[PATCH v3 00/11] tcg/riscv64: Fix AUIPC pair range validation

[PATCH v3 00/11] tcg/riscv64: Fix AUIPC pair range validation

[Richard Henderson]

Hi Max,

In v2, the change from int32_t to uint32_t is pretty much
the opposite of what should have been done, since all of
these are logically signed values.  I've adjusted all of
the encoders to take signed inputs and assert in range.

In the process, I noticed tha the branch range tests were
off by one.  Now all performed in exactly one place.

Finally, tcg_out_ldst needed updates for AUIPC as well.

I've tested this lightly so far; full testing on a rather
slow riscv machine is still on-going.


r~


Max Chou (2):
  tcg/riscv64: Validate AUIPC relocation range
  tcg/riscv64: Fall back when AUIPC pairs are out of range

Richard Henderson (9):
  tcg/riscv64: Return tcg_insn_unit from insn encoders
  tcg/riscv64: Rename sb-type to b-type format
  tcg/riscv64: Rename uj-type to j-type format
  tcg/riscv64: Use signed type for encoding immediates
  tcg/riscv64: Adjust sign of lui immediate in tcg_out_movi
  tcg/riscv64: Assert immediate in range for [isu]-type insns
  tcg/riscv64: Return success from encode_jimm
  tcg/riscv64: Return success from encode_bimm
  tcg/riscv64: Fix off-by-one in branch range tests

 tcg/riscv64/tcg-target.c.inc | 230 ++++++++++++++++++-----------------
 1 file changed, 121 insertions(+), 109 deletions(-)

-- 
2.53.0

[PATCH v3 01/11] tcg/riscv64: Return tcg_insn_unit from insn encoders

[Richard Henderson]

Returning int32_t was logically incorrect.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 47 ++++++++++++++++++------------------
 1 file changed, 23 insertions(+), 24 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index 2ce9d47a633..a26503fa1ed 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -438,28 +438,28 @@ static bool tcg_target_const_match(int64_t val, int ct,
 
 /* Type-R */
 
-static int32_t encode_r(RISCVInsn opc, TCGReg rd, TCGReg rs1, TCGReg rs2)
+static tcg_insn_unit encode_r(RISCVInsn opc, TCGReg rd, TCGReg rs1, TCGReg rs2)
 {
     return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20;
 }
 
 /* Type-I */
 
-static int32_t encode_imm12(uint32_t imm)
+static tcg_insn_unit encode_imm12(uint32_t imm)
 {
     return (imm & 0xfff) << 20;
 }
 
-static int32_t encode_i(RISCVInsn opc, TCGReg rd, TCGReg rs1, uint32_t imm)
+static tcg_insn_unit encode_i(RISCVInsn opc, TCGReg rd, TCGReg rs1, uint32_t imm)
 {
     return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 | encode_imm12(imm);
 }
 
 /* Type-S */
 
-static int32_t encode_simm12(uint32_t imm)
+static tcg_insn_unit encode_simm12(uint32_t imm)
 {
-    int32_t ret = 0;
+    tcg_insn_unit ret = 0;
 
     ret |= (imm & 0xFE0) << 20;
     ret |= (imm & 0x1F) << 7;
@@ -467,16 +467,16 @@ static int32_t encode_simm12(uint32_t imm)
     return ret;
 }
 
-static int32_t encode_s(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
+static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
 {
     return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_simm12(imm);
 }
 
 /* Type-SB */
 
-static int32_t encode_sbimm12(uint32_t imm)
+static tcg_insn_unit encode_sbimm12(uint32_t imm)
 {
-    int32_t ret = 0;
+    tcg_insn_unit ret = 0;
 
     ret |= (imm & 0x1000) << 19;
     ret |= (imm & 0x7e0) << 20;
@@ -486,28 +486,28 @@ static int32_t encode_sbimm12(uint32_t imm)
     return ret;
 }
 
-static int32_t encode_sb(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
+static tcg_insn_unit encode_sb(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
 {
     return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_sbimm12(imm);
 }
 
 /* Type-U */
 
-static int32_t encode_uimm20(uint32_t imm)
+static tcg_insn_unit encode_uimm20(uint32_t imm)
 {
     return imm & 0xfffff000;
 }
 
-static int32_t encode_u(RISCVInsn opc, TCGReg rd, uint32_t imm)
+static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, uint32_t imm)
 {
     return opc | (rd & 0x1f) << 7 | encode_uimm20(imm);
 }
 
 /* Type-UJ */
 
-static int32_t encode_ujimm20(uint32_t imm)
+static tcg_insn_unit encode_ujimm20(uint32_t imm)
 {
-    int32_t ret = 0;
+    tcg_insn_unit ret = 0;
 
     ret |= (imm & 0x0007fe) << (21 - 1);
     ret |= (imm & 0x000800) << (20 - 11);
@@ -517,7 +517,7 @@ static int32_t encode_ujimm20(uint32_t imm)
     return ret;
 }
 
-static int32_t encode_uj(RISCVInsn opc, TCGReg rd, uint32_t imm)
+static tcg_insn_unit encode_uj(RISCVInsn opc, TCGReg rd, uint32_t imm)
 {
     return opc | (rd & 0x1f) << 7 | encode_ujimm20(imm);
 }
@@ -525,8 +525,8 @@ static int32_t encode_uj(RISCVInsn opc, TCGReg rd, uint32_t imm)
 
 /* Type-OPIVI */
 
-static int32_t encode_vi(RISCVInsn opc, TCGReg rd, int32_t imm,
-                         TCGReg vs2, bool vm)
+static tcg_insn_unit encode_vi(RISCVInsn opc, TCGReg rd, int32_t imm,
+                               TCGReg vs2, bool vm)
 {
     return opc | (rd & 0x1f) << 7 | (imm & 0x1f) << 15 |
            (vs2 & 0x1f) << 20 | (vm << 25);
@@ -534,8 +534,8 @@ static int32_t encode_vi(RISCVInsn opc, TCGReg rd, int32_t imm,
 
 /* Type-OPIVV/OPMVV/OPIVX/OPMVX, Vector load and store */
 
-static int32_t encode_v(RISCVInsn opc, TCGReg d, TCGReg s1,
-                        TCGReg s2, bool vm)
+static tcg_insn_unit encode_v(RISCVInsn opc, TCGReg d, TCGReg s1,
+                              TCGReg s2, bool vm)
 {
     return opc | (d & 0x1f) << 7 | (s1 & 0x1f) << 15 |
            (s2 & 0x1f) << 20 | (vm << 25);
@@ -543,20 +543,19 @@ static int32_t encode_v(RISCVInsn opc, TCGReg d, TCGReg s1,
 
 /* Vector vtype */
 
-static uint32_t encode_vtype(bool vta, bool vma,
-                            MemOp vsew, RISCVVlmul vlmul)
+static uint32_t encode_vtype(bool vta, bool vma, MemOp vsew, RISCVVlmul vlmul)
 {
     return vma << 7 | vta << 6 | vsew << 3 | vlmul;
 }
 
-static int32_t encode_vset(RISCVInsn opc, TCGReg rd,
-                           TCGArg rs1, uint32_t vtype)
+static tcg_insn_unit encode_vset(RISCVInsn opc, TCGReg rd,
+                                 TCGArg rs1, uint32_t vtype)
 {
     return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 | (vtype & 0x7ff) << 20;
 }
 
-static int32_t encode_vseti(RISCVInsn opc, TCGReg rd,
-                            uint32_t uimm, uint32_t vtype)
+static tcg_insn_unit encode_vseti(RISCVInsn opc, TCGReg rd,
+                                  uint32_t uimm, uint32_t vtype)
 {
     return opc | (rd & 0x1f) << 7 | (uimm & 0x1f) << 15 | (vtype & 0x3ff) << 20;
 }
-- 
2.53.0

[PATCH v3 02/11] tcg/riscv64: Rename sb-type to b-type format

[Richard Henderson]

The current riscv documentation calls this b-type.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index a26503fa1ed..a10b433f2ff 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -472,9 +472,9 @@ static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t im
     return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_simm12(imm);
 }
 
-/* Type-SB */
+/* Type-B */
 
-static tcg_insn_unit encode_sbimm12(uint32_t imm)
+static tcg_insn_unit encode_bimm12(uint32_t imm)
 {
     tcg_insn_unit ret = 0;
 
@@ -486,9 +486,9 @@ static tcg_insn_unit encode_sbimm12(uint32_t imm)
     return ret;
 }
 
-static tcg_insn_unit encode_sb(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
+static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
 {
-    return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_sbimm12(imm);
+    return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_bimm12(imm);
 }
 
