[Qemu-devel] [Bug 1071149] [NEW] target-mips: special3 instruction dinsm translation error

[Qemu-devel] [Bug 1071149] [NEW] target-mips: special3 instruction dinsm translation error

[Nikita Kanunnikov]

Public bug reported:

Function decode_opc() in translate.c calls function gen_bitops(), which
has such prototype:

/* special3 bitfield operations */
static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt,
                        int rs, int lsb, int msb)

The code for DINSM instruction is:

case OPC_DINSM ... OPC_DINS:
            check_insn(env, ctx, ISA_MIPS64R2);
            check_mips_64(ctx);
            gen_bitops(ctx, op1, rt, rs, sa, rd);
            break;

But rd ≠ msb according to MIPS64R2 standard, rd = msb - 32.

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1071149

Title:
  target-mips: special3 instruction dinsm translation error

Status in QEMU:
  New

Bug description:
  Function decode_opc() in translate.c calls function gen_bitops(),
  which has such prototype:

  /* special3 bitfield operations */
  static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt,
                          int rs, int lsb, int msb)

  The code for DINSM instruction is:

  case OPC_DINSM ... OPC_DINS:
              check_insn(env, ctx, ISA_MIPS64R2);
              check_mips_64(ctx);
              gen_bitops(ctx, op1, rt, rs, sa, rd);
              break;

  But rd ≠ msb according to MIPS64R2 standard, rd = msb - 32.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1071149/+subscriptions

[Qemu-devel] [Bug 1071149] Re: target-mips: special3 instruction dinsm translation error

[Aurelien Jarno]

That's why in gen_bitops() does later:

    case OPC_DINSM:
        if (lsb > msb)
            goto fail;
        mask = ((msb - lsb + 1 + 32 < 64) ? ((1ULL << (msb - lsb + 1 + 32)) - 1) : ~0ULL) << lsb;

...

    case OPC_DINSU:
        if (lsb > msb)
            goto fail;
        mask = ((1ULL << (msb - lsb + 1)) - 1) << (lsb + 32);

...

    case OPC_DINS:
        if (lsb > msb)
            goto fail;
        gen_load_gpr(t0, rt);
        mask = ((1ULL << (msb - lsb + 1)) - 1) << lsb;

For me there is no bug there, but if you believe the contrary, please
send a testcase.

** Changed in: qemu
       Status: New => Invalid

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1071149

Title:
  target-mips: special3 instruction dinsm translation error

Status in QEMU:
  Invalid

Bug description:
  Function decode_opc() in translate.c calls function gen_bitops(),
  which has such prototype:

  /* special3 bitfield operations */
  static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt,
                          int rs, int lsb, int msb)

  The code for DINSM instruction is:

  case OPC_DINSM ... OPC_DINS:
              check_insn(env, ctx, ISA_MIPS64R2);
              check_mips_64(ctx);
              gen_bitops(ctx, op1, rt, rs, sa, rd);
              break;

  But rd ≠ msb according to MIPS64R2 standard, rd = msb - 32.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1071149/+subscriptions

[Qemu-devel] [Bug 1071149] Re: target-mips: special3 instruction dinsm translation error

[Aurelien Jarno]

Indeed the  (lsb > msb) case is wrong and should be removed. I'll post a
patch about that later this week.

** Changed in: qemu
       Status: Invalid => Confirmed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1071149

Title:
  target-mips: special3 instruction dinsm translation error

Status in QEMU:
  Confirmed

Bug description:
  Function decode_opc() in translate.c calls function gen_bitops(),
  which has such prototype:

  /* special3 bitfield operations */
  static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt,
                          int rs, int lsb, int msb)

  The code for DINSM instruction is:

  case OPC_DINSM ... OPC_DINS:
              check_insn(env, ctx, ISA_MIPS64R2);
              check_mips_64(ctx);
              gen_bitops(ctx, op1, rt, rs, sa, rd);
              break;

  But rd ≠ msb according to MIPS64R2 standard, rd = msb - 32.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1071149/+subscriptions

[Qemu-devel] [Bug 1071149] Re: target-mips: special3 instruction dinsm translation error

[Aurelien Jarno]

Fixed in commit e0d002f17d1db1ade2b8d24b4a7c7ab361256726

** Changed in: qemu
       Status: Confirmed => Fix Committed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1071149

Title:
  target-mips: special3 instruction dinsm translation error

Status in QEMU:
  Fix Committed

Bug description:
  Function decode_opc() in translate.c calls function gen_bitops(),
  which has such prototype:

  /* special3 bitfield operations */
  static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt,
                          int rs, int lsb, int msb)

  The code for DINSM instruction is:

  case OPC_DINSM ... OPC_DINS:
              check_insn(env, ctx, ISA_MIPS64R2);
              check_mips_64(ctx);
              gen_bitops(ctx, op1, rt, rs, sa, rd);
              break;

  But rd ≠ msb according to MIPS64R2 standard, rd = msb - 32.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1071149/+subscriptions

[Qemu-devel] [Bug 1071149] Re: target-mips: special3 instruction dinsm translation error

[Aurelien Jarno]

** Changed in: qemu
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1071149

Title:
  target-mips: special3 instruction dinsm translation error

Status in QEMU:
  Fix Released

Bug description:
  Function decode_opc() in translate.c calls function gen_bitops(),
  which has such prototype:

  /* special3 bitfield operations */
  static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt,
                          int rs, int lsb, int msb)

  The code for DINSM instruction is:

  case OPC_DINSM ... OPC_DINS:
              check_insn(env, ctx, ISA_MIPS64R2);
              check_mips_64(ctx);
              gen_bitops(ctx, op1, rt, rs, sa, rd);
              break;

  But rd ≠ msb according to MIPS64R2 standard, rd = msb - 32.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1071149/+subscriptions