } --=20 2.51.2