 /* Type-U */
@@ -585,7 +585,7 @@ static void tcg_out_opc_store(TCGContext *s, RISCVInsn opc,
 static void tcg_out_opc_branch(TCGContext *s, RISCVInsn opc,
                                TCGReg rs1, TCGReg rs2, uint32_t imm)
 {
-    tcg_out32(s, encode_sb(opc, rs1, rs2, imm));
+    tcg_out32(s, encode_b(opc, rs1, rs2, imm));
 }
 
 static void tcg_out_opc_upper(TCGContext *s, RISCVInsn opc,
@@ -612,14 +612,14 @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
  * Relocations
  */
 
-static bool reloc_sbimm12(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
+static bool reloc_bimm12(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
 {
     const tcg_insn_unit *src_rx = tcg_splitwx_to_rx(src_rw);
     intptr_t offset = (intptr_t)target - (intptr_t)src_rx;
 
     tcg_debug_assert((offset & 1) == 0);
     if (offset == sextreg(offset, 0, 12)) {
-        *src_rw |= encode_sbimm12(offset);
+        *src_rw |= encode_bimm12(offset);
         return true;
     }
 
@@ -662,7 +662,7 @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
     tcg_debug_assert(addend == 0);
     switch (type) {
     case R_RISCV_BRANCH:
-        return reloc_sbimm12(code_ptr, (tcg_insn_unit *)value);
+        return reloc_bimm12(code_ptr, (tcg_insn_unit *)value);
     case R_RISCV_JAL:
         return reloc_jimm20(code_ptr, (tcg_insn_unit *)value);
     case R_RISCV_CALL:
@@ -1644,7 +1644,7 @@ static bool tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     MemOp opc = get_memop(l->oi);
 
     /* resolve label address */
-    if (!reloc_sbimm12(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+    if (!reloc_bimm12(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
         return false;
     }
 
@@ -1662,7 +1662,7 @@ static bool tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
     MemOp opc = get_memop(l->oi);
 
     /* resolve label address */
-    if (!reloc_sbimm12(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
+    if (!reloc_bimm12(l->label_ptr[0], tcg_splitwx_to_rx(s->code_ptr))) {
         return false;
     }
 
-- 
2.53.0

[PATCH v3 03/11] tcg/riscv64: Rename uj-type to j-type format

[Richard Henderson]

The current riscv documentation calls this j-type.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index a10b433f2ff..f77fded1dfa 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -503,9 +503,9 @@ static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, uint32_t imm)
     return opc | (rd & 0x1f) << 7 | encode_uimm20(imm);
 }
 
-/* Type-UJ */
+/* Type-J */
 
-static tcg_insn_unit encode_ujimm20(uint32_t imm)
+static tcg_insn_unit encode_jimm20(uint32_t imm)
 {
     tcg_insn_unit ret = 0;
 
@@ -517,9 +517,9 @@ static tcg_insn_unit encode_ujimm20(uint32_t imm)
     return ret;
 }
 
-static tcg_insn_unit encode_uj(RISCVInsn opc, TCGReg rd, uint32_t imm)
+static tcg_insn_unit encode_j(RISCVInsn opc, TCGReg rd, uint32_t imm)
 {
-    return opc | (rd & 0x1f) << 7 | encode_ujimm20(imm);
+    return opc | (rd & 0x1f) << 7 | encode_jimm20(imm);
 }
 
 
@@ -597,7 +597,7 @@ static void tcg_out_opc_upper(TCGContext *s, RISCVInsn opc,
 static void tcg_out_opc_jump(TCGContext *s, RISCVInsn opc,
                              TCGReg rd, uint32_t imm)
 {
-    tcg_out32(s, encode_uj(opc, rd, imm));
+    tcg_out32(s, encode_j(opc, rd, imm));
 }
 
 static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
@@ -633,7 +633,7 @@ static bool reloc_jimm20(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
 
     tcg_debug_assert((offset & 1) == 0);
     if (offset == sextreg(offset, 0, 20)) {
-        *src_rw |= encode_ujimm20(offset);
+        *src_rw |= encode_jimm20(offset);
         return true;
     }
 
@@ -1958,7 +1958,7 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
 
     /* Either directly branch, or fall through to indirect branch. */
     if (offset == sextreg(offset, 0, 20)) {
-        insn = encode_uj(OPC_JAL, TCG_REG_ZERO, offset);
+        insn = encode_j(OPC_JAL, TCG_REG_ZERO, offset);
     } else {
         insn = OPC_NOP;
     }
-- 
2.53.0

[PATCH v3 04/11] tcg/riscv64: Use signed type for encoding immediates

[Richard Henderson]

The immediate operands in the 5 base instruction formats are all signed,
so passing an unsigned type was logically incorrect.  Use tcg_target_long
not int32_t to avoid truncation, which will become relevant later.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index f77fded1dfa..99bc658c264 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -445,19 +445,20 @@ static tcg_insn_unit encode_r(RISCVInsn opc, TCGReg rd, TCGReg rs1, TCGReg rs2)
 
 /* Type-I */
 
-static tcg_insn_unit encode_imm12(uint32_t imm)
+static tcg_insn_unit encode_imm12(tcg_target_long imm)
 {
     return (imm & 0xfff) << 20;
 }
 
-static tcg_insn_unit encode_i(RISCVInsn opc, TCGReg rd, TCGReg rs1, uint32_t imm)
+static tcg_insn_unit encode_i(RISCVInsn opc, TCGReg rd,
+                              TCGReg rs1, tcg_target_long imm)
 {
     return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 | encode_imm12(imm);
 }
 
 /* Type-S */
 
-static tcg_insn_unit encode_simm12(uint32_t imm)
+static tcg_insn_unit encode_simm12(tcg_target_long imm)
 {
     tcg_insn_unit ret = 0;
 
@@ -467,14 +468,15 @@ static tcg_insn_unit encode_simm12(uint32_t imm)
     return ret;
 }
 
-static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
+static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1,
+                              TCGReg rs2, tcg_target_long imm)
 {
     return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_simm12(imm);
 }
 
 /* Type-B */
 
-static tcg_insn_unit encode_bimm12(uint32_t imm)
+static tcg_insn_unit encode_bimm12(tcg_target_long imm)
 {
     tcg_insn_unit ret = 0;
 
@@ -486,26 +488,27 @@ static tcg_insn_unit encode_bimm12(uint32_t imm)
     return ret;
 }
 
-static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1, TCGReg rs2, uint32_t imm)
+static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1,
+                              TCGReg rs2, tcg_target_long imm)
 {
     return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_bimm12(imm);
 }
 
 /* Type-U */
 
-static tcg_insn_unit encode_uimm20(uint32_t imm)
+static tcg_insn_unit encode_uimm20(tcg_target_long imm)
 {
     return imm & 0xfffff000;
 }
 
-static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, uint32_t imm)
+static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, tcg_target_long imm)
 {
     return opc | (rd & 0x1f) << 7 | encode_uimm20(imm);
 }
 
 /* Type-J */
 
-static tcg_insn_unit encode_jimm20(uint32_t imm)
+static tcg_insn_unit encode_jimm20(tcg_target_long imm)
 {
     tcg_insn_unit ret = 0;
 
@@ -517,7 +520,7 @@ static tcg_insn_unit encode_jimm20(uint32_t imm)
     return ret;
 }
 
-static tcg_insn_unit encode_j(RISCVInsn opc, TCGReg rd, uint32_t imm)
+static tcg_insn_unit encode_j(RISCVInsn opc, TCGReg rd, tcg_target_long imm)
 {
     return opc | (rd & 0x1f) << 7 | encode_jimm20(imm);
 }
@@ -571,31 +574,31 @@ static void tcg_out_opc_reg(TCGContext *s, RISCVInsn opc,
 }
 
 static void tcg_out_opc_imm(TCGContext *s, RISCVInsn opc,
-                            TCGReg rd, TCGReg rs1, TCGArg imm)
+                            TCGReg rd, TCGReg rs1, tcg_target_long imm)
 {
     tcg_out32(s, encode_i(opc, rd, rs1, imm));
 }
 
 static void tcg_out_opc_store(TCGContext *s, RISCVInsn opc,
-                              TCGReg rs1, TCGReg rs2, uint32_t imm)
+                              TCGReg rs1, TCGReg rs2, tcg_target_long imm)
 {
     tcg_out32(s, encode_s(opc, rs1, rs2, imm));
 }
 
 static void tcg_out_opc_branch(TCGContext *s, RISCVInsn opc,
-                               TCGReg rs1, TCGReg rs2, uint32_t imm)
+                               TCGReg rs1, TCGReg rs2, tcg_target_long imm)
 {
     tcg_out32(s, encode_b(opc, rs1, rs2, imm));
 }
 
 static void tcg_out_opc_upper(TCGContext *s, RISCVInsn opc,
-                              TCGReg rd, uint32_t imm)
+                              TCGReg rd, tcg_target_long imm)
 {
     tcg_out32(s, encode_u(opc, rd, imm));
 }
 
 static void tcg_out_opc_jump(TCGContext *s, RISCVInsn opc,
-                             TCGReg rd, uint32_t imm)
+                             TCGReg rd, tcg_target_long imm)
 {
     tcg_out32(s, encode_j(opc, rd, imm));
 }
-- 
2.53.0

