id = 2971
title = "loongarch64 crashes caused by lenient instruction decoding of vldi and xvldi"
state = "opened"
created_at = "2025-05-18T20:08:15.081Z"
closed_at = "n/a"
labels = []
url = "https://gitlab.com/qemu-project/qemu/-/issues/2971"
host-os = "Linux Mint 22 Cinnamon"
host-arch = "x86"
qemu-version = "qemu-loongarch64 version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.6)"
guest-os = "n/a"
guest-arch = "loongarch64 (default one)"
description = """Lenient instruction decoding of `vldi` and `xvldi` leads to Qemu crashes.

The decoding of `vldi` and `xvldi` instruction allows for instructions with illegal immediates.

`target/loongarch/insns.decode`:

```
vldi             0111 00111110 00 ............. .....     @v_i13
xvldi            0111 01111110 00 ............. .....     @v_i13
```

This is considered in `target/loongarch/tcg/insn_trans/trans_vec.c.inc`:

```C
    /*
     * imm bit [11:8] is mode, mode value is 0-12.
     * other values are invalid.
     */
```

However, an assertion error is raised when this condition is violated and qemu crashes:

```
**
ERROR:target/loongarch/insn_trans/trans_vec.c.inc:3574:vldi_get_value: code should not be reached
Bail out! ERROR:target/loongarch/insn_trans/trans_vec.c.inc:3574:vldi_get_value: code should not be reached
```

On hardware (Loongson 3A5000), these instructions cause a SIGILL."""
reproduce = """1. compile the `test_inv_vldi` test program for loongarch64 (see additional information)
2. run `qemu-loongarch64-static ./test_inv_vldi`"""
additional = """I will post a patch for this issue to the mailing list soon.

`test_inv_vldi` source code:

```C
int main(int argc, char** argv) {
    asm volatile(".4byte 0x73e3a000");    
}
```"""