1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
TCG: 0.869
graphic: 0.858
assembly: 0.798
architecture: 0.779
device: 0.740
performance: 0.681
ppc: 0.635
vnc: 0.609
PID: 0.598
register: 0.589
socket: 0.576
permissions: 0.566
network: 0.552
risc-v: 0.506
kernel: 0.490
files: 0.464
user-level: 0.464
arm: 0.411
debug: 0.410
peripherals: 0.367
hypervisor: 0.347
boot: 0.333
virtual: 0.309
x86: 0.295
semantic: 0.288
VMM: 0.286
mistranslation: 0.231
i386: 0.203
KVM: 0.164
--------------------
assembly: 0.978
TCG: 0.952
debug: 0.505
performance: 0.313
virtual: 0.125
files: 0.081
register: 0.074
semantic: 0.040
architecture: 0.040
hypervisor: 0.028
user-level: 0.024
kernel: 0.016
PID: 0.013
arm: 0.012
device: 0.010
network: 0.006
risc-v: 0.005
graphic: 0.004
peripherals: 0.003
VMM: 0.003
ppc: 0.002
boot: 0.002
socket: 0.001
KVM: 0.001
vnc: 0.001
permissions: 0.001
x86: 0.001
mistranslation: 0.001
i386: 0.000
TCG Optimizer crashes on AArch64 SVE2 instruction
Description of problem:
QEMU crashes due to an assertion in the TCG optimizer when optimizing an SVE2 instruction:
```
Unrecognized operation 145 in do_constant_folding.
../tcg/optimize.c:458: tcg fatal error
```
Steps to reproduce:
1. Compile the following minimized reproducer: (a pre-compiled image is provided for convenience - [reproducer.img](/uploads/0bddbfac55306a297fee59dd2f6923cf/reproducer.img))
```asm
.org 0x0
entry:
mrs x1, cptr_el3
orr x9, x1, #0x100
msr cptr_el3, x9
msr cptr_el2, xzr
mov x1, #0x3
mrs x9, cpacr_el1
bfi x9, x1, #16, #2
bfi x9, x1, #20, #2
msr cpacr_el1, x9
mov x9, 512
mov x0, x9
asr x0, x0, 7
sub x9, x0, #1
msr zcr_el1, x9
mov x9, 512
mov x0, x9
asr x0, x0, 7
sub x9, x0, #1
msr zcr_el2, x9
mov x9, 512
mov x0, x9
asr x0, x0, 7
sub x9, x0, #1
msr zcr_el3, x9
uqxtnt z11.s, z22.d
```
2. Execute it using the command line given above.
Additional information:
I tested latest master as well, and the problem persists.
|