[PATCH v3 05/11] tcg/riscv64: Adjust sign of lui immediate in tcg_out_movi

[Richard Henderson]

No real bug fix here, as we've already shown the full value
fits in int32_t, but simple subtraction in tcg_target_long
may produce a positive out-of-range intermediate.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index 99bc658c264..d0c9d8e9cd2 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -792,21 +792,22 @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
                          tcg_target_long val)
 {
-    tcg_target_long lo, hi, tmp;
+    tcg_target_long tmp;
+    int32_t lo, hi;
     int shift, ret;
 
     if (type == TCG_TYPE_I32) {
         val = (int32_t)val;
     }
 
-    lo = sextreg(val, 0, 12);
+    lo = sextract32(val, 0, 12);
     if (val == lo) {
         tcg_out_opc_imm(s, OPC_ADDI, rd, TCG_REG_ZERO, lo);
         return;
     }
 
-    hi = val - lo;
     if (val == (int32_t)val) {
+        hi = val - lo;
         tcg_out_opc_upper(s, OPC_LUI, rd, hi);
         if (lo != 0) {
             tcg_out_opc_imm(s, OPC_ADDIW, rd, rd, lo);
-- 
2.53.0

[PATCH v3 06/11] tcg/riscv64: Assert immediate in range for [isu]-type insns

[Richard Henderson]

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index d0c9d8e9cd2..a5ed1e95722 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -447,6 +447,7 @@ static tcg_insn_unit encode_r(RISCVInsn opc, TCGReg rd, TCGReg rs1, TCGReg rs2)
 
 static tcg_insn_unit encode_imm12(tcg_target_long imm)
 {
+    tcg_debug_assert(imm == sextract32(imm, 0, 12));
     return (imm & 0xfff) << 20;
 }
 
@@ -462,6 +463,7 @@ static tcg_insn_unit encode_simm12(tcg_target_long imm)
 {
     tcg_insn_unit ret = 0;
 
+    tcg_debug_assert(imm == sextract32(imm, 0, 12));
     ret |= (imm & 0xFE0) << 20;
     ret |= (imm & 0x1F) << 7;
 
@@ -498,7 +500,8 @@ static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1,
 
 static tcg_insn_unit encode_uimm20(tcg_target_long imm)
 {
-    return imm & 0xfffff000;
+    tcg_debug_assert(imm == (int32_t)imm && (imm & 0xfff) == 0);
+    return imm & 0xfffff000u;
 }
 
 static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, tcg_target_long imm)
-- 
2.53.0

[PATCH v3 07/11] tcg/riscv64: Return success from encode_jimm

[Richard Henderson]

Centralize the range test for this encoding.
Directly OR into the insn value.
Assert success in encode_j.
Use encode_jimm in tcg_out_call_int.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 46 ++++++++++++++++--------------------
 1 file changed, 21 insertions(+), 25 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index a5ed1e95722..09bfce79bb7 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -511,24 +511,26 @@ static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, tcg_target_long imm)
 
 /* Type-J */
 
-static tcg_insn_unit encode_jimm20(tcg_target_long imm)
+static bool encode_jimm20(tcg_insn_unit *insn, tcg_target_long imm)
 {
-    tcg_insn_unit ret = 0;
-
-    ret |= (imm & 0x0007fe) << (21 - 1);
-    ret |= (imm & 0x000800) << (20 - 11);
-    ret |= (imm & 0x0ff000) << (12 - 12);
-    ret |= (imm & 0x100000) << (31 - 20);
-
-    return ret;
+    if ((imm & 1) == 0 && imm == sextract32(imm, 0, 20)) {
+        *insn |= ((imm & 0x0007fe) << (21 - 1)
+                  | (imm & 0x000800) << (20 - 11)
+                  | (imm & 0x0ff000) << (12 - 12)
+                  | (imm & 0x100000) << (31 - 20));
+        return true;
+    }
+    return false;
 }
 
 static tcg_insn_unit encode_j(RISCVInsn opc, TCGReg rd, tcg_target_long imm)
 {
-    return opc | (rd & 0x1f) << 7 | encode_jimm20(imm);
+    tcg_insn_unit insn = opc | (rd & 0x1f) << 7;
+    bool ok = encode_jimm20(&insn, imm);
+    tcg_debug_assert(ok);
+    return insn;
 }
 
-
 /* Type-OPIVI */
 
 static tcg_insn_unit encode_vi(RISCVInsn opc, TCGReg rd, int32_t imm,
@@ -638,12 +640,7 @@ static bool reloc_jimm20(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
     intptr_t offset = (intptr_t)target - (intptr_t)src_rx;
 
     tcg_debug_assert((offset & 1) == 0);
-    if (offset == sextreg(offset, 0, 20)) {
-        *src_rw |= encode_jimm20(offset);
-        return true;
-    }
-
-    return false;
+    return encode_jimm20(src_rw, offset);
 }
 
 static bool reloc_call(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
@@ -1577,14 +1574,15 @@ static void tcg_out_call_int(TCGContext *s, const tcg_insn_unit *arg, bool tail)
 {
     TCGReg link = tail ? TCG_REG_ZERO : TCG_REG_RA;
     ptrdiff_t offset = tcg_pcrel_diff(s, arg);
+    tcg_insn_unit insn = encode_j(OPC_JAL, link, 0);
     int ret;
 
     init_setting_vtype(s);
 
     tcg_debug_assert((offset & 1) == 0);
-    if (offset == sextreg(offset, 0, 20)) {
-        /* short jump: -2097150 to 2097152 */
-        tcg_out_opc_jump(s, OPC_JAL, link, offset);
+    if (encode_jimm20(&insn, offset)) {
+        /* short jump */
+        tcg_out32(s, insn);
     } else if (offset == (int32_t)offset) {
         /* long jump: -2147483646 to 2147483648 */
         tcg_out_opc_upper(s, OPC_AUIPC, TCG_REG_TMP0, 0);
@@ -1961,15 +1959,13 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
 {
     uintptr_t addr = tb->jmp_target_addr[n];
     ptrdiff_t offset = addr - jmp_rx;
-    tcg_insn_unit insn;
+    tcg_insn_unit insn = OPC_JAL; /* rd = TCG_REG_ZERO */
 
     /* Either directly branch, or fall through to indirect branch. */
-    if (offset == sextreg(offset, 0, 20)) {
-        insn = encode_j(OPC_JAL, TCG_REG_ZERO, offset);
-    } else {
+    if (!encode_jimm20(&insn, offset)) {
         insn = OPC_NOP;
     }
-    qatomic_set((uint32_t *)jmp_rw, insn);
+    qatomic_set((tcg_insn_unit *)jmp_rw, insn);
     flush_idcache_range(jmp_rx, jmp_rw, 4);
 }
 
-- 
2.53.0

[PATCH v3 08/11] tcg/riscv64: Return success from encode_bimm

[Richard Henderson]

Centralize the range test for this encoding.
Directly OR into the insn value.
Assert success in encode_b.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index 09bfce79bb7..e8e1480016c 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -478,22 +478,25 @@ static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1,
 
 /* Type-B */
 
-static tcg_insn_unit encode_bimm12(tcg_target_long imm)
+static bool encode_bimm12(tcg_insn_unit *insn, tcg_target_long imm)
 {
-    tcg_insn_unit ret = 0;
-
-    ret |= (imm & 0x1000) << 19;
-    ret |= (imm & 0x7e0) << 20;
-    ret |= (imm & 0x1e) << 7;
-    ret |= (imm & 0x800) >> 4;
-
-    return ret;
+    if ((imm & 1) == 0 && imm == sextract32(imm, 0, 12)) {
+        *insn |= ((imm & 0x1000) << 19
+                  | (imm & 0x7e0) << 20
+                  | (imm & 0x1e) << 7
+                  | (imm & 0x800) >> 4);
+        return true;
+    }
+    return false;
 }
 
 static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1,
                               TCGReg rs2, tcg_target_long imm)
 {
-    return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 | encode_bimm12(imm);
+    tcg_insn_unit insn = opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20;
+    bool ok = encode_bimm12(&insn, imm);
+    tcg_debug_assert(ok);
+    return insn;
 }
 
