filter for semantic-user-mode bugs

1 files changed, 57 insertions, 0 deletions

diff --git a/results/classifier/semantic-bugs-usermode/test/2971 b/results/classifier/semantic-bugs-usermode/test/2971
new file mode 100644
index 000000000..2ee49f8b8
--- /dev/null
+++ b/results/classifier/semantic-bugs-usermode/test/2971
@@ -0,0 +1,57 @@
+instruction: 0.834
+vnc: 0.780
+device: 0.770
+assembly: 0.671
+network: 0.667
+socket: 0.623
+graphic: 0.579
+semantic: 0.515
+boot: 0.473
+other: 0.425
+KVM: 0.396
+mistranslation: 0.282
+
+loongarch64 crashes caused by lenient instruction decoding of vldi and xvldi
+Description of problem:
+Lenient instruction decoding of `vldi` and `xvldi` leads to Qemu crashes.
+
+The decoding of `vldi` and `xvldi` instruction allows for instructions with illegal immediates.
+
+`target/loongarch/insns.decode`:
+
+```
+vldi             0111 00111110 00 ............. .....     @v_i13
+xvldi            0111 01111110 00 ............. .....     @v_i13
+```
+
+This is considered in `target/loongarch/tcg/insn_trans/trans_vec.c.inc`:
+
+```C
+    /*
+     * imm bit [11:8] is mode, mode value is 0-12.
+     * other values are invalid.
+     */
+```
+
+However, an assertion error is raised when this condition is violated and qemu crashes:
+
+```
+**
+ERROR:target/loongarch/insn_trans/trans_vec.c.inc:3574:vldi_get_value: code should not be reached
+Bail out! ERROR:target/loongarch/insn_trans/trans_vec.c.inc:3574:vldi_get_value: code should not be reached
+```
+
+On hardware (Loongson 3A5000), these instructions cause a SIGILL.
+Steps to reproduce:
+1. compile the `test_inv_vldi` test program for loongarch64 (see additional information)
+2. run `qemu-loongarch64-static ./test_inv_vldi`
+Additional information:
+I will post a patch for this issue to the mailing list soon.
+
+`test_inv_vldi` source code:
+
+```C
+int main(int argc, char** argv) {
+    asm volatile(".4byte 0x73e3a000");    
+}
+```