All of lore.kernel.org
 help / color / mirror / Atom feed
From: Brian Cain <brian.cain@oss.qualcomm.com>
To: qemu-devel@nongnu.org
Cc: Laurent Vivier <laurent@vivier.eu>,
	Brian Cain <brian.cain@oss.qualcomm.com>,
	Helge Deller <deller@gmx.de>,
	Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Subject: [PATCH 04/11] target/hexagon: guard writes to unimplemented guest registers
Date: Tue, 18 Aug 2026 18:31:37 -0700	[thread overview]
Message-ID: <20260819013144.3264096-5-brian.cain@oss.qualcomm.com> (raw)
In-Reply-To: <20260819013144.3264096-1-brian.cain@oss.qualcomm.com>

Gate guest-register writes on greg_writable() in the generated code so
writes to gregs above G3 are dropped instead of dereferencing an
unallocated TCG temp.

Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/translate.h   |  7 ++++---
 target/hexagon/hex_common.py | 18 +++++++++++++++++-
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/target/hexagon/translate.h b/target/hexagon/translate.h
index 00de2b0d2ec..05425d92b29 100644
--- a/target/hexagon/translate.h
+++ b/target/hexagon/translate.h
@@ -97,9 +97,10 @@ bool is_gather_store_insn(DisasContext *ctx);
 #ifndef CONFIG_USER_ONLY
 static inline void ctx_log_greg_write(DisasContext *ctx, int rnum)
 {
-    assert(rnum <= HEX_GREG_G3);
-    ctx->greg_log[ctx->greg_log_idx] = rnum;
-    ctx->greg_log_idx++;
+    if (rnum <= HEX_GREG_G3) {
+        ctx->greg_log[ctx->greg_log_idx] = rnum;
+        ctx->greg_log_idx++;
+    }
 }
 
 static inline void ctx_log_greg_write_pair(DisasContext *ctx, int rnum)
diff --git a/target/hexagon/hex_common.py b/target/hexagon/hex_common.py
index e33d43e3ce0..c180c19b092 100755
--- a/target/hexagon/hex_common.py
+++ b/target/hexagon/hex_common.py
@@ -1097,11 +1097,24 @@ def analyze_write(self, f, tag, regno):
         """))
 
 class GuestRegister(Register):
-    pass
+    def gen_check_impl(self, f, regno):
+        if self.is_written():
+            f.write(code_fmt(f"""\
+                if (!greg_writable(insn->regno[{regno}],
+                    {str(self.is_pair()).lower()})) {{
+                    return;
+                }}
+            """))
+        else:
+            f.write(code_fmt(f"""\
+                check_greg_impl(insn->regno[{regno}],
+                                {str(self.is_pair()).lower()});
+            """))
 
 class GuestDest(GuestRegister, Single, Dest):
     def decl_tcg(self, f, tag, regno):
         self.decl_reg_num(f, regno)
+        self.gen_check_impl(f, regno)
         f.write(code_fmt(f"""\
             TCGv_i32 {self.reg_tcg()} = tcg_temp_new_i32();
         """))
@@ -1121,6 +1134,7 @@ def decl_reg_num(self, f, regno):
         """))
     def decl_tcg(self, f, tag, regno):
         self.decl_reg_num(f, regno)
+        self.gen_check_impl(f, regno)
         f.write(code_fmt(f"""\
             TCGv_i32 {self.reg_tcg()} = tcg_temp_new_i32();
             gen_read_greg({self.reg_tcg()}, {self.reg_num});
@@ -1131,6 +1145,7 @@ def analyze_read(self, f, regno):
 class GuestPairDest(GuestRegister, Pair, Dest):
     def decl_tcg(self, f, tag, regno):
         self.decl_reg_num(f, regno)
+        self.gen_check_impl(f, regno)
         f.write(code_fmt(f"""\
             TCGv_i64 {self.reg_tcg()} = tcg_temp_new_i64();
         """))
@@ -1150,6 +1165,7 @@ def decl_reg_num(self, f, regno):
         """))
     def decl_tcg(self, f, tag, regno):
         self.decl_reg_num(f, regno)
+        self.gen_check_impl(f, regno)
         f.write(code_fmt(f"""\
             TCGv_i64 {self.reg_tcg()} = tcg_temp_new_i64();
             gen_read_greg_pair({self.reg_tcg()}, {self.reg_num});
-- 
2.34.1


  parent reply	other threads:[~2026-08-19  1:32 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-19  1:31 [PATCH 00/11] Hexagon: exception, interrupt, system reg fixes Brian Cain
2026-08-19  1:31 ` [PATCH 01/11] target/hexagon: align exceptions for user/sysemu Brian Cain
2026-08-20 18:40   ` Pierrick Bouvier
2026-08-20 19:02     ` Brian Cain
2026-08-20 19:32       ` Pierrick Bouvier
2026-08-21 16:37       ` Pierrick Bouvier
2026-08-22 15:46         ` Brian Cain
2026-08-19  1:31 ` [PATCH 02/11] tests/tcg/hexagon: check priv instructions raise SIGILL Brian Cain
2026-08-20 18:41   ` Pierrick Bouvier
2026-08-19  1:31 ` [PATCH 03/11] hw/intc: clear pending bit on l2vic de-assertion Brian Cain
2026-08-20 18:41   ` Pierrick Bouvier
2026-08-19  1:31 ` Brian Cain [this message]
2026-08-20 18:44   ` [PATCH 04/11] target/hexagon: guard writes to unimplemented guest registers Pierrick Bouvier
2026-08-22 15:59     ` Brian Cain
2026-08-19  1:31 ` [PATCH 05/11] target/hexagon: take BQL when reading the system pcycle count Brian Cain
2026-08-20 18:45   ` Pierrick Bouvier
2026-08-19  1:31 ` [PATCH 06/11] target/hexagon: gate GPCYCLE guest register reads on SSR:CE Brian Cain
2026-08-20 18:46   ` Pierrick Bouvier
2026-08-19  1:31 ` [PATCH 07/11] target/hexagon: read UTIMERLO/UTIMERHI from the global timer Brian Cain
2026-08-20 18:48   ` Pierrick Bouvier
2026-08-19  1:31 ` [PATCH 08/11] target/hexagon: raise imprecise exception on multi-TLB match Brian Cain
2026-08-20 18:54   ` Pierrick Bouvier
2026-08-19  1:31 ` [PATCH 09/11] target/hexagon: implement direct-to-guest interrupt delivery Brian Cain
2026-08-20 18:57   ` Pierrick Bouvier
2026-08-20 21:59     ` Brian Cain
2026-08-21 16:22       ` Pierrick Bouvier
2026-08-19  1:31 ` [PATCH 10/11] target/hexagon: fix iassign{r,w} to cover all threads Brian Cain
2026-08-20 18:59   ` Pierrick Bouvier
2026-08-19  1:31 ` [PATCH 11/11] tests/functional/hexagon: update to v0.2.12, +test_{interrupts, sys_regs} Brian Cain via qemu development
2026-08-20 18:59   ` [PATCH 11/11] tests/functional/hexagon: update to v0.2.12, +test_{interrupts,sys_regs} Pierrick Bouvier

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260819013144.3264096-5-brian.cain@oss.qualcomm.com \
    --to=brian.cain@oss.qualcomm.com \
    --cc=deller@gmx.de \
    --cc=laurent@vivier.eu \
    --cc=pierrick.bouvier@oss.qualcomm.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.