 /* Type-U */
@@ -626,12 +629,7 @@ static bool reloc_bimm12(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
     intptr_t offset = (intptr_t)target - (intptr_t)src_rx;
 
     tcg_debug_assert((offset & 1) == 0);
-    if (offset == sextreg(offset, 0, 12)) {
-        *src_rw |= encode_bimm12(offset);
-        return true;
-    }
-
-    return false;
+    return encode_bimm12(src_rw, offset);
 }
 
 static bool reloc_jimm20(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
-- 
2.53.0

[PATCH v3 09/11] tcg/riscv64: Fix off-by-one in branch range tests

[Richard Henderson]

We tested the size of the field encoding, not the
actual range of values.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index e8e1480016c..c167ff5237a 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -480,7 +480,8 @@ static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1,
 
 static bool encode_bimm12(tcg_insn_unit *insn, tcg_target_long imm)
 {
-    if ((imm & 1) == 0 && imm == sextract32(imm, 0, 12)) {
+    /* The 13-bit immediate is stored in 12 bits, with bit 0 zero. */
+    if ((imm & 1) == 0 && imm == sextract32(imm, 0, 13)) {
         *insn |= ((imm & 0x1000) << 19
                   | (imm & 0x7e0) << 20
                   | (imm & 0x1e) << 7
@@ -516,7 +517,8 @@ static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, tcg_target_long imm)
 
 static bool encode_jimm20(tcg_insn_unit *insn, tcg_target_long imm)
 {
-    if ((imm & 1) == 0 && imm == sextract32(imm, 0, 20)) {
+    /* The 21-bit immediate is stored in 20 bits, with bit 0 zero. */
+    if ((imm & 1) == 0 && imm == sextract32(imm, 0, 21)) {
         *insn |= ((imm & 0x0007fe) << (21 - 1)
                   | (imm & 0x000800) << (20 - 11)
                   | (imm & 0x0ff000) << (12 - 12)
-- 
2.53.0

[PATCH v3 10/11] tcg/riscv64: Validate AUIPC relocation range

[Richard Henderson]

From: Max Chou <max.chou@sifive.com>

reloc_call splits a PC-relative offset into a signed 12-bit low
immediate and an AUIPC contribution. When the low immediate carries
into bit 31, the existing 32-bit arithmetic can accept an unencodable
positive 0x80000000 AUIPC contribution.

Keep the split in pointer-width arithmetic and reject it unless the
rounded upper contribution is representable as signed 32-bit. Factor
this validation into split_auipc_offset so reloc_call retains its
existing failure contract.

Fixes: dfa8e74f9463 ("tcg/riscv: Add the relocation functions")
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
[rth: Pass target as intptr_t to split_auipc_offset.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index c167ff5237a..7754bcf39f2 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -643,14 +643,28 @@ static bool reloc_jimm20(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
     return encode_jimm20(src_rw, offset);
 }
 
-static bool reloc_call(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
+static bool split_auipc_offset(tcg_insn_unit *src_rw, intptr_t target,
+                               int32_t *ret_hi, int32_t *ret_lo)
 {
     const tcg_insn_unit *src_rx = tcg_splitwx_to_rx(src_rw);
-    intptr_t offset = (intptr_t)target - (intptr_t)src_rx;
-    int32_t lo = sextreg(offset, 0, 12);
-    int32_t hi = offset - lo;
+    intptr_t offset = target - (intptr_t)src_rx;
+    int32_t lo = sextract32(offset, 0, 12);
+    intptr_t hi = offset - lo;
 
-    if (offset == hi + lo) {
+    /* AUIPC sign-extends its 20-bit immediate after shifting by 12. */
+    if (hi == (int32_t)hi) {
+        *ret_lo = lo;
+        *ret_hi = hi;
+        return true;
+    }
+    return false;
+}
+
+static bool reloc_call(tcg_insn_unit *src_rw, const tcg_insn_unit *target)
+{
+    int32_t lo, hi;
+
+    if (split_auipc_offset(src_rw, (intptr_t)target, &hi, &lo)) {
         src_rw[0] |= encode_uimm20(hi);
         src_rw[1] |= encode_imm12(lo);
         return true;
-- 
2.53.0

[PATCH v3 11/11] tcg/riscv64: Fall back when AUIPC pairs are out of range

[Richard Henderson]

From: Max Chou <max.chou@sifive.com>

tcg_out_movi, tcg_out_call_int, and tcg_out_ldst only check whether a
PC-relative displacement is signed 32-bit before emitting an AUIPC pair.
This does not account for rounding the signed 12-bit immediate, which
can require an unencodable positive 0x80000000 AUIPC contribution.

Validate the split and emit the pair only when it fits.

Fixes: dfa8e74f9463 ("tcg/riscv: Add the relocation functions")
Signed-off-by: Max Chou <max.chou@sifive.com>
[rth: Drop 'ret' local variables; update tcg_out_ldst too.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv64/tcg-target.c.inc | 54 +++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 29 deletions(-)

diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-target.c.inc
index 7754bcf39f2..682d9e8320b 100644
--- a/tcg/riscv64/tcg-target.c.inc
+++ b/tcg/riscv64/tcg-target.c.inc
@@ -808,7 +808,7 @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
 {
     tcg_target_long tmp;
     int32_t lo, hi;
-    int shift, ret;
+    int shift;
 
     if (type == TCG_TYPE_I32) {
         val = (int32_t)val;
@@ -829,12 +829,9 @@ static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
         return;
     }
 
-    tmp = tcg_pcrel_diff(s, (void *)val);
-    if (tmp == (int32_t)tmp) {
-        tcg_out_opc_upper(s, OPC_AUIPC, rd, 0);
-        tcg_out_opc_imm(s, OPC_ADDI, rd, rd, 0);
-        ret = reloc_call(s->code_ptr - 2, (const tcg_insn_unit *)val);
-        tcg_debug_assert(ret == true);
+    if (split_auipc_offset(s->code_ptr, val, &hi, &lo)) {
+        tcg_out_opc_upper(s, OPC_AUIPC, rd, hi);
+        tcg_out_opc_imm(s, OPC_ADDI, rd, rd, lo);
         return;
     }
 
@@ -952,16 +949,16 @@ static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg ret, TCGReg arg)
 static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
                          TCGReg addr, intptr_t offset)
 {
-    intptr_t imm12 = sextreg(offset, 0, 12);
+    int32_t lo = sextract32(offset, 0, 12);
 
-    if (offset != imm12) {
-        intptr_t diff = tcg_pcrel_diff(s, (void *)offset);
+    if (offset != lo) {
+        int32_t hi;
 
-        if (addr == TCG_REG_ZERO && diff == (int32_t)diff) {
-            imm12 = sextreg(diff, 0, 12);
-            tcg_out_opc_upper(s, OPC_AUIPC, TCG_REG_TMP2, diff - imm12);
+        if (addr == TCG_REG_ZERO &&
+            split_auipc_offset(s->code_ptr, offset, &hi, &lo)) {
+            tcg_out_opc_upper(s, OPC_AUIPC, TCG_REG_TMP2, hi);
         } else {
-            tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP2, offset - imm12);
+            tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP2, offset - lo);
             if (addr != TCG_REG_ZERO) {
                 tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP2, TCG_REG_TMP2, addr);
             }
@@ -974,7 +971,7 @@ static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
     case OPC_SH:
     case OPC_SW:
     case OPC_SD:
-        tcg_out_opc_store(s, opc, addr, data, imm12);
+        tcg_out_opc_store(s, opc, addr, data, lo);
         break;
     case OPC_LB:
     case OPC_LBU:
@@ -983,7 +980,7 @@ static void tcg_out_ldst(TCGContext *s, RISCVInsn opc, TCGReg data,
     case OPC_LW:
     case OPC_LWU:
     case OPC_LD:
-        tcg_out_opc_imm(s, opc, data, addr, imm12);
+        tcg_out_opc_imm(s, opc, data, addr, lo);
         break;
     default:
         g_assert_not_reached();
@@ -1589,7 +1586,7 @@ static void tcg_out_call_int(TCGContext *s, const tcg_insn_unit *arg, bool tail)
     TCGReg link = tail ? TCG_REG_ZERO : TCG_REG_RA;
     ptrdiff_t offset = tcg_pcrel_diff(s, arg);
     tcg_insn_unit insn = encode_j(OPC_JAL, link, 0);
-    int ret;
+    int32_t lo, hi;
 
     init_setting_vtype(s);
 
