?stateflush reuses the app-flash no-chain window without differential shadowing.
It shows that returning to C between TBs does not materialize CPUArchState; the
nostoretci reader-open corruption still reproduces.
Skips removeFunction recycling of WASM table indices. nostoretci+noremove still
crashes 4/4, ruling out table-index reuse as the corruption source and leaving a
vCPU/IO-thread guest-RAM data race as the standing hypothesis.
Counts compiled-TB DONE_FLAG redispatch/resume re-entries. Three crashing
nostoretci runs showed zero such re-entries, ruling out the store
block-replay-via-redispatch path as the corruption trigger and pointing at a
guest-RAM data race with concurrent device/timer callbacks.
Add wasm_set_store_tci_hash and wasm_set_store_bisect so store compilation can
be split by pc hash (both widths) or bisected per width at runtime, no rebuild.
Used to show the compiled-store corruption is a nondeterministic race, not a
specific miscompiled TB: identity-independent, and a fixed config alternates
crash/pass across runs. Default path unchanged (blanket store-TCI).
The 32-bit-only store-TCI fallback passes reader-open when it works, but a
3-run benchmark hit an app-init watchdog once. Restore the upstream blanket
store-TCI fallback for reliability; keep ?nostoretci as the all-compiled repro.
The compiled-store corruption requires 8-bit and 32-bit store TB populations
compiled together. Interpreting either width breaks the interaction; keep only
32-bit qemu store TBs on TCI and allow the rest to compile. ?nostoretci remains
the all-compiled repro path.
Add an opt-in wasm_disable_store_tci() probe so browser tests can run compiled
stores at normal speed without the differential harness. Also let E11 request
no-chain only for TBs inside its PC window, avoiding the global no-chain
watchdog artifact while preserving valid per-window comparisons.
This keeps production store-TCI unchanged unless explicitly disabled.
Mode 2 runs compiled LIVE and authoritative so corruption accumulates across
TBs as in the real crash, with a per-TB TCI shadow (restored from pre-snapshot)
as the known-good reference. Store-TCI disabled under this mode; compares
env/pc/DRAM per eligible store TB, now including slow-path completions.
Result: 153k+ live-compiled comparisons, zero divergence, confirming inline
store codegen is correct even under live accumulation. Cannot reach the reader
corruption in-browser: 2x-execution + full-state snapshot trips the guest
interrupt watchdog and is throughput-bound. Suspects narrowed to the store
slow-path (helper/unwind) and store-width interaction.
Runs authoritative TCI first, snapshots its result, rewinds guest state,
runs the compiled TB as a disposable shadow, compares GPRs/DRAM, then
restores TCI. Opt-in via wasm_diff_enable(); normal execution unchanged.
Valid comparison required restoring all state a single TB can touch:
- full CPUNegativeOffsetState (the env-8 interrupt check sits before env)
- deep CPUTLB.f[].table / d[].fulltlb per MMU mode
- and skipping async cpu_exit() force-exit races.
Only side-effect-safe candidates compared (store TB, no general helper).
Result: 160k+ store-TB comparisons during reader-open, zero divergence.
Per-TB store codegen is exonerated; corruption is emergent across TBs.
A TB containing a guest store is miscompiled by the wasm backend: it
corrupts a pointer that a later load faults on. It reproduces in uzlib
inflate during the reader's font prewarm (browser panics with a rejected
Load access fault); native QEMU decompresses the same static flash font
fine, confirming a wasm32 codegen bug.
Force store-containing TBs onto the TCI interpreter as the working
workaround. Perf ceiling: those TBs no longer JIT-compile. Upgrade path:
localize the miscompiled op in tcg_wasm_out_qemu_st and drop this.
ssi-sd now enters token mode as it returns the final R1 byte, so the
write-data token that immediately follows is not discarded. SPI CMD13
returns the internal sd_r1 response (upstream fix) instead of sd_r2_s,
which the adapter converts to the two-byte SPI R2 status; this stops the
repeated "Unexpected response to cmd 13" loop on guest status polls.
Drops the experimental store-TB TCI forcing and sd-watch OOB logging now
that the raw FAT32 image path is stable.
Diagnostic: routes store-containing TBs through TCI and logs out-of-bounds
guest stores to isolate the SdSpiCard corruption. Also carries the FAT32
vvfat root/cluster fixes and ssi-sd command framing. Squash/split before
upstreaming.
When allocating new temps during tcg_optmize, do not re-use
any EBB temps that were used within the TB. We do not have
any idea what span of the TB in which the temp was live.
Introduce tcg_temp_ebb_reset_freed and use before tcg_optimize,
as well as replacing the equivalent in plugin_gen_inject and
tcg_func_start.
