From patchwork Mon Nov 18 19:35:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tokarev X-Patchwork-Id: 844117 Delivered-To: patch@linaro.org Received: by 2002:a05:6000:8b:b0:382:43a8:7b94 with SMTP id m11csp803064wrx; Mon, 18 Nov 2024 11:38:29 -0800 (PST) X-Forwarded-Encrypted: i=2; AJvYcCUKryBOImzwMr/JiDz2awTkO1WS07Ncl/4SiFk1KwWpXZh/F2qOjnxg50dNqz4B+/wn1z0X4Q==@linaro.org X-Google-Smtp-Source: AGHT+IE1z5565xMC+9JNEIIaA8Nxb2nie06Hg8uWMcCyZBVunReaXv79++QARMEwMZP3F5DYEzRl X-Received: by 2002:a05:620a:4015:b0:7a9:b4d2:9d69 with SMTP id af79cd13be357-7b3621af6d7mr1776152385a.0.1731958709122; Mon, 18 Nov 2024 11:38:29 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1731958709; cv=none; d=google.com; s=arc-20240605; b=CDFHQ6NV0FJ70LX2R7IgAhgsY/eFjop8Xq1SiPMREtQkElF2e6wKM5v810UK34KIri LxW3So5TXz09FFdIy7Ov0DwKM26LGsm1brayxlJF80Rf0r0+7he7XAPcH82l8DYGOF9T hBkWmJdces2gu4kSlxTCmSLCweTFprBZFQ7OQq2W/zTeCktLIh+Cd0DP0zxzpNH75xxa u2db5e40fNJidVL89OrDjRfvxzXKzVrNnvk++x9BKbZKT6mbs6iiVZhWTbpwt5BTRnJL m1YoeeEVp6Z5/rpdv7qc5hpygD0RmswIHCwtnf90B970XRpZK6h5Xw3d3PJLZmCxqsWj /k+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=LMl3VgmaK3q3SYObD5m5qm3/+RRmrJcV4C3nTxs68sA=; fh=xJ1URYKcMN3TM0/XAv5v+aCN+5tIbzAdcfBx5UNgoLw=; b=gHBQKeT0NnVKHZJL4Rm4Xvo+BF373OLFrMizyrO6Yhc8uJyVnOjIDFBIJEv1uv289o Er6UcBJFEmfqQTDqJJOtlaVr7fSPTSB1H3E9wNDruNpX3cy6bbiWNOMuv27/UZRM+F0i bzS3BYpwWvFGhHABRwXsZHOBq7Q50ccRMFWv67dqnkkKYRVcHBl359DDXBm9xTOh8CNb YqMpCSgK4l/aMmshfbV/HB8xI9S8MrOcz2UPbKyof42t51Ve+mOnFvhgspIGG+f6OR97 G2BbHF3yRobS1D+tTH3T+24x1t3Wu6WrI8yyM2IJd/qWy/grp/4+cQIKMt1VrAdx2ilk goVw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7b37a897f8dsi52645085a.405.2024.11.18.11.38.28 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 18 Nov 2024 11:38:29 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org" Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tD7XH-0006ey-1C; Mon, 18 Nov 2024 14:35:47 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tD7XB-0006dM-QC; Mon, 18 Nov 2024 14:35:41 -0500 Received: from isrv.corpit.ru ([86.62.121.231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tD7X9-0002hg-V1; Mon, 18 Nov 2024 14:35:41 -0500 Received: from tsrv.corpit.ru (tsrv.tls.msk.ru [192.168.177.2]) by isrv.corpit.ru (Postfix) with ESMTP id B1370A54E5; Mon, 18 Nov 2024 22:35:17 +0300 (MSK) Received: from tls.msk.ru (mjt.wg.tls.msk.ru [192.168.177.130]) by tsrv.corpit.ru (Postfix) with SMTP id 310691735A2; Mon, 18 Nov 2024 22:35:21 +0300 (MSK) Received: (nullmailer pid 2312691 invoked by uid 1000); Mon, 18 Nov 2024 19:35:20 -0000 From: Michael Tokarev To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Peter Maydell , Richard Henderson , Michael Tokarev Subject: [Stable-8.2.8 56/61] tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc() Date: Mon, 18 Nov 2024 22:35:11 +0300 Message-Id: <20241118193520.2312620-8-mjt@tls.msk.ru> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: MIME-Version: 1.0 Received-SPF: pass client-ip=86.62.121.231; envelope-from=mjt@tls.msk.ru; helo=isrv.corpit.ru X-Spam_score_int: -68 X-Spam_score: -6.9 X-Spam_bar: ------ X-Spam_report: (-6.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In simd_desc() we create a SIMD descriptor from various pieces including an arbitrary data value from the caller. We try to sanitize these to make sure everything will fit: the 'data' value needs to fit in the SIMD_DATA_BITS (== 22) sized field. However we do that sanitizing with: tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS)); This works for the case where the data is supposed to be considered as a signed integer (which can then be returned via simd_data()). However, some callers want to treat the data value as unsigned. Specifically, for the Arm SVE operations, make_svemte_desc() assembles a data value as a collection of fields, and it needs to use all 22 bits. Currently if MTE is enabled then its MTEDESC SIZEM1 field may have the most significant bit set, and then it will trip this assertion. Loosen the assertion so that we only check that the data value will fit into the field in some way, either as a signed or as an unsigned value. This means we will fail to detect some kinds of bug in the callers, but we won't spuriously assert for intentional use of the data field as unsigned. Cc: qemu-stable@nongnu.org Fixes: db432672dc50e ("tcg: Add generic vector expanders") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2601 Signed-off-by: Peter Maydell Message-ID: <20241115172515.1229393-1-peter.maydell@linaro.org> Reviewed-by: Richard Henderson Signed-off-by: Richard Henderson (cherry picked from commit 8377e3fb854d126ba10e61cb6b60885af8443ad4) Signed-off-by: Michael Tokarev diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c index 566fd6eef7..8117e4fb39 100644 --- a/tcg/tcg-op-gvec.c +++ b/tcg/tcg-op-gvec.c @@ -88,7 +88,20 @@ uint32_t simd_desc(uint32_t oprsz, uint32_t maxsz, int32_t data) uint32_t desc = 0; check_size_align(oprsz, maxsz, 0); - tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS)); + + /* + * We want to check that 'data' will fit into SIMD_DATA_BITS. + * However, some callers want to treat the data as a signed + * value (which they can later get back with simd_data()) + * and some want to treat it as an unsigned value. + * So here we assert only that the data will fit into the + * field in at least one way. This means that some invalid + * values from the caller will not be detected, e.g. if the + * caller wants to handle the value as a signed integer but + * incorrectly passes us 1 << (SIMD_DATA_BITS - 1). + */ + tcg_debug_assert(data == sextract32(data, 0, SIMD_DATA_BITS) || + data == extract32(data, 0, SIMD_DATA_BITS)); oprsz = (oprsz / 8) - 1; maxsz = (maxsz / 8) - 1;