@@ -1597,19 +1594,18 @@ static void tcg_out_call_int(TCGContext *s, const tcg_insn_unit *arg, bool tail)
     if (encode_jimm20(&insn, offset)) {
         /* short jump */
         tcg_out32(s, insn);
-    } else if (offset == (int32_t)offset) {
-        /* long jump: -2147483646 to 2147483648 */
-        tcg_out_opc_upper(s, OPC_AUIPC, TCG_REG_TMP0, 0);
-        tcg_out_opc_imm(s, OPC_JALR, link, TCG_REG_TMP0, 0);
-        ret = reloc_call(s->code_ptr - 2, arg);
-        tcg_debug_assert(ret == true);
-    } else {
-        /* far jump: 64-bit */
-        tcg_target_long imm = sextreg((tcg_target_long)arg, 0, 12);
-        tcg_target_long base = (tcg_target_long)arg - imm;
-        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP0, base);
-        tcg_out_opc_imm(s, OPC_JALR, link, TCG_REG_TMP0, imm);
+        return;
     }
+
+    if (split_auipc_offset(s->code_ptr, (intptr_t)arg, &hi, &lo)) {
+        /* long jump */
+        tcg_out_opc_upper(s, OPC_AUIPC, TCG_REG_TMP0, hi);
+    } else {
+        /* far jump */
+        lo = sextract32((intptr_t)arg, 0, 12);
+        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_TMP0, (intptr_t)arg - lo);
+    }
+    tcg_out_opc_imm(s, OPC_JALR, link, TCG_REG_TMP0, lo);
 }
 
 static void tcg_out_call(TCGContext *s, const tcg_insn_unit *arg,
-- 
2.53.0

Re: [PATCH v3 00/11] tcg/riscv64: Fix AUIPC pair range validation

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> Hi Max,
> 
> In v2, the change from int32_t to uint32_t is pretty much
> the opposite of what should have been done, since all of
> these are logically signed values.  I've adjusted all of
> the encoders to take signed inputs and assert in range.
> 
> In the process, I noticed tha the branch range tests were
> off by one.  Now all performed in exactly one place.
> 
> Finally, tcg_out_ldst needed updates for AUIPC as well.
> 
> I've tested this lightly so far; full testing on a rather
> slow riscv machine is still on-going.
> 

Hi Richard,

Thank you for the v3 patchset series.
I’m currently reviewing and trying to test it in my environment.
Could you please let me know what full testing you used to test this
patchset?

Thanks,
rnax

> 
> r~
> 
> 
> Max Chou (2):
>   tcg/riscv64: Validate AUIPC relocation range
>   tcg/riscv64: Fall back when AUIPC pairs are out of range
> 
> Richard Henderson (9):
>   tcg/riscv64: Return tcg_insn_unit from insn encoders
>   tcg/riscv64: Rename sb-type to b-type format
>   tcg/riscv64: Rename uj-type to j-type format
>   tcg/riscv64: Use signed type for encoding immediates
>   tcg/riscv64: Adjust sign of lui immediate in tcg_out_movi
>   tcg/riscv64: Assert immediate in range for [isu]-type insns
>   tcg/riscv64: Return success from encode_jimm
>   tcg/riscv64: Return success from encode_bimm
>   tcg/riscv64: Fix off-by-one in branch range tests
> 
>  tcg/riscv64/tcg-target.c.inc | 230 ++++++++++++++++++-----------------
>  1 file changed, 121 insertions(+), 109 deletions(-)
> 
> -- 
> 2.53.0
> 

Re: [PATCH v3 00/11] tcg/riscv64: Fix AUIPC pair range validation

[Richard Henderson]

Ping.

On 9/13/26 17:08, Richard Henderson wrote:
> Hi Max,
> 
> In v2, the change from int32_t to uint32_t is pretty much
> the opposite of what should have been done, since all of
> these are logically signed values.  I've adjusted all of
> the encoders to take signed inputs and assert in range.
> 
> In the process, I noticed tha the branch range tests were
> off by one.  Now all performed in exactly one place.
> 
> Finally, tcg_out_ldst needed updates for AUIPC as well.
> 
> I've tested this lightly so far; full testing on a rather
> slow riscv machine is still on-going.
> 
> 
> r~
> 
> 
> Max Chou (2):
>    tcg/riscv64: Validate AUIPC relocation range
>    tcg/riscv64: Fall back when AUIPC pairs are out of range
> 
> Richard Henderson (9):
>    tcg/riscv64: Return tcg_insn_unit from insn encoders
>    tcg/riscv64: Rename sb-type to b-type format
>    tcg/riscv64: Rename uj-type to j-type format
>    tcg/riscv64: Use signed type for encoding immediates
>    tcg/riscv64: Adjust sign of lui immediate in tcg_out_movi
>    tcg/riscv64: Assert immediate in range for [isu]-type insns
>    tcg/riscv64: Return success from encode_jimm
>    tcg/riscv64: Return success from encode_bimm
>    tcg/riscv64: Fix off-by-one in branch range tests
> 
>   tcg/riscv64/tcg-target.c.inc | 230 ++++++++++++++++++-----------------
>   1 file changed, 121 insertions(+), 109 deletions(-)
> 

Re: [PATCH v3 01/11] tcg/riscv64: Return tcg_insn_unit from insn encoders

[Alistair Francis]

On Sun, 2026-09-13 at 14:08 -1000, Richard Henderson wrote:
> Returning int32_t was logically incorrect.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  tcg/riscv64/tcg-target.c.inc | 47 ++++++++++++++++++----------------
> --
>  1 file changed, 23 insertions(+), 24 deletions(-)
> 
> diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-
> target.c.inc
> index 2ce9d47a633..a26503fa1ed 100644
> --- a/tcg/riscv64/tcg-target.c.inc
> +++ b/tcg/riscv64/tcg-target.c.inc
> @@ -438,28 +438,28 @@ static bool tcg_target_const_match(int64_t val,
> int ct,
>  
>  /* Type-R */
>  
> -static int32_t encode_r(RISCVInsn opc, TCGReg rd, TCGReg rs1, TCGReg
> rs2)
> +static tcg_insn_unit encode_r(RISCVInsn opc, TCGReg rd, TCGReg rs1,
> TCGReg rs2)
>  {
>      return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 | (rs2 &
> 0x1f) << 20;
>  }
>  
>  /* Type-I */
>  
> -static int32_t encode_imm12(uint32_t imm)
> +static tcg_insn_unit encode_imm12(uint32_t imm)
>  {
>      return (imm & 0xfff) << 20;
>  }
>  
> -static int32_t encode_i(RISCVInsn opc, TCGReg rd, TCGReg rs1,
> uint32_t imm)
> +static tcg_insn_unit encode_i(RISCVInsn opc, TCGReg rd, TCGReg rs1,
> uint32_t imm)
>  {
>      return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 |
> encode_imm12(imm);
>  }
>  
>  /* Type-S */
>  
> -static int32_t encode_simm12(uint32_t imm)
> +static tcg_insn_unit encode_simm12(uint32_t imm)
>  {
> -    int32_t ret = 0;
> +    tcg_insn_unit ret = 0;
>  
>      ret |= (imm & 0xFE0) << 20;
>      ret |= (imm & 0x1F) << 7;
> @@ -467,16 +467,16 @@ static int32_t encode_simm12(uint32_t imm)
>      return ret;
>  }
>  
> -static int32_t encode_s(RISCVInsn opc, TCGReg rs1, TCGReg rs2,
> uint32_t imm)
> +static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1, TCGReg rs2,
> uint32_t imm)
>  {
>      return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 |
> encode_simm12(imm);
>  }
>  
>  /* Type-SB */
>  
> -static int32_t encode_sbimm12(uint32_t imm)
> +static tcg_insn_unit encode_sbimm12(uint32_t imm)
>  {
> -    int32_t ret = 0;
> +    tcg_insn_unit ret = 0;
>  
>      ret |= (imm & 0x1000) << 19;
>      ret |= (imm & 0x7e0) << 20;
> @@ -486,28 +486,28 @@ static int32_t encode_sbimm12(uint32_t imm)
>      return ret;
>  }
>  
> -static int32_t encode_sb(RISCVInsn opc, TCGReg rs1, TCGReg rs2,
> uint32_t imm)
> +static tcg_insn_unit encode_sb(RISCVInsn opc, TCGReg rs1, TCGReg
> rs2, uint32_t imm)
>  {
>      return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 |
> encode_sbimm12(imm);
>  }
>  
>  /* Type-U */
>  
> -static int32_t encode_uimm20(uint32_t imm)
> +static tcg_insn_unit encode_uimm20(uint32_t imm)
>  {
>      return imm & 0xfffff000;
>  }
>  
> -static int32_t encode_u(RISCVInsn opc, TCGReg rd, uint32_t imm)
> +static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, uint32_t
> imm)
>  {
>      return opc | (rd & 0x1f) << 7 | encode_uimm20(imm);
>  }
>  
>  /* Type-UJ */
>  
> -static int32_t encode_ujimm20(uint32_t imm)
> +static tcg_insn_unit encode_ujimm20(uint32_t imm)
>  {
> -    int32_t ret = 0;
> +    tcg_insn_unit ret = 0;
>  
>      ret |= (imm & 0x0007fe) << (21 - 1);
>      ret |= (imm & 0x000800) << (20 - 11);
> @@ -517,7 +517,7 @@ static int32_t encode_ujimm20(uint32_t imm)
>      return ret;
>  }
>  
> -static int32_t encode_uj(RISCVInsn opc, TCGReg rd, uint32_t imm)
> +static tcg_insn_unit encode_uj(RISCVInsn opc, TCGReg rd, uint32_t
> imm)
>  {
>      return opc | (rd & 0x1f) << 7 | encode_ujimm20(imm);
>  }
> @@ -525,8 +525,8 @@ static int32_t encode_uj(RISCVInsn opc, TCGReg
> rd, uint32_t imm)
>  
>  /* Type-OPIVI */
>  
> -static int32_t encode_vi(RISCVInsn opc, TCGReg rd, int32_t imm,
> -                         TCGReg vs2, bool vm)
> +static tcg_insn_unit encode_vi(RISCVInsn opc, TCGReg rd, int32_t
> imm,
> +                               TCGReg vs2, bool vm)
>  {
>      return opc | (rd & 0x1f) << 7 | (imm & 0x1f) << 15 |
>             (vs2 & 0x1f) << 20 | (vm << 25);
> @@ -534,8 +534,8 @@ static int32_t encode_vi(RISCVInsn opc, TCGReg
> rd, int32_t imm,
>  
>  /* Type-OPIVV/OPMVV/OPIVX/OPMVX, Vector load and store */
>  
> -static int32_t encode_v(RISCVInsn opc, TCGReg d, TCGReg s1,
> -                        TCGReg s2, bool vm)
> +static tcg_insn_unit encode_v(RISCVInsn opc, TCGReg d, TCGReg s1,
> +                              TCGReg s2, bool vm)
>  {
>      return opc | (d & 0x1f) << 7 | (s1 & 0x1f) << 15 |
>             (s2 & 0x1f) << 20 | (vm << 25);
> @@ -543,20 +543,19 @@ static int32_t encode_v(RISCVInsn opc, TCGReg
> d, TCGReg s1,
>  
>  /* Vector vtype */
>  
> -static uint32_t encode_vtype(bool vta, bool vma,
> -                            MemOp vsew, RISCVVlmul vlmul)
> +static uint32_t encode_vtype(bool vta, bool vma, MemOp vsew,
> RISCVVlmul vlmul)
>  {
>      return vma << 7 | vta << 6 | vsew << 3 | vlmul;
>  }
>  
> -static int32_t encode_vset(RISCVInsn opc, TCGReg rd,
> -                           TCGArg rs1, uint32_t vtype)
> +static tcg_insn_unit encode_vset(RISCVInsn opc, TCGReg rd,
> +                                 TCGArg rs1, uint32_t vtype)
>  {
>      return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 | (vtype &
> 0x7ff) << 20;
>  }
>  
> -static int32_t encode_vseti(RISCVInsn opc, TCGReg rd,
> -                            uint32_t uimm, uint32_t vtype)
> +static tcg_insn_unit encode_vseti(RISCVInsn opc, TCGReg rd,
> +                                  uint32_t uimm, uint32_t vtype)
>  {
>      return opc | (rd & 0x1f) << 7 | (uimm & 0x1f) << 15 | (vtype &
> 0x3ff) << 20;
>  }