Cc: qemu-stable@nongnu.org
Fixes: fb04ab7ddd ("tcg/optimize: Lower TCG_COND_TST{EQ,NE} if unsupported")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2711
Reported-by: wannacu <wannacu2049@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 04e006ab36a8565b92d4e21dd346367fbade7d74)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
In simd_desc() we create a SIMD descriptor from various pieces
including an arbitrary data value from the caller. We try to
sanitize these to make sure everything will fit: the 'data' value
needs to fit in the SIMD_DATA_BITS (== 22) sized field. However we
do that sanitizing with:
tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS));
This works for the case where the data is supposed to be considered
as a signed integer (which can then be returned via simd_data()).
However, some callers want to treat the data value as unsigned.
Specifically, for the Arm SVE operations, make_svemte_desc()
assembles a data value as a collection of fields, and it needs to use
all 22 bits. Currently if MTE is enabled then its MTEDESC SIZEM1
field may have the most significant bit set, and then it will trip
this assertion.
Loosen the assertion so that we only check that the data value will
fit into the field in some way, either as a signed or as an unsigned
value. This means we will fail to detect some kinds of bug in the
callers, but we won't spuriously assert for intentional use of the
data field as unsigned.
Cc: qemu-stable@nongnu.org
Fixes: db432672dc ("tcg: Add generic vector expanders")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2601
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20241115172515.1229393-1-peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
The TCG IR sequence:
mov_i32 tmp97,$0xc4240000 dead: 1 pref=0xffffffff
mov_i32 tmp98,$0x0 pref=0xffffffff
rotr_i32 tmp97,tmp97,tmp98 dead: 1 2 pref=0xffffffff
was translated to `slwi r15, r14, 0` instead of `slwi r14, r14, 0`
due to SH field overflow. SH field is 5 bits, and tcg_out_rlw is called
in some situations with `32-n`, when `n` is 0 it results in an overflow
to RA field.
This commit prevents overflow of that field and adds debug assertions
for the other fields
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Dani Szebenyi <szedani@linux.ibm.com>
Message-ID: <20241022133535.69351-2-szedani@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
The RISC-V vector instruction set utilizes the LMUL field to group
multiple registers, enabling variable-length vector registers. This
implementation uses only the first register number of each group while
reserving the other register numbers within the group.
In TCG, each VEC_IR can have 3 types (TCG_TYPE_V64/128/256), and the
host runtime needs to adjust LMUL based on the type to use different
register groups.
This presents challenges for TCG's register allocation. Currently, we
avoid modifying the register allocation part of TCG and only expose the
minimum number of vector registers.
For example, when the host vlen is 64 bits and type is TCG_TYPE_V256, with
LMUL equal to 4, we use 4 vector registers as one register group. We can
use a maximum of 8 register groups, but the V0 register number is reserved
as a mask register, so we can effectively use at most 7 register groups.
Moreover, when type is smaller than TCG_TYPE_V256, only 7 registers are
forced to be used. This is because TCG cannot yet dynamically constrain
registers with type; likewise, when the host vlen is 128 bits and
TCG_TYPE_V256, we can use at most 15 registers.
There is not much pressure on vector register allocation in TCG now, so
using 7 registers is feasible and will not have a major impact on code
generation.
This patch:
1. Reserves vector register 0 for use as a mask register.
2. When using register groups, reserves the additional registers within
each group.
Signed-off-by: Huang Shiyuan <swung0x48@outlook.com>
Co-authored-by: TANG Tiancheng <tangtiancheng.ttc@alibaba-inc.com>
Signed-off-by: TANG Tiancheng <tangtiancheng.ttc@alibaba-inc.com>
Reviewed-by: Liu Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20241007025700.47259-3-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
32-bit TSTEQ and TSTNE is subject to the same constraints as
for 64-bit, but setcond_i32 and negsetcond_i32 were incorrectly
using TCG_CT_CONST ("i") instead of TCG_CT_CONST_CMP ("C").
Adjust the constraint and make tcg_target_const_match use the
same sequence as tgen_cmp2: first check if the constant is a
valid operand for TSTEQ/TSTNE, then accept everything for 32-bit
non-test comparisons, finally check if the constant is a valid
operand for 64-bit non-test comparisons.
Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
In the fallback when STDBRX is not available, avoid clobbering
TCG_REG_TMP1, which might be h.base, which is still in use.
Use TCG_REG_TMP2 instead.
Cc: qemu-stable@nongnu.org
Fixes: 01a112e2e9 ("tcg/ppc: Reorg tcg_out_tlb_read")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-By: Michael Tokarev <mjt@tls.msk.ru>
evan
xteink
Kohei Tokunaga
Dmitry Yakovlev
Roman Artemev
Richard Henderson
Peter Maydell
Dani Szebenyi
TANG Tiancheng
Huang Shiyuan
Paolo Bonzini