[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-9.0.4 66/71] tcg: Allow top bit of SIMD_DATA_BITS to be set in s
From: |
Michael Tokarev |
Subject: |
[Stable-9.0.4 66/71] tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc() |
Date: |
Tue, 19 Nov 2024 00:08:23 +0300 |
From: Peter Maydell <peter.maydell@linaro.org>
In simd_desc() we create a SIMD descriptor from various pieces
including an arbitrary data value from the caller. We try to
sanitize these to make sure everything will fit: the 'data' value
needs to fit in the SIMD_DATA_BITS (== 22) sized field. However we
do that sanitizing with:
tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
This works for the case where the data is supposed to be considered
as a signed integer (which can then be returned via simd_data()).
However, some callers want to treat the data value as unsigned.
Specifically, for the Arm SVE operations, make_svemte_desc()
assembles a data value as a collection of fields, and it needs to use
all 22 bits. Currently if MTE is enabled then its MTEDESC SIZEM1
field may have the most significant bit set, and then it will trip
this assertion.
Loosen the assertion so that we only check that the data value will
fit into the field in some way, either as a signed or as an unsigned
value. This means we will fail to detect some kinds of bug in the
callers, but we won't spuriously assert for intentional use of the
data field as unsigned.
Cc: qemu-stable@nongnu.org
Fixes: db432672dc50e ("tcg: Add generic vector expanders")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2601
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20241115172515.1229393-1-peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 8377e3fb854d126ba10e61cb6b60885af8443ad4)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index 566fd6eef7..8117e4fb39 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -88,7 +88,20 @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t
data)
uint32_t desc = 0;
check_size_align(oprsz, maxsz, 0);
- tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
+
+ /*
+ * We want to check that 'data' will fit into SIMD_DATA_BITS.
+ * However, some callers want to treat the data as a signed
+ * value (which they can later get back with simd_data())
+ * and some want to treat it as an unsigned value.
+ * So here we assert only that the data will fit into the
+ * field in at least one way. This means that some invalid
+ * values from the caller will not be detected, e.g. if the
+ * caller wants to handle the value as a signed integer but
+ * incorrectly passes us 1 << (SIMD_DATA_BITS - 1).
+ */
+ tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS) ||
+ data == extract32(data, 0, SIMD_DATA_BITS));
oprsz = (oprsz / 8) - 1;
maxsz = (maxsz / 8) - 1;
--
2.39.5
- [Stable-9.0.4 v2 00/71] Patch Round-up for stable 9.0.4, freeze on 2024-11-18, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 58/71] target/i386: Fix legacy page table walk, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 59/71] hw/i386/pc: Don't try to init PCI NICs if there is no PCI bus, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 60/71] linux-user: Fix setreuid and setregid to use direct syscalls, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 61/71] target/arm: Drop user-only special case in sve_stN_r, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 64/71] linux-user/arm: Reduce vdso alignment to 4k, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 63/71] linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 66/71] tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc(),
Michael Tokarev <=
- [Stable-9.0.4 65/71] linux-user/arm: Select vdso for be8 and be32 modes, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 67/71] target/i386: fix hang when using slow path for ptw_setl, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 62/71] accel/tcg: Fix user-only probe_access_internal plugin check, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 71/71] usb-hub: Fix handling port power control messages, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 70/71] hw/audio/hda: fix memory leak on audio setup, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 69/71] hw/misc/mos6522: Fix bad class definition of the MOS6522 device, Michael Tokarev, 2024/11/18
- [Stable-9.0.4 68/71] contrib/plugins: add compat for g_memdup2, Michael Tokarev, 2024/11/18