Re: [PATCH v3 02/11] tcg/riscv64: Rename sb-type to b-type format

[Alistair Francis]

On Sun, 2026-09-13 at 14:08 -1000, Richard Henderson wrote:
> The current riscv documentation calls this b-type.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  tcg/riscv64/tcg-target.c.inc | 20 ++++++++++----------
>  1 file changed, 10 insertions(+), 10 deletions(-)
> 
> diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-
> target.c.inc
> index a26503fa1ed..a10b433f2ff 100644
> --- a/tcg/riscv64/tcg-target.c.inc
> +++ b/tcg/riscv64/tcg-target.c.inc
> @@ -472,9 +472,9 @@ static tcg_insn_unit encode_s(RISCVInsn opc,
> TCGReg rs1, TCGReg rs2, uint32_t im
>      return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 |
> encode_simm12(imm);
>  }
>  
> -/* Type-SB */
> +/* Type-B */
>  
> -static tcg_insn_unit encode_sbimm12(uint32_t imm)
> +static tcg_insn_unit encode_bimm12(uint32_t imm)
>  {
>      tcg_insn_unit ret = 0;
>  
> @@ -486,9 +486,9 @@ static tcg_insn_unit encode_sbimm12(uint32_t imm)
>      return ret;
>  }
>  
> -static tcg_insn_unit encode_sb(RISCVInsn opc, TCGReg rs1, TCGReg
> rs2, uint32_t imm)
> +static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1, TCGReg rs2,
> uint32_t imm)
>  {
> -    return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 |
> encode_sbimm12(imm);
> +    return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 |
> encode_bimm12(imm);
>  }
>  
>  /* Type-U */
> @@ -585,7 +585,7 @@ static void tcg_out_opc_store(TCGContext *s,
> RISCVInsn opc,
>  static void tcg_out_opc_branch(TCGContext *s, RISCVInsn opc,
>                                 TCGReg rs1, TCGReg rs2, uint32_t imm)
>  {
> -    tcg_out32(s, encode_sb(opc, rs1, rs2, imm));
> +    tcg_out32(s, encode_b(opc, rs1, rs2, imm));
>  }
>  
>  static void tcg_out_opc_upper(TCGContext *s, RISCVInsn opc,
> @@ -612,14 +612,14 @@ static void tcg_out_nop_fill(tcg_insn_unit *p,
> int count)
>   * Relocations
>   */
>  
> -static bool reloc_sbimm12(tcg_insn_unit *src_rw, const tcg_insn_unit
> *target)
> +static bool reloc_bimm12(tcg_insn_unit *src_rw, const tcg_insn_unit
> *target)
>  {
>      const tcg_insn_unit *src_rx = tcg_splitwx_to_rx(src_rw);
>      intptr_t offset = (intptr_t)target - (intptr_t)src_rx;
>  
>      tcg_debug_assert((offset & 1) == 0);
>      if (offset == sextreg(offset, 0, 12)) {
> -        *src_rw |= encode_sbimm12(offset);
> +        *src_rw |= encode_bimm12(offset);
>          return true;
>      }
>  
> @@ -662,7 +662,7 @@ static bool patch_reloc(tcg_insn_unit *code_ptr,
> int type,
>      tcg_debug_assert(addend == 0);
>      switch (type) {
>      case R_RISCV_BRANCH:
> -        return reloc_sbimm12(code_ptr, (tcg_insn_unit *)value);
> +        return reloc_bimm12(code_ptr, (tcg_insn_unit *)value);
>      case R_RISCV_JAL:
>          return reloc_jimm20(code_ptr, (tcg_insn_unit *)value);
>      case R_RISCV_CALL:
> @@ -1644,7 +1644,7 @@ static bool
> tcg_out_qemu_ld_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
>      MemOp opc = get_memop(l->oi);
>  
>      /* resolve label address */
> -    if (!reloc_sbimm12(l->label_ptr[0], tcg_splitwx_to_rx(s-
> >code_ptr))) {
> +    if (!reloc_bimm12(l->label_ptr[0], tcg_splitwx_to_rx(s-
> >code_ptr))) {
>          return false;
>      }
>  
> @@ -1662,7 +1662,7 @@ static bool
> tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l)
>      MemOp opc = get_memop(l->oi);
>  
>      /* resolve label address */
> -    if (!reloc_sbimm12(l->label_ptr[0], tcg_splitwx_to_rx(s-
> >code_ptr))) {
> +    if (!reloc_bimm12(l->label_ptr[0], tcg_splitwx_to_rx(s-
> >code_ptr))) {
>          return false;
>      }
>  

Re: [PATCH v3 03/11] tcg/riscv64: Rename uj-type to j-type format

[Alistair Francis]

