From: Eric Biggers <ebiggers@kernel.org>
To: Chao Liu <chao.liu@yeah.net>
Cc: paolo.savini@embecosm.com, dbarboza@ventanamicro.com,
palmer@dabbelt.com, alistair.francis@wdc.com,
liwei1518@gmail.com, zhiwei_liu@linux.alibaba.com,
qemu-riscv@nongnu.org, qemu-devel@nongnu.org
Subject: Re: [PATCH v2 1/2] target/riscv: fix vector register address calculation in strided LD/ST
Date: Fri, 15 Aug 2025 15:07:27 -0700 [thread overview]
Message-ID: <20250815220727.GB2041@quark> (raw)
In-Reply-To: <ee461421503da741d4cf6d2486b8596862fc0b7f.1755287531.git.chao.liu@yeah.net>
On Sat, Aug 16, 2025 at 03:55:40AM +0800, Chao Liu wrote:
> This patch fixes a critical bug in the RISC-V vector instruction
> translation that caused incorrect data handling in strided load
> operations (e.g., vlsseg8e32).
>
> Problem Description:
>
> The `get_log2` function in `trans_rvv.c.inc` returned a value 1 higher
> than the actual log2 value. For example, get_log2(4) incorrectly
> returned 3 instead of 2.
>
> This led to erroneous vector register offset calculations, resulting in
> data overlap where bytes 32-47 were incorrectly copied to positions
> 16-31 in ChaCha20 encryption code.
>
> rvv_test_func:
> vsetivli zero, 1, e32, m1, ta, ma
> li t0, 64
>
> vlsseg8e32.v v0, (a0), t0
> addi a0, a0, 32
> vlsseg8e32.v v8, (a0), t0
>
> vssseg8e32.v v0, (a1), t0
> addi a1, a1, 32
> vssseg8e32.v v8, (a1), t0
> ret
>
> Analysis:
>
> The original implementation counted the number of right shifts until
> zero, including the final shift that reduced the value to zero:
>
> static inline uint32_t get_log2(uint32_t a)
> {
> uint32_t i = 0;
> for (; a > 0;) {
> a >>= 1;
> i++;
> }
> return i; // Returns 3 for a=4 (0b100 → 0b10 → 0b1 → 0b0)
> }
>
> Fix:
>
> The corrected function stops shifting when only the highest bit remains
> and handles the special case of a=0:
>
> static inline uint32_t get_log2(uint32_t a)
> {
> uint32_t i = 0;
> if (a == 0) {
> return i; // Handle edge case
> }
> for (; a > 1; a >>= 1) {
> i++;
> }
> return i; // Now returns 2 for a=4
> }
>
> Fixes: 28c12c1f2f ("Generate strided vector loads/stores with tcg nodes.")
>
> Signed-off-by: Chao Liu <chao.liu@yeah.net>
> ---
> target/riscv/insn_trans/trans_rvv.c.inc | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
Tested-by: Eric Biggers <ebiggers@kernel.org>
But, to get this to apply I had to re-apply the fixed commit (which was
reverted), then resolve a conflict. You'll need to send out a new
series which applies to the latest master branch.
- Eric
next prev parent reply other threads:[~2025-08-15 22:07 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-15 19:55 [PATCH v2 0/2] target/riscv: fix vector LD/ST instruction Chao Liu
2025-08-16 0:29 ` Chao Liu
2025-08-15 19:55 ` [PATCH v2 1/2] target/riscv: fix vector register address calculation in strided LD/ST Chao Liu
2025-08-16 0:29 ` Chao Liu
2025-08-15 22:07 ` Eric Biggers [this message]
2025-08-16 6:44 ` Richard Henderson
2025-08-15 19:55 ` [PATCH v2 2/2] tests/tcg/riscv64: Add test for vlsseg8e32 instruction Chao Liu
2025-08-16 0:29 ` Chao Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250815220727.GB2041@quark \
--to=ebiggers@kernel.org \
--cc=alistair.francis@wdc.com \
--cc=chao.liu@yeah.net \
--cc=dbarboza@ventanamicro.com \
--cc=liwei1518@gmail.com \
--cc=palmer@dabbelt.com \
--cc=paolo.savini@embecosm.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=zhiwei_liu@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.