On Sun, 2026-09-13 at 14:08 -1000, Richard Henderson wrote:
> The current riscv documentation calls this j-type.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  tcg/riscv64/tcg-target.c.inc | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-
> target.c.inc
> index a10b433f2ff..f77fded1dfa 100644
> --- a/tcg/riscv64/tcg-target.c.inc
> +++ b/tcg/riscv64/tcg-target.c.inc
> @@ -503,9 +503,9 @@ static tcg_insn_unit encode_u(RISCVInsn opc,
> TCGReg rd, uint32_t imm)
>      return opc | (rd & 0x1f) << 7 | encode_uimm20(imm);
>  }
>  
> -/* Type-UJ */
> +/* Type-J */
>  
> -static tcg_insn_unit encode_ujimm20(uint32_t imm)
> +static tcg_insn_unit encode_jimm20(uint32_t imm)
>  {
>      tcg_insn_unit ret = 0;
>  
> @@ -517,9 +517,9 @@ static tcg_insn_unit encode_ujimm20(uint32_t imm)
>      return ret;
>  }
>  
> -static tcg_insn_unit encode_uj(RISCVInsn opc, TCGReg rd, uint32_t
> imm)
> +static tcg_insn_unit encode_j(RISCVInsn opc, TCGReg rd, uint32_t
> imm)
>  {
> -    return opc | (rd & 0x1f) << 7 | encode_ujimm20(imm);
> +    return opc | (rd & 0x1f) << 7 | encode_jimm20(imm);
>  }
>  
>  
> @@ -597,7 +597,7 @@ static void tcg_out_opc_upper(TCGContext *s,
> RISCVInsn opc,
>  static void tcg_out_opc_jump(TCGContext *s, RISCVInsn opc,
>                               TCGReg rd, uint32_t imm)
>  {
> -    tcg_out32(s, encode_uj(opc, rd, imm));
> +    tcg_out32(s, encode_j(opc, rd, imm));
>  }
>  
>  static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
> @@ -633,7 +633,7 @@ static bool reloc_jimm20(tcg_insn_unit *src_rw,
> const tcg_insn_unit *target)
>  
>      tcg_debug_assert((offset & 1) == 0);
>      if (offset == sextreg(offset, 0, 20)) {
> -        *src_rw |= encode_ujimm20(offset);
> +        *src_rw |= encode_jimm20(offset);
>          return true;
>      }
>  
> @@ -1958,7 +1958,7 @@ void tb_target_set_jmp_target(const
> TranslationBlock *tb, int n,
>  
>      /* Either directly branch, or fall through to indirect branch.
> */
>      if (offset == sextreg(offset, 0, 20)) {
> -        insn = encode_uj(OPC_JAL, TCG_REG_ZERO, offset);
> +        insn = encode_j(OPC_JAL, TCG_REG_ZERO, offset);
>      } else {
>          insn = OPC_NOP;
>      }

Re: [PATCH v3 05/11] tcg/riscv64: Adjust sign of lui immediate in tcg_out_movi

[Alistair Francis]

On Sun, 2026-09-13 at 14:08 -1000, Richard Henderson wrote:
> No real bug fix here, as we've already shown the full value
> fits in int32_t, but simple subtraction in tcg_target_long
> may produce a positive out-of-range intermediate.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  tcg/riscv64/tcg-target.c.inc | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-
> target.c.inc
> index 99bc658c264..d0c9d8e9cd2 100644
> --- a/tcg/riscv64/tcg-target.c.inc
> +++ b/tcg/riscv64/tcg-target.c.inc
> @@ -792,21 +792,22 @@ static bool tcg_out_mov(TCGContext *s, TCGType
> type, TCGReg ret, TCGReg arg)
>  static void tcg_out_movi(TCGContext *s, TCGType type, TCGReg rd,
>                           tcg_target_long val)
>  {
> -    tcg_target_long lo, hi, tmp;
> +    tcg_target_long tmp;
> +    int32_t lo, hi;
>      int shift, ret;
>  
>      if (type == TCG_TYPE_I32) {
>          val = (int32_t)val;
>      }
>  
> -    lo = sextreg(val, 0, 12);
> +    lo = sextract32(val, 0, 12);
>      if (val == lo) {
>          tcg_out_opc_imm(s, OPC_ADDI, rd, TCG_REG_ZERO, lo);
>          return;
>      }
>  
> -    hi = val - lo;
>      if (val == (int32_t)val) {
> +        hi = val - lo;
>          tcg_out_opc_upper(s, OPC_LUI, rd, hi);
>          if (lo != 0) {
>              tcg_out_opc_imm(s, OPC_ADDIW, rd, rd, lo);

Re: [PATCH v3 06/11] tcg/riscv64: Assert immediate in range for [isu]-type insns

[Alistair Francis]

On Sun, 2026-09-13 at 14:08 -1000, Richard Henderson wrote:
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  tcg/riscv64/tcg-target.c.inc | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-
> target.c.inc
> index d0c9d8e9cd2..a5ed1e95722 100644
> --- a/tcg/riscv64/tcg-target.c.inc
> +++ b/tcg/riscv64/tcg-target.c.inc
> @@ -447,6 +447,7 @@ static tcg_insn_unit encode_r(RISCVInsn opc,
> TCGReg rd, TCGReg rs1, TCGReg rs2)
>  
>  static tcg_insn_unit encode_imm12(tcg_target_long imm)
>  {
> +    tcg_debug_assert(imm == sextract32(imm, 0, 12));
>      return (imm & 0xfff) << 20;
>  }
>  
> @@ -462,6 +463,7 @@ static tcg_insn_unit
> encode_simm12(tcg_target_long imm)
>  {
>      tcg_insn_unit ret = 0;
>  
> +    tcg_debug_assert(imm == sextract32(imm, 0, 12));
>      ret |= (imm & 0xFE0) << 20;
>      ret |= (imm & 0x1F) << 7;
>  
> @@ -498,7 +500,8 @@ static tcg_insn_unit encode_b(RISCVInsn opc,
> TCGReg rs1,
>  
>  static tcg_insn_unit encode_uimm20(tcg_target_long imm)
>  {
> -    return imm & 0xfffff000;
> +    tcg_debug_assert(imm == (int32_t)imm && (imm & 0xfff) == 0);
> +    return imm & 0xfffff000u;
>  }
>  
>  static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd,
> tcg_target_long imm)

Re: [PATCH v3 04/11] tcg/riscv64: Use signed type for encoding immediates

[Alistair Francis]

On Sun, 2026-09-13 at 14:08 -1000, Richard Henderson wrote:
> The immediate operands in the 5 base instruction formats are all
> signed,
> so passing an unsigned type was logically incorrect.  Use
> tcg_target_long
> not int32_t to avoid truncation, which will become relevant later.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  tcg/riscv64/tcg-target.c.inc | 33 ++++++++++++++++++---------------
>  1 file changed, 18 insertions(+), 15 deletions(-)
> 
> diff --git a/tcg/riscv64/tcg-target.c.inc b/tcg/riscv64/tcg-
> target.c.inc
> index f77fded1dfa..99bc658c264 100644
> --- a/tcg/riscv64/tcg-target.c.inc
> +++ b/tcg/riscv64/tcg-target.c.inc
> @@ -445,19 +445,20 @@ static tcg_insn_unit encode_r(RISCVInsn opc,
> TCGReg rd, TCGReg rs1, TCGReg rs2)
>  
>  /* Type-I */
>  
> -static tcg_insn_unit encode_imm12(uint32_t imm)
> +static tcg_insn_unit encode_imm12(tcg_target_long imm)
>  {
>      return (imm & 0xfff) << 20;
>  }
>  
> -static tcg_insn_unit encode_i(RISCVInsn opc, TCGReg rd, TCGReg rs1,
> uint32_t imm)
> +static tcg_insn_unit encode_i(RISCVInsn opc, TCGReg rd,
> +                              TCGReg rs1, tcg_target_long imm)
>  {
>      return opc | (rd & 0x1f) << 7 | (rs1 & 0x1f) << 15 |
> encode_imm12(imm);
>  }
>  
>  /* Type-S */
>  
> -static tcg_insn_unit encode_simm12(uint32_t imm)
> +static tcg_insn_unit encode_simm12(tcg_target_long imm)
>  {
>      tcg_insn_unit ret = 0;
>  
> @@ -467,14 +468,15 @@ static tcg_insn_unit encode_simm12(uint32_t
> imm)
>      return ret;
>  }
>  
> -static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1, TCGReg rs2,
> uint32_t imm)
> +static tcg_insn_unit encode_s(RISCVInsn opc, TCGReg rs1,
> +                              TCGReg rs2, tcg_target_long imm)
>  {
>      return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 |
> encode_simm12(imm);
>  }
>  
>  /* Type-B */
>  
> -static tcg_insn_unit encode_bimm12(uint32_t imm)
> +static tcg_insn_unit encode_bimm12(tcg_target_long imm)
>  {
>      tcg_insn_unit ret = 0;
>  
> @@ -486,26 +488,27 @@ static tcg_insn_unit encode_bimm12(uint32_t
> imm)
>      return ret;
>  }
>  
> -static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1, TCGReg rs2,
> uint32_t imm)
> +static tcg_insn_unit encode_b(RISCVInsn opc, TCGReg rs1,
> +                              TCGReg rs2, tcg_target_long imm)
>  {
>      return opc | (rs1 & 0x1f) << 15 | (rs2 & 0x1f) << 20 |
> encode_bimm12(imm);
>  }
>  
>  /* Type-U */
>  
> -static tcg_insn_unit encode_uimm20(uint32_t imm)
> +static tcg_insn_unit encode_uimm20(tcg_target_long imm)
>  {
>      return imm & 0xfffff000;
>  }
>  
> -static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd, uint32_t
> imm)
> +static tcg_insn_unit encode_u(RISCVInsn opc, TCGReg rd,
> tcg_target_long imm)
>  {
>      return opc | (rd & 0x1f) << 7 | encode_uimm20(imm);
>  }
>  
>  /* Type-J */
>  
> -static tcg_insn_unit encode_jimm20(uint32_t imm)
> +static tcg_insn_unit encode_jimm20(tcg_target_long imm)
>  {
>      tcg_insn_unit ret = 0;
>  
> @@ -517,7 +520,7 @@ static tcg_insn_unit encode_jimm20(uint32_t imm)
>      return ret;
>  }
>  
> -static tcg_insn_unit encode_j(RISCVInsn opc, TCGReg rd, uint32_t
> imm)
> +static tcg_insn_unit encode_j(RISCVInsn opc, TCGReg rd,
> tcg_target_long imm)
>  {
>      return opc | (rd & 0x1f) << 7 | encode_jimm20(imm);
>  }
> @@ -571,31 +574,31 @@ static void tcg_out_opc_reg(TCGContext *s,
> RISCVInsn opc,
>  }
>  
>  static void tcg_out_opc_imm(TCGContext *s, RISCVInsn opc,
> -                            TCGReg rd, TCGReg rs1, TCGArg imm)
> +                            TCGReg rd, TCGReg rs1, tcg_target_long
> imm)
>  {
>      tcg_out32(s, encode_i(opc, rd, rs1, imm));
>  }
>  
>  static void tcg_out_opc_store(TCGContext *s, RISCVInsn opc,
> -                              TCGReg rs1, TCGReg rs2, uint32_t imm)
> +                              TCGReg rs1, TCGReg rs2,
> tcg_target_long imm)
>  {
>      tcg_out32(s, encode_s(opc, rs1, rs2, imm));
>  }
>  
>  static void tcg_out_opc_branch(TCGContext *s, RISCVInsn opc,
> -                               TCGReg rs1, TCGReg rs2, uint32_t imm)
> +                               TCGReg rs1, TCGReg rs2,
> tcg_target_long imm)
>  {
>      tcg_out32(s, encode_b(opc, rs1, rs2, imm));
>  }
>  
>  static void tcg_out_opc_upper(TCGContext *s, RISCVInsn opc,
> -                              TCGReg rd, uint32_t imm)
> +                              TCGReg rd, tcg_target_long imm)
>  {
>      tcg_out32(s, encode_u(opc, rd, imm));
>  }
>  
>  static void tcg_out_opc_jump(TCGContext *s, RISCVInsn opc,
> -                             TCGReg rd, uint32_t imm)
> +                             TCGReg rd, tcg_target_long imm)
>  {
>      tcg_out32(s, encode_j(opc, rd, imm));
>  }

Re: [PATCH v3 01/11] tcg/riscv64: Return tcg_insn_unit from insn encoders

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> Returning int32_t was logically incorrect.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 47 ++++++++++++++++++------------------
>  1 file changed, 23 insertions(+), 24 deletions(-)

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 02/11] tcg/riscv64: Rename sb-type to b-type format

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> The current riscv documentation calls this b-type.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 20 ++++++++++----------
>  1 file changed, 10 insertions(+), 10 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 03/11] tcg/riscv64: Rename uj-type to j-type format

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> The current riscv documentation calls this j-type.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 04/11] tcg/riscv64: Use signed type for encoding immediates

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> The immediate operands in the 5 base instruction formats are all signed,
> so passing an unsigned type was logically incorrect.  Use tcg_target_long
> not int32_t to avoid truncation, which will become relevant later.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 33 ++++++++++++++++++---------------
>  1 file changed, 18 insertions(+), 15 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 05/11] tcg/riscv64: Adjust sign of lui immediate in tcg_out_movi

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> No real bug fix here, as we've already shown the full value
> fits in int32_t, but simple subtraction in tcg_target_long
> may produce a positive out-of-range intermediate.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 06/11] tcg/riscv64: Assert immediate in range for [isu]-type insns

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 07/11] tcg/riscv64: Return success from encode_jimm

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> Centralize the range test for this encoding.
> Directly OR into the insn value.
> Assert success in encode_j.
> Use encode_jimm in tcg_out_call_int.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 46 ++++++++++++++++--------------------
>  1 file changed, 21 insertions(+), 25 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 08/11] tcg/riscv64: Return success from encode_bimm

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> Centralize the range test for this encoding.
> Directly OR into the insn value.
> Assert success in encode_b.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 30 ++++++++++++++----------------
>  1 file changed, 14 insertions(+), 16 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 09/11] tcg/riscv64: Fix off-by-one in branch range tests

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> We tested the size of the field encoding, not the
> actual range of values.
> 
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 10/11] tcg/riscv64: Validate AUIPC relocation range

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> From: Max Chou <max.chou@sifive.com>
> 
> reloc_call splits a PC-relative offset into a signed 12-bit low
> immediate and an AUIPC contribution. When the low immediate carries
> into bit 31, the existing 32-bit arithmetic can accept an unencodable
> positive 0x80000000 AUIPC contribution.
> 
> Keep the split in pointer-width arithmetic and reject it unless the
> rounded upper contribution is representable as signed 32-bit. Factor
> this validation into split_auipc_offset so reloc_call retains its
> existing failure contract.
> 
> Fixes: dfa8e74f9463 ("tcg/riscv: Add the relocation functions")
> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
> Signed-off-by: Max Chou <max.chou@sifive.com>
> [rth: Pass target as intptr_t to split_auipc_offset.]
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 24 +++++++++++++++++++-----
>  1 file changed, 19 insertions(+), 5 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 11/11] tcg/riscv64: Fall back when AUIPC pairs are out of range

[Max Chou]

On 2026-09-13 14:08, Richard Henderson wrote:
> From: Max Chou <max.chou@sifive.com>
> 
> tcg_out_movi, tcg_out_call_int, and tcg_out_ldst only check whether a
> PC-relative displacement is signed 32-bit before emitting an AUIPC pair.
> This does not account for rounding the signed 12-bit immediate, which
> can require an unencodable positive 0x80000000 AUIPC contribution.
> 
> Validate the split and emit the pair only when it fits.
> 
> Fixes: dfa8e74f9463 ("tcg/riscv: Add the relocation functions")
> Signed-off-by: Max Chou <max.chou@sifive.com>
> [rth: Drop 'ret' local variables; update tcg_out_ldst too.]
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  tcg/riscv64/tcg-target.c.inc | 54 +++++++++++++++++-------------------
>  1 file changed, 25 insertions(+), 29 deletions(-)
> 

Reviewed-by: Max Chou <max.chou@sifive.com>

Thanks,
rnax

Re: [PATCH v3 00/11] tcg/riscv64: Fix AUIPC pair range validation

[Max Chou]

On 2026-09-27 10:30, Richard Henderson wrote:
> Ping.
> 
> On 9/13/26 17:08, Richard Henderson wrote:
> > Hi Max,
> > 
> > In v2, the change from int32_t to uint32_t is pretty much
> > the opposite of what should have been done, since all of
> > these are logically signed values.  I've adjusted all of
> > the encoders to take signed inputs and assert in range.
> > 
> > In the process, I noticed tha the branch range tests were
> > off by one.  Now all performed in exactly one place.
> > 
> > Finally, tcg_out_ldst needed updates for AUIPC as well.
> > 
> > I've tested this lightly so far; full testing on a rather
> > slow riscv machine is still on-going.
> > 
> > 
> > r~
> > 

Hi Richard,

I’ve discovered a verification scenario that could trigger an unexpected
segfault due to the AUIPC issue.

The scenario involves running a debug cross-build (riscv64) of
qemu-system-riscv64 with a plugin that instruments callback (e.g.,
libhotblocks.so) in a host riscv machine. (I used qemu-system-riscv64
with the same images here :p)

Before applying this patchset, the internal qemu-system-riscv64
encountered an unexpected segfault during bootup.

(P.S.: I built the riscv64 system mode image using buildroot
qemu_riscv64_virt_defconfig.)

Thanks,
rnax